Skip to contentSkip to conversation

Fix build with libressl

PATCH In review Niels Ole Salscheider 4 participants 5 messages Jan 10, 2016 – Jan 15, 2016

lore
Share & tools
lore

Niels Ole Salscheider

author
#0 lore raw

PATCH 1/1 Fix build with libressl

Signed-off-by Niels Ole Salscheider <[email protected]...>
---
 src/openvpn/ssl_openssl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
src/openvpn/ssl_openssl.c +2 -2
index d2f40e7..e390f4d 100644
@@ -358,7 +358,7 @@ tls_ctx_check_cert_time (const struct tls_root_ctx *ctx)
 
   ASSERT (ctx);
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
+#if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(LIBRESSL_VERSION_NUMBER)
   /* OpenSSL 1.0.2 and up */
   cert = SSL_CTX_get0_certificate (ctx->ctx);
 #else

@@ -393,7 +393,7 @@ tls_ctx_check_cert_time (const struct tls_root_ctx *ctx)
     }
 
 cleanup:
-#if OPENSSL_VERSION_NUMBER < 0x10002000L
+#if OPENSSL_VERSION_NUMBER < 0x10002000L || defined(LIBRESSL_VERSION_NUMBER)
   SSL_free (ssl);
 #endif
   return;
Signature · 1 line
2.7.0
#1 lore raw
Quoted 19 lines · Niels Ole Salscheider
Signed-off-by Niels Ole Salscheider <[email protected]...>
---
 src/openvpn/ssl_openssl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
src/openvpn/ssl_openssl.c +1 -1
index d2f40e7..e390f4d 100644
@@ -358,7 +358,7 @@ tls_ctx_check_cert_time (const struct tls_root_ctx *ctx)
 
   ASSERT (ctx);
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
+#if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(LIBRESSL_VERSION_NUMBER)
   /* OpenSSL 1.0.2 and up */
   cert = SSL_CTX_get0_certificate (ctx->ctx);
 #else

src/openvpn/ssl_openssl.c tls_ctx_check_cert_time (const struct tls_root_ctx *ctx) · line 399

Quoted 8 lines
src/openvpn/ssl_openssl.c +1 -1
@@ -393,7 +393,7 @@ tls_ctx_check_cert_time (const struct tls_root_ctx *ctx)
     }
 
 cleanup:
-#if OPENSSL_VERSION_NUMBER < 0x10002000L
+#if OPENSSL_VERSION_NUMBER < 0x10002000L || defined(LIBRESSL_VERSION_NUMBER)
   SSL_free (ssl);
 #endif
   return;

LibreSSL is like: We are OpenSSL 1.0.2 but have a different API?! That sounds like a LibreSSL bug.

Arne

author
#2 lore raw
Quoted 33 lines · Arne Schwabe
Quoted 32 lines · Niels Ole Salscheider
Signed-off-by Niels Ole Salscheider <[email protected]...>

---

 src/openvpn/ssl_openssl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
src/openvpn/ssl_openssl.c +1 -1
index d2f40e7..e390f4d 100644
@@ -358,7 +358,7 @@ tls_ctx_check_cert_time (const struct tls_root_ctx
 *ctx)> 
   ASSERT (ctx);
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
+#if OPENSSL_VERSION_NUMBER >= 0x10002000L &&

!defined(LIBRESSL_VERSION_NUMBER)>
/* OpenSSL 1.0.2 and up */
cert = SSL_CTX_get0_certificate (ctx->ctx);

#else

src/openvpn/ssl_openssl.c +1 -1
@@ -393,7 +393,7 @@ tls_ctx_check_cert_time (const struct tls_root_ctx
 *ctx)> 
     }
 
 cleanup:
-#if OPENSSL_VERSION_NUMBER < 0x10002000L
+#if OPENSSL_VERSION_NUMBER < 0x10002000L ||

defined(LIBRESSL_VERSION_NUMBER)>
SSL_free (ssl);

Quoted 6 lines
Quoted 3 lines

#endif

   return;

LibreSSL is like: We are OpenSSL 1.0.2 but have a different API?! That sounds like a LibreSSL bug.

LibreSSL just returns its version number in OPENSSL_VERSION_NUMBER (which is currently higher than OpenSSL's one). Since they removed some old stuff they cannot offer a superset of OpenSSL's API anyway and thus it is not clear how to choose the "right" value (according to your reasoning) for OPENSSL_VERSION_NUMBER.
I guess we have no choice but to handle this ourselves (or to leave it broken for LibreSSL).

Ole

Quoted 1 line

Arne

#3 lore raw

Hi,

Quoted 36 lines · Niels Ole Salscheider
Quoted 35 lines · Arne Schwabe
Quoted 34 lines · Niels Ole Salscheider
Signed-off-by Niels Ole Salscheider <[email protected]...>

---

 src/openvpn/ssl_openssl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
src/openvpn/ssl_openssl.c +1 -1
index d2f40e7..e390f4d 100644
@@ -358,7 +358,7 @@ tls_ctx_check_cert_time (const struct tls_root_ctx
 *ctx)>
   ASSERT (ctx);
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
+#if OPENSSL_VERSION_NUMBER >= 0x10002000L &&

!defined(LIBRESSL_VERSION_NUMBER)>
/* OpenSSL 1.0.2 and up */
cert = SSL_CTX_get0_certificate (ctx->ctx);

#else

src/openvpn/ssl_openssl.c +1 -1
@@ -393,7 +393,7 @@ tls_ctx_check_cert_time (const struct tls_root_ctx
 *ctx)>
     }
 
 cleanup:
-#if OPENSSL_VERSION_NUMBER < 0x10002000L
+#if OPENSSL_VERSION_NUMBER < 0x10002000L ||

defined(LIBRESSL_VERSION_NUMBER)>
SSL_free (ssl);

#endif

Quoted 7 lines
Quoted 4 lines
Quoted 1 line
   return;

LibreSSL is like: We are OpenSSL 1.0.2 but have a different API?! That sounds like a LibreSSL bug.

LibreSSL just returns its version number in OPENSSL_VERSION_NUMBER (which is currently higher than OpenSSL's one).

No, libressl returns a fixed version (2.0.0) in OPENSSL_VERSION_NUMBER.

Quoted 6 lines

Since they removed some old stuff they
cannot offer a superset of OpenSSL's API anyway and thus it is not clear how to choose the "right" value (according to your reasoning) for OPENSSL_VERSION_NUMBER.
I guess we have no choice but to handle this ourselves (or to leave it broken for LibreSSL).

Tbh, I didn't even know that openvpn compiled with libressl. And just to be perfectly clear on this: we do not support libressl as a crypto backend.

That said, this patch is rather minimal and if this indeed is the only thing needed to work with libressl, I can live with it. In other
words: slightly reluctant ACK.

-Steffan

#4 lore raw
In reply to Niels Ole Salscheider

Your patch has been applied to the master and release/2.3 branch.

commit 9dfc2309c6b4143892137844197f5f84755f6580 (master) commit 4bb0d8de83cbef4de8551f5a1b9dcbe6afbd6aa0 (release/2.3)

Author: Niels Ole Salscheider
Date:   Sun Jan 10 14:44:35 2016 +0100
     Fix build with libressl

     Signed-off-by: Niels Ole Salscheider <[email protected]...>
     Acked-by: Steffan Karger <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/10975
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering