1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
|
From 521750b438d96bef234b338901ff74f239b68061 Mon Sep 17 00:00:00 2001
From: Stefan Strogin <steils@gentoo.org>
Date: Sat, 8 Jun 2019 15:52:26 +0300
Subject: [PATCH] Fix build with LibreSSL
- Fix version checks as OPENSSL_VERSION_NUMBER in OpenSSL is always
0x20000000L.
- FIPS support is removed from LibreSSL, do not use it.
- Check for TLS1_3_VERSION define, not OpenSSL/LibreSSL version.
Theoretically even OpenSSL >=1.1.1 can be built with TLS 1.3 disabled.
---
cmake/ssl.cmake | 5 +++--
extra/libevent/openssl-compat.h | 5 ++++-
mysys_ssl/my_md5.cc | 2 +-
.../src/bindings/xcom/xcom/xcom_ssl_transport.c | 4 ++--
plugin/x/client/xconnection_impl.cc | 4 ++--
router/src/http/src/tls_client_context.cc | 2 +-
router/src/http/src/tls_context.cc | 6 +++++-
router/src/http/src/tls_server_context.cc | 3 ++-
sql-common/client.cc | 3 ++-
sql/mysqld.cc | 4 ++--
sql/sys_vars.cc | 8 ++++----
vio/viossl.cc | 4 ++--
vio/viosslfactories.cc | 2 +-
13 files changed, 31 insertions(+), 21 deletions(-)
diff --git a/cmake/ssl.cmake b/cmake/ssl.cmake
index be3411a8916..95ed535f08a 100644
--- a/cmake/ssl.cmake
+++ b/cmake/ssl.cmake
@@ -313,13 +313,14 @@ MACRO (MYSQL_CHECK_SSL)
OPENSSL_FIX_VERSION "${OPENSSL_VERSION_NUMBER}"
)
ENDIF()
- IF("${OPENSSL_MAJOR_VERSION}.${OPENSSL_MINOR_VERSION}.${OPENSSL_FIX_VERSION}" VERSION_GREATER "1.1.0")
+ CHECK_SYMBOL_EXISTS(TLS1_3_VERSION "openssl/tls1.h" HAVE_TLS1_3_VERSION)
+ IF(HAVE_TLS1_3_VERSION)
ADD_DEFINITIONS(-DHAVE_TLSv13)
ENDIF()
IF(OPENSSL_INCLUDE_DIR AND
OPENSSL_LIBRARY AND
CRYPTO_LIBRARY AND
- OPENSSL_MAJOR_VERSION STREQUAL "1"
+ OPENSSL_MAJOR_VERSION VERSION_GREATER_EQUAL "1"
)
SET(OPENSSL_FOUND TRUE)
FIND_PROGRAM(OPENSSL_EXECUTABLE openssl
diff --git a/extra/libevent/openssl-compat.h b/extra/libevent/openssl-compat.h
index 69afc716e25..deb21d6ad77 100644
--- a/extra/libevent/openssl-compat.h
+++ b/extra/libevent/openssl-compat.h
@@ -24,7 +24,6 @@ static inline BIO_METHOD *BIO_meth_new(int type, const char *name)
#define BIO_set_init(b, val) (b)->init = (val)
#define BIO_set_data(b, val) (b)->ptr = (val)
#define BIO_set_shutdown(b, val) (b)->shutdown = (val)
-#define BIO_get_init(b) (b)->init
#define BIO_get_data(b) (b)->ptr
#define BIO_get_shutdown(b) (b)->shutdown
@@ -32,4 +31,8 @@ static inline BIO_METHOD *BIO_meth_new(int type, const char *name)
#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+#define BIO_get_init(b) (b)->init
+#endif
+
#endif /* OPENSSL_COMPAT_H */
diff --git a/mysys_ssl/my_md5.cc b/mysys_ssl/my_md5.cc
index 095fcb4eafb..0bdc885a96d 100644
--- a/mysys_ssl/my_md5.cc
+++ b/mysys_ssl/my_md5.cc
@@ -56,7 +56,7 @@ static void my_md5_hash(unsigned char *digest, unsigned const char *buf,
int compute_md5_hash(char *digest, const char *buf, int len) {
int retval = 0;
int fips_mode = 0;
-#if !defined(HAVE_WOLFSSL)
+#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER)
fips_mode = FIPS_mode();
#endif /* HAVE_WOLFSSL */
/* If fips mode is ON/STRICT restricted method calls will result into abort,
diff --git a/plugin/group_replication/libmysqlgcs/src/bindings/xcom/xcom/xcom_ssl_transport.c b/plugin/group_replication/libmysqlgcs/src/bindings/xcom/xcom/xcom_ssl_transport.c
index 67c151b207b..6a18a717b23 100644
--- a/plugin/group_replication/libmysqlgcs/src/bindings/xcom/xcom/xcom_ssl_transport.c
+++ b/plugin/group_replication/libmysqlgcs/src/bindings/xcom/xcom/xcom_ssl_transport.c
@@ -297,7 +297,7 @@ error:
return 1;
}
-#ifndef HAVE_WOLFSSL
+#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER)
#define OPENSSL_ERROR_LENGTH 512
static int configure_ssl_fips_mode(const uint fips_mode) {
int rc = -1;
@@ -521,7 +521,7 @@ int xcom_init_ssl(const char *server_key_file, const char *server_cert_file,
int verify_server = SSL_VERIFY_NONE;
int verify_client = SSL_VERIFY_NONE;
-#ifndef HAVE_WOLFSSL
+#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER)
if (configure_ssl_fips_mode(ssl_fips_mode) != 1) {
G_ERROR("Error setting the ssl fips mode");
goto error;
diff --git a/plugin/x/client/xconnection_impl.cc b/plugin/x/client/xconnection_impl.cc
index cab1836c34f..4ba28d8fb5f 100644
--- a/plugin/x/client/xconnection_impl.cc
+++ b/plugin/x/client/xconnection_impl.cc
@@ -489,7 +489,7 @@ XError Connection_impl::get_ssl_error(const int error_id) {
return XError(CR_SSL_CONNECTION_ERROR, buffer);
}
-#ifndef HAVE_WOLFSSL
+#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER)
/**
Set fips mode in openssl library,
When we set fips mode ON/STRICT, it will perform following operations:
@@ -539,7 +539,7 @@ XError Connection_impl::activate_tls() {
if (!m_context->m_ssl_config.is_configured())
return XError{CR_SSL_CONNECTION_ERROR, ER_TEXT_TLS_NOT_CONFIGURATED};
-#ifndef HAVE_WOLFSSL
+#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER)
char err_string[OPENSSL_ERROR_LENGTH] = {'\0'};
if (set_fips_mode((int)m_context->m_ssl_config.m_ssl_fips_mode, err_string) !=
1) {
diff --git a/router/src/http/src/tls_client_context.cc b/router/src/http/src/tls_client_context.cc
index f9dff94d837..ae7413b43e9 100644
--- a/router/src/http/src/tls_client_context.cc
+++ b/router/src/http/src/tls_client_context.cc
@@ -54,7 +54,7 @@ void TlsClientContext::verify(TlsVerify verify) {
void TlsClientContext::cipher_suites(const std::string &ciphers) {
// TLSv1.3 ciphers are controlled via SSL_CTX_set_ciphersuites()
-#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 1)
+#ifdef TLS1_3_VERSION
if (1 != SSL_CTX_set_ciphersuites(ssl_ctx_.get(), ciphers.c_str())) {
throw TlsError("set-cipher-suites");
}
diff --git a/router/src/http/src/tls_context.cc b/router/src/http/src/tls_context.cc
index bae36860fea..2cdc31274b6 100644
--- a/router/src/http/src/tls_context.cc
+++ b/router/src/http/src/tls_context.cc
@@ -92,7 +92,7 @@ static constexpr int o11x_version(TlsVersion version) {
return TLS1_1_VERSION;
case TlsVersion::TLS_1_2:
return TLS1_2_VERSION;
-#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 1)
+#ifdef TLS1_3_VERSION
case TlsVersion::TLS_1_3:
return TLS1_3_VERSION;
#endif
@@ -122,9 +122,11 @@ void TlsContext::version_range(TlsVersion min_version, TlsVersion max_version) {
default:
// unknown, leave all disabled
// fallthrough
+#ifdef TLS1_3_VERSION
case TlsVersion::TLS_1_3:
opts |= SSL_OP_NO_TLSv1_2;
// fallthrough
+#endif
case TlsVersion::TLS_1_2:
opts |= SSL_OP_NO_TLSv1_1;
// fallthrough
@@ -171,8 +173,10 @@ TlsVersion TlsContext::min_version() const {
return TlsVersion::TLS_1_1;
case TLS1_2_VERSION:
return TlsVersion::TLS_1_2;
+#ifdef TLS1_3_VERSION
case TLS1_3_VERSION:
return TlsVersion::TLS_1_3;
+#endif
case 0:
return TlsVersion::AUTO;
default:
diff --git a/router/src/http/src/tls_server_context.cc b/router/src/http/src/tls_server_context.cc
index 4f3fa39cd28..ecc9755979b 100644
--- a/router/src/http/src/tls_server_context.cc
+++ b/router/src/http/src/tls_server_context.cc
@@ -162,7 +162,8 @@ void TlsServerContext::init_tmp_dh(const std::string &dh_params) {
}
} else {
-#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 0)
+#if OPENSSL_VERSION_NUMBER >= ROUTER_OPENSSL_VERSION(1, 1, 0) && \
+ !defined(LIBRESSL_VERSION_NUMBER)
dh2048.reset(DH_get_2048_256());
#else
/*
diff --git a/sql-common/client.cc b/sql-common/client.cc
index d6d977970b7..af68f04104d 100644
--- a/sql-common/client.cc
+++ b/sql-common/client.cc
@@ -7515,7 +7515,8 @@ int STDCALL mysql_options(MYSQL *mysql, enum mysql_option option,
#endif
break;
case MYSQL_OPT_SSL_FIPS_MODE: {
-#if defined(HAVE_OPENSSL) && !defined(HAVE_WOLFSSL)
+#if defined(HAVE_OPENSSL) && \
+ !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER)
char ssl_err_string[OPENSSL_ERROR_LENGTH] = {'\0'};
ENSURE_EXTENSIONS_PRESENT(&mysql->options);
mysql->options.extension->ssl_fips_mode = *(uint *)arg;
diff --git a/sql/mysqld.cc b/sql/mysqld.cc
index 13479e3c474..904bae80f8f 100644
--- a/sql/mysqld.cc
+++ b/sql/mysqld.cc
@@ -4640,7 +4640,7 @@ static int init_thread_environment() {
static PSI_memory_key key_memory_openssl = PSI_NOT_INSTRUMENTED;
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
#define FILE_LINE_ARGS
#else
#define FILE_LINE_ARGS , const char *, int
@@ -4676,7 +4676,7 @@ static void init_ssl() {
}
static int init_ssl_communication() {
-#ifndef HAVE_WOLFSSL
+#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER)
char ssl_err_string[OPENSSL_ERROR_LENGTH] = {'\0'};
int ret_fips_mode = set_fips_mode(opt_ssl_fips_mode, ssl_err_string);
if (ret_fips_mode != 1) {
diff --git a/sql/sys_vars.cc b/sql/sys_vars.cc
index b511c453f1e..8952922c1ff 100644
--- a/sql/sys_vars.cc
+++ b/sql/sys_vars.cc
@@ -4282,7 +4282,7 @@ static Sys_var_ulong Sys_max_execution_time(
HINT_UPDATEABLE SESSION_VAR(max_execution_time), CMD_LINE(REQUIRED_ARG),
VALID_RANGE(0, ULONG_MAX), DEFAULT(0), BLOCK_SIZE(1));
-#ifndef HAVE_WOLFSSL
+#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER)
static bool update_fips_mode(sys_var *, THD *, enum_var_type) {
char ssl_err_string[OPENSSL_ERROR_LENGTH] = {'\0'};
if (set_fips_mode(opt_ssl_fips_mode, ssl_err_string) != 1) {
@@ -4295,7 +4295,7 @@ static bool update_fips_mode(sys_var *, THD *, enum_var_type) {
}
#endif
-#ifdef HAVE_WOLFSSL
+#if defined(HAVE_WOLFSSL) || defined(LIBRESSL_VERSION_NUMBER)
static const char *ssl_fips_mode_names[] = {"OFF", 0};
#else
static const char *ssl_fips_mode_names[] = {"OFF", "ON", "STRICT", 0};
@@ -4303,7 +4303,7 @@ static const char *ssl_fips_mode_names[] = {"OFF", "ON", "STRICT", 0};
static Sys_var_enum Sys_ssl_fips_mode(
"ssl_fips_mode",
"SSL FIPS mode (applies only for OpenSSL); "
-#ifndef HAVE_WOLFSSL
+#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER)
"permitted values are: OFF, ON, STRICT",
#else
"permitted values are: OFF",
@@ -4311,7 +4311,7 @@ static Sys_var_enum Sys_ssl_fips_mode(
GLOBAL_VAR(opt_ssl_fips_mode), CMD_LINE(REQUIRED_ARG, OPT_SSL_FIPS_MODE),
ssl_fips_mode_names, DEFAULT(0), NO_MUTEX_GUARD, NOT_IN_BINLOG,
ON_CHECK(NULL),
-#ifndef HAVE_WOLFSSL
+#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER)
ON_UPDATE(update_fips_mode),
#else
ON_UPDATE(NULL),
diff --git a/vio/viossl.cc b/vio/viossl.cc
index 97335eef321..e34b973f59e 100644
--- a/vio/viossl.cc
+++ b/vio/viossl.cc
@@ -507,7 +507,7 @@ static int ssl_do(struct st_VioSSLFd *ptr, Vio *vio, long timeout,
#if !defined(HAVE_WOLFSSL) && !defined(DBUG_OFF)
{
STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;
- ssl_comp_methods = SSL_COMP_get_compression_methods();
+ ssl_comp_methods = (STACK_OF(SSL_COMP) *)SSL_COMP_get_compression_methods();
n = sk_SSL_COMP_num(ssl_comp_methods);
DBUG_PRINT("info", ("Available compression methods:\n"));
if (n == 0)
@@ -515,7 +515,7 @@ static int ssl_do(struct st_VioSSLFd *ptr, Vio *vio, long timeout,
else
for (j = 0; j < n; j++) {
SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j);
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
DBUG_PRINT("info", (" %d: %s\n", c->id, c->name));
#else /* OPENSSL_VERSION_NUMBER < 0x10100000L */
DBUG_PRINT("info",
diff --git a/vio/viosslfactories.cc b/vio/viosslfactories.cc
index 1a88dc3ed1d..a273c9991e7 100644
--- a/vio/viosslfactories.cc
+++ b/vio/viosslfactories.cc
@@ -429,7 +429,7 @@ void ssl_start() {
}
}
-#ifndef HAVE_WOLFSSL
+#if !defined(HAVE_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER)
/**
Set fips mode in openssl library,
When we set fips mode ON/STRICT, it will perform following operations:
--
2.22.0
|
