Backwards-compatibility subject to OPENSSL_API_COMPAT (98186eb4) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

CHANGES

+29 −0

Original line number	Diff line number	Diff line
		@@ -4,6 +4,35 @@

		Changes between 1.0.2e and 1.1.0 [xx XXX xxxx]

		*) Revert default OPENSSL_NO_DEPRECATED setting. Instead OpenSSL
		continues to support deprecated interfaces in default builds.
		However, applications are strongly advised to compile their
		source files with -DOPENSSL_API_COMPAT=0x10100000L, which hides
		the declarations of all interfaces deprecated in 0.9.8, 1.0.0
		or the 1.1.0 releases.

		In environments in which all applications have been ported to
		not use any deprecated interfaces OpenSSL's Configure script
		should be used with the --api=1.1.0 option to entirely remove
		support for the deprecated features from the library and
		unconditionally disable them in the installed headers.
		Essentially the same effect can be achieved with the "no-deprecated"
		argument to Configure, except that this will always restrict
		the build to just the latest API, rather than a fixed API
		version.

		As applications are ported to future revisions of the API,
		they should update their compile-time OPENSSL_API_COMPAT define
		accordingly, but in most cases should be able to continue to
		compile with later releases.

		The OPENSSL_API_COMPAT versions for 1.0.0, and 0.9.8 are
		0x10000000L and 0x00908000L, respectively. However those
		versions did not support the OPENSSL_API_COMPAT feature, and
		so applications are not typically tested for explicit support
		of just the undeprecated features of either release.
		[Viktor Dukhovni]

		*) Add support for setting the minimum and maximum supported protocol.
		It can bet set via the SSL_set_min_proto_version() and
		SSL_set_max_proto_version(), or via the SSL_CONF's MinProtocol and

Configure

+41 −8

Original line number	Diff line number	Diff line
		@@ -35,6 +35,9 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [experimenta
		#
		# --cross-compile-prefix Add specified prefix to binutils components.
		#
		# --api One of 0.9.8, 1.0.0 or 1.1.0. Do not compile support for
		# interfaces deprecated as of the specified OpenSSL version.
		#
		# no-hw-xxx do not compile support for specific crypto hardware.
		# Generic OpenSSL-style methods relating to this support
		# are always compiled but return NULL if the hardware
		@@ -137,6 +140,16 @@ my $bits2="SIXTY_FOUR_BIT ";
		# seems to be sufficient?
		my $BSDthreads="-pthread -D_THREAD_SAFE -D_REENTRANT";

		#
		# API compability name to version number mapping.
		#
		my $maxapi = "1.1.0"; # API for "no-deprecated" builds
		my $apitable = {
		"1.1.0" => "0x10100000L",
		"1.0.0" => "0x10000000L",
		"0.9.8" => "0x00908000L",
		};

		# table of known configurations, read in from files
		#
		# The content of each entry can take one of two forms:
		@@ -890,7 +903,6 @@ my @disablables = (
		# All of the following is disabled by default (RC5 was enabled before 0.9.8):

		my %disabled = ( # "what" => "comment" [or special keyword "experimental"]
		"deprecated" => "default",
		"ec_nistp_64_gcc_128" => "default",
		"jpake" => "experimental",
		"md2" => "default",
		@@ -932,6 +944,7 @@ my $openssl_other_defines;
		my $libs;
		my $target;
		my $options;
		my $api;
		my $make_depend=0;
		my %withargs=();
		my $build_prefix = "release_";
		@@ -1086,6 +1099,10 @@ PROCESS_ARGS:
		{
		$prefix=$1;
		}
		elsif (/^--api=(.*)$/)
		{
		$api=$1;
		}
		elsif (/^--libdir=(.*)$/)
		{
		$libdir=$1;
		@@ -1157,6 +1174,10 @@ PROCESS_ARGS:
		}
		}

		if (defined($api) && !exists $apitable->{$api}) {
		die "***** Unsupported api compatibility level: $api\n",
		}

		if (keys %unsupported_options)
		{
		die "***** Unsupported options: ",
		@@ -1542,10 +1563,9 @@ if ($zlib)
		}
		}

		#Build the library with OPENSSL_USE_DEPRECATED if deprecation is not disabled
		if(!defined($disabled{"deprecated"}))
		{
		$cflags = "-DOPENSSL_USE_DEPRECATED $cflags";
		# With "deprecated" disable all deprecated features.
		if (defined($disabled{"deprecated"})) {
		$api = $maxapi;
		}

		# You will find shlib_mark1 and shlib_mark2 explained in Makefile.org
		@@ -1744,7 +1764,7 @@ open(IN,'<include/openssl/opensslv.h') \|\| die "unable to read opensslv.h:$!\n";
		while (<IN>)
		{
		$version=$1 if /OPENSSL.VERSION.TEXT.*OpenSSL (\S+) /;
		$version_num=$1 if /OPENSSL.VERSION.NUMBER.*0x(\S+)/;
		$version_num=$1 if /OPENSSL.VERSION.NUMBER.*(0x\S+)/;
		$shlib_version_number=$1 if /SHLIB_VERSION_NUMBER *"([^"]+)"/;
		$shlib_version_history=$1 if /SHLIB_VERSION_HISTORY "([^"])"/;
		}
		@@ -1763,6 +1783,12 @@ if ($shlib_version_number =~ /(^[0-9])\.([0-9\.])/)
		$shlib_minor=$2;
		}

		if (defined($api)) {
		my $apiflag = sprintf("-DOPENSSL_API_COMPAT=%s", $apitable->{$api});
		$default_depflags .= " $apiflag";
		$cflags .= " $apiflag";
		}

		my $ecc = $cc;
		$ecc = "clang" if `$cc --version 2>&1` =~ /clang/;

		@@ -1991,6 +2017,11 @@ print OUT "#ifdef __cplusplus\n";
		print OUT "extern \"C\" {\n";
		print OUT "#endif\n";
		print OUT "/* OpenSSL was configured with the following options: */\n";

		my $openssl_api_defines = "";
		if (defined($api)) {
		$openssl_api_defines = sprintf "#define OPENSSL_MIN_API %s\n", $apitable->{$api};
		}
		my $openssl_algorithm_defines_trans = $openssl_algorithm_defines;
		$openssl_experimental_defines =~ s/^\s#\sdefine\s+OPENSSL_NO_(.*)/#ifndef OPENSSL_EXPERIMENTAL_$1\n# ifndef OPENSSL_NO_$1\n# define OPENSSL_NO_$1\n# endif\n#endif/mg;
		$openssl_algorithm_defines_trans =~ s/^\s#\sdefine\s+OPENSSL_(.*)/# if defined(OPENSSL_$1) \&\& !defined($1)\n# define $1\n# endif/mg;
		@@ -1999,9 +2030,11 @@ $openssl_algorithm_defines = " /* no ciphers excluded */\n" if $openssl_algori
		$openssl_thread_defines =~ s/^\s#\sdefine\s+(.*)/#ifndef $1\n# define $1\n#endif/mg;
		$openssl_sys_defines =~ s/^\s#\sdefine\s+(.*)/#ifndef $1\n# define $1\n#endif/mg;
		$openssl_other_defines =~ s/^\s#\sdefine\s+(.*)/#ifndef $1\n# define $1\n#endif/mg;

		print OUT $openssl_sys_defines;
		print OUT "#ifndef OPENSSL_DOING_MAKEDEPEND\n\n";
		print OUT $openssl_experimental_defines;
		print OUT $openssl_api_defines;
		print OUT "\n";
		print OUT $openssl_algorithm_defines;
		print OUT "\n#endif /* OPENSSL_DOING_MAKEDEPEND */\n\n";
		@@ -2162,7 +2195,7 @@ EOF
		# create the ms/version32.rc file if needed
		if ($IsMK1MF && ($target !~ /^netware/)) {
		my ($v1, $v2, $v3, $v4);
		if ($version_num =~ /(^[0-9a-f]{1})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})/i) {
		if ($version_num =~ /^0x([0-9a-f]{1})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})L$/i) {
		$v1=hex $1;
		$v2=hex $2;
		$v3=hex $3;

NEWS

+5 −0

Original line number	Diff line number	Diff line
		@@ -23,6 +23,11 @@
		o EC revision: now operations use new EC_KEY_METHOD.
		o Support for OCB mode added to libcrypto
		o Support for asynchronous crypto operations added to libcrypto and libssl
		o Deprecated interfaces can now be disabled at build time either
		relative to the latest relate via the "no-deprecated" Configure
		argument, or via the "--api=1.1.0\|1.0.0\|0.9.8" option.
		o Application software can be compiled with -DOPENSSL_API_COMPAT=version
		to ensure that features deprecated before that version are not exposed.

		Major changes between OpenSSL 1.0.2d and OpenSSL 1.0.2e [3 Dec 2015]

crypto/bn/bn_blind.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -109,6 +109,7 @@
		* [including the GNU Public Licence.]
		*/

		#include <openssl/opensslconf.h>
		#include "internal/cryptlib.h"
		#include "bn_lcl.h"

		@@ -119,7 +120,7 @@ struct bn_blinding_st {
		BIGNUM *Ai;
		BIGNUM *e;
		BIGNUM mod; / just a reference */
		#ifndef OPENSSL_NO_DEPRECATED
		#if OPENSSL_API_COMPAT < 0x10000000L
		unsigned long thread_id; /* added in OpenSSL 0.9.6j and 0.9.7b; used
		* only by crypto/rsa/rsa_eay.c, rsa_lib.c */
		#endif
		@@ -271,7 +272,7 @@ int BN_BLINDING_invert_ex(BIGNUM n, const BIGNUM r, BN_BLINDING *b,
		return (ret);
		}

		#ifndef OPENSSL_NO_DEPRECATED
		#if OPENSSL_API_COMPAT < 0x10000000L
		unsigned long BN_BLINDING_get_thread_id(const BN_BLINDING *b)
		{
		return b->thread_id;

crypto/bn/bn_depr.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -62,11 +62,12 @@
		#include <time.h>
		#include "internal/cryptlib.h"
		#include "bn_lcl.h"
		#include <openssl/opensslconf.h>
		#include <openssl/rand.h>

		static void *dummy = &dummy;

		#ifndef OPENSSL_NO_DEPRECATED
		#if OPENSSL_API_COMPAT < 0x00908000L
		BIGNUM BN_generate_prime(BIGNUM ret, int bits, int safe,
		const BIGNUM add, const BIGNUM rem,
		void (callback) (int, int, void ), void *cb_arg)