5 Module N_OPENSSL_COMPAT
gullradriel edited this page 2026-10-09 00:55:18 +02:00

OPENSSL COMPAT: feature tests across OpenSSL and LibreSSL

Defines

Name
N_OSSL_OPENSSL_ATLEAST(v)
true when built against real OpenSSL of at least version v (an OPENSSL_VERSION_NUMBER literal)
N_OSSL_LIBRESSL_ATLEAST(v)
true when built against LibreSSL of at least version v; never true under real OpenSSL
N_OSSL_IS_LIBRESSL
1 when the linked library is LibreSSL rather than OpenSSL, 0 otherwise
N_OSSL_HAVE_TLS13
1 when the library can negotiate TLS 1.3, which is also what makes TLS1_3_VERSION and SSL_CTX_set_ciphersuites() exist (OpenSSL 1.1.1; LibreSSL got the ciphersuites setter in 3.4.1, rounded to 3.5.0)
N_OSSL_HAVE_SSL_SET1_HOST
1 when SSL_set1_host() and SSL_set_hostflags() are declared (OpenSSL 1.1.0, LibreSSL 2.9.0), 0 when they must be shimmed over X509_VERIFY_PARAM
N_OSSL_HAVE_RAW_EVP_25519
1 when X25519/Ed25519 are reachable through the raw-key EVP API (EVP_PKEY_X25519, EVP_PKEY_ED25519, EVP_PKEY_new_raw_private_key and friends): OpenSSL 1.1.1, LibreSSL 3.7.0
N_OSSL_HAVE_PROTO_VERSION_SETTERS
1 when SSL_CTX_set_min_proto_version() / SSL_CTX_set_max_proto_version() and the version-flexible TLS_method() family are declared (OpenSSL 1.1.0, LibreSSL 2.6.0; pinned to the 2.9.0 support floor), 0 otherwise
N_OSSL_HAVE_EVP_KDF
1 when the EVP_KDF provider API (EVP_KDF_fetch and friends) exists.
N_OSSL_HAVE_CHACHA20POLY1305
1 when EVP_chacha20_poly1305() and the EVP_CTRL_AEAD_* control names exist (OpenSSL 1.1.0, LibreSSL 3.6.0)
N_OSSL_HAVE_BLAKE2B512
1 when EVP_blake2b512() exists.

Macros Documentation

define N_OSSL_OPENSSL_ATLEAST

#define N_OSSL_OPENSSL_ATLEAST(
    v
)
(OPENSSL_VERSION_NUMBER >= (v))

true when built against real OpenSSL of at least version v (an OPENSSL_VERSION_NUMBER literal)

define N_OSSL_LIBRESSL_ATLEAST

#define N_OSSL_LIBRESSL_ATLEAST(
    v
)
0

true when built against LibreSSL of at least version v; never true under real OpenSSL

define N_OSSL_IS_LIBRESSL

#define N_OSSL_IS_LIBRESSL 0

1 when the linked library is LibreSSL rather than OpenSSL, 0 otherwise

define N_OSSL_HAVE_TLS13

#define N_OSSL_HAVE_TLS13 0

1 when the library can negotiate TLS 1.3, which is also what makes TLS1_3_VERSION and SSL_CTX_set_ciphersuites() exist (OpenSSL 1.1.1; LibreSSL got the ciphersuites setter in 3.4.1, rounded to 3.5.0)

define N_OSSL_HAVE_SSL_SET1_HOST

#define N_OSSL_HAVE_SSL_SET1_HOST 0

1 when SSL_set1_host() and SSL_set_hostflags() are declared (OpenSSL 1.1.0, LibreSSL 2.9.0), 0 when they must be shimmed over X509_VERIFY_PARAM

define N_OSSL_HAVE_RAW_EVP_25519

#define N_OSSL_HAVE_RAW_EVP_25519 0

1 when X25519/Ed25519 are reachable through the raw-key EVP API (EVP_PKEY_X25519, EVP_PKEY_ED25519, EVP_PKEY_new_raw_private_key and friends): OpenSSL 1.1.1, LibreSSL 3.7.0

define N_OSSL_HAVE_PROTO_VERSION_SETTERS

#define N_OSSL_HAVE_PROTO_VERSION_SETTERS 0

1 when SSL_CTX_set_min_proto_version() / SSL_CTX_set_max_proto_version() and the version-flexible TLS_method() family are declared (OpenSSL 1.1.0, LibreSSL 2.6.0; pinned to the 2.9.0 support floor), 0 otherwise

define N_OSSL_HAVE_EVP_KDF

#define N_OSSL_HAVE_EVP_KDF 0

1 when the EVP_KDF provider API (EVP_KDF_fetch and friends) exists.

That is OpenSSL 3.0; LibreSSL does not provide it at any version

define N_OSSL_HAVE_CHACHA20POLY1305

#define N_OSSL_HAVE_CHACHA20POLY1305 0

1 when EVP_chacha20_poly1305() and the EVP_CTRL_AEAD_* control names exist (OpenSSL 1.1.0, LibreSSL 3.6.0)

define N_OSSL_HAVE_BLAKE2B512

#define N_OSSL_HAVE_BLAKE2B512 0

1 when EVP_blake2b512() exists.

OpenSSL has it from 1.1.0; LibreSSL has no BLAKE2 at any version, so this is always 0 there