From e4bcbd5885e93ea4620103efc303c9b61982851b Mon Sep 17 00:00:00 2001

From: Jeremy Barton <jbarton@microsoft.com>

Date: Tue, 4 Sep 2018 12:53:06 -0700

Subject: [PATCH 3/7] Add hybrid support for OpenSSL 1.0 and 1.1

This changes the functional code to use OpenSSL 1.1 API in the places where the API changed. "apibridge" provides equivalent methods for the OpenSSL 1.0 environment.

The following configurations have been tested:

* Non-portable against OpenSSL 1.0

* Non-portable against OpenSSL 1.1

* Portable, built against OpenSSL 1.0 and run against OpenSSL 1.0

* Portable, built against OpenSSL 1.0 and run against OpenSSL 1.1

* Portable, built against OpenSSL 1.1 and run against OpenSSL 1.0

* Portable, built against OpenSSL 1.1 and run against OpenSSL 1.1

In opensslshim, the PER_FUNCTION_BLOCK macro style has been broken up into a named purposes:

* REQUIRED_FUNCTION(fn)

  * API that we use unconditionally, regardless of version

  * Formerly PER_FUNCTION_BLOCK(fn, true)

* NEW_REQUIRED_FUNCTION(fn)

  * API that we use unconditionally in paths that only exist against OpenSSL 1.1, is not probed for when the runtime is 1.0

* LIGHTUP_FUNCTION(fn)

  * API that might not exist, must be probed with API_EXISTS checks before being utilized

  * Formerly PER_FUNCTION_BLOCK(fn, false)

* FALLBACK_FUNCTION(fn)

  * API that is required on OpenSSL 1.1, and when not found will bind to a method named local_#fn in the shim library

* RENAMED_FUNCTION(fn,oldfn)

  * Handles a rename with no signature change from oldfn to newfn, binds appropriately based on the runtime library.

* LEGACY_FUNCTION(fn)

  * API that we use unconditionally in paths that only exist against OpenSSL 1.0, is not probed for when the runtime is 1.1.

Two new #defines are available, but ideally need no further usage:

* NEED_OPENSSL_1_0

  * Defined when building portable, or on non-portable when the headers are OpenSSL 1.0

* NEED_OPENSSL_1_1

  * Defined when building portable, or on non-portable when the headers are OpenSSL 1.1

---

 .../SafeHandles/SafeEvpPKeyHandle.Unix.cs     |   7 +-

 .../CMakeLists.txt                            |   3 +-

 .../apibridge.cpp                             | 524 ++++++++++

 .../apibridge.h                               |  45 +

 .../configure.cmake                           |   5 -

 .../openssl.cpp                               | 199 ++--

 .../openssl.h                                 |  11 +

 .../openssl_1_0_structs.h                     | 139 +++

 .../opensslshim.cpp                           |  60 +-

 .../opensslshim.h                             | 928 ++++++++++++------

 .../pal_asn1.cpp                              |   2 +-

 .../pal_asn1.h                                |   2 +-

 .../pal_asn1_print.cpp                        |   9 +-

 .../pal_crypto_config.h.in                    |   2 -

 .../pal_dsa.cpp                               | 123 ++-

 .../pal_dsa.h                                 |  10 +-

 .../pal_evp.cpp                               |   6 +-

 .../pal_evp_cipher.cpp                        |  26 +-

 .../pal_evp_pkey.cpp                          |   2 +-

 .../pal_hmac.cpp                              |  12 +-

 .../pal_hmac.h                                |   1 -

 .../pal_rsa.cpp                               | 158 +--

 .../pal_rsa.h                                 |  16 +-

 .../pal_ssl.cpp                               | 144 ++-

 .../pal_x509.cpp                              |  16 +-

 .../pal_x509_root.cpp                         |   1 +

 .../Internal/Cryptography/OpenSslCipher.cs    |  19 +

 27 files changed, 1878 insertions(+), 592 deletions(-)

 create mode 100644 src/Native/Unix/System.Security.Cryptography.Native/apibridge.cpp

 create mode 100644 src/Native/Unix/System.Security.Cryptography.Native/apibridge.h

 create mode 100644 src/Native/Unix/System.Security.Cryptography.Native/openssl.h

 create mode 100644 src/Native/Unix/System.Security.Cryptography.Native/openssl_1_0_structs.h

diff --git a/src/Common/src/Microsoft/Win32/SafeHandles/SafeEvpPKeyHandle.Unix.cs b/src/Common/src/Microsoft/Win32/SafeHandles/SafeEvpPKeyHandle.Unix.cs

index c706b1ce88..e51a7ca981 100644

--- a/src/Common/src/Microsoft/Win32/SafeHandles/SafeEvpPKeyHandle.Unix.cs

+++ b/src/Common/src/Microsoft/Win32/SafeHandles/SafeEvpPKeyHandle.Unix.cs

@@ -52,12 +52,9 @@ namespace System.Security.Cryptography

             // that we don't lose a tracked reference in low-memory situations.

             SafeEvpPKeyHandle safeHandle = new SafeEvpPKeyHandle();

-            int newRefCount = Interop.Crypto.UpRefEvpPkey(this);

+            int success = Interop.Crypto.UpRefEvpPkey(this);

-            // UpRefEvpPkey returns the number of references to this key, if it's less than 2

-            // (the incoming handle, and this one) then someone has already Disposed() this key

-            // into non-existence.

-            if (newRefCount < 2)

+            if (success != 1)

             {

                 Debug.Fail("Called UpRefEvpPkey on a key which was already marked for destruction");

                 throw Interop.Crypto.CreateOpenSslCryptographicException();

diff --git a/src/Native/Unix/System.Security.Cryptography.Native/CMakeLists.txt b/src/Native/Unix/System.Security.Cryptography.Native/CMakeLists.txt

index 352f456d07..9fef63fda8 100644

--- a/src/Native/Unix/System.Security.Cryptography.Native/CMakeLists.txt

+++ b/src/Native/Unix/System.Security.Cryptography.Native/CMakeLists.txt

@@ -6,7 +6,7 @@ set(CMAKE_INCLUDE_CURRENT_DIR ON)

 # These are happening inside of OpenSSL-defined macros out of our control

 add_compile_options(-Wno-cast-align)

-add_definitions(-DPIC=1)

+add_definitions(-DPIC=1 -DOPENSSL_API_COMPAT=0x10100000L)

 if(CMAKE_STATIC_LIB_LINK)

    set(CMAKE_FIND_LIBRARY_SUFFIXES .a)

@@ -16,6 +16,7 @@ find_package(OpenSSL REQUIRED)

 include_directories(SYSTEM ${OPENSSL_INCLUDE_DIR})

 set(NATIVECRYPTO_SOURCES

+    apibridge.cpp

     openssl.cpp

     pal_asn1.cpp

     pal_asn1_print.cpp

diff --git a/src/Native/Unix/System.Security.Cryptography.Native/apibridge.cpp b/src/Native/Unix/System.Security.Cryptography.Native/apibridge.cpp

new file mode 100644

index 0000000000..fd43051c3f

--- /dev/null

+++ b/src/Native/Unix/System.Security.Cryptography.Native/apibridge.cpp

@@ -0,0 +1,524 @@

+// Licensed to the .NET Foundation under one or more agreements.

+// The .NET Foundation licenses this file to you under the MIT license.

+// See the LICENSE file in the project root for more information.

+

+#include "opensslshim.h"

+#include "pal_crypto_types.h"

+#include "pal_types.h"

+

+#ifdef NEED_OPENSSL_1_0

+

+#include "apibridge.h"

+

+// Minimally define the structs from 1.0.x which went opaque in 1.1.0 for the

+// portable build building against the 1.1.x headers

+#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_1_1_0_RTM

+#include "openssl_1_0_structs.h"

+

+#define CRYPTO_LOCK_X509 3

+#define CRYPTO_LOCK_EVP_PKEY 10

+

+#define SSL_CTRL_GET_SESSION_REUSED 8

+#define SSL_CTRL_OPTIONS 32

+

+#define SSL_ST_OK 3

+#endif

+

+extern "C" const ASN1_TIME* local_X509_get0_notBefore(const X509* x509)

+{

+    if (x509 && x509->cert_info && x509->cert_info->validity)

+    {

+        return x509->cert_info->validity->notBefore;

+    }

+

+    return nullptr;

+}

+

+extern "C" const ASN1_TIME* local_X509_get0_notAfter(const X509* x509)

+{

+    if (x509 && x509->cert_info && x509->cert_info->validity)

+    {

+        return x509->cert_info->validity->notAfter;

+    }

+

+    return nullptr;

+}

+

+extern "C" const ASN1_TIME* local_X509_CRL_get0_nextUpdate(const X509_CRL* crl)

+{

+    if (crl && crl->crl)

+    {

+        return crl->crl->nextUpdate;

+    }

+

+    return nullptr;

+}

+

+extern "C" int32_t local_X509_get_version(const X509* x509)

+{

+    if (x509 && x509->cert_info)

+    {

+        long ver = ASN1_INTEGER_get(x509->cert_info->version);

+        return (int32_t)ver;

+    }

+

+    return -1;

+}

+

+extern "C" X509_PUBKEY* local_X509_get_X509_PUBKEY(const X509* x509)

+{

+    if (x509)

+    {

+        return x509->cert_info->key;

+    }

+

+    return nullptr;

+}

+

+extern "C" int32_t local_X509_PUBKEY_get0_param(

+    ASN1_OBJECT** palgOid, const uint8_t** pkeyBytes, int* pkeyBytesLen, X509_ALGOR** palg, X509_PUBKEY* pubkey)

+{

+    if (palgOid)

+    {

+        *palgOid = pubkey->algor->algorithm;

+    }

+

+    if (pkeyBytes)

+    {

+        *pkeyBytes = pubkey->public_key->data;

+        *pkeyBytesLen = pubkey->public_key->length;

+    }

+

+    if (palg)

+    {

+        *palg = pubkey->algor;

+    }

+

+    return 1;

+}

+

+extern "C" const X509_ALGOR* local_X509_get0_tbs_sigalg(const X509* x509)

+{

+    if (x509 && x509->cert_info)

+    {

+        return x509->cert_info->signature;

+    }

+

+    return nullptr;

+}

+

+extern "C" ASN1_BIT_STRING* local_X509_get0_pubkey_bitstr(const X509* x509)

+{

+    if (x509 && x509->cert_info && x509->cert_info->key)

+    {

+        return x509->cert_info->key->public_key;

+    }

+

+    return nullptr;

+}

+

+extern "C" int32_t local_X509_NAME_get0_der(X509_NAME* x509Name, const uint8_t** pder, size_t* pderlen)

+{

+    if (!x509Name || !x509Name->bytes)

+    {

+        return 0;

+    }

+

+    if (pder)

+    {

+        *pder = (unsigned char*)x509Name->bytes->data;

+    }

+

+    if (pderlen)

+    {

+        *pderlen = x509Name->bytes->length;

+    }

+

+    return 1;

+}

+

+#ifndef SSLEAY_VERSION

+#define SSLEAY_VERSION 0

+#endif

+

+extern "C" const char* local_OpenSSL_version(int t)

+{

+    (void)t;

+    return SSLeay_version(SSLEAY_VERSION);

+}

+

+extern "C" const DSA_METHOD* local_DSA_get_method(const DSA* dsa)

+{

+    if (dsa)

+    {

+        return dsa->meth;

+    }

+

+    return nullptr;

+}

+

+extern "C" void local_DSA_get0_pqg(const DSA* dsa, const BIGNUM** p, const BIGNUM** q, const BIGNUM** g)

+{

+    if (!dsa)

+    {

+        return;

+    }

+

+    if (p)

+    {

+        *p = dsa->p;

+    }

+

+    if (q)

+    {

+        *q = dsa->q;

+    }

+

+    if (g)

+    {

+        *g = dsa->g;

+    }

+}

+

+extern "C" const BIGNUM* local_DSA_get0_key(const DSA* dsa, const BIGNUM** pubKey, const BIGNUM** privKey)

+{

+    if (dsa)

+    {

+        if (pubKey)

+        {

+            *pubKey = dsa->pub_key;

+        }

+

+        if (privKey)

+        {

+            *privKey = dsa->priv_key;

+        }

+    }

+

+    return nullptr;

+}

+

+extern "C" int32_t local_DSA_set0_pqg(DSA* dsa, BIGNUM* bnP, BIGNUM* bnQ, BIGNUM* bnG)

+{

+    if (!dsa)

+    {

+        return 0;

+    }

+

+    if ((dsa->p == nullptr && bnP == nullptr) || (dsa->q == nullptr && bnQ == nullptr) || (dsa->g == nullptr && bnG == nullptr))

+    {

+        return 0;

+    }

+

+    if (bnP)

+    {

+        BN_free(dsa->p);

+        dsa->p = bnP;

+    }

+

+    if (bnQ)

+    {

+        BN_free(dsa->q);

+        dsa->q = bnQ;

+    }

+

+    if (bnG)

+    {

+        BN_free(dsa->g);

+        dsa->g = bnG;

+    }

+

+    return 1;

+}

+

+extern "C" int32_t local_DSA_set0_key(DSA* dsa, BIGNUM* bnY, BIGNUM* bnX)

+{

+    if (!dsa)

+    {

+        return 0;

+    }

+

+    if (dsa->pub_key == nullptr && bnY == nullptr)

+    {

+        return 0;

+    }

+

+    if (bnY)

+    {

+        BN_free(dsa->pub_key);

+        dsa->pub_key = bnY;

+    }

+

+    if (bnX)

+    {

+        BN_free(dsa->priv_key);

+        dsa->priv_key = bnX;

+    }

+

+    return 1;

+}

+

+extern "C" int32_t local_EVP_PKEY_up_ref(EVP_PKEY* pkey)

+{

+    if (!pkey)

+    {

+        return 0;

+    }

+

+    return CRYPTO_add_lock(&pkey->references, 1, CRYPTO_LOCK_EVP_PKEY, __FILE__, __LINE__) > 1;

+}

+

+extern "C" EVP_CIPHER_CTX* local_EVP_CIPHER_CTX_new()

+{

+    EVP_CIPHER_CTX* ctx = (EVP_CIPHER_CTX*)calloc(1, sizeof(EVP_CIPHER_CTX));

+    return ctx;

+}

+

+extern "C" int32_t local_EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX* ctx)

+{

+    if (ctx)

+    {

+        int ret = EVP_CIPHER_CTX_cleanup(ctx);

+        EVP_CIPHER_CTX_init(ctx);

+        return ret;

+    }

+

+    // OpenSSL 1.1 returns succes 1 on a NULL input

+    return 1;

+}

+

+extern "C" void local_EVP_CIPHER_CTX_free(EVP_CIPHER_CTX* ctx)

+{

+    if (ctx)

+    {

+        local_EVP_CIPHER_CTX_reset(ctx);

+        free(ctx);

+    }

+}

+

+extern "C" HMAC_CTX* local_HMAC_CTX_new()

+{

+    HMAC_CTX* ctx = (HMAC_CTX*)calloc(1, sizeof(HMAC_CTX));

+

+    if (ctx)

+    {

+        HMAC_CTX_init(ctx);

+    }

+

+    return ctx;

+}

+

+extern "C" void local_HMAC_CTX_free(HMAC_CTX* ctx)

+{

+    if (ctx != nullptr)

+    {

+        HMAC_CTX_cleanup(ctx);

+        free(ctx);

+    }

+}

+

+extern "C" int32_t local_RSA_meth_get_flags(const RSA_METHOD* meth)

+{

+    if (meth)

+    {

+        return meth->flags;

+    }

+

+    return 0;

+}

+

+extern "C" void local_RSA_get0_key(const RSA* rsa, const BIGNUM** n, const BIGNUM** e, const BIGNUM** d)

+{

+    if (rsa)

+    {

+        if (n)

+        {

+            *n = rsa->n;

+        }

+

+        if (e)

+        {

+            *e = rsa->e;

+        }

+

+        if (d)

+        {

+            *d = rsa->d;

+        }

+    }

+}

+

+extern "C" void local_RSA_get0_factors(const RSA* rsa, const BIGNUM** p, const BIGNUM** q)

+{

+    if (rsa)

+    {

+        if (p)

+        {

+            *p = rsa->p;

+        }

+

+        if (q)

+        {

+            *q = rsa->q;

+        }

+    }

+}

+

+extern "C" void local_RSA_get0_crt_params(const RSA* rsa, const BIGNUM** dmp1, const BIGNUM** dmq1, const BIGNUM** iqmp)

+{

+    if (rsa)

+    {

+        if (dmp1)

+        {

+            *dmp1 = rsa->dmp1;

+        }

+

+        if (dmq1)

+        {

+            *dmq1 = rsa->dmq1;

+        }

+

+        if (iqmp)

+        {

+            *iqmp = rsa->iqmp;

+        }

+    }

+}

+

+extern "C" int32_t local_RSA_set0_key(RSA* rsa, BIGNUM* n, BIGNUM* e, BIGNUM* d)

+{

+    if (rsa == nullptr)

+    {

+        return 0;

+    }

+

+    if ((rsa->n == nullptr && n == nullptr) || (rsa->e == nullptr && e == nullptr))

+    {

+        return 0;

+    }

+

+    if (n != nullptr)

+    {

+        BN_free(rsa->n);

+        rsa->n = n;

+    }

+

+    if (e != nullptr)

+    {

+        BN_free(rsa->e);

+        rsa->e = e;

+    }

+

+    if (d != nullptr)

+    {

+        BN_free(rsa->d);

+        rsa->d = d;

+    }

+

+    return 1;

+}

+

+extern "C" int32_t local_RSA_set0_factors(RSA* rsa, BIGNUM* p, BIGNUM* q)

+{

+    if (rsa == nullptr)

+    {

+        return 0;

+    }

+

+    if ((rsa->p == nullptr && p == nullptr) || (rsa->q == nullptr && q == nullptr))

+    {

+        return 0;

+    }

+

+    if (p != nullptr)

+    {

+        BN_free(rsa->p);

+        rsa->p = p;

+    }

+

+    if (q != nullptr)

+    {

+        BN_free(rsa->q);

+        rsa->q = q;

+    }

+

+    return 1;

+}

+

+extern "C" int32_t local_RSA_set0_crt_params(RSA* rsa, BIGNUM* dmp1, BIGNUM* dmq1, BIGNUM* iqmp)

+{

+    if (rsa == nullptr)

+    {

+        return 0;

+    }

+

+    if ((rsa->dmp1 == nullptr && dmp1 == nullptr) || (rsa->dmq1 == nullptr && dmq1 == nullptr) ||

+        (rsa->iqmp == nullptr && iqmp == nullptr))

+    {

+        return 0;

+    }

+

+    if (dmp1 != nullptr)

+    {

+        BN_free(rsa->dmp1);

+        rsa->dmp1 = dmp1;

+    }

+

+    if (dmq1 != nullptr)

+    {

+        BN_free(rsa->dmq1);

+        rsa->dmq1 = dmq1;

+    }

+

+    if (iqmp != nullptr)

+    {

+        BN_free(rsa->iqmp);

+        rsa->iqmp = iqmp;

+    }

+

+    return 1;

+}

+

+extern "C" int32_t local_SSL_is_init_finished(const SSL* ssl)

+{

+    return SSL_state(ssl) == SSL_ST_OK;

+}

+

+extern "C" X509Stack* local_X509_STORE_CTX_get0_untrusted(X509_STORE_CTX* ctx)

+{

+    return ctx ? ctx->untrusted : nullptr;

+}

+

+extern "C" X509* local_X509_STORE_CTX_get0_cert(X509_STORE_CTX* ctx)

+{

+    return ctx ? ctx->cert : nullptr;

+}

+

+extern "C" int32_t local_X509_up_ref(X509* x509)

+{

+    if (x509 != nullptr)

+    {

+        return CRYPTO_add_lock(&x509->references, 1, CRYPTO_LOCK_X509, __FILE__, __LINE__) > 1;

+    }

+

+    return 0;

+}

+

+extern "C" unsigned long local_SSL_CTX_set_options(SSL_CTX* ctx, unsigned long options)

+{

+    // SSL_CTX_ctrl is signed long in and signed long out; but SSL_CTX_set_options,

+    // which was a macro call to SSL_CTX_ctrl in 1.0, is unsigned/unsigned.

+    return (unsigned long)SSL_CTX_ctrl(ctx, SSL_CTRL_OPTIONS, (long)options, nullptr);

+}

+

+extern "C" int local_SSL_session_reused(SSL* ssl)

+{

+    return (int)SSL_ctrl(ssl, SSL_CTRL_GET_SESSION_REUSED, 0, nullptr);

+}

+

+extern "C" void local_SSL_CTX_set_security_level(SSL_CTX* ctx, int32_t level)

+{

+    (void)ctx;

+    (void)level;

+}

+#endif

diff --git a/src/Native/Unix/System.Security.Cryptography.Native/apibridge.h b/src/Native/Unix/System.Security.Cryptography.Native/apibridge.h

new file mode 100644

index 0000000000..39d2718a30

--- /dev/null

+++ b/src/Native/Unix/System.Security.Cryptography.Native/apibridge.h

@@ -0,0 +1,45 @@

+// Licensed to the .NET Foundation under one or more agreements.

+// The .NET Foundation licenses this file to you under the MIT license.

+// See the LICENSE file in the project root for more information.

+

+// Functions based on OpenSSL 1.1 API, used when building against/running with OpenSSL 1.0

+

+#pragma once

+#include "pal_types.h"

+

+extern "C" const BIGNUM* local_DSA_get0_key(const DSA* dsa, const BIGNUM** pubKey, const BIGNUM** privKey);

+extern "C" void local_DSA_get0_pqg(const DSA* dsa, const BIGNUM** p, const BIGNUM** q, const BIGNUM** g);

+extern "C" const DSA_METHOD* local_DSA_get_method(const DSA* dsa);

+extern "C" int32_t local_DSA_set0_key(DSA* dsa, BIGNUM* bnY, BIGNUM* bnX);

+extern "C" int32_t local_DSA_set0_pqg(DSA* dsa, BIGNUM* bnP, BIGNUM* bnQ, BIGNUM* bnG);

+extern "C" void local_EVP_CIPHER_CTX_free(EVP_CIPHER_CTX* ctx);

+extern "C" EVP_CIPHER_CTX* local_EVP_CIPHER_CTX_new(void);

+extern "C" int32_t local_EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX* ctx);

+extern "C" int32_t local_EVP_PKEY_up_ref(EVP_PKEY* pkey);

+extern "C" void local_HMAC_CTX_free(HMAC_CTX* ctx);

+extern "C" HMAC_CTX* local_HMAC_CTX_new(void);

+extern "C" const char* local_OpenSSL_version(int t);

+extern "C" void local_RSA_get0_crt_params(const RSA* rsa, const BIGNUM** dmp1, const BIGNUM** dmq1, const BIGNUM** iqmp);

+extern "C" void local_RSA_get0_factors(const RSA* rsa, const BIGNUM** p, const BIGNUM** q);

+extern "C" void local_RSA_get0_key(const RSA* rsa, const BIGNUM** n, const BIGNUM** e, const BIGNUM** d);

+extern "C" int32_t local_RSA_meth_get_flags(const RSA_METHOD* meth);

+extern "C" int32_t local_RSA_set0_crt_params(RSA* rsa, BIGNUM* dmp1, BIGNUM* dmq1, BIGNUM* iqmp);

+extern "C" int32_t local_RSA_set0_factors(RSA* rsa, BIGNUM* p, BIGNUM* q);

+extern "C" int32_t local_RSA_set0_key(RSA* rsa, BIGNUM* n, BIGNUM* e, BIGNUM* d);

+extern "C" int32_t local_SSL_is_init_finished(const SSL* ssl);

+extern "C" unsigned long local_SSL_CTX_set_options(SSL_CTX* ctx, unsigned long options);

+extern "C" void local_SSL_CTX_set_security_level(SSL_CTX* ctx, int32_t level);

+extern "C" int local_SSL_session_reused(SSL* ssl);

+extern "C" const ASN1_TIME* local_X509_CRL_get0_nextUpdate(const X509_CRL* crl);

+extern "C" int32_t local_X509_NAME_get0_der(X509_NAME* x509Name, const uint8_t** pder, size_t* pderlen);

+extern "C" int32_t local_X509_PUBKEY_get0_param(

+    ASN1_OBJECT** palgOid, const uint8_t** pkeyBytes, int* pkeyBytesLen, X509_ALGOR** palg, X509_PUBKEY* pubkey);

+extern "C" X509* local_X509_STORE_CTX_get0_cert(X509_STORE_CTX* ctx);

+extern "C" STACK_OF(X509) * local_X509_STORE_CTX_get0_untrusted(X509_STORE_CTX* ctx);

+extern "C" const ASN1_TIME* local_X509_get0_notAfter(const X509* x509);

+extern "C" const ASN1_TIME* local_X509_get0_notBefore(const X509* x509);

+extern "C" ASN1_BIT_STRING* local_X509_get0_pubkey_bitstr(const X509* x509);

+extern "C" const X509_ALGOR* local_X509_get0_tbs_sigalg(const X509* x509);

+extern "C" X509_PUBKEY* local_X509_get_X509_PUBKEY(const X509* x509);

+extern "C" int32_t local_X509_get_version(const X509* x509);

+extern "C" int32_t local_X509_up_ref(X509* x509);

diff --git a/src/Native/Unix/System.Security.Cryptography.Native/configure.cmake b/src/Native/Unix/System.Security.Cryptography.Native/configure.cmake

index 809ffe318e..cdc9f50f3c 100644

--- a/src/Native/Unix/System.Security.Cryptography.Native/configure.cmake

+++ b/src/Native/Unix/System.Security.Cryptography.Native/configure.cmake

@@ -2,11 +2,6 @@ include(CheckLibraryExists)

 include(CheckFunctionExists)

 set(CMAKE_REQUIRED_INCLUDES ${OPENSSL_INCLUDE_DIR})

-

-# Check which versions of TLS the OpenSSL/ssl library supports

-check_library_exists(${OPENSSL_SSL_LIBRARY} "TLSv1_1_method" "" HAVE_TLS_V1_1)

-check_library_exists(${OPENSSL_SSL_LIBRARY} "TLSv1_2_method" "" HAVE_TLS_V1_2)

-

 set(CMAKE_REQUIRED_LIBRARIES ${OPENSSL_CRYPTO_LIBRARY})

 check_function_exists(

diff --git a/src/Native/Unix/System.Security.Cryptography.Native/openssl.cpp b/src/Native/Unix/System.Security.Cryptography.Native/openssl.cpp

index 46396370b4..f419b755b7 100644

--- a/src/Native/Unix/System.Security.Cryptography.Native/openssl.cpp

+++ b/src/Native/Unix/System.Security.Cryptography.Native/openssl.cpp

@@ -6,6 +6,7 @@

 #include "pal_utilities.h"

 #include "pal_safecrt.h"

 #include "opensslshim.h"

+#include "openssl.h"