From: Herwin Weststrate Date: Wed, 9 Nov 2016 19:58:44 +0000 (+0100) Subject: Make the code compile with OpenSSL 1.1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=77df1fd6bbdc4dd2bd5105eda66dfa29f1cb8152;p=thirdparty%2Ffreeradius-server.git Make the code compile with OpenSSL 1.1 Some functions are renamed, some are introduced, some have changed prototypes (mainly adding const). --- diff --git a/src/include/tls-h b/src/include/tls-h index e1dd15029b9..cad6fedbc0d 100644 --- a/src/include/tls-h +++ b/src/include/tls-h @@ -107,7 +107,7 @@ do {\ * exiting to prevent memory leaks. */ #if OPENSSL_VERSION_NUMBER >= 0x10100000L -# define FR_TLS_REMOVE_THREAD_STATE() ERR_remove_thread_state(); +# define FR_TLS_REMOVE_THREAD_STATE() #elif OPENSSL_VERSION_NUMBER >= 0x10000000L # define FR_TLS_REMOVE_THREAD_STATE() ERR_remove_thread_state(NULL); #else diff --git a/src/main/tls/session.c b/src/main/tls/session.c index 60079c74aa0..2bd8ddfbb75 100644 --- a/src/main/tls/session.c +++ b/src/main/tls/session.c @@ -855,7 +855,11 @@ int tls_session_pairs_from_x509_cert(vp_cursor_t *cursor, TALLOC_CTX *ctx, int attr_index, loc; +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + STACK_OF(X509_EXTENSION) const *ext_list = NULL; +#else STACK_OF(X509_EXTENSION) *ext_list = NULL; +#endif ASN1_INTEGER *sn = NULL; ASN1_TIME *asn_time = NULL; @@ -954,16 +958,27 @@ do { \ switch (name->type) { #ifdef GEN_EMAIL - case GEN_EMAIL: - ADD_CERT_ATTR(cert_attr_names[FR_TLS_SAN_EMAIL][attr_index], - (char *)ASN1_STRING_data(name->d.rfc822Name)); + case GEN_EMAIL: { +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + char const *rfc822Name = (char const *)ASN1_STRING_get0_data(name->d.rfc822Name); +#else + char *rfc822Name = (char *)ASN1_STRING_data(name->d.rfc822Name); +#endif + + ADD_CERT_ATTR(cert_attr_names[FR_TLS_SAN_EMAIL][attr_index], rfc822Name); break; + } #endif /* GEN_EMAIL */ #ifdef GEN_DNS - case GEN_DNS: - ADD_CERT_ATTR(cert_attr_names[FR_TLS_SAN_DNS][attr_index], - (char *)ASN1_STRING_data(name->d.dNSName)); + case GEN_DNS: { +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + char const *dNSName = (char const *)ASN1_STRING_get0_data(name->d.dNSName); +#else + char *dNSName = (char *)ASN1_STRING_data(name->d.dNSName); +#endif + ADD_CERT_ATTR(cert_attr_names[FR_TLS_SAN_DNS][attr_index], dNSName); break; + } #endif /* GEN_DNS */ #ifdef GEN_OTHERNAME case GEN_OTHERNAME: diff --git a/src/main/tls/validate.c b/src/main/tls/validate.c index 442eff9842b..e5d698eb259 100644 --- a/src/main/tls/validate.c +++ b/src/main/tls/validate.c @@ -165,7 +165,7 @@ int tls_validate_cert_cb(int ok, X509_STORE_CTX *x509_ctx) X509_NAME_oneline(X509_get_subject_name(cert), subject, sizeof(subject)); subject[sizeof(subject) - 1] = '\0'; - X509_NAME_oneline(X509_get_issuer_name(x509_ctx->current_cert), issuer, sizeof(issuer)); + X509_NAME_oneline(X509_get_issuer_name(cert), issuer, sizeof(issuer)); issuer[sizeof(issuer) - 1] = '\0'; /* @@ -189,7 +189,7 @@ int tls_validate_cert_cb(int ok, X509_STORE_CTX *x509_ctx) return my_ok; } - switch (x509_ctx->error) { + switch (X509_STORE_CTX_get_error(x509_ctx)) { case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: RERROR("issuer=%s", issuer); break; diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/configure b/src/modules/rlm_eap/types/rlm_eap_fast/configure index 8bc846e565f..f68299bc7e5 100755 --- a/src/modules/rlm_eap/types/rlm_eap_fast/configure +++ b/src/modules/rlm_eap/types/rlm_eap_fast/configure @@ -2893,7 +2893,7 @@ smart_prefix= sm_lib_safe=`echo "crypto" | sed 'y%./+-%__p_%'` -sm_func_safe=`echo "EVP_cleanup" | sed 'y%./+-%__p_%'` +sm_func_safe=`echo "EVP_CIPHER_CTX_new" | sed 'y%./+-%__p_%'` old_LIBS="$LIBS" old_CPPFLAGS="$CPPFLAGS" @@ -2903,17 +2903,17 @@ smart_lib_dir= if test "x$smart_try_dir" != "x"; then for try in $smart_try_dir; do - { $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_cleanup in -lcrypto in $try" >&5 -$as_echo_n "checking for EVP_cleanup in -lcrypto in $try... " >&6; } + { $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_CIPHER_CTX_new in -lcrypto in $try" >&5 +$as_echo_n "checking for EVP_CIPHER_CTX_new in -lcrypto in $try... " >&6; } LIBS="-lcrypto $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ -extern char EVP_cleanup(); +extern char EVP_CIPHER_CTX_new(); int main () { -EVP_cleanup() +EVP_CIPHER_CTX_new() ; return 0; } @@ -2938,16 +2938,16 @@ rm -f core conftest.err conftest.$ac_objext \ fi if test "x$smart_lib" = "x"; then - { $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_cleanup in -lcrypto" >&5 -$as_echo_n "checking for EVP_cleanup in -lcrypto... " >&6; } + { $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_CIPHER_CTX_new in -lcrypto" >&5 +$as_echo_n "checking for EVP_CIPHER_CTX_new in -lcrypto... " >&6; } LIBS="-lcrypto $old_LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ -extern char EVP_cleanup(); +extern char EVP_CIPHER_CTX_new(); int main () { -EVP_cleanup() +EVP_CIPHER_CTX_new() ; return 0; } @@ -3024,17 +3024,17 @@ eval "smart_lib_dir=\"\$smart_lib_dir $DIRS\"" for try in $smart_lib_dir /usr/local/lib /opt/lib; do - { $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_cleanup in -lcrypto in $try" >&5 -$as_echo_n "checking for EVP_cleanup in -lcrypto in $try... " >&6; } + { $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_CIPHER_CTX_new in -lcrypto in $try" >&5 +$as_echo_n "checking for EVP_CIPHER_CTX_new in -lcrypto in $try... " >&6; } LIBS="-lcrypto $old_LIBS" CPPFLAGS="-L$try -Wl,-rpath,$try $old_CPPFLAGS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ -extern char EVP_cleanup(); +extern char EVP_CIPHER_CTX_new(); int main () { -EVP_cleanup() +EVP_CIPHER_CTX_new() ; return 0; } @@ -3064,7 +3064,7 @@ if test "x$smart_lib" != "x"; then SMART_LIBS="$smart_ldflags $smart_lib $SMART_LIBS" fi - if test "x$ac_cv_lib_crypto_EVP_cleanup" != "xyes"; then + if test "x$ac_cv_lib_crypto_EVP_CIPHER_CTX_new" != "xyes"; then fail="libssl" fi diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/configure.ac b/src/modules/rlm_eap/types/rlm_eap_fast/configure.ac index 0548ddb0ed8..e52e7545902 100644 --- a/src/modules/rlm_eap/types/rlm_eap_fast/configure.ac +++ b/src/modules/rlm_eap/types/rlm_eap_fast/configure.ac @@ -60,8 +60,8 @@ if test x$with_[]modname != xno; then fi smart_try_dir=$openssl_lib_dir - FR_SMART_CHECK_LIB(crypto, EVP_cleanup) - if test "x$ac_cv_lib_crypto_EVP_cleanup" != "xyes"; then + FR_SMART_CHECK_LIB(crypto, EVP_CIPHER_CTX_new) + if test "x$ac_cv_lib_crypto_EVP_CIPHER_CTX_new" != "xyes"; then fail="libssl" fi diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c b/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c index ede3bd27eeb..83322a791a8 100644 --- a/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c +++ b/src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c @@ -162,9 +162,15 @@ static void eap_fast_session_ticket(tls_session_t *tls_session, const SSL *s, } // hostap:src/crypto/tls_openssl.c:tls_sess_sec_cb() +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) static int _session_secret(SSL *s, void *secret, int *secret_len, UNUSED STACK_OF(SSL_CIPHER) *peer_ciphers, UNUSED SSL_CIPHER **cipher, void *arg) +#else +static int _session_secret(SSL *s, void *secret, int *secret_len, + UNUSED STACK_OF(SSL_CIPHER) *peer_ciphers, + UNUSED SSL_CIPHER const **cipher, void *arg) +#endif { // FIXME enforce non-anon cipher