openwrt-packages-dist/mail/opendkim/patches/010-openssl_1.1_compat.patch

This patch has been tested with OpenSSL 1.0.2q, 1.1.0j and 1.1.1a
with and without support for deprecated OpenSSL APIs.

--- a/configure.ac
+++ b/configure.ac
@@ -860,26 +860,10 @@ then
 	AC_SEARCH_LIBS([ERR_peek_error], [crypto], ,
 	               AC_MSG_ERROR([libcrypto not found]))
 
-	AC_SEARCH_LIBS([SSL_library_init], [ssl], ,
-		[
-			if test x"$enable_shared" = x"yes"
-			then
-				AC_MSG_ERROR([Cannot build shared opendkim
-				              against static openssl libraries.
-				              Configure with --disable-shared
-				              to get this working or obtain a
-				              shared libssl library for
-				              opendkim to use.])
-			fi
-
-			# avoid caching issue - last result of SSL_library_init
-			# shouldn't be cached for this next check
-			unset ac_cv_search_SSL_library_init
-			LIBCRYPTO_LIBS="$LIBCRYPTO_LIBS -ldl"
-			AC_SEARCH_LIBS([SSL_library_init], [ssl], ,
-			               AC_MSG_ERROR([libssl not found]), [-ldl])
-		]
-	)
+	od_have_ossl="no"
+	AC_CHECK_LIB(ssl, OPENSSL_init_ssl, [od_have_ossl="yes"])
+	AC_CHECK_LIB(ssl, SSL_library_init, [od_have_ossl="yes"])
+	AS_IF([test "x$od_have_ossl" = xno], [AC_MSG_ERROR([libssl not found])])
 
 	AC_CHECK_DECL([SHA256_DIGEST_LENGTH],
                       AC_DEFINE([HAVE_SHA256], 1,
--- a/opendkim/opendkim-crypto.c
+++ b/opendkim/opendkim-crypto.c
@@ -139,6 +139,7 @@ static unsigned int nmutexes = 0;
 static unsigned long threadid = 0L;
 static pthread_mutex_t *mutexes = NULL;
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000
 /*
 **  DKIMF_CRYPTO_LOCK_CALLBACK -- locking callback for libcrypto
 **
@@ -166,6 +167,7 @@ dkimf_crypto_lock_callback(int mode, int
 
 	assert(status == 0);
 }
+#endif
 
 /*
 **  DKIMF_CRYPTO_GET_ID -- generate/retrieve thread ID
@@ -208,21 +210,15 @@ dkimf_crypto_get_id(void)
 static void
 dkimf_crypto_free_id(void *ptr)
 {
-	/*
-	**  Trick dkimf_crypto_get_id(); the thread-specific pointer has
-	**  already been cleared at this point, but dkimf_crypto_get_id()
-	**  may be called by ERR_remove_state() which will then allocate a
-	**  new thread pointer if the thread-specific pointer is NULL.  This
-	**  means a memory leak of thread IDs and, on Solaris, an infinite loop
-	**  because the destructor (indirectly) re-sets the thread-specific
-	**  pointer to something not NULL.  See pthread_key_create(3).
-	*/
-
 	if (ptr != NULL)
 	{
 		assert(pthread_setspecific(id_key, ptr) == 0);
 
-		ERR_remove_state(0);
+#if OPENSSL_VERSION_NUMBER >= 0x10100000
+		OPENSSL_thread_stop();
+#else
+		ERR_remove_thread_state(NULL);
+#endif
 
 		free(ptr);
 
@@ -300,6 +296,7 @@ dkimf_crypto_dyn_destroy(struct CRYPTO_d
 **  	None.
 */
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000
 static void
 dkimf_crypto_dyn_lock(int mode, struct CRYPTO_dynlock_value *lock,
                       /* UNUSED */ const char *file,
@@ -316,6 +313,7 @@ dkimf_crypto_dyn_lock(int mode, struct C
 
 	assert(status == 0);
 }
+#endif
 
 /*
 **  DKIMF_CRYPTO_INIT -- set up openssl dependencies
@@ -335,7 +333,12 @@ dkimf_crypto_init(void)
 	int n;
 	int status;
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000
 	n = CRYPTO_num_locks();
+#else
+	// see openssl/crypto.h for more details
+	n = 1;
+#endif
 	mutexes = (pthread_mutex_t *) malloc(n * sizeof(pthread_mutex_t));
 	if (mutexes == NULL)
 		return errno;
@@ -357,15 +360,22 @@ dkimf_crypto_init(void)
 	if (status != 0)
 		return status;
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000
 	SSL_load_error_strings();
 	SSL_library_init();
 	ERR_load_crypto_strings();
+#else
+	OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+	OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+#endif
 
+#if OPENSSL_VERSION_NUMBER < 0x10000000
 	CRYPTO_set_id_callback(&dkimf_crypto_get_id);
 	CRYPTO_set_locking_callback(&dkimf_crypto_lock_callback);
 	CRYPTO_set_dynlock_create_callback(&dkimf_crypto_dyn_create);
 	CRYPTO_set_dynlock_lock_callback(&dkimf_crypto_dyn_lock);
 	CRYPTO_set_dynlock_destroy_callback(&dkimf_crypto_dyn_destroy);
+#endif
 
 #ifdef USE_OPENSSL_ENGINE
 	if (!SSL_set_engine(NULL))
@@ -392,11 +402,15 @@ dkimf_crypto_free(void)
 {
 	if (crypto_init_done)
 	{
+#if OPENSSL_VERSION_NUMBER >= 0x10100000
+		OPENSSL_thread_stop();
+#else
 		CRYPTO_cleanup_all_ex_data();
 		CONF_modules_free();
 		EVP_cleanup();
 		ERR_free_strings();
-		ERR_remove_state(0);
+		ERR_remove_thread_state(NULL);
+#endif
 
 		if (nmutexes > 0)
 		{
--- a/libopendkim/dkim.c
+++ b/libopendkim/dkim.c
@@ -4195,8 +4195,10 @@ dkim_init_openssl(void)
 {
 	pthread_mutex_lock(&openssl_lock);
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000
 	if (openssl_refcount == 0)
 		OpenSSL_add_all_algorithms();
+#endif
 	openssl_refcount++;
 
 	pthread_mutex_unlock(&openssl_lock);
@@ -4220,8 +4222,10 @@ dkim_close_openssl(void)
 	pthread_mutex_lock(&openssl_lock);
 
 	openssl_refcount--;
+#if OPENSSL_VERSION_NUMBER < 0x10100000
 	if (openssl_refcount == 0)
 		EVP_cleanup();
+#endif
 
 	pthread_mutex_unlock(&openssl_lock);
 }
--- a/opendkim/opendkim-testkey.c
+++ b/opendkim/opendkim-testkey.c
@@ -452,7 +452,11 @@ main(int argc, char **argv)
 	memset(err, '\0', sizeof err);
 
 #ifndef USE_GNUTLS
+#if OPENSSL_VERSION_NUMBER < 0x10100000
 	ERR_load_crypto_strings();
+#else
+	OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+#endif
 #endif /* ! USE_GNUTLS */
 
 	/* process a KeyTable if specified and not overridden */
--- a/opendkim/opendkim.c
+++ b/opendkim/opendkim.c
@@ -15540,7 +15540,11 @@ main(int argc, char **argv)
 			printf("\tCompiled with GnuTLS %s\n", GNUTLS_VERSION);
 #else /* USE_GNUTLS */
 			printf("\tCompiled with %s\n",
+#if OPENSSL_VERSION_NUMBER < 0x10100000
 			       SSLeay_version(SSLEAY_VERSION));
+#else
+			       OpenSSL_version(OPENSSL_VERSION));
+#endif
 #endif /* USE_GNUTLS */
 			printf("\tSMFI_VERSION 0x%x\n", SMFI_VERSION);
 #ifdef HAVE_SMFI_VERSION