OPENSSL_API_COMPAT is not defined by OpenSSL 3.0

[ydroneaud]

With OpenSSL 3.0, it's really up to the application to define OPENSSL_API_COMPAT, and when compiling tcpdump, OPENSSL_API_COMPAT is not defined, thus the check in esp_init() is incorrect:

#if !defined(OPENSSL_API_COMPAT) || OPENSSL_API_COMPAT < 0x10100000L
        OpenSSL_add_all_algorithms();
#endif

tcpdump/print-esp.c

Line 683 in 9ff9f78

OpenSSL_add_all_algorithms();

When compiled against OpenSSL 3.0.1 built with --api=1.1.1 and no-deprecated configuration options, OpenSSL_add_all_algorithms() is not defined, and build fail:

./print-esp.c: In function 'esp_init':
./print-esp.c:682:2: warning: implicit declaration of function 'OpenSSL_add_all_algorithms' [-Wimplicit-function-declaration]
  OpenSSL_add_all_algorithms();
  ^
libnetdissect.a(print-esp.o): In function `esp_init':
.../print-esp.c:682: undefined reference to `OpenSSL_add_all_algorithms'
collect2: error: ld returned 1 exit status

[DimitriPapadopoulos]

The whole code looks like this:

tcpdump/print-esp.c

Lines 674 to 687 in 9ff9f78

	DIAG_OFF_DEPRECATION
	static void esp_init(netdissect_options *ndo _U_)
	{
	/*
	* 0.9.6 doesn't appear to define OPENSSL_API_COMPAT, so
	* we check whether it's undefined or it's less than the
	* value for 1.1.0.
	*/
	#if !defined(OPENSSL_API_COMPAT) || OPENSSL_API_COMPAT < 0x10100000L
	OpenSSL_add_all_algorithms();
	#endif
	EVP_add_cipher_alias(SN_des_ede3_cbc, "3des");
	}
	DIAG_ON_DEPRECATION

Given that OpenSSL 1.0.2 is no longer supported except with paid support contracts (Release Strategy), is it worth still maintaining this #if?

Also, the OpenSSL_add_all_algorithms man page, versions 1.1 and newer, reads:

HISTORY

The OpenSSL_add_all_algorithms(), OpenSSL_add_all_ciphers(), OpenSSL_add_all_digests(), and EVP_cleanup(), functions were deprecated in OpenSSL 1.1.0 by OPENSSL_init_crypto() and should not be used.

[infrastation]

Solaris CBE: OpenSSL 1.0.2za 24 Aug 2021

[DimitriPapadopoulos]

Indeed. Then isn't #980 the proper solution?