Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/mariadb/patches/mariadb-10.1.37-openssl-1.1.patch

    Contents of /trunk/mariadb/patches/mariadb-10.1.37-openssl-1.1.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3318 - (show annotations) (download)
    Tue Mar 12 14:08:59 2019 UTC (5 years, 1 month ago) by niro
    File size: 34201 byte(s) 
    -updated openssl patch
    1 diff --git a/cmake/ssl.cmake b/cmake/ssl.cmake
    2 index 24e18600402..6fac749fd13 100644
    3 --- a/cmake/ssl.cmake
    4 +++ b/cmake/ssl.cmake
    5 @@ -182,7 +182,7 @@ MACRO (MYSQL_CHECK_SSL)
    6 HAVE_SHA512_DIGEST_LENGTH)
    7 SET(CMAKE_REQUIRED_INCLUDES)
    8 IF(OPENSSL_INCLUDE_DIR AND OPENSSL_LIBRARIES AND
    9 - OPENSSL_MAJOR_VERSION STRLESS "101" AND
    10 + OPENSSL_MAJOR_VERSION STRLESS "102" AND
    11 CRYPTO_LIBRARY AND HAVE_SHA512_DIGEST_LENGTH)
    12
    13 SET(SSL_SOURCES "")
    14 diff --git a/include/ssl_compat.h b/include/ssl_compat.h
    15 new file mode 100644
    16 index 0000000..b0e3ed4
    17 --- /dev/null
    18 +++ b/include/ssl_compat.h
    19 @@ -0,0 +1,75 @@
    20 +/*
    21 + Copyright (c) 2016, 2017 MariaDB Corporation
    22 +
    23 + This program is free software; you can redistribute it and/or modify
    24 + it under the terms of the GNU General Public License as published by
    25 + the Free Software Foundation; version 2 of the License.
    26 +
    27 + This program is distributed in the hope that it will be useful,
    28 + but WITHOUT ANY WARRANTY; without even the implied warranty of
    29 + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    30 + GNU General Public License for more details.
    31 +
    32 + You should have received a copy of the GNU General Public License
    33 + along with this program; if not, write to the Free Software
    34 + Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */
    35 +
    36 +#include <openssl/opensslv.h>
    37 +
    38 +/* OpenSSL version specific definitions */
    39 +#if !defined(HAVE_YASSL) && defined(OPENSSL_VERSION_NUMBER)
    40 +
    41 +#if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(LIBRESSL_VERSION_NUMBER)
    42 +#define HAVE_X509_check_host 1
    43 +#endif
    44 +
    45 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
    46 +#define HAVE_OPENSSL11 1
    47 +#define ERR_remove_state(X) ERR_clear_error()
    48 +#define EVP_MD_CTX_cleanup(X) EVP_MD_CTX_reset(X)
    49 +#define EVP_CIPHER_CTX_SIZE 168
    50 +#define EVP_MD_CTX_SIZE 48
    51 +#undef EVP_MD_CTX_init
    52 +#define EVP_MD_CTX_init(X) do { bzero((X), EVP_MD_CTX_SIZE); EVP_MD_CTX_reset(X); } while(0)
    53 +#undef EVP_CIPHER_CTX_init
    54 +#define EVP_CIPHER_CTX_init(X) do { bzero((X), EVP_CIPHER_CTX_SIZE); EVP_CIPHER_CTX_reset(X); } while(0)
    55 +
    56 +#else
    57 +#define HAVE_OPENSSL10 1
    58 +/*
    59 + Unfortunately RAND_bytes manual page does not provide any guarantees
    60 + in relation to blocking behavior. Here we explicitly use SSLeay random
    61 + instead of whatever random engine is currently set in OpenSSL. That way
    62 + we are guaranteed to have a non-blocking random.
    63 +*/
    64 +#define RAND_OpenSSL() RAND_SSLeay()
    65 +
    66 +#ifdef HAVE_ERR_remove_thread_state
    67 +#define ERR_remove_state(X) ERR_remove_thread_state(NULL)
    68 +#endif /* HAVE_ERR_remove_thread_state */
    69 +
    70 +#endif /* HAVE_OPENSSL11 */
    71 +
    72 +#elif defined(HAVE_YASSL)
    73 +#define BN_free(X) do { } while(0)
    74 +#endif /* !defined(HAVE_YASSL) */
    75 +
    76 +#ifndef HAVE_OPENSSL11
    77 +#define ASN1_STRING_get0_data(X) ASN1_STRING_data(X)
    78 +#define OPENSSL_init_ssl(X,Y) SSL_library_init()
    79 +#define DH_set0_pqg(D,P,Q,G) ((D)->p= (P), (D)->g= (G))
    80 +#define EVP_CIPHER_CTX_buf_noconst(ctx) ((ctx)->buf)
    81 +#define EVP_CIPHER_CTX_encrypting(ctx) ((ctx)->encrypt)
    82 +#define EVP_CIPHER_CTX_SIZE sizeof(EVP_CIPHER_CTX)
    83 +#define EVP_MD_CTX_SIZE sizeof(EVP_MD_CTX)
    84 +#endif
    85 +
    86 +#ifdef __cplusplus
    87 +extern "C" {
    88 +#endif /* __cplusplus */
    89 +
    90 +int check_openssl_compatibility();
    91 +
    92 +#ifdef __cplusplus
    93 +}
    94 +#endif
    95 diff --git a/include/violite.h b/include/violite.h
    96 index a7165ca..572d474 100644
    97 --- a/include/violite.h
    98 +++ b/include/violite.h
    99 @@ -123,13 +123,6 @@ int vio_getnameinfo(const struct sockaddr *sa,
    100 int flags);
    101
    102 #ifdef HAVE_OPENSSL
    103 -#include <openssl/opensslv.h>
    104 -#if OPENSSL_VERSION_NUMBER < 0x0090700f
    105 -#define DES_cblock des_cblock
    106 -#define DES_key_schedule des_key_schedule
    107 -#define DES_set_key_unchecked(k,ks) des_set_key_unchecked((k),*(ks))
    108 -#define DES_ede3_cbc_encrypt(i,o,l,k1,k2,k3,iv,e) des_ede3_cbc_encrypt((i),(o),(l),*(k1),*(k2),*(k3),(iv),(e))
    109 -#endif
    110 /* apple deprecated openssl in MacOSX Lion */
    111 #ifdef __APPLE__
    112 #pragma GCC diagnostic ignored "-Wdeprecated-declarations"
    113 @@ -146,14 +139,10 @@ typedef my_socket YASSL_SOCKET_T;
    114 #include <openssl/ssl.h>
    115 #include <openssl/err.h>
    116
    117 -#ifdef HAVE_ERR_remove_thread_state
    118 -#define ERR_remove_state(X) ERR_remove_thread_state(NULL)
    119 -#endif
    120 -
    121 enum enum_ssl_init_error
    122 {
    123 - SSL_INITERR_NOERROR= 0, SSL_INITERR_CERT, SSL_INITERR_KEY,
    124 - SSL_INITERR_NOMATCH, SSL_INITERR_BAD_PATHS, SSL_INITERR_CIPHERS,
    125 + SSL_INITERR_NOERROR= 0, SSL_INITERR_CERT, SSL_INITERR_KEY,
    126 + SSL_INITERR_NOMATCH, SSL_INITERR_BAD_PATHS, SSL_INITERR_CIPHERS,
    127 SSL_INITERR_MEMFAIL, SSL_INITERR_DH, SSL_INITERR_LASTERR
    128 };
    129 const char* sslGetErrString(enum enum_ssl_init_error err);
    130 diff --git a/mysql-test/include/require_openssl_client.inc b/mysql-test/include/require_openssl_client.inc
    131 new file mode 100644
    132 index 0000000..9b19960
    133 --- /dev/null
    134 +++ b/mysql-test/include/require_openssl_client.inc
    135 @@ -0,0 +1,5 @@
    136 +if ($CLIENT_TLS_LIBRARY != "OpenSSL") {
    137 + if ($CLIENT_TLS_LIBRARY != "LibreSSL") {
    138 + skip "Test requires Connector/C with OpenSSL library";
    139 + }
    140 +}
    141 diff --git a/mysql-test/mysql-test-run.pl b/mysql-test/mysql-test-run.pl
    142 index eaec51b..1b28469 100755
    143 --- a/mysql-test/mysql-test-run.pl
    144 +++ b/mysql-test/mysql-test-run.pl
    145 @@ -2307,6 +2307,11 @@ sub environment_setup {
    146 $ENV{'MYSQL_PLUGIN'}= $exe_mysql_plugin;
    147 $ENV{'MYSQL_EMBEDDED'}= $exe_mysql_embedded;
    148
    149 + my $client_config_exe=
    150 + native_path("$bindir/libmariadb/mariadb_config$opt_vs_config/mariadb_config");
    151 + my $tls_info= `$client_config_exe --tlsinfo`;
    152 + ($ENV{CLIENT_TLS_LIBRARY},$ENV{CLIENT_TLS_LIBRARY_VERSION})=
    153 + split(/ /, $tls_info, 2);
    154 my $exe_mysqld= find_mysqld($basedir);
    155 $ENV{'MYSQLD'}= $exe_mysqld;
    156 my $extra_opts= join (" ", @opt_extra_mysqld_opt);
    157 diff --git a/mysql-test/r/openssl_6975,tlsv10.result b/mysql-test/r/openssl_6975,tlsv10.result
    158 index 7a4465f..202e7f4 100644
    159 --- a/mysql-test/r/openssl_6975,tlsv10.result
    160 +++ b/mysql-test/r/openssl_6975,tlsv10.result
    161 @@ -3,11 +3,11 @@ grant select on test.* to ssl_sslv3@localhost require cipher "AES128-SHA";
    162 create user ssl_tls12@localhost;
    163 grant select on test.* to ssl_tls12@localhost require cipher "AES128-SHA256";
    164 TLS1.2 ciphers: user is ok with any cipher
    165 -ERROR 2026 (HY000): SSL connection error: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
    166 -ERROR 2026 (HY000): SSL connection error: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
    167 +ERROR 2026 (HY000): SSL connection error: sslv3 alert handshake failure
    168 +ERROR 2026 (HY000): SSL connection error: sslv3 alert handshake failure
    169 TLS1.2 ciphers: user requires SSLv3 cipher AES128-SHA
    170 -ERROR 2026 (HY000): SSL connection error: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
    171 -ERROR 2026 (HY000): SSL connection error: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
    172 +ERROR 2026 (HY000): SSL connection error: sslv3 alert handshake failure
    173 +ERROR 2026 (HY000): SSL connection error: sslv3 alert handshake failure
    174 TLS1.2 ciphers: user requires TLSv1.2 cipher AES128-SHA256
    175 ERROR 2026 (HY000): SSL connection error: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
    176 ERROR 2026 (HY000): SSL connection error: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
    177 diff --git a/mysql-test/t/openssl_6975.test b/mysql-test/t/openssl_6975.test
    178 index 49889a3..6a82d01 100644
    179 --- a/mysql-test/t/openssl_6975.test
    180 +++ b/mysql-test/t/openssl_6975.test
    181 @@ -4,6 +4,7 @@
    182 # test SSLv3 and TLSv1.2 ciphers when OpenSSL is restricted to SSLv3 or TLSv1.2
    183 #
    184 source include/have_ssl_communication.inc;
    185 +source include/require_openssl_client.inc;
    186
    187 # this is OpenSSL test.
    188
    189 diff --git a/mysql-test/t/ssl_7937.test b/mysql-test/t/ssl_7937.test
    190 index d593b9d..a764579 100644
    191 --- a/mysql-test/t/ssl_7937.test
    192 +++ b/mysql-test/t/ssl_7937.test
    193 @@ -26,6 +26,7 @@ create procedure have_ssl()
    194 # we fake the test result for yassl
    195 let yassl=`select variable_value='Unknown' from information_schema.session_status where variable_name='Ssl_session_cache_mode'`;
    196 if (!$yassl) {
    197 + --replace_result "self signed certificate in certificate chain" "Failed to verify the server certificate" "Error in the certificate." "Failed to verify the server certificate"
    198 --exec $MYSQL --ssl --ssl-verify-server-cert -e "call test.have_ssl()" 2>&1
    199 }
    200 if ($yassl) {
    201 diff --git a/mysql-test/t/ssl_8k_key.test b/mysql-test/t/ssl_8k_key.test
    202 index 27cffdc..9d5b382 100644
    203 --- a/mysql-test/t/ssl_8k_key.test
    204 +++ b/mysql-test/t/ssl_8k_key.test
    205 @@ -1,5 +1,5 @@
    206 -# This test should work in embedded server after we fix mysqltest
    207 --- source include/not_embedded.inc
    208 +# schannel does not support keys longer than 4k
    209 +-- source include/not_windows.inc
    210
    211 -- source include/have_ssl_communication.inc
    212 #
    213 diff --git a/mysys_ssl/CMakeLists.txt b/mysys_ssl/CMakeLists.txt
    214 index 4f6f745..f8a767e 100644
    215 --- a/mysys_ssl/CMakeLists.txt
    216 +++ b/mysys_ssl/CMakeLists.txt
    217 @@ -28,6 +28,7 @@ SET(MYSYS_SSL_HIDDEN_SOURCES
    218 my_sha384.cc
    219 my_sha512.cc
    220 my_md5.cc
    221 + openssl.c
    222 )
    223
    224 SET(MYSYS_SSL_SOURCES
    225 diff --git a/mysys_ssl/my_crypt.cc b/mysys_ssl/my_crypt.cc
    226 index 4393394..da60a10 100644
    227 --- a/mysys_ssl/my_crypt.cc
    228 +++ b/mysys_ssl/my_crypt.cc
    229 @@ -1,6 +1,6 @@
    230 /*
    231 Copyright (c) 2014 Google Inc.
    232 - Copyright (c) 2014, 2015 MariaDB Corporation
    233 + Copyright (c) 2014, 2017 MariaDB Corporation
    234
    235 This program is free software; you can redistribute it and/or modify
    236 it under the terms of the GNU General Public License as published by
    237 @@ -17,7 +17,6 @@
    238
    239 #include <my_global.h>
    240 #include <string.h>
    241 -#include <my_crypt.h>
    242
    243 #ifdef HAVE_YASSL
    244 #include "yassl.cc"
    245 @@ -28,42 +27,53 @@
    246 #include <openssl/err.h>
    247 #include <openssl/rand.h>
    248
    249 -#ifdef HAVE_ERR_remove_thread_state
    250 -#define ERR_remove_state(X) ERR_remove_thread_state(NULL)
    251 +#include <openssl/rand.h>
    252 #endif
    253
    254 -#endif
    255 +#include <my_crypt.h>
    256 +#include <ssl_compat.h>
    257
    258 class MyCTX
    259 {
    260 public:
    261 - EVP_CIPHER_CTX ctx;
    262 - MyCTX() { EVP_CIPHER_CTX_init(&ctx); }
    263 - virtual ~MyCTX() { EVP_CIPHER_CTX_cleanup(&ctx); ERR_remove_state(0); }
    264 + char ctx_buf[EVP_CIPHER_CTX_SIZE];
    265 + EVP_CIPHER_CTX *ctx;
    266 +
    267 + MyCTX()
    268 + {
    269 + ctx= (EVP_CIPHER_CTX *)ctx_buf;
    270 + EVP_CIPHER_CTX_init(ctx);
    271 + }
    272 + virtual ~MyCTX()
    273 + {
    274 + EVP_CIPHER_CTX_cleanup(ctx);
    275 + ERR_remove_state(0);
    276 + }
    277
    278 virtual int init(const EVP_CIPHER *cipher, int encrypt, const uchar *key,
    279 uint klen, const uchar *iv, uint ivlen)
    280 {
    281 + compile_time_assert(MY_AES_CTX_SIZE >= sizeof(MyCTX));
    282 if (unlikely(!cipher))
    283 return MY_AES_BAD_KEYSIZE;
    284
    285 - if (!EVP_CipherInit_ex(&ctx, cipher, NULL, key, iv, encrypt))
    286 + if (!EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, encrypt))
    287 return MY_AES_OPENSSL_ERROR;
    288
    289 - DBUG_ASSERT(EVP_CIPHER_CTX_key_length(&ctx) == (int)klen);
    290 - DBUG_ASSERT(EVP_CIPHER_CTX_iv_length(&ctx) <= (int)ivlen);
    291 + DBUG_ASSERT(EVP_CIPHER_CTX_key_length(ctx) == (int)klen);
    292 + DBUG_ASSERT(EVP_CIPHER_CTX_iv_length(ctx) <= (int)ivlen);
    293
    294 return MY_AES_OK;
    295 }
    296 virtual int update(const uchar *src, uint slen, uchar *dst, uint *dlen)
    297 {
    298 - if (!EVP_CipherUpdate(&ctx, dst, (int*)dlen, src, slen))
    299 + if (!EVP_CipherUpdate(ctx, dst, (int*)dlen, src, slen))
    300 return MY_AES_OPENSSL_ERROR;
    301 return MY_AES_OK;
    302 }
    303 virtual int finish(uchar *dst, uint *dlen)
    304 {
    305 - if (!EVP_CipherFinal_ex(&ctx, dst, (int*)dlen))
    306 + if (!EVP_CipherFinal_ex(ctx, dst, (int*)dlen))
    307 return MY_AES_BAD_DATA;
    308 return MY_AES_OK;
    309 }
    310 @@ -73,7 +83,8 @@ class MyCTX_nopad : public MyCTX
    311 {
    312 public:
    313 const uchar *key;
    314 - int klen;
    315 + uint klen, buf_len;
    316 + uchar oiv[MY_AES_BLOCK_SIZE];
    317
    318 MyCTX_nopad() : MyCTX() { }
    319 ~MyCTX_nopad() { }
    320 @@ -84,32 +95,48 @@ class MyCTX_nopad : public MyCTX
    321 compile_time_assert(MY_AES_CTX_SIZE >= sizeof(MyCTX_nopad));
    322 this->key= key;
    323 this->klen= klen;
    324 + this->buf_len= 0;
    325 + memcpy(oiv, iv, ivlen);
    326 + DBUG_ASSERT(ivlen == 0 || ivlen == sizeof(oiv));
    327 +
    328 int res= MyCTX::init(cipher, encrypt, key, klen, iv, ivlen);
    329 - memcpy(ctx.oiv, iv, ivlen); // in ECB mode OpenSSL doesn't do that itself
    330 - EVP_CIPHER_CTX_set_padding(&ctx, 0);
    331 +
    332 + EVP_CIPHER_CTX_set_padding(ctx, 0);
    333 return res;
    334 }
    335
    336 + int update(const uchar *src, uint slen, uchar *dst, uint *dlen)
    337 + {
    338 + buf_len+= slen;
    339 + return MyCTX::update(src, slen, dst, dlen);
    340 + }
    341 +
    342 int finish(uchar *dst, uint *dlen)
    343 {
    344 - if (ctx.buf_len)
    345 + buf_len %= MY_AES_BLOCK_SIZE;
    346 + if (buf_len)
    347 {
    348 + uchar *buf= EVP_CIPHER_CTX_buf_noconst(ctx);
    349 /*
    350 Not much we can do, block ciphers cannot encrypt data that aren't
    351 a multiple of the block length. At least not without padding.
    352 Let's do something CTR-like for the last partial block.
    353 +
    354 + NOTE this assumes that there are only buf_len bytes in the buf.
    355 + If OpenSSL will change that, we'll need to change the implementation
    356 + of this class too.
    357 */
    358 uchar mask[MY_AES_BLOCK_SIZE];
    359 uint mlen;
    360
    361 my_aes_crypt(MY_AES_ECB, ENCRYPTION_FLAG_ENCRYPT | ENCRYPTION_FLAG_NOPAD,
    362 - ctx.oiv, sizeof(mask), mask, &mlen, key, klen, 0, 0);
    363 + oiv, sizeof(mask), mask, &mlen, key, klen, 0, 0);
    364 DBUG_ASSERT(mlen == sizeof(mask));
    365
    366 - for (int i=0; i < ctx.buf_len; i++)
    367 - dst[i]= ctx.buf[i] ^ mask[i];
    368 + for (uint i=0; i < buf_len; i++)
    369 + dst[i]= buf[i] ^ mask[i];
    370 }
    371 - *dlen= ctx.buf_len;
    372 + *dlen= buf_len;
    373 return MY_AES_OK;
    374 }
    375 };
    376 @@ -153,7 +180,7 @@ class MyCTX_gcm : public MyCTX
    377 {
    378 compile_time_assert(MY_AES_CTX_SIZE >= sizeof(MyCTX_gcm));
    379 int res= MyCTX::init(cipher, encrypt, key, klen, iv, ivlen);
    380 - int real_ivlen= EVP_CIPHER_CTX_iv_length(&ctx);
    381 + int real_ivlen= EVP_CIPHER_CTX_iv_length(ctx);
    382 aad= iv + real_ivlen;
    383 aadlen= ivlen - real_ivlen;
    384 return res;
    385 @@ -167,15 +194,15 @@ class MyCTX_gcm : public MyCTX
    386 before decrypting the data. it can encrypt data piecewise, like, first
    387 half, then the second half, but it must decrypt all at once
    388 */
    389 - if (!ctx.encrypt)
    390 + if (!EVP_CIPHER_CTX_encrypting(ctx))
    391 {
    392 slen-= MY_AES_BLOCK_SIZE;
    393 - if(!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_SET_TAG, MY_AES_BLOCK_SIZE,
    394 + if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, MY_AES_BLOCK_SIZE,
    395 (void*)(src + slen)))
    396 return MY_AES_OPENSSL_ERROR;
    397 }
    398 int unused;
    399 - if (aadlen && !EVP_CipherUpdate(&ctx, NULL, &unused, aad, aadlen))
    400 + if (aadlen && !EVP_CipherUpdate(ctx, NULL, &unused, aad, aadlen))
    401 return MY_AES_OPENSSL_ERROR;
    402 aadlen= 0;
    403 return MyCTX::update(src, slen, dst, dlen);
    404 @@ -184,13 +211,13 @@ class MyCTX_gcm : public MyCTX
    405 int finish(uchar *dst, uint *dlen)
    406 {
    407 int fin;
    408 - if (!EVP_CipherFinal_ex(&ctx, dst, &fin))
    409 + if (!EVP_CipherFinal_ex(ctx, dst, &fin))
    410 return MY_AES_BAD_DATA;
    411 DBUG_ASSERT(fin == 0);
    412
    413 - if (ctx.encrypt)
    414 + if (EVP_CIPHER_CTX_encrypting(ctx))
    415 {
    416 - if(!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_GET_TAG, MY_AES_BLOCK_SIZE, dst))
    417 + if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, MY_AES_BLOCK_SIZE, dst))
    418 return MY_AES_OPENSSL_ERROR;
    419 *dlen= MY_AES_BLOCK_SIZE;
    420 }
    421 @@ -258,12 +285,15 @@ int my_aes_crypt(enum my_aes_mode mode, int flags,
    422 {
    423 void *ctx= alloca(MY_AES_CTX_SIZE);
    424 int res1, res2;
    425 - uint d1, d2;
    426 + uint d1= 0, d2;
    427 if ((res1= my_aes_crypt_init(ctx, mode, flags, key, klen, iv, ivlen)))
    428 return res1;
    429 res1= my_aes_crypt_update(ctx, src, slen, dst, &d1);
    430 res2= my_aes_crypt_finish(ctx, dst + d1, &d2);
    431 - *dlen= d1 + d2;
    432 + if (res1 || res2)
    433 + ERR_remove_state(0); /* in case of failure clear error queue */
    434 + else
    435 + *dlen= d1 + d2;
    436 return res1 ? res1 : res2;
    437 }
    438
    439 diff --git a/mysys_ssl/my_md5.cc b/mysys_ssl/my_md5.cc
    440 index 7139ea9..0105082 100644
    441 --- a/mysys_ssl/my_md5.cc
    442 +++ b/mysys_ssl/my_md5.cc
    443 @@ -1,5 +1,5 @@
    444 /* Copyright (c) 2012, Oracle and/or its affiliates.
    445 - Copyright (c) 2014, SkySQL Ab.
    446 + Copyright (c) 2017, MariaDB Corporation
    447
    448 This program is free software; you can redistribute it and/or modify
    449 it under the terms of the GNU General Public License as published by
    450 @@ -29,38 +29,31 @@
    451
    452 #if defined(HAVE_YASSL)
    453 #include "md5.hpp"
    454 +#include <ssl_compat.h>
    455
    456 -typedef TaoCrypt::MD5 MD5_CONTEXT;
    457 +typedef TaoCrypt::MD5 EVP_MD_CTX;
    458
    459 -static void md5_init(MD5_CONTEXT *context)
    460 +static void md5_init(EVP_MD_CTX *context)
    461 {
    462 - context= new(context) MD5_CONTEXT;
    463 + context= new(context) EVP_MD_CTX;
    464 context->Init();
    465 }
    466
    467 -/*
    468 - this is a variant of md5_init to be used in this file only.
    469 - does nothing for yassl, because the context's constructor was called automatically.
    470 -*/
    471 -static void md5_init_fast(MD5_CONTEXT *context)
    472 -{
    473 -}
    474 -
    475 -static void md5_input(MD5_CONTEXT *context, const uchar *buf, unsigned len)
    476 +static void md5_input(EVP_MD_CTX *context, const uchar *buf, unsigned len)
    477 {
    478 context->Update((const TaoCrypt::byte *) buf, len);
    479 }
    480
    481 -static void md5_result(MD5_CONTEXT *context, uchar digest[MD5_HASH_SIZE])
    482 +static void md5_result(EVP_MD_CTX *context, uchar digest[MD5_HASH_SIZE])
    483 {
    484 context->Final((TaoCrypt::byte *) digest);
    485 }
    486
    487 #elif defined(HAVE_OPENSSL)
    488 #include <openssl/evp.h>
    489 -typedef EVP_MD_CTX MD5_CONTEXT;
    490 +#include <ssl_compat.h>
    491
    492 -static void md5_init(MD5_CONTEXT *context)
    493 +static void md5_init(EVP_MD_CTX *context)
    494 {
    495 EVP_MD_CTX_init(context);
    496 #ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
    497 @@ -70,17 +63,12 @@ static void md5_init(MD5_CONTEXT *context)
    498 EVP_DigestInit_ex(context, EVP_md5(), NULL);
    499 }
    500
    501 -static void md5_init_fast(MD5_CONTEXT *context)
    502 -{
    503 - md5_init(context);
    504 -}
    505 -
    506 -static void md5_input(MD5_CONTEXT *context, const uchar *buf, unsigned len)
    507 +static void md5_input(EVP_MD_CTX *context, const uchar *buf, unsigned len)
    508 {
    509 EVP_DigestUpdate(context, buf, len);
    510 }
    511
    512 -static void md5_result(MD5_CONTEXT *context, uchar digest[MD5_HASH_SIZE])
    513 +static void md5_result(EVP_MD_CTX *context, uchar digest[MD5_HASH_SIZE])
    514 {
    515 EVP_DigestFinal_ex(context, digest, NULL);
    516 EVP_MD_CTX_cleanup(context);
    517 @@ -99,58 +87,58 @@ static void md5_result(MD5_CONTEXT *context, uchar digest[MD5_HASH_SIZE])
    518 */
    519 void my_md5(uchar *digest, const char *buf, size_t len)
    520 {
    521 - MD5_CONTEXT md5_context;
    522 -
    523 - md5_init_fast(&md5_context);
    524 - md5_input(&md5_context, (const uchar *)buf, len);
    525 - md5_result(&md5_context, digest);
    526 + char ctx_buf[EVP_MD_CTX_SIZE];
    527 + EVP_MD_CTX * const ctx= (EVP_MD_CTX*)ctx_buf;
    528 + md5_init(ctx);
    529 + md5_input(ctx, (const uchar *)buf, len);
    530 + md5_result(ctx, digest);
    531 }
    532
    533
    534 /**
    535 Wrapper function to compute MD5 message digest for
    536 - two messages in order to emulate md5(msg1, msg2).
    537 + many messages, concatenated.
    538
    539 @param digest [out] Computed MD5 digest
    540 @param buf1 [in] First message
    541 @param len1 [in] Length of first message
    542 - @param buf2 [in] Second message
    543 - @param len2 [in] Length of second message
    544 + ...
    545 + @param bufN [in] NULL terminates the list of buf,len pairs.
    546
    547 @return void
    548 */
    549 void my_md5_multi(uchar *digest, ...)
    550 {
    551 va_list args;
    552 - va_start(args, digest);
    553 -
    554 - MD5_CONTEXT md5_context;
    555 const uchar *str;
    556 + char ctx_buf[EVP_MD_CTX_SIZE];
    557 + EVP_MD_CTX * const ctx= (EVP_MD_CTX*)ctx_buf;
    558 + va_start(args, digest);
    559
    560 - md5_init_fast(&md5_context);
    561 + md5_init(ctx);
    562 for (str= va_arg(args, const uchar*); str; str= va_arg(args, const uchar*))
    563 - md5_input(&md5_context, str, va_arg(args, size_t));
    564 + md5_input(ctx, str, va_arg(args, size_t));
    565
    566 - md5_result(&md5_context, digest);
    567 + md5_result(ctx, digest);
    568 va_end(args);
    569 }
    570
    571 size_t my_md5_context_size()
    572 {
    573 - return sizeof(MD5_CONTEXT);
    574 + return EVP_MD_CTX_SIZE;
    575 }
    576
    577 void my_md5_init(void *context)
    578 {
    579 - md5_init((MD5_CONTEXT *)context);
    580 + md5_init((EVP_MD_CTX *)context);
    581 }
    582
    583 void my_md5_input(void *context, const uchar *buf, size_t len)
    584 {
    585 - md5_input((MD5_CONTEXT *)context, buf, len);
    586 + md5_input((EVP_MD_CTX *)context, buf, len);
    587 }
    588
    589 void my_md5_result(void *context, uchar *digest)
    590 {
    591 - md5_result((MD5_CONTEXT *)context, digest);
    592 + md5_result((EVP_MD_CTX *)context, digest);
    593 }
    594 diff --git a/mysys_ssl/openssl.c b/mysys_ssl/openssl.c
    595 new file mode 100644
    596 index 0000000..a3f1ca2
    597 --- /dev/null
    598 +++ b/mysys_ssl/openssl.c
    599 @@ -0,0 +1,71 @@
    600 +/*
    601 + Copyright (c) 2017, MariaDB Corporation.
    602 +
    603 + This program is free software; you can redistribute it and/or modify
    604 + it under the terms of the GNU General Public License as published by
    605 + the Free Software Foundation; version 2 of the License.
    606 +
    607 + This program is distributed in the hope that it will be useful,
    608 + but WITHOUT ANY WARRANTY; without even the implied warranty of
    609 + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    610 + GNU General Public License for more details.
    611 +
    612 + You should have received a copy of the GNU General Public License
    613 + along with this program; if not, write to the Free Software
    614 + Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */
    615 +
    616 +#include <my_global.h>
    617 +#include <ssl_compat.h>
    618 +
    619 +#ifdef HAVE_YASSL
    620 +
    621 +int check_openssl_compatibility()
    622 +{
    623 + return 0;
    624 +}
    625 +#else
    626 +#include <openssl/evp.h>
    627 +
    628 +#ifdef HAVE_OPENSSL11
    629 +typedef void *(*CRYPTO_malloc_t)(size_t, const char *, int);
    630 +#endif
    631 +
    632 +#ifdef HAVE_OPENSSL10
    633 +typedef void *(*CRYPTO_malloc_t)(size_t);
    634 +#define CRYPTO_malloc malloc
    635 +#define CRYPTO_realloc realloc
    636 +#define CRYPTO_free free
    637 +#endif
    638 +
    639 +static uint allocated_size, allocated_count;
    640 +
    641 +static void *coc_malloc(size_t size)
    642 +{
    643 + allocated_size+= size;
    644 + allocated_count++;
    645 + return malloc(size);
    646 +}
    647 +
    648 +int check_openssl_compatibility()
    649 +{
    650 + EVP_CIPHER_CTX *evp_ctx;
    651 + EVP_MD_CTX *md5_ctx;
    652 +
    653 + CRYPTO_set_mem_functions((CRYPTO_malloc_t)coc_malloc, CRYPTO_realloc, CRYPTO_free);
    654 +
    655 + allocated_size= allocated_count= 0;
    656 + evp_ctx= EVP_CIPHER_CTX_new();
    657 + EVP_CIPHER_CTX_free(evp_ctx);
    658 + if (allocated_count != 1 || allocated_size > EVP_CIPHER_CTX_SIZE)
    659 + return 1;
    660 +
    661 + allocated_size= allocated_count= 0;
    662 + md5_ctx= EVP_MD_CTX_create();
    663 + EVP_MD_CTX_destroy(md5_ctx);
    664 + if (allocated_count != 1 || allocated_size > EVP_MD_CTX_SIZE)
    665 + return 1;
    666 +
    667 + CRYPTO_set_mem_functions(CRYPTO_malloc, CRYPTO_realloc, CRYPTO_free);
    668 + return 0;
    669 +}
    670 +#endif
    671 diff --git a/mysys_ssl/yassl.cc b/mysys_ssl/yassl.cc
    672 index e9f8e65..268589d 100644
    673 --- a/mysys_ssl/yassl.cc
    674 +++ b/mysys_ssl/yassl.cc
    675 @@ -45,7 +45,6 @@ typedef struct
    676 int buf_len;
    677 int final_used;
    678 uchar tao_buf[sizeof(TaoCrypt::AES)]; // TaoCrypt::AES object
    679 - uchar oiv[TaoCrypt::AES::BLOCK_SIZE]; // original IV
    680 uchar buf[TaoCrypt::AES::BLOCK_SIZE]; // last partial input block
    681 uchar final[TaoCrypt::AES::BLOCK_SIZE]; // last decrypted (output) block
    682 } EVP_CIPHER_CTX;
    683 @@ -98,10 +97,7 @@ static int EVP_CipherInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
    684 : TaoCrypt::DECRYPTION, cipher->mode);
    685 TAO(ctx)->SetKey(key, cipher->key_len);
    686 if (iv)
    687 - {
    688 TAO(ctx)->SetIV(iv);
    689 - memcpy(ctx->oiv, iv, TaoCrypt::AES::BLOCK_SIZE);
    690 - }
    691 ctx->encrypt= enc;
    692 ctx->key_len= cipher->key_len;
    693 ctx->flags|= cipher->mode == TaoCrypt::CBC ? EVP_CIPH_CBC_MODE : EVP_CIPH_ECB_MODE;
    694 diff --git a/sql-common/client.c b/sql-common/client.c
    695 index da18a0f..e3280a1 100644
    696 --- a/sql-common/client.c
    697 +++ b/sql-common/client.c
    698 @@ -105,6 +105,7 @@ my_bool net_flush(NET *net);
    699 #endif
    700
    701 #include "client_settings.h"
    702 +#include <ssl_compat.h>
    703 #include <sql_common.h>
    704 #include <mysql/client_plugin.h>
    705 #include <my_context.h>
    706 @@ -1770,9 +1771,8 @@ mysql_get_ssl_cipher(MYSQL *mysql __attribute__((unused)))
    707
    708 #if defined(HAVE_OPENSSL)
    709
    710 -#if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(HAVE_YASSL)
    711 +#ifdef HAVE_X509_check_host
    712 #include <openssl/x509v3.h>
    713 -#define HAVE_X509_check_host
    714 #endif
    715
    716 static int ssl_verify_server_cert(Vio *vio, const char* server_hostname, const char **errptr)
    717 @@ -1844,7 +1844,7 @@ static int ssl_verify_server_cert(Vio *vio, const char* server_hostname, const c
    718 goto error;
    719 }
    720
    721 - cn= (char *) ASN1_STRING_data(cn_asn1);
    722 + cn= (char *) ASN1_STRING_get0_data(cn_asn1);
    723
    724 if ((size_t)ASN1_STRING_length(cn_asn1) != strlen(cn))
    725 {
    726 diff --git a/sql/mysqld.cc b/sql/mysqld.cc
    727 index 0de9d7a..3a92192 100644
    728 --- a/sql/mysqld.cc
    729 +++ b/sql/mysqld.cc
    730 @@ -338,9 +338,13 @@ static PSI_thread_key key_thread_handle_con_sockets;
    731 static PSI_thread_key key_thread_handle_shutdown;
    732 #endif /* __WIN__ */
    733
    734 -#if defined (HAVE_OPENSSL) && !defined(HAVE_YASSL)
    735 +#ifdef HAVE_OPENSSL
    736 +#include <ssl_compat.h>
    737 +
    738 +#ifdef HAVE_OPENSSL10
    739 static PSI_rwlock_key key_rwlock_openssl;
    740 #endif
    741 +#endif
    742 #endif /* HAVE_PSI_INTERFACE */
    743
    744 #ifdef HAVE_NPTL
    745 @@ -987,7 +991,7 @@ PSI_rwlock_key key_rwlock_LOCK_grant, key_rwlock_LOCK_logger,
    746
    747 static PSI_rwlock_info all_server_rwlocks[]=
    748 {
    749 -#if defined (HAVE_OPENSSL) && !defined(HAVE_YASSL)
    750 +#ifdef HAVE_OPENSSL10
    751 { &key_rwlock_openssl, "CRYPTO_dynlock_value::lock", 0},
    752 #endif
    753 { &key_rwlock_LOCK_grant, "LOCK_grant", PSI_FLAG_GLOBAL},
    754 @@ -1457,7 +1461,7 @@ scheduler_functions *thread_scheduler= &thread_scheduler_struct,
    755
    756 #ifdef HAVE_OPENSSL
    757 #include <openssl/crypto.h>
    758 -#ifndef HAVE_YASSL
    759 +#ifdef HAVE_OPENSSL10
    760 typedef struct CRYPTO_dynlock_value
    761 {
    762 mysql_rwlock_t lock;
    763 @@ -1468,7 +1472,7 @@ static openssl_lock_t *openssl_dynlock_create(const char *, int);
    764 static void openssl_dynlock_destroy(openssl_lock_t *, const char *, int);
    765 static void openssl_lock_function(int, int, const char *, int);
    766 static void openssl_lock(int, openssl_lock_t *, const char *, int);
    767 -#endif
    768 +#endif /* HAVE_OPENSSL10 */
    769 char *des_key_file;
    770 #ifndef EMBEDDED_LIBRARY
    771 struct st_VioSSLFd *ssl_acceptor_fd;
    772 @@ -2244,11 +2248,11 @@ static void clean_up_mutexes()
    773 mysql_mutex_destroy(&LOCK_global_index_stats);
    774 #ifdef HAVE_OPENSSL
    775 mysql_mutex_destroy(&LOCK_des_key_file);
    776 -#ifndef HAVE_YASSL
    777 +#ifdef HAVE_OPENSSL10
    778 for (int i= 0; i < CRYPTO_num_locks(); ++i)
    779 mysql_rwlock_destroy(&openssl_stdlocks[i].lock);
    780 OPENSSL_free(openssl_stdlocks);
    781 -#endif /* HAVE_YASSL */
    782 +#endif /* HAVE_OPENSSL10 */
    783 #endif /* HAVE_OPENSSL */
    784 #ifdef HAVE_REPLICATION
    785 mysql_mutex_destroy(&LOCK_rpl_status);
    786 @@ -4038,6 +4042,14 @@ static int init_common_variables()
    787 return 1;
    788 }
    789
    790 +#ifdef HAVE_OPENSSL
    791 + if (check_openssl_compatibility())
    792 + {
    793 + sql_print_error("Incompatible OpenSSL version. Cannot continue...");
    794 + return 1;
    795 + }
    796 +#endif
    797 +
    798 if (init_thread_environment() ||
    799 mysql_init_variables())
    800 return 1;
    801 @@ -4584,7 +4596,7 @@ static int init_thread_environment()
    802 #ifdef HAVE_OPENSSL
    803 mysql_mutex_init(key_LOCK_des_key_file,
    804 &LOCK_des_key_file, MY_MUTEX_INIT_FAST);
    805 -#ifndef HAVE_YASSL
    806 +#ifdef HAVE_OPENSSL10
    807 openssl_stdlocks= (openssl_lock_t*) OPENSSL_malloc(CRYPTO_num_locks() *
    808 sizeof(openssl_lock_t));
    809 for (int i= 0; i < CRYPTO_num_locks(); ++i)
    810 @@ -4593,8 +4605,8 @@ static int init_thread_environment()
    811 CRYPTO_set_dynlock_destroy_callback(openssl_dynlock_destroy);
    812 CRYPTO_set_dynlock_lock_callback(openssl_lock);
    813 CRYPTO_set_locking_callback(openssl_lock_function);
    814 -#endif
    815 -#endif
    816 +#endif /* HAVE_OPENSSL10 */
    817 +#endif /* HAVE_OPENSSL */
    818 mysql_rwlock_init(key_rwlock_LOCK_sys_init_connect, &LOCK_sys_init_connect);
    819 mysql_rwlock_init(key_rwlock_LOCK_sys_init_slave, &LOCK_sys_init_slave);
    820 mysql_rwlock_init(key_rwlock_LOCK_grant, &LOCK_grant);
    821 @@ -4627,7 +4639,7 @@ static int init_thread_environment()
    822 }
    823
    824
    825 -#if defined(HAVE_OPENSSL) && !defined(HAVE_YASSL)
    826 +#ifdef HAVE_OPENSSL10
    827 static openssl_lock_t *openssl_dynlock_create(const char *file, int line)
    828 {
    829 openssl_lock_t *lock= new openssl_lock_t;
    830 @@ -4687,8 +4699,7 @@ static void openssl_lock(int mode, openssl_lock_t *lock, const char *file,
    831 abort();
    832 }
    833 }
    834 -#endif /* HAVE_OPENSSL */
    835 -
    836 +#endif /* HAVE_OPENSSL10 */
    837
    838 static void init_ssl()
    839 {
    840 diff --git a/sql/slave.cc b/sql/slave.cc
    841 index da394ff..2096ed1 100644
    842 --- a/sql/slave.cc
    843 +++ b/sql/slave.cc
    844 @@ -40,6 +40,7 @@
    845 #include <my_dir.h>
    846 #include <sql_common.h>
    847 #include <errmsg.h>
    848 +#include <ssl_compat.h>
    849 #include <mysqld_error.h>
    850 #include <mysys_err.h>
    851 #include "rpl_handler.h"
    852 @@ -60,7 +61,6 @@
    853 #include "debug_sync.h"
    854 #include "rpl_parallel.h"
    855
    856 -
    857 #define FLAGSTR(V,F) ((V)&(F)?#F" ":"")
    858
    859 #define MAX_SLAVE_RETRY_PAUSE 5
    860 @@ -4506,9 +4506,7 @@ log space");
    861
    862 DBUG_LEAVE; // Must match DBUG_ENTER()
    863 my_thread_end();
    864 -#ifdef HAVE_OPENSSL
    865 ERR_remove_state(0);
    866 -#endif
    867 pthread_exit(0);
    868 return 0; // Avoid compiler warnings
    869 }
    870 @@ -5167,9 +5165,7 @@ pthread_handler_t handle_slave_sql(void *arg)
    871
    872 DBUG_LEAVE; // Must match DBUG_ENTER()
    873 my_thread_end();
    874 -#ifdef HAVE_OPENSSL
    875 ERR_remove_state(0);
    876 -#endif
    877 pthread_exit(0);
    878 return 0; // Avoid compiler warnings
    879 }
    880 diff --git a/vio/vio.c b/vio/vio.c
    881 index e3bc8ca..44d0609 100644
    882 --- a/vio/vio.c
    883 +++ b/vio/vio.c
    884 @@ -22,6 +22,7 @@
    885 */
    886
    887 #include "vio_priv.h"
    888 +#include "ssl_compat.h"
    889
    890 #ifdef _WIN32
    891
    892 diff --git a/vio/viosslfactories.c b/vio/viosslfactories.c
    893 index 52b624d..71ef287 100644
    894 --- a/vio/viosslfactories.c
    895 +++ b/vio/viosslfactories.c
    896 @@ -15,6 +15,7 @@
    897 Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */
    898
    899 #include "vio_priv.h"
    900 +#include <ssl_compat.h>
    901
    902 #ifdef HAVE_OPENSSL
    903 #ifndef HAVE_YASSL
    904 @@ -26,49 +27,56 @@ static my_bool ssl_algorithms_added = FALSE;
    905 static my_bool ssl_error_strings_loaded= FALSE;
    906
    907 /* the function below was generated with "openssl dhparam -2 -C 2048" */
    908 +
    909 static
    910 DH *get_dh2048()
    911 {
    912 - static unsigned char dh2048_p[]={
    913 - 0xA1,0xBB,0x7C,0x20,0xC5,0x5B,0xC0,0x7B,0x21,0x8B,0xD6,0xA8,
    914 - 0x15,0xFC,0x3B,0xBA,0xAB,0x9F,0xDF,0x68,0xC4,0x79,0x78,0x0D,
    915 - 0xC1,0x12,0x64,0xE4,0x15,0xC9,0x66,0xDB,0xF6,0xCB,0xB3,0x39,
    916 - 0x02,0x5B,0x78,0x62,0xFB,0x09,0xAE,0x09,0x6B,0xDD,0xD4,0x5D,
    917 - 0x97,0xBC,0xDC,0x7F,0xE6,0xD6,0xF1,0xCB,0xF5,0xEB,0xDA,0xA7,
    918 - 0x2E,0x5A,0x43,0x2B,0xE9,0x40,0xE2,0x85,0x00,0x1C,0xC0,0x0A,
    919 - 0x98,0x77,0xA9,0x31,0xDE,0x0B,0x75,0x4D,0x1E,0x1F,0x16,0x83,
    920 - 0xCA,0xDE,0xBD,0x21,0xFC,0xC1,0x82,0x37,0x36,0x33,0x0B,0x66,
    921 - 0x06,0x3C,0xF3,0xAF,0x21,0x57,0x57,0x80,0xF6,0x94,0x1B,0xA9,
    922 - 0xD4,0xF6,0x8F,0x18,0x62,0x0E,0xC4,0x22,0xF9,0x5B,0x62,0xCC,
    923 - 0x3F,0x19,0x95,0xCF,0x4B,0x00,0xA6,0x6C,0x0B,0xAF,0x9F,0xD5,
    924 - 0xFA,0x3D,0x6D,0xDA,0x30,0x83,0x07,0x91,0xAC,0x15,0xFF,0x8F,
    925 - 0x59,0x54,0xEA,0x25,0xBC,0x4E,0xEB,0x6A,0x54,0xDF,0x75,0x09,
    926 - 0x72,0x0F,0xEF,0x23,0x70,0xE0,0xA8,0x04,0xEA,0xFF,0x90,0x54,
    927 - 0xCD,0x84,0x18,0xC0,0x75,0x91,0x99,0x0F,0xA1,0x78,0x0C,0x07,
    928 - 0xB7,0xC5,0xDE,0x55,0x06,0x7B,0x95,0x68,0x2C,0x33,0x39,0xBC,
    929 - 0x2C,0xD0,0x6D,0xDD,0xFA,0xDC,0xB5,0x8F,0x82,0x39,0xF8,0x67,
    930 - 0x44,0xF1,0xD8,0xF7,0x78,0x11,0x9A,0x77,0x9B,0x53,0x47,0xD6,
    931 - 0x2B,0x5D,0x67,0xB8,0xB7,0xBC,0xC1,0xD7,0x79,0x62,0x15,0xC2,
    932 - 0xC5,0x83,0x97,0xA7,0xF8,0xB4,0x9C,0xF6,0x8F,0x9A,0xC7,0xDA,
    933 - 0x1B,0xBB,0x87,0x07,0xA7,0x71,0xAD,0xB2,0x8A,0x50,0xF8,0x26,
    934 - 0x12,0xB7,0x3E,0x0B,
    935 - };
    936 - static unsigned char dh2048_g[]={
    937 - 0x02,
    938 - };
    939 - DH *dh;
    940 -
    941 - if ((dh=DH_new()) == NULL) return(NULL);
    942 - dh->p=BN_bin2bn(dh2048_p,sizeof(dh2048_p),NULL);
    943 - dh->g=BN_bin2bn(dh2048_g,sizeof(dh2048_g),NULL);
    944 - if ((dh->p == NULL) || (dh->g == NULL))
    945 - { DH_free(dh); return(NULL); }
    946 - return(dh);
    947 + static unsigned char dhp_2048[] = {
    948 + 0xA1,0xBB,0x7C,0x20,0xC5,0x5B,0xC0,0x7B,0x21,0x8B,0xD6,0xA8,
    949 + 0x15,0xFC,0x3B,0xBA,0xAB,0x9F,0xDF,0x68,0xC4,0x79,0x78,0x0D,
    950 + 0xC1,0x12,0x64,0xE4,0x15,0xC9,0x66,0xDB,0xF6,0xCB,0xB3,0x39,
    951 + 0x02,0x5B,0x78,0x62,0xFB,0x09,0xAE,0x09,0x6B,0xDD,0xD4,0x5D,
    952 + 0x97,0xBC,0xDC,0x7F,0xE6,0xD6,0xF1,0xCB,0xF5,0xEB,0xDA,0xA7,
    953 + 0x2E,0x5A,0x43,0x2B,0xE9,0x40,0xE2,0x85,0x00,0x1C,0xC0,0x0A,
    954 + 0x98,0x77,0xA9,0x31,0xDE,0x0B,0x75,0x4D,0x1E,0x1F,0x16,0x83,
    955 + 0xCA,0xDE,0xBD,0x21,0xFC,0xC1,0x82,0x37,0x36,0x33,0x0B,0x66,
    956 + 0x06,0x3C,0xF3,0xAF,0x21,0x57,0x57,0x80,0xF6,0x94,0x1B,0xA9,
    957 + 0xD4,0xF6,0x8F,0x18,0x62,0x0E,0xC4,0x22,0xF9,0x5B,0x62,0xCC,
    958 + 0x3F,0x19,0x95,0xCF,0x4B,0x00,0xA6,0x6C,0x0B,0xAF,0x9F,0xD5,
    959 + 0xFA,0x3D,0x6D,0xDA,0x30,0x83,0x07,0x91,0xAC,0x15,0xFF,0x8F,
    960 + 0x59,0x54,0xEA,0x25,0xBC,0x4E,0xEB,0x6A,0x54,0xDF,0x75,0x09,
    961 + 0x72,0x0F,0xEF,0x23,0x70,0xE0,0xA8,0x04,0xEA,0xFF,0x90,0x54,
    962 + 0xCD,0x84,0x18,0xC0,0x75,0x91,0x99,0x0F,0xA1,0x78,0x0C,0x07,
    963 + 0xB7,0xC5,0xDE,0x55,0x06,0x7B,0x95,0x68,0x2C,0x33,0x39,0xBC,
    964 + 0x2C,0xD0,0x6D,0xDD,0xFA,0xDC,0xB5,0x8F,0x82,0x39,0xF8,0x67,
    965 + 0x44,0xF1,0xD8,0xF7,0x78,0x11,0x9A,0x77,0x9B,0x53,0x47,0xD6,
    966 + 0x2B,0x5D,0x67,0xB8,0xB7,0xBC,0xC1,0xD7,0x79,0x62,0x15,0xC2,
    967 + 0xC5,0x83,0x97,0xA7,0xF8,0xB4,0x9C,0xF6,0x8F,0x9A,0xC7,0xDA,
    968 + 0x1B,0xBB,0x87,0x07,0xA7,0x71,0xAD,0xB2,0x8A,0x50,0xF8,0x26,
    969 + 0x12,0xB7,0x3E,0x0B,
    970 + };
    971 + static unsigned char dhg_2048[] = {
    972 + 0x02
    973 + };
    974 + DH *dh = DH_new();
    975 + BIGNUM *dhp_bn, *dhg_bn;
    976 +
    977 + if (dh == NULL)
    978 + return NULL;
    979 + dhp_bn = BN_bin2bn(dhp_2048, sizeof (dhp_2048), NULL);
    980 + dhg_bn = BN_bin2bn(dhg_2048, sizeof (dhg_2048), NULL);
    981 + if (dhp_bn == NULL || dhg_bn == NULL
    982 + || !DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) {
    983 + DH_free(dh);
    984 + BN_free(dhp_bn);
    985 + BN_free(dhg_bn);
    986 + return NULL;
    987 + }
    988 + return dh;
    989 }
    990
    991 -
    992 static const char*
    993 -ssl_error_string[] =
    994 +ssl_error_string[] =
    995 {
    996 "No error",
    997 "Unable to get certificate",
    998 @@ -148,9 +156,7 @@ static void check_ssl_init()
    999 if (!ssl_algorithms_added)
    1000 {
    1001 ssl_algorithms_added= TRUE;
    1002 - SSL_library_init();
    1003 - OpenSSL_add_all_algorithms();
    1004 -
    1005 + OPENSSL_init_ssl(0, NULL);
    1006 }
    1007
    1008 if (!ssl_error_strings_loaded)