Add some Autoconf support for older OpenSSL libraries that don't support

hostname verification.

diff --git a/configure.ac b/configure.ac
index 86d95f4..ba77a44 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -509,7 +509,11 @@ AS_IF([test "x$with_tls" = xyes && test "x$HAVE_SSL_H" = x],
       [test "x$with_tls" != xno && test "x$HAVE_SSL_H" = x1 && test "x$TLSLIB" != x],
       [AC_DEFINE([TLS_SUPPORT], [1], [Support TLS for session encryption.])
        TLS_SUPPORT=1
-       tls_support=yes])
+       tls_support=yes
+       save_LIBS="$LIBS"
+       LIBS="$LIBS $TLSLIB"
+       AC_CHECK_FUNCS([X509_VERIFY_PARAM_set1_host])
+       LIBS="$save_LIBS"])
 
 dnl -----------------
 dnl CHECK FOR CURL

diff --git a/sbr/netsec.c b/sbr/netsec.c
index b8806a1..e8f8901 100644 (file)
--- a/sbr/netsec.c
+++ b/sbr/netsec.c
@@ -1543,7 +1543,9 @@ netsec_set_tls(netsec_context *nsc, int tls, int noverify, char **errstr)
         */
 
        if (! noverify) {
+#ifdef HAVE_X509_VERIFY_PARAM_SET1_HOST
            X509_VERIFY_PARAM *param;
+#endif /* HAVE_X509_VERIFY_PARAM_SET1_HOST */
 
            SSL_set_verify(ssl, SSL_VERIFY_PEER, NULL);
            if (! nsc->ns_hostname) {
@@ -1553,6 +1555,7 @@ netsec_set_tls(netsec_context *nsc, int tls, int noverify, char **errstr)
                return NOTOK;
            }
 
+#ifdef HAVE_X509_VERIFY_PARAM_SET1_HOST
            param = SSL_get0_param(ssl);
 
            if (! X509_VERIFY_PARAM_set1_host(param, nsc->ns_hostname, 0)) {
@@ -1562,6 +1565,7 @@ netsec_set_tls(netsec_context *nsc, int tls, int noverify, char **errstr)
                SSL_free(ssl);
                return NOTOK;
            }
+#endif /* HAVE_X509_VERIFY_PARAM_SET1_HOST */
        }
 
        ssl_bio = BIO_new(BIO_f_ssl());