Changeset 5797 for pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c

Timestamp:

May 29, 2018 3:07:05 AM (6 years ago)

Author:

riza

Message:

Re #2059 (misc):

• Fix warning when using LibreSSL.
• Fix error build when using OpenSSL with './config no-dh' option.
• Fix error build when using OpenSSL with './config no-deprecated' option.
• Modification to r5787.

Thanks to Alexander Traud for the patch.

File:

• pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c (modified) (8 diffs)

pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c

@@ -54 +54 @@
 #include <openssl/err.h>
 #include <openssl/x509v3.h>
+#if !defined(OPENSSL_NO_DH)
+#   include <openssl/dh.h>
+#endif
+
 #include <openssl/rand.h>
 #include <openssl/opensslconf.h>
 #include <openssl/opensslv.h>
 
-#define USING_LIBRESSL (defined(LIBRESSL_VERSION_NUMBER))
+#if defined(LIBRESSL_VERSION_NUMBER)
+#       define USING_LIBRESSL 1
+#else
+#       define USING_LIBRESSL 0
+#endif
 
 #if !USING_LIBRESSL && !defined(OPENSSL_NO_EC) \
@@ -778 +786 @@
 static pj_status_t create_ssl(pj_ssl_sock_t *ssock)
 {
+#if !defined(OPENSSL_NO_DH)
     BIO *bio;
     DH *dh;
     long options;
-#if !defined(OPENSSL_NO_ECDH) && OPENSSL_VERSION_NUMBER >= 0x10000000L
-    EC_KEY *ecdh;
 #endif
     SSL_METHOD *ssl_method = NULL;
@@ -934 +941 @@
             }
 
+#if !defined(OPENSSL_NO_DH)
             if (ssock->is_server) {
                 bio = BIO_new_file(cert->privkey_file.ptr, "r");
@@ -954 +962 @@
                 }
             }
+#endif
         }
     }
@@ -1001 +1010 @@
         }
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
     #ifndef SSL_CTRL_SET_ECDH_AUTO
         #define SSL_CTRL_SET_ECDH_AUTO 94
@@ -1010 +1018 @@
             PJ_LOG(4,(ssock->pool->obj_name, "SSL ECDH initialized "
                       "(automatic), faster PFS ciphers enabled"));
-    #if !defined(OPENSSL_NO_ECDH) && OPENSSL_VERSION_NUMBER >= 0x10000000L
+    #if !defined(OPENSSL_NO_ECDH) && OPENSSL_VERSION_NUMBER >= 0x10000000L && \
+        OPENSSL_VERSION_NUMBER < 0x10100000L
         } else {
             /* enables AES-128 ciphers, to get AES-256 use NID_secp384r1 */
-            ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+            EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
             if (ecdh != NULL) {
                 if (SSL_CTX_set_tmp_ecdh(ctx, ecdh)) {
@@ -1023 +1032 @@
     #endif
         }
-#else // OPENSSL_VERSION_NUMBER < 0x10100000L
-    PJ_LOG(4,(ssock->pool->obj_name, "SSL ECDH already initialized "
-              "(OpenSSL 1.1.0+), faster PFS cipher-suites enabled"));
-#endif // OPENSSL_VERSION_NUMBER < 0x10100000L
     } else {
         X509_STORE *pkix_validation_store = SSL_CTX_get_cert_store(ctx);
@@ -2711 +2716 @@
 
     for (i = 0; i < openssl_curves_num; ++i) {
-        if (!pj_ansi_stricmp(openssl_curves[i].name, curve_name))
+        if (openssl_curves[i].name &&
+                !pj_ansi_stricmp(openssl_curves[i].name, curve_name))
+        {
             return openssl_curves[i].id;
+        }
     }