PPP 2.5.2 build fails with OpenSSL 3.0.x due to deprecated ENGINE APIs

[logu05]

When building PPP 2.5.2 against OpenSSL 3.0.x, the build fails in pppd/eap-tls.c because it uses deprecated ENGINE functions. OpenSSL 3.0 marks the ENGINE APIs as deprecated, and some calls appear to cause build failures depending on the toolchain.

eap-tls.c: In function 'eaptls_init_ssl':
eap-tls.c:411:9: warning: 'ENGINE_ctrl_cmd' is deprecated: Since OpenSSL 3.0
if (!ENGINE_ctrl_cmd( cert_engine, "LOAD_CERT_CTRL", 0, &cert_info, NULL, 0 ) )
^
eap-tls.c:536:13: warning: 'ENGINE_load_private_key' is deprecated: Since OpenSSL 3.0
pkey = ENGINE_load_private_key(pkey_engine, privkeyfile, transfer_pin, &cb_data);
^
eap-tls.c:542:13: warning: 'ENGINE_load_private_key' is deprecated: Since OpenSSL 3.0
pkey = ENGINE_load_private_key(pkey_engine, privkeyfile, NULL, NULL);
^
make[2]: *** [Makefile:819: all] Error 2
make[1]: *** [Makefile:505: all-recursive] Error 1

[Neustradamus]

@paulusmack, @enaess, @jkroonza, @jjkeijser: Have you seen this ticket?

[jkroonza]

 * Searching for ppp ...
[-P-] [  ] net-dialup/ppp-2.5.0-r7:0/2.5.0
[-P-] [  ] net-dialup/ppp-2.5.1-r1:0/2.5.1
[IP-] [  ] net-dialup/ppp-2.5.2:0/2.5.2
jkroon@plastiekpoot ~ $ equery list -ipo openssl
 * Searching for openssl ...
...
[IP-] [  ] dev-libs/openssl-3.4.2:0/3
...

I'm not seeing specific patches Gentoo's adding for openssl.

jkroon@plastiekpoot ~/projects/ppp (master) $ touch pppd/eap-tls.c 
jkroon@plastiekpoot ~/projects/ppp (master) $ make

Does reproduce the warnings, so I agree this is something that should be fixed. I'm probably the wrong person to dig into this not having worked with openssl in several years except maybe superficially.

https://docs.openssl.org/3.0/man7/migration_guide/#engines-and-method-apis

Has additional information, but whomever tackles this should have existing knowledge, or be willing (and have capacity) to do a fair amount of research.

[paulusmack]

I would like to hear from @enaess and @jjkeijser about what we should do here.

@logu05 have you added -Werror to the pppd compile options or something? It's not clear to me why the warnings cause the build to fail.

[jjkeijser]

I've just built ppp-2.5.2 on Fedora 42 (openssl 3.2.4) and it built without any issues.
If newer versions of OpenSSL (they're up to 3.6 now) do throw errors on the OpenSSL Engine stuff, then add a define to your build flags
-DOPENSSL_NO_ENGINE
and try again - that should disable engine support (but you also will not have PKCS#11 support).

[jkroonza]

Those are warnings unless you do -Werror as Paulus has suggested. Also see my misdirected comment at #567 (comment)

You mention PKCS#11 support - is there no way to implement that without engines? And how difficult is it to move the code to providers?

[jjkeijser]

the best way would be to migrate all engine stuff to an openssl pkcs#11 provider ; there now is a github project for a pkcs#11 provider but I cannot find how to easily replace the existing 'engine' code with the new 'provider' calls.

As I have zero time these days to work on this, I hope someone else can pick this up.

[paulusmack]

In the interim, I suggest we make the default be to build without engine support, and have an --enable-openssl-engine option to configure to enable it.