build BUGFIX retain support for older OpenSSL

But display a warning.
Fixes #338

Author: michalvasko

CMakeLists.txt

@@ -223,9 +223,12 @@ check_function_exists(pthread_rwlockattr_setkind_np HAVE_PTHREAD_RWLOCKATTR_SETK
 if(ENABLE_TLS OR ENABLE_DNSSEC OR ENABLE_SSH)
     find_package(OpenSSL REQUIRED)
     if(ENABLE_TLS)
-        message(STATUS "OPENSSL found, required for TLS")
+        message(STATUS "OpenSSL found, required for TLS")
         set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DNC_ENABLED_TLS")
     endif()
+    if(OPENSSL_VERSION VERSION_LESS 1.1.1)
+        message(WARNING "OpenSSL version ${OPENSSL_VERSION} is no longer maintained, consider an update.")
+    endif()
 
     target_link_libraries(netconf2 ${OPENSSL_LIBRARIES})
     include_directories(${OPENSSL_INCLUDE_DIR})

src/session_client_tls.c

@@ -637,11 +637,13 @@ nc_connect_tls(const char *host, unsigned short port, struct ly_ctx *ctx)
     /* set the SSL_MODE_AUTO_RETRY flag to allow OpenSSL perform re-handshake automatically */
     SSL_set_mode(session->ti.tls, SSL_MODE_AUTO_RETRY);
 
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L // >= 1.1.0
     /* server identity (hostname) verification */
     if (!SSL_set1_host(session->ti.tls, host)) {
         ERR(NULL, "Failed to set expected server hostname.");
         goto fail;
     }
+#endif
 
     /* connect and perform the handshake */
     nc_gettimespec_mono(&ts_timeout);
@@ -675,8 +677,13 @@ nc_connect_tls(const char *host, unsigned short port, struct ly_ctx *ctx)
     verify = SSL_get_verify_result(session->ti.tls);
     switch (verify) {
     case X509_V_OK:
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L // >= 1.1.0
         peername = SSL_get0_peername(session->ti.tls);
         VRB(NULL, "Server certificate successfully verified (domain \"%s\").", peername ? peername : "<unknown>");
+#else
+        (void)peername;
+        VRB(NULL, "Server certificate successfully verified.");
+#endif
         break;
     default:
         WRN(NULL, "Server certificate verification problem (%s).", X509_verify_cert_error_string(verify));