From 5b6739a793f40749b3354c372a95f4577dc05f78 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Krier?= Date: Sun, 19 Jul 2020 10:48:44 +0200 Subject: [PATCH] Do not use FIPS and remove hardcode OPENSSL_VERSION_NUMBER with LibreSSL Fix #552 --- src/apps/common/ns_turn_openssl.h | 5 ----- src/apps/relay/ns_ioalib_engine_impl.c | 4 ++-- src/client/ns_turn_msg.c | 4 ++-- 3 files changed, 4 insertions(+), 9 deletions(-) diff --git a/src/apps/common/ns_turn_openssl.h b/src/apps/common/ns_turn_openssl.h index eb33c143..8272f99c 100644 --- a/src/apps/common/ns_turn_openssl.h +++ b/src/apps/common/ns_turn_openssl.h @@ -42,9 +42,4 @@ #include #include -#if (defined LIBRESSL_VERSION_NUMBER && OPENSSL_VERSION_NUMBER == 0x20000000L) -#undef OPENSSL_VERSION_NUMBER -#define OPENSSL_VERSION_NUMBER 0x1000107FL -#endif - #endif //__NST_OPENSSL_LIB__ diff --git a/src/apps/relay/ns_ioalib_engine_impl.c b/src/apps/relay/ns_ioalib_engine_impl.c index 22cc640a..b5721f47 100644 --- a/src/apps/relay/ns_ioalib_engine_impl.c +++ b/src/apps/relay/ns_ioalib_engine_impl.c @@ -1828,7 +1828,7 @@ int ssl_read(evutil_socket_t fd, SSL* ssl, ioa_network_buffer_handle nbh, int ve BIO* rbio = BIO_new_mem_buf(buffer, old_buffer_len); BIO_set_mem_eof_return(rbio, -1); -#if OPENSSL_VERSION_NUMBER < 0x10100000L +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined LIBRESSL_VERSION_NUMBER ssl->rbio = rbio; #else SSL_set0_rbio(ssl,rbio); @@ -1923,7 +1923,7 @@ int ssl_read(evutil_socket_t fd, SSL* ssl, ioa_network_buffer_handle nbh, int ve if(ret>0) { ioa_network_buffer_add_offset_size(nbh, (uint16_t)buf_size, 0, (size_t)ret); } -#if OPENSSL_VERSION_NUMBER < 0x10100000L +#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined LIBRESSL_VERSION_NUMBER ssl->rbio = NULL; BIO_free(rbio); #else diff --git a/src/client/ns_turn_msg.c b/src/client/ns_turn_msg.c index e9386eb0..d0c8d889 100644 --- a/src/client/ns_turn_msg.c +++ b/src/client/ns_turn_msg.c @@ -244,7 +244,7 @@ int stun_produce_integrity_key_str(const uint8_t *uname, const uint8_t *realm, c unsigned int keylen = 0; EVP_MD_CTX ctx; EVP_MD_CTX_init(&ctx); -#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW +#if defined EVP_MD_CTX_FLAG_NON_FIPS_ALLOW && !defined(LIBRESSL_VERSION_NUMBER) if (FIPS_mode()) { EVP_MD_CTX_set_flags(&ctx,EVP_MD_CTX_FLAG_NON_FIPS_ALLOW); } @@ -256,7 +256,7 @@ int stun_produce_integrity_key_str(const uint8_t *uname, const uint8_t *realm, c #else unsigned int keylen = 0; EVP_MD_CTX *ctx = EVP_MD_CTX_new(); -#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW +#if defined EVP_MD_CTX_FLAG_NON_FIPS_ALLOW && ! defined(LIBRESSL_VERSION_NUMBER) if (FIPS_mode()) { EVP_MD_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW); }