This is an old revision of the document!


EGD

FreeBSD has not needed the Perl Entropy Gathering Daemon WikiPedia article since FreeBSD 4.2 and no Operating System that is supported by a vendor needs it any longer. EGD was only necessary for some commercial UNIX systems, versions that needed it all reached end of life.

OS EGD needed until OS released End-of-support
IRIX 6.5.19 Feb 2003 Dec 2013
Solaris 2.6 Jul 1997 Jul 2006
AIX 5.2 Oct 2002 Apr 2009
Tru64 5.1B Sep 2002 Dec 2012
HP-UX 11i v2 Sep 2003 Dec 2015

Usually noticed as

undefined reference to 'RAND_egd'

in the compile output

Remove the offending part If the port has configure you can add a check in configure.(ac|m4)

AC_CHECK_LIB(crypto, RAND_egd, AC_DEFINE(HAVE_RAND_EGD, 1, [Define if the libcrypto has RAND_egd]))

regenerate configure using autotools and adding conditional macros to C/C++ programs

#ifdef HAVE_RAND_EGD
   RAND_egd("/some/file");
#endif

Deprecated des_ methods

OpenSSL has deprecated a large number of des_ methods and types on 24 October 2001(commit) and released this 30 December 2002 with OpenSSL 0.9.7.

LibreSSL removed des_old completely, and the next release of OpenSSL (1.0.3) has also removed these compatibility macros.

use of undeclared identifier 'des_cblock'; did you mean 'DES_cblock'?

  1. Rename the des_ method or type to DES_ (don't forget to change C_Block → DES_cblock)
  2. Adapt the variables passed to the method (DES_ structs need to be passed as pointers, prefix the variable with &)

The old compatibility macros can be found here

Example

des_key_schedule ks1;
des_cblock iv1;

des_ncbc_encrypt(src, dst, len, ks1, iv1, DES_DECRYPT);

Becomes

DES_key_schedule ks1;
DES_cblock iv1;

DES_ncbc_encrypt(src, dst, len, &ks1, &iv1, DES_DECRYPT);

Uses removed Compression

LibreSSL disabled compression by default because of the number of attacks that use compression (CRIME, BREACH, BEAST). LibreSSL does not include openssl/comp.h from openssl/ssl.h (and ssl3.h) leading to build failures
TLS v1.3 no longer supports compression (so just compress before encryption)

unknown type name 'COMP_METHOD' or SSL_get_current_compression

First of all try and add

#include <openssl/comp.h>

to the code or header. There's no risk of re-defining methods/types #ifndef HEADER_COMP_H

If the OpenSSL library has been compiled without support for compression it defines OPENSSL_NO_COMP yet LibreSSL defines in opensslfeatures.h SSL_NO_COMP

Remove offending code, preferably by using macros so this will still work with OpenSSL libs that do support compression

If the software has been created with care this will likely make the port just work when added in the right location

#include <openssl/opensslfeatures.h>
#include <openssl/comp.h>
#ifdef SSL_NO_COMP
#define OPENSSL_NO_COMP
#endif

If the software unconditionally relies on the existence of SSL compression you will need to add blocks of

#ifndef OPENSSL_NO_COMP
   /* Offending code */
#endif

SSLv2 failures

Check the SSLv2 disabled exp-run results in the Bugs database. Contains interesting examples of fixes as well!

  • libressl/patchingports.1426977348.txt.gz
  • Last modified: 2015/03/21 22:35
  • by BernardSpil