[Openvpn-devel] [M] Change in openvpn[master]: Drop support for OpenSSL 1.1.0
"cron2 \(Code Review\) via Openvpn-devel" <[email protected]> Thu, 30 Jul 2026 20:37:44 +0000
| Newsgroups | net.sourceforge.lists.openvpn-devel |
|---|---|
| Message-ID | <[email protected]> |
--===============6109248228321311289==
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
Content-Type: multipart/alternative; boundary="V5z9weTMFTQ="; charset=UTF-8
--V5z9weTMFTQ=
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
cron2 has submitted this change=2E ( http://gerrit=2Eopenvpn=2Enet/c/openvp=
n/+/1821?usp=3Demail )
Change subject: Drop support for OpenSSL 1=2E1=2E0
=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=
=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E=2E
Drop support =
for OpenSSL 1=2E1=2E0
Slight simplification of the code since we can then
=
assume that TLS 1=2E3 support is present=2E
Change-Id: Iae76f10fa683369ca3=
f718dc24fd54560bb74112
Signed-off-by: Frank Lichtenheld <frank@lichtenheld=
=2Ecom>
Acked-by: Arne Schwabe <arne-openvpn@rfc2549=2Eorg>
Gerrit URL: htt=
ps://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1821
Message-Id: <20260728063652=2E=
10456-1-gert@greenie=2Emuc=2Ede>
URL: https://www=2Email-archive=2Ecom/open=
vpn-devel@lists=2Esourceforge=2Enet/msg37922=2Ehtml
Signed-off-by: Gert Doe=
ring <gert@greenie=2Emuc=2Ede>
---
M INSTALL
M configure=2Eac
M src/openvpn=
/openssl_compat=2Eh
M src/openvpn/ssl_openssl=2Ec
M tests/unit_tests/openvp=
n/test_ncp=2Ec
5 files changed, 16 insertions(+), 78 deletions(-)
diff =
--git a/INSTALL b/INSTALL
index 77656b2c=2E=2E78390d5 100644
--- a/INSTALL
=
+++ b/INSTALL
@@ -66,10 +66,10 @@
(1) TUN and/or TAP driver to allow use=
r-space programs to control
a virtual point-to-point IP or Ethernet =
device=2E
See TUN/TAP Driver References section below for more info=
=2E
- (2a) OpenSSL library, necessary for encryption, version 1=2E1=2E0 or=
higher
+ (2a) OpenSSL library, necessary for encryption, version 1=2E1=2E=
1 or higher
required, available from https://www=2Eopenssl=2Eorg/
=
or
- (2b) mbed TLS library, an alternative for encryption, version 2=
=2E0 or higher
+ (2b) mbed TLS library, an alternative for encryption, ver=
sion 3=2E2=2E1 or higher
required, available from https://tls=2Embed=
=2Eorg/
(3) on Linux, "libnl-gen" is required for kernel netlink support=
(4) on Linux, "libcap-ng" is required for Linux capability handling
dif=
f --git a/configure=2Eac b/configure=2Eac
index 188f8fa=2E=2E1aec805 100644=
--- a/configure=2Eac
+++ b/configure=2Eac
@@ -776,7 +776,7 @@
# if the =
user did not explicitly specify flags, try to autodetect
PKG_CHECK_MODUL=
ES(
[OPENSSL],
- [openssl >=3D 1=2E1=2E0],
+ [openssl >=3D 1=2E1=2E=
1],
[have_openssl=3D"yes"],
[AC_MSG_WARN([OpenSSL not found by pkg-=
config ${pkg_config_found}])] # If this fails, we will do another test next=
)
@@ -799,7 +799,7 @@
]],
[[
/* Version encoding: MNNFF=
PPS - see opensslv=2Eh for details */
-#if OPENSSL_VERSION_NUMBER < 0x10100=
000L
+#if OPENSSL_VERSION_NUMBER < 0x10101000L
#error OpenSSL too old
#en=
dif
]]
diff --git a/src/openvpn/openssl_compat=2Eh b/src/openvpn/opens=
sl_compat=2Eh
index b61bcbf=2E=2E098bdd5 100644
--- a/src/openvpn/openssl_c=
ompat=2Eh
+++ b/src/openvpn/openssl_compat=2Eh
@@ -26,9 +26,9 @@
* OpenSS=
L compatibility stub
*
* This file provide compatibility stubs for the =
OpenSSL libraries
- * prior to version 1=2E1=2E This version introduces man=
y changes in the
- * library interface, including the fact that various obj=
ects and
- * structures are not fully opaque=2E
+ * prior to the current ma=
jor version=2E Newer versions may introduce changes
+ * in the library inte=
rface, including replacing functions or enforcing
+ * various objects and s=
tructures as fully opaque=2E
*/
#ifndef OPENSSL_COMPAT_H_
@@ -62,11 +6=
2,6 @@
#endif
-/* Functionality missing in 1=2E1=2E0 */
-#if OPENSSL_V=
ERSION_NUMBER < 0x10101000L && !defined(ENABLE_CRYPTO_WOLFSSL)
-#define SSL=
_CTX_set1_groups SSL_CTX_set1_curves
-#endif
-
/* Functionality missing in=
LibreSSL before 3=2E5 */
#if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL=
_VERSION_NUMBER < 0x3050000fL
#define EVP_CTRL_AEAD_SET_TAG EVP_CTRL_GCM_S=
ET_TAG
diff --git a/src/openvpn/ssl_openssl=2Ec b/src/openvpn/ssl_openssl=
=2Ec
index ef99b22=2E=2E32b13db 100644
--- a/src/openvpn/ssl_openssl=2Ec
++=
+ b/src/openvpn/ssl_openssl=2Ec
@@ -200,42 +200,12 @@
/*
* Return maxi=
mum TLS version supported by local OpenSSL library=2E
- * Assume that prese=
nce of SSL_OP_NO_TLSvX macro indicates that
- * TLSvX is supported=2E
+ * W=
e only support OpenSSL versions that support TLS 1=2E3=2E
*/
int
tls_ve=
rsion_max(void)
{
-#if defined(TLS1_3_VERSION)
- /* If this is defined =
we can safely assume TLS 1=2E3 support */
return TLS_VER_1_3;
-#elif O=
PENSSL_VERSION_NUMBER >=3D 0x10100000L
- /*
- * If TLS_VER_1_3 is no=
t defined, we were compiled against a version that
- * did not support =
TLS 1=2E3=2E
- *
- * However, the library we are *linked* against m=
ight be OpenSSL 1=2E1=2E1
- * and therefore supports TLS 1=2E3=2E This =
needs to be checked at runtime
- * since we can be compiled against 1=
=2E1=2E0 and then the library can be
- * upgraded to 1=2E1=2E1=2E
- =
* We only need to check this for OpenSSL versions that can be
- * upgr=
aded to 1=2E1=2E1 without recompile (>=3D 1=2E1=2E0)
- */
- if (Open=
SSL_version_num() >=3D 0x1010100fL)
- {
- return TLS_VER_1_3;
- =
}
- else
- {
- return TLS_VER_1_2;
- }
-#elif defined(TLS=
1_2_VERSION) || defined(SSL_OP_NO_TLSv1_2)
- return TLS_VER_1_2;
-#elif =
defined(TLS1_1_VERSION) || defined(SSL_OP_NO_TLSv1_1)
- return TLS_VER_1=
_1;
-#else /* if defined(TLS1_3_VERSION) */
- return TLS_VER_1_0;
-#endi=
f
}
/** Convert internal version number to openssl version number */
@@=
-256,22 +226,7 @@
}
else if (ver =3D=3D TLS_VER_1_3)
{
- =
/*
- * Supporting the library upgraded to TLS1=2E3 without rec=
ompile
- * is enough to support here with a simple constant that th=
e same
- * as in the TLS 1=2E3, so spec it is very unlikely that Op=
enSSL
- * will change this constant
- */
-#ifndef TLS1_3_VE=
RSION
- /*
- * We do not want to define TLS_VER_1_3 if not d=
efined
- * since other parts of the code use the existance of this =
macro
- * as proxy for TLS 1=2E3 support
- */
- retu=
rn 0x0304;
-#else
return TLS1_3_VERSION;
-#endif
}
retur=
n 0;
}
@@ -491,8 +446,8 @@
*/
if (strlen(ciphers) >=3D (len - 1=
))
{
- msg(M_FATAL, "Failed to set restricted TLS 1=2E3 cipher =
list, too long (>%d)=2E",
- (int)(len - 1));
+ msg(M_FATA=
L, "Failed to set restricted TLS 1=2E3 cipher list, too long (>%zd)=2E",
+ =
len - 1);
}
strncpy(openssl_ciphers, ciphers, len);
=
@@ -511,17 +466,11 @@
{
if (ciphers =3D=3D NULL)
{
- /* d=
efault cipher list of OpenSSL 1=2E1=2E1 is sane, do not set own
+ /*=
default cipher list of OpenSSL is sane, do not set own
* default=
as we do with tls-cipher */
return;
}
-#if !defined(TLS1_3=
_VERSION)
- crypto_msg(M_WARN,
- "Not compiled with OpenSS=
L 1=2E1=2E1 or higher=2E "
- "Ignoring TLS 1=2E3 only tls-cip=
hersuites '%s' setting=2E",
- ciphers);
-#else
ASSERT(NU=
LL !=3D ctx);
char openssl_ciphers[4096];
@@ -531,14 +480,12 @@
=
{
crypto_msg(M_FATAL, "Failed to set restricted TLS 1=2E3 cipher =
list: %s", openssl_ciphers);
}
-#endif
}
void
tls_ctx_set_cert_pr=
ofile(struct tls_root_ctx *ctx, const char *profile)
{
-#if OPENSSL_VERSIO=
N_NUMBER > 0x10100000L \
- &&=
(!defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER > 0x3060000f=
L) \
+#if (!defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER > 0=
x3060000fL) \
&& !defined(OPENSSL_IS_AWSLC)
/* OpenSSL does not h=
ave certificate profiles, but a complex set of
* callbacks that we co=
uld try to implement to achieve something similar=2E
@@ -565,7 +512,7 @@
=
{
msg(M_FATAL, "ERROR: Invalid cert profile: %s", profile);
=
}
-#else /* if OPENSSL_VERSION_NUMBER > 0x10100000L */
+#else
if (p=
rofile)
{
msg(M_WARN,
@@ -573,7 +520,7 @@
"suppo=
rt --tls-cert-profile, ignoring user-set profile: '%s'",
profi=
le);
}
-#endif /* if OPENSSL_VERSION_NUMBER > 0x10100000L */
+#endif
=
}
void
@@ -2597,14 +2544,12 @@
crypto_msg(M_FATAL, "Cannot crea=
te SSL_CTX object");
}
-#if defined(TLS1_3_VERSION)
if (tls13)
=
{
SSL_CTX_set_min_proto_version(tls_ctx=2Ectx, TLS1_3_VERSION=
);
tls_ctx_restrict_ciphers_tls13(&tls_ctx, cipher_list);
}
=
else
-#endif
{
SSL_CTX_set_max_proto_version(tls_ctx=2Ect=
x, TLS1_2_VERSION);
tls_ctx_restrict_ciphers(&tls_ctx, cipher_list=
);
@@ -2618,7 +2563,7 @@
crypto_msg(M_FATAL, "Cannot create SSL ob=
ject");
}
-#if OPENSSL_VERSION_NUMBER < 0x1010000fL || defined(OPENS=
SL_IS_AWSLC) || defined(ENABLE_CRYPTO_WOLFSSL)
+#if defined(OPENSSL_IS_AWSL=
C) || defined(ENABLE_CRYPTO_WOLFSSL)
STACK_OF(SSL_CIPHER) *sk =3D SSL_=
get_ciphers(ssl);
#else
STACK_OF(SSL_CIPHER) *sk =3D SSL_get1_support=
ed_ciphers(ssl);
@@ -2646,9 +2591,7 @@
printf("%s\n", pair->ia=
na_name);
}
}
-#if (OPENSSL_VERSION_NUMBER >=3D 0x1010000fL)
=
sk_SSL_CIPHER_free(sk);
-#endif
SSL_free(ssl);
SSL_CTX_free(=
tls_ctx=2Ectx);
}
diff --git a/tests/unit_tests/openvpn/test_ncp=2Ec b/tes=
ts/unit_tests/openvpn/test_ncp=2Ec
index 29365db=2E=2E99e1aac 100644
--- a/=
tests/unit_tests/openvpn/test_ncp=2Ec
+++ b/tests/unit_tests/openvpn/test_n=
cp=2Ec
@@ -110,7 +110,7 @@
assert_string_equal(mutate_ncp_cipher_list(=
"AES-256-GCM:?AES-128-CCM:AES-128-GCM", &gc),
aes_=
ciphers);
- /* For testing that with OpenSSL 1=2E1=2E0+ that also acce=
pts ciphers in
+ /* For testing that with OpenSSL that also accepts ciph=
ers in
* a different spelling the normalised cipher output is the sam=
e */
bool have_chacha_mixed_case =3D cipher_valid("ChaCha20-Poly1305")=
;
if (have_chacha_mixed_case)
--
To view, visit http://gerrit=2Eopen=
vpn=2Enet/c/openvpn/+/1821?usp=3Demail
To unsubscribe, or for help writing =
mail filters, visit http://gerrit=2Eopenvpn=2Enet/settings?usp=3Demail
Ger=
rit-MessageType: merged
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerri=
t-Change-Id: Iae76f10fa683369ca3f718dc24fd54560bb74112
Gerrit-Change-Number=
: 1821
Gerrit-PatchSet: 2
Gerrit-Owner: flichtenheld <frank@lichtenheld=2Ec=
om>
Gerrit-Reviewer: plaisthos <arne-openvpn@rfc2549=2Eorg>
Gerrit-CC: open=
vpn-devel <openvpn-devel@lists=2Esourceforge=2Enet>
--V5z9weTMFTQ=
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html><html><head><style></style></head><body><p>cron2 <strong>sub=
mitted</strong> this change=2E</p><p><a href=3D"http://gerrit=2Eopenvpn=2En=
et/c/openvpn/+/1821?usp=3Demail">View Change</a></p><div style=3D"white-spa=
ce:pre-wrap"></div><pre class=3D"blocks" style=3D"font-family: monospace,mo=
nospace; white-space: pre-wrap;">Drop support for OpenSSL 1=2E1=2E0<br><br>=
Slight simplification of the code since we can then<br>assume that TLS 1=2E=
3 support is present=2E<br><br>Change-Id: Iae76f10fa683369ca3f718dc24fd5456=
0bb74112<br>Signed-off-by: Frank Lichtenheld <frank@lichtenheld=2Ecom>=
;<br>Acked-by: Arne Schwabe <arne-openvpn@rfc2549=2Eorg><br>Gerrit UR=
L: https://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1821<br>Message-Id: <20260=
728063652=2E10456-1-gert@greenie=2Emuc=2Ede><br>URL: https://www=2Email-=
archive=2Ecom/openvpn-devel@lists=2Esourceforge=2Enet/msg37922=2Ehtml<br>Si=
gned-off-by: Gert Doering <gert@greenie=2Emuc=2Ede><br>---<br>M INSTA=
LL<br>M configure=2Eac<br>M src/openvpn/openssl_compat=2Eh<br>M src/openvpn=
/ssl_openssl=2Ec<br>M tests/unit_tests/openvpn/test_ncp=2Ec<br>5 files chan=
ged, 16 insertions(+), 78 deletions(-)<br><br></pre>
<pre style=3D"font-fam=
ily: monospace,monospace; white-space: pre-wrap;"><span>diff --git a/INSTAL=
L b/INSTALL</span><br><span>index 77656b2c=2E=2E78390d5 100644</span><br><s=
pan>--- a/INSTALL</span><br><span>+++ b/INSTALL</span><br><span>@@ -66,10 +=
66,10 @@</span><br><span> (1) TUN and/or TAP driver to allow user-space p=
rograms to control</span><br><span> a virtual point-to-point IP or Et=
hernet device=2E</span><br><span> See TUN/TAP Driver References secti=
on below for more info=2E</span><br><span style=3D"color: hsl(0, 100%, 40%)=
;">- (2a) OpenSSL library, necessary for encryption, version 1=2E1=2E0 or =
higher</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ (2a) OpenSS=
L library, necessary for encryption, version 1=2E1=2E1 or higher</span><br>=
<span> required, available from https://www=2Eopenssl=2Eorg/</span><b=
r><span> or</span><br><span style=3D"color: hsl(0, 100%, 40%);">- (2=
b) mbed TLS library, an alternative for encryption, version 2=2E0 or higher=
</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ (2b) mbed TLS lib=
rary, an alternative for encryption, version 3=2E2=2E1 or higher</span><br>=
<span> required, available from https://tls=2Embed=2Eorg/</span><br><=
span> (3) on Linux, "libnl-gen" is required for kernel netlink =
support</span><br><span> (4) on Linux, "libcap-ng" is required =
for Linux capability handling</span><br><span>diff --git a/configure=2Eac b=
/configure=2Eac</span><br><span>index 188f8fa=2E=2E1aec805 100644</span><br=
><span>--- a/configure=2Eac</span><br><span>+++ b/configure=2Eac</span><br>=
<span>@@ -776,7 +776,7 @@</span><br><span> # if the user did not explicit=
ly specify flags, try to autodetect</span><br><span> PKG_CHECK_MODULES(</=
span><br><span> [OPENSSL],</span><br><span style=3D"color: hsl(0, 100%, =
40%);">- [openssl >=3D 1=2E1=2E0],</span><br><span style=3D"color: hsl=
(120, 100%, 40%);">+ [openssl >=3D 1=2E1=2E1],</span><br><span> [ha=
ve_openssl=3D"yes"],</span><br><span> [AC_MSG_WARN([OpenSSL no=
t found by pkg-config ${pkg_config_found}])] # If this fails, we will do an=
other test next</span><br><span> )</span><br><span>@@ -799,7 +799,7 @@</s=
pan><br><span> ]],</span><br><span> [[</span><br><span> /* Ver=
sion encoding: MNNFFPPS - see opensslv=2Eh for details */</span><br><span s=
tyle=3D"color: hsl(0, 100%, 40%);">-#if OPENSSL_VERSION_NUMBER < 0x10100=
000L</span><br><span style=3D"color: hsl(120, 100%, 40%);">+#if OPENSSL_VER=
SION_NUMBER < 0x10101000L</span><br><span> #error OpenSSL too old</span>=
<br><span> #endif</span><br><span> ]]</span><br><span>diff --git a/src/=
openvpn/openssl_compat=2Eh b/src/openvpn/openssl_compat=2Eh</span><br><span=
>index b61bcbf=2E=2E098bdd5 100644</span><br><span>--- a/src/openvpn/openss=
l_compat=2Eh</span><br><span>+++ b/src/openvpn/openssl_compat=2Eh</span><br=
><span>@@ -26,9 +26,9 @@</span><br><span> * OpenSSL compatibility stub</sp=
an><br><span> *</span><br><span> * This file provide compatibility stubs =
for the OpenSSL libraries</span><br><span style=3D"color: hsl(0, 100%, 40%)=
;">- * prior to version 1=2E1=2E This version introduces many changes in th=
e</span><br><span style=3D"color: hsl(0, 100%, 40%);">- * library interface=
, including the fact that various objects and</span><br><span style=3D"colo=
r: hsl(0, 100%, 40%);">- * structures are not fully opaque=2E</span><br><sp=
an style=3D"color: hsl(120, 100%, 40%);">+ * prior to the current major ver=
sion=2E Newer versions may introduce changes</span><br><span style=3D"color=
: hsl(120, 100%, 40%);">+ * in the library interface, including replacing f=
unctions or enforcing</span><br><span style=3D"color: hsl(120, 100%, 40%);"=
>+ * various objects and structures as fully opaque=2E</span><br><span> */=
</span><br><span> </span><br><span> #ifndef OPENSSL_COMPAT_H_</span><br><sp=
an>@@ -62,11 +62,6 @@</span><br><span> #endif</span><br><span> </span><br><=
span> </span><br><span style=3D"color: hsl(0, 100%, 40%);">-/* Functionalit=
y missing in 1=2E1=2E0 */</span><br><span style=3D"color: hsl(0, 100%, 40%)=
;">-#if OPENSSL_VERSION_NUMBER < 0x10101000L && !defined(ENABLE_=
CRYPTO_WOLFSSL)</span><br><span style=3D"color: hsl(0, 100%, 40%);">-#defin=
e SSL_CTX_set1_groups SSL_CTX_set1_curves</span><br><span style=3D"color: h=
sl(0, 100%, 40%);">-#endif</span><br><span style=3D"color: hsl(0, 100%, 40%=
);">-</span><br><span> /* Functionality missing in LibreSSL before 3=2E5 */=
</span><br><span> #if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_=
VERSION_NUMBER < 0x3050000fL</span><br><span> #define EVP_CTRL_AEAD_SET_=
TAG EVP_CTRL_GCM_SET_TAG</span><br><span>diff --git a/src/openvpn/ssl_opens=
sl=2Ec b/src/openvpn/ssl_openssl=2Ec</span><br><span>index ef99b22=2E=2E32b=
13db 100644</span><br><span>--- a/src/openvpn/ssl_openssl=2Ec</span><br><sp=
an>+++ b/src/openvpn/ssl_openssl=2Ec</span><br><span>@@ -200,42 +200,12 @@<=
/span><br><span> </span><br><span> /*</span><br><span> * Return maximum TL=
S version supported by local OpenSSL library=2E</span><br><span style=3D"co=
lor: hsl(0, 100%, 40%);">- * Assume that presence of SSL_OP_NO_TLSvX macro =
indicates that</span><br><span style=3D"color: hsl(0, 100%, 40%);">- * TLSv=
X is supported=2E</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ *=
We only support OpenSSL versions that support TLS 1=2E3=2E</span><br><span=
> */</span><br><span> int</span><br><span> tls_version_max(void)</span><br=
><span> {</span><br><span style=3D"color: hsl(0, 100%, 40%);">-#if defined(=
TLS1_3_VERSION)</span><br><span style=3D"color: hsl(0, 100%, 40%);">- /*=
If this is defined we can safely assume TLS 1=2E3 support */</span><br><sp=
an> return TLS_VER_1_3;</span><br><span style=3D"color: hsl(0, 100%, 40=
%);">-#elif OPENSSL_VERSION_NUMBER >=3D 0x10100000L</span><br><span styl=
e=3D"color: hsl(0, 100%, 40%);">- /*</span><br><span style=3D"color: hsl=
(0, 100%, 40%);">- * If TLS_VER_1_3 is not defined, we were compiled ag=
ainst a version that</span><br><span style=3D"color: hsl(0, 100%, 40%);">- =
* did not support TLS 1=2E3=2E</span><br><span style=3D"color: hsl(0, 1=
00%, 40%);">- *</span><br><span style=3D"color: hsl(0, 100%, 40%);">- =
* However, the library we are *linked* against might be OpenSSL 1=2E1=2E=
1</span><br><span style=3D"color: hsl(0, 100%, 40%);">- * and therefore=
supports TLS 1=2E3=2E This needs to be checked at runtime</span><br><span =
style=3D"color: hsl(0, 100%, 40%);">- * since we can be compiled agains=
t 1=2E1=2E0 and then the library can be</span><br><span style=3D"color: hsl=
(0, 100%, 40%);">- * upgraded to 1=2E1=2E1=2E</span><br><span style=3D"=
color: hsl(0, 100%, 40%);">- * We only need to check this for OpenSSL v=
ersions that can be</span><br><span style=3D"color: hsl(0, 100%, 40%);">- =
* upgraded to 1=2E1=2E1 without recompile (>=3D 1=2E1=2E0)</span><br>=
<span style=3D"color: hsl(0, 100%, 40%);">- */</span><br><span style=3D=
"color: hsl(0, 100%, 40%);">- if (OpenSSL_version_num() >=3D 0x101010=
0fL)</span><br><span style=3D"color: hsl(0, 100%, 40%);">- {</span><br><=
span style=3D"color: hsl(0, 100%, 40%);">- return TLS_VER_1_3;</span=
><br><span style=3D"color: hsl(0, 100%, 40%);">- }</span><br><span style=
=3D"color: hsl(0, 100%, 40%);">- else</span><br><span style=3D"color: hs=
l(0, 100%, 40%);">- {</span><br><span style=3D"color: hsl(0, 100%, 40%);=
">- return TLS_VER_1_2;</span><br><span style=3D"color: hsl(0, 100%,=
40%);">- }</span><br><span style=3D"color: hsl(0, 100%, 40%);">-#elif d=
efined(TLS1_2_VERSION) || defined(SSL_OP_NO_TLSv1_2)</span><br><span style=
=3D"color: hsl(0, 100%, 40%);">- return TLS_VER_1_2;</span><br><span sty=
le=3D"color: hsl(0, 100%, 40%);">-#elif defined(TLS1_1_VERSION) || defined(=
SSL_OP_NO_TLSv1_1)</span><br><span style=3D"color: hsl(0, 100%, 40%);">- =
return TLS_VER_1_1;</span><br><span style=3D"color: hsl(0, 100%, 40%);">-#=
else /* if defined(TLS1_3_VERSION) */</span><br><span style=3D"color: hsl(0=
, 100%, 40%);">- return TLS_VER_1_0;</span><br><span style=3D"color: hsl=
(0, 100%, 40%);">-#endif</span><br><span> }</span><br><span> </span><br><sp=
an> /** Convert internal version number to openssl version number */</span>=
<br><span>@@ -256,22 +226,7 @@</span><br><span> }</span><br><span> =
else if (ver =3D=3D TLS_VER_1_3)</span><br><span> {</span><br><span sty=
le=3D"color: hsl(0, 100%, 40%);">- /*</span><br><span style=3D"color=
: hsl(0, 100%, 40%);">- * Supporting the library upgraded to TLS1=
=2E3 without recompile</span><br><span style=3D"color: hsl(0, 100%, 40%);">=
- * is enough to support here with a simple constant that the same<=
/span><br><span style=3D"color: hsl(0, 100%, 40%);">- * as in the T=
LS 1=2E3, so spec it is very unlikely that OpenSSL</span><br><span style=3D=
"color: hsl(0, 100%, 40%);">- * will change this constant</span><br=
><span style=3D"color: hsl(0, 100%, 40%);">- */</span><br><span sty=
le=3D"color: hsl(0, 100%, 40%);">-#ifndef TLS1_3_VERSION</span><br><span st=
yle=3D"color: hsl(0, 100%, 40%);">- /*</span><br><span style=3D"colo=
r: hsl(0, 100%, 40%);">- * We do not want to define TLS_VER_1_3 if =
not defined</span><br><span style=3D"color: hsl(0, 100%, 40%);">- *=
since other parts of the code use the existance of this macro</span><br><s=
pan style=3D"color: hsl(0, 100%, 40%);">- * as proxy for TLS 1=2E3 =
support</span><br><span style=3D"color: hsl(0, 100%, 40%);">- */</s=
pan><br><span style=3D"color: hsl(0, 100%, 40%);">- return 0x0304;</=
span><br><span style=3D"color: hsl(0, 100%, 40%);">-#else</span><br><span> =
return TLS1_3_VERSION;</span><br><span style=3D"color: hsl(0, 100%,=
40%);">-#endif</span><br><span> }</span><br><span> return 0;</span=
><br><span> }</span><br><span>@@ -491,8 +446,8 @@</span><br><span> */<=
/span><br><span> if (strlen(ciphers) >=3D (len - 1))</span><br><span=
> {</span><br><span style=3D"color: hsl(0, 100%, 40%);">- msg(M_=
FATAL, "Failed to set restricted TLS 1=2E3 cipher list, too long (>=
%d)=2E",</span><br><span style=3D"color: hsl(0, 100%, 40%);">- =
(int)(len - 1));</span><br><span style=3D"color: hsl(120, 100%, 40%);">=
+ msg(M_FATAL, "Failed to set restricted TLS 1=2E3 cipher list,=
too long (>%zd)=2E",</span><br><span style=3D"color: hsl(120, 100%=
, 40%);">+ len - 1);</span><br><span> }</span><br><span> </s=
pan><br><span> strncpy(openssl_ciphers, ciphers, len);</span><br><span>=
@@ -511,17 +466,11 @@</span><br><span> {</span><br><span> if (ciphers =
=3D=3D NULL)</span><br><span> {</span><br><span style=3D"color: hsl(0, =
100%, 40%);">- /* default cipher list of OpenSSL 1=2E1=2E1 is sane, =
do not set own</span><br><span style=3D"color: hsl(120, 100%, 40%);">+ =
/* default cipher list of OpenSSL is sane, do not set own</span><br><spa=
n> * default as we do with tls-cipher */</span><br><span> =
return;</span><br><span> }</span><br><span> </span><br><span style=3D"c=
olor: hsl(0, 100%, 40%);">-#if !defined(TLS1_3_VERSION)</span><br><span sty=
le=3D"color: hsl(0, 100%, 40%);">- crypto_msg(M_WARN,</span><br><span st=
yle=3D"color: hsl(0, 100%, 40%);">- "Not compiled with O=
penSSL 1=2E1=2E1 or higher=2E "</span><br><span style=3D"color: hsl(0,=
100%, 40%);">- "Ignoring TLS 1=2E3 only tls-ciphersuite=
s '%s' setting=2E",</span><br><span style=3D"color: hsl(0, 100=
%, 40%);">- ciphers);</span><br><span style=3D"color: hsl(0, =
100%, 40%);">-#else</span><br><span> ASSERT(NULL !=3D ctx);</span><br><=
span> </span><br><span> char openssl_ciphers[4096];</span><br><span>@@ =
-531,14 +480,12 @@</span><br><span> {</span><br><span> crypto_m=
sg(M_FATAL, "Failed to set restricted TLS 1=2E3 cipher list: %s",=
openssl_ciphers);</span><br><span> }</span><br><span style=3D"color: h=
sl(0, 100%, 40%);">-#endif</span><br><span> }</span><br><span> </span><br><=
span> void</span><br><span> tls_ctx_set_cert_profile(struct tls_root_ctx *c=
tx, const char *profile)</span><br><span> {</span><br><span style=3D"color:=
hsl(0, 100%, 40%);">-#if OPENSSL_VERSION_NUMBER > 0x10100000L =
\</span><br><span style=3D"color: hsl(0, =
100%, 40%);">- && (!defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL=
_VERSION_NUMBER > 0x3060000fL) \</span><br><span style=3D"color: hsl(120=
, 100%, 40%);">+#if (!defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_=
NUMBER > 0x3060000fL) \</span><br><span> && !defined(OPENSSL=
_IS_AWSLC)</span><br><span> /* OpenSSL does not have certificate profil=
es, but a complex set of</span><br><span> * callbacks that we could tr=
y to implement to achieve something similar=2E</span><br><span>@@ -565,7 +5=
12,7 @@</span><br><span> {</span><br><span> msg(M_FATAL, "=
ERROR: Invalid cert profile: %s", profile);</span><br><span> }</sp=
an><br><span style=3D"color: hsl(0, 100%, 40%);">-#else /* if OPENSSL_VERS=
ION_NUMBER > 0x10100000L */</span><br><span style=3D"color: hsl(120, 100=
%, 40%);">+#else</span><br><span> if (profile)</span><br><span> {</=
span><br><span> msg(M_WARN,</span><br><span>@@ -573,7 +520,7 @@</sp=
an><br><span> "support --tls-cert-profile, ignoring user-s=
et profile: '%s'",</span><br><span> profile);</spa=
n><br><span> }</span><br><span style=3D"color: hsl(0, 100%, 40%);">-#en=
dif /* if OPENSSL_VERSION_NUMBER > 0x10100000L */</span><br><span style=
=3D"color: hsl(120, 100%, 40%);">+#endif</span><br><span> }</span><br><span=
> </span><br><span> void</span><br><span>@@ -2597,14 +2544,12 @@</span><br>=
<span> crypto_msg(M_FATAL, "Cannot create SSL_CTX object"=
);</span><br><span> }</span><br><span> </span><br><span style=3D"color:=
hsl(0, 100%, 40%);">-#if defined(TLS1_3_VERSION)</span><br><span> if (=
tls13)</span><br><span> {</span><br><span> SSL_CTX_set_min_prot=
o_version(tls_ctx=2Ectx, TLS1_3_VERSION);</span><br><span> tls_ctx_=
restrict_ciphers_tls13(&tls_ctx, cipher_list);</span><br><span> }</=
span><br><span> else</span><br><span style=3D"color: hsl(0, 100%, 40%);=
">-#endif</span><br><span> {</span><br><span> SSL_CTX_set_max_p=
roto_version(tls_ctx=2Ectx, TLS1_2_VERSION);</span><br><span> tls_c=
tx_restrict_ciphers(&tls_ctx, cipher_list);</span><br><span>@@ -2618,7 =
+2563,7 @@</span><br><span> crypto_msg(M_FATAL, "Cannot create=
SSL object");</span><br><span> }</span><br><span> </span><br><spa=
n style=3D"color: hsl(0, 100%, 40%);">-#if OPENSSL_VERSION_NUMBER < 0x10=
10000fL || defined(OPENSSL_IS_AWSLC) || defined(ENABLE_CRYPTO_WOLFSSL)</spa=
n><br><span style=3D"color: hsl(120, 100%, 40%);">+#if defined(OPENSSL_IS_A=
WSLC) || defined(ENABLE_CRYPTO_WOLFSSL)</span><br><span> STACK_OF(SSL_C=
IPHER) *sk =3D SSL_get_ciphers(ssl);</span><br><span> #else</span><br><span=
> STACK_OF(SSL_CIPHER) *sk =3D SSL_get1_supported_ciphers(ssl);</span><=
br><span>@@ -2646,9 +2591,7 @@</span><br><span> printf("%s=
\n", pair->iana_name);</span><br><span> }</span><br><span> =
}</span><br><span style=3D"color: hsl(0, 100%, 40%);">-#if (OPENSSL_VER=
SION_NUMBER >=3D 0x1010000fL)</span><br><span> sk_SSL_CIPHER_free(sk=
);</span><br><span style=3D"color: hsl(0, 100%, 40%);">-#endif</span><br><s=
pan> SSL_free(ssl);</span><br><span> SSL_CTX_free(tls_ctx=2Ectx);</=
span><br><span> }</span><br><span>diff --git a/tests/unit_tests/openvpn/tes=
t_ncp=2Ec b/tests/unit_tests/openvpn/test_ncp=2Ec</span><br><span>index 293=
65db=2E=2E99e1aac 100644</span><br><span>--- a/tests/unit_tests/openvpn/tes=
t_ncp=2Ec</span><br><span>+++ b/tests/unit_tests/openvpn/test_ncp=2Ec</span=
><br><span>@@ -110,7 +110,7 @@</span><br><span> assert_string_equal(mut=
ate_ncp_cipher_list("AES-256-GCM:?AES-128-CCM:AES-128-GCM", &=
gc),</span><br><span> aes_ciphers);</span><br><span=
> </span><br><span style=3D"color: hsl(0, 100%, 40%);">- /* For testing =
that with OpenSSL 1=2E1=2E0+ that also accepts ciphers in</span><br><span s=
tyle=3D"color: hsl(120, 100%, 40%);">+ /* For testing that with OpenSSL =
that also accepts ciphers in</span><br><span> * a different spelling t=
he normalised cipher output is the same */</span><br><span> bool have_c=
hacha_mixed_case =3D cipher_valid("ChaCha20-Poly1305");</span><br=
><span> if (have_chacha_mixed_case)</span><br><span></span><br></pre><p=
>To view, visit <a href=3D"http://gerrit=2Eopenvpn=2Enet/c/openvpn/+/1821?u=
sp=3Demail">change 1821</a>=2E To unsubscribe, or for help writing mail fil=
ters, visit <a href=3D"http://gerrit=2Eopenvpn=2Enet/settings?usp=3Demail">=
settings</a>=2E</p><div itemscope itemtype=3D"http://schema=2Eorg/EmailMess=
age"><div itemscope itemprop=3D"action" itemtype=3D"http://schema=2Eorg/Vie=
wAction"><link itemprop=3D"url" href=3D"http://gerrit=2Eopenvpn=2Enet/c/ope=
nvpn/+/1821?usp=3Demail"/><meta itemprop=3D"name" content=3D"View Change"/>=
</div></div>
<div style=3D"display:none"> Gerrit-MessageType: merged </div=
>
<div style=3D"display:none"> Gerrit-Project: openvpn </div>
<div style=3D=
"display:none"> Gerrit-Branch: master </div>
<div style=3D"display:none"> G=
errit-Change-Id: Iae76f10fa683369ca3f718dc24fd54560bb74112 </div>
<div styl=
e=3D"display:none"> Gerrit-Change-Number: 1821 </div>
<div style=3D"display=
:none"> Gerrit-PatchSet: 2 </div>
<div style=3D"display:none"> Gerrit-Owner=
: flichtenheld <frank@lichtenheld=2Ecom> </div>
<div style=3D"display=
:none"> Gerrit-Reviewer: plaisthos <arne-openvpn@rfc2549=2Eorg> </div=
>
<div style=3D"display:none"> Gerrit-CC: openvpn-devel <openvpn-devel@l=
ists=2Esourceforge=2Enet> </div>
</body></html>
--V5z9weTMFTQ=--
--===============6109248228321311289==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============6109248228321311289==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
--===============6109248228321311289==--