MINIFICPP-2524 Add FIPS compliancy support

[lordgamez]

This change adds the option to enable FIPS mode in the OpenSSL library for cryptographic functions used by MiNiFi C++. This includes the following:

• Introduces the nifi.openssl.fips.support.enable option in minifi.properties to enable this option, if the option is enabled MiNiFi C++ will try to load the openssl.cnf that loads the FIPS provider and then enables FIPS mode in OpenSSL.
• Adds compilation of the FIPS provider library from OpenSSL 3.0.9 which is the latest FIPS validated OpenSSL version as listed here: https://openssl-library.org/source/
• Adds the FIPS provider library and the required openssl.cnf files to the install package under the $MINIFI_HOME/fips directory
• Adds the openssl binary to the install package under the $MINIFI_HOME/fips directory for running the module tests and generating the fipsmodule.cnf file on the target platform as required for the FIPS compliancy, referenced in these sources: OpenSSL FIPS module distribution openssl/openssl#25036, https://openssl-library.org/source/fips-doc/openssl-3.0.9-security-policy-2024-01-12.pdf Appendix A
• Updated paho-mqtt, librdkafka libraries and added no-engine flag for OpenSSL compilation to remove legacy API usage required for FIPS compliancy as referenced here: https://docs.openssl.org/master/man7/fips_module/#description

OpenSSL discussion about this issue: openssl/openssl#26378

https://issues.apache.org/jira/browse/MINIFICPP-2524

---

Thank you for submitting a contribution to Apache NiFi - MiNiFi C++.

In order to streamline the review of the contribution we ask you
to ensure the following steps have been taken:

For all changes:

• Is there a JIRA ticket associated with this PR? Is it referenced
  in the commit message?

• Does your PR title start with MINIFICPP-XXXX where XXXX is the JIRA number you are trying to resolve? Pay particular attention to the hyphen "-" character.

• Has your PR been rebased against the latest commit within the target branch (typically main)?

• Is your initial contribution a single, squashed commit?

For code changes:

• If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?
• If applicable, have you updated the LICENSE file?
• If applicable, have you updated the NOTICE file?

For documentation related changes:

• Have you ensured that format looks appropriate for the output in which it is rendered?

Note:

Please ensure that once the PR is submitted, you check GitHub Actions CI results for build issues and submit an update to your PR as soon as possible.

[szaszm]

What does this exactly do? INSTALL.md says:

Don't build support for loading engines.

But I'm not sure what loadable engines are. Is it related to FIPS in any way? Also, the FIPS target omits most of these, probably leading to some unnecessary extra build steps, consider adding some more options there, like no-tests, no-docs.

[lordgamez]

I'm not that familiar with it, but there is an Engine API in OpenSSL that is controlled by this option. An engine that is loaded in OpenSSL is a hardware or software implementation used for performing cryptographic operations. Engines are not FIPS compatible and corresponding API is deprecated since OpenSSL 3.0, so for FIPS compliancy we should remove the engine support as well. (According to the documention it is also a good guidline for FIPS compliancy to remove anything that is deprecated in OpenSSL 3.0 as that is probably not FIPS compatible.)

[szaszm]

Why are all these removed?

[lordgamez]

• no-apps is removed because we need the openssl binary to be packaged with fips
• no-dso and no-module need to be enabled for shared libraries to be loaded in our case the fips provider which cannot be statically linked
• IMO no-pinshared should not be enabled to have the loaded fips provider available through the lifetime of the application and avoid the accidental unloading of the fips shared library

[szaszm]

It's fine with fips, but these are the library options, not the fips target options.

[lordgamez]

But these options are meant for the OpenSSL library options for loading the FIPS module, not for the FIPS target.

• We need the binary of the latest OpenSSL target, not the FIPS target
• Without the options to be able to load shared libraries, loading of the FIPS module fails with the following error:

Failed to load FIPS module
INSTALL FAILED
4077F3DFF87D0000:error:07880025:common libcrypto routines:provider_init:reason(37):crypto/provider_core.c:949:name=fips

[szaszm]

aah ok. I thought both the binary and the fips module come from the fips target.

What about no-pinshared, is removing that necessary too?