[CHANGED] TLS/Build: Requires SSL 1.1.1+ to compile, init/cleanup removed

.github/workflows/build-test.yml

@@ -183,6 +183,10 @@ jobs:
           export PATH=../deps/nats-server:../deps/nats-streaming-server:$PATH
           export NATS_TEST_SERVER_VERSION="$(nats-server -v)"
           flags=""
+          # Test app using dynamic library does not crash if no NATS call is made
+          bin/nonats
+          # Test C++ compiler compatibility
+          bin/check_cpp
           ctest -L 'test' --timeout 60 --output-on-failure --repeat-until-fail ${{ inputs.repeat }}
 
       - name: Upload coverage reports to Codecov

CMakeLists.txt

@@ -35,7 +35,6 @@ option(NATS_COVERAGE "Code coverage" OFF)
 option(NATS_BUILD_NO_SPIN "Enable if spin code does not compile on your arch" OFF)
 option(NATS_BUILD_WITH_TLS "Build with TLS support" ON)
 option(NATS_BUILD_TLS_FORCE_HOST_VERIFY "Forces hostname verification" ON)
-option(NATS_BUILD_TLS_USE_OPENSSL_1_1_API "Build for OpenSSL 1.1+" ON)
 option(NATS_BUILD_USE_SODIUM "Build using libsodium library" OFF)
 option(NATS_BUILD_EXAMPLES "Build examples" ON)
 option(NATS_BUILD_LIBUV_EXAMPLE "Build libuv examples" OFF)
@@ -72,7 +71,7 @@ endif(NATS_COVERAGE)
 
 if(NATS_BUILD_WITH_TLS)
   set(OPENSSL_USE_STATIC_LIBS ${NATS_BUILD_OPENSSL_STATIC_LIBS})
-  find_package(OpenSSL REQUIRED)
+  find_package(OpenSSL 1.1.1 REQUIRED)
 endif(NATS_BUILD_WITH_TLS)
 
 set(LIBUV_DIR "" CACHE PATH "Libuv install directory")
@@ -257,9 +256,6 @@ add_definitions(-D${NATS_OS})
 add_definitions(-D_REENTRANT)
 if(NATS_BUILD_WITH_TLS)
   add_definitions(-DNATS_HAS_TLS)
-  if(NATS_BUILD_TLS_USE_OPENSSL_1_1_API)
-    add_definitions(-DNATS_USE_OPENSSL_1_1)
-  endif(NATS_BUILD_TLS_USE_OPENSSL_1_1_API)
   if(NATS_BUILD_TLS_FORCE_HOST_VERIFY)
     add_definitions(-DNATS_FORCE_HOST_VERIFICATION)
   endif(NATS_BUILD_TLS_FORCE_HOST_VERIFY)

README.md

@@ -157,15 +157,9 @@ Although we recommend leaving the new default behavior, you can restore the prev
 cmake .. -DNATS_BUILD_TLS_FORCE_HOST_VERIFY=OFF
 ```
 
-The NATS C client is built using APIs from the [OpenSSL](https://github.com/openssl/openssl) library. By default we use `3.0+` APIs. Since OpenSSL `1.0.2` is no longer supported, starting with NATS C Client `v3.6.0` version, the CMake variable `NATS_BUILD_TLS_USE_OPENSSL_1_1_API` is now set to `ON` by default (if you are setting up a new environment) and will use OpenSSL APIs from `1.1+`/`3.0+` APIs. You will still be able to compile with the OpenSSL `1.0.2` library by setting this CMake option to `OFF`:
+The NATS C client is built using APIs from the [OpenSSL](https://github.com/openssl/openssl) library. Since NATS C Client `v3.11.0`, the `CMakeLists.txt` file requires an OpenSSL library version 1.1.1 minimum.
 
-```
-cmake .. -DNATS_BUILD_TLS_USE_OPENSSL_1_1_API=OFF
-```
-
-The variable `NATS_BUILD_TLS_USE_OPENSSL_1_1_API` is deprecated, meaning that in the future this option will simply be removed and only OpenSSL `3.0+` APIs will be used. The code in the library using older OpenSSL APIs will be removed too.
-
-Note that the variable `NATS_BUILD_WITH_TLS_CLIENT_METHOD` that was deprecated in `v2.0.0` has now been removed.
+The variable `NATS_BUILD_TLS_USE_OPENSSL_1_1_API` and code for older OpenSSL versions have been removed.
 
 Since the NATS C client dynamically links to the OpenSSL library, you need to make sure that you are then running your application against an OpenSSL 1.1+/3.0+ library.
 

src/conn.c

@@ -690,8 +690,6 @@ _makeTLSConn(natsConnection *nc)
         }
         else
         {
-            nats_sslRegisterThreadForCleanup();
-
             SSL_set_ex_data(ssl, 0, (void*) nc);
         }
     }
@@ -729,14 +727,8 @@ _makeTLSConn(natsConnection *nc)
 #endif
             if (nc->tlsName != NULL)
             {
-#if defined(NATS_USE_OPENSSL_1_1)
                 SSL_set_hostflags(ssl, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
                 if (!SSL_set1_host(ssl, nc->tlsName))
-#else
-                X509_VERIFY_PARAM *param = SSL_get0_param(ssl);
-                X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
-                if (!X509_VERIFY_PARAM_set1_host(param, nc->tlsName, 0))
-#endif
                     s = nats_setError(NATS_SSL_ERROR, "unable to set expected hostname '%s'", nc->tlsName);
             }
             if (s == NATS_OK)
@@ -752,13 +744,11 @@ _makeTLSConn(natsConnection *nc)
             }
         }
     }
-#if defined(NATS_USE_OPENSSL_1_1)
     // add the host name in the SNI extension
     if ((s == NATS_OK) && (nc->cur != NULL) && (!SSL_set_tlsext_host_name(ssl, nc->cur->url->host)))
     {
         s = nats_setError(NATS_SSL_ERROR, "unable to set SNI extension for hostname '%s'", nc->cur->url->host);
     }
-#endif
     if ((s == NATS_OK) && (SSL_do_handshake(ssl) != 1))
     {
         // check if there is already set NATS_SSL_ERROR from _sslCertCallback
@@ -2304,9 +2294,6 @@ _readLoop(void  *arg)
     if (buffer == NULL)
         s = nats_setDefaultError(NATS_NO_MEMORY);
 
-    if (nc->sockCtx.ssl != NULL)
-        nats_sslRegisterThreadForCleanup();
-
     natsDeadline_Clear(&(nc->sockCtx.readDeadline));
 
     if (nc->ps == NULL)