1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
|
From da1f5aa699f54e0f6977ab64a3bc2f90a51c3104 Mon Sep 17 00:00:00 2001
From: Arjen de Korte <build+lede@de-korte.org>
Date: Mon, 27 Nov 2017 21:10:13 +0100
Subject: [PATCH] Add support for openssl-1.1.0
--- a/clients/upsclient.c
+++ b/clients/upsclient.c
@@ -299,11 +299,6 @@
{
#ifdef WITH_OPENSSL
int ret, ssl_mode = SSL_VERIFY_NONE;
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
- const SSL_METHOD *ssl_method;
-#else
- SSL_METHOD *ssl_method;
-#endif
#elif defined(WITH_NSS) /* WITH_OPENSSL */
SECStatus status;
#endif /* WITH_OPENSSL | WITH_NSS */
@@ -315,22 +310,32 @@
}
#ifdef WITH_OPENSSL
-
- SSL_library_init();
- SSL_load_error_strings();
- ssl_method = TLSv1_client_method();
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ SSL_load_error_strings();
+ SSL_library_init();
- if (!ssl_method) {
- return 0;
- }
+ ssl_ctx = SSL_CTX_new(SSLv23_client_method());
+#else
+ ssl_ctx = SSL_CTX_new(TLS_client_method());
+#endif
- ssl_ctx = SSL_CTX_new(ssl_method);
if (!ssl_ctx) {
upslogx(LOG_ERR, "Can not initialize SSL context");
return -1;
}
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ /* set minimum protocol TLSv1 */
+ SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
+#else
+ ret = SSL_CTX_set_min_proto_version(ssl_ctx, TLS1_VERSION);
+ if (ret != 1) {
+ upslogx(LOG_ERR, "Can not set minimum protocol to TLSv1");
+ return -1;
+ }
+#endif
+
if (!certpath) {
if (certverify == 1) {
upslogx(LOG_ERR, "Can not verify certificate if any is specified");
@@ -737,7 +742,7 @@
switch(res)
{
case 1:
- upsdebugx(3, "SSL connected");
+ upsdebugx(3, "SSL connected (%s)", SSL_get_version(ups->ssl));
break;
case 0:
upslog_with_errno(1, "SSL_connect do not accept handshake.");
--- a/clients/upssched.c
+++ b/clients/upssched.c
@@ -794,7 +794,7 @@
}
if (!strcmp(cmd, "EXECUTE")) {
- if (ca1 == '\0') {
+ if (ca1[0] == '\0') {
upslogx(LOG_ERR, "Empty EXECUTE command argument");
return;
}
--- a/m4/nut_check_libopenssl.m4
+++ b/m4/nut_check_libopenssl.m4
@@ -58,7 +58,7 @@
dnl check if openssl is usable
AC_CHECK_HEADERS(openssl/ssl.h, [nut_have_openssl=yes], [nut_have_openssl=no], [AC_INCLUDES_DEFAULT])
- AC_CHECK_FUNCS(SSL_library_init, [], [nut_have_openssl=no])
+ AC_CHECK_FUNCS(SSL_CTX_new, [], [nut_have_openssl=no])
if test "${nut_have_openssl}" = "yes"; then
nut_with_ssl="yes"
--- a/server/netssl.c
+++ b/server/netssl.c
@@ -274,7 +274,7 @@
{
case 1:
client->ssl_connected = 1;
- upsdebugx(3, "SSL connected");
+ upsdebugx(3, "SSL connected (%s)", SSL_get_version(client->ssl));
break;
case 0:
@@ -370,13 +370,7 @@
{
#ifdef WITH_NSS
SECStatus status;
-#elif defined(WITH_OPENSSL)
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
- const SSL_METHOD *ssl_method;
-#else
- SSL_METHOD *ssl_method;
-#endif
-#endif /* WITH_NSS|WITH_OPENSSL */
+#endif /* WITH_NSS */
if (!certfile) {
return;
@@ -386,18 +380,29 @@
#ifdef WITH_OPENSSL
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
SSL_load_error_strings();
SSL_library_init();
- if ((ssl_method = TLSv1_server_method()) == NULL) {
+ ssl_ctx = SSL_CTX_new(SSLv23_server_method());
+#else
+ ssl_ctx = SSL_CTX_new(TLS_server_method());
+#endif
+
+ if (!ssl_ctx) {
ssl_debug();
- fatalx(EXIT_FAILURE, "TLSv1_server_method failed");
+ fatalx(EXIT_FAILURE, "SSL_CTX_new failed");
}
- if ((ssl_ctx = SSL_CTX_new(ssl_method)) == NULL) {
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ /* set minimum protocol TLSv1 */
+ SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
+#else
+ if (SSL_CTX_set_min_proto_version(ssl_ctx, TLS1_VERSION) != 1) {
ssl_debug();
- fatalx(EXIT_FAILURE, "SSL_CTX_new failed");
+ fatalx(EXIT_FAILURE, "SSL_CTX_set_min_proto_version(TLS1_VERSION)");
}
+#endif
if (SSL_CTX_use_certificate_chain_file(ssl_ctx, certfile) != 1) {
ssl_debug();
|
