Remove AES-OCB cipher preference usage

Summary:
- The incentive to clean up mcrouter OCB cipher usage is from D113609692 (next diff in stack), which removes OCB from the CipherSuite enum.
- We already removed ocb from SRConfig, Thrift, and Servicerouter: D53867041, D55032082, and D53207446 back in 2024.
- The OCB cipher is not being used in prod according [thrift connection events table](https://fburl.com/scuba/thrift_connection_events/q9r1kmj6), so this change should be safe.

Reviewed By: alikhtarov

Differential Revision: D113842492

fbshipit-source-id: 35e73e35381dabed1b830db23b3d670837c024c7

Author: Huilin Chen

mcrouter/ProxyDestination-inl.h

@@ -324,7 +324,6 @@ void ProxyDestination<Transport>::initializeTransport() {
     options.securityOpts.sslAuthorizationEnforce =
         opts.ssl_service_identity_authorization_enforce;
     options.securityOpts.tfoEnabledForSsl = opts.enable_ssl_tfo;
-    options.securityOpts.tlsPreferOcbCipher = opts.tls_prefer_ocb_cipher;
   }
 
   auto client = std::unique_ptr<Transport, typename Transport::Destructor>(

mcrouter/lib/network/AsyncMcServer.cpp

@@ -433,8 +433,7 @@ class McServerThread {
             opts.pemKeyPath,
             opts.pemCaPath,
             opts.sslRequirePeerCerts,
-            std::move(ticketKeySeeds),
-            opts.tlsPreferOcbCipher);
+            std::move(ticketKeySeeds));
 
         if (contextPair.first) {
           mcServerThread_->worker_.addSecureClientSocket(

mcrouter/lib/network/AsyncMcServer.h

@@ -100,11 +100,6 @@ class AsyncMcServer {
      */
     bool sslRequirePeerCerts{false};
 
-    /**
-     * Prefer AES-OCB cipher suite if available.
-     */
-    bool tlsPreferOcbCipher{false};
-
     /**
      * Path to JSON file containing old, current, and new seeds used for TLS
      * ticket key generation.

mcrouter/lib/network/FizzContextProvider.cpp

@@ -33,8 +33,7 @@ constexpr size_t kHandshakeValidity = 604800;
 FizzContextAndVerifier createClientFizzContextAndVerifier(
     std::string certData,
     std::string keyData,
-    folly::StringPiece pemCaPath,
-    bool preferOcbCipher) {
+    folly::StringPiece pemCaPath) {
   // global session cache
   static auto SESSION_CACHE =
       std::make_shared<fizz::client::SynchronizedLruPskCache>(100);
@@ -68,16 +67,6 @@ FizzContextAndVerifier createClientFizzContextAndVerifier(
     verifier = std::move(verifierUniq);
   }
 
-  if (preferOcbCipher) {
-#if !defined(OPENSSL_NO_OCB)
-    auto ciphers = folly::copy(ctx->getSupportedCiphers());
-    ciphers.insert(
-        ciphers.begin(),
-        fizz::CipherSuite::TLS_AES_128_OCB_SHA256_EXPERIMENTAL);
-    ctx->setSupportedCiphers(std::move(ciphers));
-#endif
-  }
-
   return FizzContextAndVerifier(std::move(ctx), std::move(verifier));
 }
 
@@ -88,7 +77,6 @@ std::shared_ptr<fizz::server::FizzServerContext> createFizzServerContext(
     folly::StringPiece keyData,
     folly::StringPiece pemCaPath,
     bool requireClientVerification,
-    bool preferOcbCipher,
     wangle::TLSTicketKeySeeds* ticketKeySeeds) {
   auto certMgr = std::make_shared<fizz::server::DefaultCertManager>();
   try {
@@ -130,18 +118,6 @@ std::shared_ptr<fizz::server::FizzServerContext> createFizzServerContext(
   if (requireClientVerification) {
     ctx->setClientAuthMode(fizz::server::ClientAuthMode::Required);
   }
-  if (preferOcbCipher) {
-#if !defined(OPENSSL_NO_OCB)
-    auto serverCiphers = folly::copy(ctx->getSupportedCiphers());
-    serverCiphers.insert(
-        serverCiphers.begin(),
-        {
-            fizz::CipherSuite::TLS_AES_128_OCB_SHA256_EXPERIMENTAL,
-        });
-    ctx->setSupportedCiphers(std::move(serverCiphers));
-#endif
-  }
-
   // set ticket seeds
   if (ticketKeySeeds) {
     std::vector<folly::ByteRange> ticketSecrets;

mcrouter/lib/network/FizzContextProvider.h

@@ -32,8 +32,7 @@ using FizzContextAndVerifier = std::pair<
 FizzContextAndVerifier createClientFizzContextAndVerifier(
     std::string certData,
     std::string keyData,
-    folly::StringPiece pemCaPath,
-    bool preferOcbCipher);
+    folly::StringPiece pemCaPath);
 
 std::shared_ptr<fizz::server::FizzServerContext> createFizzServerContext(
     folly::StringPiece pemCertPath,
@@ -42,7 +41,6 @@ std::shared_ptr<fizz::server::FizzServerContext> createFizzServerContext(
     folly::StringPiece keyData,
     folly::StringPiece pemCaPath,
     bool requireClientVerification,
-    bool preferOcbCipher,
     wangle::TLSTicketKeySeeds* ticketKeySeeds);
 } // namespace memcache
 } // namespace facebook

mcrouter/lib/network/SecurityOptions.h

@@ -83,11 +83,6 @@ struct SecurityOptions {
    * Whether TFO is enabled for SSL connections
    */
   bool tfoEnabledForSsl{false};
-
-  /**
-   * Client side to prefer AES-OCB cipher suite if supported.
-   */
-  bool tlsPreferOcbCipher{false};
 };
 
 } // namespace memcache

mcrouter/lib/network/ThreadLocalSSLContextProvider.cpp

@@ -452,10 +452,7 @@ FizzContextAndVerifier getFizzClientConfig(
     auto certData = readFile(opts.sslPemCertPath);
     auto keyData = readFile(opts.sslPemKeyPath);
     auto fizzData = createClientFizzContextAndVerifier(
-        std::move(certData),
-        std::move(keyData),
-        opts.sslPemCaPath,
-        opts.tlsPreferOcbCipher);
+        std::move(certData), std::move(keyData), opts.sslPemCaPath);
     info.setFizzData(std::move(fizzData), now);
   }
   return info.fizzData;
@@ -488,8 +485,7 @@ ServerContextPair getServerContexts(
     folly::StringPiece pemKeyPath,
     folly::StringPiece pemCaPath,
     bool requireClientCerts,
-    folly::Optional<wangle::TLSTicketKeySeeds> seeds,
-    bool preferOcbCipher) {
+    folly::Optional<wangle::TLSTicketKeySeeds> seeds) {
   auto& info = getServerContextInfo(
       evb, pemCertPath, pemKeyPath, pemCaPath, requireClientCerts);
   auto now = std::chrono::steady_clock::now();
@@ -511,7 +507,6 @@ ServerContextPair getServerContexts(
         keyData,
         pemCaPath,
         requireClientCerts,
-        preferOcbCipher,
         seeds.get_pointer());
     info.setContexts(std::move(ctx), std::move(fizzCtx), now);
   }

mcrouter/lib/network/ThreadLocalSSLContextProvider.h

@@ -89,8 +89,7 @@ ServerContextPair getServerContexts(
     folly::StringPiece pemKeyPath,
     folly::StringPiece pemCaPath,
     bool requireClientCerts,
-    folly::Optional<wangle::TLSTicketKeySeeds> seeds,
-    bool preferOcbCipher = false);
+    folly::Optional<wangle::TLSTicketKeySeeds> seeds);
 
 } // namespace memcache
 } // namespace facebook

mcrouter/lib/network/test/AsyncMcClientTestSync.cpp

@@ -46,12 +46,6 @@ folly::Optional<SSLTestPaths> getFizzSSL() {
   return res;
 }
 
-folly::Optional<SSLTestPaths> getFizzSSLWithOCB() {
-  auto res = getFizzSSL();
-  res->useOcbCipher = true;
-  return res;
-}
-
 folly::Optional<SSLTestPaths> getKtlsSSL() {
   auto res = validClientSsl();
   res.mech = SecurityMech::KTLS12;
@@ -67,9 +61,6 @@ class AsyncMcClientSimpleTest
       const folly::Optional<SSLTestPaths>& ssl,
       TestServer::Config& config) {
     config.useSsl = ssl.has_value();
-    if (config.useSsl) {
-      config.tlsPreferOcbCipher = ssl->useOcbCipher;
-    }
   }
 };
 
@@ -112,12 +103,6 @@ TEST_P(AsyncMcClientSimpleTest, serverShutdownTest) {
     auto fizzTransport =
         transport->getUnderlyingTransport<fizz::client::AsyncFizzClient>();
     EXPECT_NE(fizzTransport, nullptr);
-    if (ssl->useOcbCipher) {
-      const auto cipher = fizzTransport->getCipher();
-      EXPECT_TRUE(cipher.has_value());
-      EXPECT_EQ(
-          fizz::CipherSuite::TLS_AES_128_OCB_SHA256_EXPERIMENTAL, *cipher);
-    }
   }
 
   server->join();
@@ -271,7 +256,6 @@ INSTANTIATE_TEST_CASE_P(
         validClientSsl(),
         getTlsToPtSSL(),
         getFizzSSL(),
-        getFizzSSLWithOCB(),
         getKtlsSSL()));
 
 void testCerts(

mcrouter/lib/network/test/TestClientServerUtil.cpp

@@ -163,7 +163,6 @@ TestServer::TestServer(Config config)
     opts_.pemCertPath = config.certPath;
     opts_.pemCaPath = config.caPath;
     opts_.sslRequirePeerCerts = config.requirePeerCerts;
-    opts_.tlsPreferOcbCipher = config.tlsPreferOcbCipher;
     if (config.tfoEnabled) {
       opts_.tfoEnabledForSsl = true;
       opts_.tfoQueueSize = 100000;
@@ -262,7 +261,6 @@ TestClient::TestClient(
     opts.securityOpts.sslServiceIdentity = serviceIdentity;
     opts.securityOpts.tfoEnabledForSsl = enableTfo;
     opts.securityOpts.sslHandshakeOffload = offloadHandshakes;
-    opts.securityOpts.tlsPreferOcbCipher = ssl->useOcbCipher;
   }
   if (qosClass != 0 || qosPath != 0) {
     opts.enableQoS = true;