haproxy: 2.9.2 -> 2.9.3; Enable QUIC support

[vifino]

Description of changes

This enables switching SSL Libraries.
In addition, this switches to PCRE2 and Lua 5.4 from PCRE and Lua 5.3.
Should have no functional differences, apart from the added QUIC support which needs to be configured in HAProxy.

This also adds more test cases, specifically for SSL, mutual TLS and QUIC.

According to the recent SSL Library Support Wiki Page, OpenSSL 3.X is not the best choice by far.

I would really like WolfSSL, as that seems to be the one with the best performance yet there are still many unimplemented features.
It requires a different build config, but that's the way wolfssl intends to be used.

However, in order to make this easier to merge without worrying about breakage, it still defaults to OpenSSL (3.X)
A future PR might flip the switch, though.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 23.11 Release Notes (or backporting 23.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[vifino]

I saw #202922, but that is IMO not the way to go.
OpenSSL 3.X is not recommended for HAProxy.
As a direct quote from SSL Library Support Wiki Page:

At this point, OpenSSL 3.x is basically only usable for personal sites. Users seeking anything serious performance-wise will need to stay on version 1.1.1 provided by their vendor or to recompile one of the alternate libraries below.

[vifino]

Put the effort in to make it work with WolfSSL, which is the best option at the moment and seems to be the preferred path moving forward.
Should be less user-facing breakage than LibreSSL, actually!

[vifino]

Actually, I'll rework the WolfSSL derivation first.

[vifino]

Hey @SuperSandro2000, thank you kindly for reviewing.

The wolfssl changes are from #262594, I just needed to base the HAProxy changes on top - but I implemented your feedback (or tried, at least).

As for the sslPkgs stuff, I am not sure how to do it better as I'd need to detect if it's OpenSSL, OpenSSL with QuicTLS-compatible API (QuicTLS, BoringSSL, LibreSSL) or WolfSSL.
Do you have a suggestion?

[wlallemand]

Small update, we released haproxy 2.8.4, you can now enable USE_QUIC_OPENSSL_COMPAT=1 to have QUIC with an non-patched version of openssl.

[vifino]

Update on this:

• Bumped to 2.9.0, it removes the need for some workarounds.
• Enabled USE_QUIC_OPENSSL_COMPAT for OpenSSL. All providers enable QUIC now.
• Default to QuicTLS, OpenSSL with QUIC compat does not seem to work nicely with mTLS, breakage of existing setups should still be zero.

[vifino]

Hey @wlallemand.

I tried OpenSSL with USE_QUIC_OPENSSL_COMPAT=1 on 2.9.0 but it seems to not work properly with QUIC certificate auth.

I've enabled limited-quic in the global section, but my previously working testsuite (testing HTTP, HTTPS, HTTPS + Certificate Auth and QUIC + Certificate Auth) now fails on the last QUIC Cert Auth step.

The curl call going to the quic listener with verify required fails with the following:

curl: (55) sendmsg() returned -1 (errno 5); disable GSO

(Of course, I disabled GSO, but that didn't help.)

Meanwhile, the same tests run just fine with a haproxy compiled with quictls, which is the only difference between those runs.

Should I open an issue about this?

[wlallemand]

@vifino I'm not aware of any issue of this kind with the openssl compat layer, it could be a bug or a limitation of the current achitecture. Did you had the same issue with 2.8.4? Better open an issue on the haproxy github indeed! thanks.

[h7x4]

This looks really good. Thank you!