From 6caa50183e44b6ef760be4bdbcc98d684c309c5d Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sat, 20 Jun 2026 15:20:19 +0100 Subject: [PATCH 1/2] ssl-util: support OpenSSL 4 OpenSSL 4 broke ABI, so we need to look for both SONAMEs. Try libssl.so.3 first, and fallback to libssl.so.4, so that the older and more stable version is used if both are installed, giving distros time to fix regressions. Follow-up for ccdd42351f79cbb9c2e034a96280a1ded40a2f95 Fixes https://github.com/systemd/systemd/issues/42675 --- src/shared/ssl-util.c | 65 ++++++++++++++++++++++++++----------------- src/shared/ssl-util.h | 2 +- 2 files changed, 40 insertions(+), 27 deletions(-) diff --git a/src/shared/ssl-util.c b/src/shared/ssl-util.c index ce51c8cc59..226120c70e 100644 --- a/src/shared/ssl-util.c +++ b/src/shared/ssl-util.c @@ -4,6 +4,7 @@ #include "log.h" /* IWYU pragma: keep */ #include "ssl-util.h" +#include "strv.h" #if HAVE_OPENSSL @@ -35,35 +36,47 @@ DLSYM_PROTOTYPE(TLS_client_method) = NULL; int dlopen_libssl(int log_level) { #if HAVE_OPENSSL static void *libssl_dl = NULL; + int r; LIBSSL_NOTE(SD_ELF_NOTE_DLOPEN_PRIORITY_SUGGESTED); - return dlopen_many_sym_or_warn( - &libssl_dl, - "libssl.so.3", - log_level, - DLSYM_ARG(SSL_ctrl), - DLSYM_ARG(SSL_CTX_ctrl), - DLSYM_ARG(SSL_CTX_free), - DLSYM_ARG(SSL_CTX_new), - DLSYM_ARG(SSL_CTX_set_default_verify_paths), - DLSYM_ARG(SSL_CTX_set_options), - DLSYM_ARG(SSL_do_handshake), - DLSYM_ARG(SSL_free), - DLSYM_ARG(SSL_get_error), - DLSYM_ARG(SSL_get_wbio), - DLSYM_ARG(SSL_get0_param), - DLSYM_ARG(SSL_get1_session), - DLSYM_ARG(SSL_new), - DLSYM_ARG(SSL_read), - DLSYM_ARG(SSL_SESSION_free), - DLSYM_ARG(SSL_set_bio), - DLSYM_ARG(SSL_set_connect_state), - DLSYM_ARG(SSL_set_session), - DLSYM_ARG(SSL_set_verify), - DLSYM_ARG(SSL_shutdown), - DLSYM_ARG(SSL_write), - DLSYM_ARG(TLS_client_method)); + // FIXME: switch order to prefer libssl.so.4 in a future version once it has stabilized + FOREACH_STRING(soname, "libssl.so.3", "libssl.so.4") { + r = dlopen_many_sym_or_warn( + &libssl_dl, + soname, + log_level, + DLSYM_ARG(SSL_ctrl), + DLSYM_ARG(SSL_CTX_ctrl), + DLSYM_ARG(SSL_CTX_free), + DLSYM_ARG(SSL_CTX_new), + DLSYM_ARG(SSL_CTX_set_default_verify_paths), + DLSYM_ARG(SSL_CTX_set_options), + DLSYM_ARG(SSL_do_handshake), + DLSYM_ARG(SSL_free), + DLSYM_ARG(SSL_get_error), + DLSYM_ARG(SSL_get_wbio), + DLSYM_ARG(SSL_get0_param), + DLSYM_ARG(SSL_get1_session), + DLSYM_ARG(SSL_new), + DLSYM_ARG(SSL_read), + DLSYM_ARG(SSL_SESSION_free), + DLSYM_ARG(SSL_set_bio), + DLSYM_ARG(SSL_set_connect_state), + DLSYM_ARG(SSL_set_session), + DLSYM_ARG(SSL_set_verify), + DLSYM_ARG(SSL_shutdown), + DLSYM_ARG(SSL_write), + DLSYM_ARG(TLS_client_method)); + if (r >= 0) + break; + } + if (r < 0) { + log_full_errno(log_level, r, "Neither libssl.so.4 nor libssl.so.3 could be loaded"); + return -EOPNOTSUPP; /* turn into recognizable error */ + } + + return 0; #else return log_full_errno(log_level, SYNTHETIC_ERRNO(EOPNOTSUPP), "libssl support is not compiled in."); diff --git a/src/shared/ssl-util.h b/src/shared/ssl-util.h index 80c56fcbe1..aa3b830866 100644 --- a/src/shared/ssl-util.h +++ b/src/shared/ssl-util.h @@ -12,7 +12,7 @@ int dlopen_libssl(int log_level); SD_ELF_NOTE_DLOPEN("libssl", \ "Support for TLS", \ priority, \ - "libssl.so.3") + "libssl.so.3", "libssl.so.4") #define DLOPEN_LIBSSL(log_level, priority) \ ({ \ From 7be9032019015ddd61985e6a6721d813d62dad0b Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sat, 20 Jun 2026 15:21:26 +0100 Subject: [PATCH 2/2] ssl-util: prefer OpenSSL 4 For the next version we can switch to preferring the new version --- src/shared/ssl-util.c | 3 +-- src/shared/ssl-util.h | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/src/shared/ssl-util.c b/src/shared/ssl-util.c index 226120c70e..4b7ab2ec29 100644 --- a/src/shared/ssl-util.c +++ b/src/shared/ssl-util.c @@ -40,8 +40,7 @@ int dlopen_libssl(int log_level) { LIBSSL_NOTE(SD_ELF_NOTE_DLOPEN_PRIORITY_SUGGESTED); - // FIXME: switch order to prefer libssl.so.4 in a future version once it has stabilized - FOREACH_STRING(soname, "libssl.so.3", "libssl.so.4") { + FOREACH_STRING(soname, "libssl.so.4", "libssl.so.3") { r = dlopen_many_sym_or_warn( &libssl_dl, soname, diff --git a/src/shared/ssl-util.h b/src/shared/ssl-util.h index aa3b830866..77b5c049f9 100644 --- a/src/shared/ssl-util.h +++ b/src/shared/ssl-util.h @@ -12,7 +12,7 @@ int dlopen_libssl(int log_level); SD_ELF_NOTE_DLOPEN("libssl", \ "Support for TLS", \ priority, \ - "libssl.so.3", "libssl.so.4") + "libssl.so.4", "libssl.so.3") #define DLOPEN_LIBSSL(log_level, priority) \ ({ \