From 45356e85e148f40d4111ce9b101aeae1d5954c88 Mon Sep 17 00:00:00 2001
From: rdb <git@rdb.name>
Date: Sun, 25 Dec 2016 11:48:38 +0100
Subject: [PATCH] Backward compat with older OpenSSL versions

---
 dtool/src/prc/encryptStreamBuf.cxx  | 27 +++++++--------------------
 panda/src/downloader/httpClient.cxx |  8 ++++++++
 2 files changed, 15 insertions(+), 20 deletions(-)

diff --git a/dtool/src/prc/encryptStreamBuf.cxx b/dtool/src/prc/encryptStreamBuf.cxx
index fed8b8e7b6..6cb0ee6b39 100644
--- a/dtool/src/prc/encryptStreamBuf.cxx
+++ b/dtool/src/prc/encryptStreamBuf.cxx
@@ -111,6 +111,11 @@ open_read(istream *source, bool owns_source, const string &password) {
   _source = source;
   _owns_source = owns_source;
 
+  if (_read_ctx != NULL) {
+    EVP_CIPHER_CTX_free(_read_ctx);
+    _read_ctx = NULL;
+  }
+
   // Now read the header information.
   StreamReader sr(_source, false);
   int nid = sr.get_uint16();
@@ -122,11 +127,6 @@ open_read(istream *source, bool owns_source, const string &password) {
   if (cipher == NULL) {
     prc_cat.error()
       << "Unknown encryption algorithm in stream.\n";
-
-    if (_read_ctx != NULL) {
-      EVP_CIPHER_CTX_free(_read_ctx);
-      _read_ctx = NULL;
-    }
     return;
   }
 
@@ -147,11 +147,7 @@ open_read(istream *source, bool owns_source, const string &password) {
 
   string iv = sr.extract_bytes(iv_length);
 
-  if (_read_ctx != NULL) {
-    EVP_CIPHER_CTX_reset(_read_ctx);
-  } else {
-    _read_ctx = EVP_CIPHER_CTX_new();
-  }
+  _read_ctx = EVP_CIPHER_CTX_new();
   nassertv(_read_ctx != NULL);
 
   // Initialize the context
@@ -228,11 +224,6 @@ open_write(ostream *dest, bool owns_dest, const string &password) {
   if (cipher == NULL) {
     prc_cat.error()
       << "Unknown encryption algorithm: " << _algorithm << "\n";
-
-    if (_write_ctx != NULL) {
-      EVP_CIPHER_CTX_free(_write_ctx);
-      _write_ctx = NULL;
-    }
     return;
   }
 
@@ -246,11 +237,7 @@ open_write(ostream *dest, bool owns_dest, const string &password) {
   unsigned char *iv = (unsigned char *)alloca(iv_length);
   RAND_pseudo_bytes(iv, iv_length);
 
-  if (_read_ctx != NULL) {
-    EVP_CIPHER_CTX_reset(_write_ctx);
-  } else {
-    _write_ctx = EVP_CIPHER_CTX_new();
-  }
+  _write_ctx = EVP_CIPHER_CTX_new();
   nassertv(_write_ctx != NULL);
 
   int result;
diff --git a/panda/src/downloader/httpClient.cxx b/panda/src/downloader/httpClient.cxx
index f1ae5d7e7c..63ba1c6258 100644
--- a/panda/src/downloader/httpClient.cxx
+++ b/panda/src/downloader/httpClient.cxx
@@ -232,6 +232,12 @@ operator = (const HTTPClient &copy) {
 HTTPClient::
 ~HTTPClient() {
   if (_ssl_ctx != (SSL_CTX *)NULL) {
+#if OPENSSL_VERSION_NUMBER < 0x10100000
+    // Before we can free the context, we must remove the X509_STORE pointer
+    // from it, so it won't be destroyed along with it (this object is shared
+    // among all contexts).
+    _ssl_ctx->cert_store = NULL;
+#endif
     SSL_CTX_free(_ssl_ctx);
   }
 
@@ -1119,9 +1125,11 @@ get_ssl_ctx() {
   sslw->notify_ssl_errors();
 
   X509_STORE *store = sslw->get_x509_store();
+#if OPENSSL_VERSION_NUMBER >= 0x10100000
   if (store != NULL) {
     X509_STORE_up_ref(store);
   }
+#endif
   SSL_CTX_set_cert_store(_ssl_ctx, store);
 
   return _ssl_ctx;