267 lines
9.5 KiB
Diff
267 lines
9.5 KiB
Diff
From fbb0cc3b65a2ead522019fb461ae520371cc3ede Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Marek=20Beh=C3=BAn?= <kabel@blackhole.sk>
|
|
Date: Mon, 6 Jun 2016 18:41:30 +0200
|
|
Subject: [PATCH] Support compiling with LibreSSL 2.4.0
|
|
|
|
This patch checks for macros OPENSSL_NO_COMP, OPENSSL_NO_EGD, and
|
|
if disables those features if they are.
|
|
|
|
Also add ifdef for HAVE_SSLv3_{client/server}_method in sslcls.c,
|
|
since these were removed from LibreSSL 2.4.0.
|
|
---
|
|
sslcls.c | 8 +++++++-
|
|
sslcls.h | 4 +++-
|
|
xio-openssl.c | 24 ++++++++++++++++++------
|
|
xio-openssl.h | 4 +++-
|
|
xioopts.c | 8 ++++++--
|
|
xioopts.h | 4 +++-
|
|
6 files changed, 40 insertions(+), 12 deletions(-)
|
|
|
|
diff --git a/sslcls.c b/sslcls.c
|
|
index ea4c303..5011ef2 100644
|
|
--- a/sslcls.c
|
|
+++ b/sslcls.c
|
|
@@ -55,6 +55,7 @@ const SSL_METHOD *sycSSLv2_server_method(void) {
|
|
}
|
|
#endif
|
|
|
|
+#if HAVE_SSLv3_client_method
|
|
const SSL_METHOD *sycSSLv3_client_method(void) {
|
|
const SSL_METHOD *result;
|
|
Debug("SSLv3_client_method()");
|
|
@@ -62,7 +63,9 @@ const SSL_METHOD *sycSSLv3_client_method(void) {
|
|
Debug1("SSLv3_client_method() -> %p", result);
|
|
return result;
|
|
}
|
|
+#endif
|
|
|
|
+#if HAVE_SSLv3_server_method
|
|
const SSL_METHOD *sycSSLv3_server_method(void) {
|
|
const SSL_METHOD *result;
|
|
Debug("SSLv3_server_method()");
|
|
@@ -70,6 +73,7 @@ const SSL_METHOD *sycSSLv3_server_method(void) {
|
|
Debug1("SSLv3_server_method() -> %p", result);
|
|
return result;
|
|
}
|
|
+#endif
|
|
|
|
const SSL_METHOD *sycSSLv23_client_method(void) {
|
|
const SSL_METHOD *result;
|
|
@@ -347,6 +351,7 @@ void sycSSL_free(SSL *ssl) {
|
|
return;
|
|
}
|
|
|
|
+#ifndef OPENSSL_NO_EGD
|
|
int sycRAND_egd(const char *path) {
|
|
int result;
|
|
Debug1("RAND_egd(\"%s\")", path);
|
|
@@ -354,6 +359,7 @@ int sycRAND_egd(const char *path) {
|
|
Debug1("RAND_egd() -> %d", result);
|
|
return result;
|
|
}
|
|
+#endif
|
|
|
|
DH *sycPEM_read_bio_DHparams(BIO *bp, DH **x, pem_password_cb *cb, void *u) {
|
|
DH *result;
|
|
@@ -391,7 +397,7 @@ int sycFIPS_mode_set(int onoff) {
|
|
}
|
|
#endif /* WITH_FIPS */
|
|
|
|
-#if OPENSSL_VERSION_NUMBER >= 0x00908000L
|
|
+#if OPENSSL_VERSION_NUMBER >= 0x00908000L && !defined(OPENSSL_NO_COMP)
|
|
const COMP_METHOD *sycSSL_get_current_compression(SSL *ssl) {
|
|
const COMP_METHOD *result;
|
|
Debug1("SSL_get_current_compression(%p)", ssl);
|
|
diff --git a/sslcls.h b/sslcls.h
|
|
index 152fe5b..9fd8ef2 100644
|
|
--- a/sslcls.h
|
|
+++ b/sslcls.h
|
|
@@ -49,7 +49,9 @@ X509 *sycSSL_get_peer_certificate(SSL *ssl);
|
|
int sycSSL_shutdown(SSL *ssl);
|
|
void sycSSL_CTX_free(SSL_CTX *ctx);
|
|
void sycSSL_free(SSL *ssl);
|
|
+#ifndef OPENSSL_NO_EGD
|
|
int sycRAND_egd(const char *path);
|
|
+#endif
|
|
|
|
DH *sycPEM_read_bio_DHparams(BIO *bp, DH **x, pem_password_cb *cb, void *u);
|
|
|
|
@@ -57,7 +59,7 @@ BIO *sycBIO_new_file(const char *filename, const char *mode);
|
|
|
|
int sycFIPS_mode_set(int onoff);
|
|
|
|
-#if OPENSSL_VERSION_NUMBER >= 0x00908000L
|
|
+#if OPENSSL_VERSION_NUMBER >= 0x00908000L && !defined(OPENSSL_NO_COMP)
|
|
const COMP_METHOD *sycSSL_get_current_compression(SSL *ssl);
|
|
const COMP_METHOD *sycSSL_get_current_expansion(SSL *ssl);
|
|
const char *sycSSL_COMP_get_name(const COMP_METHOD *comp);
|
|
diff --git a/xio-openssl.c b/xio-openssl.c
|
|
index c7f283c..38dc20d 100644
|
|
--- a/xio-openssl.c
|
|
+++ b/xio-openssl.c
|
|
@@ -181,9 +181,11 @@ const struct optdesc opt_openssl_key = { "openssl-key", "key",
|
|
const struct optdesc opt_openssl_dhparam = { "openssl-dhparam", "dh", OPT_OPENSSL_DHPARAM, GROUP_OPENSSL, PH_SPEC, TYPE_FILENAME, OFUNC_SPEC };
|
|
const struct optdesc opt_openssl_cafile = { "openssl-cafile", "cafile", OPT_OPENSSL_CAFILE, GROUP_OPENSSL, PH_SPEC, TYPE_FILENAME, OFUNC_SPEC };
|
|
const struct optdesc opt_openssl_capath = { "openssl-capath", "capath", OPT_OPENSSL_CAPATH, GROUP_OPENSSL, PH_SPEC, TYPE_FILENAME, OFUNC_SPEC };
|
|
+#ifndef OPENSSL_NO_EGD
|
|
const struct optdesc opt_openssl_egd = { "openssl-egd", "egd", OPT_OPENSSL_EGD, GROUP_OPENSSL, PH_SPEC, TYPE_FILENAME, OFUNC_SPEC };
|
|
+#endif
|
|
const struct optdesc opt_openssl_pseudo = { "openssl-pseudo", "pseudo", OPT_OPENSSL_PSEUDO, GROUP_OPENSSL, PH_SPEC, TYPE_BOOL, OFUNC_SPEC };
|
|
-#if OPENSSL_VERSION_NUMBER >= 0x00908000L
|
|
+#if OPENSSL_VERSION_NUMBER >= 0x00908000L && !defined(OPENSSL_NO_COMP)
|
|
const struct optdesc opt_openssl_compress = { "openssl-compress", "compress", OPT_OPENSSL_COMPRESS, GROUP_OPENSSL, PH_SPEC, TYPE_STRING, OFUNC_SPEC };
|
|
#endif
|
|
#if WITH_FIPS
|
|
@@ -220,7 +222,7 @@ int xio_reset_fips_mode(void) {
|
|
static void openssl_conn_loginfo(SSL *ssl) {
|
|
Notice1("SSL connection using %s", SSL_get_cipher(ssl));
|
|
|
|
-#if OPENSSL_VERSION_NUMBER >= 0x00908000L
|
|
+#if OPENSSL_VERSION_NUMBER >= 0x00908000L && !defined(OPENSSL_NO_COMP)
|
|
{
|
|
const COMP_METHOD *comp, *expansion;
|
|
|
|
@@ -786,7 +788,7 @@ int _xioopen_openssl_listen(struct single *xfd,
|
|
#endif /* WITH_LISTEN */
|
|
|
|
|
|
-#if OPENSSL_VERSION_NUMBER >= 0x00908000L
|
|
+#if OPENSSL_VERSION_NUMBER >= 0x00908000L && !defined(OPENSSL_NO_COMP)
|
|
/* In OpenSSL 0.9.7 compression methods could be added using
|
|
* SSL_COMP_add_compression_method(3), but the implemntation is not compatible
|
|
* with the standard (RFC3749).
|
|
@@ -857,8 +859,10 @@ int
|
|
char *opt_dhparam = NULL; /* file name of DH params */
|
|
char *opt_cafile = NULL; /* certificate authority file */
|
|
char *opt_capath = NULL; /* certificate authority directory */
|
|
+#ifndef OPENSSL_NO_EGD
|
|
char *opt_egd = NULL; /* entropy gathering daemon socket path */
|
|
-#if OPENSSL_VERSION_NUMBER >= 0x00908000L
|
|
+#endif
|
|
+#if OPENSSL_VERSION_NUMBER >= 0x00908000L && !defined(OPENSSL_NO_COMP)
|
|
char *opt_compress = NULL; /* compression method */
|
|
#endif
|
|
bool opt_pseudo = false; /* use pseudo entropy if nothing else */
|
|
@@ -875,9 +879,11 @@ int
|
|
retropt_string(opts, OPT_OPENSSL_CAPATH, &opt_capath);
|
|
retropt_string(opts, OPT_OPENSSL_KEY, &opt_key);
|
|
retropt_string(opts, OPT_OPENSSL_DHPARAM, &opt_dhparam);
|
|
+#ifndef OPENSSL_NO_EGD
|
|
retropt_string(opts, OPT_OPENSSL_EGD, &opt_egd);
|
|
+#endif
|
|
retropt_bool(opts,OPT_OPENSSL_PSEUDO, &opt_pseudo);
|
|
-#if OPENSSL_VERSION_NUMBER >= 0x00908000L
|
|
+#if OPENSSL_VERSION_NUMBER >= 0x00908000L && !defined(OPENSSL_NO_COMP)
|
|
retropt_string(opts, OPT_OPENSSL_COMPRESS, &opt_compress);
|
|
#endif
|
|
#if WITH_FIPS
|
|
@@ -1010,9 +1016,11 @@ int
|
|
}
|
|
}
|
|
|
|
+#ifndef OPENSSL_NO_EGD
|
|
if (opt_egd) {
|
|
sycRAND_egd(opt_egd);
|
|
}
|
|
+#endif
|
|
|
|
if (opt_pseudo) {
|
|
long int randdata;
|
|
@@ -1124,7 +1132,7 @@ int
|
|
}
|
|
#endif /* !defined(EC_KEY) */
|
|
|
|
-#if OPENSSL_VERSION_NUMBER >= 0x00908000L
|
|
+#if OPENSSL_VERSION_NUMBER >= 0x00908000L && !defined(OPENSSL_NO_COMP)
|
|
if (opt_compress) {
|
|
int result;
|
|
result = openssl_setup_compression(*ctx, opt_compress);
|
|
@@ -1238,7 +1246,11 @@ static int openssl_SSL_ERROR_SSL(int level, const char *funcname) {
|
|
if (e == ((ERR_LIB_RAND<<24)|
|
|
(RAND_F_SSLEAY_RAND_BYTES<<12)|
|
|
(RAND_R_PRNG_NOT_SEEDED)) /*0x24064064*/) {
|
|
+#ifdef OPENSSL_NO_EGD
|
|
+ Error("too few entropy; use option \"pseudo\"");
|
|
+#else
|
|
Error("too few entropy; use options \"egd\" or \"pseudo\"");
|
|
+#endif
|
|
stat = STAT_NORETRY;
|
|
} else {
|
|
Msg2(level, "%s(): %s", funcname, ERR_error_string(e, buf));
|
|
diff --git a/xio-openssl.h b/xio-openssl.h
|
|
index 62586fc..f10ee0c 100644
|
|
--- a/xio-openssl.h
|
|
+++ b/xio-openssl.h
|
|
@@ -21,9 +21,11 @@ extern const struct optdesc opt_openssl_key;
|
|
extern const struct optdesc opt_openssl_dhparam;
|
|
extern const struct optdesc opt_openssl_cafile;
|
|
extern const struct optdesc opt_openssl_capath;
|
|
+#ifndef OPENSSL_NO_EGD
|
|
extern const struct optdesc opt_openssl_egd;
|
|
+#endif
|
|
extern const struct optdesc opt_openssl_pseudo;
|
|
-#if OPENSSL_VERSION_NUMBER >= 0x00908000L
|
|
+#if OPENSSL_VERSION_NUMBER >= 0x00908000L && !defined(OPENSSL_NO_COMP)
|
|
extern const struct optdesc opt_openssl_compress;
|
|
#endif
|
|
#if WITH_FIPS
|
|
diff --git a/xioopts.c b/xioopts.c
|
|
index 6c231f4..9a56298 100644
|
|
--- a/xioopts.c
|
|
+++ b/xioopts.c
|
|
@@ -303,7 +303,7 @@ const struct optname optionnames[] = {
|
|
#if WITH_EXT2 && defined(EXT2_COMPR_FL)
|
|
IF_ANY ("compr", &opt_ext2_compr)
|
|
#endif
|
|
-#if OPENSSL_VERSION_NUMBER >= 0x00908000L
|
|
+#if OPENSSL_VERSION_NUMBER >= 0x00908000L && !defined(OPENSSL_NO_COMP)
|
|
IF_OPENSSL("compress", &opt_openssl_compress)
|
|
#endif
|
|
#ifdef TCP_CONN_ABORT_THRESHOLD /* HP_UX */
|
|
@@ -419,7 +419,9 @@ const struct optname optionnames[] = {
|
|
#ifdef ECHOPRT
|
|
IF_TERMIOS("echoprt", &opt_echoprt)
|
|
#endif
|
|
+#ifndef OPENSSL_NO_EGD
|
|
IF_OPENSSL("egd", &opt_openssl_egd)
|
|
+#endif
|
|
IF_ANY ("end-close", &opt_end_close)
|
|
IF_TERMIOS("eof", &opt_veof)
|
|
IF_TERMIOS("eol", &opt_veol)
|
|
@@ -1062,11 +1064,13 @@ const struct optname optionnames[] = {
|
|
IF_OPENSSL("openssl-certificate", &opt_openssl_certificate)
|
|
IF_OPENSSL("openssl-cipherlist", &opt_openssl_cipherlist)
|
|
IF_OPENSSL("openssl-commonname", &opt_openssl_commonname)
|
|
-#if OPENSSL_VERSION_NUMBER >= 0x00908000L
|
|
+#if OPENSSL_VERSION_NUMBER >= 0x00908000L && !defined(OPENSSL_NO_COMP)
|
|
IF_OPENSSL("openssl-compress", &opt_openssl_compress)
|
|
#endif
|
|
IF_OPENSSL("openssl-dhparam", &opt_openssl_dhparam)
|
|
+#ifndef OPENSSL_NO_EGD
|
|
IF_OPENSSL("openssl-egd", &opt_openssl_egd)
|
|
+#endif
|
|
#if WITH_FIPS
|
|
IF_OPENSSL("openssl-fips", &opt_openssl_fips)
|
|
#endif
|
|
diff --git a/xioopts.h b/xioopts.h
|
|
index 2a165f5..37d6883 100644
|
|
--- a/xioopts.h
|
|
+++ b/xioopts.h
|
|
@@ -478,11 +478,13 @@ enum e_optcode {
|
|
OPT_OPENSSL_CERTIFICATE,
|
|
OPT_OPENSSL_CIPHERLIST,
|
|
OPT_OPENSSL_COMMONNAME,
|
|
-#if OPENSSL_VERSION_NUMBER >= 0x00908000L
|
|
+#if OPENSSL_VERSION_NUMBER >= 0x00908000L && !defined(OPENSSL_NO_COMP)
|
|
OPT_OPENSSL_COMPRESS,
|
|
#endif
|
|
OPT_OPENSSL_DHPARAM,
|
|
+#ifndef OPENSSL_NO_EGD
|
|
OPT_OPENSSL_EGD,
|
|
+#endif
|
|
OPT_OPENSSL_FIPS,
|
|
OPT_OPENSSL_KEY,
|
|
OPT_OPENSSL_METHOD,
|
|
--
|
|
2.7.3
|
|
|