From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Sat, 26 Jan 2019 15:41:18 +0000 (+0700)
Subject: Bump minimum OpenSSL version to 1.0.2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bee9ff910ceb9878df28f95ee0945460e0503423;p=thirdparty%2Ffreeradius-server.git

Bump minimum OpenSSL version to 1.0.2
---

diff --git a/configure b/configure
index 73fb4f6e405..c30f2f6624f 100755
--- a/configure
+++ b/configure
@@ -10378,12 +10378,12 @@ fi
 done
 
 
-    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for OpenSSL version >= 0.9.7" >&5
-$as_echo_n "checking for OpenSSL version >= 0.9.7... " >&6; }
+    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for OpenSSL version >= 1.0.2" >&5
+$as_echo_n "checking for OpenSSL version >= 1.0.2... " >&6; }
     cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 #include <openssl/crypto.h>
-       #if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
+       #if (OPENSSL_VERSION_NUMBER >= 0x10002000L)
        yes
        #endif
 
diff --git a/configure.ac b/configure.ac
index 662c21894e3..86fc0ffd76a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1092,10 +1092,10 @@ if test "x$WITH_OPENSSL" = xyes; then
       ]
     )
 
-    AC_MSG_CHECKING([for OpenSSL version >= 0.9.7])
+    AC_MSG_CHECKING([for OpenSSL version >= 1.0.2])
     AC_EGREP_CPP(yes,
       [#include <openssl/crypto.h>
-       #if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
+       #if (OPENSSL_VERSION_NUMBER >= 0x10002000L)
        yes
        #endif
       ],
diff --git a/raddb/mods-available/cipher b/raddb/mods-available/cipher
index 342c40924b2..7b02e667ad7 100644
--- a/raddb/mods-available/cipher
+++ b/raddb/mods-available/cipher
@@ -87,8 +87,6 @@ cipher {
 		#
 		#  Parameters for the OAEP RSA padding scheme.
 		#
-		#  NOTE: Only available when using OpenSSL >= 1.0.2
-		#
 		oaep {
 #			oaep_digest = "sha256"
 #			mgf1_digest = "sha256"
diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index 0c93e453341..a899ec29e01 100644
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -190,9 +190,6 @@ eap {
 		#  The key type does not need to be explicitly specified as
 		#  it is determined from the certificate provided.
 		#
-		#  Note: OpenSSL >= 1.0.2 is required for crypto agility to
-		#        function correctly.
-		#
 		chain {
 			#
 			#  The format of the certificate(s) and private key file.
@@ -219,8 +216,6 @@ eap {
 			#
 			certificate_file = ${certdir}/rsa/server.pem
 
-			#
-			#  Only available with OpenSSL >= 1.0.2
 			#
 			#  Load an additional intermediary CA or Root CA for consideration in
 			#  chain compilation.  Multiple "ca_file" config items may be used
@@ -242,7 +237,7 @@ eap {
 			private_key_file = ${certdir}/rsa/server.key
 
 			#
-			#  With OpenSSL >= 1.0.2 we attempt to precompile the certificate chain
+			#  During startup we attempt to precompile the certificate chain
 			#  from server certificate to Root CA.  This configuration item specifies
 			#  what happens if compilation fails.
 			#
@@ -263,8 +258,6 @@ eap {
 			#
 #			verify_mode = "hard"
 
-			#
-			#  Only available with OpenSSL >= 1.0.2
 			#
 			#  Omit the Root CA from the compiled certificate chain.
 			#  The Root CA should already be known/trusted by the client so it is
@@ -568,7 +561,6 @@ eap {
 			#    https://mitls.org/pages/attacks/3SHAKE
 			#
 			#  Note: This attack is undetectable by the client.
-			#  Note: Only supported with OpenSSL >= 1.1.0
 			#
 #			require_extended_master_secret = yes
 
@@ -576,8 +568,6 @@ eap {
 			#  Only allow session resumption if a cipher which would
 			#  allow perfect forward secrecy has been selected.
 			#
-			#  Note: Only enforced with OpenSSL >= 1.1.0
-			#
 #			require_perfect_forward_secrecy = no
 
 			#  As of 4.0 OpenSSL's internal cache has been disabled due to
diff --git a/src/lib/eap/crypto.c b/src/lib/eap/crypto.c
index b864b4f8a4b..ffa7eb7bf75 100644
--- a/src/lib/eap/crypto.c
+++ b/src/lib/eap/crypto.c
@@ -130,11 +130,7 @@ void eap_crypto_mppe_keys(REQUEST *request, SSL *ssl, char const *prf_label, siz
 	uint8_t		scratch[sizeof(out)];
 	uint8_t		master_key[SSL_MAX_MASTER_KEY_LENGTH];
 
-#if OPENSSL_VERSION_NUMBER >= 0x10001000L
-	if (SSL_export_keying_material(ssl, out, sizeof(out), prf_label, prf_label_len, NULL, 0, 0) != 1) /* Fallback */
-#endif
-
-	{
+	if (SSL_export_keying_material(ssl, out, sizeof(out), prf_label, prf_label_len, NULL, 0, 0) != 1) {
 		p = seed;
 		memcpy(p, prf_label, seed_len);
 		p += seed_len;
@@ -174,12 +170,9 @@ void eap_crypto_challenge(SSL *s, uint8_t *buffer, uint8_t *scratch, size_t size
 	uint8_t		master_key[SSL_MAX_MASTER_KEY_LENGTH];
 	uint8_t		seed[128 + (2 * SSL3_RANDOM_SIZE)];
 
-#if OPENSSL_VERSION_NUMBER >= 0x10001000L
 	if (SSL_export_keying_material(s, buffer, size, prf_label,
 				       strlen(prf_label), NULL, 0, 0) == 1) return;
 
-#endif
-
 	len = strlen(prf_label);
 	if (len > 128) len = 128;
 
diff --git a/src/lib/server/dependency.c b/src/lib/server/dependency.c
index f7b8b19ca67..eae0f22f9c6 100644
--- a/src/lib/server/dependency.c
+++ b/src/lib/server/dependency.c
@@ -432,15 +432,14 @@ void dependency_features_init(CONF_SECTION *cs)
 #endif
 				);
 
-#ifdef WITH_TLS
+
 	dependency_feature_add(cs, "tls-key-agility",
-#  if OPENSSL_VERSION_NUMBER >= 0x10002000L
+#ifdef WITH_TLS
 				true
-#  else
+#else
 				false
-#  endif
-				);
 #endif
+				);
 
 	dependency_feature_add(cs, "unlang",
 #ifdef WITH_UNLANG
diff --git a/src/lib/tls/base-h b/src/lib/tls/base-h
index 08e4a255323..f2b0f8068b0 100644
--- a/src/lib/tls/base-h
+++ b/src/lib/tls/base-h
@@ -87,10 +87,8 @@ extern "C" {
  */
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
 #  define FR_TLS_REMOVE_THREAD_STATE()
-#elif OPENSSL_VERSION_NUMBER >= 0x10000000L
-#  define FR_TLS_REMOVE_THREAD_STATE() ERR_remove_thread_state(NULL);
 #else
-#  define FR_TLS_REMOVE_THREAD_STATE() ERR_remove_state(0);
+#  define FR_TLS_REMOVE_THREAD_STATE() ERR_remove_thread_state(NULL);
 #endif
 
 /*
@@ -136,9 +134,7 @@ typedef struct {
 typedef struct {
 	SSL_CTX		*ctx;				//!< TLS configuration context.
 	SSL 		*ssl;				//!< This SSL session.
-#if OPENSSL_VERSION_NUMBER >= 0x10001000L
 	SSL_SESSION	*session;			//!< Session resumption data.
-#endif
 	tls_info_t	info;				//!< Information about the state of the TLS session.
 
 	BIO 		*into_ssl;			//!< Basic I/O input to OpenSSL.
@@ -194,7 +190,6 @@ typedef struct {
 } fr_tls_ocsp_conf_t;
 #endif
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
 /** Different chain building modes
  *
  */
@@ -207,7 +202,6 @@ typedef enum {
 							///< the leaf cert back to a root.
 	FR_TLS_CHAIN_VERIFY_NONE			//!< Don't verify/build the chain.
 } fr_tls_chain_verify_mode_t;
-#endif
 
 /** Structure representing a certificate chain configuration
  *
@@ -222,11 +216,9 @@ typedef struct {
 	char const	*password;			//!< Password to decrypt the certificate(s).
 	char const	*private_key_file;		//!< Path to certificate.
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
 	char const	**ca_files;			//!< Extra certificates to load.
 	fr_tls_chain_verify_mode_t	verify_mode;	//!< How hard we try to build up a complete certificate
 							///< chain.
-#endif
 	bool		include_root_ca;		//!< Include the root ca in the chain we built.
 } fr_tls_chain_conf_t;
 
@@ -303,10 +295,8 @@ struct fr_tls_conf_t {
 							//!< with ocsp.
 #endif
 
-#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
-#  ifndef OPENSSL_NO_ECDH
+#ifndef OPENSSL_NO_ECDH
 	char const	*ecdh_curve;
-#  endif
 #endif
 
 #ifdef PSK_MAX_IDENTITY_LEN
diff --git a/src/lib/tls/base.c b/src/lib/tls/base.c
index 9a1296b2da6..788c0ba42a7 100644
--- a/src/lib/tls/base.c
+++ b/src/lib/tls/base.c
@@ -176,20 +176,6 @@ static libssl_defect_t libssl_defects[] =
 		.name		= "OCSP status request extension",
 		.comment	= "For more information see https://www.openssl.org/news/secadv/20160922.txt"
 	},
-	{
-		.low		= VM(1,0,1),			/* 1.0.1  */
-		.high		= Vm(1,0,1,'t'),		/* 1.0.1t */
-		.id		= "CVE-2016-6304",
-		.name		= "OCSP status request extension",
-		.comment	= "For more information see https://www.openssl.org/news/secadv/20160922.txt"
-	},
-	{
-		.low		= VM(1,0,1),			/* 1.0.1  */
-		.high		= Vm(1,0,1,'f'),		/* 1.0.1f */
-		.id		= "CVE-2014-0160",
-		.name		= "Heartbleed",
-		.comment	= "For more information see http://heartbleed.com"
-	},
 };
 #endif /* ENABLE_OPENSSL_VERSION_CHECK */
 
@@ -225,17 +211,11 @@ static unsigned long _thread_id(void)
  *	Use preprocessor magic to get the right function and argument
  *	to use.  This avoids ifdef's through the rest of the code.
  */
-#if OPENSSL_VERSION_NUMBER < 0x10000000L
-#define ssl_id_function  _thread_id
-#define set_id_callback CRYPTO_set_id_callback
-
-#else
 static void ssl_id_function(CRYPTO_THREADID *id)
 {
 	CRYPTO_THREADID_set_numeric(id, _thread_id());
 }
 #define set_id_callback CRYPTO_THREADID_set_callback
-#endif
 
 
 static void _global_mutex(int mode, int n, UNUSED char const *file, UNUSED int line)
diff --git a/src/lib/tls/cache.c b/src/lib/tls/cache.c
index 402da8badde..6a59d0d6b04 100644
--- a/src/lib/tls/cache.c
+++ b/src/lib/tls/cache.c
@@ -160,15 +160,10 @@ do { \
  */
 inline static ssize_t tls_cache_id(uint8_t const **out, SSL_SESSION *sess)
 {
-#if OPENSSL_VERSION_NUMBER < 0x10001000L
-	*out = sess->session_id;
-	return sess->session_id_length;
-#else
 	unsigned int len;
 
 	*out = SSL_SESSION_get_id(sess, &len);
 	return len;
-#endif
 }
 
 /** Write a newly created session data to the tls_session structure
@@ -490,7 +485,7 @@ void tls_cache_deny(tls_session_t *session)
 	 *	will be called, so better to remove the session
 	 *	directly.
 	 */
-	SSL_CTX_remove_session(session->ctx, session->ssl_session);
+	SSL_CTX_remove_session(session->ctx, session->session);
 }
 
 /** Prevent a TLS session from being resumed in future
@@ -551,7 +546,7 @@ int tls_cache_disable_cb(SSL *ssl,
 	if (vp && (vp->vp_uint32 == 0)) {
 		RDEBUG2("&control:Allow-Session-Resumption == no, disabling session resumption");
 	disable:
-		SSL_CTX_remove_session(session->ctx, session->ssl_session);
+		SSL_CTX_remove_session(session->ctx, session->session);
 		session->allow_session_resumption = false;
 		return 1;
 	}
diff --git a/src/lib/tls/conf.c b/src/lib/tls/conf.c
index 2a43f8740ae..bf32ed17d1c 100644
--- a/src/lib/tls/conf.c
+++ b/src/lib/tls/conf.c
@@ -54,19 +54,15 @@ static const FR_NAME_NUMBER certificate_format_table[] = {
 	{ NULL,		0			},
 };
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
 static const FR_NAME_NUMBER chain_verify_mode_table[] = {
 	{ "hard",	FR_TLS_CHAIN_VERIFY_HARD },
 	{ "soft",	FR_TLS_CHAIN_VERIFY_SOFT },
 	{ "none",	FR_TLS_CHAIN_VERIFY_NONE },
 	{ NULL,		0			 },
 };
-#endif
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
 static int chain_verify_mode_parse(UNUSED TALLOC_CTX *ctx, void *out, UNUSED void *parent,
 				   CONF_ITEM *ci, UNUSED CONF_PARSER const *rule);
-#endif
 static int certificate_format_type_parse(UNUSED TALLOC_CTX *ctx, void *out, UNUSED void *parent,
 					 CONF_ITEM *ci, UNUSED CONF_PARSER const *rule);
 
@@ -117,12 +113,10 @@ static CONF_PARSER tls_chain_config[] = {
 	{ FR_CONF_OFFSET("private_key_password", FR_TYPE_STRING | FR_TYPE_SECRET, fr_tls_chain_conf_t, password) },
 	{ FR_CONF_OFFSET("private_key_file", FR_TYPE_FILE_INPUT | FR_TYPE_REQUIRED, fr_tls_chain_conf_t, private_key_file) },
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
 	{ FR_CONF_OFFSET("ca_file", FR_TYPE_FILE_INPUT | FR_TYPE_MULTI, fr_tls_chain_conf_t, ca_files) },
 
 	{ FR_CONF_OFFSET("verify_mode", FR_TYPE_VOID, fr_tls_chain_conf_t, verify_mode), .dflt = "hard", .func = chain_verify_mode_parse },
 	{ FR_CONF_OFFSET("include_root_ca", FR_TYPE_BOOL, fr_tls_chain_conf_t, include_root_ca), .dflt = "no" },
-#endif
 	CONF_PARSER_TERMINATOR
 };
 
@@ -165,10 +159,8 @@ CONF_PARSER tls_server_config[] = {
 	{ FR_CONF_OFFSET("check_cert_issuer", FR_TYPE_STRING, fr_tls_conf_t, check_cert_issuer) },
 	{ FR_CONF_OFFSET("require_client_cert", FR_TYPE_BOOL, fr_tls_conf_t, require_client_cert) },
 
-#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
 #ifndef OPENSSL_NO_ECDH
 	{ FR_CONF_OFFSET("ecdh_curve", FR_TYPE_STRING, fr_tls_conf_t, ecdh_curve), .dflt = "prime256v1" },
-#endif
 #endif
 	{ FR_CONF_OFFSET("tls_max_version", FR_TYPE_FLOAT32, fr_tls_conf_t, tls_max_version) },
 
@@ -208,10 +200,8 @@ CONF_PARSER tls_client_config[] = {
 	{ FR_CONF_OFFSET("cipher_list", FR_TYPE_STRING, fr_tls_conf_t, cipher_list) },
 	{ FR_CONF_OFFSET("check_cert_issuer", FR_TYPE_STRING, fr_tls_conf_t, check_cert_issuer) },
 
-#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
 #ifndef OPENSSL_NO_ECDH
 	{ FR_CONF_OFFSET("ecdh_curve", FR_TYPE_STRING, fr_tls_conf_t, ecdh_curve), .dflt = "prime256v1" },
-#endif
 #endif
 
 	{ FR_CONF_OFFSET("tls_max_version", FR_TYPE_FLOAT32, fr_tls_conf_t, tls_max_version) },
@@ -221,7 +211,6 @@ CONF_PARSER tls_client_config[] = {
 	CONF_PARSER_TERMINATOR
 };
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
 /** Calls to convert verify_mode strings into macros
  *
  * @param[in] ctx	to allocate data in.
@@ -249,7 +238,6 @@ static int chain_verify_mode_parse(UNUSED TALLOC_CTX *ctx, void *out, UNUSED voi
 
 	return 0;
 }
-#endif
 
 /** Calls to convert format strings to OpenSSL macros
  *
@@ -529,17 +517,6 @@ fr_tls_conf_t *tls_conf_parse_server(CONF_SECTION *cs)
 		if (tls_ocsp_staple_cache_compile(&conf->staple.cache, server_cs) < 0) goto error;
 	}
 
-#ifdef SSL_OP_NO_TLSv1_2
-	/*
-	 *	OpenSSL 1.0.1f and 1.0.1g get the MS-MPPE keys wrong.
-	 */
-#if (OPENSSL_VERSION_NUMBER >= 0x10010060L) && (OPENSSL_VERSION_NUMBER < 0x10010060L)
-	conf->max_tls_version = 1.1;
-	WARN("OpenSSL version in range 1.0.1f-1.0.1g. "
-	     "TLSv1.2 disabled to workaround broken keying material export");
-#endif
-#endif
-
 	/*
 	 *	Cache conf in cs in case we're asked to parse this again.
 	 */
diff --git a/src/lib/tls/ctx.c b/src/lib/tls/ctx.c
index d92f0aeadc6..dfef1032183 100644
--- a/src/lib/tls/ctx.c
+++ b/src/lib/tls/ctx.c
@@ -40,8 +40,7 @@ USES_APPLE_DEPRECATED_API	/* OpenSSL API has been deprecated by Apple */
 #include "base.h"
 #include "missing.h"
 
-#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
-#  ifndef OPENSSL_NO_ECDH
+#ifndef OPENSSL_NO_ECDH
 static int ctx_ecdh_curve_set(SSL_CTX *ctx, char const *ecdh_curve, bool disable_single_dh_use)
 {
 	int      nid;
@@ -71,7 +70,6 @@ static int ctx_ecdh_curve_set(SSL_CTX *ctx, char const *ecdh_curve, bool disable
 
 	return 0;
 }
-#  endif
 #endif
 
 /*
@@ -156,7 +154,6 @@ static int tls_ctx_load_cert_chain(SSL_CTX *ctx, fr_tls_chain_conf_t const *chai
 		return -1;
 	}
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
 	{
 		size_t		extra_cnt, i;
 		/*
@@ -203,7 +200,6 @@ static int tls_ctx_load_cert_chain(SSL_CTX *ctx, fr_tls_chain_conf_t const *chai
 			SSL_CTX_add0_chain_cert(ctx, cert);
 		}
 	}
-#endif
 
 	/*
 	 *	Check if the last loaded private key matches the last
@@ -217,7 +213,6 @@ static int tls_ctx_load_cert_chain(SSL_CTX *ctx, fr_tls_chain_conf_t const *chai
 		return -1;
 	}
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
 	{
 		int mode = SSL_BUILD_CHAIN_FLAG_CHECK;
 
@@ -259,11 +254,9 @@ static int tls_ctx_load_cert_chain(SSL_CTX *ctx, fr_tls_chain_conf_t const *chai
 			break;
 		}
 	}
-#endif
 	return 0;
 }
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
 static void _tls_ctx_print_cert_line(int index, X509 *cert)
 {
 	char		subject[1024];
@@ -273,7 +266,6 @@ static void _tls_ctx_print_cert_line(int index, X509 *cert)
 
 	DEBUG3("[%i] %s %s", index, tls_utils_x509_pkey_type(cert), subject);
 }
-#endif
 
 /** Create SSL context
  *
@@ -291,10 +283,8 @@ SSL_CTX *tls_ctx_alloc(fr_tls_conf_t const *conf, bool client)
 {
 	SSL_CTX		*ctx;
 	X509_STORE	*cert_vpstore;
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
 	X509_STORE	*chain_store;
 	X509_STORE 	*verify_store;
-#endif
 	int		verify_mode = SSL_VERIFY_NONE;
 	int		ctx_options = 0;
 	void		*app_data_index;
@@ -415,7 +405,6 @@ SSL_CTX *tls_ctx_alloc(fr_tls_conf_t const *conf, bool client)
 		if (mode) SSL_CTX_set_mode(ctx, mode);
 	}
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
 	/*
 	 *	If we're using a sufficiently new version of
 	 *	OpenSSL, initialise different stores for creating
@@ -436,7 +425,7 @@ SSL_CTX *tls_ctx_alloc(fr_tls_conf_t const *conf, bool client)
 		MEM(verify_store = X509_STORE_new());
 		SSL_CTX_set0_verify_cert_store(ctx, verify_store);
 	}
-#endif
+
 	/*
 	 *	Load the CAs we trust
 	 */
@@ -471,7 +460,6 @@ SSL_CTX *tls_ctx_alloc(fr_tls_conf_t const *conf, bool client)
 			}
 		}
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
 		/*
 		 *	Print out our certificate chains.
 		 *
@@ -531,7 +519,6 @@ SSL_CTX *tls_ctx_alloc(fr_tls_conf_t const *conf, bool client)
 			}
 			(void)SSL_CTX_set_current_cert(ctx, SSL_CERT_SET_FIRST);	/* Reset */
 		}
-#endif
 	}
 
 	/*
@@ -723,12 +710,10 @@ post_ca:
 	/*
 	 *	Set eliptical curve crypto configuration.
 	 */
-#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
 #ifndef OPENSSL_NO_ECDH
 	if (ctx_ecdh_curve_set(ctx, conf->ecdh_curve, conf->disable_single_dh_use) < 0) {
 		goto error;
 	}
-#endif
 #endif
 
 	/* Set Info callback */
diff --git a/src/lib/tls/missing.h b/src/lib/tls/missing.h
index 5bec574acda..5cae7e0a072 100644
--- a/src/lib/tls/missing.h
+++ b/src/lib/tls/missing.h
@@ -82,9 +82,3 @@ static inline size_t SSL_SESSION_get_master_key(const SSL_SESSION *s, unsigned c
 	return outlen;
 }
 #endif
-
-#if OPENSSL_VERSION_NUMBER < 0x10001000L
-#  define ssl_session ssl->session
-#else
-#  define ssl_session session
-#endif
diff --git a/src/lib/tls/ocsp.c b/src/lib/tls/ocsp.c
index d36c851da86..74e4aabe009 100644
--- a/src/lib/tls/ocsp.c
+++ b/src/lib/tls/ocsp.c
@@ -267,11 +267,9 @@ int tls_ocsp_check(REQUEST *request, SSL *ssl,
 	ocsp_status_t	status;
 	ASN1_GENERALIZEDTIME *rev, *this_update, *next_update;
 	int		reason;
-#if OPENSSL_VERSION_NUMBER >= 0x1000003f
 	OCSP_REQ_CTX	*ctx;
 	int		rc;
 	struct timeval	when;
-#endif
 	struct timeval	now = { 0, 0 };
 	time_t		next;
 	VALUE_PAIR	*vp;
@@ -410,17 +408,6 @@ int tls_ocsp_check(REQUEST *request, SSL *ssl,
 	conn = BIO_new_connect(host);
 	BIO_set_conn_port(conn, port);
 
-#if OPENSSL_VERSION_NUMBER < 0x1000003f
-	BIO_do_connect(conn);
-
-	/* Send OCSP request and wait for response */
-	resp = OCSP_sendreq_bio(conn, path, req);
-	if (!resp) {
-		REDEBUG("Couldn't get OCSP response");
-		ocsp_status = OCSP_STATUS_SKIPPED;
-		goto finish;
-	}
-#else
 	if (conf->timeout) BIO_set_nbio(conn, 1);
 
 	rc = BIO_do_connect(conn);
@@ -474,7 +461,6 @@ int tls_ocsp_check(REQUEST *request, SSL *ssl,
 		ocsp_status = OCSP_STATUS_SKIPPED;
 		goto finish;
 	}
-#endif /* OPENSSL_VERSION_NUMBER < 0x1000003f */
 
 	/* Verify OCSP response status */
 	status = OCSP_response_status(resp);
diff --git a/src/lib/tls/session.c b/src/lib/tls/session.c
index 8f814bd966e..5a360a8a3f3 100644
--- a/src/lib/tls/session.c
+++ b/src/lib/tls/session.c
@@ -731,7 +731,7 @@ void tls_session_msg_cb(int write_p, int msg_version, int content_type,
 #endif
 
 	/*
-	 *	OpenSSL 1.0.2 calls this function with 'pseudo'
+	 *	OpenSSL >= 1.0.2 calls this function with 'pseudo'
 	 *	content types.  Which breaks our tracking of
 	 *	the SSL Session state.
 	 */
@@ -1389,15 +1389,14 @@ int tls_session_handshake(REQUEST *request, tls_session_t *session)
 			REXDENT();
 		}
 
-#if OPENSSL_VERSION_NUMBER >= 0x10001000L
 		/*
 		 *	Cache the SSL_SESSION pointer.
 		 *
 		 *	Which contains all the data we need for session resumption.
 		 */
-		if (!session->ssl_session) {
-			session->ssl_session = SSL_get_session(session->ssl);
-			if (!session->ssl_session) {
+		if (!session->session) {
+			session->session = SSL_get_session(session->ssl);
+			if (!session->session) {
 				REDEBUG("Failed getting TLS session");
 				return 0;
 			}
@@ -1408,14 +1407,13 @@ int tls_session_handshake(REQUEST *request, tls_session_t *session)
 
 			MEM(ssl_log = BIO_new(BIO_s_mem()));
 
-			if (SSL_SESSION_print(ssl_log, session->ssl_session) == 1) {
+			if (SSL_SESSION_print(ssl_log, session->session) == 1) {
 				SSL_DRAIN_ERROR_QUEUE(RDEBUG3, "", ssl_log);
 			} else {
 				RDEBUG3("Failed retrieving session data");
 			}
 			BIO_free(ssl_log);
 		}
-#endif
 
 		/*
 		 *	Session was resumed, add attribute to mark it as such.
diff --git a/src/modules/rlm_cipher/rlm_cipher.c b/src/modules/rlm_cipher/rlm_cipher.c
index d78670bee27..ab22de3b8fd 100644
--- a/src/modules/rlm_cipher/rlm_cipher.c
+++ b/src/modules/rlm_cipher/rlm_cipher.c
@@ -96,7 +96,6 @@ typedef struct {
 	uint8_t			*digest_buff;			//!< Pre-allocated digest buffer.
 } rlm_cipher_rsa_thread_inst_t;
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
 /** Configuration for the OAEP padding method
  *
  */
@@ -106,7 +105,6 @@ typedef struct {
 
 	char const		*label;				//!< Additional input to the hashing function.
 } cipher_rsa_oaep_t;
-#endif
 
 /** Configuration for RSA encryption/decryption/signing
  *
@@ -125,9 +123,7 @@ typedef struct {
 
 	EVP_MD			*sig_digest;			//!< Signature digest type.
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
 	cipher_rsa_oaep_t	*oaep;				//!< OAEP can use a configurable message digest type
-#endif								///< and additional keying labeleter.
 } cipher_rsa_t;
 
 /** Instance configuration
@@ -145,7 +141,6 @@ typedef struct {
 	};
 } rlm_cipher_t;
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
 /** Configuration for the RSA-PCKS1-OAEP padding scheme
  *
  */
@@ -156,7 +151,6 @@ static const CONF_PARSER rsa_oaep_config[] = {
 
 	CONF_PARSER_TERMINATOR
 };
-#endif
 
 /** Configuration for the RSA cipher type
  *
@@ -172,10 +166,9 @@ static const CONF_PARSER rsa_config[] = {
 
 	{ FR_CONF_OFFSET("padding_type", FR_TYPE_VOID | FR_TYPE_NOT_EMPTY, cipher_rsa_t, padding), .func = cipher_rsa_padding_type_parse, .dflt = "pkcs" },
 
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
 	{ FR_CONF_OFFSET("oaep", FR_TYPE_SUBSECTION, cipher_rsa_t, oaep),
 			 .subcs_size = sizeof(cipher_rsa_oaep_t), .subcs_type = "cipher_rsa_oaep_t", .subcs = (void const *) rsa_oaep_config },
-#endif
+
 	CONF_PARSER_TERMINATOR
 };
 
@@ -890,7 +883,6 @@ static int cipher_rsa_padding_params_set(EVP_PKEY_CTX *evp_pkey_ctx, cipher_rsa_
 	 *	Configure OAEP advanced padding options
 	 */
 	case RSA_PKCS1_OAEP_PADDING:
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
 		if (unlikely(EVP_PKEY_CTX_set_rsa_oaep_md(evp_pkey_ctx, rsa_inst->oaep->oaep_digest) <= 0)) {
 			tls_strerror_printf(NULL);
 			PERROR("%s: Failed setting OAEP digest", __FUNCTION__);
@@ -922,7 +914,6 @@ static int cipher_rsa_padding_params_set(EVP_PKEY_CTX *evp_pkey_ctx, cipher_rsa_
 				return -1;
 			}
 		}
-#endif
 		return 0;
 
 	default: