diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4eb5908..2293aba 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -32,14 +32,24 @@ jobs: include: - target: linux-amd64 os: ubuntu-24.04 + openssl_target: linux-x86_64 + cross_prefix: '' - target: linux-arm64 os: ubuntu-24.04 + openssl_target: linux-aarch64 + cross_prefix: aarch64-linux-gnu- - target: linux-ppc32be os: ubuntu-24.04 + openssl_target: linux-ppc + cross_prefix: powerpc-linux-gnu- - target: macos-amd64 os: macos-14 + openssl_target: darwin64-x86_64-cc + cross_prefix: '' - target: macos-arm64 os: macos-14 + openssl_target: darwin64-arm64-cc + cross_prefix: '' runs-on: ${{ matrix.os }} steps: - name: Check out source @@ -57,8 +67,49 @@ jobs: sudo apt-get update sudo apt-get install --yes gcc-powerpc-linux-gnu - - name: Build - run: make ${{ matrix.target }} + - name: Build static OpenSSL + env: + OPENSSL_VERSION: 3.5.7 + OPENSSL_TARGET: ${{ matrix.openssl_target }} + CROSS_PREFIX: ${{ matrix.cross_prefix }} + run: | + curl --fail --location --retry 3 \ + "https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz" \ + --output openssl.tar.gz + tar -xzf openssl.tar.gz + cd "openssl-${OPENSSL_VERSION}" + CROSS_COMPILE="$CROSS_PREFIX" ./Configure "$OPENSSL_TARGET" \ + no-shared no-tests no-module no-dso \ + --prefix="$GITHUB_WORKSPACE/openssl-static" \ + --openssldir=/etc/ssl + make -j3 build_sw + make install_sw + + - name: Build static Linux executable + if: startsWith(matrix.target, 'linux-') + run: | + OPENSSL_LIBDIR="$(find "$GITHUB_WORKSPACE/openssl-static" -type f -name libssl.a -exec dirname {} \;)" + make "${{ matrix.target }}" \ + TLS_CFLAGS="-I$GITHUB_WORKSPACE/openssl-static/include" \ + TLS_LDLIBS="$OPENSSL_LIBDIR/libssl.a $OPENSSL_LIBDIR/libcrypto.a -ldl" \ + LDFLAGS=-static + file "dist/fossmark-${{ matrix.target }}" + if ldd "dist/fossmark-${{ matrix.target }}" 2>&1 | grep -q '=>'; then + echo 'Linux release binary is dynamically linked' >&2 + exit 1 + fi + + - name: Build macOS executable with static OpenSSL + if: startsWith(matrix.target, 'macos-') + run: | + OPENSSL_LIBDIR="$(find "$GITHUB_WORKSPACE/openssl-static" -type f -name libssl.a -exec dirname {} \;)" + make "${{ matrix.target }}" \ + TLS_CFLAGS="-I$GITHUB_WORKSPACE/openssl-static/include" \ + TLS_LDLIBS="$OPENSSL_LIBDIR/libssl.a $OPENSSL_LIBDIR/libcrypto.a" + if otool -L "dist/fossmark-${{ matrix.target }}" | grep -E 'lib(ssl|crypto)'; then + echo 'macOS release uses dynamic OpenSSL' >&2 + exit 1 + fi - name: Package artifact run: tar -czf fossmark-${{ matrix.target }}.tar.gz -C dist fossmark-${{ matrix.target }} diff --git a/Makefile b/Makefile index daa084d..91eb39d 100644 --- a/Makefile +++ b/Makefile @@ -35,7 +35,9 @@ CC ?= cc CFLAGS ?= -O2 -Wall -Wextra -LDLIBS ?= -lm +TLS_CFLAGS ?= +TLS_LDLIBS ?= -lssl -lcrypto +LDLIBS ?= -lm $(TLS_LDLIBS) # The driver spreads each workload across all cores with pthreads. PTHREAD := -pthread @@ -115,23 +117,23 @@ macos-arm64: $(DIST)/fossmark-macos-arm64 macos-amd64: $(DIST)/fossmark-macos-amd64 $(DIST)/fossmark-linux-arm64: $(DRIVER) $(ASM_ARM64) | $(DIST) - $(CC_ARM64) $(CFLAGS) $(PTHREAD) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS) + $(CC_ARM64) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS) @echo "built $@" $(DIST)/fossmark-linux-amd64: $(DRIVER) $(ASM_AMD64) | $(DIST) - $(CC_AMD64) $(CFLAGS) $(PTHREAD) -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS) + $(CC_AMD64) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS) @echo "built $@" $(DIST)/fossmark-linux-ppc32be: $(DRIVER) $(SRC_PPC32) $(ASM_PPC32) | $(DIST) - $(CC_PPC32BE) $(CFLAGS) $(PTHREAD) -o $@ $(DRIVER) $(SRC_PPC32) $(ASM_PPC32) $(LDLIBS) + $(CC_PPC32BE) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(SRC_PPC32) $(ASM_PPC32) $(LDLIBS) @echo "built $@" $(DIST)/fossmark-macos-arm64: $(DRIVER) $(ASM_ARM64) | $(DIST) - $(CC_MACOS_ARM64) -arch arm64 $(CFLAGS) $(PTHREAD) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS) + $(CC_MACOS_ARM64) -arch arm64 $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS) @echo "built $@" $(DIST)/fossmark-macos-amd64: $(DRIVER) $(ASM_AMD64) | $(DIST) - $(CC_MACOS_AMD64) -arch x86_64 $(CFLAGS) $(PTHREAD) -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS) + $(CC_MACOS_AMD64) -arch x86_64 $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS) @echo "built $@" # When the host is Linux/ARM64 or Linux/AMD64, the native binary IS one of the @@ -154,7 +156,7 @@ NATIVE_HAS_RULE := yes endif ifneq ($(NATIVE_HAS_RULE),yes) $(NATIVE_BIN): $(DRIVER) $(HOST_KERNEL) | $(DIST) - $(CC) $(CFLAGS) $(PTHREAD) -o $@ $(DRIVER) $(HOST_KERNEL) $(LDLIBS) + $(CC) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(HOST_KERNEL) $(LDLIBS) @echo "built $@" endif @@ -167,7 +169,7 @@ bench: $(NATIVE_BIN) # Build and run the kernel correctness tests for the host arch. test: | $(DIST) - $(CC) $(CFLAGS) $(PTHREAD) -o $(DIST)/test_kernels src/test_kernels.c $(HOST_KERNEL) $(LDLIBS) + $(CC) $(CFLAGS) $(PTHREAD) -o $(DIST)/test_kernels src/test_kernels.c $(HOST_KERNEL) -lm ./$(DIST)/test_kernels clean: diff --git a/README.md b/README.md index 06a3d55..888b1f3 100644 --- a/README.md +++ b/README.md @@ -34,7 +34,8 @@ distorting the result. ## Build and run -You need a C compiler, GNU Make, pthreads, and the system math library. +You need a C compiler, GNU Make, OpenSSL development headers and libraries, +pthreads, and the system math library. ```sh make @@ -55,7 +56,7 @@ make macos-amd64 make all ``` -`make all` builds both Linux targets. Cross-compilation requires a suitable +`make all` builds all three Linux targets. Cross-compilation requires a suitable toolchain. Override the target compiler when its name differs from the default: ```sh @@ -87,15 +88,18 @@ FOSSMARK_API_TOKEN=your_token ./dist/fossmark-linux-amd64 ``` The API base URL is defined by `FM_API_BASE_URL` in `src/main.c` and defaults to -`http://localhost:8080`. A release build can override it without editing the +`https://fossbench.net`. A release build can override it without editing the source: ```sh -make CFLAGS='-O2 -Wall -Wextra -DFM_API_BASE_URL=\"http://bench.example.com\"' +make CFLAGS='-O2 -Wall -Wextra -DFM_API_BASE_URL=\"https://bench.example.com\"' ``` -The built-in uploader currently supports plain HTTP. An HTTPS production URL -will require TLS support (or submission through a TLS-terminating local proxy). +HTTPS uploads use OpenSSL with certificate and hostname verification. + +Release binaries statically include OpenSSL. Linux releases are fully static; +macOS releases retain only Apple's required system-library linkage because the +macOS toolchain does not support fully static executables. ## Continuous integration and releases diff --git a/dist/fossmark-linux-amd64 b/dist/fossmark-linux-amd64 index 413de55..0ccdd04 100755 Binary files a/dist/fossmark-linux-amd64 and b/dist/fossmark-linux-amd64 differ diff --git a/src/main.c b/src/main.c index 1266118..c6c68bb 100644 --- a/src/main.c +++ b/src/main.c @@ -29,15 +29,17 @@ # include # include # include +# include +# include #endif #if defined(__APPLE__) # include # include #endif -/* Change this at build time with -DFM_API_BASE_URL=\"http://host:port\". */ +/* Change this at build time with -DFM_API_BASE_URL=\"https://host\". */ #ifndef FM_API_BASE_URL -# define FM_API_BASE_URL "http://localhost:8080" +# define FM_API_BASE_URL "https://fossbench.net" #endif #define FM_VERSION "0.1.2" @@ -758,17 +760,23 @@ static void json_escape(const char *src, char *dst, size_t cap) static int upload_results(const struct system_info *info, double score, uint64_t duration_ms, const char *token) { - char host[256], port[16] = "80", path[512], payload[2048], request[4096]; + char host[256], port[16], path[512], payload[2048], request[4096]; char cpu[512], os[512], compiler[256], response[512]; const char *base = FM_API_BASE_URL, *p, *slash, *colon; struct addrinfo hints, *addresses = NULL, *a; - int fd = -1, status = 0, payload_len, request_len; + SSL_CTX *tls_ctx = NULL; + SSL *tls = NULL; + int use_tls, fd = -1, status = 0, payload_len, request_len; - if (strncmp(base, "http://", 7) != 0) { - fprintf(stderr, " upload error: FM_API_BASE_URL must use http://\n"); + if (!strncmp(base, "https://", 8)) { + use_tls = 1; p = base + 8; strcpy(port, "443"); + } else if (!strncmp(base, "http://", 7)) { + use_tls = 0; p = base + 7; strcpy(port, "80"); + } else { + fprintf(stderr, " upload error: unsupported URL scheme\n"); return 0; } - p = base + 7; slash = strchr(p, '/'); + slash = strchr(p, '/'); if (!slash) slash = p + strlen(p); colon = memchr(p, ':', (size_t)(slash - p)); if (colon) { @@ -811,23 +819,49 @@ static int upload_results(const struct system_info *info, double score, } freeaddrinfo(addresses); if (fd < 0) { fprintf(stderr, " upload error: cannot connect to %s:%s\n", host, port); return 0; } + if (use_tls) { + tls_ctx = SSL_CTX_new(TLS_client_method()); + if (!tls_ctx || !SSL_CTX_set_default_verify_paths(tls_ctx)) { + fprintf(stderr, " upload error: cannot initialize TLS trust store\n"); + goto upload_failed; + } + SSL_CTX_set_verify(tls_ctx, SSL_VERIFY_PEER, NULL); + tls = SSL_new(tls_ctx); + if (!tls || !SSL_set_tlsext_host_name(tls, host) || + !SSL_set1_host(tls, host) || !SSL_set_fd(tls, fd) || + SSL_connect(tls) != 1) { + fprintf(stderr, " upload error: TLS connection or certificate verification failed\n"); + goto upload_failed; + } + } { size_t sent = 0; while (sent < (size_t)request_len) { - ssize_t n = send(fd, request + sent, (size_t)request_len - sent, 0); - if (n <= 0) { close(fd); fprintf(stderr, " upload error: send failed\n"); return 0; } + int n = use_tls ? SSL_write(tls, request + sent, (int)((size_t)request_len - sent)) : + (int)send(fd, request + sent, (size_t)request_len - sent, 0); + if (n <= 0) { fprintf(stderr, " upload error: send failed\n"); goto upload_failed; } sent += (size_t)n; } } { - ssize_t n = recv(fd, response, sizeof(response) - 1, 0); close(fd); - if (n <= 0) { fprintf(stderr, " upload error: no server response\n"); return 0; } + int n = use_tls ? SSL_read(tls, response, sizeof(response) - 1) : + (int)recv(fd, response, sizeof(response) - 1, 0); + if (n <= 0) { fprintf(stderr, " upload error: no server response\n"); goto upload_failed; } response[n] = '\0'; if (sscanf(response, "HTTP/%*s %d", &status) != 1) status = 0; } + if (tls) { SSL_shutdown(tls); SSL_free(tls); } + if (tls_ctx) SSL_CTX_free(tls_ctx); + close(fd); if (status < 200 || status >= 300) { fprintf(stderr, " upload failed: server returned HTTP %d\n", status); return 0; } printf(" Results uploaded successfully (HTTP %d).\n", status); return 1; + +upload_failed: + if (tls) SSL_free(tls); + if (tls_ctx) SSL_CTX_free(tls_ctx); + if (fd >= 0) close(fd); + return 0; } #endif