diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ba11d13..1aa5327 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -32,37 +32,20 @@ jobs: include: - target: linux-amd64 os: ubuntu-24.04 - openssl_target: linux-x86_64 - cross_prefix: '' - target: linux-i386 os: ubuntu-24.04 - openssl_target: linux-x86 - cross_prefix: '' - target: linux-arm64 os: ubuntu-24.04-arm - openssl_target: linux-aarch64 - cross_prefix: '' - openssl_options: no-asm - target: linux-ppc32be os: ubuntu-24.04 - openssl_target: linux-ppc - cross_prefix: powerpc-linux-gnu- - target: macos-amd64 os: macos-14 - openssl_target: darwin64-x86_64-cc - cross_prefix: '' - target: macos-arm64 os: macos-14 - openssl_target: darwin64-arm64-cc - cross_prefix: '' - target: windows-amd64 os: ubuntu-24.04 - openssl_target: '' - cross_prefix: '' - target: windows-i386 os: ubuntu-24.04 - openssl_target: '' - cross_prefix: '' runs-on: ${{ matrix.os }} steps: - name: Check out source @@ -92,62 +75,26 @@ jobs: sudo apt-get update sudo apt-get install --yes gcc-mingw-w64-i686 - - name: Build static OpenSSL - if: matrix.openssl_target != '' - env: - OPENSSL_VERSION: 3.5.7 - OPENSSL_TARGET: ${{ matrix.openssl_target }} - CROSS_PREFIX: ${{ matrix.cross_prefix }} - OPENSSL_OPTIONS: ${{ matrix.openssl_options }} - MACOSX_DEPLOYMENT_TARGET: ${{ matrix.target == 'macos-amd64' && '10.5' || '' }} - run: | - curl --fail --location --retry 3 \ - "https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz" \ - --output openssl.tar.gz - tar -xzf openssl.tar.gz - cd "openssl-${OPENSSL_VERSION}" - CROSS_COMPILE="$CROSS_PREFIX" ./Configure "$OPENSSL_TARGET" \ - no-shared no-tests no-module no-dso $OPENSSL_OPTIONS \ - --prefix="$GITHUB_WORKSPACE/openssl-static" \ - --openssldir=/etc/ssl - make -j3 build_sw - make install_sw - - - name: Build Linux executable with static OpenSSL + - name: Build Linux executable if: startsWith(matrix.target, 'linux-') run: | - OPENSSL_LIBDIR="$(find "$GITHUB_WORKSPACE/openssl-static" -type f -name libssl.a -exec dirname {} \;)" - EXTRA_STATIC_LIBS='-ldl' - if [ "${{ matrix.target }}" = linux-ppc32be ]; then - EXTRA_STATIC_LIBS="$EXTRA_STATIC_LIBS -latomic" - fi - make "${{ matrix.target }}" \ - TLS_CFLAGS="-I$GITHUB_WORKSPACE/openssl-static/include" \ - TLS_LDLIBS="$OPENSSL_LIBDIR/libssl.a $OPENSSL_LIBDIR/libcrypto.a $EXTRA_STATIC_LIBS" + make "${{ matrix.target }}" file "dist/fossbench-${{ matrix.target }}" if ! file "dist/fossbench-${{ matrix.target }}" | grep -q 'dynamically linked'; then echo 'Linux release uses static glibc, which is unsafe with NSS-based DNS' >&2 exit 1 fi - if readelf -d "dist/fossbench-${{ matrix.target }}" | grep -E 'NEEDED.*lib(ssl|crypto)'; then - echo 'Linux release uses dynamic OpenSSL' >&2 - exit 1 - fi if [ "${{ matrix.target }}" != linux-ppc32be ]; then "dist/fossbench-${{ matrix.target }}" --help fi - - name: Build macOS executable with static OpenSSL + - name: Build macOS executable if: startsWith(matrix.target, 'macos-') env: MACOSX_DEPLOYMENT_TARGET: ${{ matrix.target == 'macos-amd64' && '10.5' || '' }} run: | - OPENSSL_LIBDIR="$(find "$GITHUB_WORKSPACE/openssl-static" -type f -name libssl.a -exec dirname {} \;)" build_log="$(mktemp)" - if ! make "${{ matrix.target }}" \ - TLS_CFLAGS="-I$GITHUB_WORKSPACE/openssl-static/include" \ - TLS_LDLIBS="$OPENSSL_LIBDIR/libssl.a $OPENSSL_LIBDIR/libcrypto.a" \ - >"$build_log" 2>&1; then + if ! make "${{ matrix.target }}" >"$build_log" 2>&1; then cat "$build_log" { echo '## macOS build failure' @@ -158,10 +105,6 @@ jobs: exit 1 fi cat "$build_log" - if otool -L "dist/fossbench-${{ matrix.target }}" | grep -E 'lib(ssl|crypto)'; then - echo 'macOS release uses dynamic OpenSSL' >&2 - exit 1 - fi - name: Build Windows executable if: startsWith(matrix.target, 'windows-') @@ -218,5 +161,5 @@ jobs: release/SHA256SUMS \ --repo "$GITHUB_REPOSITORY" \ --title "Release $RELEASE_TAG" \ - --notes "⚠️ **i386 (Pentium 4) support is new in this release and still being validated on real hardware.** i386 benchmark scores should not be considered accurate yet." \ + --notes "Fixed x86/Linux builds on systems without OpenSSL development headers. Result uploads now use plain HTTP on every platform, removing the OpenSSL build and runtime dependency." \ --generate-notes diff --git a/Makefile b/Makefile index 8f8cb61..b19210c 100644 --- a/Makefile +++ b/Makefile @@ -3,9 +3,7 @@ CC ?= cc CFLAGS ?= -O2 -Wall -Wextra -TLS_CFLAGS ?= -TLS_LDLIBS ?= -lssl -lcrypto -LDLIBS ?= -lm $(TLS_LDLIBS) +LDLIBS ?= -lm # Needed for the worker threads. PTHREAD := -pthread @@ -119,31 +117,31 @@ windows-amd64: $(DIST)/fossbench-windows-amd64.exe windows-i386: $(DIST)/fossbench-windows-i386.exe $(DIST)/fossbench-linux-arm64: $(DRIVER) $(DRIVER_DEPS) $(ASM_ARM64) | $(DIST) - $(CC_ARM64) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS) + $(CC_ARM64) $(CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS) @echo "built $@" $(DIST)/fossbench-linux-amd64: $(DRIVER) $(DRIVER_DEPS) $(ASM_AMD64) | $(DIST) - $(CC_AMD64) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS) + $(CC_AMD64) $(CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS) @echo "built $@" $(DIST)/fossbench-linux-i386: $(DRIVER) $(DRIVER_DEPS) $(ASM_I386) | $(DIST) - $(CC_I386) -m32 -march=pentium4 -fno-pie -no-pie $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_I386) $(LDLIBS) + $(CC_I386) -m32 -march=pentium4 -fno-pie -no-pie $(CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_I386) $(LDLIBS) @echo "built $@" $(DIST)/fossbench-linux-ppc32be: $(DRIVER) $(DRIVER_DEPS) $(ASM_PPC32) | $(DIST) - $(CC_PPC32BE) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_PPC32) $(LDLIBS) + $(CC_PPC32BE) $(CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_PPC32) $(LDLIBS) @echo "built $@" $(DIST)/fossbench-linux-ppc64be: $(DRIVER) $(DRIVER_DEPS) $(ASM_PPC64) | $(DIST) - $(CC_PPC64BE) -mcpu=970 -maltivec $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_PPC64) $(LDLIBS) + $(CC_PPC64BE) -mcpu=970 -maltivec $(CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_PPC64) $(LDLIBS) @echo "built $@" $(DIST)/fossbench-macos-arm64: $(DRIVER) $(DRIVER_DEPS) $(ASM_ARM64) | $(DIST) - $(CC_MACOS_ARM64) -arch arm64 $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS) + $(CC_MACOS_ARM64) -arch arm64 $(CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(ASM_ARM64) $(LDLIBS) @echo "built $@" $(DIST)/fossbench-macos-amd64: $(DRIVER) $(DRIVER_DEPS) $(ASM_AMD64) | $(DIST) - MACOSX_DEPLOYMENT_TARGET=$(MACOS_AMD64_MIN) $(CC_MACOS_AMD64) -arch x86_64 -mmacosx-version-min=$(MACOS_AMD64_MIN) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -Wl,-no_fixup_chains -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS) + MACOSX_DEPLOYMENT_TARGET=$(MACOS_AMD64_MIN) $(CC_MACOS_AMD64) -arch x86_64 -mmacosx-version-min=$(MACOS_AMD64_MIN) $(CFLAGS) $(PTHREAD) $(LDFLAGS) -Wl,-no_fixup_chains -o $@ $(DRIVER) $(ASM_AMD64) $(LDLIBS) @echo "built $@" # Windows builds are static and use WinHTTP. @@ -179,7 +177,7 @@ NATIVE_HAS_RULE := yes endif ifneq ($(NATIVE_HAS_RULE),yes) $(NATIVE_BIN): $(DRIVER) $(DRIVER_DEPS) $(HOST_KERNEL) | $(DIST) - $(CC) $(CFLAGS) $(TLS_CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(HOST_KERNEL) $(LDLIBS) + $(CC) $(CFLAGS) $(PTHREAD) $(LDFLAGS) -o $@ $(DRIVER) $(HOST_KERNEL) $(LDLIBS) @echo "built $@" endif diff --git a/README.md b/README.md index 5eab94d..8424b19 100644 --- a/README.md +++ b/README.md @@ -36,7 +36,7 @@ fails. ## Build GNU Make, a C compiler, pthreads, and the system math library are required. -Linux and macOS also require OpenSSL. Windows uses WinHTTP. +Uploads use plain HTTP and require no TLS library. Build for the current machine: @@ -93,7 +93,7 @@ code and link that can be used to attach the result to a fossbench.net account: Set another server at compile time: ```sh -make CFLAGS='-O2 -Wall -Wextra -DFB_API_BASE_URL=\"https://bench.example.com\"' +make CFLAGS='-O2 -Wall -Wextra -DFB_API_BASE_URL=\"http://bench.example.com\"' ``` ## Workloads diff --git a/src/app/benchmark.c b/src/app/benchmark.c index 186538d..72b7f55 100644 --- a/src/app/benchmark.c +++ b/src/app/benchmark.c @@ -18,10 +18,6 @@ #if !defined(_WIN32) && !defined(FB_NO_UPLOAD) # include # include -# include -# include -# include -# include "../ca_bundle.h" #endif #if defined(__APPLE__) # include @@ -32,9 +28,9 @@ /* The server URL can be changed when building. */ #ifndef FB_API_BASE_URL -# define FB_API_BASE_URL "https://fossbench.net" +# define FB_API_BASE_URL "http://fossbench.net" #endif -#define FB_VERSION "0.2.1" +#define FB_VERSION "0.2.2" #if defined(__aarch64__) || defined(__arm64__) || defined(_M_ARM64) # define D_INT "64-bit ALU: madd, umulh, udiv, bitops" diff --git a/src/app/upload.c b/src/app/upload.c index 12be0d1..4dc9cfa 100644 --- a/src/app/upload.c +++ b/src/app/upload.c @@ -43,50 +43,10 @@ static int json_string_field(const char *json, const char *field, char *dst, siz return *p == '"' && used > 0; } -#if !defined(_WIN32) -/* Load the certificates included with the program. */ -static int load_embedded_ca_bundle(SSL_CTX *ctx) -{ - X509_STORE *store = SSL_CTX_get_cert_store(ctx); - BIO *bio = BIO_new_mem_buf(fb_ca_bundle_pem, -1); - X509 *cert; - int loaded = 0; - - if (!bio) return 0; - while ((cert = PEM_read_bio_X509(bio, NULL, NULL, NULL)) != NULL) { - if (X509_STORE_add_cert(store, cert)) loaded++; - X509_free(cert); - } - BIO_free(bio); - ERR_clear_error(); /* Reaching the end sets an error, which is fine. */ - return loaded > 0; -} -#endif - #if defined(_WIN32) -/* Check if WinHTTP found a certificate problem. */ -static int is_winhttp_secure_error(DWORD err) -{ - switch (err) { - case ERROR_WINHTTP_SECURE_CERT_DATE_INVALID: - case ERROR_WINHTTP_SECURE_CERT_CN_INVALID: - case ERROR_WINHTTP_SECURE_INVALID_CA: - case ERROR_WINHTTP_SECURE_CERT_REV_FAILED: - case ERROR_WINHTTP_SECURE_CHANNEL_ERROR: - case ERROR_WINHTTP_SECURE_INVALID_CERT: - case ERROR_WINHTTP_SECURE_CERT_REVOKED: - case ERROR_WINHTTP_SECURE_FAILURE: - case ERROR_WINHTTP_SECURE_CERT_WRONG_USAGE: - case ERROR_WINHTTP_SECURE_FAILURE_PROXY: - return 1; - default: - return 0; - } -} - /* Send the request with Windows networking. */ static int winhttp_post(const char *host, const char *port, const char *path, - int use_tls, const char *payload, int payload_len, + const char *payload, int payload_len, const char *auth_header, int *out_status, char *response, size_t response_cap) { @@ -116,25 +76,18 @@ static int winhttp_post(const char *host, const char *port, const char *path, goto done; } hrequest = WinHttpOpenRequest(hconnect, L"POST", wpath, NULL, WINHTTP_NO_REFERER, - WINHTTP_DEFAULT_ACCEPT_TYPES, - use_tls ? WINHTTP_FLAG_SECURE : 0); + WINHTTP_DEFAULT_ACCEPT_TYPES, 0); if (!hrequest) { fprintf(stderr, " upload error: cannot create HTTP request\n"); goto done; } if (!WinHttpSendRequest(hrequest, wheaders, (DWORD)-1L, (LPVOID)payload, (DWORD)payload_len, (DWORD)payload_len, 0)) { - if (is_winhttp_secure_error(GetLastError())) - fprintf(stderr, " upload error: TLS connection or certificate verification failed\n"); - else - fprintf(stderr, " upload error: send failed\n"); + fprintf(stderr, " upload error: send failed\n"); goto done; } if (!WinHttpReceiveResponse(hrequest, NULL)) { - if (is_winhttp_secure_error(GetLastError())) - fprintf(stderr, " upload error: TLS connection or certificate verification failed\n"); - else - fprintf(stderr, " upload error: no server response\n"); + fprintf(stderr, " upload error: no server response\n"); goto done; } if (!WinHttpQueryHeaders(hrequest, WINHTTP_QUERY_STATUS_CODE | WINHTTP_QUERY_FLAG_NUMBER, @@ -176,21 +129,17 @@ static int upload_results(const struct system_info *info, double score, char auth_header[600], response_body[2048], claim_url[1024]; char cpu[512], model[512], os[512], compiler[256], kernel[256]; const char *base = FB_API_BASE_URL, *p, *slash, *colon; - int use_tls, status = 0, payload_len; + int status = 0, payload_len; #if !defined(_WIN32) char request[20000], response[4096]; struct addrinfo hints, *addresses = NULL, *a; - SSL_CTX *tls_ctx = NULL; - SSL *tls = NULL; int fd = -1, request_len; #endif - if (!strncmp(base, "https://", 8)) { - use_tls = 1; p = base + 8; strcpy(port, "443"); - } else if (!strncmp(base, "http://", 7)) { - use_tls = 0; p = base + 7; strcpy(port, "80"); + if (!strncmp(base, "http://", 7)) { + p = base + 7; strcpy(port, "80"); } else { - fprintf(stderr, " upload error: unsupported URL scheme\n"); + fprintf(stderr, " upload error: only HTTP URLs are supported\n"); return 0; } slash = strchr(p, '/'); @@ -281,31 +230,10 @@ static int upload_results(const struct system_info *info, double score, } freeaddrinfo(addresses); if (fd < 0) { fprintf(stderr, " upload error: cannot connect to %s:%s\n", host, port); return 0; } - if (use_tls) { - tls_ctx = SSL_CTX_new(TLS_client_method()); - if (!tls_ctx) { - fprintf(stderr, " upload error: cannot initialize TLS trust store\n"); - goto upload_failed; - } - SSL_CTX_set_default_verify_paths(tls_ctx); /* Try system certificates too. */ - if (!load_embedded_ca_bundle(tls_ctx)) { - fprintf(stderr, " upload error: cannot initialize TLS trust store\n"); - goto upload_failed; - } - SSL_CTX_set_verify(tls_ctx, SSL_VERIFY_PEER, NULL); - tls = SSL_new(tls_ctx); - if (!tls || !SSL_set_tlsext_host_name(tls, host) || - !SSL_set1_host(tls, host) || !SSL_set_fd(tls, fd) || - SSL_connect(tls) != 1) { - fprintf(stderr, " upload error: TLS connection or certificate verification failed\n"); - goto upload_failed; - } - } { size_t sent = 0; while (sent < (size_t)request_len) { - int n = use_tls ? SSL_write(tls, request + sent, (int)((size_t)request_len - sent)) : - (int)send(fd, request + sent, (size_t)request_len - sent, 0); + int n = (int)send(fd, request + sent, (size_t)request_len - sent, 0); if (n <= 0) { fprintf(stderr, " upload error: send failed\n"); goto upload_failed; } sent += (size_t)n; } @@ -314,8 +242,7 @@ static int upload_results(const struct system_info *info, double score, size_t used = 0; int n; do { - n = use_tls ? SSL_read(tls, response + used, (int)(sizeof(response) - used - 1)) : - (int)recv(fd, response + used, sizeof(response) - used - 1, 0); + n = (int)recv(fd, response + used, sizeof(response) - used - 1, 0); if (n > 0) used += (size_t)n; } while (n > 0 && used + 1 < sizeof(response)); if (used == 0) { fprintf(stderr, " upload error: no server response\n"); goto upload_failed; } @@ -326,11 +253,9 @@ static int upload_results(const struct system_info *info, double score, if (body) snprintf(response_body, sizeof(response_body), "%s", body + 4); } } - if (tls) { SSL_shutdown(tls); SSL_free(tls); } - if (tls_ctx) SSL_CTX_free(tls_ctx); close(fd); #else - if (!winhttp_post(host, port, path, use_tls, payload, payload_len, auth_header, + if (!winhttp_post(host, port, path, payload, payload_len, auth_header, &status, response_body, sizeof(response_body))) return 0; #endif @@ -357,8 +282,6 @@ static int upload_results(const struct system_info *info, double score, #if !defined(_WIN32) upload_failed: - if (tls) SSL_free(tls); - if (tls_ctx) SSL_CTX_free(tls_ctx); if (fd >= 0) close(fd); return 0; #endif