Skip to content

Commit adfedd2

Browse files
alcaeusalcaeus
authored
PHPC-2545: Drop support for compiling with LibreSSL (#1836)
* PHPC-2545: Drop support for compiling with LibreSSL * Warn when explicitly building with libressl
1 parent 71510e2 commit adfedd2

File tree

9 files changed

+26
-64
lines changed

9 files changed

+26
-64
lines changed

‎bin/package.xml.in‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ necessary to build a fully-functional MongoDB driver.
7676
<configureoption name="with-mongodb-zlib" prompt="Enable zlib for compression? (auto/system/bundled/no)" default="auto" />
7777
<configureoption name="with-mongodb-zstd" prompt="Enable zstd for compression? (auto/yes/no)" default="auto" />
7878
<configureoption name="with-mongodb-sasl" prompt="Enable SASL for Kerberos authentication? (auto/cyrus/no)" default="auto" />
79-
<configureoption name="with-mongodb-ssl" prompt="Enable crypto and TLS? (auto/openssl/libressl/darwin/no)" default="auto" />
79+
<configureoption name="with-mongodb-ssl" prompt="Enable crypto and TLS? (auto/openssl/darwin/no)" default="auto" />
8080
<configureoption name="enable-mongodb-crypto-system-profile" prompt="Use system crypto profile (OpenSSL only)? (yes/no)" default="no" />
8181
<configureoption name="with-mongodb-utf8proc" prompt="Use bundled or system utf8proc for SCRAM-SHA-256 SASLprep? (bundled/system)" default="bundled" />
8282
</extsrcrelease>

‎composer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@
6161
},
6262
{
6363
"name": "with-mongodb-ssl",
64-
"description": "Enable crypto and TLS (auto/openssl/libressl/darwin/no)",
64+
"description": "Enable crypto and TLS (auto/openssl/darwin/no)",
6565
"needs-value": true
6666
},
6767
{

‎config.w32‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,6 @@ if (PHP_MONGODB != "no") {
161161
// Secure Transport does not apply to Windows
162162
MONGOC_ENABLE_SSL_SECURE_TRANSPORT: 0,
163163
MONGOC_ENABLE_CRYPTO_COMMON_CRYPTO: 0,
164-
MONGOC_ENABLE_SSL_LIBRESSL: 0,
165164
MONGOC_ENABLE_SSL_OPENSSL: 0,
166165
MONGOC_ENABLE_CRYPTO_LIBCRYPTO: 0,
167166
MONGOC_ENABLE_SSL: 0,

‎php_phongo.c‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -408,8 +408,6 @@ PHP_MINFO_FUNCTION(mongodb) /* {{{ */
408408
php_info_print_table_row(2, "libmongoc SSL", "enabled");
409409
#if defined(MONGOC_ENABLE_SSL_OPENSSL)
410410
php_info_print_table_row(2, "libmongoc SSL library", "OpenSSL");
411-
#elif defined(MONGOC_ENABLE_SSL_LIBRESSL)
412-
php_info_print_table_row(2, "libmongoc SSL library", "LibreSSL");
413411
#elif defined(MONGOC_ENABLE_SSL_SECURE_TRANSPORT)
414412
php_info_print_table_row(2, "libmongoc SSL library", "Secure Transport");
415413
#elif defined(MONGOC_ENABLE_SSL_SECURE_CHANNEL)

‎scripts/autotools/libmongoc/CheckSSL.m4‎

Lines changed: 18 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,32 @@
11
PHP_ARG_WITH([mongodb-ssl],
22
[whether to enable crypto and TLS],
3-
[AS_HELP_STRING([--with-mongodb-ssl=@<:@auto/openssl/libressl/darwin/no@:>@],
3+
[AS_HELP_STRING([--with-mongodb-ssl=@<:@auto/openssl/darwin/no@:>@],
44
[MongoDB: Enable TLS connections and SCRAM-SHA-1 authentication [default=auto]])],
55
[auto],
66
[no])
77

8+
dnl PHP_ARG_WITH without a value assigns "yes". Treat it like "auto" but
9+
dnl require a crypto library.
10+
if test "$PHP_MONGODB_SSL" = "yes"; then
11+
PHP_MONGODB_SSL="auto"
12+
fi
13+
14+
dnl TODO 3.0: Remove libressl from valid options
15+
PHP_MONGODB_VALIDATE_ARG([PHP_MONGODB_SSL], [auto openssl libressl darwin no])
16+
17+
if test "$PHP_MONGODB_SSL" = "libressl"; then
18+
dnl libressl is a valid option, but it is not supported by libmongoc
19+
dnl Warn users that it is not supported and treat it like "auto"
20+
PHP_MONGODB_SSL="auto"
21+
AC_MSG_WARN([Building with libressl is not supported by libmongoc. Falling back to "auto".])
22+
fi
23+
824
if test "$PHP_MONGODB_SSL" = "auto" -o "$PHP_MONGODB_SSL" = "no"; then
925
crypto_required="no"
1026
else
1127
crypto_required="yes"
12-
13-
dnl PHP_ARG_WITH without a value assigns "yes". Treat it like "auto" but
14-
dnl require a crypto library.
15-
if test "$PHP_MONGODB_SSL" = "yes"; then
16-
PHP_MONGODB_SSL="auto"
17-
fi
1828
fi
1929

20-
PHP_MONGODB_VALIDATE_ARG([PHP_MONGODB_SSL], [auto openssl libressl darwin no])
21-
2230
AS_IF([test "$PHP_MONGODB_SSL" = "openssl" -o "$PHP_MONGODB_SSL" = "auto"],[
2331
found_openssl="no"
2432
@@ -130,38 +138,6 @@ AS_IF([test "$PHP_MONGODB_SSL" = "darwin" -o \( "$PHP_MONGODB_SSL" = "auto" -a "
130138
PHP_MONGODB_SSL="darwin"
131139
])
132140

133-
AS_IF([test "$PHP_MONGODB_SSL" = "libressl" -o "$PHP_MONGODB_SSL" = "auto"],[
134-
found_libressl="no"
135-
136-
PKG_CHECK_MODULES([PHP_MONGODB_SSL],[libtls libcrypto],[
137-
PHP_MONGODB_BUNDLED_CFLAGS="$PHP_MONGODB_BUNDLED_CFLAGS $PHP_MONGODB_SSL_CFLAGS"
138-
PHP_EVAL_LIBLINE([$PHP_MONGODB_SSL_LIBS],[MONGODB_SHARED_LIBADD])
139-
PHP_MONGODB_SSL="libressl"
140-
found_libressl="yes"
141-
],[
142-
PHP_CHECK_LIBRARY([crypto],
143-
[EVP_DigestInit_ex],
144-
[have_crypto_lib="yes"],
145-
[have_crypto_lib="no"])
146-
PHP_CHECK_LIBRARY([tls],
147-
[tls_init],
148-
[have_ssl_lib="yes"],
149-
[have_ssl_lib="no"],
150-
[-lcrypto])
151-
152-
if test "$have_ssl_lib" = "yes" -a "$have_crypto_lib" = "yes"; then
153-
PHP_ADD_LIBRARY([tls],,[MONGODB_SHARED_LIBADD])
154-
PHP_ADD_LIBRARY([crypto],,[MONGODB_SHARED_LIBADD])
155-
PHP_MONGODB_SSL="libressl"
156-
found_libressl="yes"
157-
fi
158-
])
159-
160-
if test "$PHP_MONGODB_SSL" = "libressl" -a "$found_libressl" != "yes"; then
161-
AC_MSG_ERROR([LibreSSL libraries and development headers could not be found])
162-
fi
163-
])
164-
165141
AS_IF([test "$PHP_MONGODB_SSL" = "auto"],[
166142
if test "$crypto_required" = "yes"; then
167143
AC_MSG_ERROR([crypto and TLS libraries not found])
@@ -177,28 +153,18 @@ AC_SUBST(MONGOC_ENABLE_SSL_SECURE_CHANNEL, 0)
177153
AC_SUBST(MONGOC_ENABLE_CRYPTO_CNG, 0)
178154
AC_SUBST(MONGOC_HAVE_BCRYPT_PBKDF2, 0)
179155

180-
if test "$PHP_MONGODB_SSL" = "openssl" -o "$PHP_MONGODB_SSL" = "libressl" -o "$PHP_MONGODB_SSL" = "darwin"; then
156+
if test "$PHP_MONGODB_SSL" = "openssl" -o "$PHP_MONGODB_SSL" = "darwin"; then
181157
AC_SUBST(MONGOC_ENABLE_SSL, 1)
182158
AC_SUBST(MONGOC_ENABLE_CRYPTO, 1)
183159
if test "$PHP_MONGODB_SSL" = "darwin"; then
184160
AC_SUBST(MONGOC_ENABLE_SSL_OPENSSL, 0)
185-
AC_SUBST(MONGOC_ENABLE_SSL_LIBRESSL, 0)
186161
AC_SUBST(MONGOC_ENABLE_SSL_SECURE_TRANSPORT, 1)
187162
AC_SUBST(MONGOC_ENABLE_CRYPTO_LIBCRYPTO, 0)
188163
AC_SUBST(MONGOC_ENABLE_CRYPTO_COMMON_CRYPTO, 1)
189164

190165
PHP_MONGODB_BUNDLED_CFLAGS="$PHP_MONGODB_BUNDLED_CFLAGS -DKMS_MESSAGE_ENABLE_CRYPTO=1 -DKMS_MESSAGE_ENABLE_CRYPTO_COMMON_CRYPTO=1"
191166
elif test "$PHP_MONGODB_SSL" = "openssl"; then
192167
AC_SUBST(MONGOC_ENABLE_SSL_OPENSSL, 1)
193-
AC_SUBST(MONGOC_ENABLE_SSL_LIBRESSL, 0)
194-
AC_SUBST(MONGOC_ENABLE_SSL_SECURE_TRANSPORT, 0)
195-
AC_SUBST(MONGOC_ENABLE_CRYPTO_LIBCRYPTO, 1)
196-
AC_SUBST(MONGOC_ENABLE_CRYPTO_COMMON_CRYPTO, 0)
197-
198-
PHP_MONGODB_BUNDLED_CFLAGS="$PHP_MONGODB_BUNDLED_CFLAGS -DKMS_MESSAGE_ENABLE_CRYPTO=1 -DKMS_MESSAGE_ENABLE_CRYPTO_LIBCRYPTO=1"
199-
elif test "$PHP_MONGODB_SSL" = "libressl"; then
200-
AC_SUBST(MONGOC_ENABLE_SSL_OPENSSL, 0)
201-
AC_SUBST(MONGOC_ENABLE_SSL_LIBRESSL, 1)
202168
AC_SUBST(MONGOC_ENABLE_SSL_SECURE_TRANSPORT, 0)
203169
AC_SUBST(MONGOC_ENABLE_CRYPTO_LIBCRYPTO, 1)
204170
AC_SUBST(MONGOC_ENABLE_CRYPTO_COMMON_CRYPTO, 0)
@@ -207,7 +173,6 @@ if test "$PHP_MONGODB_SSL" = "openssl" -o "$PHP_MONGODB_SSL" = "libressl" -o "$P
207173
fi
208174
else
209175
AC_SUBST(MONGOC_ENABLE_SSL, 0)
210-
AC_SUBST(MONGOC_ENABLE_SSL_LIBRESSL, 0)
211176
AC_SUBST(MONGOC_ENABLE_SSL_OPENSSL, 0)
212177
AC_SUBST(MONGOC_ENABLE_SSL_SECURE_TRANSPORT, 0)
213178
AC_SUBST(MONGOC_ENABLE_CRYPTO, 0)

‎scripts/autotools/libmongocrypt/CheckSSL.m4‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ if test "$PHP_MONGODB_CLIENT_SIDE_ENCRYPTION" != "no"; then
1111
AC_SUBST(MONGOCRYPT_ENABLE_CRYPTO, 1)
1212
AC_SUBST(MONGOCRYPT_ENABLE_CRYPTO_LIBCRYPTO, 0)
1313
AC_SUBST(MONGOCRYPT_ENABLE_CRYPTO_COMMON_CRYPTO, 1)
14-
elif test "$PHP_MONGODB_SSL" = "openssl" -o "$PHP_MONGODB_SSL" = "libressl"; then
14+
elif test "$PHP_MONGODB_SSL" = "openssl"; then
1515
PHP_MONGODB_CLIENT_SIDE_ENCRYPTION="yes"
1616

1717
AC_SUBST(MONGOCRYPT_ENABLE_CRYPTO, 1)

‎src/phongo_client.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -708,9 +708,9 @@ static mongoc_ssl_opt_t* php_phongo_make_ssl_opt(mongoc_uri_t* uri, zval* driver
708708
}
709709
#endif
710710

711-
#if defined(MONGOC_ENABLE_SSL_LIBRESSL) || defined(MONGOC_ENABLE_SSL_SECURE_TRANSPORT)
711+
#if defined(MONGOC_ENABLE_SSL_SECURE_TRANSPORT)
712712
if (php_array_existsc(driverOptions, "crl_file")) {
713-
phongo_throw_exception(PHONGO_ERROR_INVALID_ARGUMENT, "\"crl_file\" option is not supported by LibreSSL and Secure Transport");
713+
phongo_throw_exception(PHONGO_ERROR_INVALID_ARGUMENT, "\"crl_file\" option is not supported by Secure Transport");
714714
return NULL;
715715
}
716716
#endif

‎tests/manager/manager-ctor-ssl-003.phpt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
MongoDB\Driver\Manager::__construct(): Specifying a driver option implicitly enables TLS
33
--SKIPIF--
44
<?php require __DIR__ . "/../utils/basic-skipif.inc"; ?>
5-
<?php skip_if_not_libmongoc_ssl(['OpenSSL', 'LibreSSL']); ?>
5+
<?php skip_if_not_libmongoc_ssl(['OpenSSL']); ?>
66
<?php skip_if_ssl(); ?>
77
<?php skip_if_not_live(); ?>
88
--FILE--

‎tests/utils/skipif.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -375,8 +375,8 @@ function skip_if_not_libmongoc_crypto(array $libs = [])
375375
* Skips the test if libmongoc does not support SSL.
376376
*
377377
* If one or more libaries are provided, additionally check that the reported
378-
* library is in that array. Possible values are "OpenSSL", "LibreSSL",
379-
* "Secure Transport", and "Secure Channel".
378+
* library is in that array. Possible values are "OpenSSL", "Secure Transport",
379+
* and "Secure Channel".
380380
*
381381
* @param array $libs Optional list of SSL libraries to require
382382
*/

0 commit comments

Comments
 (0)