Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/mariadb/patches/mariadb-10.1.28-openssl-1.1.patch

    Contents of /trunk/mariadb/patches/mariadb-10.1.28-openssl-1.1.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3016 - (show annotations) (download)
    Thu Oct 26 13:17:59 2017 UTC (6 years, 6 months ago) by niro
    File size: 35281 byte(s) 
    -added openssl-1.1 patch
    1 diff --git a/extra/yassl/src/handshake.cpp b/extra/yassl/src/handshake.cpp
    2 index 407e409..6e181a9 100644
    3 --- a/extra/yassl/src/handshake.cpp
    4 +++ b/extra/yassl/src/handshake.cpp
    5 @@ -788,6 +788,16 @@ int DoProcessReply(SSL& ssl)
    6 needHdr = true;
    7 else {
    8 buffer >> hdr;
    9 + /*
    10 + According to RFC 4346 (see "7.4.1.3. Server Hello"), the Server Hello
    11 + packet needs to specify the highest supported TLS version, but not
    12 + higher than what client requests. YaSSL highest supported version is
    13 + TLSv1.1 (=3.2) - if the client requests a higher version, downgrade it
    14 + here to 3.2.
    15 + See also Appendix E of RFC 5246 (TLS 1.2)
    16 + */
    17 + if (hdr.version_.major_ == 3 && hdr.version_.minor_ > 2)
    18 + hdr.version_.minor_ = 2;
    19 ssl.verifyState(hdr);
    20 }
    21
    22 diff --git a/include/ssl_compat.h b/include/ssl_compat.h
    23 new file mode 100644
    24 index 0000000..b0e3ed4
    25 --- /dev/null
    26 +++ b/include/ssl_compat.h
    27 @@ -0,0 +1,75 @@
    28 +/*
    29 + Copyright (c) 2016, 2017 MariaDB Corporation
    30 +
    31 + This program is free software; you can redistribute it and/or modify
    32 + it under the terms of the GNU General Public License as published by
    33 + the Free Software Foundation; version 2 of the License.
    34 +
    35 + This program is distributed in the hope that it will be useful,
    36 + but WITHOUT ANY WARRANTY; without even the implied warranty of
    37 + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    38 + GNU General Public License for more details.
    39 +
    40 + You should have received a copy of the GNU General Public License
    41 + along with this program; if not, write to the Free Software
    42 + Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */
    43 +
    44 +#include <openssl/opensslv.h>
    45 +
    46 +/* OpenSSL version specific definitions */
    47 +#if !defined(HAVE_YASSL) && defined(OPENSSL_VERSION_NUMBER)
    48 +
    49 +#if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(LIBRESSL_VERSION_NUMBER)
    50 +#define HAVE_X509_check_host 1
    51 +#endif
    52 +
    53 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
    54 +#define HAVE_OPENSSL11 1
    55 +#define ERR_remove_state(X) ERR_clear_error()
    56 +#define EVP_MD_CTX_cleanup(X) EVP_MD_CTX_reset(X)
    57 +#define EVP_CIPHER_CTX_SIZE 168
    58 +#define EVP_MD_CTX_SIZE 48
    59 +#undef EVP_MD_CTX_init
    60 +#define EVP_MD_CTX_init(X) do { bzero((X), EVP_MD_CTX_SIZE); EVP_MD_CTX_reset(X); } while(0)
    61 +#undef EVP_CIPHER_CTX_init
    62 +#define EVP_CIPHER_CTX_init(X) do { bzero((X), EVP_CIPHER_CTX_SIZE); EVP_CIPHER_CTX_reset(X); } while(0)
    63 +
    64 +#else
    65 +#define HAVE_OPENSSL10 1
    66 +/*
    67 + Unfortunately RAND_bytes manual page does not provide any guarantees
    68 + in relation to blocking behavior. Here we explicitly use SSLeay random
    69 + instead of whatever random engine is currently set in OpenSSL. That way
    70 + we are guaranteed to have a non-blocking random.
    71 +*/
    72 +#define RAND_OpenSSL() RAND_SSLeay()
    73 +
    74 +#ifdef HAVE_ERR_remove_thread_state
    75 +#define ERR_remove_state(X) ERR_remove_thread_state(NULL)
    76 +#endif /* HAVE_ERR_remove_thread_state */
    77 +
    78 +#endif /* HAVE_OPENSSL11 */
    79 +
    80 +#elif defined(HAVE_YASSL)
    81 +#define BN_free(X) do { } while(0)
    82 +#endif /* !defined(HAVE_YASSL) */
    83 +
    84 +#ifndef HAVE_OPENSSL11
    85 +#define ASN1_STRING_get0_data(X) ASN1_STRING_data(X)
    86 +#define OPENSSL_init_ssl(X,Y) SSL_library_init()
    87 +#define DH_set0_pqg(D,P,Q,G) ((D)->p= (P), (D)->g= (G))
    88 +#define EVP_CIPHER_CTX_buf_noconst(ctx) ((ctx)->buf)
    89 +#define EVP_CIPHER_CTX_encrypting(ctx) ((ctx)->encrypt)
    90 +#define EVP_CIPHER_CTX_SIZE sizeof(EVP_CIPHER_CTX)
    91 +#define EVP_MD_CTX_SIZE sizeof(EVP_MD_CTX)
    92 +#endif
    93 +
    94 +#ifdef __cplusplus
    95 +extern "C" {
    96 +#endif /* __cplusplus */
    97 +
    98 +int check_openssl_compatibility();
    99 +
    100 +#ifdef __cplusplus
    101 +}
    102 +#endif
    103 diff --git a/include/violite.h b/include/violite.h
    104 index a7165ca..572d474 100644
    105 --- a/include/violite.h
    106 +++ b/include/violite.h
    107 @@ -123,13 +123,6 @@ int vio_getnameinfo(const struct sockaddr *sa,
    108 int flags);
    109
    110 #ifdef HAVE_OPENSSL
    111 -#include <openssl/opensslv.h>
    112 -#if OPENSSL_VERSION_NUMBER < 0x0090700f
    113 -#define DES_cblock des_cblock
    114 -#define DES_key_schedule des_key_schedule
    115 -#define DES_set_key_unchecked(k,ks) des_set_key_unchecked((k),*(ks))
    116 -#define DES_ede3_cbc_encrypt(i,o,l,k1,k2,k3,iv,e) des_ede3_cbc_encrypt((i),(o),(l),*(k1),*(k2),*(k3),(iv),(e))
    117 -#endif
    118 /* apple deprecated openssl in MacOSX Lion */
    119 #ifdef __APPLE__
    120 #pragma GCC diagnostic ignored "-Wdeprecated-declarations"
    121 @@ -146,14 +139,10 @@ typedef my_socket YASSL_SOCKET_T;
    122 #include <openssl/ssl.h>
    123 #include <openssl/err.h>
    124
    125 -#ifdef HAVE_ERR_remove_thread_state
    126 -#define ERR_remove_state(X) ERR_remove_thread_state(NULL)
    127 -#endif
    128 -
    129 enum enum_ssl_init_error
    130 {
    131 - SSL_INITERR_NOERROR= 0, SSL_INITERR_CERT, SSL_INITERR_KEY,
    132 - SSL_INITERR_NOMATCH, SSL_INITERR_BAD_PATHS, SSL_INITERR_CIPHERS,
    133 + SSL_INITERR_NOERROR= 0, SSL_INITERR_CERT, SSL_INITERR_KEY,
    134 + SSL_INITERR_NOMATCH, SSL_INITERR_BAD_PATHS, SSL_INITERR_CIPHERS,
    135 SSL_INITERR_MEMFAIL, SSL_INITERR_DH, SSL_INITERR_LASTERR
    136 };
    137 const char* sslGetErrString(enum enum_ssl_init_error err);
    138 diff --git a/mysql-test/include/require_openssl_client.inc b/mysql-test/include/require_openssl_client.inc
    139 new file mode 100644
    140 index 0000000..9b19960
    141 --- /dev/null
    142 +++ b/mysql-test/include/require_openssl_client.inc
    143 @@ -0,0 +1,5 @@
    144 +if ($CLIENT_TLS_LIBRARY != "OpenSSL") {
    145 + if ($CLIENT_TLS_LIBRARY != "LibreSSL") {
    146 + skip "Test requires Connector/C with OpenSSL library";
    147 + }
    148 +}
    149 diff --git a/mysql-test/mysql-test-run.pl b/mysql-test/mysql-test-run.pl
    150 index 2cd5d2a..22bcaba 100755
    151 --- a/mysql-test/mysql-test-run.pl
    152 +++ b/mysql-test/mysql-test-run.pl
    153 @@ -2300,6 +2300,11 @@ sub environment_setup {
    154 $ENV{'MYSQL_PLUGIN'}= $exe_mysql_plugin;
    155 $ENV{'MYSQL_EMBEDDED'}= $exe_mysql_embedded;
    156
    157 + my $client_config_exe=
    158 + native_path("$bindir/libmariadb/mariadb_config$opt_vs_config/mariadb_config");
    159 + my $tls_info= `$client_config_exe --tlsinfo`;
    160 + ($ENV{CLIENT_TLS_LIBRARY},$ENV{CLIENT_TLS_LIBRARY_VERSION})=
    161 + split(/ /, $tls_info, 2);
    162 my $exe_mysqld= find_mysqld($basedir);
    163 $ENV{'MYSQLD'}= $exe_mysqld;
    164 my $extra_opts= join (" ", @opt_extra_mysqld_opt);
    165 diff --git a/mysql-test/r/openssl_6975,tlsv10.result b/mysql-test/r/openssl_6975,tlsv10.result
    166 index 7a4465f..202e7f4 100644
    167 --- a/mysql-test/r/openssl_6975,tlsv10.result
    168 +++ b/mysql-test/r/openssl_6975,tlsv10.result
    169 @@ -3,11 +3,11 @@ grant select on test.* to ssl_sslv3@localhost require cipher "AES128-SHA";
    170 create user ssl_tls12@localhost;
    171 grant select on test.* to ssl_tls12@localhost require cipher "AES128-SHA256";
    172 TLS1.2 ciphers: user is ok with any cipher
    173 -ERROR 2026 (HY000): SSL connection error: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
    174 -ERROR 2026 (HY000): SSL connection error: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
    175 +ERROR 2026 (HY000): SSL connection error: sslv3 alert handshake failure
    176 +ERROR 2026 (HY000): SSL connection error: sslv3 alert handshake failure
    177 TLS1.2 ciphers: user requires SSLv3 cipher AES128-SHA
    178 -ERROR 2026 (HY000): SSL connection error: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
    179 -ERROR 2026 (HY000): SSL connection error: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
    180 +ERROR 2026 (HY000): SSL connection error: sslv3 alert handshake failure
    181 +ERROR 2026 (HY000): SSL connection error: sslv3 alert handshake failure
    182 TLS1.2 ciphers: user requires TLSv1.2 cipher AES128-SHA256
    183 ERROR 2026 (HY000): SSL connection error: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
    184 ERROR 2026 (HY000): SSL connection error: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
    185 diff --git a/mysql-test/t/openssl_6975.test b/mysql-test/t/openssl_6975.test
    186 index 49889a3..6a82d01 100644
    187 --- a/mysql-test/t/openssl_6975.test
    188 +++ b/mysql-test/t/openssl_6975.test
    189 @@ -4,6 +4,7 @@
    190 # test SSLv3 and TLSv1.2 ciphers when OpenSSL is restricted to SSLv3 or TLSv1.2
    191 #
    192 source include/have_ssl_communication.inc;
    193 +source include/require_openssl_client.inc;
    194
    195 # this is OpenSSL test.
    196
    197 diff --git a/mysql-test/t/ssl_7937.test b/mysql-test/t/ssl_7937.test
    198 index d593b9d..a764579 100644
    199 --- a/mysql-test/t/ssl_7937.test
    200 +++ b/mysql-test/t/ssl_7937.test
    201 @@ -26,6 +26,7 @@ create procedure have_ssl()
    202 # we fake the test result for yassl
    203 let yassl=`select variable_value='Unknown' from information_schema.session_status where variable_name='Ssl_session_cache_mode'`;
    204 if (!$yassl) {
    205 + --replace_result "self signed certificate in certificate chain" "Failed to verify the server certificate" "Error in the certificate." "Failed to verify the server certificate"
    206 --exec $MYSQL --ssl --ssl-verify-server-cert -e "call test.have_ssl()" 2>&1
    207 }
    208 if ($yassl) {
    209 diff --git a/mysql-test/t/ssl_8k_key.test b/mysql-test/t/ssl_8k_key.test
    210 index 27cffdc..9d5b382 100644
    211 --- a/mysql-test/t/ssl_8k_key.test
    212 +++ b/mysql-test/t/ssl_8k_key.test
    213 @@ -1,5 +1,5 @@
    214 -# This test should work in embedded server after we fix mysqltest
    215 --- source include/not_embedded.inc
    216 +# schannel does not support keys longer than 4k
    217 +-- source include/not_windows.inc
    218
    219 -- source include/have_ssl_communication.inc
    220 #
    221 diff --git a/mysys_ssl/CMakeLists.txt b/mysys_ssl/CMakeLists.txt
    222 index 4f6f745..f8a767e 100644
    223 --- a/mysys_ssl/CMakeLists.txt
    224 +++ b/mysys_ssl/CMakeLists.txt
    225 @@ -28,6 +28,7 @@ SET(MYSYS_SSL_HIDDEN_SOURCES
    226 my_sha384.cc
    227 my_sha512.cc
    228 my_md5.cc
    229 + openssl.c
    230 )
    231
    232 SET(MYSYS_SSL_SOURCES
    233 diff --git a/mysys_ssl/my_crypt.cc b/mysys_ssl/my_crypt.cc
    234 index a0937a8..ed1c82d 100644
    235 --- a/mysys_ssl/my_crypt.cc
    236 +++ b/mysys_ssl/my_crypt.cc
    237 @@ -1,6 +1,6 @@
    238 /*
    239 Copyright (c) 2014 Google Inc.
    240 - Copyright (c) 2014, 2015 MariaDB Corporation
    241 + Copyright (c) 2014, 2017 MariaDB Corporation
    242
    243 This program is free software; you can redistribute it and/or modify
    244 it under the terms of the GNU General Public License as published by
    245 @@ -17,52 +17,60 @@
    246
    247 #include <my_global.h>
    248 #include <string.h>
    249 -#include <my_crypt.h>
    250
    251 #ifdef HAVE_YASSL
    252 #include "yassl.cc"
    253 #else
    254 -
    255 #include <openssl/evp.h>
    256 #include <openssl/aes.h>
    257 #include <openssl/err.h>
    258 -
    259 -#ifdef HAVE_ERR_remove_thread_state
    260 -#define ERR_remove_state(X) ERR_remove_thread_state(NULL)
    261 +#include <openssl/rand.h>
    262 #endif
    263
    264 -#endif
    265 +#include <my_crypt.h>
    266 +#include <ssl_compat.h>
    267
    268 class MyCTX
    269 {
    270 public:
    271 - EVP_CIPHER_CTX ctx;
    272 - MyCTX() { EVP_CIPHER_CTX_init(&ctx); }
    273 - virtual ~MyCTX() { EVP_CIPHER_CTX_cleanup(&ctx); ERR_remove_state(0); }
    274 + char ctx_buf[EVP_CIPHER_CTX_SIZE];
    275 + EVP_CIPHER_CTX *ctx;
    276 +
    277 + MyCTX()
    278 + {
    279 + ctx= (EVP_CIPHER_CTX *)ctx_buf;
    280 + EVP_CIPHER_CTX_init(ctx);
    281 + }
    282 + virtual ~MyCTX()
    283 + {
    284 + EVP_CIPHER_CTX_cleanup(ctx);
    285 + ERR_remove_state(0);
    286 + }
    287
    288 virtual int init(const EVP_CIPHER *cipher, int encrypt, const uchar *key,
    289 uint klen, const uchar *iv, uint ivlen)
    290 {
    291 + compile_time_assert(MY_AES_CTX_SIZE >= sizeof(MyCTX));
    292 if (unlikely(!cipher))
    293 return MY_AES_BAD_KEYSIZE;
    294
    295 - if (!EVP_CipherInit_ex(&ctx, cipher, NULL, key, iv, encrypt))
    296 + if (!EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, encrypt))
    297 return MY_AES_OPENSSL_ERROR;
    298
    299 - DBUG_ASSERT(EVP_CIPHER_CTX_key_length(&ctx) == (int)klen);
    300 - DBUG_ASSERT(EVP_CIPHER_CTX_iv_length(&ctx) <= (int)ivlen);
    301 + DBUG_ASSERT(EVP_CIPHER_CTX_key_length(ctx) == (int)klen);
    302 + DBUG_ASSERT(EVP_CIPHER_CTX_iv_length(ctx) <= (int)ivlen);
    303
    304 return MY_AES_OK;
    305 }
    306 virtual int update(const uchar *src, uint slen, uchar *dst, uint *dlen)
    307 {
    308 - if (!EVP_CipherUpdate(&ctx, dst, (int*)dlen, src, slen))
    309 + if (!EVP_CipherUpdate(ctx, dst, (int*)dlen, src, slen))
    310 return MY_AES_OPENSSL_ERROR;
    311 return MY_AES_OK;
    312 }
    313 virtual int finish(uchar *dst, uint *dlen)
    314 {
    315 - if (!EVP_CipherFinal_ex(&ctx, dst, (int*)dlen))
    316 + if (!EVP_CipherFinal_ex(ctx, dst, (int*)dlen))
    317 return MY_AES_BAD_DATA;
    318 return MY_AES_OK;
    319 }
    320 @@ -72,7 +80,8 @@ class MyCTX_nopad : public MyCTX
    321 {
    322 public:
    323 const uchar *key;
    324 - int klen;
    325 + uint klen, buf_len;
    326 + uchar oiv[MY_AES_BLOCK_SIZE];
    327
    328 MyCTX_nopad() : MyCTX() { }
    329 ~MyCTX_nopad() { }
    330 @@ -83,32 +92,48 @@ class MyCTX_nopad : public MyCTX
    331 compile_time_assert(MY_AES_CTX_SIZE >= sizeof(MyCTX_nopad));
    332 this->key= key;
    333 this->klen= klen;
    334 + this->buf_len= 0;
    335 + memcpy(oiv, iv, ivlen);
    336 + DBUG_ASSERT(ivlen == 0 || ivlen == sizeof(oiv));
    337 +
    338 int res= MyCTX::init(cipher, encrypt, key, klen, iv, ivlen);
    339 - memcpy(ctx.oiv, iv, ivlen); // in ECB mode OpenSSL doesn't do that itself
    340 - EVP_CIPHER_CTX_set_padding(&ctx, 0);
    341 +
    342 + EVP_CIPHER_CTX_set_padding(ctx, 0);
    343 return res;
    344 }
    345
    346 + int update(const uchar *src, uint slen, uchar *dst, uint *dlen)
    347 + {
    348 + buf_len+= slen;
    349 + return MyCTX::update(src, slen, dst, dlen);
    350 + }
    351 +
    352 int finish(uchar *dst, uint *dlen)
    353 {
    354 - if (ctx.buf_len)
    355 + buf_len %= MY_AES_BLOCK_SIZE;
    356 + if (buf_len)
    357 {
    358 + uchar *buf= EVP_CIPHER_CTX_buf_noconst(ctx);
    359 /*
    360 Not much we can do, block ciphers cannot encrypt data that aren't
    361 a multiple of the block length. At least not without padding.
    362 Let's do something CTR-like for the last partial block.
    363 +
    364 + NOTE this assumes that there are only buf_len bytes in the buf.
    365 + If OpenSSL will change that, we'll need to change the implementation
    366 + of this class too.
    367 */
    368 uchar mask[MY_AES_BLOCK_SIZE];
    369 uint mlen;
    370
    371 my_aes_crypt(MY_AES_ECB, ENCRYPTION_FLAG_ENCRYPT | ENCRYPTION_FLAG_NOPAD,
    372 - ctx.oiv, sizeof(mask), mask, &mlen, key, klen, 0, 0);
    373 + oiv, sizeof(mask), mask, &mlen, key, klen, 0, 0);
    374 DBUG_ASSERT(mlen == sizeof(mask));
    375
    376 - for (int i=0; i < ctx.buf_len; i++)
    377 - dst[i]= ctx.buf[i] ^ mask[i];
    378 + for (uint i=0; i < buf_len; i++)
    379 + dst[i]= buf[i] ^ mask[i];
    380 }
    381 - *dlen= ctx.buf_len;
    382 + *dlen= buf_len;
    383 return MY_AES_OK;
    384 }
    385 };
    386 @@ -152,7 +177,7 @@ class MyCTX_gcm : public MyCTX
    387 {
    388 compile_time_assert(MY_AES_CTX_SIZE >= sizeof(MyCTX_gcm));
    389 int res= MyCTX::init(cipher, encrypt, key, klen, iv, ivlen);
    390 - int real_ivlen= EVP_CIPHER_CTX_iv_length(&ctx);
    391 + int real_ivlen= EVP_CIPHER_CTX_iv_length(ctx);
    392 aad= iv + real_ivlen;
    393 aadlen= ivlen - real_ivlen;
    394 return res;
    395 @@ -166,15 +191,15 @@ class MyCTX_gcm : public MyCTX
    396 before decrypting the data. it can encrypt data piecewise, like, first
    397 half, then the second half, but it must decrypt all at once
    398 */
    399 - if (!ctx.encrypt)
    400 + if (!EVP_CIPHER_CTX_encrypting(ctx))
    401 {
    402 slen-= MY_AES_BLOCK_SIZE;
    403 - if(!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_SET_TAG, MY_AES_BLOCK_SIZE,
    404 + if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, MY_AES_BLOCK_SIZE,
    405 (void*)(src + slen)))
    406 return MY_AES_OPENSSL_ERROR;
    407 }
    408 int unused;
    409 - if (aadlen && !EVP_CipherUpdate(&ctx, NULL, &unused, aad, aadlen))
    410 + if (aadlen && !EVP_CipherUpdate(ctx, NULL, &unused, aad, aadlen))
    411 return MY_AES_OPENSSL_ERROR;
    412 aadlen= 0;
    413 return MyCTX::update(src, slen, dst, dlen);
    414 @@ -183,13 +208,13 @@ class MyCTX_gcm : public MyCTX
    415 int finish(uchar *dst, uint *dlen)
    416 {
    417 int fin;
    418 - if (!EVP_CipherFinal_ex(&ctx, dst, &fin))
    419 + if (!EVP_CipherFinal_ex(ctx, dst, &fin))
    420 return MY_AES_BAD_DATA;
    421 DBUG_ASSERT(fin == 0);
    422
    423 - if (ctx.encrypt)
    424 + if (EVP_CIPHER_CTX_encrypting(ctx))
    425 {
    426 - if(!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_GET_TAG, MY_AES_BLOCK_SIZE, dst))
    427 + if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, MY_AES_BLOCK_SIZE, dst))
    428 return MY_AES_OPENSSL_ERROR;
    429 *dlen= MY_AES_BLOCK_SIZE;
    430 }
    431 @@ -257,12 +282,15 @@ int my_aes_crypt(enum my_aes_mode mode, int flags,
    432 {
    433 void *ctx= alloca(MY_AES_CTX_SIZE);
    434 int res1, res2;
    435 - uint d1, d2;
    436 + uint d1= 0, d2;
    437 if ((res1= my_aes_crypt_init(ctx, mode, flags, key, klen, iv, ivlen)))
    438 return res1;
    439 res1= my_aes_crypt_update(ctx, src, slen, dst, &d1);
    440 res2= my_aes_crypt_finish(ctx, dst + d1, &d2);
    441 - *dlen= d1 + d2;
    442 + if (res1 || res2)
    443 + ERR_remove_state(0); /* in case of failure clear error queue */
    444 + else
    445 + *dlen= d1 + d2;
    446 return res1 ? res1 : res2;
    447 }
    448
    449 @@ -301,17 +329,10 @@ int my_random_bytes(uchar* buf, int num)
    450 return MY_AES_OK;
    451 }
    452 #else
    453 -#include <openssl/rand.h>
    454
    455 int my_random_bytes(uchar *buf, int num)
    456 {
    457 - /*
    458 - Unfortunately RAND_bytes manual page does not provide any guarantees
    459 - in relation to blocking behavior. Here we explicitly use SSLeay random
    460 - instead of whatever random engine is currently set in OpenSSL. That way
    461 - we are guaranteed to have a non-blocking random.
    462 - */
    463 - RAND_METHOD *rand = RAND_SSLeay();
    464 + RAND_METHOD *rand = RAND_OpenSSL();
    465 if (rand == NULL || rand->bytes(buf, num) != 1)
    466 return MY_AES_OPENSSL_ERROR;
    467 return MY_AES_OK;
    468 diff --git a/mysys_ssl/my_md5.cc b/mysys_ssl/my_md5.cc
    469 index 7139ea9..0105082 100644
    470 --- a/mysys_ssl/my_md5.cc
    471 +++ b/mysys_ssl/my_md5.cc
    472 @@ -1,5 +1,5 @@
    473 /* Copyright (c) 2012, Oracle and/or its affiliates.
    474 - Copyright (c) 2014, SkySQL Ab.
    475 + Copyright (c) 2017, MariaDB Corporation
    476
    477 This program is free software; you can redistribute it and/or modify
    478 it under the terms of the GNU General Public License as published by
    479 @@ -29,38 +29,31 @@
    480
    481 #if defined(HAVE_YASSL)
    482 #include "md5.hpp"
    483 +#include <ssl_compat.h>
    484
    485 -typedef TaoCrypt::MD5 MD5_CONTEXT;
    486 +typedef TaoCrypt::MD5 EVP_MD_CTX;
    487
    488 -static void md5_init(MD5_CONTEXT *context)
    489 +static void md5_init(EVP_MD_CTX *context)
    490 {
    491 - context= new(context) MD5_CONTEXT;
    492 + context= new(context) EVP_MD_CTX;
    493 context->Init();
    494 }
    495
    496 -/*
    497 - this is a variant of md5_init to be used in this file only.
    498 - does nothing for yassl, because the context's constructor was called automatically.
    499 -*/
    500 -static void md5_init_fast(MD5_CONTEXT *context)
    501 -{
    502 -}
    503 -
    504 -static void md5_input(MD5_CONTEXT *context, const uchar *buf, unsigned len)
    505 +static void md5_input(EVP_MD_CTX *context, const uchar *buf, unsigned len)
    506 {
    507 context->Update((const TaoCrypt::byte *) buf, len);
    508 }
    509
    510 -static void md5_result(MD5_CONTEXT *context, uchar digest[MD5_HASH_SIZE])
    511 +static void md5_result(EVP_MD_CTX *context, uchar digest[MD5_HASH_SIZE])
    512 {
    513 context->Final((TaoCrypt::byte *) digest);
    514 }
    515
    516 #elif defined(HAVE_OPENSSL)
    517 #include <openssl/evp.h>
    518 -typedef EVP_MD_CTX MD5_CONTEXT;
    519 +#include <ssl_compat.h>
    520
    521 -static void md5_init(MD5_CONTEXT *context)
    522 +static void md5_init(EVP_MD_CTX *context)
    523 {
    524 EVP_MD_CTX_init(context);
    525 #ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
    526 @@ -70,17 +63,12 @@ static void md5_init(MD5_CONTEXT *context)
    527 EVP_DigestInit_ex(context, EVP_md5(), NULL);
    528 }
    529
    530 -static void md5_init_fast(MD5_CONTEXT *context)
    531 -{
    532 - md5_init(context);
    533 -}
    534 -
    535 -static void md5_input(MD5_CONTEXT *context, const uchar *buf, unsigned len)
    536 +static void md5_input(EVP_MD_CTX *context, const uchar *buf, unsigned len)
    537 {
    538 EVP_DigestUpdate(context, buf, len);
    539 }
    540
    541 -static void md5_result(MD5_CONTEXT *context, uchar digest[MD5_HASH_SIZE])
    542 +static void md5_result(EVP_MD_CTX *context, uchar digest[MD5_HASH_SIZE])
    543 {
    544 EVP_DigestFinal_ex(context, digest, NULL);
    545 EVP_MD_CTX_cleanup(context);
    546 @@ -99,58 +87,58 @@ static void md5_result(MD5_CONTEXT *context, uchar digest[MD5_HASH_SIZE])
    547 */
    548 void my_md5(uchar *digest, const char *buf, size_t len)
    549 {
    550 - MD5_CONTEXT md5_context;
    551 -
    552 - md5_init_fast(&md5_context);
    553 - md5_input(&md5_context, (const uchar *)buf, len);
    554 - md5_result(&md5_context, digest);
    555 + char ctx_buf[EVP_MD_CTX_SIZE];
    556 + EVP_MD_CTX * const ctx= (EVP_MD_CTX*)ctx_buf;
    557 + md5_init(ctx);
    558 + md5_input(ctx, (const uchar *)buf, len);
    559 + md5_result(ctx, digest);
    560 }
    561
    562
    563 /**
    564 Wrapper function to compute MD5 message digest for
    565 - two messages in order to emulate md5(msg1, msg2).
    566 + many messages, concatenated.
    567
    568 @param digest [out] Computed MD5 digest
    569 @param buf1 [in] First message
    570 @param len1 [in] Length of first message
    571 - @param buf2 [in] Second message
    572 - @param len2 [in] Length of second message
    573 + ...
    574 + @param bufN [in] NULL terminates the list of buf,len pairs.
    575
    576 @return void
    577 */
    578 void my_md5_multi(uchar *digest, ...)
    579 {
    580 va_list args;
    581 - va_start(args, digest);
    582 -
    583 - MD5_CONTEXT md5_context;
    584 const uchar *str;
    585 + char ctx_buf[EVP_MD_CTX_SIZE];
    586 + EVP_MD_CTX * const ctx= (EVP_MD_CTX*)ctx_buf;
    587 + va_start(args, digest);
    588
    589 - md5_init_fast(&md5_context);
    590 + md5_init(ctx);
    591 for (str= va_arg(args, const uchar*); str; str= va_arg(args, const uchar*))
    592 - md5_input(&md5_context, str, va_arg(args, size_t));
    593 + md5_input(ctx, str, va_arg(args, size_t));
    594
    595 - md5_result(&md5_context, digest);
    596 + md5_result(ctx, digest);
    597 va_end(args);
    598 }
    599
    600 size_t my_md5_context_size()
    601 {
    602 - return sizeof(MD5_CONTEXT);
    603 + return EVP_MD_CTX_SIZE;
    604 }
    605
    606 void my_md5_init(void *context)
    607 {
    608 - md5_init((MD5_CONTEXT *)context);
    609 + md5_init((EVP_MD_CTX *)context);
    610 }
    611
    612 void my_md5_input(void *context, const uchar *buf, size_t len)
    613 {
    614 - md5_input((MD5_CONTEXT *)context, buf, len);
    615 + md5_input((EVP_MD_CTX *)context, buf, len);
    616 }
    617
    618 void my_md5_result(void *context, uchar *digest)
    619 {
    620 - md5_result((MD5_CONTEXT *)context, digest);
    621 + md5_result((EVP_MD_CTX *)context, digest);
    622 }
    623 diff --git a/mysys_ssl/openssl.c b/mysys_ssl/openssl.c
    624 new file mode 100644
    625 index 0000000..a3f1ca2
    626 --- /dev/null
    627 +++ b/mysys_ssl/openssl.c
    628 @@ -0,0 +1,71 @@
    629 +/*
    630 + Copyright (c) 2017, MariaDB Corporation.
    631 +
    632 + This program is free software; you can redistribute it and/or modify
    633 + it under the terms of the GNU General Public License as published by
    634 + the Free Software Foundation; version 2 of the License.
    635 +
    636 + This program is distributed in the hope that it will be useful,
    637 + but WITHOUT ANY WARRANTY; without even the implied warranty of
    638 + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    639 + GNU General Public License for more details.
    640 +
    641 + You should have received a copy of the GNU General Public License
    642 + along with this program; if not, write to the Free Software
    643 + Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */
    644 +
    645 +#include <my_global.h>
    646 +#include <ssl_compat.h>
    647 +
    648 +#ifdef HAVE_YASSL
    649 +
    650 +int check_openssl_compatibility()
    651 +{
    652 + return 0;
    653 +}
    654 +#else
    655 +#include <openssl/evp.h>
    656 +
    657 +#ifdef HAVE_OPENSSL11
    658 +typedef void *(*CRYPTO_malloc_t)(size_t, const char *, int);
    659 +#endif
    660 +
    661 +#ifdef HAVE_OPENSSL10
    662 +typedef void *(*CRYPTO_malloc_t)(size_t);
    663 +#define CRYPTO_malloc malloc
    664 +#define CRYPTO_realloc realloc
    665 +#define CRYPTO_free free
    666 +#endif
    667 +
    668 +static uint allocated_size, allocated_count;
    669 +
    670 +static void *coc_malloc(size_t size)
    671 +{
    672 + allocated_size+= size;
    673 + allocated_count++;
    674 + return malloc(size);
    675 +}
    676 +
    677 +int check_openssl_compatibility()
    678 +{
    679 + EVP_CIPHER_CTX *evp_ctx;
    680 + EVP_MD_CTX *md5_ctx;
    681 +
    682 + CRYPTO_set_mem_functions((CRYPTO_malloc_t)coc_malloc, CRYPTO_realloc, CRYPTO_free);
    683 +
    684 + allocated_size= allocated_count= 0;
    685 + evp_ctx= EVP_CIPHER_CTX_new();
    686 + EVP_CIPHER_CTX_free(evp_ctx);
    687 + if (allocated_count != 1 || allocated_size > EVP_CIPHER_CTX_SIZE)
    688 + return 1;
    689 +
    690 + allocated_size= allocated_count= 0;
    691 + md5_ctx= EVP_MD_CTX_create();
    692 + EVP_MD_CTX_destroy(md5_ctx);
    693 + if (allocated_count != 1 || allocated_size > EVP_MD_CTX_SIZE)
    694 + return 1;
    695 +
    696 + CRYPTO_set_mem_functions(CRYPTO_malloc, CRYPTO_realloc, CRYPTO_free);
    697 + return 0;
    698 +}
    699 +#endif
    700 diff --git a/mysys_ssl/yassl.cc b/mysys_ssl/yassl.cc
    701 index 9717870..aa5631f 100644
    702 --- a/mysys_ssl/yassl.cc
    703 +++ b/mysys_ssl/yassl.cc
    704 @@ -44,7 +44,6 @@ typedef struct
    705 int buf_len;
    706 int final_used;
    707 uchar tao_buf[sizeof(TaoCrypt::AES)]; // TaoCrypt::AES object
    708 - uchar oiv[TaoCrypt::AES::BLOCK_SIZE]; // original IV
    709 uchar buf[TaoCrypt::AES::BLOCK_SIZE]; // last partial input block
    710 uchar final[TaoCrypt::AES::BLOCK_SIZE]; // last decrypted (output) block
    711 } EVP_CIPHER_CTX;
    712 @@ -97,10 +96,7 @@ static int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
    713 : TaoCrypt::DECRYPTION, cipher->mode);
    714 TAO(ctx)->SetKey(key, cipher->key_len);
    715 if (iv)
    716 - {
    717 TAO(ctx)->SetIV(iv);
    718 - memcpy(ctx->oiv, iv, TaoCrypt::AES::BLOCK_SIZE);
    719 - }
    720 ctx->encrypt= enc;
    721 ctx->key_len= cipher->key_len;
    722 ctx->flags|= cipher->mode == TaoCrypt::CBC ? EVP_CIPH_CBC_MODE : EVP_CIPH_ECB_MODE;
    723 diff --git a/sql-common/client.c b/sql-common/client.c
    724 index b7796ce..2518f66 100644
    725 --- a/sql-common/client.c
    726 +++ b/sql-common/client.c
    727 @@ -105,6 +105,7 @@ my_bool net_flush(NET *net);
    728 #endif
    729
    730 #include "client_settings.h"
    731 +#include <ssl_compat.h>
    732 #include <sql_common.h>
    733 #include <mysql/client_plugin.h>
    734 #include <my_context.h>
    735 @@ -1769,9 +1770,8 @@ mysql_get_ssl_cipher(MYSQL *mysql __attribute__((unused)))
    736
    737 #if defined(HAVE_OPENSSL)
    738
    739 -#if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(HAVE_YASSL)
    740 +#ifdef HAVE_X509_check_host
    741 #include <openssl/x509v3.h>
    742 -#define HAVE_X509_check_host
    743 #endif
    744
    745 static int ssl_verify_server_cert(Vio *vio, const char* server_hostname, const char **errptr)
    746 @@ -1843,7 +1843,7 @@ static int ssl_verify_server_cert(Vio *vio, const char* server_hostname, const c
    747 goto error;
    748 }
    749
    750 - cn= (char *) ASN1_STRING_data(cn_asn1);
    751 + cn= (char *) ASN1_STRING_get0_data(cn_asn1);
    752
    753 if ((size_t)ASN1_STRING_length(cn_asn1) != strlen(cn))
    754 {
    755 diff --git a/sql/mysqld.cc b/sql/mysqld.cc
    756 index 3af8750..cc64205 100644
    757 --- a/sql/mysqld.cc
    758 +++ b/sql/mysqld.cc
    759 @@ -338,9 +338,13 @@ static PSI_thread_key key_thread_handle_con_sockets;
    760 static PSI_thread_key key_thread_handle_shutdown;
    761 #endif /* __WIN__ */
    762
    763 -#if defined (HAVE_OPENSSL) && !defined(HAVE_YASSL)
    764 +#ifdef HAVE_OPENSSL
    765 +#include <ssl_compat.h>
    766 +
    767 +#ifdef HAVE_OPENSSL10
    768 static PSI_rwlock_key key_rwlock_openssl;
    769 #endif
    770 +#endif
    771 #endif /* HAVE_PSI_INTERFACE */
    772
    773 #ifdef HAVE_NPTL
    774 @@ -987,7 +991,7 @@ PSI_rwlock_key key_rwlock_LOCK_grant, key_rwlock_LOCK_logger,
    775
    776 static PSI_rwlock_info all_server_rwlocks[]=
    777 {
    778 -#if defined (HAVE_OPENSSL) && !defined(HAVE_YASSL)
    779 +#ifdef HAVE_OPENSSL10
    780 { &key_rwlock_openssl, "CRYPTO_dynlock_value::lock", 0},
    781 #endif
    782 { &key_rwlock_LOCK_grant, "LOCK_grant", PSI_FLAG_GLOBAL},
    783 @@ -1457,7 +1461,7 @@ scheduler_functions *thread_scheduler= &thread_scheduler_struct,
    784
    785 #ifdef HAVE_OPENSSL
    786 #include <openssl/crypto.h>
    787 -#ifndef HAVE_YASSL
    788 +#ifdef HAVE_OPENSSL10
    789 typedef struct CRYPTO_dynlock_value
    790 {
    791 mysql_rwlock_t lock;
    792 @@ -1468,7 +1472,7 @@ static openssl_lock_t *openssl_dynlock_create(const char *, int);
    793 static void openssl_dynlock_destroy(openssl_lock_t *, const char *, int);
    794 static void openssl_lock_function(int, int, const char *, int);
    795 static void openssl_lock(int, openssl_lock_t *, const char *, int);
    796 -#endif
    797 +#endif /* HAVE_OPENSSL10 */
    798 char *des_key_file;
    799 #ifndef EMBEDDED_LIBRARY
    800 struct st_VioSSLFd *ssl_acceptor_fd;
    801 @@ -2244,11 +2248,11 @@ static void clean_up_mutexes()
    802 mysql_mutex_destroy(&LOCK_global_index_stats);
    803 #ifdef HAVE_OPENSSL
    804 mysql_mutex_destroy(&LOCK_des_key_file);
    805 -#ifndef HAVE_YASSL
    806 +#ifdef HAVE_OPENSSL10
    807 for (int i= 0; i < CRYPTO_num_locks(); ++i)
    808 mysql_rwlock_destroy(&openssl_stdlocks[i].lock);
    809 OPENSSL_free(openssl_stdlocks);
    810 -#endif /* HAVE_YASSL */
    811 +#endif /* HAVE_OPENSSL10 */
    812 #endif /* HAVE_OPENSSL */
    813 #ifdef HAVE_REPLICATION
    814 mysql_mutex_destroy(&LOCK_rpl_status);
    815 @@ -4057,6 +4061,14 @@ static int init_common_variables()
    816 return 1;
    817 }
    818
    819 +#ifdef HAVE_OPENSSL
    820 + if (check_openssl_compatibility())
    821 + {
    822 + sql_print_error("Incompatible OpenSSL version. Cannot continue...");
    823 + return 1;
    824 + }
    825 +#endif
    826 +
    827 if (init_thread_environment() ||
    828 mysql_init_variables())
    829 return 1;
    830 @@ -4603,7 +4615,7 @@ static int init_thread_environment()
    831 #ifdef HAVE_OPENSSL
    832 mysql_mutex_init(key_LOCK_des_key_file,
    833 &LOCK_des_key_file, MY_MUTEX_INIT_FAST);
    834 -#ifndef HAVE_YASSL
    835 +#ifdef HAVE_OPENSSL10
    836 openssl_stdlocks= (openssl_lock_t*) OPENSSL_malloc(CRYPTO_num_locks() *
    837 sizeof(openssl_lock_t));
    838 for (int i= 0; i < CRYPTO_num_locks(); ++i)
    839 @@ -4612,8 +4624,8 @@ static int init_thread_environment()
    840 CRYPTO_set_dynlock_destroy_callback(openssl_dynlock_destroy);
    841 CRYPTO_set_dynlock_lock_callback(openssl_lock);
    842 CRYPTO_set_locking_callback(openssl_lock_function);
    843 -#endif
    844 -#endif
    845 +#endif /* HAVE_OPENSSL10 */
    846 +#endif /* HAVE_OPENSSL */
    847 mysql_rwlock_init(key_rwlock_LOCK_sys_init_connect, &LOCK_sys_init_connect);
    848 mysql_rwlock_init(key_rwlock_LOCK_sys_init_slave, &LOCK_sys_init_slave);
    849 mysql_rwlock_init(key_rwlock_LOCK_grant, &LOCK_grant);
    850 @@ -4646,7 +4658,7 @@ static int init_thread_environment()
    851 }
    852
    853
    854 -#if defined(HAVE_OPENSSL) && !defined(HAVE_YASSL)
    855 +#ifdef HAVE_OPENSSL10
    856 static openssl_lock_t *openssl_dynlock_create(const char *file, int line)
    857 {
    858 openssl_lock_t *lock= new openssl_lock_t;
    859 @@ -4706,8 +4718,7 @@ static void openssl_lock(int mode, openssl_lock_t *lock, const char *file,
    860 abort();
    861 }
    862 }
    863 -#endif /* HAVE_OPENSSL */
    864 -
    865 +#endif /* HAVE_OPENSSL10 */
    866
    867 static void init_ssl()
    868 {
    869 diff --git a/sql/slave.cc b/sql/slave.cc
    870 index db1c330..aec5143 100644
    871 --- a/sql/slave.cc
    872 +++ b/sql/slave.cc
    873 @@ -40,6 +40,7 @@
    874 #include <my_dir.h>
    875 #include <sql_common.h>
    876 #include <errmsg.h>
    877 +#include <ssl_compat.h>
    878 #include <mysqld_error.h>
    879 #include <mysys_err.h>
    880 #include "rpl_handler.h"
    881 @@ -60,7 +61,6 @@
    882 #include "debug_sync.h"
    883 #include "rpl_parallel.h"
    884
    885 -
    886 #define FLAGSTR(V,F) ((V)&(F)?#F" ":"")
    887
    888 #define MAX_SLAVE_RETRY_PAUSE 5
    889 @@ -4507,9 +4507,7 @@ log space");
    890
    891 DBUG_LEAVE; // Must match DBUG_ENTER()
    892 my_thread_end();
    893 -#ifdef HAVE_OPENSSL
    894 ERR_remove_state(0);
    895 -#endif
    896 pthread_exit(0);
    897 return 0; // Avoid compiler warnings
    898 }
    899 @@ -5168,9 +5166,7 @@ pthread_handler_t handle_slave_sql(void *arg)
    900
    901 DBUG_LEAVE; // Must match DBUG_ENTER()
    902 my_thread_end();
    903 -#ifdef HAVE_OPENSSL
    904 ERR_remove_state(0);
    905 -#endif
    906 pthread_exit(0);
    907 return 0; // Avoid compiler warnings
    908 }
    909 diff --git a/vio/vio.c b/vio/vio.c
    910 index e3bc8ca..44d0609 100644
    911 --- a/vio/vio.c
    912 +++ b/vio/vio.c
    913 @@ -22,6 +22,7 @@
    914 */
    915
    916 #include "vio_priv.h"
    917 +#include "ssl_compat.h"
    918
    919 #ifdef _WIN32
    920
    921 diff --git a/vio/viosslfactories.c b/vio/viosslfactories.c
    922 index 52b624d..71ef287 100644
    923 --- a/vio/viosslfactories.c
    924 +++ b/vio/viosslfactories.c
    925 @@ -15,6 +15,7 @@
    926 Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */
    927
    928 #include "vio_priv.h"
    929 +#include <ssl_compat.h>
    930
    931 #ifdef HAVE_OPENSSL
    932 #ifndef HAVE_YASSL
    933 @@ -26,49 +27,56 @@ static my_bool ssl_algorithms_added = FALSE;
    934 static my_bool ssl_error_strings_loaded= FALSE;
    935
    936 /* the function below was generated with "openssl dhparam -2 -C 2048" */
    937 +
    938 static
    939 DH *get_dh2048()
    940 {
    941 - static unsigned char dh2048_p[]={
    942 - 0xA1,0xBB,0x7C,0x20,0xC5,0x5B,0xC0,0x7B,0x21,0x8B,0xD6,0xA8,
    943 - 0x15,0xFC,0x3B,0xBA,0xAB,0x9F,0xDF,0x68,0xC4,0x79,0x78,0x0D,
    944 - 0xC1,0x12,0x64,0xE4,0x15,0xC9,0x66,0xDB,0xF6,0xCB,0xB3,0x39,
    945 - 0x02,0x5B,0x78,0x62,0xFB,0x09,0xAE,0x09,0x6B,0xDD,0xD4,0x5D,
    946 - 0x97,0xBC,0xDC,0x7F,0xE6,0xD6,0xF1,0xCB,0xF5,0xEB,0xDA,0xA7,
    947 - 0x2E,0x5A,0x43,0x2B,0xE9,0x40,0xE2,0x85,0x00,0x1C,0xC0,0x0A,
    948 - 0x98,0x77,0xA9,0x31,0xDE,0x0B,0x75,0x4D,0x1E,0x1F,0x16,0x83,
    949 - 0xCA,0xDE,0xBD,0x21,0xFC,0xC1,0x82,0x37,0x36,0x33,0x0B,0x66,
    950 - 0x06,0x3C,0xF3,0xAF,0x21,0x57,0x57,0x80,0xF6,0x94,0x1B,0xA9,
    951 - 0xD4,0xF6,0x8F,0x18,0x62,0x0E,0xC4,0x22,0xF9,0x5B,0x62,0xCC,
    952 - 0x3F,0x19,0x95,0xCF,0x4B,0x00,0xA6,0x6C,0x0B,0xAF,0x9F,0xD5,
    953 - 0xFA,0x3D,0x6D,0xDA,0x30,0x83,0x07,0x91,0xAC,0x15,0xFF,0x8F,
    954 - 0x59,0x54,0xEA,0x25,0xBC,0x4E,0xEB,0x6A,0x54,0xDF,0x75,0x09,
    955 - 0x72,0x0F,0xEF,0x23,0x70,0xE0,0xA8,0x04,0xEA,0xFF,0x90,0x54,
    956 - 0xCD,0x84,0x18,0xC0,0x75,0x91,0x99,0x0F,0xA1,0x78,0x0C,0x07,
    957 - 0xB7,0xC5,0xDE,0x55,0x06,0x7B,0x95,0x68,0x2C,0x33,0x39,0xBC,
    958 - 0x2C,0xD0,0x6D,0xDD,0xFA,0xDC,0xB5,0x8F,0x82,0x39,0xF8,0x67,
    959 - 0x44,0xF1,0xD8,0xF7,0x78,0x11,0x9A,0x77,0x9B,0x53,0x47,0xD6,
    960 - 0x2B,0x5D,0x67,0xB8,0xB7,0xBC,0xC1,0xD7,0x79,0x62,0x15,0xC2,
    961 - 0xC5,0x83,0x97,0xA7,0xF8,0xB4,0x9C,0xF6,0x8F,0x9A,0xC7,0xDA,
    962 - 0x1B,0xBB,0x87,0x07,0xA7,0x71,0xAD,0xB2,0x8A,0x50,0xF8,0x26,
    963 - 0x12,0xB7,0x3E,0x0B,
    964 - };
    965 - static unsigned char dh2048_g[]={
    966 - 0x02,
    967 - };
    968 - DH *dh;
    969 -
    970 - if ((dh=DH_new()) == NULL) return(NULL);
    971 - dh->p=BN_bin2bn(dh2048_p,sizeof(dh2048_p),NULL);
    972 - dh->g=BN_bin2bn(dh2048_g,sizeof(dh2048_g),NULL);
    973 - if ((dh->p == NULL) || (dh->g == NULL))
    974 - { DH_free(dh); return(NULL); }
    975 - return(dh);
    976 + static unsigned char dhp_2048[] = {
    977 + 0xA1,0xBB,0x7C,0x20,0xC5,0x5B,0xC0,0x7B,0x21,0x8B,0xD6,0xA8,
    978 + 0x15,0xFC,0x3B,0xBA,0xAB,0x9F,0xDF,0x68,0xC4,0x79,0x78,0x0D,
    979 + 0xC1,0x12,0x64,0xE4,0x15,0xC9,0x66,0xDB,0xF6,0xCB,0xB3,0x39,
    980 + 0x02,0x5B,0x78,0x62,0xFB,0x09,0xAE,0x09,0x6B,0xDD,0xD4,0x5D,
    981 + 0x97,0xBC,0xDC,0x7F,0xE6,0xD6,0xF1,0xCB,0xF5,0xEB,0xDA,0xA7,
    982 + 0x2E,0x5A,0x43,0x2B,0xE9,0x40,0xE2,0x85,0x00,0x1C,0xC0,0x0A,
    983 + 0x98,0x77,0xA9,0x31,0xDE,0x0B,0x75,0x4D,0x1E,0x1F,0x16,0x83,
    984 + 0xCA,0xDE,0xBD,0x21,0xFC,0xC1,0x82,0x37,0x36,0x33,0x0B,0x66,
    985 + 0x06,0x3C,0xF3,0xAF,0x21,0x57,0x57,0x80,0xF6,0x94,0x1B,0xA9,
    986 + 0xD4,0xF6,0x8F,0x18,0x62,0x0E,0xC4,0x22,0xF9,0x5B,0x62,0xCC,
    987 + 0x3F,0x19,0x95,0xCF,0x4B,0x00,0xA6,0x6C,0x0B,0xAF,0x9F,0xD5,
    988 + 0xFA,0x3D,0x6D,0xDA,0x30,0x83,0x07,0x91,0xAC,0x15,0xFF,0x8F,
    989 + 0x59,0x54,0xEA,0x25,0xBC,0x4E,0xEB,0x6A,0x54,0xDF,0x75,0x09,
    990 + 0x72,0x0F,0xEF,0x23,0x70,0xE0,0xA8,0x04,0xEA,0xFF,0x90,0x54,
    991 + 0xCD,0x84,0x18,0xC0,0x75,0x91,0x99,0x0F,0xA1,0x78,0x0C,0x07,
    992 + 0xB7,0xC5,0xDE,0x55,0x06,0x7B,0x95,0x68,0x2C,0x33,0x39,0xBC,
    993 + 0x2C,0xD0,0x6D,0xDD,0xFA,0xDC,0xB5,0x8F,0x82,0x39,0xF8,0x67,
    994 + 0x44,0xF1,0xD8,0xF7,0x78,0x11,0x9A,0x77,0x9B,0x53,0x47,0xD6,
    995 + 0x2B,0x5D,0x67,0xB8,0xB7,0xBC,0xC1,0xD7,0x79,0x62,0x15,0xC2,
    996 + 0xC5,0x83,0x97,0xA7,0xF8,0xB4,0x9C,0xF6,0x8F,0x9A,0xC7,0xDA,
    997 + 0x1B,0xBB,0x87,0x07,0xA7,0x71,0xAD,0xB2,0x8A,0x50,0xF8,0x26,
    998 + 0x12,0xB7,0x3E,0x0B,
    999 + };
    1000 + static unsigned char dhg_2048[] = {
    1001 + 0x02
    1002 + };
    1003 + DH *dh = DH_new();
    1004 + BIGNUM *dhp_bn, *dhg_bn;
    1005 +
    1006 + if (dh == NULL)
    1007 + return NULL;
    1008 + dhp_bn = BN_bin2bn(dhp_2048, sizeof (dhp_2048), NULL);
    1009 + dhg_bn = BN_bin2bn(dhg_2048, sizeof (dhg_2048), NULL);
    1010 + if (dhp_bn == NULL || dhg_bn == NULL
    1011 + || !DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) {
    1012 + DH_free(dh);
    1013 + BN_free(dhp_bn);
    1014 + BN_free(dhg_bn);
    1015 + return NULL;
    1016 + }
    1017 + return dh;
    1018 }
    1019
    1020 -
    1021 static const char*
    1022 -ssl_error_string[] =
    1023 +ssl_error_string[] =
    1024 {
    1025 "No error",
    1026 "Unable to get certificate",
    1027 @@ -148,9 +156,7 @@ static void check_ssl_init()
    1028 if (!ssl_algorithms_added)
    1029 {
    1030 ssl_algorithms_added= TRUE;
    1031 - SSL_library_init();
    1032 - OpenSSL_add_all_algorithms();
    1033 -
    1034 + OPENSSL_init_ssl(0, NULL);
    1035 }
    1036
    1037 if (!ssl_error_strings_loaded)