From f03dc39ae891d20e56d7acd764a9b5764a8a2fef Mon Sep 17 00:00:00 2001
From: Denys Fedoryshchenko <denys.f@collabora.com>
Date: Wed, 26 Nov 2025 20:22:26 +0200
Subject: Suppress OpenSSL 3.0 deprecation warnings for legacy crypto APIs

We are using similar approach as in other projects, easiest one,
but probably in future it will break as soon as this functions
will be removed completely.

Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>
---
 accel-pppd/ctrl/sstp/sstp.c |  7 ++++++-
 accel-pppd/radius/packet.c  |  6 ++++++
 crypto/crypto.h             | 14 ++++++++++++++
 3 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/accel-pppd/ctrl/sstp/sstp.c b/accel-pppd/ctrl/sstp/sstp.c
index d63caa32..9239da30 100644
--- a/accel-pppd/ctrl/sstp/sstp.c
+++ b/accel-pppd/ctrl/sstp/sstp.c
@@ -20,8 +20,13 @@
 #include "linux_ppp.h"
 
 #ifdef CRYPTO_OPENSSL
+/*
+ * Suppress OpenSSL 3.0 deprecation warnings for DH API.
+ * See crypto.h for detailed explanation.
+ */
+#define OPENSSL_API_COMPAT 0x10100000L
 #include <openssl/ssl.h>
-#include <openssl/err.h> 
+#include <openssl/err.h>
 #endif
 
 #include "triton.h"
diff --git a/accel-pppd/radius/packet.c b/accel-pppd/radius/packet.c
index 0ef9a0e3..0bb64953 100644
--- a/accel-pppd/radius/packet.c
+++ b/accel-pppd/radius/packet.c
@@ -8,6 +8,12 @@
 #include <sys/mman.h>
 #include <linux/mman.h>
 #include <arpa/inet.h>
+
+/*
+ * Suppress OpenSSL 3.0 deprecation warnings for HMAC API.
+ * See crypto.h for detailed explanation.
+ */
+#define OPENSSL_API_COMPAT 0x10100000L
 #include <openssl/hmac.h>
 #include <openssl/evp.h>
 
diff --git a/crypto/crypto.h b/crypto/crypto.h
index 9e2e8401..45de740e 100644
--- a/crypto/crypto.h
+++ b/crypto/crypto.h
@@ -3,6 +3,20 @@
 
 #ifdef CRYPTO_OPENSSL
 
+/*
+ * Suppress OpenSSL 3.0 deprecation warnings for legacy crypto APIs.
+ * These low-level APIs (MD5, SHA1, DES, etc.) are deprecated in OpenSSL 3.0
+ * but still functional and required for protocol compatibility.
+ *
+ * This approach is consistent with other major projects:
+ * - FreeRADIUS: Uses OPENSSL_API_COMPAT for the same reason
+ * - OpenVPN: Uses OPENSSL_API_COMPAT to maintain legacy protocol support
+ *
+ * The deprecated functions will remain available in OpenSSL 3.x series.
+ * Migration to EVP API may be considered for future major versions.
+ */
+#define OPENSSL_API_COMPAT 0x10100000L
+
 #include <openssl/md4.h>
 #include <openssl/md5.h>
 #include <openssl/sha.h>
-- 
cgit v1.2.3