doesn't compile against latest BoringSSL

[bprodoehl]

A change landed in BoringSSL recently that breaks the libcurl build. I'm seeing these errors with boringssl HEAD and libcurl HEAD:

vtls/openssl.c:1810:9: warning: implicit declaration of function 'SSL_CTX_callback_ctrl' is invalid in C99
      [-Wimplicit-function-declaration]
    if(!SSL_CTX_callback_ctrl(connssl->ctx, SSL_CTRL_SET_MSG_CALLBACK,
        ^
vtls/openssl.c:1810:45: error: use of undeclared identifier 'doesnt_exist'
    if(!SSL_CTX_callback_ctrl(connssl->ctx, SSL_CTRL_SET_MSG_CALLBACK,
                                            ^
/Users/bprodoehl/src/boringssl/include/openssl/ssl.h:2405:35: note: expanded from macro 'SSL_CTRL_SET_MSG_CALLBACK'
#define SSL_CTRL_SET_MSG_CALLBACK doesnt_exist
                                  ^
vtls/openssl.c:1814:41: error: use of undeclared identifier 'doesnt_exist'
    else if(!SSL_CTX_ctrl(connssl->ctx, SSL_CTRL_SET_MSG_CALLBACK_ARG, 0,
                                        ^
/Users/bprodoehl/src/boringssl/include/openssl/ssl.h:2406:39: note: expanded from macro
      'SSL_CTRL_SET_MSG_CALLBACK_ARG'
#define SSL_CTRL_SET_MSG_CALLBACK_ARG doesnt_exist
                                      ^

I believe this is the change responsible for breaking things: https://boringssl.googlesource.com/boringssl/+/59015c365b53a855513aaf5f9ff4597df9157ac0%5E!/

[bprodoehl]

I don't completely understand the changes, but I think the patch looks something like this:

diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
index 16053a7..8febd97 100644
--- a/lib/vtls/openssl.c
+++ b/lib/vtls/openssl.c
@@ -1805,6 +1805,11 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)

 #ifdef SSL_CTRL_SET_MSG_CALLBACK
   if(data->set.fdebug && data->set.verbose) {
+#ifdef HAVE_BORINGSSL
+    connssl->ctx->msg_callback = (void (*)(int, int, int, const void *,
+                                           size_t, SSL *, void *))ssl_tls_trace;
+    SSL_CTX_set_msg_callback_arg(connssl->ctx, conn);
+#else
     /* the SSL trace callback is only used for verbose logging so we only
        inform about failures of setting it */
     if(!SSL_CTX_callback_ctrl(connssl->ctx, SSL_CTRL_SET_MSG_CALLBACK,
@@ -1815,6 +1820,7 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
                           conn)) {
       infof(data, "SSL: couldn't set callback argument!\n");
     }
+#endif
   }
 #endif

Looking through the relevant BoringSSL commits, that seems right, and it gets me building again. I'll have to test more to make sure things actually work with that.

[bagder]

From https://twitter.com/davidben__/status/600652652121325568:

"you should be able to call SSL_CTX_set_msg_callback and SSL_CTX_set_msg_callback_arg in OpenSSL too"

[bprodoehl]

Great, I'll try SSL_CTX_set_msg_callback() instead of setting it directly, and will see if that works against OpenSSL, too.

[bprodoehl]

Here's an updated patch, tested against BoringSSL HEAD and Fedora 21's OpenSSL 1.0.1k.

diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
index 16053a7..2092411 100644
--- a/lib/vtls/openssl.c
+++ b/lib/vtls/openssl.c
@@ -1805,16 +1805,10 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)

 #ifdef SSL_CTRL_SET_MSG_CALLBACK
   if(data->set.fdebug && data->set.verbose) {
-    /* the SSL trace callback is only used for verbose logging so we only
-       inform about failures of setting it */
-    if(!SSL_CTX_callback_ctrl(connssl->ctx, SSL_CTRL_SET_MSG_CALLBACK,
-                               (void (*)(void))ssl_tls_trace)) {
-      infof(data, "SSL: couldn't set callback!\n");
-    }
-    else if(!SSL_CTX_ctrl(connssl->ctx, SSL_CTRL_SET_MSG_CALLBACK_ARG, 0,
-                          conn)) {
-      infof(data, "SSL: couldn't set callback argument!\n");
-    }
+    /* the SSL trace callback is only used for verbose logging */
+    SSL_CTX_set_msg_callback(connssl->ctx, (void (*)(int, int, int, const void *,
+                                           size_t, SSL *, void *))ssl_tls_trace);
+    SSL_CTX_set_msg_callback_arg(connssl->ctx, conn);
   }
 #endif

[bprodoehl]

I can submit an actual PR for this, if you'd like. Just let me know.

[bagder]

Yes please do, makes it slightly easier for me.
Den 19 maj 2015 4:47 em skrev "Brian Prodoehl" notifications@github.com:

I can submit an actual PR for this, if you'd like. Just let me know.

Reply to this email directly or view it on GitHub
#275 (comment).

[bagder]

thanks, fixed merged now