- For #515: Fix compilation with openssl 3.0.0 beta2, lib64 dir and

  SSL_get_peer_certificate.
- Move acx_nlnetlabs.m4 to version 41, with lib64 openssl dir check.

diff --git a/acx_nlnetlabs.m4 b/acx_nlnetlabs.m4
index 7ce7907080550c85d7b820d250770a5f91f4cd7f..39e92d875331b2e695d82a9e947be64b1e386bec 100644 (file)
--- a/acx_nlnetlabs.m4
+++ b/acx_nlnetlabs.m4
@@ -2,7 +2,8 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 40
+# Version 41
+# 2021-07-30 fix for openssl use of lib64 directory.
 # 2021-06-14 fix nonblocking test to use host instead of target for mingw test.
 # 2021-05-17 fix nonblocking socket test from grep on mingw32 to mingw for
 #           64bit compatibility.
@@ -669,9 +670,15 @@ AC_DEFUN([ACX_SSL_CHECKS], [
             HAVE_SSL=yes
             dnl assume /usr is already in the lib and dynlib paths.
             if test "$ssldir" != "/usr" -a "$ssldir" != ""; then
-                LDFLAGS="$LDFLAGS -L$ssldir/lib"
-                LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir/lib"
-                ACX_RUNTIME_PATH_ADD([$ssldir/lib])
+               if test ! -d "$ssldir/lib" -a -d "$ssldir/lib64"; then
+                       LDFLAGS="$LDFLAGS -L$ssldir/lib64"
+                       LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir/lib64"
+                       ACX_RUNTIME_PATH_ADD([$ssldir/lib64])
+               else
+                       LDFLAGS="$LDFLAGS -L$ssldir/lib"
+                       LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir/lib"
+                       ACX_RUNTIME_PATH_ADD([$ssldir/lib])
+               fi
             fi
         
             AC_MSG_CHECKING([for EVP_sha256 in -lcrypto])

diff --git a/config.h.in b/config.h.in
index cb27afa4fe27e63a34407f1f9c1e0f5fefc253b8..3d45a095351aad7cab9ee41bcdbeeba185ed69c4 100644 (file)
--- a/config.h.in
+++ b/config.h.in
@@ -541,6 +541,9 @@
 /* Define to 1 if you have the `SSL_get0_peername' function. */
 #undef HAVE_SSL_GET0_PEERNAME
 
+/* Define to 1 if you have the `SSL_get1_peer_certificate' function. */
+#undef HAVE_SSL_GET1_PEER_CERTIFICATE
+
 /* Define to 1 if you have the `SSL_set1_host' function. */
 #undef HAVE_SSL_SET1_HOST
 

diff --git a/configure b/configure
index 7e722b59eaf3ce59b7b8120a3eaf4a1f607cc054..ede92e73250dd5aae80f6fcef8edac5387e0aae3 100755 (executable)
--- a/configure
+++ b/configure
@@ -811,7 +811,6 @@ infodir
 docdir
 oldincludedir
 includedir
-runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -962,7 +961,6 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
-runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -1215,15 +1213,6 @@ do
   | -silent | --silent | --silen | --sile | --sil)
     silent=yes ;;
 
-  -runstatedir | --runstatedir | --runstatedi | --runstated \
-  | --runstate | --runstat | --runsta | --runst | --runs \
-  | --run | --ru | --r)
-    ac_prev=runstatedir ;;
-  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
-  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
-  | --run=* | --ru=* | --r=*)
-    runstatedir=$ac_optarg ;;
-
   -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
     ac_prev=sbindir ;;
   -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1361,7 +1350,7 @@ fi
 for ac_var in  exec_prefix prefix bindir sbindir libexecdir datarootdir \
                datadir sysconfdir sharedstatedir localstatedir includedir \
                oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-               libdir localedir mandir runstatedir
+               libdir localedir mandir
 do
   eval ac_val=\$$ac_var
   # Remove trailing slashes.
@@ -1514,7 +1503,6 @@ Fine tuning of the installation directories:
   --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
   --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
   --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
-  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
   --libdir=DIR            object code libraries [EPREFIX/lib]
   --includedir=DIR        C header files [PREFIX/include]
   --oldincludedir=DIR     C header files for non-gcc [/usr/include]
@@ -18020,8 +18008,19 @@ _ACEOF
 $as_echo "found in $ssldir" >&6; }
             HAVE_SSL=yes
                         if test "$ssldir" != "/usr" -a "$ssldir" != ""; then
-                LDFLAGS="$LDFLAGS -L$ssldir/lib"
-                LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir/lib"
+               if test ! -d "$ssldir/lib" -a -d "$ssldir/lib64"; then
+                       LDFLAGS="$LDFLAGS -L$ssldir/lib64"
+                       LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir/lib64"
+
+       if test "x$enable_rpath" = xyes; then
+               if echo "$ssldir/lib64" | grep "^/" >/dev/null; then
+                       RUNTIME_PATH="$RUNTIME_PATH -R$ssldir/lib64"
+               fi
+       fi
+
+               else
+                       LDFLAGS="$LDFLAGS -L$ssldir/lib"
+                       LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir/lib"
 
        if test "x$enable_rpath" = xyes; then
                if echo "$ssldir/lib" | grep "^/" >/dev/null; then
@@ -18029,6 +18028,7 @@ $as_echo "found in $ssldir" >&6; }
                fi
        fi
 
+               fi
             fi
 
             { $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_sha256 in -lcrypto" >&5
@@ -18441,7 +18441,7 @@ done
 # these check_funcs need -lssl
 BAKLIBS="$LIBS"
 LIBS="-lssl $LIBS"
-for ac_func in OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername X509_VERIFY_PARAM_set1_host SSL_CTX_set_ciphersuites SSL_CTX_set_tlsext_ticket_key_evp_cb SSL_CTX_set_alpn_select_cb SSL_get0_alpn_selected SSL_CTX_set_alpn_protos
+for ac_func in OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername X509_VERIFY_PARAM_set1_host SSL_CTX_set_ciphersuites SSL_CTX_set_tlsext_ticket_key_evp_cb SSL_CTX_set_alpn_select_cb SSL_get0_alpn_selected SSL_CTX_set_alpn_protos SSL_get1_peer_certificate
 do :
   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"

diff --git a/configure.ac b/configure.ac
index 5ffbe68344ec26cf6f44078637d4961876e6fc78..933529690d7634fb0e95dc9b3281d3541bbb7bfa 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -865,7 +865,7 @@ AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_C
 # these check_funcs need -lssl
 BAKLIBS="$LIBS"
 LIBS="-lssl $LIBS"
-AC_CHECK_FUNCS([OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername X509_VERIFY_PARAM_set1_host SSL_CTX_set_ciphersuites SSL_CTX_set_tlsext_ticket_key_evp_cb SSL_CTX_set_alpn_select_cb SSL_get0_alpn_selected SSL_CTX_set_alpn_protos])
+AC_CHECK_FUNCS([OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername X509_VERIFY_PARAM_set1_host SSL_CTX_set_ciphersuites SSL_CTX_set_tlsext_ticket_key_evp_cb SSL_CTX_set_alpn_select_cb SSL_get0_alpn_selected SSL_CTX_set_alpn_protos SSL_get1_peer_certificate])
 LIBS="$BAKLIBS"
 
 AC_CHECK_DECLS([SSL_COMP_get_compression_methods,sk_SSL_COMP_pop_free,SSL_CTX_set_ecdh_auto], [], [], [

diff --git a/daemon/remote.c b/daemon/remote.c
index dd17bff91fc45f9ab99ff2a42d50345da68a50f8..923ddefa4f2961938f3ab394ceca43d0f332fa91 100644 (file)
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -3338,7 +3338,11 @@ int remote_control_callback(struct comm_point* c, void* arg, int err,
        if (!rc->use_cert) {
                verbose(VERB_ALGO, "unauthenticated remote control connection");
        } else if(SSL_get_verify_result(s->ssl) == X509_V_OK) {
+#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
+               X509* x = SSL_get1_peer_certificate(s->ssl);
+#else
                X509* x = SSL_get_peer_certificate(s->ssl);
+#endif
                if(!x) {
                        verbose(VERB_DETAIL, "remote control connection "
                                "provided no client certificate");

diff --git a/doc/Changelog b/doc/Changelog
index a2821b44dc20f8ed2cb87a02b1682a7ddffbf710..aca4b2d1f899f87304395a7a17b3eb96253c52ae 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,9 @@
 30 July 2021: Wouter
        - Fix #515: Compilation against openssl 3.0.0 beta2 is failing to
          build unbound.
+       - For #515: Fix compilation with openssl 3.0.0 beta2, lib64 dir and
+         SSL_get_peer_certificate.
+       - Move acx_nlnetlabs.m4 to version 41, with lib64 openssl dir check.
 
 26 July 2021: George
        - Merge #513: Stream reuse, attempt to fix #411, #439, #469. This

diff --git a/util/netevent.c b/util/netevent.c
index 01e44c9b6f301163189bb267fdfe7e400a3f922d..d1316c5b48368841b19098d088f4d4ab3e6d9c30 100644 (file)
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -1271,7 +1271,11 @@ ssl_handshake(struct comm_point* c)
        if((SSL_get_verify_mode(c->ssl)&SSL_VERIFY_PEER)) {
                /* verification */
                if(SSL_get_verify_result(c->ssl) == X509_V_OK) {
+#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
+                       X509* x = SSL_get1_peer_certificate(c->ssl);
+#else
                        X509* x = SSL_get_peer_certificate(c->ssl);
+#endif
                        if(!x) {
                                log_addr(VERB_ALGO, "SSL connection failed: "
                                        "no certificate",
@@ -1297,7 +1301,11 @@ ssl_handshake(struct comm_point* c)
 #endif
                        X509_free(x);
                } else {
+#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
+                       X509* x = SSL_get1_peer_certificate(c->ssl);
+#else
                        X509* x = SSL_get_peer_certificate(c->ssl);
+#endif
                        if(x) {
                                log_cert(VERB_ALGO, "peer certificate", x);
                                X509_free(x);