nginx-upload-module icon indicating copy to clipboard operation
nginx-upload-module copied to clipboard

`SHA*` functions are deprecated in OpenSSL 3.0

Open natefoo opened this issue 1 year ago • 0 comments

SHA*_Init(), SHA*_Update() and SHA*_Final() are deprecated in OpenSSL 3 (which ships in EL9) and are replaced by EVP_DigestInit_ex(), EVP_DigestUpdate(), and EVP_DigestFinal(). Although the old functions are still usable, if you compile with -Werror=deprecated-declarations, the build will fail:

upload-1.20.1/ngx_http_upload_module.c: In function 'ngx_http_upload_start_handler':
upload-1.20.1/ngx_http_upload_module.c:1525:13: error: 'SHA1_Init' is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
 1525 |             SHA1_Init(&u->sha1_ctx->sha1);
      |             ^~~~~~~~~
In file included from /usr/include/openssl/x509.h:41,
                 from /usr/include/openssl/ssl.h:32,
                 from src/event/ngx_event_openssl.h:15,
                 from src/core/ngx_core.h:84,
                 from upload-1.20.1/ngx_http_upload_module.c:7:
/usr/include/openssl/sha.h:49:27: note: declared here
   49 | OSSL_DEPRECATEDIN_3_0 int SHA1_Init(SHA_CTX *c);
      |                           ^~~~~~~~~

I have an openssl3 branch on my fork with an update to replace SHA* with EVP* that works, but did not create a PR because:

  1. it probably needs some preprocessor casing to retain the old behavior for old versions of OpenSSL, and
  2. it should probably allocate EVP_MD_CTX from the request pool rather than EVP_MD_CTX_new() and thus may leak memory if you actually use the $upload_file_sha* vars - I don't so was just interested in getting it to compile with the pkg-oss tooling.

But hopefully this gets it 95% of the way there for anyone else who runs in to the same problem and/or wants to pick this up.

natefoo avatar Nov 22 '24 21:11 natefoo