Removed openssl from default features, added openssl version check

Author: wetpeanuts

Cargo.toml

@@ -46,8 +46,7 @@ time = ["dep:chrono", "dep:chrono-tz"]
 uuid = ["dep:uuid"]
 urlquery = ["dep:url"]
 yaml = ["serde_yaml"]
-jwt = []
-jwt_backend_openssl = ["openssl"]
+jwt_openssl = ["openssl"]
 full-opa = [
     "base64",
     "base64url",
@@ -66,9 +65,7 @@ full-opa = [
     "time",
     "uuid",
     "urlquery",
-    "yaml",
-    "jwt",
-    "jwt_backend_openssl"
+    "yaml"
     #"rego-extensions"
 ]
 
@@ -146,6 +143,7 @@ num_cpus = "1.16"
 
 [build-dependencies]
 anyhow = "1.0"
+openssl = { version = "0.10.73", optional = true}
 
 [profile.release]
 debug = true

build.rs

@@ -26,6 +26,22 @@ fn main() -> Result<()> {
         println!("cargo:rustc-env=GIT_HASH={git_hash}");
     }
 
+    // Verify OpenSSL version
+    #[cfg(feature = "jwt_openssl")]
+    {
+        use openssl::version;
+        // Minimal OpenSSL version that meets FIPS certification
+        let min_ver_num = 0x30000000i64;
+        let ver = version::version();
+        let ver_num = version::number();
+        if !ver.starts_with("OpenSSL") || ver_num < min_ver_num {
+            panic!(
+                "FATAL: OpenSSL version must be 3.0.0 or higher, found version: {}",
+                ver
+            );
+        }
+    }
+
     // Rerun only if build.rs changes.
     println!("cargo:rerun-if-changed=build.rs");
     Ok(())

src/builtins/jwt/backends/mod.rs

@@ -1,5 +1,5 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.
 
-#[cfg(feature = "jwt_backend_openssl")]
+#[cfg(feature = "jwt_openssl")]
 pub mod openssl;

src/builtins/jwt/toolkit.rs

@@ -1,8 +1,8 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.
 
-#[cfg(feature = "jwt_backend_openssl")]
+#[cfg(feature = "jwt_openssl")]
 use crate::builtins::jwt::backends::openssl::OpensslBackend;
 
-#[cfg(feature = "jwt_backend_openssl")]
+#[cfg(feature = "jwt_openssl")]
 pub type JwtBackend = OpensslBackend;

src/builtins/mod.rs

@@ -49,9 +49,9 @@ mod utils;
 #[cfg(feature = "uuid")]
 mod uuid;
 
-#[cfg(feature = "jwt")]
+#[cfg(feature = "jwt_openssl")]
 mod jwt;
-#[cfg(feature = "jwt")]
+#[cfg(feature = "jwt_openssl")]
 mod token_verification;
 
 #[cfg(feature = "opa-testutil")]
@@ -114,7 +114,7 @@ lazy_static! {
 	tracing::register(&mut m);
 	units::register(&mut m);
 
-	#[cfg(feature = "jwt")]
+	#[cfg(feature = "jwt_openssl")]
 	token_verification::register(&mut m);
 
 	#[cfg(feature = "opa-testutil")]

tests/opa.passing

@@ -43,11 +43,6 @@ v0/jsonfilteridempotent
 v0/jsonremove
 v0/jsonremoveidempotent
 v0/jsonschema
-v0/jwtbuiltins
-v0/jwtverifyhs256
-v0/jwtverifyhs384
-v0/jwtverifyhs512
-v0/jwtverifyrsa
 v0/negation
 v0/nestedreferences
 v0/netcidrisvalid
@@ -155,11 +150,6 @@ v1/jsonfilteridempotent
 v1/jsonremove
 v1/jsonremoveidempotent
 v1/jsonschema
-v1/jwtbuiltins
-v1/jwtverifyhs256
-v1/jwtverifyhs384
-v1/jwtverifyhs512
-v1/jwtverifyrsa
 v1/negation
 v1/nestedreferences
 v1/netcidrcontains