From: Peter van Dijk Date: Mon, 27 Jul 2026 19:10:02 +0000 (+0200) Subject: drop support for openssl 1.0 and very old libressl X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e70cc07d8724b9bb14832e5259f1e3c8cde6501e;p=thirdparty%2Fpdns.git drop support for openssl 1.0 and very old libressl --- diff --git a/pdns/libssl.cc b/pdns/libssl.cc index 4a47b1c56f..d82542c227 100644 --- a/pdns/libssl.cc +++ b/pdns/libssl.cc @@ -48,44 +48,6 @@ #include "misc.hh" #include "tcpiohandler.hh" -#if (OPENSSL_VERSION_NUMBER < 0x1010000fL || (defined LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2090100fL) -/* OpenSSL < 1.1.0 needs support for threading/locking in the calling application. */ - -#include "lock.hh" -static std::vector openssllocks; - -extern "C" { -static void openssl_pthreads_locking_callback(int mode, int type, const char *file, int line) -{ - if (mode & CRYPTO_LOCK) { - openssllocks.at(type).lock(); - - } else { - openssllocks.at(type).unlock(); - } -} - -static unsigned long openssl_pthreads_id_callback() -{ - return (unsigned long)pthread_self(); -} -} - -static void openssl_thread_setup() -{ - openssllocks = std::vector(CRYPTO_num_locks()); - CRYPTO_set_id_callback(&openssl_pthreads_id_callback); - CRYPTO_set_locking_callback(&openssl_pthreads_locking_callback); -} - -static void openssl_thread_cleanup() -{ - CRYPTO_set_locking_callback(nullptr); - openssllocks.clear(); -} - -#endif /* (OPENSSL_VERSION_NUMBER < 0x1010000fL || (defined LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2090100fL) */ - static std::atomic s_users; #if OPENSSL_VERSION_MAJOR >= 3 && defined(HAVE_TLS_PROVIDERS) @@ -127,13 +89,6 @@ void registerOpenSSLUser() OPENSSL_init_ssl(sslOpts, nullptr); #endif /* HAVE_OPENSSL_INIT_CRYPTO */ -#if (OPENSSL_VERSION_NUMBER < 0x1010000fL || (defined LIBRESSL_VERSION_NUMBER && LIBRESSL_VERSION_NUMBER < 0x2090100fL)) - /* load error strings for both libcrypto and libssl */ - SSL_load_error_strings(); - /* load all ciphers and digests needed for TLS support */ - OpenSSL_add_ssl_algorithms(); - openssl_thread_setup(); -#endif s_ticketsKeyIndex = SSL_CTX_get_ex_new_index(0, nullptr, nullptr, nullptr, nullptr); if (s_ticketsKeyIndex == -1) { @@ -164,18 +119,6 @@ void unregisterOpenSSLUser() } s_engines.lock()->clear(); #endif /* PDNS_ENABLE_LIBSSL_ENGINE */ -#if (OPENSSL_VERSION_NUMBER < 0x1010000fL || (defined LIBRESSL_VERSION_NUMBER && LIBRESSL_VERSION_NUMBER < 0x2090100fL)) - ERR_free_strings(); - - EVP_cleanup(); - - CONF_modules_finish(); - CONF_modules_free(); - CONF_modules_unload(1); - - CRYPTO_cleanup_all_ex_data(); - openssl_thread_cleanup(); -#endif } } diff --git a/pdns/opensslsigners.cc b/pdns/opensslsigners.cc index 3b028a097a..4efa14b446 100644 --- a/pdns/opensslsigners.cc +++ b/pdns/opensslsigners.cc @@ -50,126 +50,8 @@ #include "dnssecinfra.hh" #include "dnssec.hh" -#if (OPENSSL_VERSION_NUMBER < 0x1010000fL || (defined LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2090100fL) -/* OpenSSL < 1.1.0 needs support for threading/locking in the calling application. */ - -#include "lock.hh" -static std::vector openssllocks; - -extern "C" -{ - static void openssl_pthreads_locking_callback(int mode, int type, const char* file, int line) - { - if (mode & CRYPTO_LOCK) { - openssllocks.at(type).lock(); - } - else { - openssllocks.at(type).unlock(); - } - } - - static unsigned long openssl_pthreads_id_callback(void) - { - return (unsigned long)pthread_self(); - } -} - -void openssl_thread_setup() -{ - openssllocks = std::vector(CRYPTO_num_locks()); - CRYPTO_set_id_callback(&openssl_pthreads_id_callback); - CRYPTO_set_locking_callback(&openssl_pthreads_locking_callback); -} - -void openssl_thread_cleanup() -{ - CRYPTO_set_locking_callback(nullptr); - openssllocks.clear(); -} - -#ifndef HAVE_RSA_GET0_KEY -/* those symbols are defined in LibreSSL 2.7.0+ */ -/* compat helpers. These DO NOT do any of the checking that the libssl 1.1 functions do. */ -static inline void RSA_get0_key(const RSA* rsakey, const BIGNUM** n, const BIGNUM** e, const BIGNUM** d) -{ - *n = rsakey->n; - *e = rsakey->e; - *d = rsakey->d; -} - -static inline int RSA_set0_key(RSA* rsakey, BIGNUM* n, BIGNUM* e, BIGNUM* d) -{ - if (n) { - BN_clear_free(rsakey->n); - rsakey->n = n; - } - if (e) { - BN_clear_free(rsakey->e); - rsakey->e = e; - } - if (d) { - BN_clear_free(rsakey->d); - rsakey->d = d; - } - return 1; -} - -static inline void RSA_get0_factors(const RSA* rsakey, const BIGNUM** p, const BIGNUM** q) -{ - *p = rsakey->p; - *q = rsakey->q; -} - -static inline int RSA_set0_factors(RSA* rsakey, BIGNUM* p, BIGNUM* q) -{ - BN_clear_free(rsakey->p); - rsakey->p = p; - BN_clear_free(rsakey->q); - rsakey->q = q; - return 1; -} - -static inline void RSA_get0_crt_params(const RSA* rsakey, const BIGNUM** dmp1, const BIGNUM** dmq1, const BIGNUM** iqmp) -{ - *dmp1 = rsakey->dmp1; - *dmq1 = rsakey->dmq1; - *iqmp = rsakey->iqmp; -} - -static inline int RSA_set0_crt_params(RSA* rsakey, BIGNUM* dmp1, BIGNUM* dmq1, BIGNUM* iqmp) -{ - BN_clear_free(rsakey->dmp1); - rsakey->dmp1 = dmp1; - BN_clear_free(rsakey->dmq1); - rsakey->dmq1 = dmq1; - BN_clear_free(rsakey->iqmp); - rsakey->iqmp = iqmp; - return 1; -} - -#ifdef HAVE_LIBCRYPTO_ECDSA -static inline void ECDSA_SIG_get0(const ECDSA_SIG* signature, const BIGNUM** pr, const BIGNUM** ps) -{ - *pr = signature->r; - *ps = signature->s; -} - -static inline int ECDSA_SIG_set0(ECDSA_SIG* signature, BIGNUM* pr, BIGNUM* ps) -{ - BN_clear_free(signature->r); - BN_clear_free(signature->s); - signature->r = pr; - signature->s = ps; - return 1; -} -#endif /* HAVE_LIBCRYPTO_ECDSA */ - -#endif /* HAVE_RSA_GET0_KEY */ - -#else void openssl_thread_setup() {} void openssl_thread_cleanup() {} -#endif /* seeding PRNG */ void openssl_seed() diff --git a/pdns/sha.hh b/pdns/sha.hh index a5396d06e1..be9171ce92 100644 --- a/pdns/sha.hh +++ b/pdns/sha.hh @@ -69,11 +69,7 @@ public: SHADigest() : SHADigest(256) {} SHADigest(unsigned int bits) : -#if defined(HAVE_EVP_MD_CTX_NEW) && defined(HAVE_EVP_MD_CTX_FREE) mdctx(std::unique_ptr(EVP_MD_CTX_new(), EVP_MD_CTX_free)) -#else - mdctx(std::unique_ptr(EVP_MD_CTX_create(), EVP_MD_CTX_destroy)) -#endif { if (mdctx == nullptr) { throw std::runtime_error("SHADigest: EVP_MD_CTX_new failed"); @@ -121,11 +117,7 @@ public: } private: -#if defined(HAVE_EVP_MD_CTX_NEW) && defined(HAVE_EVP_MD_CTX_FREE) std::unique_ptr mdctx; -#else - std::unique_ptr mdctx; -#endif const EVP_MD* md; }; } diff --git a/pdns/tcpiohandler.cc b/pdns/tcpiohandler.cc index 5e19a5143f..c005b408dd 100644 --- a/pdns/tcpiohandler.cc +++ b/pdns/tcpiohandler.cc @@ -200,19 +200,15 @@ public: } if (hostIsAddr) { -#if (OPENSSL_VERSION_NUMBER >= 0x10002000L) X509_VERIFY_PARAM *param = SSL_get0_param(d_conn.get()); /* Enable automatic IP checks */ X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS); if (X509_VERIFY_PARAM_set1_ip_asc(param, d_hostname.c_str()) != 1) { throw std::runtime_error("Error setting TLS IP for certificate validation"); } -#else - /* no validation for you, see https://wiki.openssl.org/index.php/Hostname_validation */ -#endif } else { -#if (OPENSSL_VERSION_NUMBER >= 0x1010000fL) && defined(HAVE_SSL_SET_HOSTFLAGS) // grrr libressl +#if defined(HAVE_SSL_SET_HOSTFLAGS) // grrr libressl // FIXME this PR: see if libressl still needs this #if, then clean up further SSL_set_hostflags(d_conn.get(), X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS); #if !defined(OPENSSL_VERSION_MAJOR) || OPENSSL_VERSION_MAJOR < 4 auto ret = SSL_set1_host(d_conn.get(), d_hostname.c_str()); @@ -222,15 +218,13 @@ public: if (ret != 1) { throw std::runtime_error("Error setting TLS hostname for certificate validation"); } -#elif (OPENSSL_VERSION_NUMBER >= 0x10002000L) +#else X509_VERIFY_PARAM *param = SSL_get0_param(d_conn.get()); /* Enable automatic hostname checks */ X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS); if (X509_VERIFY_PARAM_set1_host(param, d_hostname.c_str(), d_hostname.size()) != 1) { throw std::runtime_error("Error setting TLS hostname for certificate validation"); } -#else - /* no hostname validation for you, see https://wiki.openssl.org/index.php/Hostname_validation */ #endif } @@ -852,14 +846,6 @@ public: } SSL_CTX_set_verify(d_tlsCtx.get(), SSL_VERIFY_PEER, nullptr); -#if (OPENSSL_VERSION_NUMBER < 0x10002000L) -#if defined(DNSDIST) - SLOG(warnlog("TLS hostname validation requested but not supported for OpenSSL < 1.0.2"), - dnsdist::logging::getTopLogger("openssl-client-side")->info(Logr::Warning, "TLS hostname validation requested but not supported for OpenSSL < 1.0.2")); -#else /* DNSDIST */ - warnlog("TLS hostname validation requested but not supported for OpenSSL < 1.0.2"); -#endif /* DNSDIST */ -#endif /* OPENSSL_VERSION_NUMBER < 0x10002000L */ } /* we need to set SSL_SESS_CACHE_CLIENT for the "new ticket" callback (below) to be called,