[tor-commits] [tor/master] Stop implying that we support openssl 1.0.0; we don't.

[nickm at torproject.org]

commit 850ec1e2822482435bb0efa8853a74d6f0feaa20
Author: Nick Mathewson <nickm at torproject.org>
Date:   Thu Oct 6 12:58:49 2016 -0400

    Stop implying that we support openssl 1.0.0; we don't.
    
    Closes ticket 20303.
    
    The LIBRESSL_VERSION_NUMBER check is needed because if our openssl
    is really libressl, it will have an openssl version number we can't
    really believe.
---
 changes/no_openssl_100      | 4 ++++
 configure.ac                | 4 ++--
 src/common/compat_openssl.h | 5 +++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/changes/no_openssl_100 b/changes/no_openssl_100
new file mode 100644
index 0000000..dd89da8
--- /dev/null
+++ b/changes/no_openssl_100
@@ -0,0 +1,4 @@
+  o Required libraries:
+    - When building with OpenSSL, Tor now requires version 1.0.1 or later.
+      OpenSSL 1.0.0 and earlier are no longer supported by the openssl team,
+      and should not be used. Closes ticket 20303.
diff --git a/configure.ac b/configure.ac
index 23371d3..af42896 100644
--- a/configure.ac
+++ b/configure.ac
@@ -614,12 +614,12 @@ CPPFLAGS="$TOR_CPPFLAGS_openssl $CPPFLAGS"
 
 AC_TRY_COMPILE([
 #include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER < 0x1000000fL
+#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER < 0x1000100fL
 #error "too old"
 #endif
    ], [],
    [ : ],
-   [ AC_ERROR([OpenSSL is too old. We require 1.0.0 or later. You can specify a path to a newer one with --with-openssl-dir.]) ])
+   [ AC_ERROR([OpenSSL is too old. We require 1.0.1 or later. You can specify a path to a newer one with --with-openssl-dir.]) ])
 
 AC_TRY_COMPILE([
 #include <openssl/opensslv.h>
diff --git a/src/common/compat_openssl.h b/src/common/compat_openssl.h
index a7bdb0a..1bfe188 100644
--- a/src/common/compat_openssl.h
+++ b/src/common/compat_openssl.h
@@ -15,8 +15,9 @@
  * \brief compatability definitions for working with different openssl forks
  **/
 
-#if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(1,0,0)
-#error "We require OpenSSL >= 1.0.0"
+#if !defined(LIBRESSL_VERSION_NUMBER) && \
+  OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(1,0,1)
+#error "We require OpenSSL >= 1.0.1"
 #endif
 
 #if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) && \