Skip to content

Commit f33d611

Browse files
rheniumrhenium
committed
Require LibreSSL 3.9 or later
Drop support for LibreSSL 3.1-3.8. LibreSSL 3.8 has reached its EOL in 2024-10.
1 parent b9ef9cc commit f33d611

File tree

14 files changed

+30
-63
lines changed

14 files changed

+30
-63
lines changed

‎.github/workflows/test.yml‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -73,16 +73,8 @@ jobs:
7373
- openssl-3.4.0 # Supported until 2026-10-22
7474
- openssl-master
7575
# http://www.libressl.org/releases.html
76-
- libressl-3.1.5 # EOL
77-
- libressl-3.2.7 # EOL
78-
- libressl-3.3.6 # EOL
79-
- libressl-3.4.3 # EOL
80-
- libressl-3.5.3 # EOL
81-
- libressl-3.6.3 # EOL
82-
- libressl-3.7.3 # EOL
83-
- libressl-3.8.4 # EOL 2024-10-16
8476
- libressl-3.9.2 # Supported until 2025-04-05
85-
- libressl-4.0.0
77+
- libressl-4.0.0 # Supported until 2025-10-08
8678
include:
8779
- { name-extra: 'with fips provider', openssl: openssl-3.0.15, fips-enabled: true }
8880
- { name-extra: 'with fips provider', openssl: openssl-3.1.7, fips-enabled: true }

‎ext/openssl/extconf.rb‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -120,14 +120,14 @@ def find_openssl_library
120120

121121
version_ok = if have_macro("LIBRESSL_VERSION_NUMBER", "openssl/opensslv.h")
122122
is_libressl = true
123-
checking_for("LibreSSL version >= 3.1.0") {
124-
try_static_assert("LIBRESSL_VERSION_NUMBER >= 0x30100000L", "openssl/opensslv.h") }
123+
checking_for("LibreSSL version >= 3.9.0") {
124+
try_static_assert("LIBRESSL_VERSION_NUMBER >= 0x30900000L", "openssl/opensslv.h") }
125125
else
126126
checking_for("OpenSSL version >= 1.0.2") {
127127
try_static_assert("OPENSSL_VERSION_NUMBER >= 0x10002000L", "openssl/opensslv.h") }
128128
end
129129
unless version_ok
130-
raise "OpenSSL >= 1.0.2 or LibreSSL >= 3.1.0 is required"
130+
raise "OpenSSL >= 1.0.2 or LibreSSL >= 3.9.0 is required"
131131
end
132132

133133
# Prevent wincrypt.h from being included, which defines conflicting macro with openssl/x509.h
@@ -149,9 +149,6 @@ def find_openssl_library
149149
have_func("ENGINE_load_#{name}()", "openssl/engine.h")
150150
}
151151

152-
# missing in libressl < 3.5
153-
have_func("i2d_re_X509_tbs(NULL, NULL)", x509_h)
154-
155152
# added in 1.1.0
156153
if !have_struct_member("SSL", "ctx", "openssl/ssl.h") || is_libressl
157154
$defs.push("-DHAVE_OPAQUE_OPENSSL")

‎ext/openssl/ossl_kdf.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* Copyright (C) 2007, 2017 Ruby/OpenSSL Project Authors
44
*/
55
#include "ossl.h"
6-
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_LIBRESSL_PREREQ(3, 6, 0)
6+
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_IS_LIBRESSL
77
# include <openssl/kdf.h>
88
#endif
99

@@ -141,7 +141,7 @@ kdf_scrypt(int argc, VALUE *argv, VALUE self)
141141
}
142142
#endif
143143

144-
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_LIBRESSL_PREREQ(3, 6, 0)
144+
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_IS_LIBRESSL
145145
/*
146146
* call-seq:
147147
* KDF.hkdf(ikm, salt:, info:, length:, hash:) -> String
@@ -305,7 +305,7 @@ Init_ossl_kdf(void)
305305
#if defined(HAVE_EVP_PBE_SCRYPT)
306306
rb_define_module_function(mKDF, "scrypt", kdf_scrypt, -1);
307307
#endif
308-
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_LIBRESSL_PREREQ(3, 6, 0)
308+
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_IS_LIBRESSL
309309
rb_define_module_function(mKDF, "hkdf", kdf_hkdf, -1);
310310
#endif
311311
}

‎ext/openssl/ossl_pkey.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -799,7 +799,7 @@ ossl_pkey_export_traditional(int argc, VALUE *argv, VALUE self, int to_der)
799799
}
800800
}
801801
else {
802-
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_LIBRESSL_PREREQ(3, 5, 0)
802+
#if OSSL_OPENSSL_PREREQ(1, 1, 0) || OSSL_IS_LIBRESSL
803803
if (!PEM_write_bio_PrivateKey_traditional(bio, pkey, enc, NULL, 0,
804804
ossl_pem_passwd_cb,
805805
(void *)pass)) {
@@ -1116,7 +1116,7 @@ ossl_pkey_sign(int argc, VALUE *argv, VALUE self)
11161116
rb_jump_tag(state);
11171117
}
11181118
}
1119-
#if OSSL_OPENSSL_PREREQ(1, 1, 1) || OSSL_LIBRESSL_PREREQ(3, 4, 0)
1119+
#if OSSL_OPENSSL_PREREQ(1, 1, 1) || OSSL_IS_LIBRESSL
11201120
if (EVP_DigestSign(ctx, NULL, &siglen, (unsigned char *)RSTRING_PTR(data),
11211121
RSTRING_LEN(data)) < 1) {
11221122
EVP_MD_CTX_free(ctx);
@@ -1221,7 +1221,7 @@ ossl_pkey_verify(int argc, VALUE *argv, VALUE self)
12211221
rb_jump_tag(state);
12221222
}
12231223
}
1224-
#if OSSL_OPENSSL_PREREQ(1, 1, 1) || OSSL_LIBRESSL_PREREQ(3, 4, 0)
1224+
#if OSSL_OPENSSL_PREREQ(1, 1, 1) || OSSL_IS_LIBRESSL
12251225
ret = EVP_DigestVerify(ctx, (unsigned char *)RSTRING_PTR(sig),
12261226
RSTRING_LEN(sig), (unsigned char *)RSTRING_PTR(data),
12271227
RSTRING_LEN(data));

‎ext/openssl/ossl_ssl.c‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,6 @@
1818
# define OSSL_USE_NEXTPROTONEG
1919
#endif
2020

21-
#if !defined(TLS1_3_VERSION) && \
22-
OSSL_LIBRESSL_PREREQ(3, 2, 0) && !OSSL_LIBRESSL_PREREQ(3, 4, 0)
23-
# define TLS1_3_VERSION 0x0304
24-
#endif
25-
2621
#ifdef _WIN32
2722
# define TO_SOCKET(s) _get_osfhandle(s)
2823
#else

‎ext/openssl/ossl_x509cert.c‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -711,7 +711,6 @@ ossl_x509_eq(VALUE self, VALUE other)
711711
return !X509_cmp(a, b) ? Qtrue : Qfalse;
712712
}
713713

714-
#ifdef HAVE_I2D_RE_X509_TBS
715714
/*
716715
* call-seq:
717716
* cert.tbs_bytes => string
@@ -741,7 +740,6 @@ ossl_x509_tbs_bytes(VALUE self)
741740

742741
return str;
743742
}
744-
#endif
745743

746744
struct load_chained_certificates_arguments {
747745
VALUE certificates;
@@ -1035,7 +1033,5 @@ Init_ossl_x509cert(void)
10351033
rb_define_method(cX509Cert, "add_extension", ossl_x509_add_extension, 1);
10361034
rb_define_method(cX509Cert, "inspect", ossl_x509_inspect, 0);
10371035
rb_define_method(cX509Cert, "==", ossl_x509_eq, 1);
1038-
#ifdef HAVE_I2D_RE_X509_TBS
10391036
rb_define_method(cX509Cert, "tbs_bytes", ossl_x509_tbs_bytes, 0);
1040-
#endif
10411037
}

‎ext/openssl/ossl_x509store.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -365,12 +365,12 @@ ossl_x509store_add_file(VALUE self, VALUE file)
365365
ossl_raise(eX509StoreError, "X509_STORE_add_lookup");
366366
if (X509_LOOKUP_load_file(lookup, path, X509_FILETYPE_PEM) != 1)
367367
ossl_raise(eX509StoreError, "X509_LOOKUP_load_file");
368-
#if OPENSSL_VERSION_NUMBER < 0x10101000 || defined(LIBRESSL_VERSION_NUMBER)
368+
#if !OSSL_OPENSSL_PREREQ(1, 1, 1) && !OSSL_IS_LIBRESSL
369369
/*
370370
* X509_load_cert_crl_file() which is called from X509_LOOKUP_load_file()
371371
* did not check the return value of X509_STORE_add_{cert,crl}(), leaking
372372
* "cert already in hash table" errors on the error queue, if duplicate
373-
* certificates are found. This will be fixed by OpenSSL 1.1.1.
373+
* certificates are found. Fixed by OpenSSL 1.1.1 and LibreSSL 3.5.0.
374374
*/
375375
ossl_clear_error();
376376
#endif

‎test/openssl/test_pkey.rb‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ def test_generic_oid_inspect_rsa
1111
end
1212

1313
def test_generic_oid_inspect_x25519
14-
omit "X25519 not supported" unless openssl?(1, 1, 0) || libressl?(3, 7, 0)
14+
omit "X25519 not supported" if openssl? && !openssl?(1, 1, 0)
1515
omit_on_fips
1616

1717
# X25519 private key
@@ -85,8 +85,7 @@ def test_hmac_sign_verify
8585
def test_ed25519
8686
# Ed25519 is not FIPS-approved.
8787
omit_on_fips
88-
# See EVP_PKEY_sign in Changelog for 3.7.0: https://github.com/libressl/portable/blob/master/ChangeLog
89-
omit "Ed25519 not supported" unless openssl?(1, 1, 1) || libressl?(3, 7, 0)
88+
omit "Ed25519 not supported" if openssl? && !openssl?(1, 1, 1)
9089

9190
# Test vector from RFC 8032 Section 7.1 TEST 2
9291
priv_pem = <<~EOF
@@ -137,7 +136,7 @@ def test_ed25519
137136
end
138137

139138
def test_x25519
140-
omit "X25519 not supported" unless openssl?(1, 1, 0) || libressl?(3, 7, 0)
139+
omit "X25519 not supported" if openssl? && !openssl?(1, 1, 0)
141140
omit_on_fips
142141

143142
# Test vector from RFC 7748 Section 6.1
@@ -160,7 +159,7 @@ def test_x25519
160159
assert_equal bob_pem, bob.public_to_pem
161160
assert_equal [shared_secret].pack("H*"), alice.derive(bob)
162161

163-
unless openssl?(1, 1, 1) || libressl?(3, 7, 0)
162+
if openssl? && !openssl?(1, 1, 1)
164163
omit "running OpenSSL version does not have raw public key support"
165164
end
166165
alice_private = OpenSSL::PKey.new_raw_private_key("X25519", alice.raw_private_key)
@@ -176,7 +175,7 @@ def test_x25519
176175
end
177176

178177
def test_raw_initialize_errors
179-
omit "Ed25519 not supported" unless openssl?(1, 1, 1) || libressl?(3, 7, 0)
178+
omit "Ed25519 not supported" if openssl? && !openssl?(1, 1, 1)
180179

181180
assert_raise(OpenSSL::PKey::PKeyError) { OpenSSL::PKey.new_raw_private_key("foo123", "xxx") }
182181
assert_raise(OpenSSL::PKey::PKeyError) { OpenSSL::PKey.new_raw_private_key("ED25519", "xxx") }

‎test/openssl/test_ssl.rb‎

Lines changed: 8 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -394,7 +394,8 @@ def test_client_auth_success
394394
vflag = OpenSSL::SSL::VERIFY_PEER|OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
395395
start_server(verify_mode: vflag,
396396
ctx_proc: proc { |ctx|
397-
ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION if libressl?(3, 2, 0)
397+
# LibreSSL doesn't support client_cert_cb in TLS 1.3
398+
ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION if libressl?
398399
}) { |port|
399400
ctx = OpenSSL::SSL::SSLContext.new
400401
ctx.key = @cli_key
@@ -437,7 +438,7 @@ def test_client_cert_cb_ignore_error
437438
end
438439

439440
def test_client_ca
440-
pend "LibreSSL 3.2 has broken client CA support" if libressl?(3, 2, 0)
441+
pend "LibreSSL doesn't support certificate_authorities" if libressl?
441442

442443
ctx_proc = Proc.new do |ctx|
443444
ctx.client_ca = [@ca_cert]
@@ -609,12 +610,9 @@ def test_finished_messages
609610
start_server(accept_proc: proc { |server|
610611
server_finished = server.finished_message
611612
server_peer_finished = server.peer_finished_message
612-
}, ctx_proc: proc { |ctx|
613-
ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION if libressl?(3, 2, 0)
614613
}) { |port|
615614
ctx = OpenSSL::SSL::SSLContext.new
616615
ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
617-
ctx.max_version = :TLS1_2 if libressl?(3, 2, 0) && !libressl?(3, 3, 0)
618616
server_connect(port, ctx) { |ssl|
619617
ssl.puts "abc"; ssl.gets
620618

@@ -798,7 +796,7 @@ def test_post_connection_check_wildcard_san
798796

799797
# LibreSSL 3.5.0+ doesn't support other wildcard certificates
800798
# (it isn't required to, as RFC states MAY, not MUST)
801-
return if libressl?(3, 5, 0)
799+
return if libressl?
802800

803801
assert_equal(true, OpenSSL::SSL.verify_certificate_identity(
804802
create_cert_with_san('DNS:*baz.example.com'), 'foobaz.example.com'))
@@ -1078,7 +1076,7 @@ def test_accept_errors_include_peeraddr
10781076
def test_verify_hostname_on_connect
10791077
ctx_proc = proc { |ctx|
10801078
san = "DNS:a.example.com,DNS:*.b.example.com"
1081-
san += ",DNS:c*.example.com,DNS:d.*.example.com" unless libressl?(3, 2, 2)
1079+
san += ",DNS:c*.example.com,DNS:d.*.example.com" unless libressl?
10821080
exts = [
10831081
["keyUsage", "keyEncipherment,digitalSignature", true],
10841082
["subjectAltName", san],
@@ -1105,7 +1103,7 @@ def test_verify_hostname_on_connect
11051103
["cx.example.com", true],
11061104
["d.x.example.com", false],
11071105
].each do |name, expected_ok|
1108-
next if name.start_with?('cx') if libressl?(3, 2, 2)
1106+
next if name.start_with?('cx') if libressl?
11091107
begin
11101108
sock = TCPSocket.new("127.0.0.1", port)
11111109
ssl = OpenSSL::SSL::SSLSocket.new(sock, ctx)
@@ -1388,8 +1386,7 @@ def test_options_disable_versions
13881386
supported = check_supported_protocol_versions
13891387
if !defined?(OpenSSL::SSL::TLS1_3_VERSION) ||
13901388
!supported.include?(OpenSSL::SSL::TLS1_2_VERSION) ||
1391-
!supported.include?(OpenSSL::SSL::TLS1_3_VERSION) ||
1392-
!defined?(OpenSSL::SSL::OP_NO_TLSv1_3) # LibreSSL < 3.4
1389+
!supported.include?(OpenSSL::SSL::TLS1_3_VERSION)
13931390
pend "this test case requires both TLS 1.2 and TLS 1.3 to be supported " \
13941391
"and enabled by default"
13951392
end
@@ -1743,11 +1740,7 @@ def test_ciphersuites_method_tls_connection
17431740

17441741
server_connect(port, cli_ctx) do |ssl|
17451742
assert_equal('TLSv1.3', ssl.ssl_version)
1746-
if libressl?(3, 4, 0) && !libressl?(3, 5, 0)
1747-
assert_equal("AEAD-AES128-GCM-SHA256", ssl.cipher[0])
1748-
else
1749-
assert_equal(csuite[0], ssl.cipher[0])
1750-
end
1743+
assert_equal(csuite[0], ssl.cipher[0])
17511744
ssl.puts('abc'); assert_equal("abc\n", ssl.gets)
17521745
end
17531746
end

‎test/openssl/test_ssl_session.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ def test_resumption
120120
ctx.options &= ~OpenSSL::SSL::OP_NO_TICKET
121121
# Disable server-side session cache which is enabled by default
122122
ctx.session_cache_mode = OpenSSL::SSL::SSLContext::SESSION_CACHE_OFF
123-
ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION if libressl?(3, 2, 0)
123+
ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION if libressl?
124124
}
125125
start_server(ctx_proc: ctx_proc) do |port|
126126
sess1 = server_connect_with_session(port, nil, nil) { |ssl|

0 commit comments

Comments
 (0)