Switch OPENSSL_VERSION_NUMBER to 1.1.0.
Although we are derived from 1.0.2, we mimic 1.1.0 in some ways around
our FOO_up_ref functions and opaque libssl types. This causes some
difficulties when porting third-party code as any OPENSSL_VERSION_NUMBER
checks for 1.1.0 APIs we have will be wrong.
Moreover, adding accessors without changing OPENSSL_VERSION_NUMBER can
break external projects. It is common to implement a compatibility
version of an accessor under #ifdef as a static function. This then
conflicts with our headers if we, unlike OpenSSL 1.0.2, have this
function.
This change switches OPENSSL_VERSION_NUMBER to 1.1.0 and atomically adds
enough accessors for software with 1.1.0 support already. The hope is
this will unblock hiding SSL_CTX and SSL_SESSION, which will be
especially useful with C++-ficiation. The cost is we will hit some
growing pains as more 1.1.0 consumers enter the ecosystem and we
converge on the right set of APIs to import from upstream.
It does not remove any 1.0.2 APIs, so we will not require that all
projects support 1.1.0. The exception is APIs which changed in 1.1.0 but
did not change the function signature. Those are breaking changes.
Specifically:
- SSL_CTX_sess_set_get_cb is now const-correct.
- X509_get0_signature is now const-correct.
For C++ consumers only, this change temporarily includes an overload
hack for SSL_CTX_sess_set_get_cb that keeps the old callback working.
This is a workaround for Node not yet supporting OpenSSL 1.1.0.
The version number is set at (the as yet unreleased) 1.1.0g to denote
that this change includes https://github.com/openssl/openssl/pull/4384.
Bug: 91
Change-Id: I5eeb27448a6db4c25c244afac37f9604d9608a76
Reviewed-on: https://boringssl-review.googlesource.com/10340
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
Reviewed-by: Adam Langley <agl@google.com>
diff --git a/include/openssl/digest.h b/include/openssl/digest.h
index 9e7f434..81f5892 100644
--- a/include/openssl/digest.h
+++ b/include/openssl/digest.h
@@ -106,21 +106,25 @@
// same as setting the structure to zero.
OPENSSL_EXPORT void EVP_MD_CTX_init(EVP_MD_CTX *ctx);
-// EVP_MD_CTX_create allocates and initialises a fresh |EVP_MD_CTX| and returns
-// it, or NULL on allocation failure.
-OPENSSL_EXPORT EVP_MD_CTX *EVP_MD_CTX_create(void);
+// EVP_MD_CTX_new allocates and initialises a fresh |EVP_MD_CTX| and returns
+// it, or NULL on allocation failure. The caller must use |EVP_MD_CTX_free| to
+// release the resulting object.
+OPENSSL_EXPORT EVP_MD_CTX *EVP_MD_CTX_new(void);
// EVP_MD_CTX_cleanup frees any resources owned by |ctx| and resets it to a
// freshly initialised state. It does not free |ctx| itself. It returns one.
OPENSSL_EXPORT int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx);
-// EVP_MD_CTX_destroy calls |EVP_MD_CTX_cleanup| and then frees |ctx| itself.
-OPENSSL_EXPORT void EVP_MD_CTX_destroy(EVP_MD_CTX *ctx);
+// EVP_MD_CTX_free calls |EVP_MD_CTX_cleanup| and then frees |ctx| itself.
+OPENSSL_EXPORT void EVP_MD_CTX_free(EVP_MD_CTX *ctx);
// EVP_MD_CTX_copy_ex sets |out|, which must already be initialised, to be a
// copy of |in|. It returns one on success and zero on error.
OPENSSL_EXPORT int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in);
+// EVP_MD_CTX_reset calls |EVP_MD_CTX_cleanup| followed by |EVP_MD_CTX_init|.
+OPENSSL_EXPORT void EVP_MD_CTX_reset(EVP_MD_CTX *ctx);
+
// Digest operations.
@@ -201,6 +205,26 @@
#define EVP_MD_FLAG_DIGALGID_ABSENT 2
+// Digest operation accessors.
+
+// EVP_MD_CTX_md returns the underlying digest function, or NULL if one has not
+// been set.
+OPENSSL_EXPORT const EVP_MD *EVP_MD_CTX_md(const EVP_MD_CTX *ctx);
+
+// EVP_MD_CTX_size returns the digest size of |ctx|, in bytes. It
+// will crash if a digest hasn't been set on |ctx|.
+OPENSSL_EXPORT size_t EVP_MD_CTX_size(const EVP_MD_CTX *ctx);
+
+// EVP_MD_CTX_block_size returns the block size of the digest function used by
+// |ctx|, in bytes. It will crash if a digest hasn't been set on |ctx|.
+OPENSSL_EXPORT size_t EVP_MD_CTX_block_size(const EVP_MD_CTX *ctx);
+
+// EVP_MD_CTX_type returns a NID describing the digest function used by |ctx|.
+// (For example, |NID_sha256|.) It will crash if a digest hasn't been set on
+// |ctx|.
+OPENSSL_EXPORT int EVP_MD_CTX_type(const EVP_MD_CTX *ctx);
+
+
// ASN.1 functions.
//
// These functions allow code to parse and serialize AlgorithmIdentifiers for
@@ -238,25 +262,11 @@
// interface will always fail.
OPENSSL_EXPORT const EVP_MD *EVP_dss1(void);
+// EVP_MD_CTX_create calls |EVP_MD_CTX_new|.
+OPENSSL_EXPORT EVP_MD_CTX *EVP_MD_CTX_create(void);
-// Digest operation accessors.
-
-// EVP_MD_CTX_md returns the underlying digest function, or NULL if one has not
-// been set.
-OPENSSL_EXPORT const EVP_MD *EVP_MD_CTX_md(const EVP_MD_CTX *ctx);
-
-// EVP_MD_CTX_size returns the digest size of |ctx|, in bytes. It
-// will crash if a digest hasn't been set on |ctx|.
-OPENSSL_EXPORT size_t EVP_MD_CTX_size(const EVP_MD_CTX *ctx);
-
-// EVP_MD_CTX_block_size returns the block size of the digest function used by
-// |ctx|, in bytes. It will crash if a digest hasn't been set on |ctx|.
-OPENSSL_EXPORT size_t EVP_MD_CTX_block_size(const EVP_MD_CTX *ctx);
-
-// EVP_MD_CTX_type returns a NID describing the digest function used by |ctx|.
-// (For example, |NID_sha256|.) It will crash if a digest hasn't been set on
-// |ctx|.
-OPENSSL_EXPORT int EVP_MD_CTX_type(const EVP_MD_CTX *ctx);
+// EVP_MD_CTX_destroy calls |EVP_MD_CTX_free|.
+OPENSSL_EXPORT void EVP_MD_CTX_destroy(EVP_MD_CTX *ctx);
struct evp_md_pctx_ops;
@@ -286,7 +296,7 @@
namespace bssl {
-BORINGSSL_MAKE_DELETER(EVP_MD_CTX, EVP_MD_CTX_destroy)
+BORINGSSL_MAKE_DELETER(EVP_MD_CTX, EVP_MD_CTX_free)
using ScopedEVP_MD_CTX =
internal::StackAllocated<EVP_MD_CTX, int, EVP_MD_CTX_init,
