|
|
@@ -1,62 +0,0 @@
|
|
1
|
|
-From 5ae2a70a135062a025d8fabc104eeae3a2c53a7a Mon Sep 17 00:00:00 2001
|
|
2
|
|
-From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
|
|
3
|
|
-Date: Tue, 17 Jun 2014 10:09:24 +0100
|
|
4
|
|
-Subject: [PATCH] Relax libssl checks
|
|
5
|
|
-
|
|
6
|
|
|
|
7
|
|
- src/main/version.c | 35 ++++++++++++++++++++++++++++-------
|
|
8
|
|
- 1 file changed, 28 insertions(+), 7 deletions(-)
|
|
9
|
|
-
|
|
10
|
|
|
|
11
|
|
-+++ b/src/main/version.c
|
|
12
|
|
-@@ -34,7 +34,12 @@ RCSID("$Id: af82d4126a65d94929c22f44da2b
|
|
13
|
|
-
|
|
14
|
|
- static long ssl_built = OPENSSL_VERSION_NUMBER;
|
|
15
|
|
-
|
|
16
|
|
--/** Check build and linked versions of OpenSSL match
|
|
17
|
|
-+/** Check built and linked versions of OpenSSL match
|
|
18
|
|
-+ *
|
|
19
|
|
-+ * OpenSSL version number consists of:
|
|
20
|
|
-+ * MMNNFFPPS: major minor fix patch status
|
|
21
|
|
-+ *
|
|
22
|
|
-+ * Where status >= 0 && < 10 means beta, and status 10 means release.
|
|
23
|
|
- *
|
|
24
|
|
- * Startup check for whether the linked version of OpenSSL matches the
|
|
25
|
|
- * version the server was built against.
|
|
26
|
|
-@@ -54,14 +59,30 @@ int ssl_check_version(int allow_vulnerab
|
|
27
|
|
-
|
|
28
|
|
- ssl_linked = SSLeay();
|
|
29
|
|
-
|
|
30
|
|
-- if (ssl_linked != ssl_built) {
|
|
31
|
|
-- radlog(L_ERR, "libssl version mismatch."
|
|
32
|
|
-- " Built with: %lx\n Linked: %lx",
|
|
33
|
|
-- (unsigned long) ssl_built,
|
|
34
|
|
-- (unsigned long) ssl_linked);
|
|
35
|
|
-+ /*
|
|
36
|
|
-+ * Status mismatch always triggers error.
|
|
37
|
|
-+ */
|
|
38
|
|
-+ if ((ssl_linked & 0x00000000f) != (ssl_built & 0x00000000f)) {
|
|
39
|
|
-+ mismatch:
|
|
40
|
|
-+ radlog(L_ERR, "libssl version mismatch. built: %lx linked: %lx",
|
|
41
|
|
-+ (unsigned long) ssl_built, (unsigned long) ssl_linked);
|
|
42
|
|
-
|
|
43
|
|
- return -1;
|
|
44
|
|
-- };
|
|
45
|
|
-+ }
|
|
46
|
|
-+
|
|
47
|
|
-+ /*
|
|
48
|
|
-+ * Use the OpenSSH approach and relax fix checks after version
|
|
49
|
|
-+ * 1.0.0 and only allow moving backwards within a patch
|
|
50
|
|
-+ * series.
|
|
51
|
|
-+ */
|
|
52
|
|
-+ if (ssl_built & 0xff) {
|
|
53
|
|
-+ if ((ssl_built & 0xffff) != (ssl_linked & 0xffff) ||
|
|
54
|
|
-+ (ssl_built & 0x0000ff) > (ssl_linked & 0x0000ff)) goto mismatch;
|
|
55
|
|
-+ /*
|
|
56
|
|
-+ * Before 1.0.0 we require the same major minor and fix version
|
|
57
|
|
-+ * and ignore the patch number.
|
|
58
|
|
-+ */
|
|
59
|
|
-+ } else if ((ssl_built & 0xffffff) != (ssl_linked & 0xffffff)) goto mismatch;
|
|
60
|
|
-
|
|
61
|
|
- if (!allow_vulnerable) {
|
|
62
|
|
- /* Check for bad versions */
|
Daniel Golle
10 years ago