Increase our minimum LibreSSL.

.github/workflows/ci.yml

@@ -37,8 +37,6 @@ jobs:
           - {VERSION: "3.10", TOXENV: "py310", OPENSSL: {TYPE: "openssl", VERSION: "1.1.1q", CONFIG_FLAGS: "no-engine no-rc2 no-srtp no-ct no-psk"}}
           - {VERSION: "3.10", TOXENV: "py310", OPENSSL: {TYPE: "openssl", VERSION: "3.0.5"}}
           - {VERSION: "3.10", TOXENV: "py310", TOXARGS: "--enable-fips=1", OPENSSL: {TYPE: "openssl", CONFIG_FLAGS: "enable-fips", VERSION: "3.0.5"}}
-          - {VERSION: "3.10", TOXENV: "py310", OPENSSL: {TYPE: "libressl", VERSION: "3.1.5"}}
-          - {VERSION: "3.10", TOXENV: "py310", OPENSSL: {TYPE: "libressl", VERSION: "3.2.7"}}
           - {VERSION: "3.10", TOXENV: "py310", OPENSSL: {TYPE: "libressl", VERSION: "3.3.6"}}
           - {VERSION: "3.10", TOXENV: "py310", OPENSSL: {TYPE: "libressl", VERSION: "3.4.3"}}
           - {VERSION: "3.10", TOXENV: "py310", OPENSSL: {TYPE: "libressl", VERSION: "3.5.3"}}

CHANGELOG.rst

@@ -10,6 +10,8 @@ Changelog
 
 * Support for OpenSSL 1.1.0 has been removed. Users on older version of
   OpenSSL will need to upgrade.
+* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL 3.1.x, 3.2.x,
+  3.3.0, and 3.3.1. The new minimum LibreSSL version is 3.3.2+.
 
 .. _v38-0-0:
 

src/_cffi_src/openssl/cryptography.py

@@ -39,18 +39,12 @@
 #endif
 
 #if CRYPTOGRAPHY_IS_LIBRESSL
-#define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_322 \
-    (LIBRESSL_VERSION_NUMBER < 0x3020200f)
-#define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_332 \
-    (LIBRESSL_VERSION_NUMBER < 0x3030200f)
 #define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_340 \
     (LIBRESSL_VERSION_NUMBER < 0x3040000f)
 #define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_350 \
     (LIBRESSL_VERSION_NUMBER < 0x3050000f)
 
 #else
-#define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_322 (0)
-#define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_332 (0)
 #define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_340 (0)
 #define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_350 (0)
 #endif

src/_cffi_src/openssl/ssl.py

@@ -643,10 +643,6 @@
 #endif
 
 #if CRYPTOGRAPHY_IS_LIBRESSL || CRYPTOGRAPHY_IS_BORINGSSL
-#if CRYPTOGRAPHY_LIBRESSL_LESS_THAN_332
-static const long SSL_OP_NO_DTLSv1 = 0;
-static const long SSL_OP_NO_DTLSv1_2 = 0;
-#endif
 long (*DTLS_set_link_mtu)(SSL *, long) = NULL;
 long (*DTLS_get_link_min_mtu)(SSL *) = NULL;
 #endif

src/_cffi_src/openssl/x509_vfy.py

@@ -18,7 +18,6 @@
 """
 
 TYPES = """
-static const long Cryptography_HAS_110_VERIFICATION_PARAMS;
 static const long Cryptography_HAS_X509_STORE_CTX_GET_ISSUER;
 
 typedef ... Cryptography_STACK_OF_ASN1_OBJECT;
@@ -218,15 +217,6 @@
 """
 
 CUSTOMIZATIONS = """
-#if CRYPTOGRAPHY_IS_LIBRESSL && CRYPTOGRAPHY_LIBRESSL_LESS_THAN_322
-static const long Cryptography_HAS_110_VERIFICATION_PARAMS = 0;
-#ifndef X509_CHECK_FLAG_NEVER_CHECK_SUBJECT
-static const long X509_CHECK_FLAG_NEVER_CHECK_SUBJECT = 0;
-#endif
-#else
-static const long Cryptography_HAS_110_VERIFICATION_PARAMS = 1;
-#endif
-
 #if CRYPTOGRAPHY_IS_LIBRESSL
 static const long Cryptography_HAS_X509_STORE_CTX_GET_ISSUER = 0;
 typedef void *X509_STORE_CTX_get_issuer_fn;

src/cryptography/hazmat/bindings/openssl/_conditional.py

@@ -19,10 +19,6 @@ def cryptography_has_ssl3_method() -> typing.List[str]:
     ]
 
 
-def cryptography_has_110_verification_params() -> typing.List[str]:
-    return ["X509_CHECK_FLAG_NEVER_CHECK_SUBJECT"]
-
-
 def cryptography_has_set_cert_cb() -> typing.List[str]:
     return [
         "SSL_CTX_set_cert_cb",
@@ -320,9 +316,6 @@ def cryptography_has_ssl_op_ignore_unexpected_eof() -> typing.List[str]:
 CONDITIONAL_NAMES = {
     "Cryptography_HAS_EC2M": cryptography_has_ec2m,
     "Cryptography_HAS_SSL3_METHOD": cryptography_has_ssl3_method,
-    "Cryptography_HAS_110_VERIFICATION_PARAMS": (
-        cryptography_has_110_verification_params
-    ),
     "Cryptography_HAS_SET_CERT_CB": cryptography_has_set_cert_cb,
     "Cryptography_HAS_SSL_ST": cryptography_has_ssl_st,
     "Cryptography_HAS_TLS_ST": cryptography_has_tls_st,