Based on list discussion between myself and Geoff, it seems prudent

  to check for both the existence of the openssl/engine.h header file
  and some 'expected function' such as ENGINE_init() (better suggestions
  are welcome.)  Also clear up some confusion; so long as we have
  ENGINE_load_builtin_engines() we should attempt to preload those.

  This patch protects all ENGINE-based code within the tests for the
  engine header and function, and changes a version test into a
  function test.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@100104 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/ssl_engine_config.c b/ssl_engine_config.c
index 9a55d17b26e1e3176bd1c3234832ce4191bb9195..a2ee3d4d671506633abf3c417513bc3d52a0ce13 100644 (file)
--- a/ssl_engine_config.c
+++ b/ssl_engine_config.c
@@ -510,7 +510,7 @@ const char *ssl_cmd_SSLPassPhraseDialog(cmd_parms *cmd,
     return NULL;
 }
 
-#ifdef HAVE_ENGINE_INIT
+#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
 const char *ssl_cmd_SSLCryptoDevice(cmd_parms *cmd,
                                     void *dcfg,
                                     const char *arg)
@@ -518,7 +518,7 @@ const char *ssl_cmd_SSLCryptoDevice(cmd_parms *cmd,
     SSLModConfigRec *mc = myModConfig(cmd->server);
     const char *err;
     ENGINE *e;
-#if SSL_LIBRARY_VERSION >= 0x00907000
+#ifdef HAVE_ENGINE_LOAD_BUILTIN_ENGINES
     static int loaded_engines = FALSE;
 
     /* early loading to make sure the engines are already 

diff --git a/ssl_engine_init.c b/ssl_engine_init.c
index e2f49095939872bab87bf3acfd63f5c0416c478e..f4e758b9e418794cad0bd19a83200ec36f4bc5a3 100644 (file)
--- a/ssl_engine_init.c
+++ b/ssl_engine_init.c
@@ -270,7 +270,7 @@ int ssl_init_Module(apr_pool_t *p, apr_pool_t *plog,
     /*
      * SSL external crypto device ("engine") support
      */
-#ifdef HAVE_ENGINE_INIT
+#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
     ssl_init_Engine(base_server, p);
 #endif
 
@@ -351,7 +351,7 @@ int ssl_init_Module(apr_pool_t *p, apr_pool_t *plog,
  * Support for external a Crypto Device ("engine"), usually
  * a hardware accellerator card for crypto operations.
  */
-#ifdef HAVE_ENGINE_INIT
+#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
 void ssl_init_Engine(server_rec *s, apr_pool_t *p)
 {
     SSLModConfigRec *mc = myModConfig(s);

diff --git a/ssl_toolkit_compat.h b/ssl_toolkit_compat.h
index cba8de88d36284f21210e48febd778e30810797b..9691ed26dc3288313079c7480d4ed1c4c74de683 100644 (file)
--- a/ssl_toolkit_compat.h
+++ b/ssl_toolkit_compat.h
@@ -66,7 +66,10 @@
 #include <openssl/evp.h>
 #include <openssl/rand.h>
 #include <openssl/x509v3.h>
-#ifdef HAVE_ENGINE_INIT
+/* Avoid tripping over an engine build installed globally and detected
+ * when the user points at an explicit non-engine flavor of OpenSSL
+ */
+#if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
 #include <openssl/engine.h>
 #endif