6 n__openssl__compat_8h
gullradriel edited this page 2026-10-09 00:55:18 +02:00

include/nilorea/n_openssl_compat.h

One place deciding which OpenSSL/LibreSSL features the build can use. More...

Detailed Description

One place deciding which OpenSSL/LibreSSL features the build can use.

Author: Castagnier Mickael

Version: 1.0

Source code

/*
 * Nilorea Library
 * Copyright (C) 2005-2026 Castagnier Mickael
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
 * implied. See the License for the specific language governing
 * permissions and limitations under the License.
 *
 * SPDX-License-Identifier: Apache-2.0
 */


#ifndef __NILOREA_OPENSSL_COMPAT_HEADER
#define __NILOREA_OPENSSL_COMPAT_HEADER

#ifdef __cplusplus
extern "C" {
#endif


#ifdef HAVE_OPENSSL

#include <openssl/opensslv.h>

/* Why this file exists.
 *
 * OPENSSL_VERSION_NUMBER is not a feature test on LibreSSL. LibreSSL pins it
 * at 0x20000000L and says so in its own opensslv.h ("These will never change"),
 * shipping its real version in LIBRESSL_VERSION_NUMBER instead. So the obvious
 * test, OPENSSL_VERSION_NUMBER >= 0x10101000L, is TRUE on every LibreSSL ever
 * released, including the ones that lack the API being tested for, and the
 * build breaks on a missing declaration precisely where the guard was supposed
 * to prevent it.
 *
 * It is not only a problem for old releases: LibreSSL has no BLAKE2 at all, at
 * any version, so a bare OPENSSL_VERSION_NUMBER test picks the implemented path
 * on every LibreSSL and never builds.
 *
 * Each feature below therefore carries two thresholds, one per implementation.
 * The LibreSSL ones were read off the commit that introduced the symbol in the
 * LibreSSL tree and rounded up to the next release, so an off-by-one release
 * costs a stubbed feature (safe) rather than a broken build.
 *
 * Supported LibreSSL floor: 2.9.0. Below that the SSL_set1_host() shim needs
 * SSL_get0_param(), which LibreSSL only grew in 2.7.0.
 */

#ifdef LIBRESSL_VERSION_NUMBER
#define N_OSSL_IS_LIBRESSL 1
#else
#define N_OSSL_IS_LIBRESSL 0
#endif

#if N_OSSL_IS_LIBRESSL
#define N_OSSL_OPENSSL_ATLEAST(v) 0
#define N_OSSL_LIBRESSL_ATLEAST(v) (LIBRESSL_VERSION_NUMBER >= (v))
#else
#define N_OSSL_OPENSSL_ATLEAST(v) (OPENSSL_VERSION_NUMBER >= (v))
#define N_OSSL_LIBRESSL_ATLEAST(v) 0
#endif

#if N_OSSL_OPENSSL_ATLEAST(0x10100000L) || N_OSSL_LIBRESSL_ATLEAST(0x2090000fL)
#define N_OSSL_HAVE_PROTO_VERSION_SETTERS 1
#else
#define N_OSSL_HAVE_PROTO_VERSION_SETTERS 0
#endif

#if N_OSSL_OPENSSL_ATLEAST(0x10100000L) || N_OSSL_LIBRESSL_ATLEAST(0x2090000fL)
#define N_OSSL_HAVE_SSL_SET1_HOST 1
#else
#define N_OSSL_HAVE_SSL_SET1_HOST 0
#endif

#if N_OSSL_OPENSSL_ATLEAST(0x10101000L) || N_OSSL_LIBRESSL_ATLEAST(0x3050000fL)
#define N_OSSL_HAVE_TLS13 1
#else
#define N_OSSL_HAVE_TLS13 0
#endif

#if N_OSSL_OPENSSL_ATLEAST(0x10100000L)
#define N_OSSL_HAVE_BLAKE2B512 1
#else
#define N_OSSL_HAVE_BLAKE2B512 0
#endif

#if N_OSSL_OPENSSL_ATLEAST(0x10100000L) || N_OSSL_LIBRESSL_ATLEAST(0x3060000fL)
#define N_OSSL_HAVE_CHACHA20POLY1305 1
#else
#define N_OSSL_HAVE_CHACHA20POLY1305 0
#endif

#if N_OSSL_OPENSSL_ATLEAST(0x10101000L) || N_OSSL_LIBRESSL_ATLEAST(0x3070000fL)
#define N_OSSL_HAVE_RAW_EVP_25519 1
#else
#define N_OSSL_HAVE_RAW_EVP_25519 0
#endif

#if N_OSSL_OPENSSL_ATLEAST(0x30000000L)
#define N_OSSL_HAVE_EVP_KDF 1
#else
#define N_OSSL_HAVE_EVP_KDF 0
#endif

#endif /* HAVE_OPENSSL */


#ifdef __cplusplus
}
#endif

#endif /* __NILOREA_OPENSSL_COMPAT_HEADER */