From c47d676bd75e339f92faae430486ee337c45f134 Mon Sep 17 00:00:00 2001 From: Ilya Shipitsin Date: Sat, 13 Feb 2021 11:45:33 +0500 Subject: [PATCH] BUILD: ssl: introduce fine guard for OpenSSL specific SCTL functions SCTL (signed certificate timestamp list) specified in RFC6962 was implemented in c74ce24cd22e8c683ba0e5353c0762f8616e597d, let us introduce macro HAVE_SSL_SCTL for the HAVE_SSL_SCTL sake, which in turn is based on SN_ct_cert_scts, which comes in the same commit --- include/haproxy/openssl-compat.h | 4 ++++ src/ssl_ckch.c | 6 +++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/include/haproxy/openssl-compat.h b/include/haproxy/openssl-compat.h index 3fe58be40..b5f05d1ae 100644 --- a/include/haproxy/openssl-compat.h +++ b/include/haproxy/openssl-compat.h @@ -57,6 +57,10 @@ #define HAVE_SSL_CTX_get0_privatekey #endif +#if (defined(SN_ct_cert_scts) && !defined(OPENSSL_NO_TLSEXT)) +#define HAVE_SSL_SCTL +#endif + #if (HA_OPENSSL_VERSION_NUMBER < 0x0090800fL) /* Functions present in OpenSSL 0.9.8, older not tested */ static inline const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *sess, unsigned int *sid_length) diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c index f654b4b52..8aa29bd22 100644 --- a/src/ssl_ckch.c +++ b/src/ssl_ckch.c @@ -320,7 +320,7 @@ int ssl_sock_load_files_into_ckch(const char *path, struct cert_key_and_chain *c goto end; } -#if (HA_OPENSSL_VERSION_NUMBER >= 0x1000200fL && !defined OPENSSL_NO_TLSEXT && !defined OPENSSL_IS_BORINGSSL) +#ifdef HAVE_SSL_SCTL /* try to load the sctl file */ if (global_ssl.extra_files & SSL_GF_SCTL) { struct stat st; @@ -939,7 +939,7 @@ enum { CERT_TYPE_OCSP, #endif CERT_TYPE_ISSUER, -#if (HA_OPENSSL_VERSION_NUMBER >= 0x1000200fL && !defined OPENSSL_NO_TLSEXT && !defined OPENSSL_IS_BORINGSSL) +#ifdef HAVE_SSL_SCTL CERT_TYPE_SCTL, #endif CERT_TYPE_MAX, @@ -956,7 +956,7 @@ struct { #if ((defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP) || defined OPENSSL_IS_BORINGSSL) [CERT_TYPE_OCSP] = { "ocsp", CERT_TYPE_OCSP, &ssl_sock_load_ocsp_response_from_file }, #endif -#if (HA_OPENSSL_VERSION_NUMBER >= 0x1000200fL && !defined OPENSSL_NO_TLSEXT && !defined OPENSSL_IS_BORINGSSL) +#ifdef HAVE_SSL_SCTL [CERT_TYPE_SCTL] = { "sctl", CERT_TYPE_SCTL, &ssl_sock_load_sctl_from_file }, #endif [CERT_TYPE_ISSUER] = { "issuer", CERT_TYPE_ISSUER, &ssl_sock_load_issuer_file_into_ckch },