Re: [PATCH bpf-next 1/2] bpftool: Allow bpftool to build with openssl < 3

[Quentin Monnet <qmo@kernel.org>]

2025-11-14 15:17 UTC-0800 ~ Song Liu <song@kernel.org>
> On Fri, Nov 14, 2025 at 3:04 PM Alan Maguire <alan.maguire@oracle.com> wrote:
>>
>> On 14/11/2025 22:55, Song Liu wrote:
>>> On Fri, Nov 14, 2025 at 2:23 PM Alan Maguire <alan.maguire@oracle.com> wrote:
>>>>
>>>> ERR_get_error_all()[1] is a openssl v3 API, so to make code
>>>> compatible with openssl v1 utilize ERR_get_err_line_data
>>>> instead.  Since openssl is already a build requirement for
>>>> the kernel (minimum requirement openssl 1.0.0), this will
>>>> allow bpftool to compile where opensslv3 is not available.
>>>> Signing-related BPF selftests pass with openssl v1.
>>>>
>>>> [1] https://docs.openssl.org/3.4/man3/ERR_get_error/
>>>>
>>>> Fixes: 40863f4d6ef2 ("bpftool: Add support for signing BPF programs")
>>>> Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
>>>> ---
>>>>  tools/bpf/bpftool/sign.c | 6 ++++++
>>>>  1 file changed, 6 insertions(+)
>>>>
>>>> diff --git a/tools/bpf/bpftool/sign.c b/tools/bpf/bpftool/sign.c
>>>> index b34f74d210e9..f9b742f4bb10 100644
>>>> --- a/tools/bpf/bpftool/sign.c
>>>> +++ b/tools/bpf/bpftool/sign.c
>>>> @@ -28,6 +28,12 @@
>>>>
>>>>  #define OPEN_SSL_ERR_BUF_LEN 256
>>>>
>>>> +/* Use deprecated in 3.0 ERR_get_error_line_data for openssl < 3 */
>>>> +#if !defined(OPENSSL_VERSION_MAJOR) || (OPENSSL_VERSION_MAJOR < 3)
>>>> +#define ERR_get_error_all(file, line, func, data, flags) \
>>>> +       ERR_get_error_line_data(file, line, data, flags)
>>>> +#endif
>>>> +
>>>
>>> We have func=NULL in display_openssl_errors(). Shall we just use
>>> ERR_get_error_line_data instead?
>>>
>>
>> It's a good idea, and I tried it - unfortunately we then get a
>> "deprecated in v3" warning when we build with opensslv3. So this was the
>> only way I could think of to build on v1 and not get warnings with v3.
> 
> I see. Thanks for the explanation. This looks good to me.
> 
> Acked-by: Song Liu <song@kernel.org>


Acked-by: Quentin Monnet <qmo@kernel.org>

Thank you Alan!