Support initializing OpenSSL 1.1

[bdrung]

salt-call fails to run with OpenSSL 1.1:

Traceback (most recent call last):
  File "/usr/bin/salt-call", line 11, in <module>
    salt_call()
  File "/usr/lib/python2.7/dist-packages/salt/scripts.py", line 346, in salt_call
    import salt.cli.call
  File "/usr/lib/python2.7/dist-packages/salt/cli/call.py", line 6, in <module>
    from salt.utils import parsers
  File "/usr/lib/python2.7/dist-packages/salt/utils/parsers.py", line 28, in <module>
    import salt.config as config
  File "/usr/lib/python2.7/dist-packages/salt/config/__init__.py", line 41, in <module>
    import salt.utils.sdb
  File "/usr/lib/python2.7/dist-packages/salt/utils/sdb.py", line 9, in <module>
    import salt.loader
  File "/usr/lib/python2.7/dist-packages/salt/loader.py", line 30, in <module>
    import salt.utils.event
  File "/usr/lib/python2.7/dist-packages/salt/utils/event.py", line 72, in <module>
    import salt.payload
  File "/usr/lib/python2.7/dist-packages/salt/payload.py", line 17, in <module>
    import salt.crypt
  File "/usr/lib/python2.7/dist-packages/salt/crypt.py", line 42, in <module>
    import salt.utils.rsax931
  File "/usr/lib/python2.7/dist-packages/salt/utils/rsax931.py", line 69, in <module>
    libcrypto = _init_libcrypto()
  File "/usr/lib/python2.7/dist-packages/salt/utils/rsax931.py", line 63, in _init_libcrypto
    libcrypto.OPENSSL_no_config()
  File "/usr/lib/python2.7/ctypes/__init__.py", line 375, in __getattr__
    func = self.__getitem__(name)
  File "/usr/lib/python2.7/ctypes/__init__.py", line 380, in __getitem__
    func = self._FuncPtr((name_or_ordinal, self))
AttributeError: /lib/x86_64-linux-gnu/libcrypto.so.1.1: undefined symbol: OPENSSL_no_config

OpenSSL 1.1 replaced the symbols OPENSSL_no_config and OPENSSL_add_all_algorithms_noconf by OPENSSL_init_crypto and added these definitions:

# define OPENSSL_no_config() \
    OPENSSL_init_crypto(OPENSSL_INIT_NO_LOAD_CONFIG, NULL)
#  define OPENSSL_add_all_algorithms_noconf() \
    OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS \
                        | OPENSSL_INIT_ADD_ALL_DIGESTS, NULL)

These definitions can only be used when compiling the source code, but not when loading the symbols dynamically. Thus salt needs to adapt the initialization for OpenSSL 1.1. Try to use OPENSSL_init_crypto (which was introduced in OpenSSL 1.1) and fall back to the previous behavior
for OpenSSL 1.0 and older (when OPENSSL_init_crypto is not found).

You can easily reproduce the issue on Debian unstable by running

apt install salt-master
salt-call

Bug-Debian: https://bugs.debian.org/844503

[tobiasBora]

I confirm that I would need such a pull request, I cannot install stack on all devices running debian unstable for 3 days. Thank you !

[aphor]

+1

Nitpicking:

All this misses is maybe a comment around the OpenSSL 1.1 init calls to make it easy for others to find and update just in case OpenSSL 1.1 initialization API isn't as stable as we think today, and also to help identify the legacy OpenSSL init in case the old OpenSSL gets deprecated for security reasons.

Otherwise I love this.

[rallytime]

@thatch45 and @msteed Can you guys review this change?

[heini]

Seems this didn't make it into 2016.11.0. RC2 was working fine, though.

[heini]

Correction: Just got openssl-1.1 at the same time. RC2 is affected, too.

[cedwards]

Can we get this added to 2016.11.x? @rallytime

[heini]

In fact, it already is. It just hasn't been released, yet.

[rallytime]

Yeah, this has already been merged-forward to 2016.11. It will be available in the 2016.11.1 release.