[Windows] Build curl for Windows without openssl.

[AenBleidd]

Build it with schannel instead that allows curl to use Windows certificate store and doesn't relay on ca-bundle.crt anymore.

This fixes #4542

Signed-off-by: Vitalii Koshura [email protected]

[AenBleidd]

@RichardHaselgrove, could you please test this PR?

[RichardHaselgrove]

@AenBleidd - I'll get onto it within the hour. I want to re-run the VS2019 build first, so I can get you the error messages you asked for. I'll be on more familiar territory to do a PR test under VS2013 - would that be acceptable?

[AenBleidd]

@RichardHaselgrove,

I'll be on more familiar territory to do a PR test under VS2013 - would that be acceptable?

No, this is for VS2019 only.
On the next major release for Windows we should get rid of VS2010 and VS2013 solutions and support only one, the latest

[AenBleidd]

Btw, you can just use build artifacts from GitHub actions to test this

[AenBleidd]

I want to re-run the VS2019 build first, so I can get you the error messages you asked for.

That would be nice, because as you can see from our CI, it's build with VS2019 without any issues

[RichardHaselgrove]

Test machine is booted back into Win 10. I'll post results from the build back in my issue from last night, then try the artifacts from here.

[RichardHaselgrove]

Provisional report only. I've reverted to a standard v7.16.11 installation, and verified that it failed to connect with two of the projects that are affected by the current outage - GPUGrid and CPDN.

I then replaced boinc.exe and boincmgr.exe with the artifacts from here: noting that ca-bundle.crt is still deployed by the test build. But I deleted it from the working folder to test - I also deleted the curl and OpenSSL DLLs from the standard installation.

Client attached successfully to GPUGrid.
It failed to attach to CPDN - logged Fetching configuration file from https://climateprediction.net/get_project_config.phpand nothing else, and reported "The project is currently unavailable". However, I can reach it fine from another machine, so it may be a project problem - they're being badly let down by their hosting University, with multiple network problems.

I'll check it again on Windows 7 - I haven't got any older versions in use at the moment, though I know some volunteers do.

[CharlieFenton]

@AenBleidd I think you also need to modify client/http_curl.cpp lines 489 - 539 for this to work.

[RichardHaselgrove]

Tried it under Windows 7 - same procedure as last time. Got this in the log, which seems about right.

06/10/2021 11:02:46 |  | Version change (7.16.20 -> 7.19.0)
06/10/2021 11:02:46 | climateprediction.net | URL https://climateprediction.net/; Computer ID 1460497; resource share 100
06/10/2021 11:02:46 | climateprediction.net | Fetching scheduler list
06/10/2021 11:02:47 | climateprediction.net | Master file download succeeded

I'll check up on the 'get_project_cfg' failure direct with the project.

I've allowed production work to resume, and scheduler contacts and downloads seem to be proceeding normally.

[AenBleidd]

@CharlieFenton,probably you're right. Fixed.
Not it will not use ca-bundle.crt even if it's present in the installation folder

[CharlieFenton]

I don't have a working MS Windows computer so I can't do any testing, but this looks OK as far as I can tell. I am not very knowledgeable about ssl and encryption, so I don't know whether any code in lib/crypt.cpp depends on the certificate.

[AenBleidd]

Works well on Win7 SP1 and higher (have no Vista to check on it also)

[CharlieFenton]

@AenBleidd Please excuse my ignorance about vcpkg, but in the changed files I do not see anything that builds curl without OpenSSL. according to the help in curl's configure file, this involves building curl with the option
--without-ssl disable OpenSSL.

My understanding from this document is that to use Windows built-in certificate you should build cur with either
--with-winssl enable Windows native SSL/TLS
or
--with-schannel enable Windows native SSL/TLS

I see nothing in this PR that does any of these things.

To answer your question from PR #4544, the above referenced document says that curl can be told to use MacOS system certificate store by Secure Transport Support by building with this option:
--with-secure-transport enable Apple OS native SSL/TLS
but according to Apple's documentation Secure Transport is considered legacy (deprecated.)

[CharlieFenton]

@AenBleidd Please ignore my previous question. I see there is a reference to channel in your changed vcpkg call.

[CharlieFenton]

@AenBleidd Please see my suggestions here for an alternate approach.

[AenBleidd]

It works on Windows Vista SP2 also.

[AenBleidd]

@CharlieFenton, according to this: https://curl.se/libcurl/c/CURLOPT_CAINFO.html

(Schannel) This option is supported for Schannel in Windows 7 or later but we recommend not using it until Windows 8 since it works better starting then. If the option is not set, then curl will use the certificates in the Windows' store of root certificates (the default for Schannel).

So probably we can put back the code that checks for ca-bundle.crt file and instead put some option to use ca-bundle.crt instead of Windows certificate store in case of some errors. What do you think?

[CharlieFenton]

So probably we can put back the code that checks for ca-bundle.crt file and instead put some option to use ca-bundle.crt instead of Windows certificate store in case of some errors. What do you think?

Would this not always use the ca-bundle.crt file instead of the Windows certificate store, unless this code is executed only after an error? In any case, I think the alternate approach we have been discussing in PR #4544 might be a better long-term solution than the one in this PR for the reasons I gave here.

[CharlieFenton]

I think the alternate approach we have been discussing in PR #4544 might be a better long-term solution

Specifically, I mean the idea of adding code to the BOINC client so it automatically downloads a new ca-bundle.crt when the old one is close to expiration.

[RichardHaselgrove]

Do we have anyone in the development community who can remember the original rationale for deciding on the current Windows procedure in the first place? As I remember it, it was Rom Walton who did much of the Windows work.

[AenBleidd]

I checked this solution on Windows Vista. And it still works. That means that Vista that was not updated since 2017 still works fine with BOINC. I doubt anyone still uses it but anyway. Later we can add a code to update directly Windows certificate store with necessary certificates if necessary

[AenBleidd]

Do we have anyone in the development community who can remember the original rationale for deciding on the current Windows procedure in the first place? As I remember it, it was Rom Walton who did much of the Windows work.

I believe it's because before Windows Vista there was no Windows certificate store support.
And since we're not support Windows XP anymore, we can consider better decisions than the old one.

[RichardHaselgrove]

Makes sense. Anyone still running Windows XP (and I believe there are a few) will know that they're on their own when problems like this strike. They still have the opportunity to replace their certificate bundle manually.

[Ageless93]

Do we have anyone in the development community who can remember the original rationale for deciding on the current Windows procedure in the first place? As I remember it, it was Rom Walton who did much of the Windows work.

If the question is why ca-bundle.crt is put in the BOINC Programs directory and not the data directory, then looking at https://boinc.berkeley.edu/trac/wiki/ClientSetupLogicWinFileLayout this was the setup for the client version 5, which solely ran from the C:\Program Files\BOINC directory. Those were Windows 95, 98, ME and XP days, maybe even 2000.

When the client setup was changed to present logic (https://boinc.berkeley.edu/trac/wiki/ClientSetupLogicWinSix, https://boinc.berkeley.edu/trac/wiki/ClientSetupWinSix) the setup of the BOINC Programs directory was left unchanged.

[Ageless93]

By the way, I also found https://boinc.berkeley.edu/trac/wiki/AdminReleaseManagement which stipulates:

Check for a new CA bundle from ​https://curl.haxx.se/docs/caextract.html; copy to curl/ca-bundle.crt

Which apparently isn't followed these days, maybe we should bring it back.

[AenBleidd]

Which apparently isn't followed these days, maybe we should bring it back.

That's exactly what I did in my last PR. I plan to automate this process somehow to always have on master the latest ca-bundle.crt file

[RichardHaselgrove]

Check for a new CA bundle ...

And that was added in Version 18 by David Anderson - on May 30, 2020. I wonder why that date seems familiar in this context?

[Ageless93]

Because a day later he released 7.17.7? ( https://boinc.berkeley.edu/dl/?C=M;O=D)

[RichardHaselgrove]

Precisely.

[CharlieFenton]

By the way, I also found https://boinc.berkeley.edu/trac/wiki/AdminReleaseManagement which stipulates:

Check for a new CA bundle from ​https://curl.haxx.se/docs/caextract.html; copy to curl/ca-bundle.crt

That link shows some potentially useful ways of automatically updating ca-bundle.crt.
curl --remote-name --time-cond cacert.pem https://curl.se/ca/cacert.pem downloads a file cacert.pem which upon a quick inspection appears identical in format and content to ca-bundle.crt. Also potentially useful is the mk-ca-bundle utility described here as:

mk-ca-bundle - convert mozilla's certdata.txt to PEM format

and

mk-ca-bundle is a command line tool that is shipped as part of every curl and libcurl release

However, we may not want to have every BOINC client download the certificates from curl.se because the web page implies their servers could get overloaded:

We don't mind you downloading the PEM file from us in an automated fashion, but please don't do it more often than once per day. It is only updated once every few months anyway.

I strongly feel this PR should be put on hold in favor of having the BOINC client automatically update ca-bundle.crt (and of course, use a current version of OpenSSL.)

[AenBleidd]

@davidpanderson, what do you think? Should we go with this solution (use Windows certificate store) or should I implement automatic ca-bundle.crt update?

[davidpanderson]

Let's use the Windows certificate store.

[RichardHaselgrove]

OK, let's get this show on the road. I approve.