drop support for openssl 1.0 and very old libressl

diff --git a/pdns/libssl.cc b/pdns/libssl.cc
index 4a47b1c56f8f64789c24741a6d41efa137d1f6a6..d82542c22742435287d2b1593098985d6caf4ab0 100644 (file)
--- a/pdns/libssl.cc
+++ b/pdns/libssl.cc
@@ -48,44 +48,6 @@
 #include "misc.hh"
 #include "tcpiohandler.hh"
 
-#if (OPENSSL_VERSION_NUMBER < 0x1010000fL || (defined LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2090100fL)
-/* OpenSSL < 1.1.0 needs support for threading/locking in the calling application. */
-
-#include "lock.hh"
-static std::vector<std::mutex> openssllocks;
-
-extern "C" {
-static void openssl_pthreads_locking_callback(int mode, int type, const char *file, int line)
-{
-  if (mode & CRYPTO_LOCK) {
-    openssllocks.at(type).lock();
-
-  } else {
-    openssllocks.at(type).unlock();
-  }
-}
-
-static unsigned long openssl_pthreads_id_callback()
-{
-  return (unsigned long)pthread_self();
-}
-}
-
-static void openssl_thread_setup()
-{
-  openssllocks = std::vector<std::mutex>(CRYPTO_num_locks());
-  CRYPTO_set_id_callback(&openssl_pthreads_id_callback);
-  CRYPTO_set_locking_callback(&openssl_pthreads_locking_callback);
-}
-
-static void openssl_thread_cleanup()
-{
-  CRYPTO_set_locking_callback(nullptr);
-  openssllocks.clear();
-}
-
-#endif /* (OPENSSL_VERSION_NUMBER < 0x1010000fL || (defined LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2090100fL) */
-
 static std::atomic<uint64_t> s_users;
 
 #if OPENSSL_VERSION_MAJOR >= 3 && defined(HAVE_TLS_PROVIDERS)
@@ -127,13 +89,6 @@ void registerOpenSSLUser()
     OPENSSL_init_ssl(sslOpts, nullptr);
 #endif /* HAVE_OPENSSL_INIT_CRYPTO */
 
-#if (OPENSSL_VERSION_NUMBER < 0x1010000fL || (defined LIBRESSL_VERSION_NUMBER && LIBRESSL_VERSION_NUMBER < 0x2090100fL))
-    /* load error strings for both libcrypto and libssl */
-    SSL_load_error_strings();
-    /* load all ciphers and digests needed for TLS support */
-    OpenSSL_add_ssl_algorithms();
-    openssl_thread_setup();
-#endif
     s_ticketsKeyIndex = SSL_CTX_get_ex_new_index(0, nullptr, nullptr, nullptr, nullptr);
 
     if (s_ticketsKeyIndex == -1) {
@@ -164,18 +119,6 @@ void unregisterOpenSSLUser()
     }
     s_engines.lock()->clear();
 #endif /* PDNS_ENABLE_LIBSSL_ENGINE */
-#if (OPENSSL_VERSION_NUMBER < 0x1010000fL || (defined LIBRESSL_VERSION_NUMBER && LIBRESSL_VERSION_NUMBER < 0x2090100fL))
-    ERR_free_strings();
-
-    EVP_cleanup();
-
-    CONF_modules_finish();
-    CONF_modules_free();
-    CONF_modules_unload(1);
-
-    CRYPTO_cleanup_all_ex_data();
-    openssl_thread_cleanup();
-#endif
   }
 }
 

diff --git a/pdns/opensslsigners.cc b/pdns/opensslsigners.cc
index 3b028a097a7c5c4aa1ae2b9209f76f95e8e4fc0f..4efa14b4462613853d01d079145bf24903a3d16e 100644 (file)
--- a/pdns/opensslsigners.cc
+++ b/pdns/opensslsigners.cc
@@ -50,126 +50,8 @@
 #include "dnssecinfra.hh"
 #include "dnssec.hh"
 
-#if (OPENSSL_VERSION_NUMBER < 0x1010000fL || (defined LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2090100fL)
-/* OpenSSL < 1.1.0 needs support for threading/locking in the calling application. */
-
-#include "lock.hh"
-static std::vector<std::mutex> openssllocks;
-
-extern "C"
-{
-  static void openssl_pthreads_locking_callback(int mode, int type, const char* file, int line)
-  {
-    if (mode & CRYPTO_LOCK) {
-      openssllocks.at(type).lock();
-    }
-    else {
-      openssllocks.at(type).unlock();
-    }
-  }
-
-  static unsigned long openssl_pthreads_id_callback(void)
-  {
-    return (unsigned long)pthread_self();
-  }
-}
-
-void openssl_thread_setup()
-{
-  openssllocks = std::vector<std::mutex>(CRYPTO_num_locks());
-  CRYPTO_set_id_callback(&openssl_pthreads_id_callback);
-  CRYPTO_set_locking_callback(&openssl_pthreads_locking_callback);
-}
-
-void openssl_thread_cleanup()
-{
-  CRYPTO_set_locking_callback(nullptr);
-  openssllocks.clear();
-}
-
-#ifndef HAVE_RSA_GET0_KEY
-/* those symbols are defined in LibreSSL 2.7.0+ */
-/* compat helpers. These DO NOT do any of the checking that the libssl 1.1 functions do. */
-static inline void RSA_get0_key(const RSA* rsakey, const BIGNUM** n, const BIGNUM** e, const BIGNUM** d)
-{
-  *n = rsakey->n;
-  *e = rsakey->e;
-  *d = rsakey->d;
-}
-
-static inline int RSA_set0_key(RSA* rsakey, BIGNUM* n, BIGNUM* e, BIGNUM* d)
-{
-  if (n) {
-    BN_clear_free(rsakey->n);
-    rsakey->n = n;
-  }
-  if (e) {
-    BN_clear_free(rsakey->e);
-    rsakey->e = e;
-  }
-  if (d) {
-    BN_clear_free(rsakey->d);
-    rsakey->d = d;
-  }
-  return 1;
-}
-
-static inline void RSA_get0_factors(const RSA* rsakey, const BIGNUM** p, const BIGNUM** q)
-{
-  *p = rsakey->p;
-  *q = rsakey->q;
-}
-
-static inline int RSA_set0_factors(RSA* rsakey, BIGNUM* p, BIGNUM* q)
-{
-  BN_clear_free(rsakey->p);
-  rsakey->p = p;
-  BN_clear_free(rsakey->q);
-  rsakey->q = q;
-  return 1;
-}
-
-static inline void RSA_get0_crt_params(const RSA* rsakey, const BIGNUM** dmp1, const BIGNUM** dmq1, const BIGNUM** iqmp)
-{
-  *dmp1 = rsakey->dmp1;
-  *dmq1 = rsakey->dmq1;
-  *iqmp = rsakey->iqmp;
-}
-
-static inline int RSA_set0_crt_params(RSA* rsakey, BIGNUM* dmp1, BIGNUM* dmq1, BIGNUM* iqmp)
-{
-  BN_clear_free(rsakey->dmp1);
-  rsakey->dmp1 = dmp1;
-  BN_clear_free(rsakey->dmq1);
-  rsakey->dmq1 = dmq1;
-  BN_clear_free(rsakey->iqmp);
-  rsakey->iqmp = iqmp;
-  return 1;
-}
-
-#ifdef HAVE_LIBCRYPTO_ECDSA
-static inline void ECDSA_SIG_get0(const ECDSA_SIG* signature, const BIGNUM** pr, const BIGNUM** ps)
-{
-  *pr = signature->r;
-  *ps = signature->s;
-}
-
-static inline int ECDSA_SIG_set0(ECDSA_SIG* signature, BIGNUM* pr, BIGNUM* ps)
-{
-  BN_clear_free(signature->r);
-  BN_clear_free(signature->s);
-  signature->r = pr;
-  signature->s = ps;
-  return 1;
-}
-#endif /* HAVE_LIBCRYPTO_ECDSA */
-
-#endif /* HAVE_RSA_GET0_KEY */
-
-#else
 void openssl_thread_setup() {}
 void openssl_thread_cleanup() {}
-#endif
 
 /* seeding PRNG */
 void openssl_seed()

diff --git a/pdns/sha.hh b/pdns/sha.hh
index a5396d06e194c569fd95d1b4da8976ffcf03a328..be9171ce92d371dc6028d53e29a52a021600ef17 100644 (file)
--- a/pdns/sha.hh
+++ b/pdns/sha.hh
@@ -69,11 +69,7 @@ public:
   SHADigest() :
     SHADigest(256) {}
   SHADigest(unsigned int bits) :
-#if defined(HAVE_EVP_MD_CTX_NEW) && defined(HAVE_EVP_MD_CTX_FREE)
     mdctx(std::unique_ptr<EVP_MD_CTX, decltype(&EVP_MD_CTX_free)>(EVP_MD_CTX_new(), EVP_MD_CTX_free))
-#else
-    mdctx(std::unique_ptr<EVP_MD_CTX, decltype(&EVP_MD_CTX_destroy)>(EVP_MD_CTX_create(), EVP_MD_CTX_destroy))
-#endif
   {
     if (mdctx == nullptr) {
       throw std::runtime_error("SHADigest: EVP_MD_CTX_new failed");
@@ -121,11 +117,7 @@ public:
   }
 
 private:
-#if defined(HAVE_EVP_MD_CTX_NEW) && defined(HAVE_EVP_MD_CTX_FREE)
   std::unique_ptr<EVP_MD_CTX, decltype(&EVP_MD_CTX_free)> mdctx;
-#else
-  std::unique_ptr<EVP_MD_CTX, decltype(&EVP_MD_CTX_destroy)> mdctx;
-#endif
   const EVP_MD* md;
 };
 }

diff --git a/pdns/tcpiohandler.cc b/pdns/tcpiohandler.cc
index 5e19a5143fe8803aa924e0bd9b3ed8babf5f9a79..c005b408dd845299a77af39bc9b6e5295b3d3696 100644 (file)
--- a/pdns/tcpiohandler.cc
+++ b/pdns/tcpiohandler.cc
@@ -200,19 +200,15 @@ public:
     }
 
     if (hostIsAddr) {
-#if (OPENSSL_VERSION_NUMBER >= 0x10002000L)
       X509_VERIFY_PARAM *param = SSL_get0_param(d_conn.get());
       /* Enable automatic IP checks */
       X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
       if (X509_VERIFY_PARAM_set1_ip_asc(param, d_hostname.c_str()) != 1) {
         throw std::runtime_error("Error setting TLS IP for certificate validation");
       }
-#else
-      /* no validation for you, see https://wiki.openssl.org/index.php/Hostname_validation */
-#endif
     }
     else {
-#if (OPENSSL_VERSION_NUMBER >= 0x1010000fL) && defined(HAVE_SSL_SET_HOSTFLAGS) // grrr libressl
+#if defined(HAVE_SSL_SET_HOSTFLAGS) // grrr libressl // FIXME this PR: see if libressl still needs this #if, then clean up further
       SSL_set_hostflags(d_conn.get(), X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
 #if !defined(OPENSSL_VERSION_MAJOR) || OPENSSL_VERSION_MAJOR < 4
       auto ret = SSL_set1_host(d_conn.get(), d_hostname.c_str());
@@ -222,15 +218,13 @@ public:
       if (ret != 1) {
         throw std::runtime_error("Error setting TLS hostname for certificate validation");
       }
-#elif (OPENSSL_VERSION_NUMBER >= 0x10002000L)
+#else
       X509_VERIFY_PARAM *param = SSL_get0_param(d_conn.get());
       /* Enable automatic hostname checks */
       X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
       if (X509_VERIFY_PARAM_set1_host(param, d_hostname.c_str(), d_hostname.size()) != 1) {
         throw std::runtime_error("Error setting TLS hostname for certificate validation");
       }
-#else
-      /* no hostname validation for you, see https://wiki.openssl.org/index.php/Hostname_validation */
 #endif
     }
 
@@ -852,14 +846,6 @@ public:
       }
 
       SSL_CTX_set_verify(d_tlsCtx.get(), SSL_VERIFY_PEER, nullptr);
-#if (OPENSSL_VERSION_NUMBER < 0x10002000L)
-#if defined(DNSDIST)
-      SLOG(warnlog("TLS hostname validation requested but not supported for OpenSSL < 1.0.2"),
-           dnsdist::logging::getTopLogger("openssl-client-side")->info(Logr::Warning, "TLS hostname validation requested but not supported for OpenSSL < 1.0.2"));
-#else /* DNSDIST */
-      warnlog("TLS hostname validation requested but not supported for OpenSSL < 1.0.2");
-#endif /* DNSDIST */
-#endif /* OPENSSL_VERSION_NUMBER < 0x10002000L */
     }
 
     /* we need to set SSL_SESS_CACHE_CLIENT for the "new ticket" callback (below) to be called,