Require OpenSSL 1.1.0 or later.

This gets rid of some backwards compatibility code, and avoids calling
deprecated OpenSSL functions.

diff --git a/README b/README
index 127cde2e78758d1d61223c63fd580777db815578..2f7856132b0fa1f87d065623a9a8ed9b80e6b0c6 100644 (file)
--- a/README
+++ b/README
@@ -69,7 +69,7 @@ Requirements
 ------------
 
 The OpenSSL library is used for all cryptographic functions. You can find it at
-https://www.openssl.org/. You will need version 1.0.1 or later with support for
+https://www.openssl.org/. You will need version 1.1.0 or later with support for
 AES256 and SHA256 enabled. If this library is not installed on your system, the
 configure script will fail.  The manual in doc/tinc.texi contains more detailed
 information on how to install this library. Alternatively, you may also use the

diff --git a/m4/openssl.m4 b/m4/openssl.m4
index 895c31aa0d09ff374a27274f8f7aabfe8b3046de..99023c2493058a2881f320a522741066d3293a0d 100644 (file)
--- a/m4/openssl.m4
+++ b/m4/openssl.m4
@@ -35,24 +35,15 @@ AC_DEFUN([tinc_OPENSSL],
      LDFLAGS="$LDFLAGS -L$withval"]
   )
 
-  AC_CHECK_HEADERS(openssl/evp.h openssl/rsa.h openssl/rand.h openssl/err.h openssl/sha.h openssl/pem.h openssl/engine.h,
+  AC_CHECK_HEADERS([openssl/evp.h openssl/rsa.h openssl/rand.h openssl/err.h openssl/sha.h openssl/pem.h openssl/engine.h],
     [],
     [AC_MSG_ERROR([LibreSSL/OpenSSL header files not found.]); break]
   )
 
-  AC_CHECK_LIB(crypto, EVP_EncryptInit_ex,
+  AC_CHECK_LIB(crypto, OPENSSL_init_crypto,
     [LIBS="-lcrypto $LIBS"],
     [AC_MSG_ERROR([LibreSSL/OpenSSL libraries not found.])]
   )
 
-  AC_CHECK_FUNCS([RAND_bytes EVP_EncryptInit_ex EVP_CIPHER_CTX_new], ,
-    [AC_MSG_ERROR([Missing LibreSSL/OpenSSL functionality, make sure you have installed the latest version.]); break],
-  )
-
-  AC_CHECK_DECLS([OpenSSL_add_all_algorithms, EVP_aes_256_cfb], ,
-    [AC_MSG_ERROR([Missing LibreSSL/OpenSSL functionality, make sure you have installed the latest version.]); break],
-    [#include <openssl/evp.h>]
-  )
-
-  AC_CHECK_FUNCS([BN_GENCB_new RSA_set0_key], , , [#include <openssl/rsa.h>])
+  AC_DEFINE(HAVE_OPENSSL, 1, [enable OpenSSL support])
 ])

diff --git a/src/connection.h b/src/connection.h
index d619e85cf64f7dcabd973e4578939eb315f256b2..629e16b9cc1bc555db64ce91a2abede82865f24c 100644 (file)
--- a/src/connection.h
+++ b/src/connection.h
@@ -24,10 +24,6 @@
 #include <openssl/rsa.h>
 #include <openssl/evp.h>
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-#define EVP_CIPHER_CTX_reset(c) EVP_CIPHER_CTX_cleanup(c)
-#endif
-
 #include "avl_tree.h"
 
 #define OPTION_INDIRECT         0x0001

diff --git a/src/net_setup.c b/src/net_setup.c
index f26007bda07ff27d248f98166f0133fce2a2e8e3..501fecd385770ada23842b4de74966157b1e4977 100644 (file)
--- a/src/net_setup.c
+++ b/src/net_setup.c
@@ -49,18 +49,6 @@
 char *myport;
 devops_t devops;
 
-#ifndef HAVE_RSA_SET0_KEY
-int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d) {
-       BN_free(r->n);
-       r->n = n;
-       BN_free(r->e);
-       r->e = e;
-       BN_free(r->d);
-       r->d = d;
-       return 1;
-}
-#endif
-
 bool read_rsa_public_key(connection_t *c) {
        FILE *fp;
        char *pubname;

diff --git a/src/tincd.c b/src/tincd.c
index 066ad9c83cdb3842596ab4f0accc043816da52fb..c1f2e5a2b16d93deeb032885d18d36573c0687d7 100644 (file)
--- a/src/tincd.c
+++ b/src/tincd.c
@@ -37,9 +37,7 @@
 #include <openssl/rsa.h>
 #include <openssl/pem.h>
 #include <openssl/evp.h>
-#ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
-#endif
 #include <openssl/bn.h>
 
 #ifdef HAVE_LZO
@@ -404,16 +402,6 @@ static int indicator(int a, int b, BN_GENCB *cb) {
        return 1;
 }
 
-#ifndef HAVE_BN_GENCB_NEW
-BN_GENCB *BN_GENCB_new(void) {
-       return xmalloc_and_zero(sizeof(BN_GENCB));
-}
-
-void BN_GENCB_free(BN_GENCB *cb) {
-       free(cb);
-}
-#endif
-
 /*
   Generate a public/private RSA keypair, and ask for a file to store
   them in.
@@ -688,14 +676,7 @@ int main(int argc, char **argv) {
 
        init_configuration(&config_tree);
 
-#ifndef OPENSSL_NO_ENGINE
        ENGINE_load_builtin_engines();
-       ENGINE_register_all_complete();
-#endif
-
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-       OpenSSL_add_all_algorithms();
-#endif
 
        if(generate_keys) {
                read_server_config();
@@ -814,14 +795,6 @@ end:
 
        free(priority);
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-       EVP_cleanup();
-       ERR_free_strings();
-#ifndef OPENSSL_NO_ENGINE
-       ENGINE_cleanup();
-#endif
-#endif
-
        exit_configuration(&config_tree);
        list_delete_list(cmdline_conf);
        free_names();