OpenSSL version tested

[laffer1]

Could you provide major version info on what OpenSSL releases you currently test with and/or support with duo unix?

Use Case

I'm seeing some build errors on my BSD system when compiling 2.1.0 or later versions, but prior releases worked (2.0.2 and 2.0.4). I suspect the issue is the version of OpenSSL it's linking against (3.0.16). Having a sense of what versions do work would help me narrow down the problem.

[AaronAtDuo]

@laffer1 I do not have an exhaustive list, but looking back at our various builds and testing infrastructure, we've tested against a pretty wide spread of OpenSSL versions from 1.1.1 onward; but that's only across a variety of Linux distros - not BSD.

[AaronAtDuo]

@laffer1 Can you share the error you are getting? At the very least I may be able to take a guess as to what change in 2.1.0 might be related, since there were quite a few.

[laffer1]

So this is attempting to build 2.2.1. OS: MidnightBSD 4.0 current

I got past the OpenSSL error after updating to OpenSSL 3.0.18. Now I get a new error.

libtool: compile:  cc -DHAVE_CONFIG_H -I. -I.. -I../compat -I/usr/local/include -O2 -pipe -fstack-protector-strong -fno-strict-aliasing -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -g0 -MT ini.lo -MD -MP -MF .deps/ini.Tpo -c ini.c  -fPIC -DPIC -o .libs/ini.o
--- urlenc.lo ---
libtool: compile:  cc -DHAVE_CONFIG_H -I. -I.. -I../compat -I/usr/local/include -O2 -pipe -fstack-protector-strong -fno-strict-aliasing -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -g0 -MT urlenc.lo -MD -MP -MF .deps/urlenc.Tpo -c urlenc.c  -fPIC -DPIC -o .libs/urlenc.o
libtool: compile:  cc -DHAVE_CONFIG_H -I. -I.. -I../compat -I/usr/local/include -O2 -pipe -fstack-protector-strong -fno-strict-aliasing -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -g0 -MT urlenc.lo -MD -MP -MF .deps/urlenc.Tpo -c urlenc.c -fPIE -o urlenc.o >/dev/null 2>&1
--- ini.lo ---
libtool: compile:  cc -DHAVE_CONFIG_H -I. -I.. -I../compat -I/usr/local/include -O2 -pipe -fstack-protector-strong -fno-strict-aliasing -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -g0 -MT ini.lo -MD -MP -MF .deps/ini.Tpo -c ini.c -fPIE -o ini.o >/dev/null 2>&1
--- util.lo ---
libtool: compile:  cc -DHAVE_CONFIG_H -I. -I.. -I../compat -I/usr/local/include -O2 -pipe -fstack-protector-strong -fno-strict-aliasing -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -g0 -MT util.lo -MD -MP -MF .deps/util.Tpo -c util.c -fPIE -o util.o >/dev/null 2>&1
--- https.lo ---
https.c:208:21: error: variable has incomplete type 'struct in6_addr'
  208 |     struct in6_addr addr;
      |                     ^
https.c:208:12: note: forward declaration of 'struct in6_addr'
  208 |     struct in6_addr addr;
      |            ^
https.c:220:20: error: invalid application of 'sizeof' to an incomplete type 'struct in6_addr'
  220 |         addrsize = sizeof(struct in6_addr);
      |                    ^     ~~~~~~~~~~~~~~~~~
https.c:208:12: note: forward declaration of 'struct in6_addr'
  208 |     struct in6_addr addr;
      |            ^
https.c:234:40: warning: 'ASN1_STRING_data' is deprecated [-Wdeprecated-declarations]
  234 |                 char *altptr = (char *)ASN1_STRING_data(altname->d.ia5);
      |                                        ^
/usr/local/include/openssl/asn1.h:680:1: note: 'ASN1_STRING_data' has been explicitly marked deprecated here
  680 | OSSL_DEPRECATEDIN_1_1_0 unsigned char *ASN1_STRING_data(ASN1_STRING *x);
      | ^
/usr/local/include/openssl/macros.h:204:49: note: expanded from macro 'OSSL_DEPRECATEDIN_1_1_0'
  204 | #   define OSSL_DEPRECATEDIN_1_1_0              OSSL_DEPRECATED(1.1.0)
      |                                                 ^
/usr/local/include/openssl/macros.h:62:52: note: expanded from macro 'OSSL_DEPRECATED'
   62 | #     define OSSL_DEPRECATED(since) __attribute__((deprecated))
      |                                                    ^
https.c:261:47: warning: 'ASN1_STRING_data' is deprecated [-Wdeprecated-declarations]
  261 |                 const char *pattern = (char *)ASN1_STRING_data(tmp);
      |                                               ^
/usr/local/include/openssl/asn1.h:680:1: note: 'ASN1_STRING_data' has been explicitly marked deprecated here
  680 | OSSL_DEPRECATEDIN_1_1_0 unsigned char *ASN1_STRING_data(ASN1_STRING *x);
      | ^
/usr/local/include/openssl/macros.h:204:49: note: expanded from macro 'OSSL_DEPRECATEDIN_1_1_0'
  204 | #   define OSSL_DEPRECATEDIN_1_1_0              OSSL_DEPRECATED(1.1.0)
      |                                                 ^
/usr/local/include/openssl/macros.h:62:52: note: expanded from macro 'OSSL_DEPRECATED'
   62 | #     define OSSL_DEPRECATED(since) __attribute__((deprecated))
      |                                                    ^
--- duo.lo ---
duo.c:376:40: warning: implicit conversion from 'int' to 'float' changes value from 2147483647 to 2147483648 [-Wimplicit-const-int-float-conversion]
  376 |             .tv_nsec = (float)rand() / RAND_MAX * 1000000000
      |                                      ~ ^~~~~~~~
/usr/include/stdlib.h:79:18: note: expanded from macro 'RAND_MAX'
   79 | #define RAND_MAX        0x7fffffff
      |                         ^~~~~~~~~~
--- https.lo ---
https.c:974:17: warning: 'HMAC_CTX_new' is deprecated [-Wdeprecated-declarations]
  974 |     if ((hmac = HMAC_CTX_new()) == NULL) {
      |                 ^
/usr/local/include/openssl/hmac.h:33:1: note: 'HMAC_CTX_new' has been explicitly marked deprecated here
   33 | OSSL_DEPRECATEDIN_3_0 HMAC_CTX *HMAC_CTX_new(void);
      | ^
/usr/local/include/openssl/macros.h:182:49: note: expanded from macro 'OSSL_DEPRECATEDIN_3_0'
  182 | #   define OSSL_DEPRECATEDIN_3_0                OSSL_DEPRECATED(3.0)
      |                                                 ^
/usr/local/include/openssl/macros.h:62:52: note: expanded from macro 'OSSL_DEPRECATED'
   62 | #     define OSSL_DEPRECATED(since) __attribute__((deprecated))
      |                                                    ^
https.c:980:5: warning: 'HMAC_Init' is deprecated [-Wdeprecated-declarations]
  980 |     HMAC_Init(hmac, skey, strlen(skey), EVP_sha512());
      |     ^
/usr/local/include/openssl/hmac.h:38:1: note: 'HMAC_Init' has been explicitly marked deprecated here
   38 | OSSL_DEPRECATEDIN_1_1_0 __owur int HMAC_Init(HMAC_CTX *ctx,
      | ^
/usr/local/include/openssl/macros.h:204:49: note: expanded from macro 'OSSL_DEPRECATEDIN_1_1_0'
  204 | #   define OSSL_DEPRECATEDIN_1_1_0              OSSL_DEPRECATED(1.1.0)
      |                                                 ^
/usr/local/include/openssl/macros.h:62:52: note: expanded from macro 'OSSL_DEPRECATED'
   62 | #     define OSSL_DEPRECATED(since) __attribute__((deprecated))
      |                                                    ^
https.c:981:5: warning: 'HMAC_Update' is deprecated [-Wdeprecated-declarations]
  981 |     HMAC_Update(hmac, (unsigned char *)p, strlen(p));
      |     ^
/usr/local/include/openssl/hmac.h:45:1: note: 'HMAC_Update' has been explicitly marked deprecated here
   45 | OSSL_DEPRECATEDIN_3_0 int HMAC_Update(HMAC_CTX *ctx, const unsigned char *data,
      | ^
/usr/local/include/openssl/macros.h:182:49: note: expanded from macro 'OSSL_DEPRECATEDIN_3_0'
  182 | #   define OSSL_DEPRECATEDIN_3_0                OSSL_DEPRECATED(3.0)
      |                                                 ^
/usr/local/include/openssl/macros.h:62:52: note: expanded from macro 'OSSL_DEPRECATED'
   62 | #     define OSSL_DEPRECATED(since) __attribute__((deprecated))
      |                                                    ^
https.c:982:5: warning: 'HMAC_Final' is deprecated [-Wdeprecated-declarations]
  982 |     HMAC_Final(hmac, MD, NULL);
      |     ^
/usr/local/include/openssl/hmac.h:47:1: note: 'HMAC_Final' has been explicitly marked deprecated here
   47 | OSSL_DEPRECATEDIN_3_0 int HMAC_Final(HMAC_CTX *ctx, unsigned char *md,
      | ^
/usr/local/include/openssl/macros.h:182:49: note: expanded from macro 'OSSL_DEPRECATEDIN_3_0'
  182 | #   define OSSL_DEPRECATEDIN_3_0                OSSL_DEPRECATED(3.0)
      |                                                 ^
/usr/local/include/openssl/macros.h:62:52: note: expanded from macro 'OSSL_DEPRECATED'
   62 | #     define OSSL_DEPRECATED(since) __attribute__((deprecated))
      |                                                    ^
https.c:983:5: warning: 'HMAC_CTX_free' is deprecated [-Wdeprecated-declarations]
  983 |     HMAC_CTX_free(hmac);
      |     ^
/usr/local/include/openssl/hmac.h:35:1: note: 'HMAC_CTX_free' has been explicitly marked deprecated here
   35 | OSSL_DEPRECATEDIN_3_0 void HMAC_CTX_free(HMAC_CTX *ctx);
      | ^
/usr/local/include/openssl/macros.h:182:49: note: expanded from macro 'OSSL_DEPRECATEDIN_3_0'
  182 | #   define OSSL_DEPRECATEDIN_3_0                OSSL_DEPRECATED(3.0)
      |                                                 ^
/usr/local/include/openssl/macros.h:62:52: note: expanded from macro 'OSSL_DEPRECATED'
   62 | #     define OSSL_DEPRECATED(since) __attribute__((deprecated))
      |                                                    ^
7 warnings and 2 errors generated.
*** [https.lo] Error code 1

make[2]: stopped in /usr/mports/security/duo/work/duo_unix-2.2.1/lib
--- duo.lo ---
1 warning generated.
libtool: compile:  cc -DHAVE_CONFIG_H -I. -I.. -I../compat -I/usr/local/include -O2 -pipe -fstack-protector-strong -fno-strict-aliasing -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -g0 -MT duo.lo -MD -MP -MF .deps/duo.Tpo -c duo.c -fPIE -o duo.o >/dev/null 2>&1
--- http_parser.lo ---
libtool: compile:  cc -DHAVE_CONFIG_H -I. -I.. -I../compat -I/usr/local/include -O2 -pipe -fstack-protector-strong -fno-strict-aliasing -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -g0 -MT http_parser.lo -MD -MP -MF .deps/http_parser.Tpo -c http_parser.c -fPIE -o http_parser.o >/dev/null 2>&1
--- parson.lo ---
libtool: compile:  cc -DHAVE_CONFIG_H -I. -I.. -I../compat -I/usr/local/include -O2 -pipe -fstack-protector-strong -fno-strict-aliasing -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -g0 -MT parson.lo -MD -MP -MF .deps/parson.Tpo -c parson.c -fPIE -o parson.o >/dev/null 2>&1
1 error

make[2]: stopped in /usr/mports/security/duo/work/duo_unix-2.2.1/lib

make[1]: stopped in /usr/mports/security/duo/work/duo_unix-2.2.1

[laffer1]

This patch seems to fix it. (Should also work on FreeBSD 13.x)

https://github.com/MidnightBSD/mports/blob/c54547dc934a925a8bad7bd1fc4d9b0d9a5019e5/security/duo/files/patch-lib_https.c