Merge pull request #2490 from rust-openssl/botovq-rm-libressl-3.3

botovq · botovq · commit 8d4624521144 · 2025-10-14T15:26:01.000+02:00
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -190,7 +190,7 @@ jobs:
               bindgen: true
               library:
                 name: libressl
-                version: 3.3.6
+                version: 3.4.3
             - target: x86_64-unknown-linux-gnu
               bindgen: true
               library:
@@ -210,7 +210,7 @@ jobs:
               bindgen: false
               library:
                 name: libressl
-                version: 3.3.6
+                version: 3.4.3
             - target: x86_64-unknown-linux-gnu
               bindgen: false
               library:
diff --git a/openssl-sys/build/cfgs.rs b/openssl-sys/build/cfgs.rs
@@ -16,13 +16,9 @@ pub fn get(openssl_version: Option<u64>, libressl_version: Option<u64>) -> Vec<&
         cfgs.push("libressl291");
         cfgs.push("libressl310");
         cfgs.push("libressl321");
+        cfgs.push("libressl332");
+        cfgs.push("libressl340");
 
-        if libressl_version >= 0x3_03_02_00_0 {
-            cfgs.push("libressl332");
-        }
-        if libressl_version >= 0x3_04_00_00_0 {
-            cfgs.push("libressl340");
-        }
         if libressl_version >= 0x3_05_00_00_0 {
             cfgs.push("libressl350");
         }
diff --git a/openssl-sys/build/main.rs b/openssl-sys/build/main.rs
@@ -418,9 +418,6 @@ See rust-openssl documentation for more information:
         let minor = (libressl_version >> 20) as u8;
         let fix = (libressl_version >> 12) as u8;
         let (major, minor, fix) = match (major, minor, fix) {
-            (3, 3, 0) => ('3', '3', '0'),
-            (3, 3, 1) => ('3', '3', '1'),
-            (3, 3, _) => ('3', '3', 'x'),
             (3, 4, 0) => ('3', '4', '0'),
             (3, 4, _) => ('3', '4', 'x'),
             (3, 5, _) => ('3', '5', 'x'),
@@ -476,7 +473,7 @@ fn version_error() -> ! {
     panic!(
         "
 
-This crate is only compatible with OpenSSL (version 1.0.2 through 1.1.1, or 3), or LibreSSL 3.3
+This crate is only compatible with OpenSSL (version 1.0.2 through 1.1.1, or 3), or LibreSSL 3.4
 through 4.1.x, but a different version of OpenSSL was found. The build is now aborting
 due to this version mismatch.
 
diff --git a/openssl-sys/src/handwritten/bn.rs b/openssl-sys/src/handwritten/bn.rs
@@ -23,7 +23,7 @@ extern "C" {
     pub fn BN_clear_free(bn: *mut BIGNUM);
     pub fn BN_bin2bn(s: *const u8, size: c_int, ret: *mut BIGNUM) -> *mut BIGNUM;
     pub fn BN_bn2bin(a: *const BIGNUM, to: *mut u8) -> c_int;
-    #[cfg(any(ossl110, libressl340))]
+    #[cfg(any(ossl110, libressl))]
     pub fn BN_bn2binpad(a: *const BIGNUM, to: *mut u8, tolen: c_int) -> c_int;
     pub fn BN_sub(r: *mut BIGNUM, a: *const BIGNUM, b: *const BIGNUM) -> c_int;
     pub fn BN_add(r: *mut BIGNUM, a: *const BIGNUM, b: *const BIGNUM) -> c_int;
diff --git a/openssl-sys/src/handwritten/ec.rs b/openssl-sys/src/handwritten/ec.rs
@@ -56,7 +56,7 @@ extern "C" {
 
     pub fn EC_GROUP_get_degree(group: *const EC_GROUP) -> c_int;
 
-    #[cfg(any(ossl110, libressl340))]
+    #[cfg(any(ossl110, libressl))]
     pub fn EC_GROUP_order_bits(group: *const EC_GROUP) -> c_int;
 
     pub fn EC_GROUP_new_curve_GFp(
diff --git a/openssl-sys/src/handwritten/ssl.rs b/openssl-sys/src/handwritten/ssl.rs
@@ -353,13 +353,13 @@ extern "C" {
     #[cfg(ossl111)]
     pub fn SSL_CTX_set_keylog_callback(ctx: *mut SSL_CTX, cb: SSL_CTX_keylog_cb_func);
 
-    #[cfg(any(ossl111, libressl340))]
+    #[cfg(any(ossl111, libressl))]
     pub fn SSL_CTX_set_max_early_data(ctx: *mut SSL_CTX, max_early_data: u32) -> c_int;
-    #[cfg(any(ossl111, libressl340))]
+    #[cfg(any(ossl111, libressl))]
     pub fn SSL_CTX_get_max_early_data(ctx: *const SSL_CTX) -> u32;
-    #[cfg(any(ossl111, libressl340))]
+    #[cfg(any(ossl111, libressl))]
     pub fn SSL_set_max_early_data(ctx: *mut SSL, max_early_data: u32) -> c_int;
-    #[cfg(any(ossl111, libressl340))]
+    #[cfg(any(ossl111, libressl))]
     pub fn SSL_get_max_early_data(ctx: *const SSL) -> u32;
 
     pub fn SSL_get_finished(s: *const SSL, buf: *mut c_void, count: size_t) -> size_t;
@@ -424,9 +424,9 @@ extern "C" {
     pub fn SSL_set_bio(ssl: *mut SSL, rbio: *mut BIO, wbio: *mut BIO);
     pub fn SSL_get_rbio(ssl: *const SSL) -> *mut BIO;
     pub fn SSL_get_wbio(ssl: *const SSL) -> *mut BIO;
-    #[cfg(any(ossl111, libressl340))]
+    #[cfg(any(ossl111, libressl))]
     pub fn SSL_CTX_set_ciphersuites(ctx: *mut SSL_CTX, str: *const c_char) -> c_int;
-    #[cfg(any(ossl111, libressl340))]
+    #[cfg(any(ossl111, libressl))]
     pub fn SSL_set_ciphersuites(ssl: *mut SSL, str: *const c_char) -> c_int;
     pub fn SSL_set_cipher_list(ssl: *mut SSL, s: *const c_char) -> c_int;
     pub fn SSL_set_ssl_method(s: *mut SSL, method: *const SSL_METHOD) -> c_int;
@@ -456,7 +456,7 @@ extern "C" {
     pub fn SSL_use_PrivateKey_file(ssl: *mut SSL, file: *const c_char, type_: c_int) -> c_int;
     pub fn SSL_use_PrivateKey(ssl: *mut SSL, pkey: *mut EVP_PKEY) -> c_int;
     pub fn SSL_use_certificate(ssl: *mut SSL, x: *mut X509) -> c_int;
-    #[cfg(any(ossl110, libressl332))]
+    #[cfg(any(ossl110, libressl))]
     pub fn SSL_use_certificate_chain_file(ssl: *mut SSL, file: *const c_char) -> c_int;
     pub fn SSL_set_client_CA_list(s: *mut SSL, name_list: *mut stack_st_X509_NAME);
     pub fn SSL_add_client_CA(ssl: *mut SSL, x: *mut X509) -> c_int;
@@ -472,9 +472,9 @@ extern "C" {
     #[cfg(any(ossl110, libressl))]
     pub fn SSL_SESSION_get_protocol_version(s: *const SSL_SESSION) -> c_int;
 
-    #[cfg(any(ossl111, libressl340))]
+    #[cfg(any(ossl111, libressl))]
     pub fn SSL_SESSION_set_max_early_data(ctx: *mut SSL_SESSION, max_early_data: u32) -> c_int;
-    #[cfg(any(ossl111, libressl340))]
+    #[cfg(any(ossl111, libressl))]
     pub fn SSL_SESSION_get_max_early_data(ctx: *const SSL_SESSION) -> u32;
 
     pub fn SSL_SESSION_get_id(s: *const SSL_SESSION, len: *mut c_uint) -> *const c_uchar;
@@ -511,7 +511,7 @@ extern "C" {
     );
     pub fn SSL_CTX_set_verify_depth(ctx: *mut SSL_CTX, depth: c_int);
 
-    #[cfg(any(ossl111, libressl340))]
+    #[cfg(any(ossl111, libressl))]
     pub fn SSL_CTX_set_post_handshake_auth(ctx: *mut SSL_CTX, val: c_int);
 
     pub fn SSL_CTX_check_private_key(ctx: *const SSL_CTX) -> c_int;
@@ -581,7 +581,7 @@ extern "C" {
     #[cfg(any(ossl111, libressl350))]
     pub fn SSL_peek_ex(ssl: *mut SSL, buf: *mut c_void, num: usize, readbytes: *mut usize)
         -> c_int;
-    #[cfg(any(ossl111, libressl340))]
+    #[cfg(any(ossl111, libressl))]
     pub fn SSL_read_early_data(
         s: *mut SSL,
         buf: *mut c_void,
@@ -608,7 +608,7 @@ extern "C" {
         num: size_t,
         written: *mut size_t,
     ) -> c_int;
-    #[cfg(any(ossl111, libressl340))]
+    #[cfg(any(ossl111, libressl))]
     pub fn SSL_write_early_data(
         s: *mut SSL,
         buf: *const c_void,
@@ -709,7 +709,6 @@ extern "C" {
 
 extern "C" {
     pub fn SSL_CTX_get0_certificate(ctx: *const SSL_CTX) -> *mut X509;
-    #[cfg(any(ossl102, libressl340))]
     pub fn SSL_CTX_get0_privatekey(ctx: *const SSL_CTX) -> *mut EVP_PKEY;
 
     pub fn SSL_set_shutdown(ss: *mut SSL, mode: c_int);
diff --git a/openssl-sys/src/ssl.rs b/openssl-sys/src/ssl.rs
@@ -136,12 +136,12 @@ cfg_if! {
     if #[cfg(ossl102)] {
         pub const SSL_OP_NO_DTLSv1: ssl_op_type!() = 0x04000000;
         pub const SSL_OP_NO_DTLSv1_2: ssl_op_type!() = 0x08000000;
-    } else if #[cfg(libressl332)] {
+    } else if #[cfg(libressl)] {
         pub const SSL_OP_NO_DTLSv1: ssl_op_type!() = 0x40000000;
         pub const SSL_OP_NO_DTLSv1_2: ssl_op_type!() = 0x80000000;
     }
 }
-#[cfg(any(ossl111, libressl340))]
+#[cfg(any(ossl111, libressl))]
 pub const SSL_OP_NO_TLSv1_3: ssl_op_type!() = 0x20000000;
 
 #[cfg(ossl110h)]
@@ -552,11 +552,11 @@ pub const SSL_CLIENT_HELLO_ERROR: c_int = 0;
 #[cfg(ossl111)]
 pub const SSL_CLIENT_HELLO_RETRY: c_int = -1;
 
-#[cfg(any(ossl111, libressl340))]
+#[cfg(any(ossl111, libressl))]
 pub const SSL_READ_EARLY_DATA_ERROR: c_int = 0;
-#[cfg(any(ossl111, libressl340))]
+#[cfg(any(ossl111, libressl))]
 pub const SSL_READ_EARLY_DATA_SUCCESS: c_int = 1;
-#[cfg(any(ossl111, libressl340))]
+#[cfg(any(ossl111, libressl))]
 pub const SSL_READ_EARLY_DATA_FINISH: c_int = 2;
 
 cfg_if! {
diff --git a/openssl-sys/src/tls1.rs b/openssl-sys/src/tls1.rs
@@ -7,11 +7,10 @@ use super::*;
 pub const TLS1_VERSION: c_int = 0x301;
 pub const TLS1_1_VERSION: c_int = 0x302;
 pub const TLS1_2_VERSION: c_int = 0x303;
-#[cfg(any(ossl111, libressl340))]
+#[cfg(any(ossl111, libressl))]
 pub const TLS1_3_VERSION: c_int = 0x304;
 
 pub const DTLS1_VERSION: c_int = 0xFEFF;
-#[cfg(any(ossl102, libressl332))]
 pub const DTLS1_2_VERSION: c_int = 0xFEFD;
 
 pub const TLS1_AD_DECODE_ERROR: c_int = 50;
diff --git a/openssl/build.rs b/openssl/build.rs
@@ -80,13 +80,9 @@ fn main() {
         println!("cargo:rustc-cfg=libressl291");
         println!("cargo:rustc-cfg=libressl310");
         println!("cargo:rustc-cfg=libressl321");
+        println!("cargo:rustc-cfg=libressl332");
+        println!("cargo:rustc-cfg=libressl340");
 
-        if version >= 0x3_03_02_00_0 {
-            println!("cargo:rustc-cfg=libressl332");
-        }
-        if version >= 0x3_04_00_00_0 {
-            println!("cargo:rustc-cfg=libressl340");
-        }
         if version >= 0x3_05_00_00_0 {
             println!("cargo:rustc-cfg=libressl350");
         }
diff --git a/openssl/src/bn.rs b/openssl/src/bn.rs
@@ -857,7 +857,7 @@ impl BigNumRef {
     /// assert_eq!(&bn_vec, &[0, 0, 0x45, 0x43]);
     /// ```
     #[corresponds(BN_bn2binpad)]
-    #[cfg(any(ossl110, libressl340, boringssl, awslc))]
+    #[cfg(any(ossl110, libressl, boringssl, awslc))]
     pub fn to_vec_padded(&self, pad_to: i32) -> Result<Vec<u8>, ErrorStack> {
         let mut v = Vec::with_capacity(pad_to as usize);
         unsafe {
diff --git a/openssl/src/ec.rs b/openssl/src/ec.rs
@@ -240,7 +240,7 @@ impl EcGroupRef {
 
     /// Returns the number of bits in the group order.
     #[corresponds(EC_GROUP_order_bits)]
-    #[cfg(any(ossl110, libressl340, awslc, boringssl))]
+    #[cfg(any(ossl110, libressl, awslc, boringssl))]
     pub fn order_bits(&self) -> u32 {
         unsafe { ffi::EC_GROUP_order_bits(self.as_ptr()) as u32 }
     }
diff --git a/openssl/src/lib.rs b/openssl/src/lib.rs
@@ -1,7 +1,7 @@
 //! Bindings to OpenSSL
 //!
 //! This crate provides a safe interface to the popular OpenSSL cryptography library. OpenSSL versions 1.0.2 through
-//! 3.x.x and LibreSSL versions 3.3 through 4.1.x are supported.
+//! 3.x.x and LibreSSL versions 3.4 through 4.1.x are supported.
 //!
 //! # Building
 //!
diff --git a/openssl/src/ssl/connector.rs b/openssl/src/ssl/connector.rs
@@ -4,7 +4,7 @@ use std::ops::{Deref, DerefMut};
 
 use crate::dh::Dh;
 use crate::error::ErrorStack;
-#[cfg(any(ossl111, libressl340))]
+#[cfg(any(ossl111, libressl))]
 use crate::ssl::SslVersion;
 use crate::ssl::{
     HandshakeError, Ssl, SslContext, SslContextBuilder, SslContextRef, SslMethod, SslMode,
@@ -239,7 +239,7 @@ impl SslAcceptor {
              ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:\
              DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
         )?;
-        #[cfg(any(ossl111, libressl340))]
+        #[cfg(any(ossl111, libressl))]
         ctx.set_ciphersuites(
             "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256",
         )?;
@@ -251,10 +251,10 @@ impl SslAcceptor {
     /// This corresponds to the modern configuration of version 5 of Mozilla's server side TLS recommendations.
     /// See its [documentation][docs] for more details on specifics.
     ///
-    /// Requires OpenSSL 1.1.1 or LibreSSL 3.4.0 or newer.
+    /// Requires OpenSSL 1.1.1 or newer or LibreSSL.
     ///
     /// [docs]: https://wiki.mozilla.org/Security/Server_Side_TLS
-    #[cfg(any(ossl111, libressl340))]
+    #[cfg(any(ossl111, libressl))]
     pub fn mozilla_modern_v5(method: SslMethod) -> Result<SslAcceptorBuilder, ErrorStack> {
         let mut ctx = ctx(method)?;
         ctx.set_min_proto_version(Some(SslVersion::TLS1_3))?;
@@ -275,7 +275,7 @@ impl SslAcceptor {
     pub fn mozilla_intermediate(method: SslMethod) -> Result<SslAcceptorBuilder, ErrorStack> {
         let mut ctx = ctx(method)?;
         ctx.set_options(SslOptions::CIPHER_SERVER_PREFERENCE);
-        #[cfg(any(ossl111, libressl340))]
+        #[cfg(any(ossl111, libressl))]
         ctx.set_options(SslOptions::NO_TLSV1_3);
         let dh = Dh::params_from_pem(FFDHE_2048.as_bytes())?;
         ctx.set_tmp_dh(&dh)?;
@@ -305,7 +305,7 @@ impl SslAcceptor {
         ctx.set_options(
             SslOptions::CIPHER_SERVER_PREFERENCE | SslOptions::NO_TLSV1 | SslOptions::NO_TLSV1_1,
         );
-        #[cfg(any(ossl111, libressl340))]
+        #[cfg(any(ossl111, libressl))]
         ctx.set_options(SslOptions::NO_TLSV1_3);
         setup_curves(&mut ctx)?;
         ctx.set_cipher_list(
diff --git a/openssl/src/ssl/mod.rs b/openssl/src/ssl/mod.rs
diff --git a/openssl/src/ssl/test/mod.rs b/openssl/src/ssl/test/mod.rs
diff --git a/openssl/src/x509/tests.rs b/openssl/src/x509/tests.rs
