Fix build on SSLv2-disabled OpenSSL setups

On systems where SSLv2_client_method isn't defined in OpenSSL (such as newer
Debian, and Ubuntu starting with 11.10 oneiric ocelot), don't reference it (to
fix the build) and print a run-time error that the OS does not support SSLv2.
Fixes Debian Bug #622054, but note that that bug report has a more thorough
patch that does away with SSLv2 altogether.

diff --git a/NEWS b/NEWS
index e4656ecbaed72dd869620441f057aa5bd637bf16..7e4fd66426d25a7b6c00fc124c8d5e7a0276b80c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -60,6 +60,13 @@ removed from a 6.4.0 or newer release.)
 * The Server certificate: message in verbose mode now appears on stdout like the
   remainder of the output. Reported by Henry Jensen, to fix Debian Bug #639807.
 
+# CHANGE
+* On systems where SSLv2_client_method isn't defined in OpenSSL (such as
+  newer Debian, and Ubuntu starting with 11.10 oneiric ocelot), don't
+  reference it (to fix the build) and print a run-time error that the OS
+  does not support SSLv2. Fixes Debian Bug #622054, but note that that bug
+  report has a more thorough patch that does away with SSLv2 altogether.
+
 
 fetchmail-6.3.21 (released 2011-08-21, 26011 LoC):
 

diff --git a/configure.ac b/configure.ac
index b66ad80972605dbfd3d0311ddb7a979dff3a80b4..de3a37a387758d5614477ecb15f9c1b32cf4de6f 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -799,6 +799,11 @@ else
   AC_MSG_NOTICE(Disabling SSL support.)
 fi
 
+case "$LIBS" in *-lssl*)
+       AC_CHECK_DECLS([SSLv2_client_method],,,[#include <openssl/ssl.h>])
+       ;;
+esac
+
 ###    use option --with-socks=DIR to point at SOCKS library
 AC_ARG_WITH(socks,
        [  --with-socks[=DIR]      add built-in SOCKS firewall access],

diff --git a/fetchmail.man b/fetchmail.man
index 237710f865c34d18f650f86e4eb5bed7e051cb00..e953a5dd0b5d6d68644a1a347247f0452ee4ae9a 100644 (file)
--- a/fetchmail.man
+++ b/fetchmail.man
@@ -474,7 +474,8 @@ Also see \-\-sslcert above.
 (Keyword: sslproto)
 .br
 Forces an SSL/TLS protocol. Possible values are \fB''\fP,
-\&'\fBSSL2\fP', '\fBSSL23\fP', (use of these two values is discouraged
+\&'\fBSSL2\fP' (not supported on all systems),
+\&'\fBSSL23\fP', (use of these two values is discouraged
 and should only be used as a last resort) \&'\fBSSL3\fP', and
 \&'\fBTLS1\fP'.  The default behaviour if this option is unset is: for
 connections without \-\-ssl, use \&'\fBTLS1\fP' so that fetchmail will

diff --git a/socket.c b/socket.c
index d20048193c36455f903f53604b686aac31d33e4a..260b0aa31f16eaf5f0d9023716a57834ff024983 100644 (file)
--- a/socket.c
+++ b/socket.c
@@ -874,7 +874,12 @@ int SSLOpen(int sock, char *mycert, char *mykey, const char *myproto, int certck
        _ssl_context[sock] = NULL;
        if(myproto) {
                if(!strcasecmp("ssl2",myproto)) {
+#if HAVE_DECL_SSLV2_CLIENT_METHOD + 0 > 0
                        _ctx[sock] = SSL_CTX_new(SSLv2_client_method());
+#else
+                       report(stderr, GT_("Your operating system does not support SSLv2.\n"));
+                       return -1;
+#endif
                } else if(!strcasecmp("ssl3",myproto)) {
                        _ctx[sock] = SSL_CTX_new(SSLv3_client_method());
                } else if(!strcasecmp("tls1",myproto)) {