Skip to content

Commit eec9ccf

Browse files
qmuntalqmuntal
authored
remove OpenSSL 1.0.2 support (#248)
1 parent 069e800 commit eec9ccf

22 files changed

+39
-649
lines changed

‎.github/workflows/test.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ jobs:
66
fail-fast: false
77
matrix:
88
go-version: [1.22.x, 1.23.x]
9-
openssl-version: [1.0.2, 1.1.0, 1.1.1, 3.0.1, 3.0.13, 3.1.5, 3.2.1, 3.3.0, 3.3.1]
9+
openssl-version: [1.1.0, 1.1.1, 3.0.1, 3.0.13, 3.1.5, 3.2.1, 3.3.0, 3.3.1]
1010
runs-on: ubuntu-20.04
1111
steps:
1212
- name: Install build tools

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ On the other hand, Google maintains a branch that uses cgo and BoringSSL to impl
2626

2727
### Multiple OpenSSL versions supported
2828

29-
The `openssl` package has support for multiple OpenSSL versions, namely 1.0.2, 1.1.0, 1.1.1 and 3.x.
29+
The `openssl` package has support for multiple OpenSSL versions, namely 1.1.0, 1.1.1 and 3.x.
3030

3131
All supported OpenSSL versions pass a small set of automatic tests that ensure they can be built and that there are no major regressions.
3232
These tests do not validate the cryptographic correctness of the `openssl` package.

‎cmd/checkheader/main.go

-6
Original file line numberDiff line numberDiff line change
@@ -289,18 +289,12 @@ func tryConvertDefineFunc(w io.Writer, l string, i int) bool {
289289
writeDefineFunc("")
290290
case "DEFINEFUNC_LEGACY_1_1":
291291
writeDefineFunc("(OPENSSL_VERSION_NUMBER >= 0x10100000L) && (OPENSSL_VERSION_NUMBER < 0x30000000L)")
292-
case "DEFINEFUNC_LEGACY_1_0":
293-
writeDefineFunc("OPENSSL_VERSION_NUMBER < 0x10100000L")
294292
case "DEFINEFUNC_LEGACY_1":
295293
writeDefineFunc("OPENSSL_VERSION_NUMBER < 0x30000000L")
296-
case "DEFINEFUNC_1_1":
297-
writeDefineFunc("OPENSSL_VERSION_NUMBER >= 0x10100000L")
298294
case "DEFINEFUNC_1_1_1":
299295
writeDefineFunc("OPENSSL_VERSION_NUMBER >= 0x10101000L")
300296
case "DEFINEFUNC_3_0":
301297
writeDefineFunc("OPENSSL_VERSION_NUMBER >= 0x30000000L")
302-
case "DEFINEFUNC_RENAMED_1_1":
303-
writeDefineFuncRename("OPENSSL_VERSION_NUMBER < 0x10100000L")
304298
case "DEFINEFUNC_RENAMED_3_0":
305299
writeDefineFuncRename("OPENSSL_VERSION_NUMBER < 0x30000000L")
306300
default:

‎dsa.go

+6-29
Original file line numberDiff line numberDiff line change
@@ -91,11 +91,7 @@ func GenerateParametersDSA(l, n int) (DSAParameters, error) {
9191
switch vMajor {
9292
case 1:
9393
dsa := getDSA(pkey)
94-
if vMinor == 0 {
95-
C.go_openssl_DSA_get0_pqg_backport(dsa, &p, &q, &g)
96-
} else {
97-
C.go_openssl_DSA_get0_pqg(dsa, &p, &q, &g)
98-
}
94+
C.go_openssl_DSA_get0_pqg(dsa, &p, &q, &g)
9995
case 3:
10096
defer func() {
10197
C.go_openssl_BN_free(p)
@@ -157,11 +153,7 @@ func GenerateKeyDSA(params DSAParameters) (x, y BigInt, err error) {
157153
switch vMajor {
158154
case 1:
159155
dsa := getDSA(pkey)
160-
if vMinor == 0 {
161-
C.go_openssl_DSA_get0_key_backport(dsa, &by, &bx)
162-
} else {
163-
C.go_openssl_DSA_get0_key(dsa, &by, &bx)
164-
}
156+
C.go_openssl_DSA_get0_key(dsa, &by, &bx)
165157
case 3:
166158
defer func() {
167159
C.go_openssl_BN_clear_free(bx)
@@ -212,12 +204,7 @@ func newDSA1(params DSAParameters, x, y BigInt) (pkey C.GO_EVP_PKEY_PTR, err err
212204
}()
213205

214206
p, q, g := bigToBN(params.P), bigToBN(params.Q), bigToBN(params.G)
215-
var ret C.int
216-
if vMinor == 0 {
217-
ret = C.go_openssl_DSA_set0_pqg_backport(dsa, p, q, g)
218-
} else {
219-
ret = C.go_openssl_DSA_set0_pqg(dsa, p, q, g)
220-
}
207+
ret := C.go_openssl_DSA_set0_pqg(dsa, p, q, g)
221208
if ret != 1 {
222209
C.go_openssl_BN_free(p)
223210
C.go_openssl_BN_free(q)
@@ -226,11 +213,7 @@ func newDSA1(params DSAParameters, x, y BigInt) (pkey C.GO_EVP_PKEY_PTR, err err
226213
}
227214
if y != nil {
228215
pub, priv := bigToBN(y), bigToBN(x)
229-
if vMinor == 0 {
230-
ret = C.go_openssl_DSA_set0_key_backport(dsa, pub, priv)
231-
} else {
232-
ret = C.go_openssl_DSA_set0_key(dsa, pub, priv)
233-
}
216+
ret = C.go_openssl_DSA_set0_key(dsa, pub, priv)
234217
if ret != 1 {
235218
C.go_openssl_BN_free(pub)
236219
C.go_openssl_BN_clear_free(priv)
@@ -308,14 +291,8 @@ func newDSA3(params DSAParameters, x, y BigInt) (C.GO_EVP_PKEY_PTR, error) {
308291
// getDSA returns the DSA from pkey.
309292
// If pkey does not contain an DSA it panics.
310293
// The returned key should not be freed.
311-
func getDSA(pkey C.GO_EVP_PKEY_PTR) (key C.GO_DSA_PTR) {
312-
if vMajor == 1 && vMinor == 0 {
313-
if key0 := C.go_openssl_EVP_PKEY_get0(pkey); key0 != nil {
314-
key = C.GO_DSA_PTR(key0)
315-
}
316-
} else {
317-
key = C.go_openssl_EVP_PKEY_get0_DSA(pkey)
318-
}
294+
func getDSA(pkey C.GO_EVP_PKEY_PTR) C.GO_DSA_PTR {
295+
key := C.go_openssl_EVP_PKEY_get0_DSA(pkey)
319296
if key == nil {
320297
panic("pkey does not contain an DSA")
321298
}

‎evp.go

+3-14
Original file line numberDiff line numberDiff line change
@@ -95,12 +95,7 @@ func loadHash(ch crypto.Hash) *hashAlgorithm {
9595
hash.magic = md5Magic
9696
hash.marshalledSize = md5MarshaledSize
9797
case crypto.MD5SHA1:
98-
if vMajor == 1 && vMinor == 0 {
99-
// OpenSSL 1.0.2 does not support MD5SHA1.
100-
hash.md = nil
101-
} else {
102-
hash.md = C.go_openssl_EVP_md5_sha1()
103-
}
98+
hash.md = C.go_openssl_EVP_md5_sha1()
10499
case crypto.SHA1:
105100
hash.md = C.go_openssl_EVP_sha1()
106101
hash.magic = sha1Magic
@@ -522,14 +517,8 @@ func newEVPPKEY(key C.GO_EC_KEY_PTR) (C.GO_EVP_PKEY_PTR, error) {
522517
// getECKey returns the EC_KEY from pkey.
523518
// If pkey does not contain an EC_KEY it panics.
524519
// The returned key should not be freed.
525-
func getECKey(pkey C.GO_EVP_PKEY_PTR) (key C.GO_EC_KEY_PTR) {
526-
if vMajor == 1 && vMinor == 0 {
527-
if key0 := C.go_openssl_EVP_PKEY_get0(pkey); key0 != nil {
528-
key = C.GO_EC_KEY_PTR(key0)
529-
}
530-
} else {
531-
key = C.go_openssl_EVP_PKEY_get0_EC_KEY(pkey)
532-
}
520+
func getECKey(pkey C.GO_EVP_PKEY_PTR) C.GO_EC_KEY_PTR {
521+
key := C.go_openssl_EVP_PKEY_get0_EC_KEY(pkey)
533522
if key == nil {
534523
panic("pkey does not contain an EC_KEY")
535524
}

‎goopenssl.c

-33
Original file line numberDiff line numberDiff line change
@@ -15,25 +15,19 @@
1515

1616
#define DEFINEFUNC(ret, func, args, argscall) ret (*_g_##func)args;
1717
#define DEFINEFUNC_LEGACY_1_1(ret, func, args, argscall) DEFINEFUNC(ret, func, args, argscall)
18-
#define DEFINEFUNC_LEGACY_1_0(ret, func, args, argscall) DEFINEFUNC(ret, func, args, argscall)
1918
#define DEFINEFUNC_LEGACY_1(ret, func, args, argscall) DEFINEFUNC(ret, func, args, argscall)
20-
#define DEFINEFUNC_1_1(ret, func, args, argscall) DEFINEFUNC(ret, func, args, argscall)
2119
#define DEFINEFUNC_1_1_1(ret, func, args, argscall) DEFINEFUNC(ret, func, args, argscall)
2220
#define DEFINEFUNC_3_0(ret, func, args, argscall) DEFINEFUNC(ret, func, args, argscall)
23-
#define DEFINEFUNC_RENAMED_1_1(ret, func, oldfunc, args, argscall) DEFINEFUNC(ret, func, args, argscall)
2421
#define DEFINEFUNC_RENAMED_3_0(ret, func, oldfunc, args, argscall) DEFINEFUNC(ret, func, args, argscall)
2522
#define DEFINEFUNC_VARIADIC_3_0(ret, func, newname, args, argscall) DEFINEFUNC(ret, newname, args, argscall)
2623

2724
FOR_ALL_OPENSSL_FUNCTIONS
2825

2926
#undef DEFINEFUNC
3027
#undef DEFINEFUNC_LEGACY_1_1
31-
#undef DEFINEFUNC_LEGACY_1_0
3228
#undef DEFINEFUNC_LEGACY_1
33-
#undef DEFINEFUNC_1_1
3429
#undef DEFINEFUNC_1_1_1
3530
#undef DEFINEFUNC_3_0
36-
#undef DEFINEFUNC_RENAMED_1_1
3731
#undef DEFINEFUNC_RENAMED_3_0
3832
#undef DEFINEFUNC_VARIADIC_3_0
3933

@@ -99,21 +93,11 @@ go_openssl_load_functions(void* handle, unsigned int major, unsigned int minor,
9993
{ \
10094
DEFINEFUNC_INTERNAL(func, #func) \
10195
}
102-
#define DEFINEFUNC_LEGACY_1_0(ret, func, args, argscall) \
103-
if (major == 1 && minor == 0) \
104-
{ \
105-
DEFINEFUNC_INTERNAL(func, #func) \
106-
}
10796
#define DEFINEFUNC_LEGACY_1(ret, func, args, argscall) \
10897
if (major == 1) \
10998
{ \
11099
DEFINEFUNC_INTERNAL(func, #func) \
111100
}
112-
#define DEFINEFUNC_1_1(ret, func, args, argscall) \
113-
if (major == 3 || (major == 1 && minor == 1)) \
114-
{ \
115-
DEFINEFUNC_INTERNAL(func, #func) \
116-
}
117101
#define DEFINEFUNC_1_1_1(ret, func, args, argscall) \
118102
if (major == 3 || (major == 1 && minor == 1 && patch == 1)) \
119103
{ \
@@ -124,15 +108,6 @@ go_openssl_load_functions(void* handle, unsigned int major, unsigned int minor,
124108
{ \
125109
DEFINEFUNC_INTERNAL(func, #func) \
126110
}
127-
#define DEFINEFUNC_RENAMED_1_1(ret, func, oldfunc, args, argscall) \
128-
if (major == 1 && minor == 0) \
129-
{ \
130-
DEFINEFUNC_INTERNAL(func, #oldfunc) \
131-
} \
132-
else \
133-
{ \
134-
DEFINEFUNC_INTERNAL(func, #func) \
135-
}
136111
#define DEFINEFUNC_RENAMED_3_0(ret, func, oldfunc, args, argscall) \
137112
if (major == 1) \
138113
{ \
@@ -152,12 +127,9 @@ FOR_ALL_OPENSSL_FUNCTIONS
152127

153128
#undef DEFINEFUNC
154129
#undef DEFINEFUNC_LEGACY_1_1
155-
#undef DEFINEFUNC_LEGACY_1_0
156130
#undef DEFINEFUNC_LEGACY_1
157-
#undef DEFINEFUNC_1_1
158131
#undef DEFINEFUNC_1_1_1
159132
#undef DEFINEFUNC_3_0
160-
#undef DEFINEFUNC_RENAMED_1_1
161133
#undef DEFINEFUNC_RENAMED_3_0
162134
#undef DEFINEFUNC_VARIADIC_3_0
163135
}
@@ -171,11 +143,6 @@ version_num(void* handle)
171143
if (fn != NULL)
172144
return fn();
173145

174-
// SSLeay is defined in OpenSSL 1.0.2.
175-
fn = (unsigned long (*)(void))dlsym(handle, "SSLeay");
176-
if (fn != NULL)
177-
return fn();
178-
179146
return 0;
180147
}
181148

‎goopenssl.h

-27
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,7 @@ int go_openssl_fips_enabled(void* handle);
2525
int go_openssl_version_major(void* handle);
2626
int go_openssl_version_minor(void* handle);
2727
int go_openssl_version_patch(void* handle);
28-
int go_openssl_thread_setup(void);
2928
void go_openssl_load_functions(void* handle, unsigned int major, unsigned int minor, unsigned int patch);
30-
void go_openssl_DSA_get0_pqg_backport(const GO_DSA_PTR d, GO_BIGNUM_PTR *p, GO_BIGNUM_PTR *q, GO_BIGNUM_PTR *g);
31-
int go_openssl_DSA_set0_pqg_backport(GO_DSA_PTR d, GO_BIGNUM_PTR p, GO_BIGNUM_PTR q, GO_BIGNUM_PTR g);
32-
void go_openssl_DSA_get0_key_backport(const GO_DSA_PTR d, GO_BIGNUM_PTR *pub_key, GO_BIGNUM_PTR *priv_key);
33-
int go_openssl_DSA_set0_key_backport(GO_DSA_PTR d, GO_BIGNUM_PTR pub_key, GO_BIGNUM_PTR priv_key);
3429

3530
// Define pointers to all the used OpenSSL functions.
3631
// Calling C function pointers from Go is currently not supported.
@@ -44,18 +39,12 @@ int go_openssl_DSA_set0_key_backport(GO_DSA_PTR d, GO_BIGNUM_PTR pub_key, GO_BIG
4439
}
4540
#define DEFINEFUNC_LEGACY_1_1(ret, func, args, argscall) \
4641
DEFINEFUNC(ret, func, args, argscall)
47-
#define DEFINEFUNC_LEGACY_1_0(ret, func, args, argscall) \
48-
DEFINEFUNC(ret, func, args, argscall)
4942
#define DEFINEFUNC_LEGACY_1(ret, func, args, argscall) \
5043
DEFINEFUNC(ret, func, args, argscall)
51-
#define DEFINEFUNC_1_1(ret, func, args, argscall) \
52-
DEFINEFUNC(ret, func, args, argscall)
5344
#define DEFINEFUNC_1_1_1(ret, func, args, argscall) \
5445
DEFINEFUNC(ret, func, args, argscall)
5546
#define DEFINEFUNC_3_0(ret, func, args, argscall) \
5647
DEFINEFUNC(ret, func, args, argscall)
57-
#define DEFINEFUNC_RENAMED_1_1(ret, func, oldfunc, args, argscall) \
58-
DEFINEFUNC(ret, func, args, argscall)
5948
#define DEFINEFUNC_RENAMED_3_0(ret, func, oldfunc, args, argscall) \
6049
DEFINEFUNC(ret, func, args, argscall)
6150
#define DEFINEFUNC_VARIADIC_3_0(ret, func, newname, args, argscall) \
@@ -65,12 +54,9 @@ FOR_ALL_OPENSSL_FUNCTIONS
6554

6655
#undef DEFINEFUNC
6756
#undef DEFINEFUNC_LEGACY_1_1
68-
#undef DEFINEFUNC_LEGACY_1_0
6957
#undef DEFINEFUNC_LEGACY_1
70-
#undef DEFINEFUNC_1_1
7158
#undef DEFINEFUNC_1_1_1
7259
#undef DEFINEFUNC_3_0
73-
#undef DEFINEFUNC_RENAMED_1_1
7460
#undef DEFINEFUNC_RENAMED_3_0
7561
#undef DEFINEFUNC_VARIADIC_3_0
7662

@@ -246,16 +232,3 @@ go_openssl_EVP_CIPHER_CTX_open_wrapper(const GO_EVP_CIPHER_CTX_PTR ctx,
246232

247233
return 1;
248234
}
249-
250-
// Hand-roll custom wrappers for CRYPTO_malloc and CRYPTO_free which cast the
251-
// function pointers to the correct signatures for OpenSSL 1.0.2.
252-
253-
static inline void *
254-
go_openssl_CRYPTO_malloc_legacy102(int num, const char *file, int line) {
255-
return ((void *(*)(int, const char *, int))_g_CRYPTO_malloc)(num, file, line);
256-
}
257-
258-
static inline void
259-
go_openssl_CRYPTO_free_legacy102(void *str) {
260-
((void (*)(void *))_g_CRYPTO_free)(str);
261-
}

‎hmac.go

+4-25
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ type opensslHMAC struct {
7676
}
7777

7878
func newHMAC1(key []byte, md C.GO_EVP_MD_PTR) hmacCtx1 {
79-
ctx := hmacCtxNew()
79+
ctx := C.go_openssl_HMAC_CTX_new()
8080
if ctx == nil {
8181
panic("openssl: EVP_MAC_CTX_new failed")
8282
}
@@ -188,7 +188,7 @@ func (h *opensslHMAC) Reset() {
188188
func (h *opensslHMAC) finalize() {
189189
switch vMajor {
190190
case 1:
191-
hmacCtxFree(h.ctx1.ctx)
191+
C.go_openssl_HMAC_CTX_free(h.ctx1.ctx)
192192
case 3:
193193
C.go_openssl_EVP_MAC_CTX_free(h.ctx3.ctx)
194194
default:
@@ -230,11 +230,11 @@ func (h *opensslHMAC) Sum(in []byte) []byte {
230230
// and the second Sum acts as if the first didn't happen.
231231
switch vMajor {
232232
case 1:
233-
ctx2 := hmacCtxNew()
233+
ctx2 := C.go_openssl_HMAC_CTX_new()
234234
if ctx2 == nil {
235235
panic("openssl: HMAC_CTX_new failed")
236236
}
237-
defer hmacCtxFree(ctx2)
237+
defer C.go_openssl_HMAC_CTX_free(ctx2)
238238
if C.go_openssl_HMAC_CTX_copy(ctx2, h.ctx1.ctx) == 0 {
239239
panic("openssl: HMAC_CTX_copy failed")
240240
}
@@ -251,24 +251,3 @@ func (h *opensslHMAC) Sum(in []byte) []byte {
251251
}
252252
return append(in, h.sum...)
253253
}
254-
255-
func hmacCtxNew() C.GO_HMAC_CTX_PTR {
256-
if vMajor == 1 && vMinor == 0 {
257-
// 0x120 is the sizeof value when building against OpenSSL 1.0.2 on Ubuntu 16.04.
258-
ctx := (C.GO_HMAC_CTX_PTR)(C.malloc(0x120))
259-
if ctx != nil {
260-
C.go_openssl_HMAC_CTX_init(ctx)
261-
}
262-
return ctx
263-
}
264-
return C.go_openssl_HMAC_CTX_new()
265-
}
266-
267-
func hmacCtxFree(ctx C.GO_HMAC_CTX_PTR) {
268-
if vMajor == 1 && vMinor == 0 {
269-
C.go_openssl_HMAC_CTX_cleanup(ctx)
270-
C.free(unsafe.Pointer(ctx))
271-
return
272-
}
273-
C.go_openssl_HMAC_CTX_free(ctx)
274-
}

‎init.go

+4-12
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ func opensslInit(file string) (major, minor, patch uint, err error) {
3333
major, minor, patch = uint(imajor), uint(iminor), uint(ipatch)
3434
var supported bool
3535
if major == 1 {
36-
supported = minor == 0 || minor == 1
36+
supported = minor == 1
3737
} else if major == 3 {
3838
// OpenSSL guarantees API and ABI compatibility within the same major version since OpenSSL 3.
3939
supported = true
@@ -48,17 +48,9 @@ func opensslInit(file string) (major, minor, patch uint, err error) {
4848

4949
// Initialize OpenSSL.
5050
C.go_openssl_OPENSSL_init()
51-
if major == 1 && minor == 0 {
52-
if C.go_openssl_thread_setup() != 1 {
53-
return 0, 0, 0, fail("openssl: thread setup")
54-
}
55-
C.go_openssl_OPENSSL_add_all_algorithms_conf()
56-
C.go_openssl_ERR_load_crypto_strings()
57-
} else {
58-
flags := C.uint64_t(C.GO_OPENSSL_INIT_ADD_ALL_CIPHERS | C.GO_OPENSSL_INIT_ADD_ALL_DIGESTS | C.GO_OPENSSL_INIT_LOAD_CONFIG | C.GO_OPENSSL_INIT_LOAD_CRYPTO_STRINGS)
59-
if C.go_openssl_OPENSSL_init_crypto(flags, nil) != 1 {
60-
return 0, 0, 0, fail("openssl: init crypto")
61-
}
51+
flags := C.uint64_t(C.GO_OPENSSL_INIT_ADD_ALL_CIPHERS | C.GO_OPENSSL_INIT_ADD_ALL_DIGESTS | C.GO_OPENSSL_INIT_LOAD_CONFIG | C.GO_OPENSSL_INIT_LOAD_CRYPTO_STRINGS)
52+
if C.go_openssl_OPENSSL_init_crypto(flags, nil) != 1 {
53+
return 0, 0, 0, fail("openssl: init crypto")
6254
}
6355
return major, minor, patch, nil
6456
}

‎init_unix.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
package openssl
44

5-
// #cgo LDFLAGS: -ldl -pthread
5+
// #cgo LDFLAGS: -ldl
66
// #include <stdlib.h>
77
// #include <dlfcn.h>
88
import "C"

0 commit comments

Comments
 (0)