sfackler · Jan 16, 2023 · Jan 16, 2023 · Jan 16, 2023 · Feb 24, 2023 · Feb 24, 2023
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -59,6 +59,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
+      # Remember to also update `--rust-target` in `openssl-sys/build/run_bindgen.rs`
       - uses: sfackler/actions/rustup@master
         with:
           version: 1.56.0
@@ -153,7 +154,7 @@ jobs:
             - false
           library:
             - name: boringssl
-              version: 93e8d4463d59d671e9c5c6171226341f04b07907
+              version: bcecc7d834fc44ad257b2f23f88e1cf597ab2736
             - name: openssl
               version: vendored
             - name: openssl
@@ -181,7 +182,12 @@ jobs:
               bindgen: true
               library:
                 name: libressl
-                version: 3.7.1
+                version: 3.7.3
+            - target: x86_64-unknown-linux-gnu
+              bindgen: true
+              library:
+                name: libressl
+                version: 3.8.0
             - target: x86_64-unknown-linux-gnu
               bindgen: false
               library:
@@ -191,7 +197,12 @@ jobs:
               bindgen: false
               library:
                 name: libressl
-                version: 3.7.1
+                version: 3.7.3
+            - target: x86_64-unknown-linux-gnu
+              bindgen: false
+              library:
+                name: libressl
+                version: 3.8.0
       name: ${{ matrix.target }}-${{ matrix.library.name }}-${{ matrix.library.version }}-${{ matrix.bindgen }}
       runs-on: ubuntu-latest
       env:
@@ -310,7 +321,7 @@ jobs:
         - run: |
             mkdir -p .cargo
             echo '[patch.crates-io]' > .cargo/config.toml
-            echo 'bssl-sys = { path = "'$OPENSSL_DIR'/rust" }' >> .cargo/config.toml
+            echo 'bssl-sys = { path = "'$OPENSSL_DIR'/rust/bssl-sys" }' >> .cargo/config.toml
           if: matrix.library.name == 'boringssl' && !matrix.bindgen
         - uses: actions/cache@v3
           with:

diff --git a/openssl-macros/Cargo.toml b/openssl-macros/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "openssl-macros"
-version = "0.1.0"
+version = "0.1.1"
 edition = "2018"
 license = "MIT/Apache-2.0"
 description = "Internal macros used by the openssl crate."
@@ -11,4 +11,4 @@ proc-macro = true
 [dependencies]
 proc-macro2 = "1"
 quote = "1"
-syn = { version = "1", features = ["full"] }
+syn = { version = "2", features = ["full"] }
diff --git a/openssl-sys/CHANGELOG.md b/openssl-sys/CHANGELOG.md
@@ -2,6 +2,69 @@
 
 ## [Unreleased]
 
+## [v0.9.89] - 2023-06-20
+
+### Fixed
+
+* Fixed compilation with recent versions of BoringSSL.
+
+### Added
+
+* Added support for detecting OpenSSL compiled with `OPENSSL_NO_OCB`.
+* Added `EVP_PKEY_SM2` and `NID_sm2`.
+* Added `EVP_PKEY_assign_RSA`, `EVP_PKEY_assign_DSA`, `EVP_PKEY_assign_DH`, and `EVP_PKEY_assign_EC_KEY`.
+* Added `EC_GROUP_get_asn1_flag`.
+* Expose `EC_POINT_get_affine_coordinates` on BoringSSL and LibreSSL.
+* Added `EVP_PKEY_derive_set_peer_ex`.
+
+## [v0.9.88] - 2023-05-30
+
+### Added
+
+* Added support for the LibreSSL 3.8.0.
+* Added support for detecting `OPENSSL_NO_RC4`.
+* Added `OBJ_dup`.
+* Added `ASN1_TYPE_new`, `ASN1_TYPE_set`, `d2i_ASN1_TYPE`, and `i2d_ASN1_TYPE`.
+* Added `SSL_bytes_to_cipher_list`, `SSL_CTX_get_num_tickets`, and `SSL_get_num_tickets`.
+* Added `GENERAL_NAME_set0_othername`.
+* Added `X509_get_pathlen`.
+
+## [v0.9.87] - 2023-04-24
+
+### Added
+
+* Added `DH_CHECK`.
+* Added `CMAC_CTX_new`, `CMAC_CTX_free`, `CMAC_Init`, `CMAC_Update`, `CMAC_Final`, and `CMAC_CTX_copy`.
+* Added `EVP_default_properties_is_fips_enabled`.
+* Added `X509_get0_subject_key_id`, `X509_get0_authority_key_id`, `X509_get0_authority_issuer`, and `X509_get0_authority_serial`.
+* Added `NID_poly1305`.
+
+
+## [v0.9.86] - 2023-04-20
+
+### Fixed
+
+* Fixed BoringSSL support with the latest bindgen release.
+
+### Added
+
+* Added bindings for PKCS#7 functions and more X.509 functions.
+
+
+## [v0.9.85] - 2023-04-09
+
+### Added
+
+* Added support for LibreSSL 3.7.x.
+
+## [v0.9.84] - 2023-04-01
+
+### Added
+
+* Added `ASN1_INTEGER_dup` and `ASN1_INTEGER_cmp`.
+* Added `stack_st_X509_NAME_ENTRY`.
+* Added `DIST_POINT_NAME`, `DIST_POINT`, `stack_st_DIST_POINT`, `DIST_POINT_free`, and `DIST_POINT_NAME_free`.
+
 ## [v0.9.83] - 2023-03-23
 
 ### Fixed
@@ -410,7 +473,13 @@ Fixed builds against OpenSSL built with `no-cast`.
 * Added `X509_verify` and `X509_REQ_verify`.
 * Added `EVP_MD_type` and `EVP_GROUP_get_curve_name`.
 
-[Unreleased]: https://github.com/sfackler/rust-openssl/compare/openssl-sys-v0.9.83..master
+[Unreleased]: https://github.com/sfackler/rust-openssl/compare/openssl-sys-v0.9.89..master
+[v0.9.89]: https://github.com/sfackler/rust-openssl/compare/openssl-sys-v0.9.88...openssl-sys-v0.9.89
+[v0.9.88]: https://github.com/sfackler/rust-openssl/compare/openssl-sys-v0.9.87...openssl-sys-v0.9.88
+[v0.9.87]: https://github.com/sfackler/rust-openssl/compare/openssl-sys-v0.9.86...openssl-sys-v0.9.87
+[v0.9.86]: https://github.com/sfackler/rust-openssl/compare/openssl-sys-v0.9.85...openssl-sys-v0.9.86
+[v0.9.85]: https://github.com/sfackler/rust-openssl/compare/openssl-sys-v0.9.84...openssl-sys-v0.9.85
+[v0.9.84]: https://github.com/sfackler/rust-openssl/compare/openssl-sys-v0.9.83...openssl-sys-v0.9.84
 [v0.9.83]: https://github.com/sfackler/rust-openssl/compare/openssl-sys-v0.9.82...openssl-sys-v0.9.83
 [v0.9.82]: https://github.com/sfackler/rust-openssl/compare/openssl-sys-v0.9.81...openssl-sys-v0.9.82
 [v0.9.81]: https://github.com/sfackler/rust-openssl/compare/openssl-sys-v0.9.80...openssl-sys-v0.9.81

diff --git a/openssl-sys/Cargo.toml b/openssl-sys/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "openssl-sys"
-version = "0.9.83"
+version = "0.9.89"
 authors = [
     "Alex Crichton <alex@alexcrichton.com>",
     "Steven Fackler <sfackler@gmail.com>",
@@ -24,10 +24,9 @@ bssl-sys = { version = "0.1.0", optional = true }
 
 [build-dependencies]
 bindgen = { version = "0.64.0", optional = true, features = ["experimental"] }
-cc = "1.0"
+cc = "1.0.61"
 openssl-src = { version = "111", optional = true }
 pkg-config = "0.3.9"
-autocfg = "1.0"
 
 [target.'cfg(target_env = "msvc")'.build-dependencies]
 vcpkg = "0.2.8"

diff --git a/openssl-sys/build/cfgs.rs b/openssl-sys/build/cfgs.rs
@@ -1,3 +1,4 @@
+#[allow(clippy::unusual_byte_groupings)]
 pub fn get(openssl_version: Option<u64>, libressl_version: Option<u64>) -> Vec<&'static str> {
     let mut cfgs = vec![];
 
@@ -91,6 +92,9 @@ pub fn get(openssl_version: Option<u64>, libressl_version: Option<u64>) -> Vec<&
         if openssl_version >= 0x1_01_01_03_0 {
             cfgs.push("ossl111c");
         }
+        if openssl_version >= 0x1_01_01_04_0 {
+            cfgs.push("ossl111d");
+        }
     }
 
     cfgs

diff --git a/openssl-sys/build/expando.c b/openssl-sys/build/expando.c
@@ -75,10 +75,18 @@ RUST_CONF_OPENSSL_NO_NEXTPROTONEG
 RUST_CONF_OPENSSL_NO_OCSP
 #endif
 
+#ifdef OPENSSL_NO_OCB
+RUST_CONF_OPENSSL_NO_OCB
+#endif
+
 #ifdef OPENSSL_NO_PSK
 RUST_CONF_OPENSSL_NO_PSK
 #endif
 
+#ifdef OPENSSL_NO_RC4
+RUST_CONF_OPENSSL_NO_RC4
+#endif
+
 #ifdef OPENSSL_NO_RFC3779
 RUST_CONF_OPENSSL_NO_RFC3779
 #endif

diff --git a/openssl-sys/build/main.rs b/openssl-sys/build/main.rs
@@ -1,10 +1,3 @@
-#![allow(
-    clippy::inconsistent_digit_grouping,
-    clippy::uninlined_format_args,
-    clippy::unusual_byte_groupings
-)]
-
-extern crate autocfg;
 #[cfg(feature = "bindgen")]
 extern crate bindgen;
 extern crate cc;
@@ -74,8 +67,6 @@ fn check_ssl_kind() {
 }
 
 fn main() {
-    check_rustc_versions();
-
     check_ssl_kind();
 
     let target = env::var("TARGET").unwrap();
@@ -134,15 +125,6 @@ fn main() {
     }
 }
 
-fn check_rustc_versions() {
-    let cfg = autocfg::new();
-
-    if cfg.probe_rustc_version(1, 31) {
-        println!("cargo:rustc-cfg=const_fn");
-    }
-}
-
-#[allow(clippy::let_and_return)]
 fn postprocess(include_dirs: &[PathBuf]) -> Version {
     let version = validate_headers(include_dirs);
 
@@ -157,7 +139,7 @@ fn postprocess(include_dirs: &[PathBuf]) -> Version {
 
 /// Validates the header files found in `include_dir` and then returns the
 /// version string of OpenSSL.
-#[allow(clippy::manual_strip)] // we need to support pre-1.45.0
+#[allow(clippy::unusual_byte_groupings)]
 fn validate_headers(include_dirs: &[PathBuf]) -> Version {
     // This `*-sys` crate only works with OpenSSL 1.0.1, 1.0.2, 1.1.0, 1.1.1 and 3.0.0.
     // To correctly expose the right API from this crate, take a look at
@@ -173,9 +155,7 @@ fn validate_headers(include_dirs: &[PathBuf]) -> Version {
     // account for compile differences and such.
     println!("cargo:rerun-if-changed=build/expando.c");
     let mut gcc = cc::Build::new();
-    for include_dir in include_dirs {
-        gcc.include(include_dir);
-    }
+    gcc.includes(include_dirs);
     let expanded = match gcc.file("build/expando.c").try_expand() {
         Ok(expanded) => expanded,
         Err(e) => {
@@ -221,17 +201,14 @@ See rust-openssl documentation for more information:
         let libressl_prefix = "RUST_VERSION_LIBRESSL_";
         let boringsl_prefix = "RUST_OPENSSL_IS_BORINGSSL";
         let conf_prefix = "RUST_CONF_";
-        if line.starts_with(openssl_prefix) {
-            let version = &line[openssl_prefix.len()..];
+        if let Some(version) = line.strip_prefix(openssl_prefix) {
             openssl_version = Some(parse_version(version));
-        } else if line.starts_with(new_openssl_prefix) {
-            let version = &line[new_openssl_prefix.len()..];
+        } else if let Some(version) = line.strip_prefix(new_openssl_prefix) {
             openssl_version = Some(parse_new_version(version));
-        } else if line.starts_with(libressl_prefix) {
-            let version = &line[libressl_prefix.len()..];
+        } else if let Some(version) = line.strip_prefix(libressl_prefix) {
             libressl_version = Some(parse_version(version));
-        } else if line.starts_with(conf_prefix) {
-            enabled.push(&line[conf_prefix.len()..]);
+        } else if let Some(conf) = line.strip_prefix(conf_prefix) {
+            enabled.push(conf);
         } else if line.starts_with(boringsl_prefix) {
             is_boringssl = true;
         }
@@ -295,6 +272,8 @@ See rust-openssl documentation for more information:
             (3, 6, _) => ('3', '6', 'x'),
             (3, 7, 0) => ('3', '7', '0'),
             (3, 7, 1) => ('3', '7', '1'),
+            (3, 7, _) => ('3', '7', 'x'),
+            (3, 8, 0) => ('3', '8', '0'),
             _ => version_error(),
         };
 
@@ -337,26 +316,21 @@ fn version_error() -> ! {
         "
 
 This crate is only compatible with OpenSSL (version 1.0.1 through 1.1.1, or 3.0.0), or LibreSSL 2.5
-through 3.7.1, but a different version of OpenSSL was found. The build is now aborting
+through 3.8.0, but a different version of OpenSSL was found. The build is now aborting
 due to this version mismatch.
 
 "
     );
 }
 
 // parses a string that looks like "0x100020cfL"
-#[allow(deprecated)] // trim_right_matches is now trim_end_matches
-#[allow(clippy::match_like_matches_macro)] // matches macro requires rust 1.42.0
 fn parse_version(version: &str) -> u64 {
     // cut off the 0x prefix
     assert!(version.starts_with("0x"));
     let version = &version[2..];
 
     // and the type specifier suffix
-    let version = version.trim_right_matches(|c: char| match c {
-        '0'..='9' | 'a'..='f' | 'A'..='F' => false,
-        _ => true,
-    });
+    let version = version.trim_end_matches(|c: char| !c.is_ascii_hexdigit());
 
     u64::from_str_radix(version, 16).unwrap()
 }

diff --git a/openssl-sys/build/run_bindgen.rs b/openssl-sys/build/run_bindgen.rs
@@ -12,6 +12,7 @@ const INCLUDES: &str = "
 #include <openssl/aes.h>
 #include <openssl/asn1.h>
 #include <openssl/bio.h>
+#include <openssl/cmac.h>
 #include <openssl/conf.h>
 #include <openssl/crypto.h>
 #include <openssl/dh.h>
@@ -109,12 +110,15 @@ pub fn run_boringssl(include_dirs: &[PathBuf]) {
     let mut builder = bindgen::builder()
         .rust_target(RustTarget::Stable_1_47)
         .ctypes_prefix("::libc")
+        .raw_line("use libc::*;")
         .derive_default(false)
         .enable_function_attribute_detection()
-        .size_t_is_usize(true)
         .default_macro_constant_type(MacroTypeVariation::Signed)
         .rustified_enum("point_conversion_form_t")
         .allowlist_file(".*/openssl/[^/]+\\.h")
+        .allowlist_recursively(false)
+        .blocklist_function("BIO_vsnprintf")
+        .blocklist_function("OPENSSL_vasprintf")
         .wrap_static_fns(true)
         .wrap_static_fns_path(out_dir.join("boring_static_wrapper").display().to_string())
         .layout_tests(false)
@@ -163,14 +167,17 @@ pub fn run_boringssl(include_dirs: &[PathBuf]) {
     bindgen_cmd
         .arg("-o")
         .arg(out_dir.join("bindgen.rs"))
-        .arg("--rust-target=1.47")
+        .arg("--rust-target=1.56")
         .arg("--ctypes-prefix=::libc")
+        .arg("--raw-line=use libc::*;")
         .arg("--no-derive-default")
         .arg("--enable-function-attribute-detection")
-        .arg("--size_t-is-usize")
         .arg("--default-macro-constant-type=signed")
         .arg("--rustified-enum=point_conversion_form_t")
         .arg("--allowlist-file=.*/openssl/[^/]+\\.h")
+        .arg("--no-recursive-allowlist")
+        .arg("--blocklist-function=BIO_vsnprintf")
+        .arg("--blocklist-function=OPENSSL_vasprintf")
         .arg("--experimental")
         .arg("--wrap-static-fns")
         .arg("--wrap-static-fns-path")