From d6d467b92e527f2f4c1402a4efb8be5933797304 Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" Date: Sat, 5 Aug 2023 10:38:02 -0600 Subject: [PATCH] Add implementation of SSL_read_ex/SSL_write_ex for those without. --- MANIFEST | 3 + Makefile.in | 7 +- configure | 45 +++++++-- configure.ac | 3 +- include/sudo_ssl_compat.h | 31 ++++++ lib/ssl_compat/Makefile.in | 189 +++++++++++++++++++++++++++++++++++ lib/ssl_compat/ssl_compat.c | 56 +++++++++++ logsrvd/Makefile.in | 138 +++++++++++++------------ logsrvd/tls_common.h | 1 + m4/openssl.m4 | 15 ++- plugins/sudoers/Makefile.in | 64 ++++++------ plugins/sudoers/log_client.h | 1 + src/Makefile.in | 4 +- 13 files changed, 453 insertions(+), 104 deletions(-) create mode 100644 include/sudo_ssl_compat.h create mode 100644 lib/ssl_compat/Makefile.in create mode 100644 lib/ssl_compat/ssl_compat.c diff --git a/MANIFEST b/MANIFEST index 3a5426d12..050e65c8f 100644 --- a/MANIFEST +++ b/MANIFEST @@ -110,6 +110,7 @@ include/sudo_lbuf.h include/sudo_plugin.h include/sudo_queue.h include/sudo_rand.h +include/sudo_ssl_compat.h include/sudo_util.h lib/eventlog/Makefile.in lib/eventlog/eventlog.c @@ -227,6 +228,8 @@ lib/logsrv/log_server.pb-c.c lib/logsrv/log_server.proto lib/protobuf-c/Makefile.in lib/protobuf-c/protobuf-c.c +lib/ssl_compat/Makefile.in +lib/ssl_compat/ssl_compat.c lib/util/Makefile.in lib/util/aix.c lib/util/arc4random.c diff --git a/Makefile.in b/Makefile.in index 1d771e18e..f0c33a648 100644 --- a/Makefile.in +++ b/Makefile.in @@ -57,9 +57,10 @@ shlib_mode = @SHLIB_MODE@ python_version = @PYTHON_VERSION@ SUBDIRS = lib/util @ZLIB_SRC@ lib/eventlog lib/fuzzstub lib/iolog \ - lib/protobuf-c @LOGSRV_SRC@ @LOGSRVD_SRC@ plugins/audit_json \ - plugins/group_file plugins/sudoers plugins/system_group \ - @PYTHON_PLUGIN_SRC@ src include docs examples + lib/protobuf-c @SSL_COMPAT_SRC@ @LOGSRV_SRC@ @LOGSRVD_SRC@ \ + plugins/audit_json plugins/group_file plugins/sudoers \ + plugins/system_group @PYTHON_PLUGIN_SRC@ src include \ + docs examples SAMPLES = plugins/sample plugins/sample_approval diff --git a/configure b/configure index 2d827d2b9..ec12856ed 100755 --- a/configure +++ b/configure @@ -784,6 +784,7 @@ LOGSRVD_CONF LOGSRVD_SRC LOGSRV_SRC LOGSRV +SSL_COMPAT_SRC PYTHON_PLUGIN_SRC PYTHON_PLUGIN SIGNAME @@ -25969,12 +25970,6 @@ if test "x$ac_cv_func_TLS_method" = xyes then : printf "%s\n" "#define HAVE_TLS_METHOD 1" >>confdefs.h -fi -ac_fn_c_check_func "$LINENO" "SSL_read_ex" "ac_cv_func_SSL_read_ex" -if test "x$ac_cv_func_SSL_read_ex" = xyes -then : - printf "%s\n" "#define HAVE_SSL_READ_EX 1" >>confdefs.h - fi # SSL_CTX_set_min_proto_version may be a macro @@ -25988,6 +25983,22 @@ then : printf "%s\n" "#define HAVE_SSL_CTX_SET_MIN_PROTO_VERSION 1" >>confdefs.h fi + + for ac_func in SSL_read_ex +do : + ac_fn_c_check_func "$LINENO" "SSL_read_ex" "ac_cv_func_SSL_read_ex" +if test "x$ac_cv_func_SSL_read_ex" = xyes +then : + printf "%s\n" "#define HAVE_SSL_READ_EX 1" >>confdefs.h + +else case e in #( + e) + SSL_COMPAT_SRC=lib/ssl_compat + ;; +esac +fi + +done # LibreSSL TLS 1.3 support may not be enabled, check for declaration too. ac_fn_c_check_func "$LINENO" "SSL_CTX_set_ciphersuites" "ac_cv_func_SSL_CTX_set_ciphersuites" if test "x$ac_cv_func_SSL_CTX_set_ciphersuites" = xyes @@ -26678,6 +26689,25 @@ then : printf "%s\n" "#define HAVE_SSL_CTX_SET_CIPHERSUITES 1" >>confdefs.h fi + ac_fn_check_decl "$LINENO" "SSL_read_ex" "ac_cv_have_decl_SSL_read_ex" " + $ac_includes_default + #include + #include + +" "$ac_c_undeclared_builtin_options" "CFLAGS" +if test "x$ac_cv_have_decl_SSL_read_ex" = xyes +then : + printf "%s\n" "#define HAVE_SSL_READ_EX 1" >>confdefs.h + +else case e in #( + e) + SSL_COMPAT_SRC=lib/ssl_compat + ;; +esac +fi + fi + if test -n "$SSL_COMPAT_SRC"; then + LIBTLS='$(top_builddir)/lib/ssl_compat/libssl_compat.la '"${LIBTLS}" fi @@ -36106,7 +36136,7 @@ then : fi -ac_config_files="$ac_config_files Makefile docs/Makefile examples/Makefile examples/sudoers examples/sudo.conf examples/sudo_logsrvd.conf examples/syslog.conf include/Makefile lib/eventlog/Makefile lib/fuzzstub/Makefile lib/iolog/Makefile lib/logsrv/Makefile lib/protobuf-c/Makefile lib/util/Makefile lib/util/regress/harness lib/util/util.exp logsrvd/Makefile src/intercept.exp src/sudo_usage.h src/Makefile plugins/audit_json/Makefile plugins/sample/Makefile plugins/group_file/Makefile plugins/sample_approval/Makefile plugins/system_group/Makefile plugins/sudoers/Makefile plugins/sudoers/regress/harness plugins/sudoers/sudoers" +ac_config_files="$ac_config_files Makefile docs/Makefile examples/Makefile examples/sudoers examples/sudo.conf examples/sudo_logsrvd.conf examples/syslog.conf include/Makefile lib/eventlog/Makefile lib/fuzzstub/Makefile lib/iolog/Makefile lib/logsrv/Makefile lib/protobuf-c/Makefile lib/ssl_compat/Makefile lib/util/Makefile lib/util/regress/harness lib/util/util.exp logsrvd/Makefile src/intercept.exp src/sudo_usage.h src/Makefile plugins/audit_json/Makefile plugins/sample/Makefile plugins/group_file/Makefile plugins/sample_approval/Makefile plugins/system_group/Makefile plugins/sudoers/Makefile plugins/sudoers/regress/harness plugins/sudoers/sudoers" ac_config_commands="$ac_config_commands harness" @@ -37123,6 +37153,7 @@ do "lib/iolog/Makefile") CONFIG_FILES="$CONFIG_FILES lib/iolog/Makefile" ;; "lib/logsrv/Makefile") CONFIG_FILES="$CONFIG_FILES lib/logsrv/Makefile" ;; "lib/protobuf-c/Makefile") CONFIG_FILES="$CONFIG_FILES lib/protobuf-c/Makefile" ;; + "lib/ssl_compat/Makefile") CONFIG_FILES="$CONFIG_FILES lib/ssl_compat/Makefile" ;; "lib/util/Makefile") CONFIG_FILES="$CONFIG_FILES lib/util/Makefile" ;; "lib/util/regress/harness") CONFIG_FILES="$CONFIG_FILES lib/util/regress/harness" ;; "lib/util/util.exp") CONFIG_FILES="$CONFIG_FILES lib/util/util.exp" ;; diff --git a/configure.ac b/configure.ac index 1a3945406..fdbd3ea06 100644 --- a/configure.ac +++ b/configure.ac @@ -116,6 +116,7 @@ AC_SUBST([devsearch])dnl AC_SUBST([SIGNAME])dnl AC_SUBST([PYTHON_PLUGIN], ['#'])dnl AC_SUBST([PYTHON_PLUGIN_SRC])dnl +AC_SUBST([SSL_COMPAT_SRC])dnl AC_SUBST([LOGSRV])dnl AC_SUBST([LOGSRV_SRC], ['lib/logsrv'])dnl AC_SUBST([LOGSRVD_SRC], ['logsrvd'])dnl @@ -4435,7 +4436,7 @@ AS_IF([test X"$INIT_SCRIPT" != X""], [ AC_CONFIG_FILES([etc/init.d/sudo.conf]) ]) -AC_CONFIG_FILES([Makefile docs/Makefile examples/Makefile examples/sudoers examples/sudo.conf examples/sudo_logsrvd.conf examples/syslog.conf include/Makefile lib/eventlog/Makefile lib/fuzzstub/Makefile lib/iolog/Makefile lib/logsrv/Makefile lib/protobuf-c/Makefile lib/util/Makefile lib/util/regress/harness lib/util/util.exp logsrvd/Makefile src/intercept.exp src/sudo_usage.h src/Makefile plugins/audit_json/Makefile plugins/sample/Makefile plugins/group_file/Makefile plugins/sample_approval/Makefile plugins/system_group/Makefile plugins/sudoers/Makefile plugins/sudoers/regress/harness plugins/sudoers/sudoers]) +AC_CONFIG_FILES([Makefile docs/Makefile examples/Makefile examples/sudoers examples/sudo.conf examples/sudo_logsrvd.conf examples/syslog.conf include/Makefile lib/eventlog/Makefile lib/fuzzstub/Makefile lib/iolog/Makefile lib/logsrv/Makefile lib/protobuf-c/Makefile lib/ssl_compat/Makefile lib/util/Makefile lib/util/regress/harness lib/util/util.exp logsrvd/Makefile src/intercept.exp src/sudo_usage.h src/Makefile plugins/audit_json/Makefile plugins/sample/Makefile plugins/group_file/Makefile plugins/sample_approval/Makefile plugins/system_group/Makefile plugins/sudoers/Makefile plugins/sudoers/regress/harness plugins/sudoers/sudoers]) AC_CONFIG_COMMANDS([harness], [chmod +x lib/util/regress/harness plugins/sudoers/regress/harness]) AC_OUTPUT diff --git a/include/sudo_ssl_compat.h b/include/sudo_ssl_compat.h new file mode 100644 index 000000000..a10169120 --- /dev/null +++ b/include/sudo_ssl_compat.h @@ -0,0 +1,31 @@ +/* + * SPDX-License-Identifier: ISC + * + * Copyright (c) 2023 Todd C. Miller + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef SUDO_SSL_COMPAT_H +#define SUDO_SSL_COMPAT_H + +# ifdef HAVE_OPENSSL + +# ifndef HAVE_SSL_READ_EX +int SSL_read_ex(SSL *, void *, size_t, size_t *); +int SSL_write_ex(SSL *, const void *, size_t, size_t *); +# endif /* HAVE_SSL_READ_EX */ + +# endif /* HAVE_OPENSSL */ + +#endif /* SUDO_SSL_COMPAT_H */ diff --git a/lib/ssl_compat/Makefile.in b/lib/ssl_compat/Makefile.in new file mode 100644 index 000000000..7fef9ad46 --- /dev/null +++ b/lib/ssl_compat/Makefile.in @@ -0,0 +1,189 @@ +# +# SPDX-License-Identifier: ISC +# +# Copyright (c) 2023 Todd C. Miller +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. +# +# @configure_input@ +# + +#### Start of system configuration section. #### + +srcdir = @srcdir@ +abs_srcdir = @abs_srcdir@ +top_srcdir = @top_srcdir@ +abs_top_srcdir = @abs_top_srcdir@ +top_builddir = @top_builddir@ +abs_top_builddir = @abs_top_builddir@ +devdir = @devdir@ +scriptdir = $(top_srcdir)/scripts +incdir = $(top_srcdir)/include + +# Compiler & tools to use +CC = @CC@ +LIBTOOL = @LIBTOOL@ + +# Libraries +LT_LIBS = + +# C preprocessor flags +CPPFLAGS = -I$(incdir) -I$(top_builddir) -I$(srcdir) -I$(top_srcdir) @CPPFLAGS@ + +# Usually -O and/or -g +CFLAGS = @CFLAGS@ + +# Flags to pass to libtool +LTFLAGS = @LT_STATIC@ + +# Address sanitizer flags +ASAN_CFLAGS = @ASAN_CFLAGS@ +ASAN_LDFLAGS = @ASAN_LDFLAGS@ + +# PIE flags +PIE_CFLAGS = @PIE_CFLAGS@ +PIE_LDFLAGS = @PIE_LDFLAGS@ + +# Stack smashing protection flags +HARDENING_CFLAGS = @HARDENING_CFLAGS@ +HARDENING_LDFLAGS = @HARDENING_LDFLAGS@ + +# cppcheck options, usually set in the top-level Makefile +CPPCHECK_OPTS = -q --enable=warning,performance,portability --suppress=constStatement --suppress=compareBoolExpressionWithInt --error-exitcode=1 --inline-suppr -Dva_copy=va_copy -U__cplusplus -UQUAD_MAX -UQUAD_MIN -UUQUAD_MAX -U_POSIX_HOST_NAME_MAX -U_POSIX_PATH_MAX -U__NBBY -DNSIG=64 + +# splint options, usually set in the top-level Makefile +SPLINT_OPTS = -D__restrict= -checks + +# PVS-studio options +PVS_CFG = $(top_srcdir)/PVS-Studio.cfg +PVS_IGNORE = 'V707,V011,V002,V536' +PVS_LOG_OPTS = -a 'GA:1,2' -e -t errorfile -d $(PVS_IGNORE) + +# Set to non-empty for development mode +DEVEL = @DEVEL@ + +#### End of system configuration section. #### + +SHELL = @SHELL@ + +LIBSSL_COMPAT_OBJS = ssl_compat.lo + +IOBJS = $(LIBSSL_COMPAT_OBJS:.lo=.i) + +POBJS = $(IOBJS:.i=.plog) + +GENERATED = + +all: libssl_compat.la + +depend: + $(scriptdir)/mkdep.pl --srcdir=$(abs_top_srcdir) \ + --builddir=$(abs_top_builddir) lib/ssl_compat/Makefile.in + cd $(top_builddir) && ./config.status --file lib/ssl_compat/Makefile + +Makefile: $(srcdir)/Makefile.in + cd $(top_builddir) && ./config.status --file lib/ssl_compat/Makefile + +.SUFFIXES: .c .h .i .lo .plog + +.c.lo: + $(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $< + +.c.i: + $(CC) -E -o $@ $(CPPFLAGS) $< + +.i.plog: + ifile=$<; rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $${ifile%i}c --i-file $< --output-file $@ + +$(devdir)/log_server.pb-c.c: $(srcdir)/log_server.proto + @if [ -n "$(DEVEL)" ]; then \ + cmd='protoc-c --c_out=$(devdir) --proto_path=$(srcdir) $(srcdir)/log_server.proto'; \ + echo "$$cmd"; eval $$cmd; \ + cmd='$(scriptdir)/unanon $(devdir)/log_server.pb-c.h $(devdir)/log_server.pb-c.c'; \ + echo "$$cmd"; eval $$cmd; \ + if [ "$(devdir)" == "$(srcdir)" ]; then \ + cmd='mv -f $(devdir)/log_server.pb-c.h $(incdir)/log_server.pb-c.h'; \ + else \ + cmd='mv -f $(devdir)/log_server.pb-c.h $(top_builddir)/log_server.pb-c.h'; \ + fi; \ + echo "$$cmd"; eval $$cmd; \ + fi + +libssl_compat.la: $(LIBSSL_COMPAT_OBJS) $(LT_LIBS) + $(LIBTOOL) $(LTFLAGS) --mode=link $(CC) -o $@ $(LIBSSL_COMPAT_OBJS) $(LT_LIBS) + +pre-install: + +install: + +install-binaries: + +install-includes: + +install-doc: + +install-plugin: + +install-fuzzer: + +uninstall: + +splint: + splint $(SPLINT_OPTS) -I$(incdir) -I$(top_builddir) -I$(top_srcdir) $(srcdir)/*.c + +cppcheck: + cppcheck $(CPPCHECK_OPTS) -I$(incdir) -I$(top_builddir) -I$(top_srcdir) $(srcdir)/*.c + +pvs-log-files: + +pvs-studio: + +fuzz: + +check-fuzzer: + +check: check-fuzzer + +check-verbose: check + +clean: + -$(LIBTOOL) $(LTFLAGS) --mode=clean rm -f *.lo *.o *.la + -rm -f *.i *.plog stamp-* core *.core core.* + +mostlyclean: clean + +distclean: clean + -rm -rf Makefile .libs + @if [ -n "$(DEVEL)" -a "$(devdir)" != "$(srcdir)" ]; then \ + cmd='rm -rf $(GENERATED)'; \ + echo "$$cmd"; eval $$cmd; \ + fi + +clobber: distclean + +realclean: distclean + rm -f TAGS tags + +cleandir: realclean + +.PHONY: clean mostlyclean distclean cleandir clobber realclean + +# Autogenerated dependencies, do not modify +ssl_compat.lo: $(srcdir)/ssl_compat.c $(incdir)/sudo_compat.h \ + $(incdir)/sudo_ssl_compat.h $(top_builddir)/config.h + $(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/ssl_compat.c +ssl_compat.i: $(srcdir)/ssl_compat.c $(incdir)/sudo_compat.h \ + $(incdir)/sudo_ssl_compat.h $(top_builddir)/config.h + $(CC) -E -o $@ $(CPPFLAGS) $< +ssl_compat.plog: ssl_compat.i + rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/ssl_compat.c --i-file $< --output-file $@ diff --git a/lib/ssl_compat/ssl_compat.c b/lib/ssl_compat/ssl_compat.c new file mode 100644 index 000000000..61b6e79a5 --- /dev/null +++ b/lib/ssl_compat/ssl_compat.c @@ -0,0 +1,56 @@ +/* + * SPDX-License-Identifier: ISC + * + * Copyright (c) 2023 Todd C. Miller + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +/* + * This is an open source non-commercial project. Dear PVS-Studio, please check it. + * PVS-Studio Static Code Analyzer for C, C++ and C#: http://www.viva64.com + */ + +#include + +#if defined(HAVE_OPENSSL) && !defined(HAVE_SSL_READ_EX) + +# include +# if defined(HAVE_WOLFSSL) +# include +# endif +# include + +# include "sudo_compat.h" +# include "sudo_ssl_compat.h" + +int +SSL_read_ex(SSL *ssl, void *buf, size_t num, size_t *readbytes) +{ + int nr = SSL_read(ssl, buf, (int)num); + if (nr <= 0) + return nr; + *readbytes = (size_t)nr; + return 1; +} + +int +SSL_write_ex(SSL *ssl, const void *buf, size_t num, size_t *written) +{ + int nw = SSL_write(ssl, buf, (int)num); + if (nw <= 0) + return nw; + *written = (size_t)nw; + return 1; +} +#endif /* HAVE_OPENSSL && !HAVE_SSL_READ_EX */ diff --git a/logsrvd/Makefile.in b/logsrvd/Makefile.in index 028e752f5..1c7e3ee82 100644 --- a/logsrvd/Makefile.in +++ b/logsrvd/Makefile.in @@ -318,9 +318,10 @@ fuzz_logsrvd_conf.o: $(srcdir)/regress/fuzz/fuzz_logsrvd_conf.c \ $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \ $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \ $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \ - $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \ - $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \ - $(srcdir)/tls_common.h $(top_builddir)/config.h + $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \ + $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ + $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ + $(top_builddir)/config.h $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/regress/fuzz/fuzz_logsrvd_conf.c fuzz_logsrvd_conf.i: $(srcdir)/regress/fuzz/fuzz_logsrvd_conf.c \ $(incdir)/compat/stdbool.h $(incdir)/log_server.pb-c.h \ @@ -328,9 +329,10 @@ fuzz_logsrvd_conf.i: $(srcdir)/regress/fuzz/fuzz_logsrvd_conf.c \ $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \ $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \ $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \ - $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \ - $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \ - $(srcdir)/tls_common.h $(top_builddir)/config.h + $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \ + $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ + $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ + $(top_builddir)/config.h $(CC) -E -o $@ $(CPPFLAGS) $< fuzz_logsrvd_conf.plog: fuzz_logsrvd_conf.i rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/regress/fuzz/fuzz_logsrvd_conf.c --i-file $< --output-file $@ @@ -340,9 +342,9 @@ iolog_writer.o: $(srcdir)/iolog_writer.c $(incdir)/compat/stdbool.h \ $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \ $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \ $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \ - $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ - $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ - $(top_builddir)/config.h + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ + $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \ + $(srcdir)/tls_common.h $(top_builddir)/config.h $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/iolog_writer.c iolog_writer.i: $(srcdir)/iolog_writer.c $(incdir)/compat/stdbool.h \ $(incdir)/log_server.pb-c.h $(incdir)/protobuf-c/protobuf-c.h \ @@ -350,9 +352,9 @@ iolog_writer.i: $(srcdir)/iolog_writer.c $(incdir)/compat/stdbool.h \ $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \ $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \ $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \ - $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ - $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ - $(top_builddir)/config.h + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ + $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \ + $(srcdir)/tls_common.h $(top_builddir)/config.h $(CC) -E -o $@ $(CPPFLAGS) $< iolog_writer.plog: iolog_writer.i rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/iolog_writer.c --i-file $< --output-file $@ @@ -380,7 +382,8 @@ logsrvd.o: $(srcdir)/logsrvd.c $(incdir)/compat/getopt.h \ $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \ $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \ $(incdir)/sudo_json.h $(incdir)/sudo_plugin.h \ - $(incdir)/sudo_queue.h $(incdir)/sudo_rand.h $(incdir)/sudo_util.h \ + $(incdir)/sudo_queue.h $(incdir)/sudo_rand.h \ + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ $(top_builddir)/config.h $(top_builddir)/pathnames.h $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/logsrvd.c @@ -392,7 +395,8 @@ logsrvd.i: $(srcdir)/logsrvd.c $(incdir)/compat/getopt.h \ $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \ $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \ $(incdir)/sudo_json.h $(incdir)/sudo_plugin.h \ - $(incdir)/sudo_queue.h $(incdir)/sudo_rand.h $(incdir)/sudo_util.h \ + $(incdir)/sudo_queue.h $(incdir)/sudo_rand.h \ + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ $(top_builddir)/config.h $(top_builddir)/pathnames.h $(CC) -E -o $@ $(CPPFLAGS) $< @@ -404,10 +408,10 @@ logsrvd_conf.o: $(srcdir)/logsrvd_conf.c $(incdir)/compat/getaddrinfo.h \ $(incdir)/sudo_debug.h $(incdir)/sudo_eventlog.h \ $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \ $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \ - $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \ - $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \ - $(srcdir)/tls_common.h $(top_builddir)/config.h \ - $(top_builddir)/pathnames.h + $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \ + $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ + $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ + $(top_builddir)/config.h $(top_builddir)/pathnames.h $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/logsrvd_conf.c logsrvd_conf.i: $(srcdir)/logsrvd_conf.c $(incdir)/compat/getaddrinfo.h \ $(incdir)/compat/stdbool.h $(incdir)/log_server.pb-c.h \ @@ -415,10 +419,10 @@ logsrvd_conf.i: $(srcdir)/logsrvd_conf.c $(incdir)/compat/getaddrinfo.h \ $(incdir)/sudo_debug.h $(incdir)/sudo_eventlog.h \ $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \ $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \ - $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \ - $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \ - $(srcdir)/tls_common.h $(top_builddir)/config.h \ - $(top_builddir)/pathnames.h + $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \ + $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ + $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ + $(top_builddir)/config.h $(top_builddir)/pathnames.h $(CC) -E -o $@ $(CPPFLAGS) $< logsrvd_conf.plog: logsrvd_conf.i rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/logsrvd_conf.c --i-file $< --output-file $@ @@ -426,17 +430,17 @@ logsrvd_conf_test.o: $(srcdir)/regress/logsrvd_conf/logsrvd_conf_test.c \ $(incdir)/compat/stdbool.h $(incdir)/log_server.pb-c.h \ $(incdir)/protobuf-c/protobuf-c.h $(incdir)/sudo_compat.h \ $(incdir)/sudo_iolog.h $(incdir)/sudo_queue.h \ - $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ - $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ - $(top_builddir)/config.h + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ + $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \ + $(srcdir)/tls_common.h $(top_builddir)/config.h $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/regress/logsrvd_conf/logsrvd_conf_test.c logsrvd_conf_test.i: $(srcdir)/regress/logsrvd_conf/logsrvd_conf_test.c \ $(incdir)/compat/stdbool.h $(incdir)/log_server.pb-c.h \ $(incdir)/protobuf-c/protobuf-c.h $(incdir)/sudo_compat.h \ $(incdir)/sudo_iolog.h $(incdir)/sudo_queue.h \ - $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ - $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ - $(top_builddir)/config.h + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ + $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \ + $(srcdir)/tls_common.h $(top_builddir)/config.h $(CC) -E -o $@ $(CPPFLAGS) $< logsrvd_conf_test.plog: logsrvd_conf_test.i rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/regress/logsrvd_conf/logsrvd_conf_test.c --i-file $< --output-file $@ @@ -447,9 +451,10 @@ logsrvd_journal.o: $(srcdir)/logsrvd_journal.c $(incdir)/compat/stdbool.h \ $(incdir)/sudo_event.h $(incdir)/sudo_eventlog.h \ $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \ $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \ - $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \ - $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \ - $(srcdir)/tls_common.h $(top_builddir)/config.h + $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \ + $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ + $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ + $(top_builddir)/config.h $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/logsrvd_journal.c logsrvd_journal.i: $(srcdir)/logsrvd_journal.c $(incdir)/compat/stdbool.h \ $(incdir)/log_server.pb-c.h \ @@ -458,9 +463,10 @@ logsrvd_journal.i: $(srcdir)/logsrvd_journal.c $(incdir)/compat/stdbool.h \ $(incdir)/sudo_event.h $(incdir)/sudo_eventlog.h \ $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \ $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \ - $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \ - $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \ - $(srcdir)/tls_common.h $(top_builddir)/config.h + $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \ + $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ + $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ + $(top_builddir)/config.h $(CC) -E -o $@ $(CPPFLAGS) $< logsrvd_journal.plog: logsrvd_journal.i rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/logsrvd_journal.c --i-file $< --output-file $@ @@ -472,9 +478,9 @@ logsrvd_local.o: $(srcdir)/logsrvd_local.c $(incdir)/compat/stdbool.h \ $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \ $(incdir)/sudo_json.h $(incdir)/sudo_plugin.h \ $(incdir)/sudo_queue.h $(incdir)/sudo_rand.h \ - $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ - $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ - $(top_builddir)/config.h + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ + $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \ + $(srcdir)/tls_common.h $(top_builddir)/config.h $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/logsrvd_local.c logsrvd_local.i: $(srcdir)/logsrvd_local.c $(incdir)/compat/stdbool.h \ $(incdir)/log_server.pb-c.h $(incdir)/protobuf-c/protobuf-c.h \ @@ -484,9 +490,9 @@ logsrvd_local.i: $(srcdir)/logsrvd_local.c $(incdir)/compat/stdbool.h \ $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \ $(incdir)/sudo_json.h $(incdir)/sudo_plugin.h \ $(incdir)/sudo_queue.h $(incdir)/sudo_rand.h \ - $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ - $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ - $(top_builddir)/config.h + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ + $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \ + $(srcdir)/tls_common.h $(top_builddir)/config.h $(CC) -E -o $@ $(CPPFLAGS) $< logsrvd_local.plog: logsrvd_local.i rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/logsrvd_local.c --i-file $< --output-file $@ @@ -497,9 +503,9 @@ logsrvd_queue.o: $(srcdir)/logsrvd_queue.c $(incdir)/compat/stdbool.h \ $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \ $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \ $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \ - $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ - $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ - $(top_builddir)/config.h + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ + $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \ + $(srcdir)/tls_common.h $(top_builddir)/config.h $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/logsrvd_queue.c logsrvd_queue.i: $(srcdir)/logsrvd_queue.c $(incdir)/compat/stdbool.h \ $(incdir)/log_server.pb-c.h $(incdir)/protobuf-c/protobuf-c.h \ @@ -508,9 +514,9 @@ logsrvd_queue.i: $(srcdir)/logsrvd_queue.c $(incdir)/compat/stdbool.h \ $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \ $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \ $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \ - $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ - $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ - $(top_builddir)/config.h + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ + $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \ + $(srcdir)/tls_common.h $(top_builddir)/config.h $(CC) -E -o $@ $(CPPFLAGS) $< logsrvd_queue.plog: logsrvd_queue.i rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/logsrvd_queue.c --i-file $< --output-file $@ @@ -520,9 +526,10 @@ logsrvd_relay.o: $(srcdir)/logsrvd_relay.c $(incdir)/compat/stdbool.h \ $(incdir)/sudo_event.h $(incdir)/sudo_eventlog.h \ $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \ $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \ - $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \ - $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \ - $(srcdir)/tls_common.h $(top_builddir)/config.h + $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \ + $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ + $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ + $(top_builddir)/config.h $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/logsrvd_relay.c logsrvd_relay.i: $(srcdir)/logsrvd_relay.c $(incdir)/compat/stdbool.h \ $(incdir)/log_server.pb-c.h $(incdir)/protobuf-c/protobuf-c.h \ @@ -530,9 +537,10 @@ logsrvd_relay.i: $(srcdir)/logsrvd_relay.c $(incdir)/compat/stdbool.h \ $(incdir)/sudo_event.h $(incdir)/sudo_eventlog.h \ $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \ $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \ - $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \ - $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \ - $(srcdir)/tls_common.h $(top_builddir)/config.h + $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \ + $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ + $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \ + $(top_builddir)/config.h $(CC) -E -o $@ $(CPPFLAGS) $< logsrvd_relay.plog: logsrvd_relay.i rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/logsrvd_relay.c --i-file $< --output-file $@ @@ -544,8 +552,9 @@ sendlog.o: $(srcdir)/sendlog.c $(incdir)/compat/getaddrinfo.h \ $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \ $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \ $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \ - $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h $(srcdir)/sendlog.h \ - $(srcdir)/tls_common.h $(top_builddir)/config.h + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ + $(srcdir)/logsrv_util.h $(srcdir)/sendlog.h $(srcdir)/tls_common.h \ + $(top_builddir)/config.h $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/sendlog.c sendlog.i: $(srcdir)/sendlog.c $(incdir)/compat/getaddrinfo.h \ $(incdir)/compat/getopt.h $(incdir)/compat/stdbool.h \ @@ -555,8 +564,9 @@ sendlog.i: $(srcdir)/sendlog.c $(incdir)/compat/getaddrinfo.h \ $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \ $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \ $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \ - $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h $(srcdir)/sendlog.h \ - $(srcdir)/tls_common.h $(top_builddir)/config.h + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ + $(srcdir)/logsrv_util.h $(srcdir)/sendlog.h $(srcdir)/tls_common.h \ + $(top_builddir)/config.h $(CC) -E -o $@ $(CPPFLAGS) $< sendlog.plog: sendlog.i rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/sendlog.c --i-file $< --output-file $@ @@ -565,16 +575,18 @@ tls_client.o: $(srcdir)/tls_client.c $(incdir)/compat/stdbool.h \ $(incdir)/sudo_debug.h $(incdir)/sudo_event.h \ $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \ $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \ - $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ - $(srcdir)/tls_common.h $(top_builddir)/config.h + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ + $(srcdir)/logsrv_util.h $(srcdir)/tls_common.h \ + $(top_builddir)/config.h $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/tls_client.c tls_client.i: $(srcdir)/tls_client.c $(incdir)/compat/stdbool.h \ $(incdir)/hostcheck.h $(incdir)/sudo_compat.h \ $(incdir)/sudo_debug.h $(incdir)/sudo_event.h \ $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \ $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \ - $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \ - $(srcdir)/tls_common.h $(top_builddir)/config.h + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ + $(srcdir)/logsrv_util.h $(srcdir)/tls_common.h \ + $(top_builddir)/config.h $(CC) -E -o $@ $(CPPFLAGS) $< tls_client.plog: tls_client.i rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/tls_client.c --i-file $< --output-file $@ @@ -583,14 +595,16 @@ tls_init.o: $(srcdir)/tls_init.c $(incdir)/compat/stdbool.h \ $(incdir)/sudo_debug.h $(incdir)/sudo_event.h \ $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \ $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \ - $(srcdir)/tls_common.h $(top_builddir)/config.h + $(incdir)/sudo_ssl_compat.h $(srcdir)/tls_common.h \ + $(top_builddir)/config.h $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/tls_init.c tls_init.i: $(srcdir)/tls_init.c $(incdir)/compat/stdbool.h \ $(incdir)/hostcheck.h $(incdir)/sudo_compat.h \ $(incdir)/sudo_debug.h $(incdir)/sudo_event.h \ $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \ $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \ - $(srcdir)/tls_common.h $(top_builddir)/config.h + $(incdir)/sudo_ssl_compat.h $(srcdir)/tls_common.h \ + $(top_builddir)/config.h $(CC) -E -o $@ $(CPPFLAGS) $< tls_init.plog: tls_init.i rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/tls_init.c --i-file $< --output-file $@ diff --git a/logsrvd/tls_common.h b/logsrvd/tls_common.h index 505801c3e..61fbe1027 100644 --- a/logsrvd/tls_common.h +++ b/logsrvd/tls_common.h @@ -27,6 +27,7 @@ # endif # include # include +# include "sudo_ssl_compat.h" struct tls_client_closure { SSL *ssl; diff --git a/m4/openssl.m4 b/m4/openssl.m4 index 019ec1dbf..6c2d6a688 100644 --- a/m4/openssl.m4 +++ b/m4/openssl.m4 @@ -156,12 +156,15 @@ AC_DEFUN([SUDO_CHECK_OPENSSL], [ if test "${enable_openssl-no}" != no; then OLIBS="$LIBS" LIBS="$LIBS $LIBTLS" - AC_CHECK_FUNCS([X509_STORE_CTX_get0_cert ASN1_STRING_get0_data SSL_CTX_get0_certificate SSL_CTX_set0_tmp_dh_pkey TLS_method SSL_read_ex]) + AC_CHECK_FUNCS([X509_STORE_CTX_get0_cert ASN1_STRING_get0_data SSL_CTX_get0_certificate SSL_CTX_set0_tmp_dh_pkey TLS_method]) # SSL_CTX_set_min_proto_version may be a macro AC_CHECK_DECL([SSL_CTX_set_min_proto_version], [AC_DEFINE(HAVE_SSL_CTX_SET_MIN_PROTO_VERSION)], [], [ AC_INCLUDES_DEFAULT #include ]) + AC_CHECK_FUNCS([SSL_read_ex], [], [ + SSL_COMPAT_SRC=lib/ssl_compat + ]) # LibreSSL TLS 1.3 support may not be enabled, check for declaration too. AC_CHECK_FUNC([SSL_CTX_set_ciphersuites], [ AC_CHECK_DECL([SSL_CTX_set_ciphersuites], [AC_DEFINE(HAVE_SSL_CTX_SET_CIPHERSUITES)], [], [ @@ -292,5 +295,15 @@ AC_DEFUN([SUDO_CHECK_OPENSSL], [ #include #include ]) + AC_CHECK_DECL([SSL_read_ex], [AC_DEFINE(HAVE_SSL_READ_EX)], [ + SSL_COMPAT_SRC=lib/ssl_compat + ], [ + AC_INCLUDES_DEFAULT + #include + #include + ]) + fi + if test -n "$SSL_COMPAT_SRC"; then + LIBTLS='$(top_builddir)/lib/ssl_compat/libssl_compat.la '"${LIBTLS}" fi ]) diff --git a/plugins/sudoers/Makefile.in b/plugins/sudoers/Makefile.in index 8c3f1b80d..9455b635a 100644 --- a/plugins/sudoers/Makefile.in +++ b/plugins/sudoers/Makefile.in @@ -783,10 +783,11 @@ audit.lo: $(srcdir)/audit.c $(devdir)/def_data.h $(incdir)/compat/stdbool.h \ $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \ $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \ $(incdir)/sudo_gettext.h $(incdir)/sudo_plugin.h \ - $(incdir)/sudo_queue.h $(incdir)/sudo_util.h $(srcdir)/bsm_audit.h \ - $(srcdir)/defaults.h $(srcdir)/linux_audit.h $(srcdir)/log_client.h \ - $(srcdir)/logging.h $(srcdir)/parse.h $(srcdir)/solaris_audit.h \ - $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \ + $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \ + $(incdir)/sudo_util.h $(srcdir)/bsm_audit.h $(srcdir)/defaults.h \ + $(srcdir)/linux_audit.h $(srcdir)/log_client.h $(srcdir)/logging.h \ + $(srcdir)/parse.h $(srcdir)/solaris_audit.h $(srcdir)/sudo_nss.h \ + $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \ $(top_builddir)/config.h $(top_builddir)/pathnames.h $(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/audit.c audit.i: $(srcdir)/audit.c $(devdir)/def_data.h $(incdir)/compat/stdbool.h \ @@ -794,10 +795,11 @@ audit.i: $(srcdir)/audit.c $(devdir)/def_data.h $(incdir)/compat/stdbool.h \ $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \ $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \ $(incdir)/sudo_gettext.h $(incdir)/sudo_plugin.h \ - $(incdir)/sudo_queue.h $(incdir)/sudo_util.h $(srcdir)/bsm_audit.h \ - $(srcdir)/defaults.h $(srcdir)/linux_audit.h $(srcdir)/log_client.h \ - $(srcdir)/logging.h $(srcdir)/parse.h $(srcdir)/solaris_audit.h \ - $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \ + $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \ + $(incdir)/sudo_util.h $(srcdir)/bsm_audit.h $(srcdir)/defaults.h \ + $(srcdir)/linux_audit.h $(srcdir)/log_client.h $(srcdir)/logging.h \ + $(srcdir)/parse.h $(srcdir)/solaris_audit.h $(srcdir)/sudo_nss.h \ + $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \ $(top_builddir)/config.h $(top_builddir)/pathnames.h $(CC) -E -o $@ $(CPPFLAGS) $< audit.plog: audit.i @@ -2013,7 +2015,8 @@ iolog.lo: $(srcdir)/iolog.c $(devdir)/def_data.h $(incdir)/compat/stdbool.h \ $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \ $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \ $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \ - $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \ + $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \ + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ $(srcdir)/defaults.h $(srcdir)/log_client.h $(srcdir)/logging.h \ $(srcdir)/parse.h $(srcdir)/strlist.h $(srcdir)/sudo_nss.h \ $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \ @@ -2024,7 +2027,8 @@ iolog.i: $(srcdir)/iolog.c $(devdir)/def_data.h $(incdir)/compat/stdbool.h \ $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \ $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \ $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \ - $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \ + $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \ + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ $(srcdir)/defaults.h $(srcdir)/log_client.h $(srcdir)/logging.h \ $(srcdir)/parse.h $(srcdir)/strlist.h $(srcdir)/sudo_nss.h \ $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \ @@ -2228,11 +2232,12 @@ log_client.lo: $(srcdir)/log_client.c $(devdir)/def_data.h \ $(incdir)/sudo_event.h $(incdir)/sudo_eventlog.h \ $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \ $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \ - $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \ - $(srcdir)/defaults.h $(srcdir)/log_client.h $(srcdir)/logging.h \ - $(srcdir)/parse.h $(srcdir)/strlist.h $(srcdir)/sudo_nss.h \ - $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \ - $(top_builddir)/config.h $(top_builddir)/pathnames.h + $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \ + $(incdir)/sudo_util.h $(srcdir)/defaults.h \ + $(srcdir)/log_client.h $(srcdir)/logging.h $(srcdir)/parse.h \ + $(srcdir)/strlist.h $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h \ + $(srcdir)/sudoers_debug.h $(top_builddir)/config.h \ + $(top_builddir)/pathnames.h $(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/log_client.c log_client.i: $(srcdir)/log_client.c $(devdir)/def_data.h \ $(incdir)/compat/getaddrinfo.h $(incdir)/compat/stdbool.h \ @@ -2242,11 +2247,12 @@ log_client.i: $(srcdir)/log_client.c $(devdir)/def_data.h \ $(incdir)/sudo_event.h $(incdir)/sudo_eventlog.h \ $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \ $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \ - $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \ - $(srcdir)/defaults.h $(srcdir)/log_client.h $(srcdir)/logging.h \ - $(srcdir)/parse.h $(srcdir)/strlist.h $(srcdir)/sudo_nss.h \ - $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \ - $(top_builddir)/config.h $(top_builddir)/pathnames.h + $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \ + $(incdir)/sudo_util.h $(srcdir)/defaults.h \ + $(srcdir)/log_client.h $(srcdir)/logging.h $(srcdir)/parse.h \ + $(srcdir)/strlist.h $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h \ + $(srcdir)/sudoers_debug.h $(top_builddir)/config.h \ + $(top_builddir)/pathnames.h $(CC) -E -o $@ $(CPPFLAGS) $< log_client.plog: log_client.i rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/log_client.c --i-file $< --output-file $@ @@ -2257,9 +2263,10 @@ logging.lo: $(srcdir)/logging.c $(devdir)/def_data.h \ $(incdir)/sudo_debug.h $(incdir)/sudo_eventlog.h \ $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \ $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \ - $(incdir)/sudo_util.h $(srcdir)/defaults.h $(srcdir)/log_client.h \ - $(srcdir)/logging.h $(srcdir)/parse.h $(srcdir)/strlist.h \ - $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \ + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ + $(srcdir)/defaults.h $(srcdir)/log_client.h $(srcdir)/logging.h \ + $(srcdir)/parse.h $(srcdir)/strlist.h $(srcdir)/sudo_nss.h \ + $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \ $(top_builddir)/config.h $(top_builddir)/pathnames.h $(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/logging.c logging.i: $(srcdir)/logging.c $(devdir)/def_data.h \ @@ -2269,9 +2276,10 @@ logging.i: $(srcdir)/logging.c $(devdir)/def_data.h \ $(incdir)/sudo_debug.h $(incdir)/sudo_eventlog.h \ $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \ $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \ - $(incdir)/sudo_util.h $(srcdir)/defaults.h $(srcdir)/log_client.h \ - $(srcdir)/logging.h $(srcdir)/parse.h $(srcdir)/strlist.h \ - $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \ + $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \ + $(srcdir)/defaults.h $(srcdir)/log_client.h $(srcdir)/logging.h \ + $(srcdir)/parse.h $(srcdir)/strlist.h $(srcdir)/sudo_nss.h \ + $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \ $(top_builddir)/config.h $(top_builddir)/pathnames.h $(CC) -E -o $@ $(CPPFLAGS) $< logging.plog: logging.i @@ -3076,7 +3084,7 @@ testsudoers.o: $(srcdir)/testsudoers.c $(devdir)/def_data.h $(devdir)/gram.h \ $(srcdir)/interfaces.h $(srcdir)/logging.h $(srcdir)/parse.h \ $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h \ $(srcdir)/sudoers_debug.h $(srcdir)/testsudoers_pwutil.h \ - $(srcdir)/tsgetgrpw.h $(top_builddir)/config.h \ + $(srcdir)/toke.h $(srcdir)/tsgetgrpw.h $(top_builddir)/config.h \ $(top_builddir)/pathnames.h $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/testsudoers.c testsudoers.i: $(srcdir)/testsudoers.c $(devdir)/def_data.h $(devdir)/gram.h \ @@ -3089,7 +3097,7 @@ testsudoers.i: $(srcdir)/testsudoers.c $(devdir)/def_data.h $(devdir)/gram.h \ $(srcdir)/interfaces.h $(srcdir)/logging.h $(srcdir)/parse.h \ $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h \ $(srcdir)/sudoers_debug.h $(srcdir)/testsudoers_pwutil.h \ - $(srcdir)/tsgetgrpw.h $(top_builddir)/config.h \ + $(srcdir)/toke.h $(srcdir)/tsgetgrpw.h $(top_builddir)/config.h \ $(top_builddir)/pathnames.h $(CC) -E -o $@ $(CPPFLAGS) $< testsudoers.plog: testsudoers.i diff --git a/plugins/sudoers/log_client.h b/plugins/sudoers/log_client.h index f23fcf2cb..5e37e986b 100644 --- a/plugins/sudoers/log_client.h +++ b/plugins/sudoers/log_client.h @@ -25,6 +25,7 @@ # include # endif /* HAVE_WOLFSSL */ # include +# include "sudo_ssl_compat.h" #endif /* HAVE_OPENSSL */ #include "log_server.pb-c.h" diff --git a/src/Makefile.in b/src/Makefile.in index 57299ad9b..e2ff91941 100644 --- a/src/Makefile.in +++ b/src/Makefile.in @@ -1010,13 +1010,13 @@ sudo_intercept_common.plog: sudo_intercept_common.i suspend_parent.o: $(srcdir)/suspend_parent.c $(incdir)/compat/stdbool.h \ $(incdir)/sudo_debug.h $(incdir)/sudo_fatal.h \ $(incdir)/sudo_gettext.h $(incdir)/sudo_plugin.h \ - $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \ + $(incdir)/sudo_queue.h $(srcdir)/sudo_exec.h \ $(top_builddir)/config.h $(top_builddir)/pathnames.h $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/suspend_parent.c suspend_parent.i: $(srcdir)/suspend_parent.c $(incdir)/compat/stdbool.h \ $(incdir)/sudo_debug.h $(incdir)/sudo_fatal.h \ $(incdir)/sudo_gettext.h $(incdir)/sudo_plugin.h \ - $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \ + $(incdir)/sudo_queue.h $(srcdir)/sudo_exec.h \ $(top_builddir)/config.h $(top_builddir)/pathnames.h $(CC) -E -o $@ $(CPPFLAGS) $< suspend_parent.plog: suspend_parent.i