1 #ifndef _COMMON_OPENSSL_COMPAT_H
2 #define _COMMON_OPENSSL_COMPAT_H
3 #ifdef USE_OPENSSL
4 
5 #include <openssl/bn.h>
6 #include <openssl/crypto.h>
7 #include <openssl/ssl.h>
8 #include <openssl/x509.h>
9 #include <openssl/x509v3.h>
10 #include <openssl/err.h>
11 #include <openssl/rand.h>
12 #include <openssl/hmac.h>
13 #if (defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP)
14 #include <openssl/ocsp.h>
15 #endif
16 #ifndef OPENSSL_NO_DH
17 #include <openssl/dh.h>
18 #endif
19 #ifndef OPENSSL_NO_ENGINE
20 #include <openssl/engine.h>
21 #endif
22 
23 #if (OPENSSL_VERSION_NUMBER >= 0x1010000fL) && !defined(OPENSSL_NO_ASYNC) && !defined(LIBRESSL_VERSION_NUMBER)
24 #include <openssl/async.h>
25 #endif
26 
27 #if defined(LIBRESSL_VERSION_NUMBER)
28 /* LibreSSL is a fork of OpenSSL 1.0.1g but pretends to be 2.0.0, thus
29  * systematically breaking when some code is written for a specific version
30  * of OpenSSL. Let's make it appear like what it really is and deal with
31  * extra features with ORs and not with AND NOT.
32  */
33 #define HA_OPENSSL_VERSION_NUMBER 0x1000107fL
34 #elif defined(OPENSSL_IS_BORINGSSL)
35 /*
36  * in 49e9f67d8b7cbeb3953b5548ad1009d15947a523 BoringSSL has changed its version to 1.1.1
37  * Let's switch it back to 1.1.0
38  */
39 #define HA_OPENSSL_VERSION_NUMBER 0x1010007f
40 #else /* this is for a real OpenSSL or a truly compatible derivative */
41 #define HA_OPENSSL_VERSION_NUMBER OPENSSL_VERSION_NUMBER
42 #endif
43 
44 #ifndef OPENSSL_VERSION
45 #define OPENSSL_VERSION         SSLEAY_VERSION
46 #define OpenSSL_version(x)      SSLeay_version(x)
47 #define OpenSSL_version_num     SSLeay
48 #endif
49 
50 #if (HA_OPENSSL_VERSION_NUMBER < 0x0090800fL)
51 /* Functions present in OpenSSL 0.9.8, older not tested */
SSL_SESSION_get_id(const SSL_SESSION * sess,unsigned int * sid_length)52 static inline const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *sess, unsigned int *sid_length)
53 {
54 	*sid_length = sess->session_id_length;
55 	return sess->session_id;
56 }
57 
X509_NAME_get_entry(const X509_NAME * name,int loc)58 static inline X509_NAME_ENTRY *X509_NAME_get_entry(const X509_NAME *name, int loc)
59 {
60 	return sk_X509_NAME_ENTRY_value(name->entries, loc);
61 }
62 
X509_NAME_ENTRY_get_object(const X509_NAME_ENTRY * ne)63 static inline ASN1_OBJECT *X509_NAME_ENTRY_get_object(const X509_NAME_ENTRY *ne)
64 {
65 	return ne->object;
66 }
67 
X509_NAME_ENTRY_get_data(const X509_NAME_ENTRY * ne)68 static inline ASN1_STRING *X509_NAME_ENTRY_get_data(const X509_NAME_ENTRY *ne)
69 {
70 	return ne->value;
71 }
72 
ASN1_STRING_length(const ASN1_STRING * x)73 static inline int ASN1_STRING_length(const ASN1_STRING *x)
74 {
75 	return x->length;
76 }
77 
X509_NAME_entry_count(X509_NAME * name)78 static inline int X509_NAME_entry_count(X509_NAME *name)
79 {
80 	return sk_X509_NAME_ENTRY_num(name->entries)
81 }
82 
83 static inline void X509_ALGOR_get0(ASN1_OBJECT **paobj, int *pptype, const void **ppval, const X509_ALGOR *algor)
84 {
85 	*paobj = algor->algorithm;
86 }
87 
88 #endif // OpenSSL < 0.9.8
89 
90 
91 #if (HA_OPENSSL_VERSION_NUMBER < 0x1000000fL)
92 /* Functions introduced in OpenSSL 1.0.0 */
93 static inline int EVP_PKEY_base_id(const EVP_PKEY *pkey)
94 {
95 	return EVP_PKEY_type(pkey->type);
96 }
97 
98 /* minimal implementation based on the fact that the only known call place
99  * doesn't make use of other arguments.
100  */
101 static inline int X509_PUBKEY_get0_param(ASN1_OBJECT **ppkalg, const unsigned char **pk, int *ppklen, X509_ALGOR **pa, X509_PUBKEY *pub)
102 {
103 	*ppkalg = pub->algor->algorithm;
104 	return 1;
105 }
106 
107 #ifndef X509_get_X509_PUBKEY
108 #define X509_get_X509_PUBKEY(x) ((x)->cert_info->key
109 #endif
110 
111 #endif
112 
113 #if (HA_OPENSSL_VERSION_NUMBER < 0x1000100fL)
114 /*
115  * Functions introduced in OpenSSL 1.0.1
116  */
117 static inline int SSL_SESSION_set1_id_context(SSL_SESSION *s, const unsigned char *sid_ctx, unsigned int sid_ctx_len)
118 {
119 	s->sid_ctx_length = sid_ctx_len;
120 	memcpy(s->sid_ctx, sid_ctx, sid_ctx_len);
121 	return 1;
122 }
123 #endif
124 
125 
126 #if (HA_OPENSSL_VERSION_NUMBER < 0x1000200fL) && (LIBRESSL_VERSION_NUMBER < 0x2070500fL)
127 /* introduced in openssl 1.0.2 */
128 
129 static inline STACK_OF(X509) *X509_chain_up_ref(STACK_OF(X509) *chain)
130 {
131 	STACK_OF(X509) *ret;
132 	int i;
133 
134 	if ((ret = sk_X509_dup(chain)) == NULL)
135 		return NULL;
136 	for (i = 0; i < sk_X509_num(ret); i++) {
137 		X509 *x = sk_X509_value(ret, i);
138 		CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
139 	}
140 	return ret;
141 }
142 
143 #endif
144 
145 #if (HA_OPENSSL_VERSION_NUMBER < 0x1010000fL) && (LIBRESSL_VERSION_NUMBER < 0x2070000fL)
146 /*
147  * Functions introduced in OpenSSL 1.1.0 and in LibreSSL 2.7.0
148  */
149 
150 static inline const unsigned char *SSL_SESSION_get0_id_context(const SSL_SESSION *sess, unsigned int *sid_ctx_length)
151 {
152 	*sid_ctx_length = sess->sid_ctx_length;
153 	return sess->sid_ctx;
154 }
155 
156 static inline int SSL_SESSION_set1_id(SSL_SESSION *s, const unsigned char *sid, unsigned int sid_len)
157 {
158 	s->session_id_length = sid_len;
159 	memcpy(s->session_id, sid, sid_len);
160 	return 1;
161 }
162 
163 static inline X509_ALGOR *X509_get0_tbs_sigalg(const X509 *x)
164 {
165 	return x->cert_info->signature;
166 }
167 
168 #if (!defined OPENSSL_NO_OCSP)
169 static inline const OCSP_CERTID *OCSP_SINGLERESP_get0_id(const OCSP_SINGLERESP *single)
170 {
171 	return single->certId;
172 }
173 #endif
174 
175 static inline pem_password_cb *SSL_CTX_get_default_passwd_cb(SSL_CTX *ctx)
176 {
177 	return ctx->default_passwd_callback;
178 }
179 
180 static inline void *SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX *ctx)
181 {
182 	return ctx->default_passwd_callback_userdata;
183 }
184 
185 #ifndef OPENSSL_NO_DH
186 static inline int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g)
187 {
188 	/* Implements only the bare necessities for HAProxy */
189 	dh->p = p;
190 	dh->g = g;
191 	return 1;
192 }
193 #endif
194 
195 static inline const unsigned char *ASN1_STRING_get0_data(const ASN1_STRING *x)
196 {
197 	return x->data;
198 }
199 
200 static inline void X509_up_ref(X509 *x)
201 {
202 	CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
203 }
204 
205 static inline void EVP_PKEY_up_ref(EVP_PKEY *pkey)
206 {
207 	CRYPTO_add(&pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);
208 }
209 #endif
210 
211 #if (HA_OPENSSL_VERSION_NUMBER >= 0x1010000fL) || (LIBRESSL_VERSION_NUMBER >= 0x2070200fL)
212 #define __OPENSSL_110_CONST__ const
213 #else
214 #define __OPENSSL_110_CONST__
215 #endif
216 
217 /* ERR_remove_state() was deprecated in 1.0.0 in favor of
218  * ERR_remove_thread_state(), which was in turn deprecated in
219  * 1.1.0 and does nothing anymore. Let's simply silently kill
220  * it.
221  */
222 #if (HA_OPENSSL_VERSION_NUMBER >= 0x1010000fL)
223 #undef  ERR_remove_state
224 #define ERR_remove_state(x)
225 #endif
226 
227 
228 /* RAND_pseudo_bytes() is deprecated in 1.1.0 in favor of RAND_bytes(). Note
229  * that the return codes differ, but it happens that the only use case (ticket
230  * key update) was already wrong, considering a non-cryptographic random as a
231  * failure.
232  */
233 #if (HA_OPENSSL_VERSION_NUMBER >= 0x1010000fL)
234 #undef  RAND_pseudo_bytes
235 #define RAND_pseudo_bytes(x,y) RAND_bytes(x,y)
236 #endif
237 
238 
239 /* Signature from RFC 5246, missing in openssl < 1.0.1 */
240 #ifndef TLSEXT_signature_anonymous
241 #define TLSEXT_signature_anonymous  0
242 #define TLSEXT_signature_rsa        1
243 #define TLSEXT_signature_dsa        2
244 #define TLSEXT_signature_ecdsa      3
245 #endif
246 
247 #if ((HA_OPENSSL_VERSION_NUMBER < 0x1010000fL) && (LIBRESSL_VERSION_NUMBER < 0x2070000fL)) ||\
248 	defined(OPENSSL_IS_BORINGSSL)
249 #define X509_getm_notBefore     X509_get_notBefore
250 #define X509_getm_notAfter      X509_get_notAfter
251 #endif
252 
253 #if (OPENSSL_VERSION_NUMBER < 0x1010000fL || defined LIBRESSL_VERSION_NUMBER)
254 #define EVP_CTRL_AEAD_SET_IVLEN EVP_CTRL_GCM_SET_IVLEN
255 #define EVP_CTRL_AEAD_SET_TAG   EVP_CTRL_GCM_SET_TAG
256 #endif
257 
258 /* Supported hash function for TLS tickets */
259 #ifdef OPENSSL_NO_SHA256
260 #define TLS_TICKET_HASH_FUNCT EVP_sha1
261 #else
262 #define TLS_TICKET_HASH_FUNCT EVP_sha256
263 #endif /* OPENSSL_NO_SHA256 */
264 
265 #ifndef SSL_OP_CIPHER_SERVER_PREFERENCE                 /* needs OpenSSL >= 0.9.7 */
266 #define SSL_OP_CIPHER_SERVER_PREFERENCE 0
267 #endif
268 
269 #ifndef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION   /* needs OpenSSL >= 0.9.7 */
270 #define SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION 0
271 #define SSL_renegotiate_pending(arg) 0
272 #endif
273 
274 #ifndef SSL_OP_SINGLE_ECDH_USE                          /* needs OpenSSL >= 0.9.8 */
275 #define SSL_OP_SINGLE_ECDH_USE 0
276 #endif
277 
278 #ifndef SSL_OP_NO_TICKET                                /* needs OpenSSL >= 0.9.8 */
279 #define SSL_OP_NO_TICKET 0
280 #endif
281 
282 #ifndef SSL_OP_NO_COMPRESSION                           /* needs OpenSSL >= 0.9.9 */
283 #define SSL_OP_NO_COMPRESSION 0
284 #endif
285 
286 #ifdef OPENSSL_NO_SSL3                                  /* SSLv3 support removed */
287 #undef  SSL_OP_NO_SSLv3
288 #define SSL_OP_NO_SSLv3 0
289 #endif
290 
291 #ifndef SSL_OP_NO_TLSv1_1                               /* needs OpenSSL >= 1.0.1 */
292 #define SSL_OP_NO_TLSv1_1 0
293 #endif
294 
295 #ifndef SSL_OP_NO_TLSv1_2                               /* needs OpenSSL >= 1.0.1 */
296 #define SSL_OP_NO_TLSv1_2 0
297 #endif
298 
299 #ifndef SSL_OP_NO_TLSv1_3                               /* needs OpenSSL >= 1.1.1 */
300 #define SSL_OP_NO_TLSv1_3 0
301 #endif
302 
303 #ifndef SSL_OP_SINGLE_DH_USE                            /* needs OpenSSL >= 0.9.6 */
304 #define SSL_OP_SINGLE_DH_USE 0
305 #endif
306 
307 #ifndef SSL_OP_SINGLE_ECDH_USE                            /* needs OpenSSL >= 1.0.0 */
308 #define SSL_OP_SINGLE_ECDH_USE 0
309 #endif
310 
311 #ifndef SSL_MODE_RELEASE_BUFFERS                        /* needs OpenSSL >= 1.0.0 */
312 #define SSL_MODE_RELEASE_BUFFERS 0
313 #endif
314 
315 #ifndef SSL_MODE_SMALL_BUFFERS                          /* needs small_records.patch */
316 #define SSL_MODE_SMALL_BUFFERS 0
317 #endif
318 
319 #ifndef SSL_OP_PRIORITIZE_CHACHA                        /* needs OpenSSL >= 1.1.1 */
320 #define SSL_OP_PRIORITIZE_CHACHA 0
321 #endif
322 
323 #ifndef SSL_CTRL_GET_EXTRA_CHAIN_CERTS
324 #define SSL_CTX_get_extra_chain_certs(ctx, chain) do { *(chain) = (ctx)->extra_certs; } while (0)
325 #endif
326 
327 #if HA_OPENSSL_VERSION_NUMBER < 0x10100000L
328 #define BIO_get_data(b)            (b)->ptr
329 #define BIO_set_data(b, v)         do { (b)->ptr  = (v); } while (0)
330 #define BIO_set_init(b, v)         do { (b)->init = (v); } while (0)
331 
332 #define BIO_meth_free(m)           free(m)
333 #define BIO_meth_new(type, name)   calloc(1, sizeof(BIO_METHOD))
334 #define BIO_meth_set_gets(m, f)    do { (m)->bgets   = (f); } while (0)
335 #define BIO_meth_set_puts(m, f)    do { (m)->bputs   = (f); } while (0)
336 #define BIO_meth_set_read(m, f)    do { (m)->bread   = (f); } while (0)
337 #define BIO_meth_set_write(m, f)   do { (m)->bwrite  = (f); } while (0)
338 #define BIO_meth_set_create(m, f)  do { (m)->create  = (f); } while (0)
339 #define BIO_meth_set_ctrl(m, f)    do { (m)->ctrl    = (f); } while (0)
340 #define BIO_meth_set_destroy(m, f) do { (m)->destroy = (f); } while (0)
341 #endif
342 
343 #ifndef SSL_CTX_set_ecdh_auto
344 #define SSL_CTX_set_ecdh_auto(dummy, onoff)      ((onoff) != 0)
345 #endif
346 
347 #endif /* USE_OPENSSL */
348 #endif /* _COMMON_OPENSSL_COMPAT_H */
349