Skip to content

Commit 81520fe

Browse files
authored
bpo-45536: Check OpenSSL APIs in configure (GH-29088)
1 parent d9e1dae commit 81520fe

File tree

3 files changed

+105
-0
lines changed

3 files changed

+105
-0
lines changed
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
The ``configure`` script now checks whether OpenSSL headers and libraries
2+
provide required APIs. Most common APIs are verified. The check detects
3+
outdated or missing OpenSSL. Failures do not stop configure.

configure

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17949,6 +17949,66 @@ esac
1794917949
$as_echo "$OPENSSL_RPATH" >&6; }
1795017950

1795117951

17952+
# check if OpenSSL libraries work as expected
17953+
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether OpenSSL provides required APIs" >&5
17954+
$as_echo_n "checking whether OpenSSL provides required APIs... " >&6; }
17955+
save_LIBS="$LIBS"
17956+
save_CFLAGS="$CFLAGS"
17957+
save_LDFLAGS="$LDFLAGS"
17958+
LIBS="$LIBS $OPENSSL_LIBS"
17959+
CFLAGS="$CFLAGS_NODIST $OPENSSL_INCLUDES"
17960+
LDFLAGS="$LDFLAGS $OPENSSL_LDFLAGS"
17961+
17962+
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
17963+
/* end confdefs.h. */
17964+
17965+
#include <openssl/opensslv.h>
17966+
#include <openssl/evp.h>
17967+
#include <openssl/ssl.h>
17968+
17969+
#if OPENSSL_VERSION_NUMBER < 0x10101000L
17970+
#error "OpenSSL >= 1.1.1 is required"
17971+
#endif
17972+
17973+
static void keylog_cb(const SSL *ssl, const char *line) {}
17974+
17975+
int
17976+
main ()
17977+
{
17978+
17979+
/* SSL APIs */
17980+
SSL_CTX *ctx = SSL_CTX_new(TLS_client_method());
17981+
SSL_CTX_set_keylog_callback(ctx, keylog_cb);
17982+
SSL *ssl = SSL_new(ctx);
17983+
X509_VERIFY_PARAM *param = SSL_get0_param(ssl);
17984+
X509_VERIFY_PARAM_set1_host(param, "python.org", 0);
17985+
SSL_free(ssl);
17986+
SSL_CTX_free(ctx);
17987+
17988+
/* hashlib APIs */
17989+
OBJ_nid2sn(NID_md5);
17990+
OBJ_nid2sn(NID_sha1);
17991+
OBJ_nid2sn(NID_sha3_512);
17992+
OBJ_nid2sn(NID_blake2b512);
17993+
EVP_PBE_scrypt(NULL, 0, NULL, 0, 2, 8, 1, 0, NULL, 0);
17994+
17995+
;
17996+
return 0;
17997+
}
17998+
_ACEOF
17999+
if ac_fn_c_try_link "$LINENO"; then :
18000+
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
18001+
$as_echo "yes" >&6; }
18002+
else
18003+
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
18004+
$as_echo "no" >&6; }
18005+
fi
18006+
rm -f core conftest.err conftest.$ac_objext \
18007+
conftest$ac_exeext conftest.$ac_ext
18008+
LIBS="$save_LIBS"
18009+
CFLAGS="$save_CFLAGS"
18010+
LDFLAGS="$save_LDFLAGS"
18011+
1795218012
# ssl module default cipher suite string
1795318013

1795418014

configure.ac

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5888,6 +5888,48 @@ AS_CASE($with_openssl_rpath,
58885888
AC_MSG_RESULT($OPENSSL_RPATH)
58895889
AC_SUBST([OPENSSL_RPATH])
58905890

5891+
# check if OpenSSL libraries work as expected
5892+
AC_MSG_CHECKING(whether OpenSSL provides required APIs)
5893+
save_LIBS="$LIBS"
5894+
save_CFLAGS="$CFLAGS"
5895+
save_LDFLAGS="$LDFLAGS"
5896+
LIBS="$LIBS $OPENSSL_LIBS"
5897+
CFLAGS="$CFLAGS_NODIST $OPENSSL_INCLUDES"
5898+
LDFLAGS="$LDFLAGS $OPENSSL_LDFLAGS"
5899+
5900+
AC_LINK_IFELSE([AC_LANG_PROGRAM([[
5901+
#include <openssl/opensslv.h>
5902+
#include <openssl/evp.h>
5903+
#include <openssl/ssl.h>
5904+
5905+
#if OPENSSL_VERSION_NUMBER < 0x10101000L
5906+
#error "OpenSSL >= 1.1.1 is required"
5907+
#endif
5908+
5909+
static void keylog_cb(const SSL *ssl, const char *line) {}
5910+
]], [[
5911+
/* SSL APIs */
5912+
SSL_CTX *ctx = SSL_CTX_new(TLS_client_method());
5913+
SSL_CTX_set_keylog_callback(ctx, keylog_cb);
5914+
SSL *ssl = SSL_new(ctx);
5915+
X509_VERIFY_PARAM *param = SSL_get0_param(ssl);
5916+
X509_VERIFY_PARAM_set1_host(param, "python.org", 0);
5917+
SSL_free(ssl);
5918+
SSL_CTX_free(ctx);
5919+
5920+
/* hashlib APIs */
5921+
OBJ_nid2sn(NID_md5);
5922+
OBJ_nid2sn(NID_sha1);
5923+
OBJ_nid2sn(NID_sha3_512);
5924+
OBJ_nid2sn(NID_blake2b512);
5925+
EVP_PBE_scrypt(NULL, 0, NULL, 0, 2, 8, 1, 0, NULL, 0);
5926+
]])],
5927+
[AC_MSG_RESULT(yes)],
5928+
[AC_MSG_RESULT(no)])
5929+
LIBS="$save_LIBS"
5930+
CFLAGS="$save_CFLAGS"
5931+
LDFLAGS="$save_LDFLAGS"
5932+
58915933
# ssl module default cipher suite string
58925934
AH_TEMPLATE(PY_SSL_DEFAULT_CIPHERS,
58935935
[Default cipher suites list for ssl module.

0 commit comments

Comments
 (0)