Strongswan support openssl 3.0?

[duancanran]

Does strongswan support openssl 3.0?
When I complie the strongswan , I met some errors like this.
The strongswan's branch is master.

openssl_plugin.c:445:9: warning: ‘ENGINE_free’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
445 | ENGINE_free(engine);
| ^~~~~~~~~~~
In file included from openssl_plugin.c:29:
/usr/include/openssl/engine.h:493:27: note: declared here
493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e);

[tobiasbrunner]

Does strongswan support openssl 3.0?

Yes, but only since 5.9.6.

The strongswan's branch is master.

It most definitely is not. openssl_plugin.c hasn't contained an ENGINE_free() call since a8bab0e.

[duancanran]

Thanks.
But when I compile the master, I meet a new problem.
../../../../src/libstrongswan/credentials/certificates/crl.h:47:9: error: expected identifier before numeric constant
47 | CRL_REASON_UNSPECIFIED = 0,
Could you help me?

[tobiasbrunner]

No idea what you are doing wrong, but that file, in the current master, has #undefs for exactly this reason:

strongswan/src/libstrongswan/credentials/certificates/crl.h

Lines 33 to 44 in 7b453ae

	/* <wincrypt.h> comes with CRL_REASON clashing with ours. The same is true for
	* OpenSSL 3.0. Even if the values are identical, we undef them here to use our
	* enum instead of defines. */
	#ifdef CRL_REASON_UNSPECIFIED
	# undef CRL_REASON_UNSPECIFIED
	# undef CRL_REASON_KEY_COMPROMISE
	# undef CRL_REASON_CA_COMPROMISE
	# undef CRL_REASON_AFFILIATION_CHANGED
	# undef CRL_REASON_SUPERSEDED
	# undef CRL_REASON_CERTIFICATE_HOLD
	# undef CRL_REASON_REMOVE_FROM_CRL
	#endif

[pushkarhelge]

Hi @tobiasbrunner , I tried to compile strongswan(5.5.3) using OpenSSL 3.0 getting this issue:
dumping 28 stack frame addresses:

/lib/x86_64-linux-gnu/libc.so.6 @ 0x7f47519fc000 [0x7f4751a3e520]
->
/lib/x86_64-linux-gnu/libc.so.6 @ 0x7f47519fc000 [0x7f4751b997fd]
->
/lib/x86_64-linux-gnu/libc.so.6 @ 0x7f47519fc000 [0x7f4751a705ce]
->
/lib/x86_64-linux-gnu/libc.so.6 @ 0x7f47519fc000 [0x7f4751a71336]
->
/usr/lib/ipsec/libstrongswan.so.0 @ 0x7f4751cc6000 (print_in_hook+0xa6) [0x7f4751d0b176]
->
/usr/lib/ipsec/libstrongswan.so.0 @ 0x7f4751cc6000 (enum_printf_hook+0x70) [0x7f4751d0b210]
->
/usr/lib/ipsec/libstrongswan.so.0 @ 0x7f4751cc6000 [0x7f4751d0687f]
->
/lib/x86_64-linux-gnu/libc.so.6 @ 0x7f47519fc000 [0x7f4751a6fe83]
->
/lib/x86_64-linux-gnu/libc.so.6 @ 0x7f47519fc000 [0x7f4751a71336]
->
/lib/x86_64-linux-gnu/libc.so.6 @ 0x7f47519fc000 [0x7f4751a8449a]
->
/usr/lib/ipsec/libcharon.so.0 @ 0x7f4751c2a000 [0x7f4751c3be27]
->
/usr/lib/ipsec/libcharon.so.0 @ 0x7f4751c2a000 [0x7f4751c43576]
->
/usr/lib/ipsec/plugins/libstrongswan-kernel-netlink.so @ 0x7f475069c000 [0x7f47506a473c]
->
/usr/lib/ipsec/plugins/libstrongswan-kernel-netlink.so @ 0x7f475069c000 [0x7f47506a2483]
->
/usr/lib/ipsec/plugins/libstrongswan-kernel-netlink.so @ 0x7f475069c000 [0x7f47506a9dc9]
->
/usr/lib/ipsec/plugins/libstrongswan-kernel-netlink.so @ 0x7f475069c000 [0x7f47506a63c4]
->
/usr/lib/ipsec/plugins/libstrongswan-kernel-netlink.so @ 0x7f475069c000 [0x7f47506a6f38]
->
/usr/lib/ipsec/libcharon.so.0 @ 0x7f4751c2a000 [0x7f4751c96952]
->
/usr/lib/ipsec/libcharon.so.0 @ 0x7f4751c2a000 [0x7f4751c58db3]
->
/usr/lib/ipsec/libcharon.so.0 @ 0x7f4751c2a000 [0x7f4751c7051e]
->
/usr/lib/ipsec/libcharon.so.0 @ 0x7f4751c2a000 [0x7f4751c71208]
->
/usr/lib/ipsec/libcharon.so.0 @ 0x7f4751c2a000 [0x7f4751c6dd3d]
->
/usr/lib/ipsec/libcharon.so.0 @ 0x7f4751c2a000 [0x7f4751c5a520]
->
/usr/lib/ipsec/libcharon.so.0 @ 0x7f4751c2a000 [0x7f4751c54a2a]
->
/usr/lib/ipsec/libstrongswan.so.0 @ 0x7f4751cc6000 [0x7f4751d00921]
->
/usr/lib/ipsec/libstrongswan.so.0 @ 0x7f4751cc6000 [0x7f4751d07b08]
->
/lib/x86_64-linux-gnu/libc.so.6 @ 0x7f47519fc000 [0x7f4751a90ac3]
->
/lib/x86_64-linux-gnu/libc.so.6 @ 0x7f47519fc000 [0x7f4751b22850]
->

killing ourself, received critical signal

Is there a workaround or fix available for StrongSwan version 5.5.3 crashing when used with OpenSSL 3.0 on Ubuntu 22.04, considering support for OpenSSL 3.0 started from StrongSwan version 5.9.6?

[tobiasbrunner]

No idea. You an try to backport changes to the plugin from newer versions (and possibly other components), but you are on your own with this. Use a more recent version if you want support for OpenSSL 3 and a lot of other fixes and new features.

[a-gavin]

Experienced this exact issue when building on Fedora 36. After running yum update, the issue went away. I believe the issue was OpenSSL versions. See below:

# Pre update
$ dnf list --installed | grep openssl
openssl.x86_64                                 1:3.0.2-4.fc36                    @anaconda     
openssl-devel.x86_64                           1:3.0.2-4.fc36                    @fedora
openssl-libs.x86_64                            1:3.0.2-4.fc36                    @anaconda

# Post update
$ dnf list --installed | grep openssl
openssl.x86_64                                 1:3.0.8-1.fc36                    @updates              
openssl-devel.x86_64                           1:3.0.8-1.fc36                    @updates              
openssl-libs.x86_64                            1:3.0.8-1.fc36                    @updates