From 65c18e3f17a2ba0012479f5122e155d3f1039da9 Mon Sep 17 00:00:00 2001 From: akallabeth Date: Tue, 22 Aug 2023 12:12:45 +0200 Subject: [PATCH 1/4] [cmake] update FindOpenSSL also check OPENSSL_VERSION_STR if OPENSSL_VERSION_NUMBER fails to parse --- cmake/FindOpenSSL.cmake | 69 ++++++++++++++++++++++++++++------------- 1 file changed, 47 insertions(+), 22 deletions(-) diff --git a/cmake/FindOpenSSL.cmake b/cmake/FindOpenSSL.cmake index d42a50cde7b7..f630d1a16ec5 100644 --- a/cmake/FindOpenSSL.cmake +++ b/cmake/FindOpenSSL.cmake @@ -55,7 +55,7 @@ FIND_PATH(OPENSSL_INCLUDE_DIR NAMES openssl/ssl.h PATH_SUFFIXES - "include" + "include" HINTS ${_OPENSSL_INCLUDEDIR} ${_OPENSSL_ROOT_HINTS_AND_PATHS} @@ -172,8 +172,8 @@ ELSEIF(WIN32 AND NOT CYGWIN) ) set( OPENSSL_DEBUG_LIBRARIES ${SSL_EAY_DEBUG} ${LIB_EAY_DEBUG} ) - set( OPENSSL_RELEASE_LIBRARIES ${SSL_EAY_RELEASE} ${LIB_EAY_RELEASE} ) - set( OPENSSL_LIBRARIES ${OPENSSL_RELEASE_LIBRARIES} ) + set( OPENSSL_RELEASE_LIBRARIES ${SSL_EAY_RELEASE} ${LIB_EAY_RELEASE} ) + set( OPENSSL_LIBRARIES ${OPENSSL_RELEASE_LIBRARIES} ) MARK_AS_ADVANCED(SSL_EAY_DEBUG SSL_EAY_RELEASE) MARK_AS_ADVANCED(LIB_EAY_DEBUG LIB_EAY_RELEASE) @@ -313,25 +313,50 @@ if (OPENSSL_INCLUDE_DIR) string(REGEX REPLACE "^.*OPENSSL_VERSION_NUMBER[\t ]+0x([0-9a-fA-F])([0-9a-fA-F][0-9a-fA-F])([0-9a-fA-F][0-9a-fA-F])([0-9a-fA-F][0-9a-fA-F])([0-9a-fA-F]).*$" "\\1;\\2;\\3;\\4;\\5" OPENSSL_VERSION_LIST "${openssl_version_str}") - list(GET OPENSSL_VERSION_LIST 0 OPENSSL_VERSION_MAJOR) - list(GET OPENSSL_VERSION_LIST 1 OPENSSL_VERSION_MINOR) - from_hex("${OPENSSL_VERSION_MINOR}" OPENSSL_VERSION_MINOR) - list(GET OPENSSL_VERSION_LIST 2 OPENSSL_VERSION_FIX) - from_hex("${OPENSSL_VERSION_FIX}" OPENSSL_VERSION_FIX) - list(GET OPENSSL_VERSION_LIST 3 OPENSSL_VERSION_PATCH) - - if (NOT OPENSSL_VERSION_PATCH STREQUAL "00") - from_hex("${OPENSSL_VERSION_PATCH}" _tmp) - # 96 is the ASCII code of 'a' minus 1 - math(EXPR OPENSSL_VERSION_PATCH_ASCII "${_tmp} + 96") - unset(_tmp) - # Once anyone knows how OpenSSL would call the patch versions beyond 'z' - # this should be updated to handle that, too. This has not happened yet - # so it is simply ignored here for now. - string(ASCII "${OPENSSL_VERSION_PATCH_ASCII}" OPENSSL_VERSION_PATCH_STRING) - endif (NOT OPENSSL_VERSION_PATCH STREQUAL "00") - - set(OPENSSL_VERSION "${OPENSSL_VERSION_MAJOR}.${OPENSSL_VERSION_MINOR}.${OPENSSL_VERSION_FIX}${OPENSSL_VERSION_PATCH_STRING}") + if (OPENSSL_VERSION_LIST) + list(GET OPENSSL_VERSION_LIST 0 OPENSSL_VERSION_MAJOR) + list(GET OPENSSL_VERSION_LIST 1 OPENSSL_VERSION_MINOR) + from_hex("${OPENSSL_VERSION_MINOR}" OPENSSL_VERSION_MINOR) + list(GET OPENSSL_VERSION_LIST 2 OPENSSL_VERSION_FIX) + from_hex("${OPENSSL_VERSION_FIX}" OPENSSL_VERSION_FIX) + list(GET OPENSSL_VERSION_LIST 3 OPENSSL_VERSION_PATCH) + + if (NOT OPENSSL_VERSION_PATCH STREQUAL "00") + from_hex("${OPENSSL_VERSION_PATCH}" _tmp) + # 96 is the ASCII code of 'a' minus 1 + math(EXPR OPENSSL_VERSION_PATCH_ASCII "${_tmp} + 96") + unset(_tmp) + # Once anyone knows how OpenSSL would call the patch versions beyond 'z' + # this should be updated to handle that, too. This has not happened yet + # so it is simply ignored here for now. + string(ASCII "${OPENSSL_VERSION_PATCH_ASCII}" OPENSSL_VERSION_PATCH_STRING) + endif (NOT OPENSSL_VERSION_PATCH STREQUAL "00") + + set(OPENSSL_VERSION "${OPENSSL_VERSION_MAJOR}.${OPENSSL_VERSION_MINOR}.${OPENSSL_VERSION_FIX}${OPENSSL_VERSION_PATCH_STRING}") + endif() + + if (NOT OPENSSL_VERSION_LIST) + file(STRINGS "${OPENSSL_INCLUDE_DIR}/openssl/opensslv.h" openssl_version_str_str + REGEX "^#[\t ]*define[\t ]+OPENSSL_VERSION_STR[\t ]\"([0-9a-fA-F]+)\\.([0-9a-fA-F]+)\\.([0-9a-fA-F]+).*\".*$") + string(REGEX REPLACE "^.*OPENSSL_VERSION_STR[\t ]+\"([0-9a-fA-F]+)\\.([0-9a-fA-F]+)\\.([0-9a-fA-F]+).*\".*$" + "\\1.\\2.\\3" OPENSSL_VERSION "${openssl_version_str_str}") + endif() + + if (NOT OPENSSL_VERSION_LIST) + file(STRINGS "${OPENSSL_INCLUDE_DIR}/openssl/opensslv.h" openssl_version_major_str + REGEX "^#[\t ]*define[\t ]+OPENSSL_VERSION_MAJOR[\t ]+([0-9a-fA-F]+).*$") + string(REGEX REPLACE "^#[\t ]*define[\t ]+OPENSSL_VERSION_MAJOR[\t ]+([0-9a-fA-F]+).*$" + "\\1" OPENSSL_VERSION_MAJOR "${openssl_version_major_str}") + file(STRINGS "${OPENSSL_INCLUDE_DIR}/openssl/opensslv.h" openssl_version_minor_str + REGEX "^#[\t ]*define[\t ]+OPENSSL_VERSION_MINOR[\t ]+([0-9a-fA-F]+).*$") + string(REGEX REPLACE "^#[\t ]*define[\t ]+OPENSSL_VERSION_MINOR[\t ]+([0-9a-fA-F]+).*$" + "\\1" OPENSSL_VERSION_MINOR "${openssl_version_minor_str}") + file(STRINGS "${OPENSSL_INCLUDE_DIR}/openssl/opensslv.h" openssl_version_patch_str + REGEX "^#[\t ]*define[\t ]+OPENSSL_VERSION_PATCH[\t ]+([0-9a-fA-F]+).*$") + string(REGEX REPLACE "^#[\t ]*define[\t ]+OPENSSL_VERSION_PATCH[\t ]+([0-9a-fA-F]+).*$" + "\\1" OPENSSL_VERSION_PATCH "${openssl_version_patch_str}") + set(OPENSSL_VERSION "${OPENSSL_VERSION_MAJOR}.${OPENSSL_VERSION_MINOR}.${OPENSSL_VERSION_PATCH}") + endif() endif (_OPENSSL_VERSION) endif (OPENSSL_INCLUDE_DIR) From c6116960d1e7bf7a5f1ced225ff9a8f03ceadc55 Mon Sep 17 00:00:00 2001 From: Ondrej Holy Date: Wed, 12 May 2021 12:48:15 +0200 Subject: [PATCH 2/4] Fix FIPS mode support and build with OpenSSL 3.0 FreeRDP fails to build with OpenSSL 3.0 because of usage of the `FIPS_mode` and `FIPS_mode_set` functions, which were removed there. Just a note that the FIPS mode is not supported by OpenSSL 1.1.* although the mentioned functions are still there (see https://wiki.openssl.org/index.php/FIPS_modules). Let's make FreeRDP build with OpenSSL 3.0 and fix the FIPS mode support. See: https://bugzilla.redhat.com/show_bug.cgi?id=1952937 --- winpr/libwinpr/utils/ssl.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/winpr/libwinpr/utils/ssl.c b/winpr/libwinpr/utils/ssl.c index 3a8590390343..03b23af43ac8 100644 --- a/winpr/libwinpr/utils/ssl.c +++ b/winpr/libwinpr/utils/ssl.c @@ -244,9 +244,17 @@ static BOOL winpr_enable_fips(DWORD flags) #else WLog_DBG(TAG, "Ensuring openssl fips mode is ENabled"); +#if defined(OPENSSL_VERSION_MAJOR) && (OPENSSL_VERSION_MAJOR >= 3) + if (!EVP_default_properties_is_fips_enabled(NULL)) +#else if (FIPS_mode() != 1) +#endif { +#if defined(OPENSSL_VERSION_MAJOR) && (OPENSSL_VERSION_MAJOR >= 3) + if (EVP_set_default_properties(NULL, "fips=yes")) +#else if (FIPS_mode_set(1)) +#endif WLog_INFO(TAG, "Openssl fips mode ENabled!"); else { From bcbf8557b991272568645a953653f09f6071dc9c Mon Sep 17 00:00:00 2001 From: Mike Gilbert Date: Sun, 1 Aug 2021 12:14:43 -0400 Subject: [PATCH 3/4] winpr: avoid calling FIPS_mode() with OpenSSL 3.0 Fixes: 26bf2816c3e0daeaf524c47cf0fcda8ae13b65ad --- winpr/libwinpr/utils/ssl.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/winpr/libwinpr/utils/ssl.c b/winpr/libwinpr/utils/ssl.c index 03b23af43ac8..74ef156e7b07 100644 --- a/winpr/libwinpr/utils/ssl.c +++ b/winpr/libwinpr/utils/ssl.c @@ -364,6 +364,8 @@ BOOL winpr_FIPSMode(void) { #if (OPENSSL_VERSION_NUMBER < 0x10001000L) || defined(LIBRESSL_VERSION_NUMBER) return FALSE; +#elif defined(OPENSSL_VERSION_MAJOR) && (OPENSSL_VERSION_MAJOR >= 3) + return (EVP_default_properties_is_fips_enabled(NULL) == 1); #else return (FIPS_mode() == 1); #endif From a8c63d5364843acaf7e8aabd1f5546e516371259 Mon Sep 17 00:00:00 2001 From: Frederik Carlier Date: Sun, 10 Nov 2024 16:35:54 +0100 Subject: [PATCH 4/4] Add CI --- .github/workflows/ci.yml | 47 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 000000000000..a65d4d6a7e64 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,47 @@ +name: FreeRDP CI +on: + push: + pull_request: + workflow_dispatch: + +jobs: + ubuntu: + runs-on: ubuntu-latest + container: + image: ${{ matrix.image }} + strategy: + fail-fast: false + matrix: + include: + - name: ubuntu-22.04 + image: ubuntu:22.04 + family: ubuntu + - name: ubuntu-24.04 + image: ubuntu:24.04 + family: ubuntu + - name: rockylinux-9 + image: rockylinux:9 + family: rhel + repos: crb + - name: rockylinux-8 + image: rockylinux:8 + family: rhel + repos: powertools + steps: + - name: Install dependencies (Ubuntu) + run: | + apt-get update + apt-get install -y clang cmake libssl-dev zlib1g-dev + if: matrix.family == 'ubuntu' + - name: Install dependencies (Enterprise Linux) + run: | + yum install -y clang cmake openssl-devel zlib-devel + if: matrix.family == 'rhel' + - name: Checkout + uses: actions/checkout@v4 + - name: Build + run: | + mkdir build + cd build + cmake .. + cmake --build . -j$(nproc)