From: Ken Hornstein <kenh@pobox.com>
Date: Wed, 2 Nov 2016 14:45:16 +0000 (-0400)
Subject: Add some Autoconf support for older OpenSSL libraries that don't support
X-Git-Url: https://diplodocus.org/git/nmh/commitdiff_plain/d587c35d34fa72b933314771b019e6a45fb6e64d

Add some Autoconf support for older OpenSSL libraries that don't support
hostname verification.
---

diff --git a/configure.ac b/configure.ac
index 86d95f42..ba77a442 100644
--- a/configure.ac
+++ b/configure.ac
@@ -509,7 +509,11 @@ AS_IF([test "x$with_tls" = xyes && test "x$HAVE_SSL_H" = x],
       [test "x$with_tls" != xno && test "x$HAVE_SSL_H" = x1 && test "x$TLSLIB" != x],
       [AC_DEFINE([TLS_SUPPORT], [1], [Support TLS for session encryption.])
        TLS_SUPPORT=1
-       tls_support=yes])
+       tls_support=yes
+       save_LIBS="$LIBS"
+       LIBS="$LIBS $TLSLIB"
+       AC_CHECK_FUNCS([X509_VERIFY_PARAM_set1_host])
+       LIBS="$save_LIBS"])
 
 dnl -----------------
 dnl CHECK FOR CURL
diff --git a/sbr/netsec.c b/sbr/netsec.c
index b8806a17..e8f8901f 100644
--- a/sbr/netsec.c
+++ b/sbr/netsec.c
@@ -1543,7 +1543,9 @@ netsec_set_tls(netsec_context *nsc, int tls, int noverify, char **errstr)
 	 */
 
 	if (! noverify) {
+#ifdef HAVE_X509_VERIFY_PARAM_SET1_HOST
 	    X509_VERIFY_PARAM *param;
+#endif /* HAVE_X509_VERIFY_PARAM_SET1_HOST */
 
 	    SSL_set_verify(ssl, SSL_VERIFY_PEER, NULL);
 	    if (! nsc->ns_hostname) {
@@ -1553,6 +1555,7 @@ netsec_set_tls(netsec_context *nsc, int tls, int noverify, char **errstr)
 		return NOTOK;
 	    }
 
+#ifdef HAVE_X509_VERIFY_PARAM_SET1_HOST
 	    param = SSL_get0_param(ssl);
 
 	    if (! X509_VERIFY_PARAM_set1_host(param, nsc->ns_hostname, 0)) {
@@ -1562,6 +1565,7 @@ netsec_set_tls(netsec_context *nsc, int tls, int noverify, char **errstr)
 		SSL_free(ssl);
 		return NOTOK;
 	    }
+#endif /* HAVE_X509_VERIFY_PARAM_SET1_HOST */
 	}
 
 	ssl_bio = BIO_new(BIO_f_ssl());