Add implementation of SSL_read_ex/SSL_write_ex for those without.

MANIFEST

@@ -110,6 +110,7 @@ include/sudo_lbuf.h
 include/sudo_plugin.h
 include/sudo_queue.h
 include/sudo_rand.h
+include/sudo_ssl_compat.h
 include/sudo_util.h
 lib/eventlog/Makefile.in
 lib/eventlog/eventlog.c
@@ -227,6 +228,8 @@ lib/logsrv/log_server.pb-c.c
 lib/logsrv/log_server.proto
 lib/protobuf-c/Makefile.in
 lib/protobuf-c/protobuf-c.c
+lib/ssl_compat/Makefile.in
+lib/ssl_compat/ssl_compat.c
 lib/util/Makefile.in
 lib/util/aix.c
 lib/util/arc4random.c

Makefile.in

@@ -57,9 +57,10 @@ shlib_mode = @SHLIB_MODE@
 python_version = @PYTHON_VERSION@
 
 SUBDIRS = lib/util @ZLIB_SRC@ lib/eventlog lib/fuzzstub lib/iolog \
-	  lib/protobuf-c @LOGSRV_SRC@ @LOGSRVD_SRC@ plugins/audit_json \
+	  lib/protobuf-c @SSL_COMPAT_SRC@ @LOGSRV_SRC@ @LOGSRVD_SRC@ \
-	  plugins/group_file plugins/sudoers plugins/system_group \
+	  plugins/audit_json plugins/group_file plugins/sudoers \
-	  @PYTHON_PLUGIN_SRC@ src include docs examples
+	  plugins/system_group @PYTHON_PLUGIN_SRC@ src include \
+	  docs examples
 
 SAMPLES = plugins/sample plugins/sample_approval
 

configure

@@ -784,6 +784,7 @@ LOGSRVD_CONF
 LOGSRVD_SRC
 LOGSRV_SRC
 LOGSRV
+SSL_COMPAT_SRC
 PYTHON_PLUGIN_SRC
 PYTHON_PLUGIN
 SIGNAME
@@ -25969,12 +25970,6 @@ if test "x$ac_cv_func_TLS_method" = xyes
 then :
   printf "%s\n" "#define HAVE_TLS_METHOD 1" >>confdefs.h
 
-fi
-ac_fn_c_check_func "$LINENO" "SSL_read_ex" "ac_cv_func_SSL_read_ex"
-if test "x$ac_cv_func_SSL_read_ex" = xyes
-then :
-  printf "%s\n" "#define HAVE_SSL_READ_EX 1" >>confdefs.h
-
 fi
 
 	# SSL_CTX_set_min_proto_version may be a macro
@@ -25988,6 +25983,22 @@ then :
   printf "%s\n" "#define HAVE_SSL_CTX_SET_MIN_PROTO_VERSION 1" >>confdefs.h
 
 fi
+
+  for ac_func in SSL_read_ex
+do :
+  ac_fn_c_check_func "$LINENO" "SSL_read_ex" "ac_cv_func_SSL_read_ex"
+if test "x$ac_cv_func_SSL_read_ex" = xyes
+then :
+  printf "%s\n" "#define HAVE_SSL_READ_EX 1" >>confdefs.h
+
+else case e in #(
+  e)
+	    SSL_COMPAT_SRC=lib/ssl_compat
+	 ;;
+esac
+fi
+
+done
 	# LibreSSL TLS 1.3 support may not be enabled, check for declaration too.
 	ac_fn_c_check_func "$LINENO" "SSL_CTX_set_ciphersuites" "ac_cv_func_SSL_CTX_set_ciphersuites"
 if test "x$ac_cv_func_SSL_CTX_set_ciphersuites" = xyes
@@ -26678,6 +26689,25 @@ then :
   printf "%s\n" "#define HAVE_SSL_CTX_SET_CIPHERSUITES 1" >>confdefs.h
 
 fi
+	ac_fn_check_decl "$LINENO" "SSL_read_ex" "ac_cv_have_decl_SSL_read_ex" "
+	    $ac_includes_default
+	    #include <wolfssl/options.h>
+	    #include <wolfssl/openssl/ssl.h>
+
+" "$ac_c_undeclared_builtin_options" "CFLAGS"
+if test "x$ac_cv_have_decl_SSL_read_ex" = xyes
+then :
+  printf "%s\n" "#define HAVE_SSL_READ_EX 1" >>confdefs.h
+
+else case e in #(
+  e)
+	    SSL_COMPAT_SRC=lib/ssl_compat
+	 ;;
+esac
+fi
+    fi
+    if test -n "$SSL_COMPAT_SRC"; then
+	LIBTLS='$(top_builddir)/lib/ssl_compat/libssl_compat.la '"${LIBTLS}"
     fi
 
 
@@ -36106,7 +36136,7 @@ then :
 
 fi
 
-ac_config_files="$ac_config_files Makefile docs/Makefile examples/Makefile examples/sudoers examples/sudo.conf examples/sudo_logsrvd.conf examples/syslog.conf include/Makefile lib/eventlog/Makefile lib/fuzzstub/Makefile lib/iolog/Makefile lib/logsrv/Makefile lib/protobuf-c/Makefile lib/util/Makefile lib/util/regress/harness lib/util/util.exp logsrvd/Makefile src/intercept.exp src/sudo_usage.h src/Makefile plugins/audit_json/Makefile plugins/sample/Makefile plugins/group_file/Makefile plugins/sample_approval/Makefile plugins/system_group/Makefile plugins/sudoers/Makefile plugins/sudoers/regress/harness plugins/sudoers/sudoers"
+ac_config_files="$ac_config_files Makefile docs/Makefile examples/Makefile examples/sudoers examples/sudo.conf examples/sudo_logsrvd.conf examples/syslog.conf include/Makefile lib/eventlog/Makefile lib/fuzzstub/Makefile lib/iolog/Makefile lib/logsrv/Makefile lib/protobuf-c/Makefile lib/ssl_compat/Makefile lib/util/Makefile lib/util/regress/harness lib/util/util.exp logsrvd/Makefile src/intercept.exp src/sudo_usage.h src/Makefile plugins/audit_json/Makefile plugins/sample/Makefile plugins/group_file/Makefile plugins/sample_approval/Makefile plugins/system_group/Makefile plugins/sudoers/Makefile plugins/sudoers/regress/harness plugins/sudoers/sudoers"
 
 ac_config_commands="$ac_config_commands harness"
 
@@ -37123,6 +37153,7 @@ do
     "lib/iolog/Makefile") CONFIG_FILES="$CONFIG_FILES lib/iolog/Makefile" ;;
     "lib/logsrv/Makefile") CONFIG_FILES="$CONFIG_FILES lib/logsrv/Makefile" ;;
     "lib/protobuf-c/Makefile") CONFIG_FILES="$CONFIG_FILES lib/protobuf-c/Makefile" ;;
+    "lib/ssl_compat/Makefile") CONFIG_FILES="$CONFIG_FILES lib/ssl_compat/Makefile" ;;
     "lib/util/Makefile") CONFIG_FILES="$CONFIG_FILES lib/util/Makefile" ;;
     "lib/util/regress/harness") CONFIG_FILES="$CONFIG_FILES lib/util/regress/harness" ;;
     "lib/util/util.exp") CONFIG_FILES="$CONFIG_FILES lib/util/util.exp" ;;

configure.ac

@@ -116,6 +116,7 @@ AC_SUBST([devsearch])dnl
 AC_SUBST([SIGNAME])dnl
 AC_SUBST([PYTHON_PLUGIN], ['#'])dnl
 AC_SUBST([PYTHON_PLUGIN_SRC])dnl
+AC_SUBST([SSL_COMPAT_SRC])dnl
 AC_SUBST([LOGSRV])dnl
 AC_SUBST([LOGSRV_SRC], ['lib/logsrv'])dnl
 AC_SUBST([LOGSRVD_SRC], ['logsrvd'])dnl
@@ -4435,7 +4436,7 @@ AS_IF([test X"$INIT_SCRIPT" != X""], [
     AC_CONFIG_FILES([etc/init.d/sudo.conf])
 ])
 
-AC_CONFIG_FILES([Makefile docs/Makefile examples/Makefile examples/sudoers examples/sudo.conf examples/sudo_logsrvd.conf examples/syslog.conf include/Makefile lib/eventlog/Makefile lib/fuzzstub/Makefile lib/iolog/Makefile lib/logsrv/Makefile lib/protobuf-c/Makefile lib/util/Makefile lib/util/regress/harness lib/util/util.exp logsrvd/Makefile src/intercept.exp src/sudo_usage.h src/Makefile plugins/audit_json/Makefile plugins/sample/Makefile plugins/group_file/Makefile plugins/sample_approval/Makefile plugins/system_group/Makefile plugins/sudoers/Makefile plugins/sudoers/regress/harness plugins/sudoers/sudoers])
+AC_CONFIG_FILES([Makefile docs/Makefile examples/Makefile examples/sudoers examples/sudo.conf examples/sudo_logsrvd.conf examples/syslog.conf include/Makefile lib/eventlog/Makefile lib/fuzzstub/Makefile lib/iolog/Makefile lib/logsrv/Makefile lib/protobuf-c/Makefile lib/ssl_compat/Makefile lib/util/Makefile lib/util/regress/harness lib/util/util.exp logsrvd/Makefile src/intercept.exp src/sudo_usage.h src/Makefile plugins/audit_json/Makefile plugins/sample/Makefile plugins/group_file/Makefile plugins/sample_approval/Makefile plugins/system_group/Makefile plugins/sudoers/Makefile plugins/sudoers/regress/harness plugins/sudoers/sudoers])
 AC_CONFIG_COMMANDS([harness], [chmod +x lib/util/regress/harness plugins/sudoers/regress/harness])
 
 AC_OUTPUT

include/sudo_ssl_compat.h

@@ -0,0 +1,31 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2023 Todd C. Miller <Todd.Miller@sudo.ws>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef SUDO_SSL_COMPAT_H
+#define SUDO_SSL_COMPAT_H
+
+# ifdef HAVE_OPENSSL
+
+#  ifndef HAVE_SSL_READ_EX
+int SSL_read_ex(SSL *, void *, size_t, size_t *);
+int SSL_write_ex(SSL *, const void *, size_t, size_t *);
+#  endif /* HAVE_SSL_READ_EX */
+
+# endif /* HAVE_OPENSSL */
+
+#endif /* SUDO_SSL_COMPAT_H */

lib/ssl_compat/Makefile.in

@@ -0,0 +1,189 @@
+#
+# SPDX-License-Identifier: ISC
+#
+# Copyright (c) 2023 Todd C. Miller <Todd.Miller@sudo.ws>
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+#
+# @configure_input@
+#
+
+#### Start of system configuration section. ####
+
+srcdir = @srcdir@
+abs_srcdir = @abs_srcdir@
+top_srcdir = @top_srcdir@
+abs_top_srcdir = @abs_top_srcdir@
+top_builddir = @top_builddir@
+abs_top_builddir = @abs_top_builddir@
+devdir = @devdir@
+scriptdir = $(top_srcdir)/scripts
+incdir = $(top_srcdir)/include
+
+# Compiler & tools to use
+CC = @CC@
+LIBTOOL = @LIBTOOL@
+
+# Libraries
+LT_LIBS =
+
+# C preprocessor flags
+CPPFLAGS = -I$(incdir) -I$(top_builddir) -I$(srcdir) -I$(top_srcdir) @CPPFLAGS@
+
+# Usually -O and/or -g
+CFLAGS = @CFLAGS@
+
+# Flags to pass to libtool
+LTFLAGS = @LT_STATIC@
+
+# Address sanitizer flags
+ASAN_CFLAGS = @ASAN_CFLAGS@
+ASAN_LDFLAGS = @ASAN_LDFLAGS@
+
+# PIE flags
+PIE_CFLAGS = @PIE_CFLAGS@
+PIE_LDFLAGS = @PIE_LDFLAGS@
+
+# Stack smashing protection flags
+HARDENING_CFLAGS = @HARDENING_CFLAGS@
+HARDENING_LDFLAGS = @HARDENING_LDFLAGS@
+
+# cppcheck options, usually set in the top-level Makefile
+CPPCHECK_OPTS = -q --enable=warning,performance,portability --suppress=constStatement --suppress=compareBoolExpressionWithInt --error-exitcode=1 --inline-suppr -Dva_copy=va_copy -U__cplusplus -UQUAD_MAX -UQUAD_MIN -UUQUAD_MAX -U_POSIX_HOST_NAME_MAX -U_POSIX_PATH_MAX -U__NBBY -DNSIG=64
+
+# splint options, usually set in the top-level Makefile
+SPLINT_OPTS = -D__restrict= -checks
+
+# PVS-studio options
+PVS_CFG = $(top_srcdir)/PVS-Studio.cfg
+PVS_IGNORE = 'V707,V011,V002,V536'
+PVS_LOG_OPTS = -a 'GA:1,2' -e -t errorfile -d $(PVS_IGNORE)
+
+# Set to non-empty for development mode
+DEVEL = @DEVEL@
+
+#### End of system configuration section. ####
+
+SHELL = @SHELL@
+
+LIBSSL_COMPAT_OBJS = ssl_compat.lo
+
+IOBJS = $(LIBSSL_COMPAT_OBJS:.lo=.i)
+
+POBJS = $(IOBJS:.i=.plog)
+
+GENERATED =
+
+all: libssl_compat.la
+
+depend:
+	$(scriptdir)/mkdep.pl --srcdir=$(abs_top_srcdir) \
+	    --builddir=$(abs_top_builddir) lib/ssl_compat/Makefile.in
+	cd $(top_builddir) && ./config.status --file lib/ssl_compat/Makefile
+
+Makefile: $(srcdir)/Makefile.in
+	cd $(top_builddir) && ./config.status --file lib/ssl_compat/Makefile
+
+.SUFFIXES: .c .h .i .lo .plog
+
+.c.lo:
+	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $<
+
+.c.i:
+	$(CC) -E -o $@ $(CPPFLAGS) $<
+
+.i.plog:
+	ifile=$<; rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $${ifile%i}c --i-file $< --output-file $@
+
+$(devdir)/log_server.pb-c.c: $(srcdir)/log_server.proto
+	@if [ -n "$(DEVEL)" ]; then \
+	    cmd='protoc-c --c_out=$(devdir) --proto_path=$(srcdir) $(srcdir)/log_server.proto'; \
+	    echo "$$cmd"; eval $$cmd; \
+	    cmd='$(scriptdir)/unanon $(devdir)/log_server.pb-c.h $(devdir)/log_server.pb-c.c'; \
+	    echo "$$cmd"; eval $$cmd; \
+	    if [ "$(devdir)" == "$(srcdir)" ]; then \
+		cmd='mv -f $(devdir)/log_server.pb-c.h $(incdir)/log_server.pb-c.h'; \
+	    else \
+		cmd='mv -f $(devdir)/log_server.pb-c.h $(top_builddir)/log_server.pb-c.h'; \
+	    fi; \
+	    echo "$$cmd"; eval $$cmd; \
+	fi
+
+libssl_compat.la: $(LIBSSL_COMPAT_OBJS) $(LT_LIBS)
+	$(LIBTOOL) $(LTFLAGS) --mode=link $(CC) -o $@ $(LIBSSL_COMPAT_OBJS) $(LT_LIBS)
+
+pre-install:
+
+install:
+
+install-binaries:
+
+install-includes:
+
+install-doc:
+
+install-plugin:
+
+install-fuzzer:
+
+uninstall:
+
+splint:
+	splint $(SPLINT_OPTS) -I$(incdir) -I$(top_builddir) -I$(top_srcdir) $(srcdir)/*.c
+
+cppcheck:
+	cppcheck $(CPPCHECK_OPTS) -I$(incdir) -I$(top_builddir) -I$(top_srcdir) $(srcdir)/*.c
+
+pvs-log-files:
+
+pvs-studio:
+
+fuzz:
+
+check-fuzzer:
+
+check: check-fuzzer
+
+check-verbose: check
+
+clean:
+	-$(LIBTOOL) $(LTFLAGS) --mode=clean rm -f *.lo *.o *.la
+	-rm -f *.i *.plog stamp-* core *.core core.*
+
+mostlyclean: clean
+
+distclean: clean
+	-rm -rf Makefile .libs
+	@if [ -n "$(DEVEL)" -a "$(devdir)" != "$(srcdir)" ]; then \
+	    cmd='rm -rf $(GENERATED)'; \
+	    echo "$$cmd"; eval $$cmd; \
+	fi
+
+clobber: distclean
+
+realclean: distclean
+	rm -f TAGS tags
+
+cleandir: realclean
+
+.PHONY: clean mostlyclean distclean cleandir clobber realclean
+
+# Autogenerated dependencies, do not modify
+ssl_compat.lo: $(srcdir)/ssl_compat.c $(incdir)/sudo_compat.h \
+               $(incdir)/sudo_ssl_compat.h $(top_builddir)/config.h
+	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/ssl_compat.c
+ssl_compat.i: $(srcdir)/ssl_compat.c $(incdir)/sudo_compat.h \
+               $(incdir)/sudo_ssl_compat.h $(top_builddir)/config.h
+	$(CC) -E -o $@ $(CPPFLAGS) $<
+ssl_compat.plog: ssl_compat.i
+	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/ssl_compat.c --i-file $< --output-file $@

lib/ssl_compat/ssl_compat.c

@@ -0,0 +1,56 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2023 Todd C. Miller <Todd.Miller@sudo.ws>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * This is an open source non-commercial project. Dear PVS-Studio, please check it.
+ * PVS-Studio Static Code Analyzer for C, C++ and C#: http://www.viva64.com
+ */
+
+#include <config.h>
+
+#if defined(HAVE_OPENSSL) && !defined(HAVE_SSL_READ_EX)
+
+# include <sys/types.h>
+# if defined(HAVE_WOLFSSL)
+#  include <wolfssl/options.h>
+# endif
+# include <openssl/ssl.h>
+
+# include "sudo_compat.h"
+# include "sudo_ssl_compat.h"
+
+int
+SSL_read_ex(SSL *ssl, void *buf, size_t num, size_t *readbytes)
+{
+    int nr = SSL_read(ssl, buf, (int)num);
+    if (nr <= 0)
+	return nr;
+    *readbytes = (size_t)nr;
+    return 1;
+}
+
+int
+SSL_write_ex(SSL *ssl, const void *buf, size_t num, size_t *written)
+{
+    int nw = SSL_write(ssl, buf, (int)num);
+    if (nw <= 0)
+	return nw;
+    *written = (size_t)nw;
+    return 1;
+}
+#endif /* HAVE_OPENSSL && !HAVE_SSL_READ_EX */

logsrvd/Makefile.in

@@ -318,9 +318,10 @@ fuzz_logsrvd_conf.o: $(srcdir)/regress/fuzz/fuzz_logsrvd_conf.c \
                      $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \
                      $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
                      $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \
-                     $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+                     $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \
-                     $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \
+                     $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
-                     $(srcdir)/tls_common.h $(top_builddir)/config.h
+                     $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
+                     $(top_builddir)/config.h
 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/regress/fuzz/fuzz_logsrvd_conf.c
 fuzz_logsrvd_conf.i: $(srcdir)/regress/fuzz/fuzz_logsrvd_conf.c \
                      $(incdir)/compat/stdbool.h $(incdir)/log_server.pb-c.h \
@@ -328,9 +329,10 @@ fuzz_logsrvd_conf.i: $(srcdir)/regress/fuzz/fuzz_logsrvd_conf.c \
                      $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \
                      $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
                      $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \
-                     $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+                     $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \
-                     $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \
+                     $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
-                     $(srcdir)/tls_common.h $(top_builddir)/config.h
+                     $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
+                     $(top_builddir)/config.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 fuzz_logsrvd_conf.plog: fuzz_logsrvd_conf.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/regress/fuzz/fuzz_logsrvd_conf.c --i-file $< --output-file $@
@@ -340,9 +342,9 @@ iolog_writer.o: $(srcdir)/iolog_writer.c $(incdir)/compat/stdbool.h \
                 $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
                 $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \
                 $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
-                $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
+                $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
-                $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
+                $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \
-                $(top_builddir)/config.h
+                $(srcdir)/tls_common.h $(top_builddir)/config.h
 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/iolog_writer.c
 iolog_writer.i: $(srcdir)/iolog_writer.c $(incdir)/compat/stdbool.h \
                 $(incdir)/log_server.pb-c.h $(incdir)/protobuf-c/protobuf-c.h \
@@ -350,9 +352,9 @@ iolog_writer.i: $(srcdir)/iolog_writer.c $(incdir)/compat/stdbool.h \
                 $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
                 $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \
                 $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
-                $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
+                $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
-                $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
+                $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \
-                $(top_builddir)/config.h
+                $(srcdir)/tls_common.h $(top_builddir)/config.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 iolog_writer.plog: iolog_writer.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/iolog_writer.c --i-file $< --output-file $@
@@ -380,7 +382,8 @@ logsrvd.o: $(srcdir)/logsrvd.c $(incdir)/compat/getopt.h \
            $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
            $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \
            $(incdir)/sudo_json.h $(incdir)/sudo_plugin.h \
-           $(incdir)/sudo_queue.h $(incdir)/sudo_rand.h $(incdir)/sudo_util.h \
+           $(incdir)/sudo_queue.h $(incdir)/sudo_rand.h \
+           $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
            $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
            $(top_builddir)/config.h $(top_builddir)/pathnames.h
 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/logsrvd.c
@@ -392,7 +395,8 @@ logsrvd.i: $(srcdir)/logsrvd.c $(incdir)/compat/getopt.h \
            $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
            $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \
            $(incdir)/sudo_json.h $(incdir)/sudo_plugin.h \
-           $(incdir)/sudo_queue.h $(incdir)/sudo_rand.h $(incdir)/sudo_util.h \
+           $(incdir)/sudo_queue.h $(incdir)/sudo_rand.h \
+           $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
            $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
            $(top_builddir)/config.h $(top_builddir)/pathnames.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
@@ -404,10 +408,10 @@ logsrvd_conf.o: $(srcdir)/logsrvd_conf.c $(incdir)/compat/getaddrinfo.h \
                 $(incdir)/sudo_debug.h $(incdir)/sudo_eventlog.h \
                 $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
                 $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \
-                $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+                $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \
-                $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \
+                $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
-                $(srcdir)/tls_common.h $(top_builddir)/config.h \
+                $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
-                $(top_builddir)/pathnames.h
+                $(top_builddir)/config.h $(top_builddir)/pathnames.h
 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/logsrvd_conf.c
 logsrvd_conf.i: $(srcdir)/logsrvd_conf.c $(incdir)/compat/getaddrinfo.h \
                 $(incdir)/compat/stdbool.h $(incdir)/log_server.pb-c.h \
@@ -415,10 +419,10 @@ logsrvd_conf.i: $(srcdir)/logsrvd_conf.c $(incdir)/compat/getaddrinfo.h \
                 $(incdir)/sudo_debug.h $(incdir)/sudo_eventlog.h \
                 $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
                 $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \
-                $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+                $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \
-                $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \
+                $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
-                $(srcdir)/tls_common.h $(top_builddir)/config.h \
+                $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
-                $(top_builddir)/pathnames.h
+                $(top_builddir)/config.h $(top_builddir)/pathnames.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 logsrvd_conf.plog: logsrvd_conf.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/logsrvd_conf.c --i-file $< --output-file $@
@@ -426,17 +430,17 @@ logsrvd_conf_test.o: $(srcdir)/regress/logsrvd_conf/logsrvd_conf_test.c \
                      $(incdir)/compat/stdbool.h $(incdir)/log_server.pb-c.h \
                      $(incdir)/protobuf-c/protobuf-c.h $(incdir)/sudo_compat.h \
                      $(incdir)/sudo_iolog.h $(incdir)/sudo_queue.h \
-                     $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
+                     $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
-                     $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
+                     $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \
-                     $(top_builddir)/config.h
+                     $(srcdir)/tls_common.h $(top_builddir)/config.h
 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/regress/logsrvd_conf/logsrvd_conf_test.c
 logsrvd_conf_test.i: $(srcdir)/regress/logsrvd_conf/logsrvd_conf_test.c \
                      $(incdir)/compat/stdbool.h $(incdir)/log_server.pb-c.h \
                      $(incdir)/protobuf-c/protobuf-c.h $(incdir)/sudo_compat.h \
                      $(incdir)/sudo_iolog.h $(incdir)/sudo_queue.h \
-                     $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
+                     $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
-                     $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
+                     $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \
-                     $(top_builddir)/config.h
+                     $(srcdir)/tls_common.h $(top_builddir)/config.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 logsrvd_conf_test.plog: logsrvd_conf_test.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/regress/logsrvd_conf/logsrvd_conf_test.c --i-file $< --output-file $@
@@ -447,9 +451,10 @@ logsrvd_journal.o: $(srcdir)/logsrvd_journal.c $(incdir)/compat/stdbool.h \
                    $(incdir)/sudo_event.h $(incdir)/sudo_eventlog.h \
                    $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
                    $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \
-                   $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+                   $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \
-                   $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \
+                   $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
-                   $(srcdir)/tls_common.h $(top_builddir)/config.h
+                   $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
+                   $(top_builddir)/config.h
 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/logsrvd_journal.c
 logsrvd_journal.i: $(srcdir)/logsrvd_journal.c $(incdir)/compat/stdbool.h \
                    $(incdir)/log_server.pb-c.h \
@@ -458,9 +463,10 @@ logsrvd_journal.i: $(srcdir)/logsrvd_journal.c $(incdir)/compat/stdbool.h \
                    $(incdir)/sudo_event.h $(incdir)/sudo_eventlog.h \
                    $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
                    $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \
-                   $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+                   $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \
-                   $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \
+                   $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
-                   $(srcdir)/tls_common.h $(top_builddir)/config.h
+                   $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
+                   $(top_builddir)/config.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 logsrvd_journal.plog: logsrvd_journal.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/logsrvd_journal.c --i-file $< --output-file $@
@@ -472,9 +478,9 @@ logsrvd_local.o: $(srcdir)/logsrvd_local.c $(incdir)/compat/stdbool.h \
                  $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \
                  $(incdir)/sudo_json.h $(incdir)/sudo_plugin.h \
                  $(incdir)/sudo_queue.h $(incdir)/sudo_rand.h \
-                 $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
+                 $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
-                 $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
+                 $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \
-                 $(top_builddir)/config.h
+                 $(srcdir)/tls_common.h $(top_builddir)/config.h
 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/logsrvd_local.c
 logsrvd_local.i: $(srcdir)/logsrvd_local.c $(incdir)/compat/stdbool.h \
                  $(incdir)/log_server.pb-c.h $(incdir)/protobuf-c/protobuf-c.h \
@@ -484,9 +490,9 @@ logsrvd_local.i: $(srcdir)/logsrvd_local.c $(incdir)/compat/stdbool.h \
                  $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \
                  $(incdir)/sudo_json.h $(incdir)/sudo_plugin.h \
                  $(incdir)/sudo_queue.h $(incdir)/sudo_rand.h \
-                 $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
+                 $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
-                 $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
+                 $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \
-                 $(top_builddir)/config.h
+                 $(srcdir)/tls_common.h $(top_builddir)/config.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 logsrvd_local.plog: logsrvd_local.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/logsrvd_local.c --i-file $< --output-file $@
@@ -497,9 +503,9 @@ logsrvd_queue.o: $(srcdir)/logsrvd_queue.c $(incdir)/compat/stdbool.h \
                  $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
                  $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \
                  $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
-                 $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
+                 $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
-                 $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
+                 $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \
-                 $(top_builddir)/config.h
+                 $(srcdir)/tls_common.h $(top_builddir)/config.h
 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/logsrvd_queue.c
 logsrvd_queue.i: $(srcdir)/logsrvd_queue.c $(incdir)/compat/stdbool.h \
                  $(incdir)/log_server.pb-c.h $(incdir)/protobuf-c/protobuf-c.h \
@@ -508,9 +514,9 @@ logsrvd_queue.i: $(srcdir)/logsrvd_queue.c $(incdir)/compat/stdbool.h \
                  $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
                  $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \
                  $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
-                 $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
+                 $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
-                 $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
+                 $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \
-                 $(top_builddir)/config.h
+                 $(srcdir)/tls_common.h $(top_builddir)/config.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 logsrvd_queue.plog: logsrvd_queue.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/logsrvd_queue.c --i-file $< --output-file $@
@@ -520,9 +526,10 @@ logsrvd_relay.o: $(srcdir)/logsrvd_relay.c $(incdir)/compat/stdbool.h \
                  $(incdir)/sudo_event.h $(incdir)/sudo_eventlog.h \
                  $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
                  $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \
-                 $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+                 $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \
-                 $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \
+                 $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
-                 $(srcdir)/tls_common.h $(top_builddir)/config.h
+                 $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
+                 $(top_builddir)/config.h
 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/logsrvd_relay.c
 logsrvd_relay.i: $(srcdir)/logsrvd_relay.c $(incdir)/compat/stdbool.h \
                  $(incdir)/log_server.pb-c.h $(incdir)/protobuf-c/protobuf-c.h \
@@ -530,9 +537,10 @@ logsrvd_relay.i: $(srcdir)/logsrvd_relay.c $(incdir)/compat/stdbool.h \
                  $(incdir)/sudo_event.h $(incdir)/sudo_eventlog.h \
                  $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
                  $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \
-                 $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+                 $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \
-                 $(srcdir)/logsrv_util.h $(srcdir)/logsrvd.h \
+                 $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
-                 $(srcdir)/tls_common.h $(top_builddir)/config.h
+                 $(srcdir)/logsrvd.h $(srcdir)/tls_common.h \
+                 $(top_builddir)/config.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 logsrvd_relay.plog: logsrvd_relay.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/logsrvd_relay.c --i-file $< --output-file $@
@@ -544,8 +552,9 @@ sendlog.o: $(srcdir)/sendlog.c $(incdir)/compat/getaddrinfo.h \
            $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
            $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \
            $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
-           $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h $(srcdir)/sendlog.h \
+           $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
-           $(srcdir)/tls_common.h $(top_builddir)/config.h
+           $(srcdir)/logsrv_util.h $(srcdir)/sendlog.h $(srcdir)/tls_common.h \
+           $(top_builddir)/config.h
 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/sendlog.c
 sendlog.i: $(srcdir)/sendlog.c $(incdir)/compat/getaddrinfo.h \
            $(incdir)/compat/getopt.h $(incdir)/compat/stdbool.h \
@@ -555,8 +564,9 @@ sendlog.i: $(srcdir)/sendlog.c $(incdir)/compat/getaddrinfo.h \
            $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
            $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \
            $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
-           $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h $(srcdir)/sendlog.h \
+           $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
-           $(srcdir)/tls_common.h $(top_builddir)/config.h
+           $(srcdir)/logsrv_util.h $(srcdir)/sendlog.h $(srcdir)/tls_common.h \
+           $(top_builddir)/config.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 sendlog.plog: sendlog.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/sendlog.c --i-file $< --output-file $@
@@ -565,16 +575,18 @@ tls_client.o: $(srcdir)/tls_client.c $(incdir)/compat/stdbool.h \
               $(incdir)/sudo_debug.h $(incdir)/sudo_event.h \
               $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
               $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
-              $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
+              $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
-              $(srcdir)/tls_common.h $(top_builddir)/config.h
+              $(srcdir)/logsrv_util.h $(srcdir)/tls_common.h \
+              $(top_builddir)/config.h
 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/tls_client.c
 tls_client.i: $(srcdir)/tls_client.c $(incdir)/compat/stdbool.h \
               $(incdir)/hostcheck.h $(incdir)/sudo_compat.h \
               $(incdir)/sudo_debug.h $(incdir)/sudo_event.h \
               $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
               $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
-              $(incdir)/sudo_util.h $(srcdir)/logsrv_util.h \
+              $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
-              $(srcdir)/tls_common.h $(top_builddir)/config.h
+              $(srcdir)/logsrv_util.h $(srcdir)/tls_common.h \
+              $(top_builddir)/config.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 tls_client.plog: tls_client.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/tls_client.c --i-file $< --output-file $@
@@ -583,14 +595,16 @@ tls_init.o: $(srcdir)/tls_init.c $(incdir)/compat/stdbool.h \
             $(incdir)/sudo_debug.h $(incdir)/sudo_event.h \
             $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
             $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
-            $(srcdir)/tls_common.h $(top_builddir)/config.h
+            $(incdir)/sudo_ssl_compat.h $(srcdir)/tls_common.h \
+            $(top_builddir)/config.h
 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/tls_init.c
 tls_init.i: $(srcdir)/tls_init.c $(incdir)/compat/stdbool.h \
             $(incdir)/hostcheck.h $(incdir)/sudo_compat.h \
             $(incdir)/sudo_debug.h $(incdir)/sudo_event.h \
             $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
             $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
-            $(srcdir)/tls_common.h $(top_builddir)/config.h
+            $(incdir)/sudo_ssl_compat.h $(srcdir)/tls_common.h \
+            $(top_builddir)/config.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 tls_init.plog: tls_init.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/tls_init.c --i-file $< --output-file $@

logsrvd/tls_common.h

@@ -27,6 +27,7 @@
 # endif
 # include <openssl/ssl.h>
 # include <openssl/err.h>
+# include "sudo_ssl_compat.h"
 
 struct tls_client_closure {
     SSL *ssl;

m4/openssl.m4

@@ -156,12 +156,15 @@ AC_DEFUN([SUDO_CHECK_OPENSSL], [
     if test "${enable_openssl-no}" != no; then
 	OLIBS="$LIBS"
 	LIBS="$LIBS $LIBTLS"
-	AC_CHECK_FUNCS([X509_STORE_CTX_get0_cert ASN1_STRING_get0_data SSL_CTX_get0_certificate SSL_CTX_set0_tmp_dh_pkey TLS_method SSL_read_ex])
+	AC_CHECK_FUNCS([X509_STORE_CTX_get0_cert ASN1_STRING_get0_data SSL_CTX_get0_certificate SSL_CTX_set0_tmp_dh_pkey TLS_method])
 	# SSL_CTX_set_min_proto_version may be a macro
 	AC_CHECK_DECL([SSL_CTX_set_min_proto_version], [AC_DEFINE(HAVE_SSL_CTX_SET_MIN_PROTO_VERSION)], [], [
 	    AC_INCLUDES_DEFAULT
 	    #include <openssl/ssl.h>
 	])
+	AC_CHECK_FUNCS([SSL_read_ex], [], [
+	    SSL_COMPAT_SRC=lib/ssl_compat
+	])
 	# LibreSSL TLS 1.3 support may not be enabled, check for declaration too.
 	AC_CHECK_FUNC([SSL_CTX_set_ciphersuites], [
 	    AC_CHECK_DECL([SSL_CTX_set_ciphersuites], [AC_DEFINE(HAVE_SSL_CTX_SET_CIPHERSUITES)], [], [
@@ -292,5 +295,15 @@ AC_DEFUN([SUDO_CHECK_OPENSSL], [
 	    #include <wolfssl/options.h>
 	    #include <wolfssl/openssl/ssl.h>
 	])
+	AC_CHECK_DECL([SSL_read_ex], [AC_DEFINE(HAVE_SSL_READ_EX)], [
+	    SSL_COMPAT_SRC=lib/ssl_compat
+	], [
+	    AC_INCLUDES_DEFAULT
+	    #include <wolfssl/options.h>
+	    #include <wolfssl/openssl/ssl.h>
+	])
+    fi
+    if test -n "$SSL_COMPAT_SRC"; then
+	LIBTLS='$(top_builddir)/lib/ssl_compat/libssl_compat.la '"${LIBTLS}"
     fi
 ])

plugins/sudoers/Makefile.in

@@ -783,10 +783,11 @@ audit.lo: $(srcdir)/audit.c $(devdir)/def_data.h $(incdir)/compat/stdbool.h \
           $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \
           $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
           $(incdir)/sudo_gettext.h $(incdir)/sudo_plugin.h \
-          $(incdir)/sudo_queue.h $(incdir)/sudo_util.h $(srcdir)/bsm_audit.h \
+          $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \
-          $(srcdir)/defaults.h $(srcdir)/linux_audit.h $(srcdir)/log_client.h \
+          $(incdir)/sudo_util.h $(srcdir)/bsm_audit.h $(srcdir)/defaults.h \
-          $(srcdir)/logging.h $(srcdir)/parse.h $(srcdir)/solaris_audit.h \
+          $(srcdir)/linux_audit.h $(srcdir)/log_client.h $(srcdir)/logging.h \
-          $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \
+          $(srcdir)/parse.h $(srcdir)/solaris_audit.h $(srcdir)/sudo_nss.h \
+          $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \
           $(top_builddir)/config.h $(top_builddir)/pathnames.h
 	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/audit.c
 audit.i: $(srcdir)/audit.c $(devdir)/def_data.h $(incdir)/compat/stdbool.h \
@@ -794,10 +795,11 @@ audit.i: $(srcdir)/audit.c $(devdir)/def_data.h $(incdir)/compat/stdbool.h \
           $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \
           $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
           $(incdir)/sudo_gettext.h $(incdir)/sudo_plugin.h \
-          $(incdir)/sudo_queue.h $(incdir)/sudo_util.h $(srcdir)/bsm_audit.h \
+          $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \
-          $(srcdir)/defaults.h $(srcdir)/linux_audit.h $(srcdir)/log_client.h \
+          $(incdir)/sudo_util.h $(srcdir)/bsm_audit.h $(srcdir)/defaults.h \
-          $(srcdir)/logging.h $(srcdir)/parse.h $(srcdir)/solaris_audit.h \
+          $(srcdir)/linux_audit.h $(srcdir)/log_client.h $(srcdir)/logging.h \
-          $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \
+          $(srcdir)/parse.h $(srcdir)/solaris_audit.h $(srcdir)/sudo_nss.h \
+          $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \
           $(top_builddir)/config.h $(top_builddir)/pathnames.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 audit.plog: audit.i
@@ -2013,7 +2015,8 @@ iolog.lo: $(srcdir)/iolog.c $(devdir)/def_data.h $(incdir)/compat/stdbool.h \
           $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \
           $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
           $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \
-          $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+          $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
+          $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
           $(srcdir)/defaults.h $(srcdir)/log_client.h $(srcdir)/logging.h \
           $(srcdir)/parse.h $(srcdir)/strlist.h $(srcdir)/sudo_nss.h \
           $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \
@@ -2024,7 +2027,8 @@ iolog.i: $(srcdir)/iolog.c $(devdir)/def_data.h $(incdir)/compat/stdbool.h \
           $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h \
           $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
           $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \
-          $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+          $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
+          $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
           $(srcdir)/defaults.h $(srcdir)/log_client.h $(srcdir)/logging.h \
           $(srcdir)/parse.h $(srcdir)/strlist.h $(srcdir)/sudo_nss.h \
           $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \
@@ -2228,11 +2232,12 @@ log_client.lo: $(srcdir)/log_client.c $(devdir)/def_data.h \
                $(incdir)/sudo_event.h $(incdir)/sudo_eventlog.h \
                $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
                $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \
-               $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+               $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \
-               $(srcdir)/defaults.h $(srcdir)/log_client.h $(srcdir)/logging.h \
+               $(incdir)/sudo_util.h $(srcdir)/defaults.h \
-               $(srcdir)/parse.h $(srcdir)/strlist.h $(srcdir)/sudo_nss.h \
+               $(srcdir)/log_client.h $(srcdir)/logging.h $(srcdir)/parse.h \
-               $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \
+               $(srcdir)/strlist.h $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h \
-               $(top_builddir)/config.h $(top_builddir)/pathnames.h
+               $(srcdir)/sudoers_debug.h $(top_builddir)/config.h \
+               $(top_builddir)/pathnames.h
 	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/log_client.c
 log_client.i: $(srcdir)/log_client.c $(devdir)/def_data.h \
                $(incdir)/compat/getaddrinfo.h $(incdir)/compat/stdbool.h \
@@ -2242,11 +2247,12 @@ log_client.i: $(srcdir)/log_client.c $(devdir)/def_data.h \
                $(incdir)/sudo_event.h $(incdir)/sudo_eventlog.h \
                $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
                $(incdir)/sudo_iolog.h $(incdir)/sudo_plugin.h \
-               $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+               $(incdir)/sudo_queue.h $(incdir)/sudo_ssl_compat.h \
-               $(srcdir)/defaults.h $(srcdir)/log_client.h $(srcdir)/logging.h \
+               $(incdir)/sudo_util.h $(srcdir)/defaults.h \
-               $(srcdir)/parse.h $(srcdir)/strlist.h $(srcdir)/sudo_nss.h \
+               $(srcdir)/log_client.h $(srcdir)/logging.h $(srcdir)/parse.h \
-               $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \
+               $(srcdir)/strlist.h $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h \
-               $(top_builddir)/config.h $(top_builddir)/pathnames.h
+               $(srcdir)/sudoers_debug.h $(top_builddir)/config.h \
+               $(top_builddir)/pathnames.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 log_client.plog: log_client.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/log_client.c --i-file $< --output-file $@
@@ -2257,9 +2263,10 @@ logging.lo: $(srcdir)/logging.c $(devdir)/def_data.h \
             $(incdir)/sudo_debug.h $(incdir)/sudo_eventlog.h \
             $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
             $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
-            $(incdir)/sudo_util.h $(srcdir)/defaults.h $(srcdir)/log_client.h \
+            $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
-            $(srcdir)/logging.h $(srcdir)/parse.h $(srcdir)/strlist.h \
+            $(srcdir)/defaults.h $(srcdir)/log_client.h $(srcdir)/logging.h \
-            $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \
+            $(srcdir)/parse.h $(srcdir)/strlist.h $(srcdir)/sudo_nss.h \
+            $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \
             $(top_builddir)/config.h $(top_builddir)/pathnames.h
 	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/logging.c
 logging.i: $(srcdir)/logging.c $(devdir)/def_data.h \
@@ -2269,9 +2276,10 @@ logging.i: $(srcdir)/logging.c $(devdir)/def_data.h \
             $(incdir)/sudo_debug.h $(incdir)/sudo_eventlog.h \
             $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
             $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
-            $(incdir)/sudo_util.h $(srcdir)/defaults.h $(srcdir)/log_client.h \
+            $(incdir)/sudo_ssl_compat.h $(incdir)/sudo_util.h \
-            $(srcdir)/logging.h $(srcdir)/parse.h $(srcdir)/strlist.h \
+            $(srcdir)/defaults.h $(srcdir)/log_client.h $(srcdir)/logging.h \
-            $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \
+            $(srcdir)/parse.h $(srcdir)/strlist.h $(srcdir)/sudo_nss.h \
+            $(srcdir)/sudoers.h $(srcdir)/sudoers_debug.h \
             $(top_builddir)/config.h $(top_builddir)/pathnames.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 logging.plog: logging.i
@@ -3076,7 +3084,7 @@ testsudoers.o: $(srcdir)/testsudoers.c $(devdir)/def_data.h $(devdir)/gram.h \
                $(srcdir)/interfaces.h $(srcdir)/logging.h $(srcdir)/parse.h \
                $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h \
                $(srcdir)/sudoers_debug.h $(srcdir)/testsudoers_pwutil.h \
-               $(srcdir)/tsgetgrpw.h $(top_builddir)/config.h \
+               $(srcdir)/toke.h $(srcdir)/tsgetgrpw.h $(top_builddir)/config.h \
                $(top_builddir)/pathnames.h
 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/testsudoers.c
 testsudoers.i: $(srcdir)/testsudoers.c $(devdir)/def_data.h $(devdir)/gram.h \
@@ -3089,7 +3097,7 @@ testsudoers.i: $(srcdir)/testsudoers.c $(devdir)/def_data.h $(devdir)/gram.h \
                $(srcdir)/interfaces.h $(srcdir)/logging.h $(srcdir)/parse.h \
                $(srcdir)/sudo_nss.h $(srcdir)/sudoers.h \
                $(srcdir)/sudoers_debug.h $(srcdir)/testsudoers_pwutil.h \
-               $(srcdir)/tsgetgrpw.h $(top_builddir)/config.h \
+               $(srcdir)/toke.h $(srcdir)/tsgetgrpw.h $(top_builddir)/config.h \
                $(top_builddir)/pathnames.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 testsudoers.plog: testsudoers.i

plugins/sudoers/log_client.h

@@ -25,6 +25,7 @@
 #  include <wolfssl/options.h>
 # endif /* HAVE_WOLFSSL */
 # include <openssl/ssl.h>
+# include "sudo_ssl_compat.h"
 #endif /* HAVE_OPENSSL */
 
 #include "log_server.pb-c.h"

src/Makefile.in

@@ -1010,13 +1010,13 @@ sudo_intercept_common.plog: sudo_intercept_common.i
 suspend_parent.o: $(srcdir)/suspend_parent.c $(incdir)/compat/stdbool.h \
                   $(incdir)/sudo_debug.h $(incdir)/sudo_fatal.h \
                   $(incdir)/sudo_gettext.h $(incdir)/sudo_plugin.h \
-                  $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+                  $(incdir)/sudo_queue.h $(srcdir)/sudo_exec.h \
                   $(top_builddir)/config.h $(top_builddir)/pathnames.h
 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/suspend_parent.c
 suspend_parent.i: $(srcdir)/suspend_parent.c $(incdir)/compat/stdbool.h \
                   $(incdir)/sudo_debug.h $(incdir)/sudo_fatal.h \
                   $(incdir)/sudo_gettext.h $(incdir)/sudo_plugin.h \
-                  $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+                  $(incdir)/sudo_queue.h $(srcdir)/sudo_exec.h \
                   $(top_builddir)/config.h $(top_builddir)/pathnames.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 suspend_parent.plog: suspend_parent.i