RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2024-12-24 21:52:17 +00:00
Code Issues Packages Projects Releases Wiki Activity
2c315ee75e
haproxy/include/common/openssl-compat.h

370 lines
10 KiB
C
Raw Normal View History

REORG: ssl: move openssl-compat from proto to common This way we can include it much earlier to cover types/ as well.
2019-05-09 12:52:44 +00:00
#ifndef _COMMON_OPENSSL_COMPAT_H
#define _COMMON_OPENSSL_COMPAT_H
CLEANUP: ssl: make inclusion of openssl headers safe It's always a pain to have to stuff lots of #ifdef USE_OPENSSL around ssl headers, it even results in some of them appearing in a random order and multiple times just to benefit form an existing ifdef block. Let's make these headers safe for inclusion when USE_OPENSSL is not defined, they now perform the test themselves and do nothing if USE_OPENSSL is not defined. This allows to remove no less than 8 such ifdef blocks and make include blocks more readable.
2019-05-10 07:58:43 +00:00
#ifdef USE_OPENSSL
CLEANUP: ssl: never include openssl/*.h outside of openssl-compat.h anymore Since we're providing a compatibility layer for multiple OpenSSL implementations and their derivatives, it is important that no C file directly includes openssl headers but only passes via openssl-compat instead. As a bonus this also gets rid of redundant complex rules for inclusion of certain files (engines etc).
2019-05-10 07:35:00 +00:00
#include <openssl/bn.h>
MEDIUM: ssl: Add support for OpenSSL 1.1.0 In the last release a lot of the structures have become opaque for an end user. This means the code using these needs to be changed to use the proper functions to interact with these structures instead of trying to manipulate them directly. This does not fix any deprecations yet that are part of 1.1.0, it only ensures that it can be compiled against that version and is still compatible with older ones. [wt: openssl-0.9.8 doesn't build with it, there are conflicts on certain function prototypes which we declare as inline here and which are defined differently there. But openssl-0.9.8 is not supported anymore so probably it's OK to go without it for now and we'll see later if some users still need it. Emeric has reviewed this change and didn't spot anything obvious which requires special care. Let's try it for real now]
2016-08-29 11:26:37 +00:00
#include <openssl/crypto.h>
#include <openssl/ssl.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include <openssl/err.h>
#include <openssl/rand.h>
CLEANUP: ssl: never include openssl/*.h outside of openssl-compat.h anymore Since we're providing a compatibility layer for multiple OpenSSL implementations and their derivatives, it is important that no C file directly includes openssl headers but only passes via openssl-compat instead. As a bonus this also gets rid of redundant complex rules for inclusion of certain files (engines etc).
2019-05-10 07:35:00 +00:00
#include <openssl/hmac.h>
MEDIUM: ssl: Add support for OpenSSL 1.1.0 In the last release a lot of the structures have become opaque for an end user. This means the code using these needs to be changed to use the proper functions to interact with these structures instead of trying to manipulate them directly. This does not fix any deprecations yet that are part of 1.1.0, it only ensures that it can be compiled against that version and is still compatible with older ones. [wt: openssl-0.9.8 doesn't build with it, there are conflicts on certain function prototypes which we declare as inline here and which are defined differently there. But openssl-0.9.8 is not supported anymore so probably it's OK to go without it for now and we'll see later if some users still need it. Emeric has reviewed this change and didn't spot anything obvious which requires special care. Let's try it for real now]
2016-08-29 11:26:37 +00:00
#if (defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP)
#include <openssl/ocsp.h>
#endif
#ifndef OPENSSL_NO_DH
#include <openssl/dh.h>
#endif
CLEANUP: ssl: never include openssl/*.h outside of openssl-compat.h anymore Since we're providing a compatibility layer for multiple OpenSSL implementations and their derivatives, it is important that no C file directly includes openssl headers but only passes via openssl-compat instead. As a bonus this also gets rid of redundant complex rules for inclusion of certain files (engines etc).
2019-05-10 07:35:00 +00:00
#ifndef OPENSSL_NO_ENGINE
#include <openssl/engine.h>
#endif
#if (OPENSSL_VERSION_NUMBER >= 0x1010000fL) && !defined(OPENSSL_NO_ASYNC) && !defined(LIBRESSL_VERSION_NUMBER)
#include <openssl/async.h>
#endif
MEDIUM: ssl: Add support for OpenSSL 1.1.0 In the last release a lot of the structures have become opaque for an end user. This means the code using these needs to be changed to use the proper functions to interact with these structures instead of trying to manipulate them directly. This does not fix any deprecations yet that are part of 1.1.0, it only ensures that it can be compiled against that version and is still compatible with older ones. [wt: openssl-0.9.8 doesn't build with it, there are conflicts on certain function prototypes which we declare as inline here and which are defined differently there. But openssl-0.9.8 is not supported anymore so probably it's OK to go without it for now and we'll see later if some users still need it. Emeric has reviewed this change and didn't spot anything obvious which requires special care. Let's try it for real now]
2016-08-29 11:26:37 +00:00
BUILD: ssl: make libressl use its own version numbers LibreSSL causes lots of build issues by pretending to be OpenSSL 2.0.0, and it requires lots of care for each #if added to cover any specific OpenSSL features. This commit addresses the problem by making LibreSSL only advertise the version it forked from (1.0.1g) and by starting to use tests based on its real version to enable features instead of working by exclusion.
2019-05-09 11:41:45 +00:00
#if defined(LIBRESSL_VERSION_NUMBER)
/* LibreSSL is a fork of OpenSSL 1.0.1g but pretends to be 2.0.0, thus
* systematically breaking when some code is written for a specific version
* of OpenSSL. Let's make it appear like what it really is and deal with
* extra features with ORs and not with AND NOT.
*/
#define HA_OPENSSL_VERSION_NUMBER 0x1000107fL
#else /* this is for a real OpenSSL or a truly compatible derivative */
CLEANUP: ssl-sock: use HA_OPENSSL_VERSION_NUMBER instead of OPENSSL_VERSION_NUMBER Most tests on OPENSSL_VERSION_NUMBER have become complex and break all the time because this number is fake for some derivatives like LibreSSL. This patch creates a new macro, HA_OPENSSL_VERSION_NUMBER, which will carry the real openssl version defining the compatibility level, and this version will be adjusted depending on the variants.
2019-05-09 11:26:41 +00:00
#define HA_OPENSSL_VERSION_NUMBER OPENSSL_VERSION_NUMBER
BUILD: ssl: make libressl use its own version numbers LibreSSL causes lots of build issues by pretending to be OpenSSL 2.0.0, and it requires lots of care for each #if added to cover any specific OpenSSL features. This commit addresses the problem by making LibreSSL only advertise the version it forked from (1.0.1g) and by starting to use tests based on its real version to enable features instead of working by exclusion.
2019-05-09 11:41:45 +00:00
#endif
CLEANUP: ssl-sock: use HA_OPENSSL_VERSION_NUMBER instead of OPENSSL_VERSION_NUMBER Most tests on OPENSSL_VERSION_NUMBER have become complex and break all the time because this number is fake for some derivatives like LibreSSL. This patch creates a new macro, HA_OPENSSL_VERSION_NUMBER, which will carry the real openssl version defining the compatibility level, and this version will be adjusted depending on the variants.
2019-05-09 11:26:41 +00:00
REORG: ssl: move some OpenSSL defines from ssl_sock to openssl-compat Some defines like OPENSSL_VERSION or X509_getm_notBefore() have nothing to do in ssl_sock and must move to openssl-compat.h so that they are consistently shared by the whole code. A warning in the code was added against wild additions of macros there.
2019-05-10 07:22:53 +00:00
#ifndef OPENSSL_VERSION
#define OPENSSL_VERSION SSLEAY_VERSION
#define OpenSSL_version(x) SSLeay_version(x)
#define OpenSSL_version_num SSLeay
#endif
CLEANUP: ssl-sock: use HA_OPENSSL_VERSION_NUMBER instead of OPENSSL_VERSION_NUMBER Most tests on OPENSSL_VERSION_NUMBER have become complex and break all the time because this number is fake for some derivatives like LibreSSL. This patch creates a new macro, HA_OPENSSL_VERSION_NUMBER, which will carry the real openssl version defining the compatibility level, and this version will be adjusted depending on the variants.
2019-05-09 11:26:41 +00:00
#if (HA_OPENSSL_VERSION_NUMBER < 0x0090800fL)
BUILD: ssl: make the SSL layer build again with openssl 0.9.8 Commit 1866d6d ("MEDIUM: ssl: Add support for OpenSSL 1.1.0") introduced support for openssl 1.1.0 and temporarily broke 0.9.8. In the end the port was not very hard given that the only cause of build failures were functions supposedly absent from 0.9.8 that in fact did exist. Thus, adding a new #if to move these functions for versions older than 0.9.8 was enough to fix the trouble. It received very light testing, basically only an SSL bridge decrypting and re-encrypting traffic, and checking that everything looks right. That said, the functions specific to 0.9.8 here compared to 1.0.x are only SSL_SESSION_set1_id_context(), EVP_PKEY_base_id(), and X509_PUBKEY_get0_param().
2016-11-24 19:07:11 +00:00
/* Functions present in OpenSSL 0.9.8, older not tested */
MEDIUM: ssl: Add support for OpenSSL 1.1.0 In the last release a lot of the structures have become opaque for an end user. This means the code using these needs to be changed to use the proper functions to interact with these structures instead of trying to manipulate them directly. This does not fix any deprecations yet that are part of 1.1.0, it only ensures that it can be compiled against that version and is still compatible with older ones. [wt: openssl-0.9.8 doesn't build with it, there are conflicts on certain function prototypes which we declare as inline here and which are defined differently there. But openssl-0.9.8 is not supported anymore so probably it's OK to go without it for now and we'll see later if some users still need it. Emeric has reviewed this change and didn't spot anything obvious which requires special care. Let's try it for real now]
2016-08-29 11:26:37 +00:00
static inline const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *sess, unsigned int *sid_length)
{
*sid_length = sess->session_id_length;
return sess->session_id;
}
static inline X509_NAME_ENTRY *X509_NAME_get_entry(const X509_NAME *name, int loc)
{
return sk_X509_NAME_ENTRY_value(name->entries, loc);
}
static inline ASN1_OBJECT *X509_NAME_ENTRY_get_object(const X509_NAME_ENTRY *ne)
{
return ne->object;
}
static inline ASN1_STRING *X509_NAME_ENTRY_get_data(const X509_NAME_ENTRY *ne)
{
return ne->value;
}
static inline int ASN1_STRING_length(const ASN1_STRING *x)
{
return x->length;
}
static inline int X509_NAME_entry_count(X509_NAME *name)
{
return sk_X509_NAME_ENTRY_num(name->entries)
}
BUILD: ssl: make the SSL layer build again with openssl 0.9.8 Commit 1866d6d ("MEDIUM: ssl: Add support for OpenSSL 1.1.0") introduced support for openssl 1.1.0 and temporarily broke 0.9.8. In the end the port was not very hard given that the only cause of build failures were functions supposedly absent from 0.9.8 that in fact did exist. Thus, adding a new #if to move these functions for versions older than 0.9.8 was enough to fix the trouble. It received very light testing, basically only an SSL bridge decrypting and re-encrypting traffic, and checking that everything looks right. That said, the functions specific to 0.9.8 here compared to 1.0.x are only SSL_SESSION_set1_id_context(), EVP_PKEY_base_id(), and X509_PUBKEY_get0_param().
2016-11-24 19:07:11 +00:00
static inline void X509_ALGOR_get0(ASN1_OBJECT **paobj, int *pptype, const void **ppval, const X509_ALGOR *algor)
MEDIUM: ssl: Add support for OpenSSL 1.1.0 In the last release a lot of the structures have become opaque for an end user. This means the code using these needs to be changed to use the proper functions to interact with these structures instead of trying to manipulate them directly. This does not fix any deprecations yet that are part of 1.1.0, it only ensures that it can be compiled against that version and is still compatible with older ones. [wt: openssl-0.9.8 doesn't build with it, there are conflicts on certain function prototypes which we declare as inline here and which are defined differently there. But openssl-0.9.8 is not supported anymore so probably it's OK to go without it for now and we'll see later if some users still need it. Emeric has reviewed this change and didn't spot anything obvious which requires special care. Let's try it for real now]
2016-08-29 11:26:37 +00:00
{
BUILD: ssl: make the SSL layer build again with openssl 0.9.8 Commit 1866d6d ("MEDIUM: ssl: Add support for OpenSSL 1.1.0") introduced support for openssl 1.1.0 and temporarily broke 0.9.8. In the end the port was not very hard given that the only cause of build failures were functions supposedly absent from 0.9.8 that in fact did exist. Thus, adding a new #if to move these functions for versions older than 0.9.8 was enough to fix the trouble. It received very light testing, basically only an SSL bridge decrypting and re-encrypting traffic, and checking that everything looks right. That said, the functions specific to 0.9.8 here compared to 1.0.x are only SSL_SESSION_set1_id_context(), EVP_PKEY_base_id(), and X509_PUBKEY_get0_param().
2016-11-24 19:07:11 +00:00
*paobj = algor->algorithm;
}
#endif // OpenSSL < 0.9.8
CLEANUP: ssl-sock: use HA_OPENSSL_VERSION_NUMBER instead of OPENSSL_VERSION_NUMBER Most tests on OPENSSL_VERSION_NUMBER have become complex and break all the time because this number is fake for some derivatives like LibreSSL. This patch creates a new macro, HA_OPENSSL_VERSION_NUMBER, which will carry the real openssl version defining the compatibility level, and this version will be adjusted depending on the variants.
2019-05-09 11:26:41 +00:00
#if (HA_OPENSSL_VERSION_NUMBER < 0x1000000fL)
BUILD: ssl: fix build on OpenSSL 1.0.0 After the code was ported to support 1.1.0, this one broke on 1.0.0 : src/shctx.c:406: undefined reference to `SSL_SESSION_set1_id_context' The function was indeed introduced only in 1.0.1. The build was validated with 0.9.8, 1.0.0, 1.0.1, 1.0.2 and 1.1.0. This fix must be backported to 1.7.
2017-01-19 16:04:02 +00:00
/* Functions introduced in OpenSSL 1.0.0 */
BUILD: ssl: make the SSL layer build again with openssl 0.9.8 Commit 1866d6d ("MEDIUM: ssl: Add support for OpenSSL 1.1.0") introduced support for openssl 1.1.0 and temporarily broke 0.9.8. In the end the port was not very hard given that the only cause of build failures were functions supposedly absent from 0.9.8 that in fact did exist. Thus, adding a new #if to move these functions for versions older than 0.9.8 was enough to fix the trouble. It received very light testing, basically only an SSL bridge decrypting and re-encrypting traffic, and checking that everything looks right. That said, the functions specific to 0.9.8 here compared to 1.0.x are only SSL_SESSION_set1_id_context(), EVP_PKEY_base_id(), and X509_PUBKEY_get0_param().
2016-11-24 19:07:11 +00:00
static inline int EVP_PKEY_base_id(const EVP_PKEY *pkey)
MEDIUM: ssl: Add support for OpenSSL 1.1.0 In the last release a lot of the structures have become opaque for an end user. This means the code using these needs to be changed to use the proper functions to interact with these structures instead of trying to manipulate them directly. This does not fix any deprecations yet that are part of 1.1.0, it only ensures that it can be compiled against that version and is still compatible with older ones. [wt: openssl-0.9.8 doesn't build with it, there are conflicts on certain function prototypes which we declare as inline here and which are defined differently there. But openssl-0.9.8 is not supported anymore so probably it's OK to go without it for now and we'll see later if some users still need it. Emeric has reviewed this change and didn't spot anything obvious which requires special care. Let's try it for real now]
2016-08-29 11:26:37 +00:00
{
BUILD: ssl: make the SSL layer build again with openssl 0.9.8 Commit 1866d6d ("MEDIUM: ssl: Add support for OpenSSL 1.1.0") introduced support for openssl 1.1.0 and temporarily broke 0.9.8. In the end the port was not very hard given that the only cause of build failures were functions supposedly absent from 0.9.8 that in fact did exist. Thus, adding a new #if to move these functions for versions older than 0.9.8 was enough to fix the trouble. It received very light testing, basically only an SSL bridge decrypting and re-encrypting traffic, and checking that everything looks right. That said, the functions specific to 0.9.8 here compared to 1.0.x are only SSL_SESSION_set1_id_context(), EVP_PKEY_base_id(), and X509_PUBKEY_get0_param().
2016-11-24 19:07:11 +00:00
return EVP_PKEY_type(pkey->type);
}
/* minimal implementation based on the fact that the only known call place
* doesn't make use of other arguments.
*/
static inline int X509_PUBKEY_get0_param(ASN1_OBJECT **ppkalg, const unsigned char **pk, int *ppklen, X509_ALGOR **pa, X509_PUBKEY *pub)
{
*ppkalg = pub->algor->algorithm;
return 1;
MEDIUM: ssl: Add support for OpenSSL 1.1.0 In the last release a lot of the structures have become opaque for an end user. This means the code using these needs to be changed to use the proper functions to interact with these structures instead of trying to manipulate them directly. This does not fix any deprecations yet that are part of 1.1.0, it only ensures that it can be compiled against that version and is still compatible with older ones. [wt: openssl-0.9.8 doesn't build with it, there are conflicts on certain function prototypes which we declare as inline here and which are defined differently there. But openssl-0.9.8 is not supported anymore so probably it's OK to go without it for now and we'll see later if some users still need it. Emeric has reviewed this change and didn't spot anything obvious which requires special care. Let's try it for real now]
2016-08-29 11:26:37 +00:00
}
#ifndef X509_get_X509_PUBKEY
#define X509_get_X509_PUBKEY(x) ((x)->cert_info->key
#endif
#endif
CLEANUP: ssl-sock: use HA_OPENSSL_VERSION_NUMBER instead of OPENSSL_VERSION_NUMBER Most tests on OPENSSL_VERSION_NUMBER have become complex and break all the time because this number is fake for some derivatives like LibreSSL. This patch creates a new macro, HA_OPENSSL_VERSION_NUMBER, which will carry the real openssl version defining the compatibility level, and this version will be adjusted depending on the variants.
2019-05-09 11:26:41 +00:00
#if (HA_OPENSSL_VERSION_NUMBER < 0x1000100fL)
BUILD: ssl: fix build on OpenSSL 1.0.0 After the code was ported to support 1.1.0, this one broke on 1.0.0 : src/shctx.c:406: undefined reference to `SSL_SESSION_set1_id_context' The function was indeed introduced only in 1.0.1. The build was validated with 0.9.8, 1.0.0, 1.0.1, 1.0.2 and 1.1.0. This fix must be backported to 1.7.
2017-01-19 16:04:02 +00:00
/*
* Functions introduced in OpenSSL 1.0.1
*/
static inline int SSL_SESSION_set1_id_context(SSL_SESSION *s, const unsigned char *sid_ctx, unsigned int sid_ctx_len)
{
s->sid_ctx_length = sid_ctx_len;
memcpy(s->sid_ctx, sid_ctx, sid_ctx_len);
return 1;
}
#endif
BUG/MINOR: ssl: fix build with openssl < 1.1.0 8c1cddef ("MINOR: ssl: new functions duplicate and free a ckch_store") use some OpenSSL refcount functions that were introduced in OpenSSL 1.0.2 and OpenSSL 1.1.0. Fix the problem by introducing them in openssl-compat.h. Fix #336.
2019-10-23 17:40:28 +00:00
BUG/MINOR: ssl: fix build of X509_chain_up_ref() w/ libreSSL LibreSSL brought X509_chain_up_ref() in 2.7.5, so no need to build our own version starting from this version.
2019-10-23 21:15:46 +00:00
#if (HA_OPENSSL_VERSION_NUMBER < 0x1000200fL) && (LIBRESSL_VERSION_NUMBER < 0x2070500fL)
BUG/MINOR: ssl: fix build with openssl < 1.1.0 8c1cddef ("MINOR: ssl: new functions duplicate and free a ckch_store") use some OpenSSL refcount functions that were introduced in OpenSSL 1.0.2 and OpenSSL 1.1.0. Fix the problem by introducing them in openssl-compat.h. Fix #336.
2019-10-23 17:40:28 +00:00
/* introduced in openssl 1.0.2 */
static inline STACK_OF(X509) *X509_chain_up_ref(STACK_OF(X509) *chain)
{
STACK_OF(X509) *ret;
int i;
if ((ret = sk_X509_dup(chain)) == NULL)
return NULL;
for (i = 0; i < sk_X509_num(ret); i++) {
X509 *x = sk_X509_value(ret, i);
CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
}
return ret;
}
#endif
MINOR: ssl: deduplicate ca-file Typically server line like: 'server-template srv 1-1000 *:443 ssl ca-file ca-certificates.crt' load ca-certificates.crt 1000 times and stay duplicated in memory. Same case for bind line: ca-file is loaded for each certificate. Same 'ca-file' can be load one time only and stay deduplicated in memory. As a corollary, this will prevent file access for ca-file when updating a certificate via CLI.
2019-10-24 09:32:47 +00:00
#ifdef OPENSSL_IS_BORINGSSL
/*
* Functions missing in BoringSSL
*/
static inline X509_CRL *X509_OBJECT_get0_X509_CRL(const X509_OBJECT *a)
{
if (a == NULL || a->type != X509_LU_CRL) {
return NULL;
}
return a->data.crl;
}
#endif
BUILD: ssl: make libressl use its own version numbers LibreSSL causes lots of build issues by pretending to be OpenSSL 2.0.0, and it requires lots of care for each #if added to cover any specific OpenSSL features. This commit addresses the problem by making LibreSSL only advertise the version it forked from (1.0.1g) and by starting to use tests based on its real version to enable features instead of working by exclusion.
2019-05-09 11:41:45 +00:00
#if (HA_OPENSSL_VERSION_NUMBER < 0x1010000fL) && (LIBRESSL_VERSION_NUMBER < 0x2070000fL)
MEDIUM: ssl: Add support for OpenSSL 1.1.0 In the last release a lot of the structures have become opaque for an end user. This means the code using these needs to be changed to use the proper functions to interact with these structures instead of trying to manipulate them directly. This does not fix any deprecations yet that are part of 1.1.0, it only ensures that it can be compiled against that version and is still compatible with older ones. [wt: openssl-0.9.8 doesn't build with it, there are conflicts on certain function prototypes which we declare as inline here and which are defined differently there. But openssl-0.9.8 is not supported anymore so probably it's OK to go without it for now and we'll see later if some users still need it. Emeric has reviewed this change and didn't spot anything obvious which requires special care. Let's try it for real now]
2016-08-29 11:26:37 +00:00
/*
BUILD: enable several LibreSSL hacks, including SSL_SESSION_get0_id_context is introduced in LibreSSL-2.7.0 async operations are not supported by LibreSSL early data is not supported by LibreSSL packet_length is removed from SSL struct in LibreSSL
2019-05-05 18:27:54 +00:00
* Functions introduced in OpenSSL 1.1.0 and in LibreSSL 2.7.0
MEDIUM: ssl: Add support for OpenSSL 1.1.0 In the last release a lot of the structures have become opaque for an end user. This means the code using these needs to be changed to use the proper functions to interact with these structures instead of trying to manipulate them directly. This does not fix any deprecations yet that are part of 1.1.0, it only ensures that it can be compiled against that version and is still compatible with older ones. [wt: openssl-0.9.8 doesn't build with it, there are conflicts on certain function prototypes which we declare as inline here and which are defined differently there. But openssl-0.9.8 is not supported anymore so probably it's OK to go without it for now and we'll see later if some users still need it. Emeric has reviewed this change and didn't spot anything obvious which requires special care. Let's try it for real now]
2016-08-29 11:26:37 +00:00
*/
BUG/MINOR: ssl: fix X509 compatibility for openssl < 1.1.0 Commit d4f9a60e "MINOR: ssl: deduplicate ca-file" uses undeclared X509 functions when build with openssl < 1.1.0. Introduce this functions in openssl-compat.h . Fix issue #385.
2019-12-02 10:41:23 +00:00
static inline STACK_OF(X509_OBJECT) *X509_STORE_get0_objects(X509_STORE *st)
{
return st->objs;
}
static inline int X509_OBJECT_get_type(const X509_OBJECT *a)
{
return a->type;
}
static inline X509 *X509_OBJECT_get0_X509(const X509_OBJECT *a)
{
if (a == NULL || a->type != X509_LU_X509) {
return NULL;
}
return a->data.x509;
}
static inline X509_CRL *X509_OBJECT_get0_X509_CRL(const X509_OBJECT *a)
{
if (a == NULL || a->type != X509_LU_CRL) {
return NULL;
}
return a->data.crl;
}
MEDIUM: ssl: Add support for OpenSSL 1.1.0 In the last release a lot of the structures have become opaque for an end user. This means the code using these needs to be changed to use the proper functions to interact with these structures instead of trying to manipulate them directly. This does not fix any deprecations yet that are part of 1.1.0, it only ensures that it can be compiled against that version and is still compatible with older ones. [wt: openssl-0.9.8 doesn't build with it, there are conflicts on certain function prototypes which we declare as inline here and which are defined differently there. But openssl-0.9.8 is not supported anymore so probably it's OK to go without it for now and we'll see later if some users still need it. Emeric has reviewed this change and didn't spot anything obvious which requires special care. Let's try it for real now]
2016-08-29 11:26:37 +00:00
static inline int SSL_SESSION_set1_id(SSL_SESSION *s, const unsigned char *sid, unsigned int sid_len)
{
s->session_id_length = sid_len;
memcpy(s->session_id, sid, sid_len);
return 1;
}
MINOR: ssl: build with recent BoringSSL library BoringSSL switch OPENSSL_VERSION_NUMBER to 1.1.0 for compatibility. Fix BoringSSL call and openssl-compat.h/#define occordingly. This will not break openssl/libressl compat.
2017-10-02 15:12:06 +00:00
static inline X509_ALGOR *X509_get0_tbs_sigalg(const X509 *x)
{
return x->cert_info->signature;
}
BUILD: ssl: fix to build (again) with boringssl Limitations: . disable force-ssl/tls (need more work) should be set earlier with SSL_CTX_new (SSL_CTX_set_ssl_version is removed) . disable generate-certificates (need more work) introduce SSL_NO_GENERATE_CERTIFICATES to disable generate-certificates. Cleanup some #ifdef and type related to boringssl env.
2017-01-13 16:48:18 +00:00
#if (!defined OPENSSL_NO_OCSP)
MEDIUM: ssl: Add support for OpenSSL 1.1.0 In the last release a lot of the structures have become opaque for an end user. This means the code using these needs to be changed to use the proper functions to interact with these structures instead of trying to manipulate them directly. This does not fix any deprecations yet that are part of 1.1.0, it only ensures that it can be compiled against that version and is still compatible with older ones. [wt: openssl-0.9.8 doesn't build with it, there are conflicts on certain function prototypes which we declare as inline here and which are defined differently there. But openssl-0.9.8 is not supported anymore so probably it's OK to go without it for now and we'll see later if some users still need it. Emeric has reviewed this change and didn't spot anything obvious which requires special care. Let's try it for real now]
2016-08-29 11:26:37 +00:00
static inline const OCSP_CERTID *OCSP_SINGLERESP_get0_id(const OCSP_SINGLERESP *single)
{
return single->certId;
}
BUILD: ssl: fix to build (again) with boringssl Limitations: . disable force-ssl/tls (need more work) should be set earlier with SSL_CTX_new (SSL_CTX_set_ssl_version is removed) . disable generate-certificates (need more work) introduce SSL_NO_GENERATE_CERTIFICATES to disable generate-certificates. Cleanup some #ifdef and type related to boringssl env.
2017-01-13 16:48:18 +00:00
#endif
MEDIUM: ssl: Add support for OpenSSL 1.1.0 In the last release a lot of the structures have become opaque for an end user. This means the code using these needs to be changed to use the proper functions to interact with these structures instead of trying to manipulate them directly. This does not fix any deprecations yet that are part of 1.1.0, it only ensures that it can be compiled against that version and is still compatible with older ones. [wt: openssl-0.9.8 doesn't build with it, there are conflicts on certain function prototypes which we declare as inline here and which are defined differently there. But openssl-0.9.8 is not supported anymore so probably it's OK to go without it for now and we'll see later if some users still need it. Emeric has reviewed this change and didn't spot anything obvious which requires special care. Let's try it for real now]
2016-08-29 11:26:37 +00:00
#ifndef OPENSSL_NO_DH
static inline int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g)
{
/* Implements only the bare necessities for HAProxy */
dh->p = p;
dh->g = g;
return 1;
}
#endif
static inline const unsigned char *ASN1_STRING_get0_data(const ASN1_STRING *x)
{
return x->data;
}
BUG/MINOR: ssl: fix build with openssl < 1.1.0 8c1cddef ("MINOR: ssl: new functions duplicate and free a ckch_store") use some OpenSSL refcount functions that were introduced in OpenSSL 1.0.2 and OpenSSL 1.1.0. Fix the problem by introducing them in openssl-compat.h. Fix #336.
2019-10-23 17:40:28 +00:00
static inline void X509_up_ref(X509 *x)
{
CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
}
static inline void EVP_PKEY_up_ref(EVP_PKEY *pkey)
{
CRYPTO_add(&pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);
}
MEDIUM: ssl: Add support for OpenSSL 1.1.0 In the last release a lot of the structures have become opaque for an end user. This means the code using these needs to be changed to use the proper functions to interact with these structures instead of trying to manipulate them directly. This does not fix any deprecations yet that are part of 1.1.0, it only ensures that it can be compiled against that version and is still compatible with older ones. [wt: openssl-0.9.8 doesn't build with it, there are conflicts on certain function prototypes which we declare as inline here and which are defined differently there. But openssl-0.9.8 is not supported anymore so probably it's OK to go without it for now and we'll see later if some users still need it. Emeric has reviewed this change and didn't spot anything obvious which requires special care. Let's try it for real now]
2016-08-29 11:26:37 +00:00
#endif
BUILD: ssl: make libressl use its own version numbers LibreSSL causes lots of build issues by pretending to be OpenSSL 2.0.0, and it requires lots of care for each #if added to cover any specific OpenSSL features. This commit addresses the problem by making LibreSSL only advertise the version it forked from (1.0.1g) and by starting to use tests based on its real version to enable features instead of working by exclusion.
2019-05-09 11:41:45 +00:00
#if (HA_OPENSSL_VERSION_NUMBER >= 0x1010000fL) || (LIBRESSL_VERSION_NUMBER >= 0x2070200fL)
MEDIUM: ssl: Add support for OpenSSL 1.1.0 In the last release a lot of the structures have become opaque for an end user. This means the code using these needs to be changed to use the proper functions to interact with these structures instead of trying to manipulate them directly. This does not fix any deprecations yet that are part of 1.1.0, it only ensures that it can be compiled against that version and is still compatible with older ones. [wt: openssl-0.9.8 doesn't build with it, there are conflicts on certain function prototypes which we declare as inline here and which are defined differently there. But openssl-0.9.8 is not supported anymore so probably it's OK to go without it for now and we'll see later if some users still need it. Emeric has reviewed this change and didn't spot anything obvious which requires special care. Let's try it for real now]
2016-08-29 11:26:37 +00:00
#define __OPENSSL_110_CONST__ const
#else
#define __OPENSSL_110_CONST__
#endif
BUILD: ssl: silence a warning reported for ERR_remove_state() In 1.0.0, this function was replaced with ERR_remove_thread_state(). As of openssl 1.1.0, both are now deprecated and do nothing at all. Thus we simply make this call do nothing in 1.1.0 to silence the warning. The change was tested with 0.9.8, 1.0.0, 1.0.1, 1.0.2 and 1.1.0. This kills the following warning on 1.1.0 : src/ssl_sock.c:7266:9: warning: 'ERR_remove_state' is deprecated (declared at /dev/shm/openssl-1.1.0b/include/openssl/err.h:247) [-Wdeprecated-declarations] This fix should be backported to 1.7.
2017-01-19 15:50:25 +00:00
/* ERR_remove_state() was deprecated in 1.0.0 in favor of
* ERR_remove_thread_state(), which was in turn deprecated in
* 1.1.0 and does nothing anymore. Let's simply silently kill
* it.
*/
CLEANUP: ssl-sock: use HA_OPENSSL_VERSION_NUMBER instead of OPENSSL_VERSION_NUMBER Most tests on OPENSSL_VERSION_NUMBER have become complex and break all the time because this number is fake for some derivatives like LibreSSL. This patch creates a new macro, HA_OPENSSL_VERSION_NUMBER, which will carry the real openssl version defining the compatibility level, and this version will be adjusted depending on the variants.
2019-05-09 11:26:41 +00:00
#if (HA_OPENSSL_VERSION_NUMBER >= 0x1010000fL)
BUILD: ssl: silence a warning reported for ERR_remove_state() In 1.0.0, this function was replaced with ERR_remove_thread_state(). As of openssl 1.1.0, both are now deprecated and do nothing at all. Thus we simply make this call do nothing in 1.1.0 to silence the warning. The change was tested with 0.9.8, 1.0.0, 1.0.1, 1.0.2 and 1.1.0. This kills the following warning on 1.1.0 : src/ssl_sock.c:7266:9: warning: 'ERR_remove_state' is deprecated (declared at /dev/shm/openssl-1.1.0b/include/openssl/err.h:247) [-Wdeprecated-declarations] This fix should be backported to 1.7.
2017-01-19 15:50:25 +00:00
#undef ERR_remove_state
#define ERR_remove_state(x)
#endif
BUILD: ssl: eliminate warning with OpenSSL 1.1.0 regarding RAND_pseudo_bytes() This function was deprecated in 1.1.0 causing this warning : src/ssl_sock.c:551:3: warning: 'RAND_pseudo_bytes' is deprecated (declared at /opt/openssl-1.1.0/include/openssl/rand.h:47) [-Wdeprecated-declarations] The man suggests to use RAND_bytes() instead. While the return codes differ, it turns out that the function was already misused and was relying on RAND_bytes() return code instead. The patch was tested on 0.9.8, 1.0.0, 1.0.1, 1.0.2 and 1.1.0. This fix must be backported to 1.7 and the return code check should be backported to earlier versions if relevant.
2017-01-19 16:10:54 +00:00
/* RAND_pseudo_bytes() is deprecated in 1.1.0 in favor of RAND_bytes(). Note
* that the return codes differ, but it happens that the only use case (ticket
* key update) was already wrong, considering a non-cryptographic random as a
* failure.
*/
CLEANUP: ssl-sock: use HA_OPENSSL_VERSION_NUMBER instead of OPENSSL_VERSION_NUMBER Most tests on OPENSSL_VERSION_NUMBER have become complex and break all the time because this number is fake for some derivatives like LibreSSL. This patch creates a new macro, HA_OPENSSL_VERSION_NUMBER, which will carry the real openssl version defining the compatibility level, and this version will be adjusted depending on the variants.
2019-05-09 11:26:41 +00:00
#if (HA_OPENSSL_VERSION_NUMBER >= 0x1010000fL)
BUILD: ssl: eliminate warning with OpenSSL 1.1.0 regarding RAND_pseudo_bytes() This function was deprecated in 1.1.0 causing this warning : src/ssl_sock.c:551:3: warning: 'RAND_pseudo_bytes' is deprecated (declared at /opt/openssl-1.1.0/include/openssl/rand.h:47) [-Wdeprecated-declarations] The man suggests to use RAND_bytes() instead. While the return codes differ, it turns out that the function was already misused and was relying on RAND_bytes() return code instead. The patch was tested on 0.9.8, 1.0.0, 1.0.1, 1.0.2 and 1.1.0. This fix must be backported to 1.7 and the return code check should be backported to earlier versions if relevant.
2017-01-19 16:10:54 +00:00
#undef RAND_pseudo_bytes
#define RAND_pseudo_bytes(x,y) RAND_bytes(x,y)
#endif
BUILD: ssl: fix compatibility with openssl without TLSEXT_signature_* In openssl < 1.0.1, TLSEXT_signature_* is undefined. Add TLSEXT signatures (RFC 5246) when TLSEXT_signature_anonymous is undefined.
2017-07-19 14:04:05 +00:00
/* Signature from RFC 5246, missing in openssl < 1.0.1 */
#ifndef TLSEXT_signature_anonymous
#define TLSEXT_signature_anonymous 0
#define TLSEXT_signature_rsa 1
#define TLSEXT_signature_dsa 2
#define TLSEXT_signature_ecdsa 3
#endif
BUG/MINOR: ssl: openssl-compat: Fix getm_ defines LIBRESSL_VERSION_NUMBER evaluates to 0 under OpenSSL, making the condition always true. Check for the define before checking it. Signed-off-by: Rosen Penev <rosenp@gmail.com> [wt: to be backported as far as 1.9]
2019-12-19 20:54:13 +00:00
#if ((HA_OPENSSL_VERSION_NUMBER < 0x1010000fL) && (LIBRESSL_VERSION_NUMBER < 0x2070000fL)) ||\
defined(OPENSSL_IS_BORINGSSL)
REORG: ssl: move some OpenSSL defines from ssl_sock to openssl-compat Some defines like OPENSSL_VERSION or X509_getm_notBefore() have nothing to do in ssl_sock and must move to openssl-compat.h so that they are consistently shared by the whole code. A warning in the code was added against wild additions of macros there.
2019-05-10 07:22:53 +00:00
#define X509_getm_notBefore X509_get_notBefore
#define X509_getm_notAfter X509_get_notAfter
#endif
BUG/MINOR: ssl: fix build on development versions of openssl-1.1.x while working on issue #429, I encountered build failures with various non-released openssl versions, let us improve ssl defines, switch to features, not versions, for EVP_CTRL_AEAD_SET_IVLEN and EVP_CTRL_AEAD_SET_TAG. No backport is needed as there is no valid reason to build a stable haproxy version against a development version of openssl.
2020-01-18 13:42:45 +00:00
#if !defined(EVP_CTRL_AEAD_SET_IVLEN)
REORG: ssl: move some OpenSSL defines from ssl_sock to openssl-compat Some defines like OPENSSL_VERSION or X509_getm_notBefore() have nothing to do in ssl_sock and must move to openssl-compat.h so that they are consistently shared by the whole code. A warning in the code was added against wild additions of macros there.
2019-05-10 07:22:53 +00:00
#define EVP_CTRL_AEAD_SET_IVLEN EVP_CTRL_GCM_SET_IVLEN
BUG/MINOR: ssl: fix build on development versions of openssl-1.1.x while working on issue #429, I encountered build failures with various non-released openssl versions, let us improve ssl defines, switch to features, not versions, for EVP_CTRL_AEAD_SET_IVLEN and EVP_CTRL_AEAD_SET_TAG. No backport is needed as there is no valid reason to build a stable haproxy version against a development version of openssl.
2020-01-18 13:42:45 +00:00
#endif
#if !defined(EVP_CTRL_AEAD_SET_TAG)
REORG: ssl: move some OpenSSL defines from ssl_sock to openssl-compat Some defines like OPENSSL_VERSION or X509_getm_notBefore() have nothing to do in ssl_sock and must move to openssl-compat.h so that they are consistently shared by the whole code. A warning in the code was added against wild additions of macros there.
2019-05-10 07:22:53 +00:00
#define EVP_CTRL_AEAD_SET_TAG EVP_CTRL_GCM_SET_TAG
#endif
/* Supported hash function for TLS tickets */
#ifdef OPENSSL_NO_SHA256
#define TLS_TICKET_HASH_FUNCT EVP_sha1
#else
#define TLS_TICKET_HASH_FUNCT EVP_sha256
#endif /* OPENSSL_NO_SHA256 */
CLEANUP: ssl: move the SSL_OP_* and SSL_MODE_* definitions to openssl-compat These ones were defined in the middle of ssl_sock.c, better move them to the include file to find them.
2019-05-11 15:09:44 +00:00
#ifndef SSL_OP_CIPHER_SERVER_PREFERENCE /* needs OpenSSL >= 0.9.7 */
#define SSL_OP_CIPHER_SERVER_PREFERENCE 0
#endif
#ifndef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION /* needs OpenSSL >= 0.9.7 */
#define SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION 0
#define SSL_renegotiate_pending(arg) 0
#endif
#ifndef SSL_OP_SINGLE_ECDH_USE /* needs OpenSSL >= 0.9.8 */
#define SSL_OP_SINGLE_ECDH_USE 0
#endif
#ifndef SSL_OP_NO_TICKET /* needs OpenSSL >= 0.9.8 */
#define SSL_OP_NO_TICKET 0
#endif
#ifndef SSL_OP_NO_COMPRESSION /* needs OpenSSL >= 0.9.9 */
#define SSL_OP_NO_COMPRESSION 0
#endif
#ifdef OPENSSL_NO_SSL3 /* SSLv3 support removed */
#undef SSL_OP_NO_SSLv3
#define SSL_OP_NO_SSLv3 0
#endif
#ifndef SSL_OP_NO_TLSv1_1 /* needs OpenSSL >= 1.0.1 */
#define SSL_OP_NO_TLSv1_1 0
#endif
#ifndef SSL_OP_NO_TLSv1_2 /* needs OpenSSL >= 1.0.1 */
#define SSL_OP_NO_TLSv1_2 0
#endif
#ifndef SSL_OP_NO_TLSv1_3 /* needs OpenSSL >= 1.1.1 */
#define SSL_OP_NO_TLSv1_3 0
#endif
#ifndef SSL_OP_SINGLE_DH_USE /* needs OpenSSL >= 0.9.6 */
#define SSL_OP_SINGLE_DH_USE 0
#endif
#ifndef SSL_OP_SINGLE_ECDH_USE /* needs OpenSSL >= 1.0.0 */
#define SSL_OP_SINGLE_ECDH_USE 0
#endif
#ifndef SSL_MODE_RELEASE_BUFFERS /* needs OpenSSL >= 1.0.0 */
#define SSL_MODE_RELEASE_BUFFERS 0
#endif
#ifndef SSL_MODE_SMALL_BUFFERS /* needs small_records.patch */
#define SSL_MODE_SMALL_BUFFERS 0
#endif
#ifndef SSL_OP_PRIORITIZE_CHACHA /* needs OpenSSL >= 1.1.1 */
#define SSL_OP_PRIORITIZE_CHACHA 0
#endif
CLEANUP: ssl: remove ifdef around SSL_CTX_get_extra_chain_certs() Instead define this one in openssl-compat.h when SSL_CTRL_GET_EXTRA_CHAIN_CERTS is not defined (which was the current condition used in the ifdef).
2019-05-11 15:02:04 +00:00
#ifndef SSL_CTRL_GET_EXTRA_CHAIN_CERTS
#define SSL_CTX_get_extra_chain_certs(ctx, chain) do { *(chain) = (ctx)->extra_certs; } while (0)
#endif
CLEANUP: ssl: move all BIO_* definitions to openssl-compat The following macros are now defined for openssl < 1.1 so that we can remove the code performing direct access to the structures : BIO_get_data(), BIO_set_data(), BIO_set_init(), BIO_meth_free(), BIO_meth_new(), BIO_meth_set_gets(), BIO_meth_set_puts(), BIO_meth_set_read(), BIO_meth_set_write(), BIO_meth_set_create(), BIO_meth_set_ctrl(), BIO_meth_set_destroy()
2019-05-11 15:34:03 +00:00
#if HA_OPENSSL_VERSION_NUMBER < 0x10100000L
#define BIO_get_data(b) (b)->ptr
#define BIO_set_data(b, v) do { (b)->ptr = (v); } while (0)
#define BIO_set_init(b, v) do { (b)->init = (v); } while (0)
#define BIO_meth_free(m) free(m)
#define BIO_meth_new(type, name) calloc(1, sizeof(BIO_METHOD))
#define BIO_meth_set_gets(m, f) do { (m)->bgets = (f); } while (0)
#define BIO_meth_set_puts(m, f) do { (m)->bputs = (f); } while (0)
#define BIO_meth_set_read(m, f) do { (m)->bread = (f); } while (0)
#define BIO_meth_set_write(m, f) do { (m)->bwrite = (f); } while (0)
#define BIO_meth_set_create(m, f) do { (m)->create = (f); } while (0)
#define BIO_meth_set_ctrl(m, f) do { (m)->ctrl = (f); } while (0)
#define BIO_meth_set_destroy(m, f) do { (m)->destroy = (f); } while (0)
#endif
BUILD: ssl: improve SSL_CTX_set_ecdh_auto compatibility SSL_CTX_set_ecdh_auto() is not defined when OpenSSL 1.1.1 is compiled with the no-deprecated option. Remove existing, incomplete guards and add a compatibility macro in openssl-compat.h, just as OpenSSL does: https://github.com/openssl/openssl/blob/bf4006a6f9be691ba6eef0e8629e63369a033ccf/include/openssl/ssl.h#L1486 This should be backported as far as 2.0 and probably even 1.9.
2019-12-20 17:47:18 +00:00
#ifndef SSL_CTX_set_ecdh_auto
#define SSL_CTX_set_ecdh_auto(dummy, onoff) ((onoff) != 0)
#endif
CLEANUP: ssl: make inclusion of openssl headers safe It's always a pain to have to stuff lots of #ifdef USE_OPENSSL around ssl headers, it even results in some of them appearing in a random order and multiple times just to benefit form an existing ifdef block. Let's make these headers safe for inclusion when USE_OPENSSL is not defined, they now perform the test themselves and do nothing if USE_OPENSSL is not defined. This allows to remove no less than 8 such ifdef blocks and make include blocks more readable.
2019-05-10 07:58:43 +00:00
#endif /* USE_OPENSSL */
REORG: ssl: move openssl-compat from proto to common This way we can include it much earlier to cover types/ as well.
2019-05-09 12:52:44 +00:00
#endif /* _COMMON_OPENSSL_COMPAT_H */
Reference in New Issue Copy Permalink