PHPC-2545: Drop support for compiling with LibreSSL

alcaeus · alcaeus · commit 0378a6eccba1 · 2025-05-26T15:37:14.000+02:00
diff --git a/bin/package.xml.in b/bin/package.xml.in
@@ -76,7 +76,7 @@ necessary to build a fully-functional MongoDB driver.
   <configureoption name="with-mongodb-zlib"                    prompt="Enable zlib for compression? (auto/system/bundled/no)"                       default="auto" />
   <configureoption name="with-mongodb-zstd"                    prompt="Enable zstd for compression? (auto/yes/no)"                                  default="auto" />
   <configureoption name="with-mongodb-sasl"                    prompt="Enable SASL for Kerberos authentication? (auto/cyrus/no)"                    default="auto" />
-  <configureoption name="with-mongodb-ssl"                     prompt="Enable crypto and TLS? (auto/openssl/libressl/darwin/no)"                    default="auto" />
+  <configureoption name="with-mongodb-ssl"                     prompt="Enable crypto and TLS? (auto/openssl/darwin/no)"                             default="auto" />
   <configureoption name="enable-mongodb-crypto-system-profile" prompt="Use system crypto profile (OpenSSL only)? (yes/no)"                          default="no" />
   <configureoption name="with-mongodb-utf8proc"                prompt="Use bundled or system utf8proc for SCRAM-SHA-256 SASLprep? (bundled/system)" default="bundled" />
  </extsrcrelease>
diff --git a/composer.json b/composer.json
@@ -61,7 +61,7 @@
       },
       {
         "name": "with-mongodb-ssl",
-        "description": "Enable crypto and TLS (auto/openssl/libressl/darwin/no)",
+        "description": "Enable crypto and TLS (auto/openssl/darwin/no)",
         "needs-value": true
       },
       {
diff --git a/config.w32 b/config.w32
@@ -161,7 +161,6 @@ if (PHP_MONGODB != "no") {
     // Secure Transport does not apply to Windows
     MONGOC_ENABLE_SSL_SECURE_TRANSPORT: 0,
     MONGOC_ENABLE_CRYPTO_COMMON_CRYPTO: 0,
-    MONGOC_ENABLE_SSL_LIBRESSL: 0,
     MONGOC_ENABLE_SSL_OPENSSL: 0,
     MONGOC_ENABLE_CRYPTO_LIBCRYPTO: 0,
     MONGOC_ENABLE_SSL: 0,
diff --git a/php_phongo.c b/php_phongo.c
@@ -408,8 +408,6 @@ PHP_MINFO_FUNCTION(mongodb) /* {{{ */
 	php_info_print_table_row(2, "libmongoc SSL", "enabled");
 #if defined(MONGOC_ENABLE_SSL_OPENSSL)
 	php_info_print_table_row(2, "libmongoc SSL library", "OpenSSL");
-#elif defined(MONGOC_ENABLE_SSL_LIBRESSL)
-	php_info_print_table_row(2, "libmongoc SSL library", "LibreSSL");
 #elif defined(MONGOC_ENABLE_SSL_SECURE_TRANSPORT)
 	php_info_print_table_row(2, "libmongoc SSL library", "Secure Transport");
 #elif defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)
diff --git a/scripts/autotools/libmongoc/CheckSSL.m4 b/scripts/autotools/libmongoc/CheckSSL.m4
@@ -1,6 +1,6 @@
 PHP_ARG_WITH([mongodb-ssl],
              [whether to enable crypto and TLS],
-             [AS_HELP_STRING([--with-mongodb-ssl=@<:@auto/openssl/libressl/darwin/no@:>@],
+             [AS_HELP_STRING([--with-mongodb-ssl=@<:@auto/openssl/darwin/no@:>@],
                              [MongoDB: Enable TLS connections and SCRAM-SHA-1 authentication [default=auto]])],
              [auto],
              [no])
@@ -130,38 +130,6 @@ AS_IF([test "$PHP_MONGODB_SSL" = "darwin" -o \( "$PHP_MONGODB_SSL" = "auto" -a "
   PHP_MONGODB_SSL="darwin"
 ])
 
-AS_IF([test "$PHP_MONGODB_SSL" = "libressl" -o "$PHP_MONGODB_SSL" = "auto"],[
-  found_libressl="no"
-
-  PKG_CHECK_MODULES([PHP_MONGODB_SSL],[libtls libcrypto],[
-    PHP_MONGODB_BUNDLED_CFLAGS="$PHP_MONGODB_BUNDLED_CFLAGS $PHP_MONGODB_SSL_CFLAGS"
-    PHP_EVAL_LIBLINE([$PHP_MONGODB_SSL_LIBS],[MONGODB_SHARED_LIBADD])
-    PHP_MONGODB_SSL="libressl"
-    found_libressl="yes"
-  ],[
-    PHP_CHECK_LIBRARY([crypto],
-                      [EVP_DigestInit_ex],
-                      [have_crypto_lib="yes"],
-                      [have_crypto_lib="no"])
-    PHP_CHECK_LIBRARY([tls],
-                      [tls_init],
-                      [have_ssl_lib="yes"],
-                      [have_ssl_lib="no"],
-                      [-lcrypto])
-
-    if test "$have_ssl_lib" = "yes" -a "$have_crypto_lib" = "yes"; then
-      PHP_ADD_LIBRARY([tls],,[MONGODB_SHARED_LIBADD])
-      PHP_ADD_LIBRARY([crypto],,[MONGODB_SHARED_LIBADD])
-      PHP_MONGODB_SSL="libressl"
-      found_libressl="yes"
-    fi
-  ])
-
-  if test "$PHP_MONGODB_SSL" = "libressl" -a "$found_libressl" != "yes"; then
-    AC_MSG_ERROR([LibreSSL libraries and development headers could not be found])
-  fi
-])
-
 AS_IF([test "$PHP_MONGODB_SSL" = "auto"],[
   if test "$crypto_required" = "yes"; then
     AC_MSG_ERROR([crypto and TLS libraries not found])
@@ -177,28 +145,18 @@ AC_SUBST(MONGOC_ENABLE_SSL_SECURE_CHANNEL, 0)
 AC_SUBST(MONGOC_ENABLE_CRYPTO_CNG, 0)
 AC_SUBST(MONGOC_HAVE_BCRYPT_PBKDF2, 0)
 
-if test "$PHP_MONGODB_SSL" = "openssl" -o "$PHP_MONGODB_SSL" = "libressl" -o "$PHP_MONGODB_SSL" = "darwin"; then
+if test "$PHP_MONGODB_SSL" = "openssl" -o "$PHP_MONGODB_SSL" = "darwin"; then
   AC_SUBST(MONGOC_ENABLE_SSL, 1)
   AC_SUBST(MONGOC_ENABLE_CRYPTO, 1)
   if test "$PHP_MONGODB_SSL" = "darwin"; then
     AC_SUBST(MONGOC_ENABLE_SSL_OPENSSL, 0)
-    AC_SUBST(MONGOC_ENABLE_SSL_LIBRESSL, 0)
     AC_SUBST(MONGOC_ENABLE_SSL_SECURE_TRANSPORT, 1)
     AC_SUBST(MONGOC_ENABLE_CRYPTO_LIBCRYPTO, 0)
     AC_SUBST(MONGOC_ENABLE_CRYPTO_COMMON_CRYPTO, 1)
 
     PHP_MONGODB_BUNDLED_CFLAGS="$PHP_MONGODB_BUNDLED_CFLAGS -DKMS_MESSAGE_ENABLE_CRYPTO=1 -DKMS_MESSAGE_ENABLE_CRYPTO_COMMON_CRYPTO=1"
   elif test "$PHP_MONGODB_SSL" = "openssl"; then
     AC_SUBST(MONGOC_ENABLE_SSL_OPENSSL, 1)
-    AC_SUBST(MONGOC_ENABLE_SSL_LIBRESSL, 0)
-    AC_SUBST(MONGOC_ENABLE_SSL_SECURE_TRANSPORT, 0)
-    AC_SUBST(MONGOC_ENABLE_CRYPTO_LIBCRYPTO, 1)
-    AC_SUBST(MONGOC_ENABLE_CRYPTO_COMMON_CRYPTO, 0)
-
-    PHP_MONGODB_BUNDLED_CFLAGS="$PHP_MONGODB_BUNDLED_CFLAGS -DKMS_MESSAGE_ENABLE_CRYPTO=1 -DKMS_MESSAGE_ENABLE_CRYPTO_LIBCRYPTO=1"
-  elif test "$PHP_MONGODB_SSL" = "libressl"; then
-    AC_SUBST(MONGOC_ENABLE_SSL_OPENSSL, 0)
-    AC_SUBST(MONGOC_ENABLE_SSL_LIBRESSL, 1)
     AC_SUBST(MONGOC_ENABLE_SSL_SECURE_TRANSPORT, 0)
     AC_SUBST(MONGOC_ENABLE_CRYPTO_LIBCRYPTO, 1)
     AC_SUBST(MONGOC_ENABLE_CRYPTO_COMMON_CRYPTO, 0)
@@ -207,7 +165,6 @@ if test "$PHP_MONGODB_SSL" = "openssl" -o "$PHP_MONGODB_SSL" = "libressl" -o "$P
   fi
 else
   AC_SUBST(MONGOC_ENABLE_SSL, 0)
-  AC_SUBST(MONGOC_ENABLE_SSL_LIBRESSL, 0)
   AC_SUBST(MONGOC_ENABLE_SSL_OPENSSL, 0)
   AC_SUBST(MONGOC_ENABLE_SSL_SECURE_TRANSPORT, 0)
   AC_SUBST(MONGOC_ENABLE_CRYPTO, 0)
diff --git a/scripts/autotools/libmongocrypt/CheckSSL.m4 b/scripts/autotools/libmongocrypt/CheckSSL.m4
@@ -11,7 +11,7 @@ if test "$PHP_MONGODB_CLIENT_SIDE_ENCRYPTION" != "no"; then
     AC_SUBST(MONGOCRYPT_ENABLE_CRYPTO, 1)
     AC_SUBST(MONGOCRYPT_ENABLE_CRYPTO_LIBCRYPTO, 0)
     AC_SUBST(MONGOCRYPT_ENABLE_CRYPTO_COMMON_CRYPTO, 1)
-  elif test "$PHP_MONGODB_SSL" = "openssl" -o "$PHP_MONGODB_SSL" = "libressl"; then
+  elif test "$PHP_MONGODB_SSL" = "openssl"; then
     PHP_MONGODB_CLIENT_SIDE_ENCRYPTION="yes"
 
     AC_SUBST(MONGOCRYPT_ENABLE_CRYPTO, 1)
diff --git a/src/phongo_client.c b/src/phongo_client.c
@@ -708,9 +708,9 @@ static mongoc_ssl_opt_t* php_phongo_make_ssl_opt(mongoc_uri_t* uri, zval* driver
 	}
 #endif
 
-#if defined(MONGOC_ENABLE_SSL_LIBRESSL) || defined(MONGOC_ENABLE_SSL_SECURE_TRANSPORT)
+#if defined(MONGOC_ENABLE_SSL_SECURE_TRANSPORT)
 	if (php_array_existsc(driverOptions, "crl_file")) {
-		phongo_throw_exception(PHONGO_ERROR_INVALID_ARGUMENT, "\"crl_file\" option is not supported by LibreSSL and Secure Transport");
+		phongo_throw_exception(PHONGO_ERROR_INVALID_ARGUMENT, "\"crl_file\" option is not supported by Secure Transport");
 		return NULL;
 	}
 #endif
diff --git a/tests/manager/manager-ctor-ssl-003.phpt b/tests/manager/manager-ctor-ssl-003.phpt
@@ -2,7 +2,7 @@
 MongoDB\Driver\Manager::__construct(): Specifying a driver option implicitly enables TLS
 --SKIPIF--
 <?php require __DIR__ . "/../utils/basic-skipif.inc"; ?>
-<?php skip_if_not_libmongoc_ssl(['OpenSSL', 'LibreSSL']); ?>
+<?php skip_if_not_libmongoc_ssl(['OpenSSL']); ?>
 <?php skip_if_ssl(); ?>
 <?php skip_if_not_live(); ?>
 --FILE--
diff --git a/tests/utils/skipif.php b/tests/utils/skipif.php
@@ -375,8 +375,8 @@ function skip_if_not_libmongoc_crypto(array $libs = [])
  * Skips the test if libmongoc does not support SSL.
  *
  * If one or more libaries are provided, additionally check that the reported
- * library is in that array. Possible values are "OpenSSL", "LibreSSL",
- * "Secure Transport", and "Secure Channel".
+ * library is in that array. Possible values are "OpenSSL", "Secure Transport",
+ * and "Secure Channel".
  *
  * @param array $libs Optional list of SSL libraries to require
  */

Original file line number	Diff line number	Diff line change
`@@ -61,7 +61,7 @@`
`61`	`61`	`},`
`62`	`62`	`{`
`63`	`63`	`"name": "with-mongodb-ssl",`
`64`		`- "description": "Enable crypto and TLS (auto/openssl/libressl/darwin/no)",`
	`64`	`+ "description": "Enable crypto and TLS (auto/openssl/darwin/no)",`
`65`	`65`	`"needs-value": true`
`66`	`66`	`},`
`67`	`67`	`{`
Original file line number	Diff line number	Diff line change
`@@ -708,9 +708,9 @@ static mongoc_ssl_opt_t* php_phongo_make_ssl_opt(mongoc_uri_t* uri, zval* driver`
`708`	`708`	`}`
`709`	`709`	`#endif`
`710`	`710`
`711`		`-#if defined(MONGOC_ENABLE_SSL_LIBRESSL) \|\| defined(MONGOC_ENABLE_SSL_SECURE_TRANSPORT)`
	`711`	`+#if defined(MONGOC_ENABLE_SSL_SECURE_TRANSPORT)`
`712`	`712`	`if (php_array_existsc(driverOptions, "crl_file")) {`
`713`		`- phongo_throw_exception(PHONGO_ERROR_INVALID_ARGUMENT, "\"crl_file\" option is not supported by LibreSSL and Secure Transport");`
	`713`	`+ phongo_throw_exception(PHONGO_ERROR_INVALID_ARGUMENT, "\"crl_file\" option is not supported by Secure Transport");`
`714`	`714`	`return NULL;`
`715`	`715`	`}`
`716`	`716`	`#endif`
Original file line number	Diff line number	Diff line change
`@@ -375,8 +375,8 @@ function skip_if_not_libmongoc_crypto(array $libs = [])`
`375`	`375`	`* Skips the test if libmongoc does not support SSL.`
`376`	`376`	`*`
`377`	`377`	`* If one or more libaries are provided, additionally check that the reported`
`378`		`- * library is in that array. Possible values are "OpenSSL", "LibreSSL",`
`379`		`- * "Secure Transport", and "Secure Channel".`
	`378`	`+ * library is in that array. Possible values are "OpenSSL", "Secure Transport",`
	`379`	`+ * and "Secure Channel".`
`380`	`380`	`*`
`381`	`381`	`* @param array $libs Optional list of SSL libraries to require`
`382`	`382`	`*/`