1 From de115e14079d12e8826eabaa396677dc40beb5d1 Mon Sep 17 00:00:00 2001
2 From: Bernard Spil <brnrd@FreeBSD.org>
3 Date: Mon, 2 Apr 2018 19:04:06 +0200
4 Subject: [PATCH] openssl: fix build with LibreSSL 2.7
6 - LibreSSL 2.7 implements (most of) OpenSSL 1.1 API
12 Signed-off-by: Bernard Spil <brnrd@FreeBSD.org>
13 (cherry picked from commit 7c90c93c0b061da81f69fabdd57125b2783c15fb)
14 Signed-off-by: Adam Duskett <aduskett@gmail.com>
16 lib/vtls/openssl.c | 15 +++++++++------
17 1 file changed, 9 insertions(+), 6 deletions(-)
19 diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
20 index 2a6b3cfac..bbb8ec766 100644
21 --- a/lib/vtls/openssl.c
22 +++ b/lib/vtls/openssl.c
26 #if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && /* OpenSSL 1.1.0+ */ \
27 - !defined(LIBRESSL_VERSION_NUMBER)
28 + !(defined(LIBRESSL_VERSION_NUMBER) && \
29 + LIBRESSL_VERSION_NUMBER < 0x20700000L)
30 #define SSLEAY_VERSION_NUMBER OPENSSL_VERSION_NUMBER
31 #define HAVE_X509_GET0_EXTENSIONS 1 /* added in 1.1.0 -pre1 */
32 #define HAVE_OPAQUE_EVP_PKEY 1 /* since 1.1.0 -pre3 */
33 @@ -128,7 +129,8 @@ static unsigned long OpenSSL_version_num(void)
36 #if (OPENSSL_VERSION_NUMBER >= 0x1000200fL) && /* 1.0.2 or later */ \
37 - !defined(LIBRESSL_VERSION_NUMBER)
38 + !(defined(LIBRESSL_VERSION_NUMBER) && \
39 + LIBRESSL_VERSION_NUMBER < 0x20700000L)
40 #define HAVE_X509_GET0_SIGNATURE 1
43 @@ -147,7 +149,7 @@ static unsigned long OpenSSL_version_num(void)
44 * Whether SSL_CTX_set_keylog_callback is available.
45 * OpenSSL: supported since 1.1.1 https://github.com/openssl/openssl/pull/2287
46 * BoringSSL: supported since d28f59c27bac (committed 2015-11-19)
47 - * LibreSSL: unsupported in at least 2.5.1 (explicitly check for it since it
48 + * LibreSSL: unsupported in at least 2.7.2 (explicitly check for it since it
49 * lies and pretends to be OpenSSL 2.0.0).
51 #if (OPENSSL_VERSION_NUMBER >= 0x10101000L && \
52 @@ -259,7 +261,9 @@ static void tap_ssl_key(const SSL *ssl, ssl_tap_state_t *state)
53 if(!session || !keylog_file_fp)
56 -#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
57 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L && \
58 + !(defined(LIBRESSL_VERSION_NUMBER) && \
59 + LIBRESSL_VERSION_NUMBER < 0x20700000L)
60 /* ssl->s3 is not checked in openssl 1.1.0-pre6, but let's assume that
61 * we have a valid SSL context if we have a non-NULL session. */
62 SSL_get_client_random(ssl, client_random, SSL3_RANDOM_SIZE);
63 @@ -2082,8 +2086,7 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
64 case CURL_SSLVERSION_TLSv1_2:
65 case CURL_SSLVERSION_TLSv1_3:
66 /* it will be handled later with the context options */
67 -#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && \
68 - !defined(LIBRESSL_VERSION_NUMBER)
69 +#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
70 req_method = TLS_client_method();
72 req_method = SSLv23_client_method();