Skip to content

openssl: remove legacy cruft, document macro guards#18351

Closed
vszakats wants to merge 24 commits intocurl:masterfrom
vszakats:ossltidy
Closed

openssl: remove legacy cruft, document macro guards#18351
vszakats wants to merge 24 commits intocurl:masterfrom
vszakats:ossltidy

Conversation

@vszakats
Copy link
Member

@vszakats vszakats commented Aug 22, 2025

  • assume:

    • BIO_CTRL_EOF
    • SSL_CTRL_SET_MSG_CALLBACK
    • SSL_CTRL_SET_MSG_CALLBACK
    • SSL_CTRL_SET_TLSEXT_HOSTNAME
    • SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER
    • SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
    • SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
    • SSL_OP_NO_COMPRESSION
    • SSL_OP_NO_TICKET
    • X509_V_FLAG_PARTIAL_CHAIN
    • X509_V_FLAG_TRUSTED_FIRST
      They are present in all supported OpenSSL (and fork) versions.
  • replace SSL_ERROR_WANT_EARLY with SSL_ERROR_WANT_CLIENT_HELLO_CB.
    The former appeared in OpenSSL 1.1.1-dev, but renamed before
    the stable release.

  • document support for macros:

    • ENGINE_CTRL_GET_CMD_FROM_NAME
    • SSL_ERROR_WANT_ASYNC_JOB
    • SSL_ERROR_WANT_ASYNC
    • SSL2_VERSION_MAJOR
    • TLS1_3_VERSION
  • drop legacy fallback for CONF_MFLAGS_DEFAULT_SECTION.
    It was there for OpenSSL 0.9.8 support.

  • fix SSL_CTRL_SET_MSG_CALLBACK accidentally serving as a guard for
    OpenSSL (and forks) as a whole.

Tested OK with OpenSSL 1.0.2 and 1.1.0 in CI.


TODO:

@github-actions github-actions bot added the CI Continuous Integration label Aug 22, 2025
@vszakats vszakats changed the title openssl: remove legacy cruft, document some guards openssl: remove legacy cruft, document guards Aug 22, 2025
@vszakats vszakats marked this pull request as draft August 22, 2025 11:21
@vszakats vszakats marked this pull request as ready for review August 22, 2025 12:19
@vszakats vszakats changed the title openssl: remove legacy cruft, document guards openssl: remove legacy cruft, document macro guards Aug 22, 2025
@vszakats vszakats closed this in 80c10c5 Aug 22, 2025
@vszakats vszakats deleted the ossltidy branch August 22, 2025 13:54
vszakats added a commit that referenced this pull request Aug 22, 2025
- drop `ALLOW_RENEG` undocumented (insecure) build-time option.
- drop unnecessary check for `OPENSSL_VERSION_NUMBER`.
  It's present in all supported OpenSSL versions and forks.

Follow-up to 80c10c5 #18351
Follow-up to 59311bd #3293 #3283

Closes #18359
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CI Continuous Integration tidy-up TLS

Development

Successfully merging this pull request may close these issues.

1 participant