From 0591829ab2c8844ba40a3bac3b7e0f5479da14fe Mon Sep 17 00:00:00 2001 From: Amos Jeffries Date: Thu, 23 Jul 2020 17:38:26 +1200 Subject: [PATCH 01/37] Update license disclaimer OpenSSL 3.0 uses Apache License v2 which removes the SSLeay distribution restrictions. --- src/main.cc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/main.cc b/src/main.cc index 99bad6ea740..c1e665232f5 100644 --- a/src/main.cc +++ b/src/main.cc @@ -671,7 +671,9 @@ mainHandleCommandLineOption(const int optId, const char *optValue) printf("%s\n",SQUID_BUILD_INFO); #if USE_OPENSSL printf("\nThis binary uses %s. ", OpenSSL_version(OPENSSL_VERSION)); +#if OPENSSL_VERSION_MAJOR < 3 printf("For legal restrictions on distribution see https://www.openssl.org/source/license.html\n\n"); +#endif #endif printf( "configure options: %s\n", SQUID_CONFIGURE_OPTIONS); From 4dd37f3c48360af5d4bb692cf39bf229456354d6 Mon Sep 17 00:00:00 2001 From: Amos Jeffries Date: Thu, 23 Jul 2020 18:51:20 +1200 Subject: [PATCH 02/37] Declaration of CRYPTO_EX_dup changed again in 3.0 --- src/ssl/support.cc | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/ssl/support.cc b/src/ssl/support.cc index 99c4087b688..a164526a749 100644 --- a/src/ssl/support.cc +++ b/src/ssl/support.cc @@ -556,7 +556,11 @@ Ssl::VerifyCallbackParameters::At(Security::Connection &sconn) } // "dup" function for SSL_get_ex_new_index("cert_err_check") -#if SQUID_USE_CONST_CRYPTO_EX_DATA_DUP +#if OPENSSL_VERSION_MAJOR >= 3 +static int +ssl_dupAclChecklist(CRYPTO_EX_DATA *, const CRYPTO_EX_DATA *, void **, + int, long, void *) +#elif SQUID_USE_CONST_CRYPTO_EX_DATA_DUP static int ssl_dupAclChecklist(CRYPTO_EX_DATA *, const CRYPTO_EX_DATA *, void *, int, long, void *) From 5564eb40937031e822012c62bdaa5d487c5eb87d Mon Sep 17 00:00:00 2001 From: Amos Jeffries Date: Sun, 10 Oct 2021 02:35:10 +1300 Subject: [PATCH 03/37] SSL_OP_* macro definitions changed in 3.0 --- src/security/PeerOptions.cc | 50 ++++++++++++++++++------------------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/src/security/PeerOptions.cc b/src/security/PeerOptions.cc index 95e5a2eddc4..8538f2c15c4 100644 --- a/src/security/PeerOptions.cc +++ b/src/security/PeerOptions.cc @@ -297,130 +297,130 @@ static struct ssl_option { } ssl_options[] = { -#if SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG +#if defined(SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) { "NETSCAPE_REUSE_CIPHER_CHANGE_BUG", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG }, #endif -#if SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG +#if defined(SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG) { "SSLREF2_REUSE_CERT_TYPE_BUG", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG }, #endif -#if SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER +#if defined(SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER) { "MICROSOFT_BIG_SSLV3_BUFFER", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER }, #endif -#if SSL_OP_SSLEAY_080_CLIENT_DH_BUG +#if defined(SSL_OP_SSLEAY_080_CLIENT_DH_BUG) { "SSLEAY_080_CLIENT_DH_BUG", SSL_OP_SSLEAY_080_CLIENT_DH_BUG }, #endif -#if SSL_OP_TLS_D5_BUG +#if defined(SSL_OP_TLS_D5_BUG) { "TLS_D5_BUG", SSL_OP_TLS_D5_BUG }, #endif -#if SSL_OP_TLS_BLOCK_PADDING_BUG +#if defined(SSL_OP_TLS_BLOCK_PADDING_BUG) { "TLS_BLOCK_PADDING_BUG", SSL_OP_TLS_BLOCK_PADDING_BUG }, #endif -#if SSL_OP_TLS_ROLLBACK_BUG +#if defined(SSL_OP_TLS_ROLLBACK_BUG) { "TLS_ROLLBACK_BUG", SSL_OP_TLS_ROLLBACK_BUG }, #endif -#if SSL_OP_ALL +#if defined(SSL_OP_ALL) { "ALL", (long)SSL_OP_ALL }, #endif -#if SSL_OP_SINGLE_DH_USE +#if defined(SSL_OP_SINGLE_DH_USE) { "SINGLE_DH_USE", SSL_OP_SINGLE_DH_USE }, #endif -#if SSL_OP_EPHEMERAL_RSA +#if defined(SSL_OP_EPHEMERAL_RSA) { "EPHEMERAL_RSA", SSL_OP_EPHEMERAL_RSA }, #endif -#if SSL_OP_PKCS1_CHECK_1 +#if defined(SSL_OP_PKCS1_CHECK_1) { "PKCS1_CHECK_1", SSL_OP_PKCS1_CHECK_1 }, #endif -#if SSL_OP_PKCS1_CHECK_2 +#if defined(SSL_OP_PKCS1_CHECK_2) { "PKCS1_CHECK_2", SSL_OP_PKCS1_CHECK_2 }, #endif -#if SSL_OP_NETSCAPE_CA_DN_BUG +#if defined(SSL_OP_NETSCAPE_CA_DN_BUG) { "NETSCAPE_CA_DN_BUG", SSL_OP_NETSCAPE_CA_DN_BUG }, #endif -#if SSL_OP_NON_EXPORT_FIRST +#if defined(SSL_OP_NON_EXPORT_FIRST) { "NON_EXPORT_FIRST", SSL_OP_NON_EXPORT_FIRST }, #endif -#if SSL_OP_CIPHER_SERVER_PREFERENCE +#if defined(SSL_OP_CIPHER_SERVER_PREFERENCE) { "CIPHER_SERVER_PREFERENCE", SSL_OP_CIPHER_SERVER_PREFERENCE }, #endif -#if SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG +#if defined(SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG) { "NETSCAPE_DEMO_CIPHER_CHANGE_BUG", SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG }, #endif -#if SSL_OP_NO_SSLv3 +#if defined(SSL_OP_NO_SSLv3) { "NO_SSLv3", SSL_OP_NO_SSLv3 }, #endif -#if SSL_OP_NO_TLSv1 +#if defined(SSL_OP_NO_TLSv1) { "NO_TLSv1", SSL_OP_NO_TLSv1 }, #else { "NO_TLSv1", 0 }, #endif -#if SSL_OP_NO_TLSv1_1 +#if defined(SSL_OP_NO_TLSv1_1) { "NO_TLSv1_1", SSL_OP_NO_TLSv1_1 }, #else { "NO_TLSv1_1", 0 }, #endif -#if SSL_OP_NO_TLSv1_2 +#if defined(SSL_OP_NO_TLSv1_2) { "NO_TLSv1_2", SSL_OP_NO_TLSv1_2 }, #else { "NO_TLSv1_2", 0 }, #endif -#if SSL_OP_NO_TLSv1_3 +#if defined(SSL_OP_NO_TLSv1_3) { "NO_TLSv1_3", SSL_OP_NO_TLSv1_3 }, #else { "NO_TLSv1_3", 0 }, #endif -#if SSL_OP_NO_COMPRESSION +#if defined(SSL_OP_NO_COMPRESSION) { "No_Compression", SSL_OP_NO_COMPRESSION }, #endif -#if SSL_OP_NO_TICKET +#if defined(SSL_OP_NO_TICKET) { "NO_TICKET", SSL_OP_NO_TICKET }, #endif -#if SSL_OP_SINGLE_ECDH_USE +#if defined(SSL_OP_SINGLE_ECDH_USE) { "SINGLE_ECDH_USE", SSL_OP_SINGLE_ECDH_USE }, @@ -512,7 +512,7 @@ Security::PeerOptions::parseOptions() } -#if SSL_OP_NO_SSLv2 +#if defined(SSL_OP_NO_SSLv2) // compliance with RFC 6176: Prohibiting Secure Sockets Layer (SSL) Version 2.0 op = op | SSL_OP_NO_SSLv2; #endif From b787e70640c855f1ae86d0a247e4d84d3e7b0ef8 Mon Sep 17 00:00:00 2001 From: Amos Jeffries Date: Thu, 23 Jul 2020 21:02:36 +1200 Subject: [PATCH 04/37] Refactor Ssl::createSslPrivateKey() * Use the OpenSSL 1.1+ EVP API for generating RSA keys. * Make static since this is only used by the gadgets.cc code. --- src/ssl/gadgets.cc | 35 ++++++++++++++++------------------- src/ssl/gadgets.h | 8 +------- 2 files changed, 17 insertions(+), 26 deletions(-) diff --git a/src/ssl/gadgets.cc b/src/ssl/gadgets.cc index 4eff48bf7d2..d9616a04891 100644 --- a/src/ssl/gadgets.cc +++ b/src/ssl/gadgets.cc @@ -48,33 +48,26 @@ ThrowErrors(const char * const problem, const int savedErrno, const SourceLocati where); } -EVP_PKEY * Ssl::createSslPrivateKey() +static EVP_PKEY * +CreateRsaPrivateKey() { - Security::PrivateKeyPointer pkey(EVP_PKEY_new()); - - if (!pkey) - return nullptr; - - BIGNUM_Pointer bn(BN_new()); - if (!bn) - return nullptr; - - if (!BN_set_word(bn.get(), RSA_F4)) + Ssl::EVP_PKEY_CTX_Pointer rsa(EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, nullptr)); + if (!rsa) return nullptr; - Ssl::RSA_Pointer rsa(RSA_new()); - if (!rsa) + if (EVP_PKEY_keygen_init(rsa.get()) <= 0) return nullptr; int num = 2048; // Maybe use 4096 RSA keys, or better make it configurable? - if (!RSA_generate_key_ex(rsa.get(), num, bn.get(), nullptr)) + if (EVP_PKEY_CTX_set_rsa_keygen_bits(rsa.get(), num) <= 0) return nullptr; - if (!EVP_PKEY_assign_RSA(pkey.get(), (rsa.get()))) + /* Generate key */ + EVP_PKEY *pkey = nullptr; + if (EVP_PKEY_keygen(rsa.get(), &pkey) <= 0) return nullptr; - rsa.release(); - return pkey.release(); + return pkey; } /** @@ -421,7 +414,11 @@ mimicExtensions(Security::CertPointer & cert, Security::CertPointer const &mimic // XXX: Add PublicKeyPointer. In OpenSSL, public and private keys are // internally represented by EVP_PKEY pair, but GnuTLS uses distinct types. const Security::PrivateKeyPointer certKey(X509_get_pubkey(mimicCert.get())); - const auto rsaPkey = EVP_PKEY_get0_RSA(certKey.get()) != nullptr; +#if OPENSSL_VERSION_MAJOR < 3 + const auto rsaPkey = bool(EVP_PKEY_get0_RSA(certKey.get())); +#else + const auto rsaPkey = EVP_PKEY_is_a(certKey.get(), "RSA"); +#endif int added = 0; int nid; @@ -595,7 +592,7 @@ static bool generateFakeSslCertificate(Security::CertPointer & certToStore, Secu if (properties.signWithPkey.get()) pkey.resetAndLock(properties.signWithPkey.get()); else // if not exist generate one - pkey.resetWithoutLocking(Ssl::createSslPrivateKey()); + pkey.resetWithoutLocking(CreateRsaPrivateKey()); if (!pkey) return false; diff --git a/src/ssl/gadgets.h b/src/ssl/gadgets.h index df45f5d3d0d..7dab85ab76d 100644 --- a/src/ssl/gadgets.h +++ b/src/ssl/gadgets.h @@ -58,7 +58,7 @@ typedef std::unique_ptr> TXT_DB_Poi typedef std::unique_ptr> X509_NAME_Pointer; -typedef std::unique_ptr> RSA_Pointer; +typedef std::unique_ptr> EVP_PKEY_CTX_Pointer; typedef std::unique_ptr> X509_REQ_Pointer; @@ -86,12 +86,6 @@ void ForgetErrors(); /// Also clears all reported errors. std::ostream &ReportAndForgetErrors(std::ostream &); -/** - \ingroup SslCrtdSslAPI - * Create 1024 bits rsa key. - */ -EVP_PKEY * createSslPrivateKey(); - /** \ingroup SslCrtdSslAPI * Write private key and SSL certificate to memory. From e290d6c046adae5ecf96e2c6617ac4e5df64cfdc Mon Sep 17 00:00:00 2001 From: Amos Jeffries Date: Wed, 6 Oct 2021 21:55:38 +1300 Subject: [PATCH 05/37] Switch to BN_rand() BN_pseudo_rand() has been identical since libssl 1.1.0 and is removed in libssl 3.0 --- src/cf.data.pre | 2 ++ src/ssl/gadgets.cc | 2 +- src/ssl/support.cc | 5 ++--- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/src/cf.data.pre b/src/cf.data.pre index 493fb7cbeff..034c8074f02 100644 --- a/src/cf.data.pre +++ b/src/cf.data.pre @@ -3061,6 +3061,8 @@ DEFAULT: none DOC_START The OpenSSL engine to use. You will need to set this if you would like to use hardware SSL acceleration for example. + + Note: OpenSSL 3.0 and newer do not provide Engine support. DOC_END NAME: sslproxy_session_ttl diff --git a/src/ssl/gadgets.cc b/src/ssl/gadgets.cc index d9616a04891..3aec4e58837 100644 --- a/src/ssl/gadgets.cc +++ b/src/ssl/gadgets.cc @@ -85,7 +85,7 @@ static bool setSerialNumber(ASN1_INTEGER *ai, BIGNUM const* serial) if (!bn) return false; - if (!BN_pseudo_rand(bn.get(), 64, 0, 0)) + if (!BN_rand(bn.get(), 64, 0, 0)) return false; } diff --git a/src/ssl/support.cc b/src/ssl/support.cc index a164526a749..59446359129 100644 --- a/src/ssl/support.cc +++ b/src/ssl/support.cc @@ -657,8 +657,8 @@ Ssl::Initialize(void) SQUID_OPENSSL_init_ssl(); -#if !defined(OPENSSL_NO_ENGINE) if (::Config.SSL.ssl_engine) { +#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_VERSION_MAJOR < 3 ENGINE_load_builtin_engines(); ENGINE *e; if (!(e = ENGINE_by_id(::Config.SSL.ssl_engine))) @@ -668,11 +668,10 @@ Ssl::Initialize(void) const auto ssl_error = ERR_get_error(); fatalf("Failed to initialise SSL engine: %s\n", Security::ErrorString(ssl_error)); } - } #else - if (::Config.SSL.ssl_engine) fatalf("Your OpenSSL has no SSL engine support\n"); #endif + } const char *defName = ::Config.SSL.certSignHash ? ::Config.SSL.certSignHash : SQUID_SSL_SIGN_HASH_IF_NONE; Ssl::DefaultSignHash = EVP_get_digestbyname(defName); From b98cd0f79ae6b0ceb28abc395a00bf16904a5605 Mon Sep 17 00:00:00 2001 From: Amos Jeffries Date: Thu, 23 Jul 2020 18:08:15 +1200 Subject: [PATCH 06/37] TODO Upgrade API calls verifying loaded DH params file --- src/security/ServerOptions.cc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/security/ServerOptions.cc b/src/security/ServerOptions.cc index 5cf0c6e13f0..5a2a1e93fb3 100644 --- a/src/security/ServerOptions.cc +++ b/src/security/ServerOptions.cc @@ -364,6 +364,10 @@ Security::ServerOptions::loadDhParams() return; } +#if OPENSSL_VERSION_MAJOR < 3 + // DH_check() removed in OpenSSL 3.0. + // TODO: use the EVP API instead, which also works in OpenSSL 1.1. + // But it is not yet clear exactly how that API works for DH. int codes; if (DH_check(dhp, &codes) == 0) { if (codes) { @@ -372,6 +376,7 @@ Security::ServerOptions::loadDhParams() dhp = nullptr; } } +#endif parsedDhParams.resetWithoutLocking(dhp); #endif From 34d6c44ad0904d69f96a06e48010900bf450d998 Mon Sep 17 00:00:00 2001 From: Amos Jeffries Date: Wed, 6 Oct 2021 21:12:25 +1300 Subject: [PATCH 07/37] Initial DH conversion to EVP_PKEY 3.0 build does not yet complete due to ENGINE and BIGNUM deprecation issues. This conversion relies on OSSL_*() functions added in 3.0. So the old DH loading code is left unchanged. --- configure.ac | 1 + src/security/ServerOptions.cc | 30 +++++++++++++++++++++++++++--- src/security/forward.h | 24 +++++++++++++++--------- 3 files changed, 43 insertions(+), 12 deletions(-) diff --git a/configure.ac b/configure.ac index d3f8f21d852..2d65559ea93 100644 --- a/configure.ac +++ b/configure.ac @@ -1283,6 +1283,7 @@ if test "x$with_openssl" = "xyes"; then openssl/bio.h \ openssl/bn.h \ openssl/crypto.h \ + openssl/decoder.h \ openssl/dh.h \ openssl/err.h \ openssl/evp.h \ diff --git a/src/security/ServerOptions.cc b/src/security/ServerOptions.cc index 5a2a1e93fb3..4a4f1847cde 100644 --- a/src/security/ServerOptions.cc +++ b/src/security/ServerOptions.cc @@ -19,6 +19,9 @@ #include "compat/openssl.h" #include "ssl/support.h" +#if HAVE_OPENSSL_DECODER_H +#include +#endif #if HAVE_OPENSSL_ERR_H #include #endif @@ -353,6 +356,7 @@ Security::ServerOptions::loadDhParams() return; #if USE_OPENSSL +#if OPENSSL_VERSION_MAJOR < 3 DH *dhp = nullptr; if (FILE *in = fopen(dhParamsFile.c_str(), "r")) { dhp = PEM_read_DHparams(in, nullptr, nullptr, nullptr); @@ -364,7 +368,6 @@ Security::ServerOptions::loadDhParams() return; } -#if OPENSSL_VERSION_MAJOR < 3 // DH_check() removed in OpenSSL 3.0. // TODO: use the EVP API instead, which also works in OpenSSL 1.1. // But it is not yet clear exactly how that API works for DH. @@ -376,10 +379,31 @@ Security::ServerOptions::loadDhParams() dhp = nullptr; } } -#endif - parsedDhParams.resetWithoutLocking(dhp); + +#else // OpenSSL 3.0+ + EVP_PKEY *pkey = nullptr; + if (auto *dctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, "PEM", nullptr, "DH", OSSL_KEYMGMT_SELECT_ALL, nullptr, nullptr)) { + if (auto *in = fopen(dhParamsFile.c_str(), "r")) { + if (OSSL_DECODER_from_fp(dctx, in) == 1) { + + /* pkey is created with the decoded data from the bio */ + Must(pkey); + parsedDhParams.resetWithoutLocking(pkey); + + } else { + debugs(83, DBG_IMPORTANT, "WARNING: Failed to decode DH parameters '" << dhParamsFile << "'"); + } + fclose(in); + } + OSSL_DECODER_CTX_free(dctx); + + } else { + debugs(83, DBG_IMPORTANT, "WARNING: no suitable potential decoders found for DH parameters"); + return; + } #endif +#endif // USE_OPENSSL } bool diff --git a/src/security/forward.h b/src/security/forward.h index d0d745efb02..461694a6c44 100644 --- a/src/security/forward.h +++ b/src/security/forward.h @@ -101,9 +101,24 @@ typedef std::list CertList; typedef std::list CertRevokeList; #if USE_OPENSSL +CtoCpp1(EVP_PKEY_free, EVP_PKEY *) +typedef Security::LockingPointer > PrivateKeyPointer; +#elif USE_GNUTLS +typedef std::shared_ptr PrivateKeyPointer; +#else +typedef std::shared_ptr PrivateKeyPointer; +#endif + +#if USE_OPENSSL +#if OPENSSL_VERSION_MAJOR < 3 CtoCpp1(DH_free, DH *); typedef Security::LockingPointer > DhePointer; #else +typedef PrivateKeyPointer DhePointer; +#endif +#elif USE_GNUTLS +typedef void *DhePointer; +#else typedef void *DhePointer; #endif @@ -186,15 +201,6 @@ class PeerConnector; class BlindPeerConnector; class PeerOptions; -#if USE_OPENSSL -CtoCpp1(EVP_PKEY_free, EVP_PKEY *) -typedef Security::LockingPointer > PrivateKeyPointer; -#elif USE_GNUTLS -typedef std::shared_ptr PrivateKeyPointer; -#else -typedef std::shared_ptr PrivateKeyPointer; -#endif - class ServerOptions; class ErrorDetail; From be2c0e814615d4da38020e9abf0cc49098898e07 Mon Sep 17 00:00:00 2001 From: Amos Jeffries Date: Mon, 11 Oct 2021 06:01:10 +1300 Subject: [PATCH 08/37] Update ECDH key settings --- src/security/ServerOptions.cc | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/src/security/ServerOptions.cc b/src/security/ServerOptions.cc index 4a4f1847cde..a36d1fbd5e7 100644 --- a/src/security/ServerOptions.cc +++ b/src/security/ServerOptions.cc @@ -383,7 +383,12 @@ Security::ServerOptions::loadDhParams() #else // OpenSSL 3.0+ EVP_PKEY *pkey = nullptr; - if (auto *dctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, "PEM", nullptr, "DH", OSSL_KEYMGMT_SELECT_ALL, nullptr, nullptr)) { + const char *type = "DH"; + if (!eecdhCurve.isEmpty()) + type = "EC"; + // XXX: use the eecdhCurve name when generating the EVP_KEY object. or at least verify it matches the loaded params. + + if (auto *dctx = OSSL_DECODER_CTX_new_for_pkey(&pkey, "PEM", nullptr, type, OSSL_KEYMGMT_SELECT_ALL, nullptr, nullptr)) { if (auto *in = fopen(dhParamsFile.c_str(), "r")) { if (OSSL_DECODER_from_fp(dctx, in) == 1) { @@ -483,6 +488,9 @@ Security::ServerOptions::updateContextEecdh(Security::ContextPointer &ctx) debugs(83, 9, "Setting Ephemeral ECDH curve to " << eecdhCurve << "."); #if USE_OPENSSL && OPENSSL_VERSION_NUMBER >= 0x0090800fL && !defined(OPENSSL_NO_ECDH) + + // OpenSSL 3.0+ generates the key in loadDhParams() +#if OPENSSL_VERSION_MAJOR < 3 int nid = OBJ_sn2nid(eecdhCurve.c_str()); if (!nid) { debugs(83, DBG_CRITICAL, "ERROR: Unknown EECDH curve '" << eecdhCurve << "'"); @@ -490,6 +498,9 @@ Security::ServerOptions::updateContextEecdh(Security::ContextPointer &ctx) } auto ecdh = EC_KEY_new_by_curve_name(nid); +#else + auto ecdh = parsedDhParams.get(); +#endif if (!ecdh) { const auto x = ERR_get_error(); debugs(83, DBG_CRITICAL, "ERROR: Unable to configure Ephemeral ECDH: " << Security::ErrorString(x)); @@ -500,7 +511,11 @@ Security::ServerOptions::updateContextEecdh(Security::ContextPointer &ctx) const auto x = ERR_get_error(); debugs(83, DBG_CRITICAL, "ERROR: Unable to set Ephemeral ECDH: " << Security::ErrorString(x)); } +#if OPENSSL_VERSION_MAJOR < 3 EC_KEY_free(ecdh); +#else + return; +#endif #else debugs(83, DBG_CRITICAL, "ERROR: EECDH is not available in this build." << @@ -509,8 +524,8 @@ Security::ServerOptions::updateContextEecdh(Security::ContextPointer &ctx) #endif } - // set DH parameters into the server context #if USE_OPENSSL + // set DH parameters into the server context if (parsedDhParams) { SSL_CTX_set_tmp_dh(ctx.get(), parsedDhParams.get()); } From 743fa75f3df588851de68737a2ff859e6d779e02 Mon Sep 17 00:00:00 2001 From: Amos Jeffries Date: Fri, 15 Oct 2021 04:34:23 +1300 Subject: [PATCH 09/37] Detect and default-enable OpenSSL 3+ --- configure.ac | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index 2d65559ea93..e52c385fd7b 100644 --- a/configure.ac +++ b/configure.ac @@ -1275,7 +1275,14 @@ AC_MSG_NOTICE([GnuTLS library support: ${with_gnutls:=auto} ${LIBGNUTLS_PATH} ${ dnl User may specify OpenSSL is needed from a non-standard location SQUID_OPTIONAL_LIB(openssl,[OpenSSL],[LIBOPENSSL]) AH_TEMPLATE(USE_OPENSSL,[OpenSSL support is available]) -## OpenSSL is default disable due to licensing issues on some OS +AS_IF([test "x$with_openssl" != "xno"],[ + SQUID_STATE_SAVE(squid_openssl3_state) + CPPFLAGS="$LIBOPENSSL_CFLAGS $CPPFLAGS" + LIBS="$LIBS $LIBOPENSSL_PATH" + PKG_CHECK_MODULES([LIBOPENSSL],[openssl >= 3],[with_openssl="yes"],[:]) + SQUID_STATE_ROLLBACK(squid_openssl3_state) +]) +## OpenSSL < 3 is default disable due to licensing issues on some OS if test "x$with_openssl" = "xyes"; then CPPFLAGS="$LIBOPENSSL_CFLAGS $CPPFLAGS" AC_CHECK_HEADERS( \ From a9e367d96e236a8d4e6640221b1697b38c5c0ce4 Mon Sep 17 00:00:00 2001 From: Amos Jeffries Date: Fri, 15 Oct 2021 04:49:46 +1300 Subject: [PATCH 10/37] Remove stale TODO and comment --- src/security/ServerOptions.cc | 3 --- 1 file changed, 3 deletions(-) diff --git a/src/security/ServerOptions.cc b/src/security/ServerOptions.cc index a36d1fbd5e7..bd6cdb3dcf0 100644 --- a/src/security/ServerOptions.cc +++ b/src/security/ServerOptions.cc @@ -368,9 +368,6 @@ Security::ServerOptions::loadDhParams() return; } - // DH_check() removed in OpenSSL 3.0. - // TODO: use the EVP API instead, which also works in OpenSSL 1.1. - // But it is not yet clear exactly how that API works for DH. int codes; if (DH_check(dhp, &codes) == 0) { if (codes) { From df2d57e70a2e793852b4c3c880c4d8cab09eb6e9 Mon Sep 17 00:00:00 2001 From: Amos Jeffries Date: Fri, 15 Oct 2021 05:00:40 +1300 Subject: [PATCH 11/37] Update release notes for UI changes related to OpenSSL 3.0 --- doc/release-notes/release-6.sgml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/doc/release-notes/release-6.sgml b/doc/release-notes/release-6.sgml index 0e193a9155b..73595d79f0b 100644 --- a/doc/release-notes/release-6.sgml +++ b/doc/release-notes/release-6.sgml @@ -63,7 +63,9 @@ This section gives an account of those changes in three categories: Changes to existing directives