Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -314,8 +314,8 @@ if(NOT SSLLIB_IS_BORINGSSL
AND NOT SSLLIB_IS_AWSLC
AND OPENSSL_VERSION VERSION_GREATER_EQUAL "3.0.0"
)
set(SSLLIB_IS_OPENSSL3 TRUE)
add_compile_definitions(OPENSSL_API_COMPAT=10002 OPENSSL_IS_OPENSSL3)
set(SSLLIB_IS_AT_LEAST_OPENSSL3 TRUE)
add_compile_definitions(OPENSSL_API_COMPAT=10002 OPENSSL_IS_AT_LEAST_OPENSSL3)
Comment thread
JosiahWI marked this conversation as resolved.
endif()

check_openssl_has_quic_tls_cbs(SSLLIB_HAS_QUIC_TLS_CBS "${OPENSSL_INCLUDE_DIR}")
Expand Down Expand Up @@ -636,7 +636,7 @@ check_symbol_exists(ENGINE_get_default_RSA "openssl/engine.h" HAVE_ENGINE_GET_DE
check_symbol_exists(ENGINE_load_private_key "openssl/engine.h" HAVE_ENGINE_LOAD_PRIVATE_KEY)
check_symbol_exists(sysctlbyname "sys/sysctl.h" HAVE_SYSCTLBYNAME)

if(SSLLIB_IS_OPENSSL3)
if(SSLLIB_IS_AT_LEAST_OPENSSL3)
check_symbol_exists(SSL_CTX_set_tlsext_ticket_key_evp_cb "openssl/ssl.h" TS_HAS_TLS_SESSION_TICKET)
else()
check_symbol_exists(SSL_CTX_set_tlsext_ticket_key_cb "openssl/ssl.h" TS_HAS_TLS_SESSION_TICKET)
Expand Down
2 changes: 1 addition & 1 deletion example/plugins/c-api/verify_cert/verify_cert.cc
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ CB_clientcert(TSCont /* contp */, TSEvent /* event */, void *edata)
TSVConn ssl_vc = reinterpret_cast<TSVConn>(edata);
TSSslConnection sslobj = TSVConnSslConnectionGet(ssl_vc);
SSL *ssl = reinterpret_cast<SSL *>(sslobj);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down
2 changes: 1 addition & 1 deletion include/cripts/Connections.hpp
Original file line number Diff line number Diff line change
Expand Up @@ -365,7 +365,7 @@ class ConnBase
auto conn = Connection();

if (mTLS) {
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
return SSL_get1_peer_certificate(reinterpret_cast<::SSL *>(conn));
#else
return SSL_get_peer_certificate(reinterpret_cast<::SSL *>(conn));
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -252,7 +252,7 @@ TEST_CASE("HMAC Digest: test various supported/unsupported types", "[MAC][access
digests.push_back("ccf3230972bcf229fb3b16741495c74a72bbdd14");
#endif

#ifdef OPENSSL_IS_OPENSSL3 // MD4, RIPEMD160 are deprecated in OpenSSL 3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3 // MD4, RIPEMD160 are deprecated in OpenSSL 3
types.pop_front();
digests.pop_front();
types.pop_back();
Expand Down
2 changes: 1 addition & 1 deletion plugins/experimental/sslheaders/sslheaders.cc
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,7 @@ template <bool IsClient> class WrapX509
void
_set()
{
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
_x509 = (IsClient ? SSL_get1_peer_certificate : SSL_get_certificate)(_ssl);
#else
_x509 = (IsClient ? SSL_get_peer_certificate : SSL_get_certificate)(_ssl);
Expand Down
14 changes: 7 additions & 7 deletions plugins/experimental/wasm/ats_context.cc
Original file line number Diff line number Diff line change
Expand Up @@ -719,7 +719,7 @@ Context::getProperty(std::string_view path, std::string *result)
TSVConn client_conn = TSHttpSsnClientVConnGet(ssnp);
TSSslConnection sslobj = TSVConnSslConnectionGet(client_conn);
SSL *ssl = reinterpret_cast<SSL *>(sslobj);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -787,7 +787,7 @@ Context::getProperty(std::string_view path, std::string *result)
TSVConn client_conn = TSHttpSsnClientVConnGet(ssnp);
TSSslConnection sslobj = TSVConnSslConnectionGet(client_conn);
SSL *ssl = reinterpret_cast<SSL *>(sslobj);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -825,7 +825,7 @@ Context::getProperty(std::string_view path, std::string *result)
TSVConn client_conn = TSHttpSsnClientVConnGet(ssnp);
TSSslConnection sslobj = TSVConnSslConnectionGet(client_conn);
SSL *ssl = reinterpret_cast<SSL *>(sslobj);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -863,7 +863,7 @@ Context::getProperty(std::string_view path, std::string *result)
TSVConn client_conn = TSHttpSsnClientVConnGet(ssnp);
TSSslConnection sslobj = TSVConnSslConnectionGet(client_conn);
SSL *ssl = reinterpret_cast<SSL *>(sslobj);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -952,7 +952,7 @@ Context::getProperty(std::string_view path, std::string *result)
TSVConn client_conn = TSHttpSsnServerVConnGet(ssnp);
TSSslConnection sslobj = TSVConnSslConnectionGet(client_conn);
SSL *ssl = reinterpret_cast<SSL *>(sslobj);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -990,7 +990,7 @@ Context::getProperty(std::string_view path, std::string *result)
TSVConn client_conn = TSHttpSsnServerVConnGet(ssnp);
TSSslConnection sslobj = TSVConnSslConnectionGet(client_conn);
SSL *ssl = reinterpret_cast<SSL *>(sslobj);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -1028,7 +1028,7 @@ Context::getProperty(std::string_view path, std::string *result)
TSVConn client_conn = TSHttpSsnServerVConnGet(ssnp);
TSSslConnection sslobj = TSVConnSslConnectionGet(client_conn);
SSL *ssl = reinterpret_cast<SSL *>(sslobj);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down
24 changes: 12 additions & 12 deletions plugins/lua/ts_lua_client_request.cc
Original file line number Diff line number Diff line change
Expand Up @@ -1299,7 +1299,7 @@ ts_lua_client_request_client_cert_get_pem(lua_State *L)
TSSslConnection ssl_conn = TSVConnSslConnectionGet(client_conn);
if (ssl_conn) {
SSL *ssl = reinterpret_cast<SSL *>(ssl_conn);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -1335,7 +1335,7 @@ ts_lua_client_request_client_cert_get_subject(lua_State *L)
TSSslConnection ssl_conn = TSVConnSslConnectionGet(client_conn);
if (ssl_conn) {
SSL *ssl = reinterpret_cast<SSL *>(ssl_conn);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -1371,7 +1371,7 @@ ts_lua_client_request_client_cert_get_issuer(lua_State *L)
TSSslConnection ssl_conn = TSVConnSslConnectionGet(client_conn);
if (ssl_conn) {
SSL *ssl = reinterpret_cast<SSL *>(ssl_conn);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -1407,7 +1407,7 @@ ts_lua_client_request_client_cert_get_serial(lua_State *L)
TSSslConnection ssl_conn = TSVConnSslConnectionGet(client_conn);
if (ssl_conn) {
SSL *ssl = reinterpret_cast<SSL *>(ssl_conn);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -1443,7 +1443,7 @@ ts_lua_client_request_client_cert_get_signature(lua_State *L)
TSSslConnection ssl_conn = TSVConnSslConnectionGet(client_conn);
if (ssl_conn) {
SSL *ssl = reinterpret_cast<SSL *>(ssl_conn);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -1479,7 +1479,7 @@ ts_lua_client_request_client_cert_get_not_before(lua_State *L)
TSSslConnection ssl_conn = TSVConnSslConnectionGet(client_conn);
if (ssl_conn) {
SSL *ssl = reinterpret_cast<SSL *>(ssl_conn);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -1515,7 +1515,7 @@ ts_lua_client_request_client_cert_get_not_after(lua_State *L)
TSSslConnection ssl_conn = TSVConnSslConnectionGet(client_conn);
if (ssl_conn) {
SSL *ssl = reinterpret_cast<SSL *>(ssl_conn);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -1551,7 +1551,7 @@ ts_lua_client_request_client_cert_get_version(lua_State *L)
TSSslConnection ssl_conn = TSVConnSslConnectionGet(client_conn);
if (ssl_conn) {
SSL *ssl = reinterpret_cast<SSL *>(ssl_conn);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -1585,7 +1585,7 @@ ts_lua_client_request_client_cert_get_san_dns(lua_State *L)
TSSslConnection ssl_conn = TSVConnSslConnectionGet(client_conn);
if (ssl_conn) {
SSL *ssl = reinterpret_cast<SSL *>(ssl_conn);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -1626,7 +1626,7 @@ ts_lua_client_request_client_cert_get_san_ip(lua_State *L)
TSSslConnection ssl_conn = TSVConnSslConnectionGet(client_conn);
if (ssl_conn) {
SSL *ssl = reinterpret_cast<SSL *>(ssl_conn);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -1667,7 +1667,7 @@ ts_lua_client_request_client_cert_get_san_email(lua_State *L)
TSSslConnection ssl_conn = TSVConnSslConnectionGet(client_conn);
if (ssl_conn) {
SSL *ssl = reinterpret_cast<SSL *>(ssl_conn);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -1708,7 +1708,7 @@ ts_lua_client_request_client_cert_get_san_uri(lua_State *L)
TSSslConnection ssl_conn = TSVConnSslConnectionGet(client_conn);
if (ssl_conn) {
SSL *ssl = reinterpret_cast<SSL *>(ssl_conn);
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down
2 changes: 1 addition & 1 deletion src/iocore/net/CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,7 @@ if(BUILD_TESTING)
unit_tests/unit_test_main.cc
unit_tests/benchmark_TLSCertCompression.cc
)
if(SSLLIB_IS_OPENSSL3)
if(SSLLIB_IS_AT_LEAST_OPENSSL3)
target_sources(test_net PRIVATE unit_tests/test_SSLDHParams.cc)
endif()
# Use link groups to solve circular dependency
Expand Down
2 changes: 1 addition & 1 deletion src/iocore/net/P_SSLNetVConnection.h
Original file line number Diff line number Diff line change
Expand Up @@ -258,7 +258,7 @@ class SSLNetVConnection : public UnixNetVConnection,
bool
peer_provided_cert() const override
{
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(this->ssl);
#else
X509 *cert = SSL_get_peer_certificate(this->ssl);
Expand Down
6 changes: 3 additions & 3 deletions src/iocore/net/P_SSLUtils.h
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@
#include "iocore/net/SSLTypes.h"
#include "tscore/Diags.h"

#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
#include <openssl/decoder.h>
#include <openssl/evp.h>
#endif
Expand Down Expand Up @@ -122,7 +122,7 @@ namespace detail
}
};

#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
struct PKEYCTXDeleter {
void
operator()(EVP_PKEY_CTX *pctx)
Expand Down Expand Up @@ -165,7 +165,7 @@ struct ats_wildcard_matcher {
using scoped_X509 = std::unique_ptr<X509, ssl::detail::X509Deleter>;
using scoped_BIO = std::unique_ptr<BIO, ssl::detail::BIODeleter>;
using scoped_PKEY = std::unique_ptr<EVP_PKEY, ssl::detail::PKEYDeleter>;
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
using scoped_PKEY_CTX = std::unique_ptr<EVP_PKEY_CTX, ssl::detail::PKEYCTXDeleter>;
using scoped_Decoder_CTX = std::unique_ptr<OSSL_DECODER_CTX, ssl::detail::DecoderCTXDeleter>;
#endif
2 changes: 1 addition & 1 deletion src/iocore/net/SSLClientUtils.cc
Original file line number Diff line number Diff line change
Expand Up @@ -177,7 +177,7 @@ validate_server_certificate_hostname(NetVConnection *netvc, std::string_view hos
char *matched_name = nullptr;
bool const enforce_mode = netvc->options.verifyServerPolicy == YamlSNIConfig::Policy::ENFORCED;
bool verified = false;
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down
8 changes: 4 additions & 4 deletions src/iocore/net/SSLKeyUtils.cc
Original file line number Diff line number Diff line change
Expand Up @@ -23,13 +23,13 @@
#include "P_SSLUtils.h"

#include <tscore/Diags.h>
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
#include <tscore/ink_assert.h>
#else
#include <tscore/ink_config.h>
#endif

#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
#include <openssl/evp.h>
#include <openssl/decoder.h>
#include <openssl/params.h>
Expand All @@ -41,7 +41,7 @@
#include <openssl/ssl.h>
#endif

#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3

EVP_PKEY *
gen_dh_2048_256_pkey()
Expand Down Expand Up @@ -187,4 +187,4 @@ set_ctx_dh(SSL_CTX *ctx, dh_key_t *pkey)
return result;
}

#endif // OPENSSL_IS_OPENSSL3
#endif // OPENSSL_IS_AT_LEAST_OPENSSL3
4 changes: 2 additions & 2 deletions src/iocore/net/SSLKeyUtils.h
Original file line number Diff line number Diff line change
Expand Up @@ -21,14 +21,14 @@

#pragma once

#if OPENSSL_IS_OPENSSL3
#if OPENSSL_IS_AT_LEAST_OPENSSL3
#include <openssl/evp.h>
#else
#include <openssl/dh.h>
#endif
#include <openssl/ssl.h>

#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
using dh_key_t = EVP_PKEY;
#else
using dh_key_t = DH;
Expand Down
4 changes: 2 additions & 2 deletions src/iocore/net/SSLNetVConnection.cc
Original file line number Diff line number Diff line change
Expand Up @@ -1431,7 +1431,7 @@ SSLNetVConnection::sslServerHandShakeEvent(int &err)
switch (ssl_error) {
case SSL_ERROR_NONE:
if (dbg_ctl_ssl.on()) {
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down Expand Up @@ -1613,7 +1613,7 @@ SSLNetVConnection::sslClientHandShakeEvent(int &err)
switch (ssl_error) {
case SSL_ERROR_NONE:
if (dbg_ctl_ssl.on()) {
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
X509 *cert = SSL_get1_peer_certificate(ssl);
#else
X509 *cert = SSL_get_peer_certificate(ssl);
Expand Down
2 changes: 1 addition & 1 deletion src/iocore/net/SSLUtils.cc
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@
#include <openssl/asn1.h>
#include <openssl/bio.h>
#include <openssl/conf.h>
#ifdef OPENSSL_IS_OPENSSL3
#ifdef OPENSSL_IS_AT_LEAST_OPENSSL3
#include <openssl/evp.h>
#endif
#include <openssl/dh.h>
Expand Down
2 changes: 1 addition & 1 deletion src/tscore/CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,7 @@ set_target_properties(tscore PROPERTIES POSITION_INDEPENDENT_CODE TRUE)

if(SSLLIB_IS_BORINGSSL OR SSLLIB_IS_AWSLC)
target_sources(tscore PRIVATE HKDF_boringssl.cc)
elseif(SSLLIB_IS_OPENSSL3)
elseif(SSLLIB_IS_AT_LEAST_OPENSSL3)
target_sources(tscore PRIVATE HKDF_openssl3.cc)
else()
target_sources(tscore PRIVATE HKDF_openssl.cc)
Expand Down