104104#endif
105105
106106#ifdef LIBRESSL_VERSION_NUMBER
107- # /* As of LibreSSL 2.0.0-4.0.0: OPENSSL_VERSION_NUMBER == 0x20000000L */
108- # if LIBRESSL_VERSION_NUMBER < 0x2090100fL /* 2019-04-13 */
109- # error "LibreSSL 2.9.1 or later required"
110- # endif
107+ /* As of LibreSSL 2.0.0-4.0.0: OPENSSL_VERSION_NUMBER == 0x20000000L */
108+ # if LIBRESSL_VERSION_NUMBER < 0x2090100fL /* 2019-04-13 */
109+ # error "LibreSSL 2.9.1 or later required"
110+ # endif
111111#elif OPENSSL_VERSION_NUMBER < 0x1000201fL /* 2015-03-19 */
112- # error "OpenSSL 1.0.2a or later required"
112+ # error "OpenSSL 1.0.2a or later required"
113113#endif
114114
115115#if defined(HAVE_OPENSSL3 ) && !defined(OPENSSL_NO_UI_CONSOLE )
121121static void ossl_provider_cleanup (struct Curl_easy * data );
122122#endif
123123
124- #if (OPENSSL_VERSION_NUMBER >= 0x10100000L && \
125- !defined(LIBRESSL_VERSION_NUMBER ) && \
126- !defined(OPENSSL_IS_BORINGSSL ))
127- #define HAVE_SSL_CTX_SET_DEFAULT_READ_BUFFER_LEN 1
124+ #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \
125+ !defined(LIBRESSL_VERSION_NUMBER ) && !defined(OPENSSL_IS_BORINGSSL )
126+ #define HAVE_SSL_CTX_SET_DEFAULT_READ_BUFFER_LEN 1
128127#endif
129128
130129#include "../curlx/warnless.h"
@@ -185,20 +184,19 @@ static void ossl_provider_cleanup(struct Curl_easy *data);
185184 (defined(LIBRESSL_VERSION_NUMBER ) && \
186185 LIBRESSL_VERSION_NUMBER >= 0x3040100fL )) && \
187186 !defined(OPENSSL_IS_BORINGSSL )
188- # define HAVE_SSL_CTX_SET_CIPHERSUITES
189- # ifndef OPENSSL_IS_AWSLC
190- # define HAVE_SSL_CTX_SET_POST_HANDSHAKE_AUTH
191- # endif
187+ # define HAVE_SSL_CTX_SET_CIPHERSUITES
188+ # ifndef OPENSSL_IS_AWSLC
189+ # define HAVE_SSL_CTX_SET_POST_HANDSHAKE_AUTH
190+ # endif
192191#endif
193192
194193/* Whether SSL_CTX_set1_sigalgs_list is available
195194 * OpenSSL: supported since 1.0.2 (commit 0b362de5f575)
196195 * BoringSSL: supported since 0.20240913.0 (commit 826ce15)
197196 * LibreSSL: no
198197 */
199- #if (OPENSSL_VERSION_NUMBER >= 0x10002000L && \
200- !defined(LIBRESSL_VERSION_NUMBER ))
201- #define HAVE_SSL_CTX_SET1_SIGALGS
198+ #if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(LIBRESSL_VERSION_NUMBER )
199+ #define HAVE_SSL_CTX_SET1_SIGALGS
202200#endif
203201
204202#ifdef LIBRESSL_VERSION_NUMBER
@@ -207,8 +205,8 @@ static void ossl_provider_cleanup(struct Curl_easy *data);
207205#define OSSL_PACKAGE "BoringSSL"
208206#elif defined(OPENSSL_IS_AWSLC )
209207#define OSSL_PACKAGE "AWS-LC"
210- #elif ( defined(USE_NGTCP2 ) && defined(USE_NGHTTP3 ) && \
211- !defined(OPENSSL_QUIC_API2 ) )
208+ #elif defined(USE_NGTCP2 ) && defined(USE_NGHTTP3 ) && \
209+ !defined(OPENSSL_QUIC_API2 )
212210#define OSSL_PACKAGE "quictls"
213211#else
214212#define OSSL_PACKAGE "OpenSSL"
@@ -223,7 +221,7 @@ typedef unsigned long sslerr_t;
223221#endif
224222#define ossl_valsize_t numcert_t
225223
226- #if ( OPENSSL_VERSION_NUMBER >= 0x10100000L )
224+ #if OPENSSL_VERSION_NUMBER >= 0x10100000L
227225/* up2date versions of OpenSSL maintain reasonably secure defaults without
228226 * breaking compatibility, so it is better not to override the defaults in curl
229227 */
@@ -242,7 +240,7 @@ typedef unsigned long sslerr_t;
242240#endif
243241#endif
244242
245- #if ( OPENSSL_VERSION_NUMBER >= 0x10100000L )
243+ #if OPENSSL_VERSION_NUMBER >= 0x10100000L
246244#define HAVE_RANDOM_INIT_BY_DEFAULT 1
247245#endif
248246
@@ -251,7 +249,7 @@ typedef unsigned long sslerr_t;
251249 * X509_STORE between connections. The API is:
252250 * * `X509_STORE_up_ref` -- Introduced: OpenSSL 1.1.0.
253251 */
254- #if ( OPENSSL_VERSION_NUMBER >= 0x10100000L ) /* OpenSSL >= 1.1.0 */
252+ #if OPENSSL_VERSION_NUMBER >= 0x10100000L /* OpenSSL >= 1.1.0 */
255253#define HAVE_SSL_X509_STORE_SHARE
256254#endif
257255
@@ -322,8 +320,7 @@ static CURLcode X509V3_ext(struct Curl_easy *data,
322320{
323321 int i ;
324322 CURLcode result = CURLE_OK ;
325- #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \
326- !defined(LIBRESSL_VERSION_NUMBER )
323+ #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER )
327324 const STACK_OF (X509_EXTENSION ) * exts = extsarg ;
328325#else
329326 STACK_OF (X509_EXTENSION ) * exts = CURL_UNCONST (extsarg );
@@ -1255,8 +1252,7 @@ static int enginecheck(struct Curl_easy *data,
12551252 UI_METHOD * ui_method =
12561253 UI_create_method (OSSL_UI_METHOD_CAST ("curl user interface" ));
12571254 if (!ui_method ) {
1258- failf (data , "unable do create " OSSL_PACKAGE
1259- " user-interface method" );
1255+ failf (data , "unable do create " OSSL_PACKAGE " user-interface method" );
12601256 return 0 ;
12611257 }
12621258 UI_method_set_opener (ui_method , UI_method_get_opener (UI_OpenSSL ()));
@@ -1318,8 +1314,7 @@ static int providercheck(struct Curl_easy *data,
13181314 UI_METHOD * ui_method =
13191315 UI_create_method (OSSL_UI_METHOD_CAST ("curl user interface" ));
13201316 if (!ui_method ) {
1321- failf (data , "unable do create " OSSL_PACKAGE
1322- " user-interface method" );
1317+ failf (data , "unable do create " OSSL_PACKAGE " user-interface method" );
13231318 return 0 ;
13241319 }
13251320 UI_method_set_opener (ui_method , UI_method_get_opener (UI_OpenSSL ()));
@@ -1547,8 +1542,7 @@ static int pkcs12load(struct Curl_easy *data,
15471542 cert_bio = BIO_new_mem_buf (cert_blob -> data , (int )(cert_blob -> len ));
15481543 if (!cert_bio ) {
15491544 failf (data ,
1550- "BIO_new_mem_buf NULL, " OSSL_PACKAGE
1551- " error %s" ,
1545+ "BIO_new_mem_buf NULL, " OSSL_PACKAGE " error %s" ,
15521546 ossl_strerror (ERR_get_error (), error_buffer ,
15531547 sizeof (error_buffer )) );
15541548 return 0 ;
@@ -1558,8 +1552,7 @@ static int pkcs12load(struct Curl_easy *data,
15581552 cert_bio = BIO_new (BIO_s_file ());
15591553 if (!cert_bio ) {
15601554 failf (data ,
1561- "BIO_new return NULL, " OSSL_PACKAGE
1562- " error %s" ,
1555+ "BIO_new return NULL, " OSSL_PACKAGE " error %s" ,
15631556 ossl_strerror (ERR_get_error (), error_buffer ,
15641557 sizeof (error_buffer )) );
15651558 return 0 ;
@@ -2872,7 +2865,7 @@ static void ossl_trace(int direction, int ssl_ver, int content_type,
28722865# define HAS_ALPN_OPENSSL
28732866#endif
28742867
2875- #if ( OPENSSL_VERSION_NUMBER >= 0x10100000L ) /* 1.1.0 */
2868+ #if OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 */
28762869static CURLcode
28772870ossl_set_ssl_version_min_max (struct Curl_cfilter * cf , SSL_CTX * ctx )
28782871{
@@ -2970,7 +2963,7 @@ typedef unsigned long ctx_option_t;
29702963typedef long ctx_option_t ;
29712964#endif
29722965
2973- #if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) /* 1.1.0 */
2966+ #if OPENSSL_VERSION_NUMBER < 0x10100000L /* 1.1.0 */
29742967static CURLcode
29752968ossl_set_ssl_version_min_max_legacy (ctx_option_t * ctx_options ,
29762969 struct Curl_cfilter * cf ,
@@ -3923,7 +3916,7 @@ static CURLcode ossl_init_ssl(struct ossl_ctx *octx,
39233916 if (result )
39243917 return result ;
39253918 }
3926- #endif /* USE_ECH_OPENSSL */
3919+ #endif /* USE_ECH_OPENSSL */
39273920
39283921 return ossl_init_session_and_alpns (octx , cf , data , peer ,
39293922 alpns_requested , sess_reuse_cb );
@@ -3951,11 +3944,11 @@ static CURLcode ossl_init_method(struct Curl_cfilter *cf,
39513944 case CURL_SSLVERSION_TLSv1_2 :
39523945 case CURL_SSLVERSION_TLSv1_3 :
39533946 /* it will be handled later with the context options */
3954- #if ( OPENSSL_VERSION_NUMBER >= 0x10100000L )
3947+ #if OPENSSL_VERSION_NUMBER >= 0x10100000L
39553948 * pmethod = TLS_client_method ();
3956- #else
3949+ #else
39573950 * pmethod = SSLv23_client_method ();
3958- #endif
3951+ #endif
39593952 break ;
39603953 case CURL_SSLVERSION_SSLv2 :
39613954 failf (data , "No SSLv2 support" );
@@ -4118,7 +4111,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
41184111 ctx_options |= SSL_OP_NO_SSLv2 ;
41194112 ctx_options |= SSL_OP_NO_SSLv3 ;
41204113
4121- #if ( OPENSSL_VERSION_NUMBER >= 0x10100000L ) /* 1.1.0 */
4114+ #if OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 */
41224115 result = ossl_set_ssl_version_min_max (cf , octx -> ssl_ctx );
41234116#else
41244117 result = ossl_set_ssl_version_min_max_legacy (& ctx_options , cf , data );
@@ -4338,7 +4331,7 @@ void Curl_ossl_report_handshake(struct Curl_easy *data,
43384331
43394332#ifdef HAVE_OPENSSL3
43404333 SSL_get_peer_signature_type_nid (octx -> ssl , & psigtype_nid );
4341- #if ( OPENSSL_VERSION_NUMBER >= 0x30200000L )
4334+ #if OPENSSL_VERSION_NUMBER >= 0x30200000L
43424335 negotiated_group_name = SSL_get0_group_name (octx -> ssl );
43434336#else
43444337 negotiated_group_name =
@@ -4629,8 +4622,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
46294622 connssl -> connecting_state = ssl_connect_3 ;
46304623 Curl_ossl_report_handshake (data , octx );
46314624
4632- #ifdef USE_ECH_OPENSSL
4633- # ifndef HAVE_BORINGSSL_LIKE
4625+ #if defined(USE_ECH_OPENSSL ) && !defined(HAVE_BORINGSSL_LIKE )
46344626 if (ECH_ENABLED (data )) {
46354627 char * inner = NULL , * outer = NULL ;
46364628 const char * status = NULL ;
@@ -4688,8 +4680,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
46884680 else {
46894681 infof (data , "ECH: result: status is not attempted" );
46904682 }
4691- # endif /* !HAVE_BORINGSSL_LIKE */
4692- #endif /* USE_ECH_OPENSSL */
4683+ #endif /* USE_ECH_OPENSSL && !HAVE_BORINGSSL_LIKE */
46934684
46944685#ifdef HAS_ALPN_OPENSSL
46954686 /* Sets data and len to negotiated protocol, len is 0 if no protocol was
@@ -4766,7 +4757,7 @@ static CURLcode ossl_pkp_pin_peer_pubkey(struct Curl_easy *data, X509* cert,
47664757 return result ;
47674758}
47684759
4769- #if ( OPENSSL_VERSION_NUMBER >= 0x10100000L ) && \
4760+ #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \
47704761 !(defined(LIBRESSL_VERSION_NUMBER ) && \
47714762 LIBRESSL_VERSION_NUMBER < 0x3060000fL ) && \
47724763 !defined(HAVE_BORINGSSL_LIKE ) && !defined(CURL_DISABLE_VERBOSE_STRINGS )
@@ -4859,8 +4850,7 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
48594850
48604851 if (!mem ) {
48614852 failf (data ,
4862- "BIO_new return NULL, " OSSL_PACKAGE
4863- " error %s" ,
4853+ "BIO_new return NULL, " OSSL_PACKAGE " error %s" ,
48644854 ossl_strerror (ERR_get_error (), error_buffer ,
48654855 sizeof (error_buffer )) );
48664856 return CURLE_OUT_OF_MEMORY ;
@@ -4936,8 +4926,7 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
49364926 (int )conn_config -> issuercert_blob -> len );
49374927 if (!fp ) {
49384928 failf (data ,
4939- "BIO_new_mem_buf NULL, " OSSL_PACKAGE
4940- " error %s" ,
4929+ "BIO_new_mem_buf NULL, " OSSL_PACKAGE " error %s" ,
49414930 ossl_strerror (ERR_get_error (), error_buffer ,
49424931 sizeof (error_buffer )) );
49434932 X509_free (octx -> server_cert );
@@ -4949,8 +4938,7 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
49494938 fp = BIO_new (BIO_s_file ());
49504939 if (!fp ) {
49514940 failf (data ,
4952- "BIO_new return NULL, " OSSL_PACKAGE
4953- " error %s" ,
4941+ "BIO_new return NULL, " OSSL_PACKAGE " error %s" ,
49544942 ossl_strerror (ERR_get_error (), error_buffer ,
49554943 sizeof (error_buffer )) );
49564944 X509_free (octx -> server_cert );
@@ -5558,15 +5546,13 @@ size_t Curl_ossl_version(char *buffer, size_t size)
55585546#elif defined(OPENSSL_IS_BORINGSSL )
55595547#ifdef CURL_BORINGSSL_VERSION
55605548 return msnprintf (buffer , size , "%s/%s" ,
5561- OSSL_PACKAGE ,
5562- CURL_BORINGSSL_VERSION );
5549+ OSSL_PACKAGE , CURL_BORINGSSL_VERSION );
55635550#else
55645551 return msnprintf (buffer , size , OSSL_PACKAGE );
55655552#endif
55665553#elif defined(OPENSSL_IS_AWSLC )
55675554 return msnprintf (buffer , size , "%s/%s" ,
5568- OSSL_PACKAGE ,
5569- AWSLC_VERSION_NUMBER_STRING );
5555+ OSSL_PACKAGE , AWSLC_VERSION_NUMBER_STRING );
55705556#elif defined(OPENSSL_VERSION_STRING ) /* OpenSSL 3+ */
55715557 return msnprintf (buffer , size , "%s/%s" ,
55725558 OSSL_PACKAGE , OpenSSL_version (OPENSSL_VERSION_STRING ));
0 commit comments