Remove OpenSSL < 3.0.x support

diff --git a/configure b/configure
index 80419fb1c54d4e404b7254f8aee31bb29c8282eb..4e60cff4ccc74806b897faa01277fe84b4c5e298 100755 (executable)
--- a/configure
+++ b/configure
@@ -10695,8 +10695,8 @@ fi
 
 done
 
-    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for OpenSSL version >= 1.1.1" >&5
-printf %s "checking for OpenSSL version >= 1.1.1... " >&6; }
+    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for OpenSSL version >= 3.0.0" >&5
+printf %s "checking for OpenSSL version >= 3.0.0... " >&6; }
     ac_ext=c
 ac_cpp='$CPP $CPPFLAGS'
 ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
@@ -10973,7 +10973,7 @@ printf "%s\n" "$ac_cv_path_EGREP_TRADITIONAL" >&6; }
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <openssl/crypto.h>
-       #if (OPENSSL_VERSION_NUMBER >= 0x10101000L)
+       #if (OPENSSL_VERSION_NUMBER >= 0x30000000L)
        yes
        #endif
 
@@ -15878,7 +15878,7 @@ else case e in #(
   e) cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
-          #include <stdlib.h>
+         #include <stdlib.h>
           #include <regex.h>
 
 int

diff --git a/configure.ac b/configure.ac
index 5d6c019f6bf56d9a295bbf6fc3394ada9ee6386d..34c831ee1e72a23c086cbb4299761700b663c901 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -1376,10 +1376,10 @@ if test "x$WITH_OPENSSL" = xyes; then
       ]
     )
 
-    AC_MSG_CHECKING([for OpenSSL version >= 1.1.1])
+    AC_MSG_CHECKING([for OpenSSL version >= 3.0.0])
     AC_EGREP_CPP(yes,
       [#include <openssl/crypto.h>
-       #if (OPENSSL_VERSION_NUMBER >= 0x10101000L)
+       #if (OPENSSL_VERSION_NUMBER >= 0x30000000L)
        yes
        #endif
       ],

diff --git a/src/bin/radclient-ng.c b/src/bin/radclient-ng.c
index 9257b0bc886425dacca2d3d002e6ac0f00c2a7c3..bef53a0fb1a91b6c9d31355545395860c35e6d8e 100644 (file)
--- a/src/bin/radclient-ng.c
+++ b/src/bin/radclient-ng.c
@@ -205,8 +205,7 @@ static int _rc_request_free(rc_request_t *request)
        return 0;
 }
 
-#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L
-#  include <openssl/provider.h>
+#include <openssl/provider.h>
 
 static OSSL_PROVIDER *openssl_default_provider = NULL;
 static OSSL_PROVIDER *openssl_legacy_provider = NULL;
@@ -248,10 +247,6 @@ static void openssl3_free(void)
        }
        openssl_legacy_provider = NULL;
 }
-#else
-#define openssl3_init()
-#define openssl3_free()
-#endif
 
 static int _loop_status(UNUSED fr_time_t now, fr_time_delta_t wake, UNUSED void *ctx)
 {

diff --git a/src/bin/radclient.c b/src/bin/radclient.c
index a3f89af0782b2f37364ca71c1e1114858db51ae1..4a6daf26bc613faa422b9282a281c2dc468f583e 100644 (file)
--- a/src/bin/radclient.c
+++ b/src/bin/radclient.c
@@ -195,8 +195,7 @@ static int _rc_request_free(rc_request_t *request)
        return 0;
 }
 
-#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L
-#  include <openssl/provider.h>
+#include <openssl/provider.h>
 
 static OSSL_PROVIDER *openssl_default_provider = NULL;
 static OSSL_PROVIDER *openssl_legacy_provider = NULL;
@@ -238,10 +237,6 @@ static void openssl3_free(void)
        }
        openssl_legacy_provider = NULL;
 }
-#else
-#define openssl3_init()
-#define openssl3_free()
-#endif
 
 static int mschapv1_encode(fr_packet_t *packet, fr_pair_list_t *list,
                           char const *password)

diff --git a/src/lib/eap/crypto.c b/src/lib/eap/crypto.c
index e39b4d2dd51a289f9eaaa1f2d46d65429a6dd2d4..7b7aa96359b1ecf54a963e6b1326ce9ad5aef1a4 100644 (file)
--- a/src/lib/eap/crypto.c
+++ b/src/lib/eap/crypto.c
@@ -130,9 +130,6 @@ int eap_crypto_mppe_keys(request_t *request, SSL *ssl, eap_tls_prf_label_t *prf_
 }
 
 int eap_crypto_tls_session_id(TALLOC_CTX *ctx,
-#if OPENSSL_VERSION_NUMBER < 0x10101000L
-                             UNUSED
-#endif
                              request_t *request, SSL *ssl, eap_tls_prf_label_t *prf_label,
                              uint8_t **out, uint8_t eap_type)
 {
@@ -157,7 +154,6 @@ int eap_crypto_tls_session_id(TALLOC_CTX *ctx,
                SSL_get_client_random(ssl, p, SSL3_RANDOM_SIZE);
                p += SSL3_RANDOM_SIZE;
                SSL_get_server_random(ssl, p, SSL3_RANDOM_SIZE);
-#if OPENSSL_VERSION_NUMBER >= 0x10101000L
                break;
 
        /*
@@ -180,7 +176,6 @@ int eap_crypto_tls_session_id(TALLOC_CTX *ctx,
                }
        }
                break;
-#endif
        }
        *out = buff;
 

diff --git a/src/lib/server/dependency.c b/src/lib/server/dependency.c
index 3e724029310141f5b440f0394ae62e21eafef1a2..8cdba7d2338bc569a75e1eb5576ef079974157c7 100644 (file)
--- a/src/lib/server/dependency.c
+++ b/src/lib/server/dependency.c
@@ -380,10 +380,6 @@ void dependency_version_print(void)
        CONF_PAIR *cp;
 
        if (DEBUG_ENABLED3) {
-#if defined(WITH_TLS) && (OPENSSL_VERSION_NUMBER < 0x30000000L)
-               ENGINE *engine;
-               char const *engine_id;
-#endif
                int max = 0, len;
 
                MEM(features = cf_section_alloc(NULL, NULL, "feature", NULL));
@@ -408,15 +404,6 @@ void dependency_version_print(void)
                        if (max < len) max = len;
                }
 
-#if defined(WITH_TLS) && (OPENSSL_VERSION_NUMBER < 0x30000000L)
-               for (engine = ENGINE_get_first();
-                    engine;
-                    engine = ENGINE_get_next(engine)) {
-                       len = strlen(ENGINE_get_id(engine) + 1);
-                       if (max < len) max = len;
-               }
-#endif
-
                for (ci = cf_item_next(features, NULL);
                     ci;
                     ci = cf_item_next(features, ci)) {
@@ -446,18 +433,6 @@ void dependency_version_print(void)
                talloc_free(features);
                talloc_free(versions);
 
-#if defined(WITH_TLS) && (OPENSSL_VERSION_NUMBER < 0x30000000L)
-               DEBUG3("OpenSSL engines:");
-               for (engine = ENGINE_get_first();
-                    engine;
-                    engine = ENGINE_get_next(engine)) {
-                       engine_id = ENGINE_get_id(engine);
-
-                       DEBUG3("  %s%.*s : %s", engine_id, (int)(max - (strlen(engine_id) + 1)), spaces,
-                              ENGINE_get_name(engine));
-               }
-#endif
-
                DEBUG2("Endianness:");
 #ifdef WORDS_BIGENDIAN
                DEBUG2("  big");

diff --git a/src/lib/server/password.c b/src/lib/server/password.c
index 669c815efe18d82f9cceaf09b2f72bfbe4efb5bf..be2e3c363037e3c9ecd522e9d219ddd2accf09b7 100644 (file)
--- a/src/lib/server/password.c
+++ b/src/lib/server/password.c
@@ -218,12 +218,10 @@ static fr_table_num_sorted_t const password_header_table[] = {
 #ifdef HAVE_OPENSSL_EVP_H
        { L("{ssha224}"),                       FR_SSHA2_224    },
        { L("{ssha256}"),                       FR_SSHA2_256    },
-#  if OPENSSL_VERSION_NUMBER >= 0x10101000L
        { L("{ssha3-224}"),                     FR_SSHA3_224    },
        { L("{ssha3-256}"),                     FR_SSHA3_256    },
        { L("{ssha3-384}"),                     FR_SSHA3_384    },
        { L("{ssha3-512}"),                     FR_SSHA3_512    },
-#  endif
        { L("{ssha384}"),                       FR_SSHA2_384    },
        { L("{ssha512}"),                       FR_SSHA2_512    },
 #endif
@@ -237,9 +235,7 @@ static size_t password_header_table_len = NUM_ELEMENTS(password_header_table);
 
 #ifdef HAVE_OPENSSL_EVP_H
 static fr_pair_t *password_process_sha2(TALLOC_CTX *ctx, request_t *request, fr_pair_t *known_good);
-#  if OPENSSL_VERSION_NUMBER >= 0x10101000L
 static fr_pair_t *password_process_sha3(TALLOC_CTX *ctx, request_t *request, fr_pair_t *known_good);
-#  endif
 #endif
 static fr_pair_t *password_process_header(TALLOC_CTX *ctx, request_t *request, fr_pair_t *known_good);
 
@@ -318,7 +314,6 @@ static password_info_t password_info[] = {
                                                .da = &attr_sha2_512,
                                                .min_hash_len = SHA512_DIGEST_LENGTH,
                                        },
-#  if OPENSSL_VERSION_NUMBER >= 0x10101000L
        [FR_SHA3]                       = {
                                                .type = PASSWORD_HASH_VARIABLE,
                                                .da = &attr_sha3,
@@ -345,7 +340,6 @@ static password_info_t password_info[] = {
                                                .da = &attr_sha3_512,
                                                .min_hash_len = SHA512_DIGEST_LENGTH
                                        },
-#  endif
 #endif
        [FR_SMD5]                       = {
                                                .type = PASSWORD_HASH,
@@ -378,7 +372,6 @@ static password_info_t password_info[] = {
                                                .da = &attr_ssha2_512,
                                                .min_hash_len = SHA512_DIGEST_LENGTH
                                        },
-#  if OPENSSL_VERSION_NUMBER >= 0x10101000L
        [FR_SSHA3_224]                  = {
                                                .type = PASSWORD_HASH_SALTED,
                                                .da = &attr_ssha3_224,
@@ -399,7 +392,6 @@ static password_info_t password_info[] = {
                                                .da = &attr_ssha3_512,
                                                .min_hash_len = SHA512_DIGEST_LENGTH
                                        }
-#  endif
 #endif
 };
 
@@ -559,7 +551,6 @@ static fr_pair_t *password_process_sha2(TALLOC_CTX *ctx, request_t *request, fr_
        }
 }
 
-#  if OPENSSL_VERSION_NUMBER >= 0x10101000L
 /** Split SHA3 hashes into separate attributes based on their length
  *
  * @param[in] ctx              to allocate attributes in.
@@ -604,7 +595,6 @@ static fr_pair_t *password_process_sha3(TALLOC_CTX *ctx, request_t *request, fr_
                return normalised;
        }
 }
-#  endif
 #endif
 
 /** Convert a Password.With-Header attribute to the correct type

diff --git a/src/lib/tls/base.c b/src/lib/tls/base.c
index dd951b942c4694a9f3ece3dcf25bc4b7518fb7cd..a963fdf55fe7fe57e1008f18674d39e05ad59d5f 100644 (file)
--- a/src/lib/tls/base.c
+++ b/src/lib/tls/base.c
@@ -34,9 +34,7 @@ USES_APPLE_DEPRECATED_API     /* OpenSSL API has been deprecated by Apple */
 #include "bio.h"
 
 #include <openssl/conf.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#  include <openssl/provider.h>
-#endif
+#include <openssl/provider.h>
 
 #include <freeradius-devel/server/base.h>
 #include <freeradius-devel/tls/attrs.h>
@@ -58,10 +56,8 @@ _Thread_local TALLOC_CTX     *ssl_talloc_ctx;
  */
 static _Thread_local bool      *async_pool_init;
 
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 static OSSL_PROVIDER *openssl_default_provider = NULL;
 static OSSL_PROVIDER *openssl_legacy_provider = NULL;
-#endif
 
 static uint32_t tls_instance_count = 0;
 
@@ -349,7 +345,6 @@ void fr_openssl_free(void)
        fr_tls_bio_free();
 }
 
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
 static void _openssl_provider_free(void)
 {
        if (openssl_default_provider && !OSSL_PROVIDER_unload(openssl_default_provider)) {
@@ -362,14 +357,6 @@ static void _openssl_provider_free(void)
        }
        openssl_legacy_provider = NULL;
 }
-#endif
-
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
-static void _openssl_engine_free(void)
-{
-       fr_tls_engine_free_all();
-}
-#endif
 
 static int fr_openssl_cleanup(UNUSED void *uctx)
 {
@@ -411,7 +398,6 @@ int fr_openssl_init(void)
                return -1;
        }
 
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
        /*
         *      Load the default provider for most algorithms
         */
@@ -431,20 +417,13 @@ int fr_openssl_init(void)
                fr_tls_log(NULL, "Failed loading legacy provider");
                return -1;
        }
-#endif
 
        /*
         *      It's best to use OpenSSL's cleanup stack
         *      as then everything is cleaned up relative
         *      to the OPENSSL_cleanup() call.
         */
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
        OPENSSL_atexit(_openssl_provider_free);
-#endif
-
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
-       OPENSSL_atexit(_openssl_engine_free);
-#endif
 
        /*
         *      SHA256 is in all versions of OpenSSL, but isn't
@@ -453,14 +432,6 @@ int fr_openssl_init(void)
         */
        EVP_add_digest(EVP_sha256());
 
-       /*
-        *      FIXME - This should be done _after_
-        *      running any engine controls.
-        */
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
-       fr_tls_engine_load_builtin();
-#endif
-
        fr_tls_log_init();
 
        fr_tls_bio_init();
@@ -489,17 +460,10 @@ int fr_openssl_init(void)
  */
 int fr_openssl_fips_mode(bool enabled)
 {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
        if (!EVP_set_default_properties(NULL, enabled ? "fips=yes" : "fips=no")) {
                fr_tls_log(NULL, "Failed %s OpenSSL FIPS mode", enabled ? "enabling" : "disabling");
                return -1;
        }
-#else
-       if (!FIPS_mode_set(enabled ? 1 : 0)) {
-               fr_tls_log(NULL, "Failed %s OpenSSL FIPS mode", enabled ? "enabling" : "disabling");
-               return -1;
-       }
-#endif
 
        return 0;
 }

diff --git a/src/lib/tls/cache.c b/src/lib/tls/cache.c
index 896d93d9d792dbbd32e888dacfa5c94d5a52b13c..47366421e44a4f9536731b4760f44866a39ab660 100644 (file)
--- a/src/lib/tls/cache.c
+++ b/src/lib/tls/cache.c
@@ -1148,7 +1148,6 @@ void tls_cache_disable_stateless_resumption(SSL_CTX *ctx)
        ctx_options |= SSL_OP_NO_TICKET;
        SSL_CTX_set_options(ctx, ctx_options);
 
-#if OPENSSL_VERSION_NUMBER >= 0x10101000L
        /*
         *      This controls the number of stateful or stateless
         *      tickets generated with TLS 1.3.  In OpenSSL 1.1.0
@@ -1156,7 +1155,6 @@ void tls_cache_disable_stateless_resumption(SSL_CTX *ctx)
         *      SSL_SESS_CACHE_OFF is not good enough.
         */
        SSL_CTX_set_num_tickets(ctx, 0);
-#endif
 }
 
 /** Disable stateful session resumption for a given TLS ctx
@@ -1501,9 +1499,7 @@ int fr_tls_cache_ctx_init(SSL_CTX *ctx, fr_tls_cache_conf_t const *cache_conf)
                 *      many session tickets by default (2), and we only
                 *      need one.
                 */
-#if OPENSSL_VERSION_NUMBER >= 0x10101000L
                SSL_CTX_set_num_tickets(ctx, 1);
-#endif
        }
                break;
        }

diff --git a/src/lib/tls/conf.c b/src/lib/tls/conf.c
index 421cf4e8ee42fb00dc3a6add203353a4f07b246e..100448229f88ebe4bbc7742000860b804b397530 100644 (file)
--- a/src/lib/tls/conf.c
+++ b/src/lib/tls/conf.c
@@ -92,10 +92,8 @@ static conf_parser_t tls_cache_config[] = {
                         .dflt = "%{EAP-Type}%interpreter(server)", .quote = T_DOUBLE_QUOTED_STRING },
        { FR_CONF_OFFSET("lifetime", fr_tls_cache_conf_t, lifetime), .dflt = "1d" },
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
        { FR_CONF_OFFSET("require_extended_master_secret", fr_tls_cache_conf_t, require_extms), .dflt = "yes" },
        { FR_CONF_OFFSET("require_perfect_forward_secrecy", fr_tls_cache_conf_t, require_pfs), .dflt = "no" },
-#endif
 
        { FR_CONF_OFFSET("session_ticket_key", fr_tls_cache_conf_t, session_ticket_key) },
 

diff --git a/src/lib/tls/ctx.c b/src/lib/tls/ctx.c
index 66d2d6b0dfab6d50005c83c585e958d72f9cbbe1..66808f4d85ba83e9e203ecae12525b848b435d0b 100644 (file)
--- a/src/lib/tls/ctx.c
+++ b/src/lib/tls/ctx.c
@@ -46,9 +46,7 @@ USES_APPLE_DEPRECATED_API     /* OpenSSL API has been deprecated by Apple */
 #include <openssl/rand.h>
 #include <openssl/dh.h>
 #include <openssl/x509v3.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#  include <openssl/provider.h>
-#endif
+#include <openssl/provider.h>
 
 #ifndef OPENSSL_NO_ECDH
 static int ctx_ecdh_curve_set(SSL_CTX *ctx, char const *ecdh_curve, bool disable_single_dh_use)
@@ -80,11 +78,7 @@ static int ctx_dh_params_load(SSL_CTX *ctx, char *file)
        BIO     *bio;
        int     ret;
 
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
        EVP_PKEY *dh = NULL;
-#else
-       DH *dh = NULL;
-#endif
 
        if (!file) return 0;
 
@@ -98,27 +92,17 @@ static int ctx_dh_params_load(SSL_CTX *ctx, char *file)
         *
         * Change suggested by @t8m
         */
-#if OPENSSL_VERSION_NUMBER >= 0x10101000L
-#  if OPENSSL_VERSION_NUMBER >= 0x30000000L
        if (EVP_default_properties_is_fips_enabled(NULL)) {
-#  else
-       if (FIPS_mode() > 0) {
-#endif
                WARN(LOG_PREFIX ": Ignoring user-selected DH parameters in FIPS mode. Using defaults.");
                return 0;
        }
-#endif
 
        if ((bio = BIO_new_file(file, "r")) == NULL) {
                ERROR("Unable to open DH file - %s", file);
                return -1;
        }
 
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
        dh = PEM_read_bio_Parameters(bio, &dh);
-#else
-       dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
-#endif
        BIO_free(bio);
        if (!dh) {
                WARN("Unable to set DH parameters.  DH cipher suites may not work!");
@@ -126,13 +110,7 @@ static int ctx_dh_params_load(SSL_CTX *ctx, char *file)
                return 0;
        }
 
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
        ret = SSL_CTX_set0_tmp_dh_pkey(ctx, dh);
-#else
-       ret = SSL_CTX_set_tmp_dh(ctx, dh);
-       DH_free(dh);
-#endif
-
        if (ret < 0) {
                ERROR("Unable to set DH parameters");
                return -1;
@@ -460,13 +438,9 @@ DIAG_ON(DIAG_UNKNOWN_PRAGMAS)
 
 static inline CC_HINT(always_inline)
 int tls_ctx_version_set(
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
                        UNUSED
-#endif
                        int *ctx_options, SSL_CTX *ctx, fr_tls_conf_t const *conf)
 {
-
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
        /*
         *      SSL_CTX_set_(min|max)_proto_version was included in OpenSSL 1.1.0
         *
@@ -552,45 +526,6 @@ int tls_ctx_version_set(
                        goto error;
                }
        }
-#else
-       /*
-        *      OpenSSL < 1.1.0 - This doesn't need to change when new TLS versions are issued
-        *      as new TLS versions will never be added to older OpenSSL versions.
-        */
-       {
-               int ctx_tls_versions = 0;
-
-               /*
-                *      We never want SSLv2 or SSLv3.
-                */
-               *ctx_options |= SSL_OP_NO_SSLv2;
-               *ctx_options |= SSL_OP_NO_SSLv3;
-
-#  ifdef SSL_OP_NO_TLSv1
-               if (conf->tls_min_version > (float) 1.0) *ctx_options |= SSL_OP_NO_TLSv1;
-               ctx_tls_versions |= SSL_OP_NO_TLSv1;
-#  endif
-#  ifdef SSL_OP_NO_TLSv1_1
-               if (conf->tls_min_version > (float) 1.1) *ctx_options |= SSL_OP_NO_TLSv1_1;
-               if ((conf->tls_max_version > (float) 0.0) && (conf->tls_max_version < (float) 1.1)) {
-                       *ctx_options |= SSL_OP_NO_TLSv1_1;
-               }
-               ctx_tls_versions |= SSL_OP_NO_TLSv1_1;
-#  endif
-#  ifdef SSL_OP_NO_TLSv1_2
-               if (conf->tls_min_version > (float) 1.2) *ctx_options |= SSL_OP_NO_TLSv1_2;
-               if ((conf->tls_max_version > (float) 0.0) && (conf->tls_max_version < (float) 1.2)) {
-                       *ctx_options |= SSL_OP_NO_TLSv1_2;
-               }
-               ctx_tls_versions |= SSL_OP_NO_TLSv1_2;
-#  endif
-
-               if ((*ctx_options & ctx_tls_versions) == ctx_tls_versions) {
-                       ERROR("You have disabled all available TLS versions");
-                       goto error;
-               }
-       }
-#endif
 
        return 0;
 }
@@ -928,13 +863,11 @@ post_ca:
         *      SSL_CTX_set_tmp_dh_callback(ctx, cbtls_dh);
         */
 
-#if OPENSSL_VERSION_NUMBER >= 0x10101000L
        /*
         *      Set the block size for record padding.  This is only
         *      used in TLS 1.3.
         */
        if (conf->padding_block_size) SSL_CTX_set_block_padding(ctx, conf->padding_block_size);
-#endif
 
        /*
         *      Set elliptical curve crypto configuration.
@@ -969,7 +902,7 @@ post_ca:
                X509_STORE_set_flags(cert_vpstore, X509_V_FLAG_USE_DELTAS);
 #endif
        }
-#endif
+
 
        /*
         *      SSL_ctx_set_verify is now called in the session
@@ -1035,14 +968,12 @@ post_ca:
         */
        if (fr_tls_cache_ctx_init(ctx, &conf->cache) < 0) goto error;
 
-#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
        /*
         *      Set the keylog file if the admin requested it.
         */
        if ((getenv("SSLKEYLOGFILE") != NULL) || (conf->keylog_file && *conf->keylog_file)) {
                SSL_CTX_set_keylog_callback(ctx, fr_tls_session_keylog_cb);
        }
-#endif
 
        return ctx;
 }

diff --git a/src/lib/tls/session.c b/src/lib/tls/session.c
index da96c9c3fbe0dd3cd8df4679e047192921e4d24f..d27c1fa2f8ff544b565fd0a4031c8084c1964cfc 100644 (file)
--- a/src/lib/tls/session.c
+++ b/src/lib/tls/session.c
@@ -848,7 +848,6 @@ void fr_tls_session_msg_cb(int write_p, int msg_version, int content_type,
 #endif
 }
 
-#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
 /*
  *  By setting the environment variable SSLKEYLOGFILE to a filename keying
  *  material will be exported that you may use with Wireshark to decode any
@@ -921,7 +920,6 @@ void fr_tls_session_keylog_cb(const SSL *ssl, const char *line)
 
        close(fd);
 }
-#endif
 
 /** Decrypt application data
  *
@@ -1382,7 +1380,6 @@ static unlang_action_t tls_session_async_handshake_cont(rlm_rcode_t *p_result, i
                return UNLANG_ACTION_CALCULATE_RESULT;
        }
 
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
        /*
         *      Bug in OpenSSL 3.0 - Normal handshaking behaviour
         *      results in spurious "BIO_R_UNSUPPORTED_METHOD"
@@ -1418,7 +1415,6 @@ DIAG_OFF(used-but-marked-unused)
 DIAG_ON(used-but-marked-unused)
 DIAG_ON(DIAG_UNKNOWN_PRAGMAS)
        }
-#endif
 
        /*
         *      Deal with asynchronous requests from OpenSSL.

diff --git a/src/lib/tls/strerror.c b/src/lib/tls/strerror.c
index 80451e14a99890819a08e8afc4bd6aad74435aff..68c4ed2b7bb9da4dab7adb25a3c9b8361d768af1 100644 (file)
--- a/src/lib/tls/strerror.c
+++ b/src/lib/tls/strerror.c
@@ -35,17 +35,6 @@ USES_APPLE_DEPRECATED_API    /* OpenSSL API has been deprecated by Apple */
 #include "strerror.h"
 #include "utils.h"
 
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
-static inline unsigned long ERR_get_error_all(const char **file, int *line,
-                                             const char **func,
-                                             const char **data, int *flags)
-{
-       if (func != NULL) *func = "";
-
-       return ERR_get_error_line_data(file, line, data, flags);
-}
-#endif
-
 DIAG_OFF(DIAG_UNKNOWN_PRAGMAS)
 DIAG_OFF(used-but-marked-unused)       /* fix spurious warnings for sk macros */
 static void _tls_cert_line_push(char const *file, int line, int idx, X509 *cert)

diff --git a/src/lib/tls/verify.c b/src/lib/tls/verify.c
index 3903553b74c9ef9660c976a43e0ced349d8a1525..39dd73e484c5cc58810926dd7ef5327bbb19d386 100644 (file)
--- a/src/lib/tls/verify.c
+++ b/src/lib/tls/verify.c
@@ -182,12 +182,7 @@ int fr_tls_verify_cert_cb(int ok, X509_STORE_CTX *x509_ctx)
                STACK_OF(X509)  *our_chain;
                int             i;
 
-#if OPENSSL_VERSION_NUMBER >= 0x10101000L
                our_chain = X509_STORE_CTX_get0_chain(x509_ctx);
-#else
-               our_chain = X509_STORE_CTX_get_chain(x509_ctx);
-#endif
-
                RDEBUG3("Certificate chain - %i cert(s) untrusted", untrusted);
                for (i = sk_X509_num(our_chain); i > 0 ; i--) {
                        X509 *this_cert = sk_X509_value(our_chain, i - 1);
@@ -358,11 +353,7 @@ int fr_tls_verify_cert_chain(request_t *request, SSL *ssl)
        /*
         *      If there's no client certificate, we just return OK.
         */
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
        cert = SSL_get0_peer_certificate(ssl);                  /* Does not increase ref count */
-#else
-       cert = SSL_get_peer_certificate(ssl);                   /* Increases ref count */
-#endif
        if (!cert) return 1;
 
        ssl_ctx = SSL_get_SSL_CTX(ssl);
@@ -400,9 +391,6 @@ int fr_tls_verify_cert_chain(request_t *request, SSL *ssl)
                }
        }
 
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
-       X509_free(cert);
-#endif
        X509_STORE_CTX_free(store_ctx);
 
        return ret;

diff --git a/src/lib/tls/version.c b/src/lib/tls/version.c
index 224ebf663247f7b1e48fa7672eadfd1eb5f443f2..135d0f83c8e2bcbfa7a9de58710e0704050708a4 100644 (file)
--- a/src/lib/tls/version.c
+++ b/src/lib/tls/version.c
@@ -51,11 +51,7 @@ int fr_openssl_version_consistent(void)
 {
        unsigned long ssl_linked;
 
-#if OPENSSL_VERSION_NUMBER >= 0x10101000L
        ssl_linked = OpenSSL_version_num();
-#else
-       ssl_linked = (unsigned long)SSLeay();
-#endif
 
        /*
         *      Major and minor versions mismatch, that's bad.
@@ -159,7 +155,6 @@ char const *fr_openssl_version_range(uint32_t low, uint32_t high)
        return buffer;
 }
 
-#  if OPENSSL_VERSION_NUMBER >= 0x10101000L
 /** Return the linked SSL version number as a string
  *
  * @return pointer to a static buffer containing the version string.
@@ -191,40 +186,6 @@ char const *fr_openssl_version_expanded(void)
 
        return buffer;
 }
-#  else
-/** Return the linked SSL version number as a string
- *
- * @return pointer to a static buffer containing the version string.
- */
-char const *fr_openssl_version_basic(void)
-{
-       long ssl_linked;
-
-       ssl_linked = SSLeay();
-       return fr_openssl_version_str_from_num((uint32_t)ssl_linked);
-}
-
-/** Print the current linked version of Openssl
- *
- * Print the currently linked version of the OpenSSL library.
- *
- * @note Not thread safe.
- *
- * @return pointer to a static buffer containing libssl version information.
- */
-char const *fr_openssl_version_expanded(void)
-{
-       static _Thread_local char buffer[256];
-       long ssl_linked = SSLeay();
-
-       snprintf(buffer, sizeof(buffer), "%s 0x%.8x (%s)",
-                SSLeay_version(SSLEAY_VERSION),                /* Not all builds include a useful version number */
-                ssl_linked,
-                fr_openssl_version_str_from_num(v));
-
-       return buffer;
-}
-#  endif
 
 #  ifdef ENABLE_OPENSSL_VERSION_CHECK
 typedef struct {
@@ -284,13 +245,7 @@ int fr_openssl_version_check(char const *acknowledged)
        if (strcmp(acknowledged, "yes") == 0) return 0;
 
        /* Check for bad versions */
-
-#    if OPENSSL_VERSION_NUMBER >= 0x10101000L
        ssl_linked = OpenSSL_version_num();
-#    else
-       ssl_linked = (unsigned long)SSLeay();
-#    endif
-
        for (i = 0; i < (NUM_ELEMENTS(fr_openssl_defects)); i++) {
                fr_openssl_defect_t *defect = &fr_openssl_defects[i];
 

diff --git a/src/lib/unlang/xlat_builtin.c b/src/lib/unlang/xlat_builtin.c
index d4f069aa4870d35941951ccc86cbf8f57da3ef7b..a238815f96cf6dd69973ed129083f007d25956a4 100644 (file)
--- a/src/lib/unlang/xlat_builtin.c
+++ b/src/lib/unlang/xlat_builtin.c
@@ -2914,12 +2914,10 @@ EVP_MD_XLAT(blake2s_256, blake2s256)
 EVP_MD_XLAT(blake2b_512, blake2b512)
 #endif
 
-#  if OPENSSL_VERSION_NUMBER >= 0x10101000L
 EVP_MD_XLAT(sha3_224, sha3_224)
 EVP_MD_XLAT(sha3_256, sha3_256)
 EVP_MD_XLAT(sha3_384, sha3_384)
 EVP_MD_XLAT(sha3_512, sha3_512)
-#  endif
 #endif
 
 
@@ -4158,12 +4156,10 @@ do { \
        XLAT_REGISTER_PURE("blake2b_512", xlat_func_blake2b_512, FR_TYPE_OCTETS, xlat_func_sha_arg);
 #  endif
 
-#  if OPENSSL_VERSION_NUMBER >= 0x10101000L
        XLAT_REGISTER_PURE("sha3_224", xlat_func_sha3_224, FR_TYPE_OCTETS, xlat_func_sha_arg);
        XLAT_REGISTER_PURE("sha3_256", xlat_func_sha3_256, FR_TYPE_OCTETS, xlat_func_sha_arg);
        XLAT_REGISTER_PURE("sha3_384", xlat_func_sha3_384, FR_TYPE_OCTETS, xlat_func_sha_arg);
        XLAT_REGISTER_PURE("sha3_512", xlat_func_sha3_512, FR_TYPE_OCTETS, xlat_func_sha_arg);
-#  endif
 #endif
 
        XLAT_REGISTER_PURE("string", xlat_func_string, FR_TYPE_STRING, xlat_func_string_arg);

diff --git a/src/lib/util/md4.c b/src/lib/util/md4.c
index b5564f72eb4799fc57eb4979685d38aa97914d6a..8f0f3e17b6b6689d24065998753e49f332e45cc5 100644 (file)
--- a/src/lib/util/md4.c
+++ b/src/lib/util/md4.c
@@ -37,10 +37,7 @@ static _Thread_local fr_md4_free_list_t *md4_array;
 #  include <openssl/evp.h>
 #  include <openssl/crypto.h>
 #  include <openssl/err.h>
-
-#  if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#    include <openssl/provider.h>
-#  endif
+#  include <openssl/provider.h>
 
 static int have_openssl_md4 = -1;
 
@@ -322,11 +319,7 @@ static fr_md4_ctx_t *fr_md4_local_ctx_alloc(void)
                 *      md4 functions, and call the OpenSSL init
                 *      function.
                 */
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
                if (!EVP_default_properties_is_fips_enabled(NULL)) {
-#else
-               if (FIPS_mode() == 0) {
-#endif
                        have_openssl_md4 = 1;
 
                        /*

diff --git a/src/lib/util/md5.c b/src/lib/util/md5.c
index c3c60049cd3a1776740782409276b17294411651..9ec77909d2526dcd03bdc53b065a260c8535e354 100644 (file)
--- a/src/lib/util/md5.c
+++ b/src/lib/util/md5.c
@@ -38,10 +38,7 @@ static _Thread_local fr_md5_free_list_t *md5_array;
 #  include <openssl/evp.h>
 #  include <openssl/crypto.h>
 #  include <openssl/err.h>
-
-#  if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#    include <openssl/provider.h>
-#  endif
+#  include <openssl/provider.h>
 
 static int have_openssl_md5 = -1;
 
@@ -317,11 +314,7 @@ static fr_md5_ctx_t *fr_md5_local_ctx_alloc(void)
                 *      md5 functions, and call the OpenSSL init
                 *      function.
                 */
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
                if (!EVP_default_properties_is_fips_enabled(NULL)) {
-#else
-               if (FIPS_mode() == 0) {
-#endif
                        have_openssl_md5 = 1;
 
                        /*

diff --git a/src/modules/rlm_cipher/rlm_cipher.c b/src/modules/rlm_cipher/rlm_cipher.c
index 92098d6c8425197cf0a65f87903cb81ea8d6353d..24fda7f2b4c129a7972d2c54a18bfad00e0745ba 100644 (file)
--- a/src/modules/rlm_cipher/rlm_cipher.c
+++ b/src/modules/rlm_cipher/rlm_cipher.c
@@ -59,6 +59,8 @@ static int cipher_rsa_certificate_file_load(TALLOC_CTX *ctx, void *out, UNUSED v
 typedef enum {
        RLM_CIPHER_TYPE_INVALID = 0,
        RLM_CIPHER_TYPE_RSA = 1,
+       RLM_CIPHER_TYPE_SYMMETRIC = 2                           //!< Any symmetric cipher available via
+                                                               ///< OpenSSL's EVP interface.
 } cipher_type_t;
 
 /** Certificate validation modes
@@ -99,15 +101,13 @@ static fr_table_num_sorted_t const cipher_rsa_padding[] = {
        { L("none"),    RSA_NO_PADDING          },
        { L("oaep"),    RSA_PKCS1_OAEP_PADDING  },              /* PKCS OAEP padding */
        { L("pkcs"),    RSA_PKCS1_PADDING       },              /* PKCS 1.5 */
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
-       { L("ssl"),     RSA_SSLV23_PADDING      },
-#endif
        { L("x931"),    RSA_X931_PADDING        }
 };
 static size_t cipher_rsa_padding_len = NUM_ELEMENTS(cipher_rsa_padding);
 
 static fr_table_num_sorted_t const cipher_type[] = {
-       { L("rsa"),     RLM_CIPHER_TYPE_RSA     }
+       { L("rsa"),             RLM_CIPHER_TYPE_RSA             },
+       { L("symmetric"),       RLM_CIPHER_TYPE_SYMMETRIC       }
 };
 static size_t cipher_type_len = NUM_ELEMENTS(cipher_type);
 
@@ -235,7 +235,6 @@ static const conf_parser_t rsa_config[] = {
 static const conf_parser_t module_config[] = {
        { FR_CONF_OFFSET_TYPE_FLAGS("type", FR_TYPE_VOID, CONF_FLAG_NOT_EMPTY, rlm_cipher_t, type), .func = cipher_type_parse, .dflt = "rsa" },
        { FR_CONF_OFFSET_SUBSECTION("rsa", 0, rlm_cipher_t, rsa, rsa_config), .subcs_size = sizeof(cipher_rsa_t), .subcs_type = "cipher_rsa_t" },
-
        CONF_PARSER_TERMINATOR
 };
 
@@ -1035,9 +1034,6 @@ static int cipher_rsa_padding_params_set(EVP_PKEY_CTX *evp_pkey_ctx, cipher_rsa_
        switch (rsa_inst->padding) {
        case RSA_NO_PADDING:
        case RSA_X931_PADDING:
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
-       case RSA_SSLV23_PADDING:
-#endif
        case RSA_PKCS1_PADDING:
                return 0;
 

diff --git a/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.h b/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.h
index 47e41f63c49a6a24d0081a9174ae08db4e3e98b1..c6aeeb14bbc182b105731f5ed82aa22c57abbf48 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.h
+++ b/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.h
@@ -41,11 +41,6 @@ RCSIDH(eap_pwd_h, "$Id$")
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
 
-#if OPENSSL_VERSION_NUMBER < 0x10101000L
-#  define EC_POINT_get_affine_coordinates EC_POINT_get_affine_coordinates_GFp
-#  define EC_POINT_set_affine_coordinates EC_POINT_set_affine_coordinates_GFp
-#endif
-
 typedef struct {
     uint8_t lm_exchange;
 #define EAP_PWD_EXCH_ID                1

diff --git a/src/modules/rlm_pap/rlm_pap.c b/src/modules/rlm_pap/rlm_pap.c
index 9e5430140560bc3cc79ac017842df36c05280dec..50818f979867e98520f89503d6dc9a7290019d21 100644 (file)
--- a/src/modules/rlm_pap/rlm_pap.c
+++ b/src/modules/rlm_pap/rlm_pap.c
@@ -122,12 +122,10 @@ static fr_table_num_sorted_t const pbkdf2_crypt_names[] = {
        { L("HMACSHA2+256"),    FR_SSHA2_256 },
        { L("HMACSHA2+384"),    FR_SSHA2_384 },
        { L("HMACSHA2+512"),    FR_SSHA2_512 },
-#  if OPENSSL_VERSION_NUMBER >= 0x10101000L
        { L("HMACSHA3+224"),    FR_SSHA3_224 },
        { L("HMACSHA3+256"),    FR_SSHA3_256 },
        { L("HMACSHA3+384"),    FR_SSHA3_384 },
        { L("HMACSHA3+512"),    FR_SSHA3_512 },
-#  endif
 };
 static size_t pbkdf2_crypt_names_len = NUM_ELEMENTS(pbkdf2_crypt_names);
 
@@ -431,7 +429,6 @@ PAP_AUTH_EVP_MD(pap_auth_evp_md_salted, pap_auth_ssha2_256, "SSHA2-256", EVP_sha
 PAP_AUTH_EVP_MD(pap_auth_evp_md_salted, pap_auth_ssha2_384, "SSHA2-384", EVP_sha384())
 PAP_AUTH_EVP_MD(pap_auth_evp_md_salted, pap_auth_ssha2_512, "SSHA2-512", EVP_sha512())
 
-#  if OPENSSL_VERSION_NUMBER >= 0x10101000L
 PAP_AUTH_EVP_MD(pap_auth_evp_md, pap_auth_sha3_224, "SHA3-224", EVP_sha3_224())
 PAP_AUTH_EVP_MD(pap_auth_evp_md, pap_auth_sha3_256, "SHA3-256", EVP_sha3_256())
 PAP_AUTH_EVP_MD(pap_auth_evp_md, pap_auth_sha3_384, "SHA3-384", EVP_sha3_384())
@@ -440,7 +437,6 @@ PAP_AUTH_EVP_MD(pap_auth_evp_md_salted, pap_auth_ssha3_224, "SSHA3-224", EVP_sha
 PAP_AUTH_EVP_MD(pap_auth_evp_md_salted, pap_auth_ssha3_256, "SSHA3-256", EVP_sha3_256())
 PAP_AUTH_EVP_MD(pap_auth_evp_md_salted, pap_auth_ssha3_384, "SSHA3-384", EVP_sha3_384())
 PAP_AUTH_EVP_MD(pap_auth_evp_md_salted, pap_auth_ssha3_512, "SSHA3-512", EVP_sha3_512())
-#  endif
 
 /** Validates Crypt::PBKDF2 LDAP format strings
  *
@@ -527,7 +523,6 @@ static inline CC_HINT(nonnull) unlang_action_t pap_auth_pbkdf2_parse(rlm_rcode_t
                digest_len = SHA512_DIGEST_LENGTH;
                break;
 
-#  if OPENSSL_VERSION_NUMBER >= 0x10101000L
        case FR_SSHA3_224:
                evp_md = EVP_sha3_224();
                digest_len = SHA224_DIGEST_LENGTH;
@@ -547,7 +542,6 @@ static inline CC_HINT(nonnull) unlang_action_t pap_auth_pbkdf2_parse(rlm_rcode_t
                evp_md = EVP_sha3_512();
                digest_len = SHA512_DIGEST_LENGTH;
                break;
-#  endif
 
        default:
                REDEBUG("Unknown PBKDF2 hash method \"%.*s\"", (int)(q - p), p);
@@ -889,8 +883,6 @@ static const pap_auth_func_t auth_func_table[] = {
        [FR_SSHA2_256]  = pap_auth_ssha2_256,
        [FR_SSHA2_384]  = pap_auth_ssha2_384,
        [FR_SSHA2_512]  = pap_auth_ssha2_512,
-
-#  if OPENSSL_VERSION_NUMBER >= 0x10101000L
        [FR_SHA3]       = pap_auth_dummy,
        [FR_SHA3_224]   = pap_auth_sha3_224,
        [FR_SHA3_256]   = pap_auth_sha3_256,
@@ -900,7 +892,6 @@ static const pap_auth_func_t auth_func_table[] = {
        [FR_SSHA3_256]  = pap_auth_ssha3_256,
        [FR_SSHA3_384]  = pap_auth_ssha3_384,
        [FR_SSHA3_512]  = pap_auth_ssha3_512,
-#  endif
 #endif /* HAVE_OPENSSL_EVP_H */
 };