Skip to content

Disable OpenSSL version check #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jgoerzen wants to merge 1 commit into
base: main
Choose a base branch
from
+0 −76
Open

Disable OpenSSL version check #14

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
76 changes: 0 additions & 76 deletions ck_ssl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1529,82 +1529,6 @@ ssl_once_init()
debug(F110,"OpenSSL Library",SSLeay_version(SSLEAY_CFLAGS),0);
debug(F110,"OpenSSL Library",SSLeay_version(SSLEAY_PLATFORM),0);

/* The following test is suggested by Richard Levitte */
/* if (((OPENSSL_VERSION_NUMBER ^ SSLeay()) & 0xffffff0f) */
/* Modified by Adam Friedlander for OpenSSL >= 1.0.0 */
if (OPENSSL_VERSION_NUMBER > SSLeay()
|| ((OPENSSL_VERSION_NUMBER ^ SSLeay()) & COMPAT_VERSION_MASK)
#ifdef OS2
/* DG 2024-08-05: Not sure what the point of this was. Presumably the goal was

@jaltman jaltman Nov 19, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@davidrg The problem on both OS2 and Windows is that OpenSSL DLLs are built and distributed as part of many applications. Whichever one is found in the PATH first will be loaded unless there is some binding between the application and the associated DLLs. Windows introduced the concept of an assembly to work around this problem.

If the wrong version of OpenSSL DLLs were loaded, then the process could crash.

@jaltman jaltman Nov 19, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The requirement is not specific to SSH because OpenSSL libraries are used for TELNET START_TLS and TELNET ENCRYPT options as well.

@jaltman jaltman Nov 19, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The block of comments in ck_ssl.c from line 1500 explain when and why the checks are required.
If the ABI guarantees have changed for major version 3, then the comment block should be updated to explain the changes and the version check should be modified to accept the new guarantees when the major version is 3.

* to prevent updated OpenSSL libraries from being used, though why you'd
* want to do that I'm not sure. Might have been to do with how Kermit 95s
* SSH code was built way back in the early 2000s I guess. Today Kermit 95s
* use of OpenSSL is largely the same as how C-Kermit uses it on other
* platforms so I don't see any reason to treat it differently here.
|| ckstrcmp(OPENSSL_VERSION_TEXT,(char *)SSLeay_version(SSLEAY_VERSION),-1,1)
*/
#endif /* OS2 */
) {
ssl_installed = 0;
debug(F111,"OpenSSL Version does not match. Built with",
SSLeay_version(SSLEAY_VERSION),SSLEAY_VERSION_NUMBER);
printf("?OpenSSL libraries do not match required version:\r\n");
printf(" . C-Kermit built with %s\r\n",OPENSSL_VERSION_TEXT);
printf(" . Version found %s\r\n",SSLeay_version(SSLEAY_VERSION));
#ifdef OPENSSL_100
printf(" OpenSSL versions 1.0.0 or newer must be the same\r\n");
printf(" major and minor version number, and Kermit may not\r\n");
printf(" be used with a version of OpenSSL older than the one\r\n");
printf(" supplied at compile time.\r\n");
#else
printf(" OpenSSL versions prior to 1.0.0 must be the same.\r\n");
#endif /* OPENSSL_100 */

s = "R";
#ifdef SOLARIS
printf(" Set CD_LIBRARY_PATH for %s.\r\n",OPENSSL_VERSION_TEXT);
s = " Or r";
#endif /* SOLARIS */

#ifdef HPUX
printf(" Set SHLIB_PATH for %s.\r\n",OPENSSL_VERSION_TEXT);
s = " Or r";
#endif /* HPUX */

#ifdef AIX
printf(" Set LIBPATH for %s.\r\n",OPENSSL_VERSION_TEXT);
s = " Or r";
#endif /* AIX */

#ifdef LINUX
printf(" Set LD_LIBRARY_PATH for %s.\r\n",OPENSSL_VERSION_TEXT);
s = " Or r";
#endif /* LINUX */

printf(" %sebuild C-Kermit from source on this computer to make \
versions agree.\r\n",s);

#ifdef KTARGET
{
char * s;
s = KTARGET;
if (!s) s = "";
if (!*s) s = "(unknown)";
printf(" C-Kermit makefile target: %s\r\n",s);
}
#endif /* KTARGET */
printf(" Or if that is what you did then try to find out why\r\n");
printf(" the program loader (image activator) is choosing a\r\n");
printf(" different OpenSSL library than the one specified in \
the build.\r\n\r\n");
printf(" All SSL/TLS features disabled.\r\n\r\n");
bleep(BP_FAIL);
#ifdef SSLDLL
ck_ssl_unloaddll();
ck_crypto_unloaddll();
#endif /* SSLDLL */
return;
}
#endif /* OS2ONLY */

/* init things so we will get meaningful error messages
Expand Down