Make the code compile with OpenSSL 1.1

Some functions are renamed, some are introduced, some have changed
prototypes (mainly adding const).

diff --git a/src/include/tls-h b/src/include/tls-h
index e1dd15029b9ee097580b7cf2ecc2d59fd9a8b099..cad6fedbc0db0dc3071da174cb76aab58578f179 100644 (file)
--- a/src/include/tls-h
+++ b/src/include/tls-h
@@ -107,7 +107,7 @@ do {\
  *     exiting to prevent memory leaks.
  */
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
-#  define FR_TLS_REMOVE_THREAD_STATE() ERR_remove_thread_state();
+#  define FR_TLS_REMOVE_THREAD_STATE()
 #elif OPENSSL_VERSION_NUMBER >= 0x10000000L
 #  define FR_TLS_REMOVE_THREAD_STATE() ERR_remove_thread_state(NULL);
 #else

diff --git a/src/main/tls/session.c b/src/main/tls/session.c
index 60079c74aa019a51a673f13d94023888e6b3a214..2bd8ddfbb75e0dcd49a727edee4a73a605542b25 100644 (file)
--- a/src/main/tls/session.c
+++ b/src/main/tls/session.c
@@ -855,7 +855,11 @@ int tls_session_pairs_from_x509_cert(vp_cursor_t *cursor, TALLOC_CTX *ctx,
 
        int             attr_index, loc;
 
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+       STACK_OF(X509_EXTENSION) const *ext_list = NULL;
+#else
        STACK_OF(X509_EXTENSION) *ext_list = NULL;
+#endif
 
        ASN1_INTEGER    *sn = NULL;
        ASN1_TIME       *asn_time = NULL;
@@ -954,16 +958,27 @@ do { \
 
                                switch (name->type) {
 #ifdef GEN_EMAIL
-                               case GEN_EMAIL:
-                                       ADD_CERT_ATTR(cert_attr_names[FR_TLS_SAN_EMAIL][attr_index],
-                                                     (char *)ASN1_STRING_data(name->d.rfc822Name));
+                               case GEN_EMAIL: {
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+                                       char const *rfc822Name = (char const *)ASN1_STRING_get0_data(name->d.rfc822Name);
+#else
+                                       char *rfc822Name = (char *)ASN1_STRING_data(name->d.rfc822Name);
+#endif
+
+                                       ADD_CERT_ATTR(cert_attr_names[FR_TLS_SAN_EMAIL][attr_index], rfc822Name);
                                        break;
+                               }
 #endif /* GEN_EMAIL */
 #ifdef GEN_DNS
-                               case GEN_DNS:
-                                       ADD_CERT_ATTR(cert_attr_names[FR_TLS_SAN_DNS][attr_index],
-                                                     (char *)ASN1_STRING_data(name->d.dNSName));
+                               case GEN_DNS: {
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+                                       char const *dNSName = (char const *)ASN1_STRING_get0_data(name->d.dNSName);
+#else
+                                       char *dNSName = (char *)ASN1_STRING_data(name->d.dNSName);
+#endif
+                                       ADD_CERT_ATTR(cert_attr_names[FR_TLS_SAN_DNS][attr_index], dNSName);
                                        break;
+                               }
 #endif /* GEN_DNS */
 #ifdef GEN_OTHERNAME
                                case GEN_OTHERNAME:

diff --git a/src/main/tls/validate.c b/src/main/tls/validate.c
index 442eff9842b0600030041e1fca1a1a59a9d9842d..e5d698eb25939a249df67b50bd90adf85e7fc71c 100644 (file)
--- a/src/main/tls/validate.c
+++ b/src/main/tls/validate.c
@@ -165,7 +165,7 @@ int tls_validate_cert_cb(int ok, X509_STORE_CTX *x509_ctx)
        X509_NAME_oneline(X509_get_subject_name(cert), subject, sizeof(subject));
        subject[sizeof(subject) - 1] = '\0';
 
-       X509_NAME_oneline(X509_get_issuer_name(x509_ctx->current_cert), issuer, sizeof(issuer));
+       X509_NAME_oneline(X509_get_issuer_name(cert), issuer, sizeof(issuer));
        issuer[sizeof(issuer) - 1] = '\0';
 
        /*
@@ -189,7 +189,7 @@ int tls_validate_cert_cb(int ok, X509_STORE_CTX *x509_ctx)
                return my_ok;
        }
 
-       switch (x509_ctx->error) {
+       switch (X509_STORE_CTX_get_error(x509_ctx)) {
        case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
                RERROR("issuer=%s", issuer);
                break;

diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/configure b/src/modules/rlm_eap/types/rlm_eap_fast/configure
index 8bc846e565fefa8cb18aef45848f71173733c2ba..f68299bc7e5f14c03fefcae6e12058f1b50e4190 100755 (executable)
--- a/src/modules/rlm_eap/types/rlm_eap_fast/configure
+++ b/src/modules/rlm_eap/types/rlm_eap_fast/configure
@@ -2893,7 +2893,7 @@ smart_prefix=
 
 
 sm_lib_safe=`echo "crypto" | sed 'y%./+-%__p_%'`
-sm_func_safe=`echo "EVP_cleanup" | sed 'y%./+-%__p_%'`
+sm_func_safe=`echo "EVP_CIPHER_CTX_new" | sed 'y%./+-%__p_%'`
 
 old_LIBS="$LIBS"
 old_CPPFLAGS="$CPPFLAGS"
@@ -2903,17 +2903,17 @@ smart_lib_dir=
 
 if test "x$smart_try_dir" != "x"; then
   for try in $smart_try_dir; do
-    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_cleanup in -lcrypto in $try" >&5
-$as_echo_n "checking for EVP_cleanup in -lcrypto in $try... " >&6; }
+    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_CIPHER_CTX_new in -lcrypto in $try" >&5
+$as_echo_n "checking for EVP_CIPHER_CTX_new in -lcrypto in $try... " >&6; }
     LIBS="-lcrypto $old_LIBS"
     CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS"
     cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-extern char EVP_cleanup();
+extern char EVP_CIPHER_CTX_new();
 int
 main ()
 {
-EVP_cleanup()
+EVP_CIPHER_CTX_new()
   ;
   return 0;
 }
@@ -2938,16 +2938,16 @@ rm -f core conftest.err conftest.$ac_objext \
 fi
 
 if test "x$smart_lib" = "x"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_cleanup in -lcrypto" >&5
-$as_echo_n "checking for EVP_cleanup in -lcrypto... " >&6; }
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_CIPHER_CTX_new in -lcrypto" >&5
+$as_echo_n "checking for EVP_CIPHER_CTX_new in -lcrypto... " >&6; }
   LIBS="-lcrypto $old_LIBS"
   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-extern char EVP_cleanup();
+extern char EVP_CIPHER_CTX_new();
 int
 main ()
 {
-EVP_cleanup()
+EVP_CIPHER_CTX_new()
   ;
   return 0;
 }
@@ -3024,17 +3024,17 @@ eval "smart_lib_dir=\"\$smart_lib_dir $DIRS\""
 
 
   for try in $smart_lib_dir /usr/local/lib /opt/lib; do
-    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_cleanup in -lcrypto in $try" >&5
-$as_echo_n "checking for EVP_cleanup in -lcrypto in $try... " >&6; }
+    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_CIPHER_CTX_new in -lcrypto in $try" >&5
+$as_echo_n "checking for EVP_CIPHER_CTX_new in -lcrypto in $try... " >&6; }
     LIBS="-lcrypto $old_LIBS"
     CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS"
     cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-extern char EVP_cleanup();
+extern char EVP_CIPHER_CTX_new();
 int
 main ()
 {
-EVP_cleanup()
+EVP_CIPHER_CTX_new()
   ;
   return 0;
 }
@@ -3064,7 +3064,7 @@ if test "x$smart_lib" != "x"; then
   SMART_LIBS="$smart_ldflags $smart_lib $SMART_LIBS"
 fi
 
-        if test "x$ac_cv_lib_crypto_EVP_cleanup" != "xyes"; then
+        if test "x$ac_cv_lib_crypto_EVP_CIPHER_CTX_new" != "xyes"; then
          fail="libssl"
        fi
 

diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/configure.ac b/src/modules/rlm_eap/types/rlm_eap_fast/configure.ac
index 0548ddb0ed83f844aa000a9238bce7909279742d..e52e7545902feb7acb1342a05a8cf1c9af1e095a 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_fast/configure.ac
+++ b/src/modules/rlm_eap/types/rlm_eap_fast/configure.ac
@@ -60,8 +60,8 @@ if test x$with_[]modname != xno; then
        fi
 
        smart_try_dir=$openssl_lib_dir
-        FR_SMART_CHECK_LIB(crypto, EVP_cleanup)
-        if test "x$ac_cv_lib_crypto_EVP_cleanup" != "xyes"; then
+        FR_SMART_CHECK_LIB(crypto, EVP_CIPHER_CTX_new)
+        if test "x$ac_cv_lib_crypto_EVP_CIPHER_CTX_new" != "xyes"; then
          fail="libssl"
        fi
 

diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c b/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c
index ede3bd27eebb59cda5009833999d1b75f5529b6e..83322a791a83956dc34864ef6c223caf540befd0 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c
+++ b/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c
@@ -162,9 +162,15 @@ static void eap_fast_session_ticket(tls_session_t *tls_session, const SSL *s,
 }
 
 // hostap:src/crypto/tls_openssl.c:tls_sess_sec_cb()
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
 static int _session_secret(SSL *s, void *secret, int *secret_len,
                           UNUSED STACK_OF(SSL_CIPHER) *peer_ciphers,
                           UNUSED SSL_CIPHER **cipher, void *arg)
+#else
+static int _session_secret(SSL *s, void *secret, int *secret_len,
+                          UNUSED STACK_OF(SSL_CIPHER) *peer_ciphers,
+                          UNUSED SSL_CIPHER const **cipher, void *arg)
+#endif
 {
        // FIXME enforce non-anon cipher