libstrophe + openssl 3.0

[S-Hobb]

Hello. Does libstrophe work with openssl 3.0 and higher? SSL_get_peer_certificate, which is used in tls_openssl.c, is deprecated starting from openssl 3.0. I'm getting undefined symbol error from linker trying to link it with system provided ssl.dylib (openssl version 3.2).

[pasis]

I believe similar patch should work in libstrophe: https://forum.nginx.org/read.php?29,292175 . According to openssl documentation, SSL_get1_peer_certificate() does the same as SSL_get_peer_certificate().

[sjaeckel]

We're building in our CI against 3.x and it didn't complain yet that SSL_get_peer_certificate() is deprecated.

I don't understand why the OpenSSL project didn't properly deprecate that API if they want to get rid of it.

Also I don't understand yet (and didn't have the time to deeper investigate) why it fails for you and doesn't for the CI.

[sjaeckel]

I believe similar patch should work in libstrophe: https://forum.nginx.org/read.php?29,292175

That patch is what is also done in openssl/ssl.h

https://github.com/openssl/openssl/blob/933f57dfe21657f7aba8f13e0cdb3b02dd64fcc3/include/openssl/ssl.h.in#L1756-L1759

/* Deprecated in 3.0.0 */
#  ifndef OPENSSL_NO_DEPRECATED_3_0
#   define SSL_get_peer_certificate SSL_get1_peer_certificate
#  endif
# endif

My proposed patch to libstrophe would look like that

diff --git a/src/tls_openssl.c b/src/tls_openssl.c
index 7f8c27b..641ca6c 100644
--- a/src/tls_openssl.c
+++ b/src/tls_openssl.c
@@ -53,4 +53,6 @@
 #define STROPHE_ERR_func_error_string(e) ERR_func_error_string(e)
+#define STROPHE_SSL_get1_peer_certificate(s) SSL_get_peer_certificate(s)
 #else
 #define STROPHE_ERR_func_error_string(e) ""
+#define STROPHE_SSL_get1_peer_certificate(s) SSL_get1_peer_certificate(s)
 #endif
@@ -764,3 +766,3 @@ xmpp_tlscert_t *tls_peer_cert(xmpp_conn_t *conn)
     if (conn && conn->tls && conn->tls->ssl) {
-        X509 *cert = SSL_get_peer_certificate(conn->tls->ssl);
+        X509 *cert = STROPHE_SSL_get1_peer_certificate(conn->tls->ssl);
         if (cert) {
@@ -1036,3 +1038,3 @@ static void _tls_dump_cert_info(tls_t *tls)
 
-    cert = SSL_get_peer_certificate(tls->ssl);
+    cert = STROPHE_SSL_get1_peer_certificate(tls->ssl);
     if (cert == NULL)

but first I'd like to clear that situation why it fails for you and not for our CI

[S-Hobb]

Do you define OPENSSL_NO_DEPRECATED macro for your builds?

Without this macro I can build libstrophe static library successfully as well. But when I link libstrophe.a with libssl.dylib in my app, I get undefined symbols in tls_openssl.o

And I verified with "nm" command that my ssl library (/opt/homebrew/lib/libssl.dylib, version 3.2) does not have neither SSL_get_peer_certificate nor SSL_get1_peer_certificate symbols

[sjaeckel]

Do you define OPENSSL_NO_DEPRECATED macro for your builds?

Nope. C.f. https://github.com/strophe/libstrophe/blob/master/travis/before_script.sh - we basically do the following after cloning openssl and checking out the correct branch:

./Configure --prefix=$HOME/xssl --libdir=lib
make -j"$(nproc)"
make install_sw

This installs openssl to $HOME/xssl.

Then we build libstrophe, c.f. https://github.com/strophe/libstrophe/blob/master/.github/workflows/main.yml#L91-L93, against the openssl version we just built:

./bootstrap.sh
PKG_CONFIG_PATH="${HOME}/xssl/lib/pkgconfig" ./configure CFLAGS="-Werror -g3" --prefix="${HOME}/xssl"
make -j$(nproc)

And I verified with "nm" command that my ssl library (/opt/homebrew/lib/libssl.dylib, version 3.2) does not have neither SSL_get_peer_certificate nor SSL_get1_peer_certificate symbols

Well that's kind of bad. SSL_get_peer_certificate is not a symbol anymore that's OK, but SSL_get1_peer_certificate() should be a symbol.

$ nm $PREFIX/lib/libssl.so.3 | grep _peer_certificate
000000000003a160 T SSL_get0_peer_certificate
000000000003a1a0 T SSL_get1_peer_certificate

While trying to reproduce this, I realized that the xssl CI jobs only really worked for libressl.

For openssl I had to fix the invocation of the tests, since ld doesn't really care at runtime what flags were given at compile time, c.f. cf046d2

https://github.com/strophe/libstrophe/actions/runs/8877231369 shows now in all the CI jobs that we build&run successfully against the different versions, e.g. https://github.com/strophe/libstrophe/actions/runs/8877231369/job/24370379829#step:7:32.

[S-Hobb]

I will continue digging into the problem on my side then. Thank you for support!