Fix build failure when --disable-openssl-version-check is set.

4f24d4c mostly corrected the behaviour, however mainconfig.allow_vulnerable_ssl still had a dependency on ENABLE_OPENSSL_VERSION_CHECK.

diff --git a/src/include/radiusd.h b/src/include/radiusd.h
index db05e25..471c922 100644 (file)
--- a/src/include/radiusd.h
+++ b/src/include/radiusd.h
@@ -360,7 +360,7 @@ typedef struct main_config_t {
        int             proxy_requests;
        int             reject_delay;
        int             status_server;
-#ifdef ENABLE_OPENSSL_VERSION_CHECK
+#if defined(HAVE_OPENSSL_CRYPTO_H) && defined(ENABLE_OPENSSL_VERSION_CHECK)
        int             allow_vulnerable_openssl;
 #endif
        int             max_request_time;
@@ -536,7 +536,8 @@ int         pairlist_read(const char *file, PAIR_LIST **list, int complain);
 void           pairlist_free(PAIR_LIST **);
 
 /* version.c */
-int            ssl_check_version(int allow_vulnerable);
+int            ssl_check_version(void);
+int            ssl_check_vulnerable(void);
 const char     *ssl_version(void);
 void           version(void);
 

diff --git a/src/main/mainconfig.c b/src/main/mainconfig.c
index a90bd78..3ccfcd8 100644 (file)
--- a/src/main/mainconfig.c
+++ b/src/main/mainconfig.c
@@ -172,7 +172,7 @@ static const CONF_PARSER security_config[] = {
        { "max_attributes",  PW_TYPE_INTEGER, 0, &fr_max_attributes, Stringify(0) },
        { "reject_delay",  PW_TYPE_INTEGER, 0, &mainconfig.reject_delay, Stringify(0) },
        { "status_server", PW_TYPE_BOOLEAN, 0, &mainconfig.status_server, "no"},
-#ifdef ENABLE_OPENSSL_VERSION_CHECK
+#if defined(HAVE_OPENSSL_CRYPTO_H) && defined(ENABLE_OPENSSL_VERSION_CHECK)
        { "allow_vulnerable_openssl", PW_TYPE_BOOLEAN, 0, &mainconfig.allow_vulnerable_openssl, "no"},
 #endif
        { NULL, -1, 0, NULL, NULL }

diff --git a/src/main/radiusd.c b/src/main/radiusd.c
index 6cd9654..bd8b379 100644 (file)
--- a/src/main/radiusd.c
+++ b/src/main/radiusd.c
@@ -293,9 +293,22 @@ int main(int argc, char *argv[])
         *      Mismatch between build time OpenSSL and linked SSL,
         *      better to die here than segfault later.
         */
-       if (ssl_check_version(mainconfig.allow_vulnerable_openssl) < 0) {
+       if (ssl_check_version() < 0) {
                exit(1);
        }
+
+       /*
+        *      Check for known vulnerabilities that compromise the 
+        *      security of the server.
+        */
+#  ifdef ENABLE_OPENSSL_VERSION_CHECK
+       if (!mainconfig.allow_vulnerable_openssl) {
+               if (ssl_check_vulnerable() < 0) {
+                       exit(1);
+               }
+       }
+#  endif
+
 #endif
 
        /*  Load the modules AFTER doing SSL checks */

diff --git a/src/main/version.c b/src/main/version.c
index 760a1bf..504ce20 100644 (file)
--- a/src/main/version.c
+++ b/src/main/version.c
@@ -63,7 +63,7 @@ const char *ssl_version()
  * @return 0 if ok, else -1
  */
 #ifdef HAVE_OPENSSL_CRYPTO_H
-int ssl_check_version(int allow_vulnerable)
+int ssl_check_version()
 {
        long ssl_linked;
 
@@ -94,22 +94,42 @@ int ssl_check_version(int allow_vulnerable)
         */
        } else if ((ssl_built & 0xfffff000) != (ssl_linked & 0xfffff000)) goto mismatch;
 
+       return 0;
+}
+
+/** Check OpenSSL version for known vulnerabilities.
+ *
+ * OpenSSL version number consists of:
+ * MNNFFPPS: major minor fix patch status
+ *
+ * Where status >= 0 && < 10 means beta, and status 10 means release.
+ *
+ * Startup check for whether the linked version of OpenSSL is a version known to
+ * have serious vulnerabilities impacting FreeRADIUS.
+ *
+ * @return 0 if ok, else -1
+ */
 #  ifdef ENABLE_OPENSSL_VERSION_CHECK
-       if (!allow_vulnerable) {
-               /* Check for bad versions */
-               /* 1.0.1 - 1.0.1f CVE-2014-0160 http://heartbleed.com */
-               if ((ssl_linked >= 0x010001000) && (ssl_linked < 0x010001070)) {
-                       radlog(L_ERR, "Refusing to start with libssl version %s (in range 1.0.1 - 1.0.1f).  "
-                             "Security advisory CVE-2014-0160 (Heartbleed)", ssl_version());
-                       radlog(L_ERR, "For more information see http://heartbleed.com");
-
-                       return -1;
-               }
+int ssl_check_vulnerable()
+{
+       long ssl_linked;
+
+       ssl_linked = SSLeay();
+
+       /* Check for bad versions */
+       /* 1.0.1 - 1.0.1f CVE-2014-0160 http://heartbleed.com */
+       if ((ssl_linked >= 0x010001000) && (ssl_linked < 0x010001070)) {
+               radlog(L_ERR, "Refusing to start with libssl version %s (in range 1.0.1 - 1.0.1f).  "
+                     "Security advisory CVE-2014-0160 (Heartbleed)", ssl_version());
+               radlog(L_ERR, "For more information see http://heartbleed.com");
+
+               return -1;
        }
-#  endif
 
        return 0;
 }
+#  endif
+
 #endif
 
 /*