Browse code

tls: support compilation without deprecated OpenSSL APIs

- GH #2428

Rosen Penev authored on 12/08/2020 14:37:13 • Daniel-Constantin Mierla committed on 12/08/2020 14:37:13
Showing 3 changed files
... ...
@@ -27,6 +27,8 @@
27 27
 #include <stdlib.h>
28 28
 #include <openssl/ssl.h>
29 29
 #include <openssl/opensslv.h>
30
+#include <openssl/bn.h>
31
+#include <openssl/dh.h>
30 32
 
31 33
 #ifndef OPENSSL_NO_ENGINE
32 34
 #include <openssl/engine.h>
... ...
@@ -61,7 +63,7 @@ static void setup_ecdh(SSL_CTX *ctx)
61 63
 {
62 64
    EC_KEY *ecdh;
63 65
 
64
-   if (SSLeay() < 0x1000005fL) {
66
+   if (OpenSSL_version_num() < 0x1000005fL) {
65 67
       return;
66 68
    }
67 69
 
... ...
@@ -627,14 +627,13 @@ int tls_h_mod_pre_init_f(void)
627 627
 		return 0;
628 628
 	}
629 629
 	LM_DBG("preparing tls env for modules initialization\n");
630
-#if OPENSSL_VERSION_NUMBER >= 0x010100000L && !defined(LIBRESSL_VERSION_NUMBER)
631
-	LM_DBG("preparing tls env for modules initialization (libssl >=1.1)\n");
632
-	OPENSSL_init_ssl(0, NULL);
633
-#else
630
+#if OPENSSL_VERSION_NUMBER < 0x010100000L || defined(LIBRESSL_VERSION_NUMBER)
634 631
 	LM_DBG("preparing tls env for modules initialization (libssl <=1.0)\n");
635 632
 	SSL_library_init();
636
-#endif
637 633
 	SSL_load_error_strings();
634
+#else
635
+	LM_DBG("preparing tls env for modules initialization (libssl >=1.1)\n");
636
+#endif
638 637
 	tls_mod_preinitialized=1;
639 638
 	return 0;
640 639
 }
... ...
@@ -668,7 +667,7 @@ int tls_h_mod_init_f(void)
668 667
 #if OPENSSL_VERSION_NUMBER < 0x00907000L
669 668
 	LM_WARN("You are using an old version of OpenSSL (< 0.9.7). Upgrade!\n");
670 669
 #endif
671
-	ssl_version=SSLeay();
670
+	ssl_version=OpenSSL_version_num();
672 671
 	/* check if version have the same major minor and fix level
673 672
 	 * (e.g. 0.9.8a & 0.9.8c are ok, but 0.9.8 and 0.9.9x are not)
674 673
 	 * - values is represented as 0xMMNNFFPPS: major minor fix patch status
... ...
@@ -680,7 +679,7 @@ int tls_h_mod_init_f(void)
680 679
 				" compiled \"%s\" (0x%08lx).\n"
681 680
 				" Please make sure a compatible version is used"
682 681
 				" (tls_force_run in kamailio.cfg will override this check)\n",
683
-				SSLeay_version(SSLEAY_VERSION), ssl_version,
682
+				OpenSSL_version(OPENSSL_VERSION), ssl_version,
684 683
 				OPENSSL_VERSION_TEXT, (long)OPENSSL_VERSION_NUMBER);
685 684
 		if (cfg_get(tls, tls_cfg, force_run))
686 685
 			LM_WARN("tls_force_run turned on, ignoring "
... ...
@@ -857,6 +856,7 @@ int tls_check_sockets(tls_domains_cfg_t* cfg)
857 856
 void tls_h_mod_destroy_f(void)
858 857
 {
859 858
 	LM_DBG("tls module final tls destroy\n");
859
+#if OPENSSL_VERSION_NUMBER < 0x010100000L || defined(LIBRESSL_VERSION_NUMBER)
860 860
 	if(tls_mod_preinitialized > 0)
861 861
 		ERR_free_strings();
862 862
 	/* TODO: free all the ctx'es */
... ...
@@ -869,4 +869,5 @@ void tls_h_mod_destroy_f(void)
869 869
 	LM_DBG("executing openssl v1.1+ cleanup\n");
870 870
 	OPENSSL_cleanup();
871 871
 #endif
872
+#endif
872 873
 }
... ...
@@ -140,6 +140,8 @@ unsigned long sr_ssl_id_f()
140 140
 /* returns -1 on error, 0 on success */
141 141
 int tls_init_locks()
142 142
 {
143
+/* OpenSSL is thread-safe since 1.1.0 */
144
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
143 145
 	/* init "static" tls locks */
144 146
 	n_static_locks=CRYPTO_num_locks();
145 147
 	if (n_static_locks<0){
... ...
@@ -167,13 +169,10 @@ int tls_init_locks()
167 169
 		CRYPTO_set_locking_callback(locking_f);
168 170
 	}
169 171
 
170
-/* OpenSSL is thread-safe since 1.1.0 */
171
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
172 172
 	/* set "dynamic" locks callbacks */
173 173
 	CRYPTO_set_dynlock_create_callback(dyn_create_f);
174 174
 	CRYPTO_set_dynlock_lock_callback(dyn_lock_f);
175 175
 	CRYPTO_set_dynlock_destroy_callback(dyn_destroy_f);
176
-#endif
177 176
 
178 177
 	/* starting with v1.0.0 openssl does not use anymore getpid(), but address
179 178
 	 * of errno which can point to same virtual address in a multi-process
... ...
@@ -186,6 +185,7 @@ int tls_init_locks()
186 185
 	 *  (only atomic_inc), fallback to the default use-locks mode
187 186
 	 * CRYPTO_set_add_lock_callback(atomic_add_f);
188 187
 	 */
188
+#endif
189 189
 
190 190
 	return 0;
191 191
 error: