Add opt-in system crypto-policies seeding for SSL_CTX (broad approach)

[WillChilds-Klein]

Issues:

No existing issue. This is a draft to solicit feedback on approach before investing further.

Description of changes:

AWS-LC deliberately ignores system configuration today. On distributions with the crypto-policies framework (notably Amazon Linux 2023 and Fedora, which share it), an operator selects a system-wide policy that is rendered to an OpenSSL back-end file describing the OS TLS posture. This PR lets AWS-LC optionally honor that policy so applications inherit it without code changes.

This is the "broad" approach: behind a new off-by-default CMake flag (-DENABLE_CRYPTO_POLICIES), every context created by SSL_CTX_new is seeded from the system policy after AWS-LC's built-in defaults, and consumers can still override afterward. Cipher, protocol-version, signature-algorithm and group directives are applied.

The signature-algorithm and group lists are narrowed to the algorithms AWS-LC implements before being applied, in the order the policy gave them. A stock policy names algorithms AWS-LC lacks, and the setters reject a whole list on the first name they do not recognize, so applying a policy as written would throw away the operator's preference order entirely.

Seeding is best-effort and never fatal. A missing or malformed file, an unsupported directive, a cipher rule AWS-LC cannot satisfy, or a version range whose floor sits above its ceiling all leave the built-in default in place. Errors raised along the way are dropped, and the caller's own error queue comes back byte-identical: same entries, same data pointers, same mark.

Packagers can relocate the policy file at build time with -DAWSLC_CRYPTO_POLICY_PATH; AWSLC_CRYPTO_POLICY_FILE overrides it at run time, and is ignored when the real and effective user or group differ so an unprivileged caller cannot pick the policy a set-uid process runs under.

Call-outs:

• Broad vs. narrow. This implements the broad, automatic approach (seed on every context creation); the alternative "narrow" approach would add an explicit opt-in call per context with no implicit behavior change. Feedback on which direction AWS-LC prefers is the main purpose of this draft.
• Security levels are dropped. The policy's @SECLEVEL token is parsed and ignored because AWS-LC has no security levels, so only the cipher list is applied and the level's key-size/hash intent is not enforced.
• secp256r1 is translated. crypto-policies uses the IANA name; AWS-LC follows OpenSSL and knows the curve as P-256. Without the translation the most widely deployed group in a stock policy is the one that gets dropped.
• Two new internal error-queue primitives. ERR_num_errors and ERR_pop_to_count let seeding discard its own errors by cutting the queue back to the length it had. Saving and restoring the queue instead rebuilds every surviving entry, which dangles a data pointer the caller is already holding and drops a mark the caller set -- neither of which SSL_CTX_new may do.
• Version-locked methods keep their pin. TLSv1_2_method and friends skip the policy's version directives, since the public setters check a bound against the method's whole range and would otherwise widen a pin the caller chose. A policy that tightens such a context is skipped along with one that loosens it.
• FIPS. The flag is orthogonal to -DFIPS=1; it seeds preferences and does not establish FIPS posture.

Testing:

• Unit tests cover directive parsing, security-level stripping, missing and malformed files, DTLS-versus-TLS selection, overlong values, and an end-to-end case against the real system policy that skips when absent.
• The filtering tests run the verbatim Amazon Linux 2023 DEFAULT policy and assert the exact group and signature-algorithm lists installed, with negative controls showing the setters reject that same policy value unfiltered.
• Separate tests pin the failure modes where a rejected directive could still mutate the context: an unsatisfiable cipher rule, an inverted version range in both TLS and DTLS wire orders, a one-sided bound that would cross the bound already set, and a version-locked method.
• Three tests cover the caller's error queue across seeding: a queued error, a queued error behind a mark, and a data pointer the caller already holds, which is asserted to be the same address afterward.
• Each test pins the policy path, so a host with crypto-policies installed exercises the same assertions as one without. Removing the pin fails the DTLS test on Amazon Linux 2023.
• A new CI job runs the flag-on suite on Amazon Linux 2023 (x86_64/aarch64, gcc and clang), where the end-to-end test reads the real policy file; the bulk suite runs with seeding neutralized.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[github-actions]

🔒 Security Review — View Report

Please review before merging.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 77.77778% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.13%. Comparing base (ac587fb) to head (8fdbc58).

Files with missing lines	Patch %	Lines
ssl/ssl_privkey.cc	0.00%	11 Missing ⚠️
crypto/err/err.c	83.33%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3442      +/-   ##
==========================================
+ Coverage   78.11%   78.13%   +0.01%     
==========================================
  Files         700      700              
  Lines      125599   125663      +64     
  Branches    17372    17382      +10     
==========================================
+ Hits        98117    98188      +71     
+ Misses      26611    26604       -7     
  Partials      871      871              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[WillChilds-Klein]

Superseded by a five-PR stack, to review and merge bottom-up:

1. Add ERR_num_errors and ERR_pop_to_count #3501 -- error-queue primitives
2. Add a reader for the system crypto-policies OpenSSL back-end #3502 -- policy file reader
3. Seed cipher lists and version bounds from the system crypto policy #3503 -- cipher lists and version bounds
4. Seed groups and signature algorithms from the system crypto policy #3504 -- groups and signature algorithms
5. Keep AWS-LC's post-quantum defaults unless the policy opts out #3505 -- post-quantum defaults

The stack is not a straight split. Two changes it makes that this PR did not:

• Groups and signature algorithms are narrowed to the algorithms AWS-LC implements, and secp256r1 is translated to the name AWS-LC knows. As written here, a stock policy value hit an unknown name and the setter discarded the whole list, so the directives had no effect.
• AWS-LC's post-quantum defaults survive a policy that says nothing about them. The group and signature-algorithm setters replace AWS-LC's defaults rather than intersect with them, so seeding as done here downgraded every context. Turning post-quantum off now takes an explicit AWSLC.PostQuantum = off.