Rename OPENSSL_IS_X -> OPENSSL_IS_AT_LEAST_X - #13469
Conversation
This is for consistency since there is now OpenSSL 4, and we need to add a macro definition for OpenSSL 4 as well.
There was a problem hiding this comment.
Pull request overview
This pull request renames OpenSSL 3 detection macros/variables to use an “at least OpenSSL 3” naming scheme, so the build and code paths remain correct when building against newer OpenSSL major versions (e.g., OpenSSL 4).
Changes:
- Rename the CMake variable
SSLLIB_IS_OPENSSL3toSSLLIB_IS_AT_LEAST_OPENSSL3and update CMake conditionals accordingly. - Rename the preprocessor macro
OPENSSL_IS_OPENSSL3toOPENSSL_IS_AT_LEAST_OPENSSL3across core code, plugins, examples, and tests. - Keep OpenSSL-3+ specific code paths (e.g.,
SSL_get1_peer_certificate, decoder APIs) guarded by the updated macro.
Reviewed changes
Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| CMakeLists.txt | Renames the top-level OpenSSL 3+ build flag and the global compile definition macro. |
| src/tscore/CMakeLists.txt | Switches HKDF source selection to the renamed “at least OpenSSL 3” CMake variable. |
| src/iocore/net/CMakeLists.txt | Updates OpenSSL 3+ unit test inclusion guard to the renamed CMake variable. |
| src/iocore/net/SSLUtils.cc | Updates OpenSSL 3+ include guard to the renamed macro. |
| src/iocore/net/SSLNetVConnection.cc | Updates OpenSSL 3+ certificate API selection guard to the renamed macro. |
| src/iocore/net/SSLKeyUtils.h | Updates OpenSSL 3+ DH key type/header selection guard to the renamed macro. |
| src/iocore/net/SSLKeyUtils.cc | Updates OpenSSL 3+ DH generation/decoder implementation guards to the renamed macro. |
| src/iocore/net/SSLClientUtils.cc | Updates OpenSSL 3+ certificate retrieval guard to the renamed macro. |
| src/iocore/net/P_SSLUtils.h | Updates OpenSSL 3+ RAII/deleter type availability guards to the renamed macro. |
| src/iocore/net/P_SSLNetVConnection.h | Updates OpenSSL 3+ certificate retrieval guard to the renamed macro. |
| plugins/lua/ts_lua_client_request.cc | Updates OpenSSL 3+ certificate retrieval guards in Lua plugin bindings. |
| plugins/experimental/wasm/ats_context.cc | Updates OpenSSL 3+ certificate retrieval guards in the wasm experimental plugin. |
| plugins/experimental/sslheaders/sslheaders.cc | Updates OpenSSL 3+ certificate retrieval guards in the sslheaders experimental plugin. |
| plugins/experimental/access_control/unit_tests/test_utils.cc | Updates OpenSSL 3+ deprecation-guarded test logic to the renamed macro. |
| include/cripts/Connections.hpp | Updates OpenSSL 3+ certificate retrieval guard in a public header. |
| example/plugins/c-api/verify_cert/verify_cert.cc | Updates OpenSSL 3+ certificate retrieval guard in the example plugin. |
maskit
left a comment
maskit
left a comment
There was a problem hiding this comment.
I'm fine with this because it's just renaming. My preference is checking function availability rather than relying on version number. Availability flags work better for forks such as AWS-LC.
|
@maskit I agree checking function availability is better in general. I considered that first. But in this case I think we need to rely on both, because the Provider APIs exist already in OpenSSL 3, but I plan to only add support for Providers only for OpenSSL 4 and above. I think that's simpler; otherwise we have to support both the ENGINE and Provider APIs in OpenSSL 3, and that seems messy. |
This is for consistency since there is now OpenSSL 4, and we need to add a macro definition for OpenSSL 4 as well. (cherry picked from commit 80c01c2)
|
Cherry-picked to the 10.2.x branch as 5633e14 for the 10.2.0 release. |
This is for consistency since there is now OpenSSL 4, and we need to add a macro definition for OpenSSL 4 as well.