Skip to content

Commit 4831aee

Browse files
rheniumrhenium
authored
Merge pull request #836 from rhenium/ky/require-libressl-3.9
Require LibreSSL 3.9 or later (Drop support for 3.1-3.8)
2 parents a3e0c16 + 187b176 commit 4831aee

16 files changed

+42
-75
lines changed

‎.github/workflows/test.yml‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -73,16 +73,8 @@ jobs:
7373
- openssl-3.4.0 # Supported until 2026-10-22
7474
- openssl-master
7575
# http://www.libressl.org/releases.html
76-
- libressl-3.1.5 # EOL
77-
- libressl-3.2.7 # EOL
78-
- libressl-3.3.6 # EOL
79-
- libressl-3.4.3 # EOL
80-
- libressl-3.5.3 # EOL
81-
- libressl-3.6.3 # EOL
82-
- libressl-3.7.3 # EOL
83-
- libressl-3.8.4 # EOL 2024-10-16
8476
- libressl-3.9.2 # Supported until 2025-04-05
85-
- libressl-4.0.0
77+
- libressl-4.0.0 # Supported until 2025-10-08
8678
include:
8779
- { name-extra: 'with fips provider', openssl: openssl-3.0.15, fips-enabled: true }
8880
- { name-extra: 'with fips provider', openssl: openssl-3.1.7, fips-enabled: true }

‎ext/openssl/extconf.rb‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -120,14 +120,15 @@ def find_openssl_library
120120

121121
version_ok = if have_macro("LIBRESSL_VERSION_NUMBER", "openssl/opensslv.h")
122122
is_libressl = true
123-
checking_for("LibreSSL version >= 3.1.0") {
124-
try_static_assert("LIBRESSL_VERSION_NUMBER >= 0x30100000L", "openssl/opensslv.h") }
123+
checking_for("LibreSSL version >= 3.9.0") {
124+
try_static_assert("LIBRESSL_VERSION_NUMBER >= 0x30900000L", "openssl/opensslv.h") }
125125
else
126+
is_openssl = true
126127
checking_for("OpenSSL version >= 1.0.2") {
127128
try_static_assert("OPENSSL_VERSION_NUMBER >= 0x10002000L", "openssl/opensslv.h") }
128129
end
129130
unless version_ok
130-
raise "OpenSSL >= 1.0.2 or LibreSSL >= 3.1.0 is required"
131+
raise "OpenSSL >= 1.0.2 or LibreSSL >= 3.9.0 is required"
131132
end
132133

133134
# Prevent wincrypt.h from being included, which defines conflicting macro with openssl/x509.h
@@ -143,14 +144,13 @@ def find_openssl_library
143144

144145
# compile options
145146
have_func("RAND_egd()", "openssl/rand.h")
146-
engines = %w{dynamic 4758cca aep atalla chil
147-
cswift nuron sureware ubsec padlock capi gmp gost cryptodev}
148-
engines.each { |name|
149-
have_func("ENGINE_load_#{name}()", "openssl/engine.h")
150-
}
151-
152-
# missing in libressl < 3.5
153-
have_func("i2d_re_X509_tbs(NULL, NULL)", x509_h)
147+
if is_openssl
148+
engines = %w{dynamic 4758cca aep atalla chil
149+
cswift nuron sureware ubsec padlock capi gmp gost cryptodev}
150+
engines.each { |name|
151+
have_func("ENGINE_load_#{name}()", "openssl/engine.h")
152+
}
153+
end
154154

155155
# added in 1.1.0
156156
if !have_struct_member("SSL", "ctx", "openssl/ssl.h") || is_libressl

‎ext/openssl/ossl.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1050,7 +1050,7 @@ Init_openssl(void)
10501050
/*
10511051
* Init all digests, ciphers
10521052
*/
1053-
#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10100000
1053+
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_IS_LIBRESSL
10541054
if (!OPENSSL_init_ssl(0, NULL))
10551055
rb_raise(rb_eRuntimeError, "OPENSSL_init_ssl");
10561056
#else
@@ -1075,7 +1075,7 @@ Init_openssl(void)
10751075
/*
10761076
* Version of OpenSSL the ruby OpenSSL extension is running with
10771077
*/
1078-
#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10100000
1078+
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_IS_LIBRESSL
10791079
rb_define_const(mOSSL, "OPENSSL_LIBRARY_VERSION", rb_str_new2(OpenSSL_version(OPENSSL_VERSION)));
10801080
#else
10811081
rb_define_const(mOSSL, "OPENSSL_LIBRARY_VERSION", rb_str_new2(SSLeay_version(SSLEAY_VERSION)));

‎ext/openssl/ossl_engine.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ static VALUE eEngineError;
4747
/*
4848
* Private
4949
*/
50-
#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10100000
50+
#if OSSL_OPENSSL_PREREQ(1, 1, 0)
5151
#define OSSL_ENGINE_LOAD_IF_MATCH(engine_name, x) \
5252
do{\
5353
if(!strcmp(#engine_name, RSTRING_PTR(name))){\
@@ -163,7 +163,7 @@ ossl_engine_s_load(int argc, VALUE *argv, VALUE klass)
163163
static VALUE
164164
ossl_engine_s_cleanup(VALUE self)
165165
{
166-
#if defined(LIBRESSL_VERSION_NUMBER) || OPENSSL_VERSION_NUMBER < 0x10100000
166+
#if !OSSL_OPENSSL_PREREQ(1, 1, 0)
167167
ENGINE_cleanup();
168168
#endif
169169
return Qnil;

‎ext/openssl/ossl_kdf.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* Copyright (C) 2007, 2017 Ruby/OpenSSL Project Authors
44
*/
55
#include "ossl.h"
6-
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_LIBRESSL_PREREQ(3, 6, 0)
6+
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_IS_LIBRESSL
77
# include <openssl/kdf.h>
88
#endif
99

@@ -141,7 +141,7 @@ kdf_scrypt(int argc, VALUE *argv, VALUE self)
141141
}
142142
#endif
143143

144-
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_LIBRESSL_PREREQ(3, 6, 0)
144+
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_IS_LIBRESSL
145145
/*
146146
* call-seq:
147147
* KDF.hkdf(ikm, salt:, info:, length:, hash:) -> String
@@ -305,7 +305,7 @@ Init_ossl_kdf(void)
305305
#if defined(HAVE_EVP_PBE_SCRYPT)
306306
rb_define_module_function(mKDF, "scrypt", kdf_scrypt, -1);
307307
#endif
308-
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_LIBRESSL_PREREQ(3, 6, 0)
308+
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_IS_LIBRESSL
309309
rb_define_module_function(mKDF, "hkdf", kdf_hkdf, -1);
310310
#endif
311311
}

‎ext/openssl/ossl_pkey.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -799,7 +799,7 @@ ossl_pkey_export_traditional(int argc, VALUE *argv, VALUE self, int to_der)
799799
}
800800
}
801801
else {
802-
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_LIBRESSL_PREREQ(3, 5, 0)
802+
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_IS_LIBRESSL
803803
if (!PEM_write_bio_PrivateKey_traditional(bio, pkey, enc, NULL, 0,
804804
ossl_pem_passwd_cb,
805805
(void *)pass)) {
@@ -1116,7 +1116,7 @@ ossl_pkey_sign(int argc, VALUE *argv, VALUE self)
11161116
rb_jump_tag(state);
11171117
}
11181118
}
1119-
#if OSSL_OPENSSL_PREREQ(1, 1, 1) || OSSL_LIBRESSL_PREREQ(3, 4, 0)
1119+
#if OSSL_OPENSSL_PREREQ(1, 1, 1) || OSSL_IS_LIBRESSL
11201120
if (EVP_DigestSign(ctx, NULL, &siglen, (unsigned char *)RSTRING_PTR(data),
11211121
RSTRING_LEN(data)) < 1) {
11221122
EVP_MD_CTX_free(ctx);
@@ -1221,7 +1221,7 @@ ossl_pkey_verify(int argc, VALUE *argv, VALUE self)
12211221
rb_jump_tag(state);
12221222
}
12231223
}
1224-
#if OSSL_OPENSSL_PREREQ(1, 1, 1) || OSSL_LIBRESSL_PREREQ(3, 4, 0)
1224+
#if OSSL_OPENSSL_PREREQ(1, 1, 1) || OSSL_IS_LIBRESSL
12251225
ret = EVP_DigestVerify(ctx, (unsigned char *)RSTRING_PTR(sig),
12261226
RSTRING_LEN(sig), (unsigned char *)RSTRING_PTR(data),
12271227
RSTRING_LEN(data));

‎ext/openssl/ossl_ssl.c‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,6 @@
1818
# define OSSL_USE_NEXTPROTONEG
1919
#endif
2020

21-
#if !defined(TLS1_3_VERSION) && \
22-
OSSL_LIBRESSL_PREREQ(3, 2, 0) && !OSSL_LIBRESSL_PREREQ(3, 4, 0)
23-
# define TLS1_3_VERSION 0x0304
24-
#endif
25-
2621
#ifdef _WIN32
2722
# define TO_SOCKET(s) _get_osfhandle(s)
2823
#else

‎ext/openssl/ossl_x509cert.c‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -711,7 +711,6 @@ ossl_x509_eq(VALUE self, VALUE other)
711711
return !X509_cmp(a, b) ? Qtrue : Qfalse;
712712
}
713713

714-
#ifdef HAVE_I2D_RE_X509_TBS
715714
/*
716715
* call-seq:
717716
* cert.tbs_bytes => string
@@ -741,7 +740,6 @@ ossl_x509_tbs_bytes(VALUE self)
741740

742741
return str;
743742
}
744-
#endif
745743

746744
struct load_chained_certificates_arguments {
747745
VALUE certificates;
@@ -1035,7 +1033,5 @@ Init_ossl_x509cert(void)
10351033
rb_define_method(cX509Cert, "add_extension", ossl_x509_add_extension, 1);
10361034
rb_define_method(cX509Cert, "inspect", ossl_x509_inspect, 0);
10371035
rb_define_method(cX509Cert, "==", ossl_x509_eq, 1);
1038-
#ifdef HAVE_I2D_RE_X509_TBS
10391036
rb_define_method(cX509Cert, "tbs_bytes", ossl_x509_tbs_bytes, 0);
1040-
#endif
10411037
}

‎ext/openssl/ossl_x509store.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -365,12 +365,12 @@ ossl_x509store_add_file(VALUE self, VALUE file)
365365
ossl_raise(eX509StoreError, "X509_STORE_add_lookup");
366366
if (X509_LOOKUP_load_file(lookup, path, X509_FILETYPE_PEM) != 1)
367367
ossl_raise(eX509StoreError, "X509_LOOKUP_load_file");
368-
#if OPENSSL_VERSION_NUMBER < 0x10101000 || defined(LIBRESSL_VERSION_NUMBER)
368+
#if !OSSL_OPENSSL_PREREQ(1, 1, 1) && !OSSL_IS_LIBRESSL
369369
/*
370370
* X509_load_cert_crl_file() which is called from X509_LOOKUP_load_file()
371371
* did not check the return value of X509_STORE_add_{cert,crl}(), leaking
372372
* "cert already in hash table" errors on the error queue, if duplicate
373-
* certificates are found. This will be fixed by OpenSSL 1.1.1.
373+
* certificates are found. Fixed by OpenSSL 1.1.1 and LibreSSL 3.5.0.
374374
*/
375375
ossl_clear_error();
376376
#endif

‎test/openssl/test_pkey.rb‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ def test_generic_oid_inspect_rsa
1111
end
1212

1313
def test_generic_oid_inspect_x25519
14-
omit "X25519 not supported" unless openssl?(1, 1, 0) || libressl?(3, 7, 0)
14+
omit "X25519 not supported" if openssl? && !openssl?(1, 1, 0)
1515
omit_on_fips
1616

1717
# X25519 private key
@@ -85,8 +85,7 @@ def test_hmac_sign_verify
8585
def test_ed25519
8686
# Ed25519 is not FIPS-approved.
8787
omit_on_fips
88-
# See EVP_PKEY_sign in Changelog for 3.7.0: https://github.com/libressl/portable/blob/master/ChangeLog
89-
omit "Ed25519 not supported" unless openssl?(1, 1, 1) || libressl?(3, 7, 0)
88+
omit "Ed25519 not supported" if openssl? && !openssl?(1, 1, 1)
9089

9190
# Test vector from RFC 8032 Section 7.1 TEST 2
9291
priv_pem = <<~EOF
@@ -137,7 +136,7 @@ def test_ed25519
137136
end
138137

139138
def test_x25519
140-
omit "X25519 not supported" unless openssl?(1, 1, 0) || libressl?(3, 7, 0)
139+
omit "X25519 not supported" if openssl? && !openssl?(1, 1, 0)
141140
omit_on_fips
142141

143142
# Test vector from RFC 7748 Section 6.1
@@ -160,7 +159,7 @@ def test_x25519
160159
assert_equal bob_pem, bob.public_to_pem
161160
assert_equal [shared_secret].pack("H*"), alice.derive(bob)
162161

163-
unless openssl?(1, 1, 1) || libressl?(3, 7, 0)
162+
if openssl? && !openssl?(1, 1, 1)
164163
omit "running OpenSSL version does not have raw public key support"
165164
end
166165
alice_private = OpenSSL::PKey.new_raw_private_key("X25519", alice.raw_private_key)
@@ -176,7 +175,7 @@ def test_x25519
176175
end
177176

178177
def test_raw_initialize_errors
179-
omit "Ed25519 not supported" unless openssl?(1, 1, 1) || libressl?(3, 7, 0)
178+
omit "Ed25519 not supported" if openssl? && !openssl?(1, 1, 1)
180179

181180
assert_raise(OpenSSL::PKey::PKeyError) { OpenSSL::PKey.new_raw_private_key("foo123", "xxx") }
182181
assert_raise(OpenSSL::PKey::PKeyError) { OpenSSL::PKey.new_raw_private_key("ED25519", "xxx") }

0 commit comments

Comments
 (0)