Repository: borgbackup/borg

Issue:
borgbackup build failure when using OpenSSL 1.1.0
https://groups.google.com/d/msg/linux.debian.devel/53fq9S-Qpp4/V_0pPtdzBQAJ



Discussion:
Note: as some developer on the linked mailing list thread has noticed, just making an application work with OpenSSL 1.1.0 is often not sufficient if one still wants it to work with 1.0.1 and 1.0.2 also.

Guess we'll need to detect OpenSSL version in setup.py and generate a little header file aliasing changed names -- Cython has no "ifdef" like construct, at least not that I'm aware...

https://breakpoint.cc/openssl-1.1-rebuild-2016-05-29/Attempted/borgbackup_1.0.3-1_amd64-20160529-1408

The interesting part of that is:

```
cythoning borg/crypto.pyx to borg/crypto.c
building 'borg.crypto' extension
x86_64-linux-gnu-gcc -pthread -DNDEBUG -g -fwrapv -O2 -Wall -Wstrict-prototypes -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -fPIC -I/usr/include -I/usr/include -I/usr/include/python3.5m -c borg/crypto.c -o build/temp.linux-x86_64-3.5/borg/crypto.o
borg/crypto.c:466:18: error: field 'ctx' has incomplete type
   EVP_CIPHER_CTX ctx;
                  ^
error: command 'x86_64-linux-gnu-gcc' failed with exit status 1
```

Probably one of the (many) structures that are now opaque in 1.1 and require accessors.

See this PR which is scheduled for borg 1.2:
https://github.com/borgbackup/borg/pull/1034/files#diff-85ee6ebe1cdcfd4a4699c3913d519b27L104

When this is merged, we do not access into the OpenSSL ctx any more (to read the current value of ctx.iv), but just compute the next iv from the previous iv and, if needed, the amount of data.

This could be done in a similar way in borg 1.0 and 1.1 also.

Related: what is the best / easiest way to build / test borg with OpenSSL 1.1 without disturbing any other openssl using software on the system?

> Related: what is the best / easiest way to build / test borg with OpenSSL 1.1 without disturbing any other openssl using software on the system?

```
pbuilder-dist experimental create
pbuilder-dist experimental login
do your checks here :)
```

Note: once openssl 1.1 is the test environment, attic of course does not build/install any more and test environment setup fails hard.


Resolving patch:
diff --git a/borg/testsuite/crypto.py b/borg/testsuite/crypto.py
--- a/borg/testsuite/crypto.py
+++ b/borg/testsuite/crypto.py
@@ -1,6 +1,7 @@
 from binascii import hexlify
 
 from ..crypto import AES, bytes_to_long, bytes_to_int, long_to_bytes
+from ..crypto import increment_iv, bytes16_to_int, int_to_bytes16
 from . import BaseTestCase
 
 
@@ -13,6 +14,27 @@ def test_bytes_to_long(self):
         self.assert_equal(bytes_to_long(b'\0\0\0\0\0\0\0\1'), 1)
         self.assert_equal(long_to_bytes(1), b'\0\0\0\0\0\0\0\1')
 
+    def test_bytes16_to_int(self):
+        self.assert_equal(bytes16_to_int(b'\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1'), 1)
+        self.assert_equal(int_to_bytes16(1), b'\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1')
+        self.assert_equal(bytes16_to_int(b'\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0'), 2 ** 64)
+        self.assert_equal(int_to_bytes16(2 ** 64), b'\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0')
+
+    def test_increment_iv(self):
+        iv0 = b'\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0'
+        iv1 = b'\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1'
+        iv2 = b'\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2'
+        self.assert_equal(increment_iv(iv0, 0), iv0)
+        self.assert_equal(increment_iv(iv0, 1), iv1)
+        self.assert_equal(increment_iv(iv0, 2), iv2)
+        iva = b'\0\0\0\0\0\0\0\0\xff\xff\xff\xff\xff\xff\xff\xff'
+        ivb = b'\0\0\0\0\0\0\0\1\x00\x00\x00\x00\x00\x00\x00\x00'
+        ivc = b'\0\0\0\0\0\0\0\1\x00\x00\x00\x00\x00\x00\x00\x01'
+        self.assert_equal(increment_iv(iva, 0), iva)
+        self.assert_equal(increment_iv(iva, 1), ivb)
+        self.assert_equal(increment_iv(iva, 2), ivc)
+        self.assert_equal(increment_iv(iv0, 2**64), ivb)
+
     def test_aes(self):
         key = b'X' * 32
         data = b'foo' * 10


Test patch: