OpenSSL v1.1 fixes for v3.0.x #1850

spbnick · 2016-11-18T18:02:30Z

This makes v3.0.x build on Fedora Rawhide and concerns #1817.

I tested the build on Fedora Rawhide, Debian Testing, and RHEL6.8.

I didn't run any tests.

There are still a couple OpenSSL-related warnings on Rawhide, which I'm not yet sure how to deal with:

src/main/threads.c: In function ‘request_handler_thread’:
src/main/threads.c:721:2: warning: ‘ERR_remove_state’ is deprecated [-Wdeprecated-declarations]
  ERR_remove_state(0);
  ^~~~~~~~~~~~~~~~
In file included from /usr/include/openssl/opensslconf.h:42:0,
				 from /usr/include/openssl/md4.h:13,
				 from src/freeradius-devel/md4.h:30,
				 from src/freeradius-devel/libradius.h:96,
				 from src/freeradius-devel/radiusd.h:29,
				 from src/main/threads.c:27:
/usr/include/openssl/err.h:247:1: note: declared here
 DEPRECATEDIN_1_0_0(void ERR_remove_state(unsigned long pid))
 ^
At top level:
src/main/threads.c:239:13: warning: ‘ssl_locking_function’ defined but not used [-Wunused-function]
 static void ssl_locking_function(int mode, int n, UNUSED char const *file, UNUSED int line)
			 ^~~~~~~~~~~~~~~~~~~~
src/main/threads.c:225:22: warning: ‘ssl_id_function’ defined but not used [-Wunused-function]
 static unsigned long ssl_id_function(void)
					  ^~~~~~~~~~~~~~~

src/main/tls.c: In function ‘tls_global_cleanup’:
src/main/tls.c:2525:2: warning: ‘ERR_remove_state’ is deprecated [-Wdeprecated-declarations]
  ERR_remove_state(0);
  ^~~~~~~~~~~~~~~~
In file included from /usr/include/openssl/opensslconf.h:42:0,
				 from /usr/include/openssl/md4.h:13,
				 from src/freeradius-devel/md4.h:30,
				 from src/freeradius-devel/libradius.h:96,
				 from src/freeradius-devel/radiusd.h:29,
				 from src/main/tls.c:28:
/usr/include/openssl/err.h:247:1: note: declared here
 DEPRECATEDIN_1_0_0(void ERR_remove_state(unsigned long pid))
 ^

RHEL6.8 also complained a bit:

src/main/tls.c: In function ‘cbtls_verify’:
src/main/tls.c:2131: warning: cast discards qualifiers from pointer target type
src/main/tls.c:2139: warning: cast discards qualifiers from pointer target type
src/main/tls.c:2143: warning: cast discards qualifiers from pointer target type

The above can be fixed by checking that we're below OpenSSL_0_9_8y, and
removing const from ext_list in cbtls_verify in src/main/tls.c, but I'm not
sure if it's worth it, or maybe I just had enough for today.

Some of the fallback functions I defined in missing-h might not be necessary.

Please tell me what you think and if anything needs changing.

Thank you.

spbnick · 2016-11-18T18:21:30Z

Alright, I see some failures in CI and will try to fix them next week.
It would still be good if you gave me some feedback regardless.

herwinw · 2016-11-20T12:06:26Z

Not directly related to this change, but it looks like both 3.0 and 3.1 compile fine on my Debian Sid system (OpenSSL 1.1.0c-1) now. I'm actually not really sure what caused this

spbnick · 2016-11-21T12:45:25Z

The mentioned warnings are still there (except ones seen on RHEL6), but otherwise it builds fine in CI now.

spbnick · 2016-11-23T09:29:15Z

Alright, now all OpenSSL-related warnings are gone. @alandekok, @arr2036, could you please review? Thank you.

alandekok · 2016-11-23T14:19:56Z

src/modules/rlm_eap/libeap/mppe_keys.c

 	p += SSL3_RANDOM_SIZE;
+#ifdef HAVE_SSL_GET_CLIENT_RANDOM


I'd prefer to just use the local version of SSL_get_server_random() instead of ifdefs. We took a pass through the code to do this, but haven't finished it yet.

Ah, OK, makes sense.

alandekok · 2016-11-23T14:21:40Z

It looks pretty good. I'll take another pass through it later today.

Needed for conditionally avoiding accessing private OpenSSL structures in a following patch. Backported from v3.1.x.

Switch to checking for EVP_CIPHER_CTX_new instead of EVP_cleanup to detect presence of libcrypto, because EVP_cleanup was removed as symbol from OpenSSL 1.1, and the check would always fail.

Apart from dealing with a FIXME, this is needed for implementing compatibility fallbacks for some functions introduced in OpenSSL 1.1, in following commits.

Check for presence of openssl/asn1.h to support definition of fallback functions in later patches.

Check for presence of openssl/conf.h to support definition of fallback functions in later patches.

Add four fallback function implementations to use in place of functions removed/deprecated in OpenSSL 1.1. Those are to be used in the following patches to make the build work and not produce deprecation warnings.

Some more OpenSSL structures were made private in v1.1 and accessor functions were added instead. Switch to using accessor functions to fix the build.

Add the missing mandatory HMAC context initialization to rlm_otp's otp_gen_state. Otherwise the outcome of the following HMAC operations is undefined.

Switch to using HMAC_CTX_new in place of HMAC_CTX_init, which was removed in OpenSSL 1.1, resulting in broken build.

Replace remaining use of HMAC_Init with HMAC_Init_ex to silence deprecation warnings with OpenSSL 1.1.

Switch to using ASN1_STRING_get0_data instead of ASN1_STRING_data, which was deprecated in OpenSSL 1.1 and would produce build warnings.

Switch to using CONF_modules_load_file instead of OPENSSL_config, which was deprecated in OpenSSL 1.1 and would produce build warnings.

Update some declarations to use const to match respective changes in OpenSSL 1.1 and not produce build warnings.

Use appropriate OpenSSL thread cleanup function or don't use any, depending on their deprecation status in various OpenSSL versions.

Check if CRYPTO_set_id_callback and CRYPTO_set_locking_callback are defined as functions (as opposed to stub macros), and if they aren't, don't call them and don't define the corresponding callbacks. This avoids the "unused function" warnings with OpenSSL v1.1.

spbnick · 2016-12-07T12:53:32Z

Alright, I moved SSL_get_client_random, SSL_get_server_random, and SSL_SESSION_get_master_key to missing.c and switched to using them exclusively in mppe_keys.c instead of ifdefs.

spbnick force-pushed the v3.0.x_openssl_1.1_fix branch from 3b97563 to 34f496c Compare November 18, 2016 18:10

spbnick force-pushed the v3.0.x_openssl_1.1_fix branch from 34f496c to 7bf250b Compare November 21, 2016 08:31

spbnick closed this Nov 21, 2016

spbnick force-pushed the v3.0.x_openssl_1.1_fix branch from 7bf250b to bbbde85 Compare November 21, 2016 11:26

spbnick reopened this Nov 21, 2016

spbnick force-pushed the v3.0.x_openssl_1.1_fix branch 2 times, most recently from 44db3d0 to 6979958 Compare November 21, 2016 12:32

spbnick force-pushed the v3.0.x_openssl_1.1_fix branch from 6979958 to ae84424 Compare November 23, 2016 09:19

alandekok reviewed Nov 23, 2016

View reviewed changes

spbnick added 16 commits December 7, 2016 14:03

Fix SSL_get_client/server_random checks

ce91702

Needed for conditionally avoiding accessing private OpenSSL structures in a following patch. Backported from v3.1.x.

Check for EVP_CIPHER_CTX_new to detect libcrypto

6b3a501

Switch to checking for EVP_CIPHER_CTX_new instead of EVP_cleanup to detect presence of libcrypto, because EVP_cleanup was removed as symbol from OpenSSL 1.1, and the check would always fail.

Check for openssl/hmac.h

b2cafe2

Apart from dealing with a FIXME, this is needed for implementing compatibility fallbacks for some functions introduced in OpenSSL 1.1, in following commits.

Check for openssl/asn1.h

f56a8d8

Check for presence of openssl/asn1.h to support definition of fallback functions in later patches.

Check for openssl/conf.h

0b0f4a8

Check for presence of openssl/conf.h to support definition of fallback functions in later patches.

Add a few OpenSSL fallback funcs

d9b75be

Add four fallback function implementations to use in place of functions removed/deprecated in OpenSSL 1.1. Those are to be used in the following patches to make the build work and not produce deprecation warnings.

Move func substitutes from rlm_eap to missing.c

8c4a2b3

Do not try to access private OpenSSL structs

f1e139b

Some more OpenSSL structures were made private in v1.1 and accessor functions were added instead. Switch to using accessor functions to fix the build.

Initialize HMAC context in rlm_otp

e867899

Add the missing mandatory HMAC context initialization to rlm_otp's otp_gen_state. Otherwise the outcome of the following HMAC operations is undefined.

Do not use HMAC_CTX_init

d2b119e

Switch to using HMAC_CTX_new in place of HMAC_CTX_init, which was removed in OpenSSL 1.1, resulting in broken build.

Do not use HMAC_Init

41d68e6

Replace remaining use of HMAC_Init with HMAC_Init_ex to silence deprecation warnings with OpenSSL 1.1.

Do not use ASN1_STRING_data

508f69a

Switch to using ASN1_STRING_get0_data instead of ASN1_STRING_data, which was deprecated in OpenSSL 1.1 and would produce build warnings.

Do not use OPENSSL_config

8d97195

Switch to using CONF_modules_load_file instead of OPENSSL_config, which was deprecated in OpenSSL 1.1 and would produce build warnings.

Accomodate consts added in OpenSSL 1.1

e787e4d

Update some declarations to use const to match respective changes in OpenSSL 1.1 and not produce build warnings.

Handle deprecated OpenSSL thread cleanup functions

1ce9691

Use appropriate OpenSSL thread cleanup function or don't use any, depending on their deprecation status in various OpenSSL versions.

spbnick force-pushed the v3.0.x_openssl_1.1_fix branch from ae84424 to d768705 Compare December 7, 2016 12:52

alandekok merged commit b810473 into FreeRADIUS:v3.0.x Dec 7, 2016

OpenSSL v1.1 fixes for v3.0.x #1850

OpenSSL v1.1 fixes for v3.0.x #1850

spbnick commented Nov 18, 2016

spbnick commented Nov 18, 2016

herwinw commented Nov 20, 2016

spbnick commented Nov 21, 2016

spbnick commented Nov 23, 2016

alandekok Nov 23, 2016

spbnick Nov 23, 2016

alandekok commented Nov 23, 2016

spbnick commented Dec 7, 2016 •

edited

OpenSSL v1.1 fixes for v3.0.x #1850

OpenSSL v1.1 fixes for v3.0.x #1850

Conversation

spbnick commented Nov 18, 2016

spbnick commented Nov 18, 2016

herwinw commented Nov 20, 2016

spbnick commented Nov 21, 2016

spbnick commented Nov 23, 2016

alandekok Nov 23, 2016

Choose a reason for hiding this comment

spbnick Nov 23, 2016

Choose a reason for hiding this comment

alandekok commented Nov 23, 2016

spbnick commented Dec 7, 2016 • edited

spbnick commented Dec 7, 2016 •

edited