openssl: don't use deprecated SSLEAY/SSLeay symbols

PATCH In review Steffan Karger 2 participants 5 messages Nov 26, 2017 – Jun 29, 2018

Share & tools

Steffan Karger

author

2017-11-26 15:04 UTC #0 lore raw

PATCH 1/2 openssl: don't use deprecated SSLEAY/SSLeay symbols

Compiling our current master against OpenSSL 1.1 with -DOPENSSL_API_COMPAT=0x10100000L screams bloody murder. This patch fixes the errors about the deprecated SSLEAY/SSLeay symbols and defines.

Signed-off-by Steffan Karger <[email protected]...>

---
 configure.ac                 | 1 +
 src/openvpn/openssl_compat.h | 8 ++++++++
 src/openvpn/ssl_openssl.c    | 2 +-
 3 files changed, 10 insertions(+), 1 deletion(-)

configure.ac +1 -0

index acfddb22..954c4516 100644
@@ -925,6 +925,7 @@ if test "${enable_crypto}" = "yes" -a "${with_crypto_library}" = "openssl"; then
 			EVP_MD_CTX_new \
 			EVP_MD_CTX_free \
 			EVP_MD_CTX_reset \
+			OpenSSL_version \
 			SSL_CTX_get_default_passwd_cb \
 			SSL_CTX_get_default_passwd_cb_userdata \
 			SSL_CTX_set_security_level \

src/openvpn/openssl_compat.h +8 -0

index c9b6a179..9eb427da 100644
@@ -643,6 +643,14 @@ EC_GROUP_order_bits(const EC_GROUP *group)
 #endif
 
 /* SSLeay symbols have been renamed in OpenSSL 1.1 */
+#ifndef OPENSSL_VERSION
+#define OPENSSL_VERSION SSLEAY_VERSION
+#endif
+
+#ifndef HAVE_OPENSSL_VERSION
+#define OpenSSL_version SSLeay_version
+#endif
+
 #if !defined(RSA_F_RSA_OSSL_PRIVATE_ENCRYPT)
 #define RSA_F_RSA_OSSL_PRIVATE_ENCRYPT       RSA_F_RSA_EAY_PRIVATE_ENCRYPT
 #endif

src/openvpn/ssl_openssl.c +1 -1

index 10d161ef..18ceecb4 100644
@@ -1884,7 +1884,7 @@ get_highest_preference_tls_cipher(char *buf, int size)
 const char *
 get_ssl_library_version(void)
 {
-    return SSLeay_version(SSLEAY_VERSION);
+    return OpenSSL_version(OPENSSL_VERSION);
 }
 
 #endif /* defined(ENABLE_CRYPTO) && defined(ENABLE_CRYPTO_OPENSSL) */

Signature · 1 line

2.14.1

Steffan Karger

author

2017-11-26 15:04 UTC #1 lore raw

PATCH 2/2 openssl: add missing #include statements

Compiling our current master against OpenSSL 1.1 with -DOPENSSL_API_COMPAT=0x10100000L screams bloody murder. This patch fixes the errors caused by missing includes. Previous openssl versions would usually include 'the rest of the world', but they're fixing that. So we should no longer rely on it.

(And sneaking in alphabetic ordering of the includes while touching them.)

Signed-off-by Steffan Karger <[email protected]...>

---
 src/openvpn/openssl_compat.h     | 1 +
 src/openvpn/ssl_openssl.c        | 6 +++++-
 src/openvpn/ssl_verify_openssl.c | 3 ++-
 3 files changed, 8 insertions(+), 2 deletions(-)

src/openvpn/openssl_compat.h +1 -0

index 9eb427da..6d7f7d02 100644
@@ -42,6 +42,7 @@
 
 #include "buffer.h"
 
+#include <openssl/rsaerr.h>
 #include <openssl/ssl.h>
 #include <openssl/x509.h>

src/openvpn/ssl_openssl.c +5 -1

index 18ceecb4..79121049 100644
@@ -52,10 +52,14 @@
 
 #include "ssl_verify_openssl.h"
 
+#include <openssl/bn.h>
+#include <openssl/crypto.h>
+#include <openssl/dh.h>
+#include <openssl/dsa.h>
 #include <openssl/err.h>
 #include <openssl/pkcs12.h>
+#include <openssl/rsa.h>
 #include <openssl/x509.h>
-#include <openssl/crypto.h>
 #ifndef OPENSSL_NO_EC
 #include <openssl/ec.h>
 #endif

src/openvpn/ssl_verify_openssl.c +2 -1

index 2f3b10b9..4a1d1cf8 100644
@@ -44,8 +44,9 @@
 #include "ssl_verify_backend.h"
 #include "openssl_compat.h"
 
-#include <openssl/x509v3.h>
+#include <openssl/bn.h>
 #include <openssl/err.h>
+#include <openssl/x509v3.h>
 
 int
 verify_callback(int preverify_ok, X509_STORE_CTX *ctx)

Signature · 1 line

2.14.1

Steffan Karger

author

2017-11-26 15:49 UTC #2 lore raw

PATCH v2 2/2 openssl: add missing #include statements

(And sneaking in alphabetic ordering of the includes while touching them.)

Signed-off-by Steffan Karger <[email protected]...>

---
v2: rsaerr.h only exists in openssl's master branch, use rsa.h instead.

 src/openvpn/openssl_compat.h     | 1 +
 src/openvpn/ssl_openssl.c        | 6 +++++-
 src/openvpn/ssl_verify_openssl.c | 3 ++-
 3 files changed, 8 insertions(+), 2 deletions(-)

src/openvpn/openssl_compat.h +1 -0

index 9eb427da..6c2b9904 100644
@@ -42,6 +42,7 @@
 
 #include "buffer.h"
 
+#include <openssl/rsa.h>
 #include <openssl/ssl.h>
 #include <openssl/x509.h>

src/openvpn/ssl_openssl.c +5 -1

index 18ceecb4..79121049 100644
@@ -52,10 +52,14 @@
 
 #include "ssl_verify_openssl.h"
 
+#include <openssl/bn.h>
+#include <openssl/crypto.h>
+#include <openssl/dh.h>
+#include <openssl/dsa.h>
 #include <openssl/err.h>
 #include <openssl/pkcs12.h>
+#include <openssl/rsa.h>
 #include <openssl/x509.h>
-#include <openssl/crypto.h>
 #ifndef OPENSSL_NO_EC
 #include <openssl/ec.h>
 #endif

src/openvpn/ssl_verify_openssl.c +2 -1

index 2f3b10b9..4a1d1cf8 100644
@@ -44,8 +44,9 @@
 #include "ssl_verify_backend.h"
 #include "openssl_compat.h"
 
-#include <openssl/x509v3.h>
+#include <openssl/bn.h>
 #include <openssl/err.h>
+#include <openssl/x509v3.h>
 
 int
 verify_callback(int preverify_ok, X509_STORE_CTX *ctx)

Signature · 1 line

2.14.1

Gert Doering

Acked-by on v2 2/2

2018-06-29 12:41 UTC #3 lore raw

[Openvpn-devel] [PATCH applied] Re: openssl: add missing #include statements

Acked-by Gert Doering <[email protected]...>

"Looks sane", and tested against the same set of OS/OpenSSL combinations as 1/2 ("--version" and t_client tests).

Compilation with -DOPENSSL_API_COMPAT=0x10100000L still does not work (quite a few linker errors), but those seem to be unrelated to missing includes, and more related to "these are macros we shouldn't be using anymore"... namely EVP_CIPHER_CTX_init(), EVP_CIPHER_CTX_cleanup(), SSL_library_init(), SSL_load_error_strings(), OpenSSL_add_all_algorithms(), EVP_cleanup(), ERR_free_strings(), X509_get_notBefore(), X509_get_notAfter() and SSL_CTX_set_ecdh_auto().

Without said define, OpenSSL 1.1.0 is also fine, but this smells like "a bit more work needed".

Your patch has been applied to the master branch.

commit 1987498271abadf042d8bb3feee1fe0d877a9d55

Author: Steffan Karger
Date:   Sun Nov 26 16:49:12 2017 +0100

     openssl: add missing #include statements

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg15936.html
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

Acked-by on v1 1/2

2018-06-29 12:23 UTC #4 lore raw

In reply to Steffan Karger

Acked-by Gert Doering <[email protected]...>

"because it makes sense".

Tested on FreeBSD/1.0.1u, Linux/1.0.2o, FreeBSD/1.1.0h. ("testing" = "it compiles, and openvpn --version prints the right version", so it's not worse than before :-) - a test compilation with -DOPENSSL_API_COMPAT=0x10100000L still explodes because 2/2 is missing)

Your patch has been applied to the master branch.

commit 17a476fd5c8cc49f1d103a50199e87ede76b1b67

Author: Steffan Karger
Date:   Sun Nov 26 16:04:00 2017 +0100

     openssl: don't use deprecated SSLEAY/SSLeay symbols

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg15934.html
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering