On Tue, 2018-10-16 at 20:13 +0200, Jakub Jelen wrote:
> On Mon, 2018-10-15 at 10:18 +1100, Damien Miller wrote:
> > On Fri, 12 Oct 2018, Jakub Jelen wrote:
> >
> > > Something like this can be used to properly initialize new
> > > OpenSSL
> > > versions:
> > >
> > > @@ -70,12 +70,19 @@ ssh_compatible_openssl(long headerver, long
> > > libver)
> > > void
> > > ssh_OpenSSL_add_all_algorithms(void)
> > > {
> > > +#if OPENSSL_VERSION_NUMBER < 0x10100000L
> > > OpenSSL_add_all_algorithms();
> > >
> > > /* Enable use of crypto hardware */
> > > ENGINE_load_builtin_engines();
> > > +#if OPENSSL_VERSION_NUMBER < 0x10001000L
> > > ENGINE_register_all_complete();
> > > +#endif
> > > OPENSSL_config(NULL);
> > > +#else
> > > + OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_DIGESTS |
> > > + OPENSSL_INIT_ADD_ALL_DIGESTS | OPENSSL_INIT_LOAD_CONFIG,
> > > NULL);
> > > +#endif
> >
> > I don't think the #ifs match the #endifs properly here - it leaves
> > the OPENSSL_init_crypto() call inside a #if OPENSSL_VERSION_NUMBER
> > <
> > 0x10100000L...
> >
> > IMO this is simpler and better preserves the current flow of the
> > code.
> > OpenSSL_add_all_algorithms() isn't marked as deprecated in the
> > OpenSSL
> > headers, is used elsewhere in OpenSSH and is still used in most of
> > OpenSSL's demos/*, so I don't see any need to skip that ATM.
> >
> > diff --git a/openbsd-compat/openssl-compat.c b/openbsd-
> > compat/openssl-compat.c
> > index 259fccbe..762358f0 100644
> > --- a/openbsd-compat/openssl-compat.c
> > +++ b/openbsd-compat/openssl-compat.c
> > @@ -75,7 +75,13 @@ ssh_OpenSSL_add_all_algorithms(void)
> > /* Enable use of crypto hardware */
> > ENGINE_load_builtin_engines();
> > ENGINE_register_all_complete();
> > +
> > +#if OPENSSL_VERSION_NUMBER < 0x10001000L
> > OPENSSL_config(NULL);
> > +#else
> > + OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS |
> > + OPENSSL_INIT_ADD_ALL_DIGESTS | OPENSSL_INIT_LOAD_CONFIG);
> > +#endif
> > }
> > #endif
>
> The version in the last snap 20181017 (master commit [1]) is actually
> missing the last (NULL) argument so the master/snap does not compile
> at
> all now with new OpenSSL.
>
> [1] https://github.com/openssh/openssh-portable/commit/4e23deef
After fixing the missing argument above, all the tests pass for me on
Fedora 28 with OpenSSL 1.1.0
Thanks,
Jakub
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
