This is an automated email from the ASF dual-hosted git repository.
JosiahWI pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
The following commit(s) were added to refs/heads/master by this push:
new e7eb77a5c3 Remove OpenSSL ENGINE code (#13471)
e7eb77a5c3 is described below
commit e7eb77a5c3acc2eecd651b1f6e60c74dc857970c
Author: JosiahWI <[email protected]>
AuthorDate: Mon Aug 3 18:19:42 2026 -0500
Remove OpenSSL ENGINE code (#13471)
* Remove OpenSSL ENGINE code
Commit a966bc4cce (#11219) accidentally disabled OpenSSL ENGINE support
entirely. Although it was unintentional, it seems clear no one is using
that API by this point (no one has reported it was broken), and the
API is gone in recent OpenSSL versions. This patch removes the dead logic.
---
CMakeLists.txt | 3 ---
src/iocore/net/SSLUtils.cc | 58 ++++++++++++++--------------------------------
2 files changed, 17 insertions(+), 44 deletions(-)
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2805612543..06a619b6e4 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -672,9 +672,6 @@ check_symbol_exists(SSL_get_all_async_fds openssl/ssl.h
TS_USE_TLS_ASYNC)
check_symbol_exists(OSSL_PARAM_construct_end "openssl/params.h"
HAVE_OSSL_PARAM_CONSTRUCT_END)
check_symbol_exists(TLS1_3_VERSION "openssl/ssl.h" TS_USE_TLS13)
check_symbol_exists(MD5_Init "openssl/md5.h" HAVE_MD5_INIT)
-check_symbol_exists(ENGINE_load_dynamic "openssl/engine.h"
HAVE_ENGINE_LOAD_DYNAMIC)
-check_symbol_exists(ENGINE_get_default_RSA "openssl/engine.h"
HAVE_ENGINE_GET_DEFAULT_RSA)
-check_symbol_exists(ENGINE_load_private_key "openssl/engine.h"
HAVE_ENGINE_LOAD_PRIVATE_KEY)
check_symbol_exists(sysctlbyname "sys/sysctl.h" HAVE_SYSCTLBYNAME)
if(SSLLIB_IS_AT_LEAST_OPENSSL3)
diff --git a/src/iocore/net/SSLUtils.cc b/src/iocore/net/SSLUtils.cc
index a88bdceb56..a79efe962f 100644
--- a/src/iocore/net/SSLUtils.cc
+++ b/src/iocore/net/SSLUtils.cc
@@ -60,9 +60,6 @@
#endif
#include <openssl/dh.h>
#include <openssl/ec.h>
-#if HAVE_ENGINE_LOAD_DYNAMIC
-#include <openssl/engine.h>
-#endif
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/objects.h>
@@ -823,10 +820,6 @@ void
SSLPostConfigInitialize()
{
if (SSLConfigParams::engine_conf_file) {
-#if HAVE_ENGINE_LOAD_DYNAMIC
- ENGINE_load_dynamic();
-#endif
-
OPENSSL_load_builtin_modules();
if (CONF_modules_load_file(SSLConfigParams::engine_conf_file, nullptr, 0)
<= 0) {
char err_buf[256] = {0};
@@ -911,42 +904,25 @@ SSLPrivateKeyHandler(SSL_CTX *ctx, const char *keyPath,
const char *secret_data,
{
// SSL_CTX_use_PrivateKey() takes its own reference on the key, so this
// reference must be released on every exit.
- scoped_PKEY pkey;
-#if HAVE_ENGINE_GET_DEFAULT_RSA && HAVE_ENGINE_LOAD_PRIVATE_KEY
- ENGINE *e = ENGINE_get_default_RSA();
- if (e != nullptr) {
- pkey.reset(ENGINE_load_private_key(e, keyPath, nullptr, nullptr));
- if (pkey) {
- if (!SSL_CTX_use_PrivateKey(ctx, pkey.get())) {
- Dbg(dbg_ctl_ssl_load, "failed to load server private key from engine");
- return false;
- }
- }
- }
-#else
- void *e = nullptr;
-#endif
- if (pkey == nullptr) {
- scoped_BIO bio(BIO_new_mem_buf(secret_data, secret_data_len));
+ scoped_BIO bio(BIO_new_mem_buf(secret_data, secret_data_len));
- pem_password_cb *password_cb = SSL_CTX_get_default_passwd_cb(ctx);
- void *u = SSL_CTX_get_default_passwd_cb_userdata(ctx);
+ pem_password_cb *password_cb = SSL_CTX_get_default_passwd_cb(ctx);
+ void *u = SSL_CTX_get_default_passwd_cb_userdata(ctx);
- pkey.reset(PEM_read_bio_PrivateKey(bio.get(), nullptr, password_cb, u));
- if (nullptr == pkey) {
- Dbg(dbg_ctl_ssl_load, "failed to load server private key (%.*s) from
%s", secret_data_len < 50 ? secret_data_len : 50,
- secret_data, (!keyPath || keyPath[0] == '\0') ? "[empty key path]" :
keyPath);
- return false;
- }
- if (!SSL_CTX_use_PrivateKey(ctx, pkey.get())) {
- Dbg(dbg_ctl_ssl_load, "failed to attach server private key loaded from
%s",
- (!keyPath || keyPath[0] == '\0') ? "[empty key path]" : keyPath);
- return false;
- }
- if (e == nullptr && !SSL_CTX_check_private_key(ctx)) {
- Dbg(dbg_ctl_ssl_load, "server private key does not match the certificate
public key");
- return false;
- }
+ scoped_PKEY const pkey{PEM_read_bio_PrivateKey(bio.get(), nullptr,
password_cb, u)};
+ if (nullptr == pkey) {
+ Dbg(dbg_ctl_ssl_load, "failed to load server private key (%.*s) from %s",
secret_data_len < 50 ? secret_data_len : 50,
+ secret_data, (!keyPath || keyPath[0] == '\0') ? "[empty key path]" :
keyPath);
+ return false;
+ }
+ if (!SSL_CTX_use_PrivateKey(ctx, pkey.get())) {
+ Dbg(dbg_ctl_ssl_load, "failed to attach server private key loaded from %s",
+ (!keyPath || keyPath[0] == '\0') ? "[empty key path]" : keyPath);
+ return false;
+ }
+ if (!SSL_CTX_check_private_key(ctx)) {
+ Dbg(dbg_ctl_ssl_load, "server private key does not match the certificate
public key");
+ return false;
}
return true;
