From 9d5efa309a3f959d42edb53ff3d8d4af34ce4398 Mon Sep 17 00:00:00 2001
From: synqa <synqa@socket.moe>
Date: Wed, 10 Jun 2026 14:36:23 +0900
Subject: [PATCH 1/4] Add CI for LibreSSL

When libressl-dev package is installed on Alpine Linux, LibreSSL is used
by default.
---
 .github/workflows/libressl.yml | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 .github/workflows/libressl.yml

diff --git a/.github/workflows/libressl.yml b/.github/workflows/libressl.yml
new file mode 100644
index 00000000..3ed27413
--- /dev/null
+++ b/.github/workflows/libressl.yml
@@ -0,0 +1,31 @@
+name: LibreSSL
+
+on: [push, pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  libressl:
+    runs-on: ubuntu-latest
+    container:
+      image: alpine:latest
+
+    steps:
+      - name: Install dependencies
+        run: apk add binutils --no-cache build-base git readline-dev libressl-dev ncurses-dev git cmake zlib-dev libsodium-dev gnu-libiconv
+
+      - uses: actions/checkout@v6
+        with:
+          submodules: true
+
+      - name: Configure
+        run: ./configure
+
+      - name: Make
+        run: make -j $(nproc)  -C build
+
+      - name: Test
+        run: |
+          .ci/memory-leak-test.sh
+          .ci/vpntools-check.sh

From 576a627e60fe46f8f6b0e5b04561c3218aa8ae13 Mon Sep 17 00:00:00 2001
From: synqa <synqa@socket.moe>
Date: Wed, 10 Jun 2026 15:28:14 +0900
Subject: [PATCH 2/4] Rename env_md_st to evp_md_st for LibreSSL above v3.8.1

Upstream changed on ccf80370e13df3645f5a40674dded2e94f8cb0e9.
---
 src/Mayaqua/Encrypt.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Mayaqua/Encrypt.h b/src/Mayaqua/Encrypt.h
index 642e2081..a9f39b40 100644
--- a/src/Mayaqua/Encrypt.h
+++ b/src/Mayaqua/Encrypt.h
@@ -129,7 +129,7 @@
 // Macro
 #define	HASHED_DATA(p)			(((UCHAR *)p) + 15)
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)) || LIBRESSL_VERSION_NUMBER >= 0x3080100L
 typedef struct PKCS12_st PKCS12;
 typedef struct evp_md_st EVP_MD;
 #else

From 3fda39dc457af77e751715c60313cc90a0af3dde Mon Sep 17 00:00:00 2001
From: synqa <synqa@socket.moe>
Date: Wed, 10 Jun 2026 16:05:53 +0900
Subject: [PATCH 3/4] Support security level API on LibreSSL above v3.6.0

See:
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.0-relnotes.txt
---
 src/Mayaqua/Network.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/Mayaqua/Network.c b/src/Mayaqua/Network.c
index 990ced79..7d57ff06 100644
--- a/src/Mayaqua/Network.c
+++ b/src/Mayaqua/Network.c
@@ -11852,7 +11852,7 @@ bool StartSSLEx3(SOCK *sock, X *x, K *priv, LIST *chain, UINT ssl_timeout, char
 			}
 		}
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)) ||  LIBRESSL_VERSION_NUMBER >= 0x3060000L
 		if (sock->SslAcceptSettings.Override_Security_Level)
 		{
 			SSL_CTX_set_security_level(ssl_ctx, sock->SslAcceptSettings.Override_Security_Level_Value);
@@ -16262,7 +16262,7 @@ UINT GetOSSecurityLevel()
 	}
 
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)) || LIBRESSL_VERSION_NUMBER >= 0x3060000L
 	security_level_new = SSL_CTX_get_security_level(ctx);
 #endif
 

From bfcb6788a79c4ad479dfb569e716311924228692 Mon Sep 17 00:00:00 2001
From: synqa <synqa@socket.moe>
Date: Wed, 10 Jun 2026 16:27:54 +0900
Subject: [PATCH 4/4] Support SSL_get1_supported_ciphers() on LibreSSL above
 v2.9.1

Upstream changed on add79fb32686c1e8baf10def36ae00f8ab91a52b.
---
 src/Mayaqua/Network.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Mayaqua/Network.c b/src/Mayaqua/Network.c
index 7d57ff06..0ea87fee 100644
--- a/src/Mayaqua/Network.c
+++ b/src/Mayaqua/Network.c
@@ -16346,7 +16346,7 @@ TOKEN_LIST *GetCipherList()
 		return ciphers;
 	}
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)) || LIBRESSL_VERSION_NUMBER >= 0x2090100L
 	sk = SSL_get1_supported_ciphers(ssl);
 #else
 	sk = SSL_get_ciphers(ssl);