1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
|
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Rosen Penev <rosenp@gmail.com>
Date: Sun, 2 Aug 2020 15:07:47 -0700
Subject: [PATCH] fix compilation without deprecated OpenSSL APIs
Guard the OpenSSL 1.0 locking callbacks and the explicit library
init/cleanup calls behind a version check, switch X509_get_notAfter() and
X509_get_notBefore() to their X509_get0_* replacements, replace the
SSLeay() aliases with OpenSSL_version_num()/OpenSSL_version(), and
include <openssl/dh.h> explicitly.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
--- a/src/main/threads.c
+++ b/src/main/threads.c
@@ -257,6 +257,7 @@ static void ssl_locking_function(int mod
*/
int tls_mutexes_init(void)
{
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
int i, num;
rad_assert(ssl_mutexes == NULL);
@@ -274,6 +275,7 @@ int tls_mutexes_init(void)
}
CRYPTO_set_locking_callback(ssl_locking_function);
+#endif
return 0;
}
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -59,6 +59,7 @@ USES_APPLE_DEPRECATED_API /* OpenSSL API
# include <openssl/evp.h>
# endif
# include <openssl/ssl.h>
+# include <openssl/dh.h>
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
# include <openssl/provider.h>
@@ -2985,7 +2986,7 @@ int cbtls_verify(int ok, X509_STORE_CTX
int my_ok = ok;
ASN1_INTEGER *sn = NULL;
- ASN1_TIME *asn_time = NULL;
+ const ASN1_TIME *asn_time = NULL;
VALUE_PAIR **certs;
char **identity;
#ifdef HAVE_OPENSSL_OCSP_H
@@ -3077,7 +3078,7 @@ int cbtls_verify(int ok, X509_STORE_CTX
* Get the Expiration Date
*/
buf[0] = '\0';
- asn_time = X509_get_notAfter(client_cert);
+ asn_time = X509_get0_notAfter(client_cert);
if (certs && (lookup <= 1) && asn_time &&
(asn_time->length < (int) sizeof(buf))) {
memcpy(buf, (char*) asn_time->data, asn_time->length);
@@ -3090,7 +3091,7 @@ int cbtls_verify(int ok, X509_STORE_CTX
* Get the Valid Since Date
*/
buf[0] = '\0';
- asn_time = X509_get_notBefore(client_cert);
+ asn_time = X509_get0_notBefore(client_cert);
if (certs && (lookup <= 1) && asn_time &&
(asn_time->length < (int) sizeof(buf))) {
memcpy(buf, (char*) asn_time->data, asn_time->length);
@@ -3697,10 +3698,12 @@ static int set_ecdh_curve(SSL_CTX *ctx,
*/
int tls_global_init(TLS_UNUSED bool spawn_flag, TLS_UNUSED bool check)
{
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
SSL_load_error_strings(); /* readable error messages (examples show call before library_init) */
SSL_library_init(); /* initialize library */
OpenSSL_add_all_algorithms(); /* required for SHA2 in OpenSSL < 0.9.8o and 1.0.0.a */
CONF_modules_load_file(NULL, NULL, 0);
+#endif
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
EVP_set_default_properties(NULL, "-fips");
@@ -3806,6 +3809,7 @@ int tls_global_version_check(char const
*/
void tls_global_cleanup(void)
{
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
#if OPENSSL_VERSION_NUMBER < 0x10000000L
ERR_remove_state(0);
#elif OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
@@ -3833,6 +3837,7 @@ void tls_global_cleanup(void)
ERR_free_strings();
EVP_cleanup();
CRYPTO_cleanup_all_ex_data();
+#endif
}
--- a/src/main/version.c
+++ b/src/main/version.c
@@ -54,7 +54,7 @@ int ssl_check_consistency(void)
{
long ssl_linked;
- ssl_linked = SSLeay();
+ ssl_linked = OpenSSL_version_num();
/*
* Major mismatch, that's bad.
@@ -165,7 +165,7 @@ char const *ssl_version_num(void)
{
long ssl_linked;
- ssl_linked = SSLeay();
+ ssl_linked = OpenSSL_version_num();
return ssl_version_by_num((uint32_t)ssl_linked);
}
@@ -201,10 +201,10 @@ char const *ssl_version(void)
{
static char buffer[256];
- uint32_t v = SSLeay();
+ uint32_t v = OpenSSL_version_num();
snprintf(buffer, sizeof(buffer), "%s 0x%.8x (%s)",
- SSLeay_version(SSLEAY_VERSION), /* Not all builds include a useful version number */
+ OpenSSL_version(OPENSSL_VERSION), /* Not all builds include a useful version number */
v,
ssl_version_by_num(v));
|
