.if ${SSL_DEFAULT:Mlibressl*}

WARNING=	Building with LibreSSL will disable PSK functionality\

		necessitating the use of certificates for authentication.

SUB_LIST=	LIBRESSL_MSG="${PORTNAME} was built with LibreSSL which\

		lacks PSK functionality. You must use certificates for\

		authentication."

.endif

--- src/libs/zbxcrypto/tls.c.orig	2016-12-21 08:08:40 UTC

+++ src/libs/zbxcrypto/tls.c

@@ -54,7 +54,8 @@

 #	define ZBX_TLS_CIPHERSUITE_ALL	2			/* select ciphersuites with certificate and PSK */

 #endif

-#if defined(HAVE_OPENSSL) && OPENSSL_VERSION_NUMBER < 0x1010000fL	/* for OpenSSL 1.0.1/1.0.2 (before 1.1.0) */

+#if defined(HAVE_OPENSSL) && OPENSSL_VERSION_NUMBER < 0x1010000fL \

+	|| defined(LIBRESSL_VERSION_NUMBER)	/* for OpenSSL 1.0.1/1.0.2 (before 1.1.0) */

 /* mutexes for multi-threaded OpenSSL (see "man 3ssl threads" and example in crypto/threads/mttest.c) */

@@ -178,8 +179,10 @@ extern char				*CONFIG_TLS_SERVER_CERT_I

 extern char				*CONFIG_TLS_SERVER_CERT_SUBJECT;

 extern char				*CONFIG_TLS_CERT_FILE;

 extern char				*CONFIG_TLS_KEY_FILE;

+#ifndef OPENSSL_NO_PSK

 extern char				*CONFIG_TLS_PSK_IDENTITY;

 extern char				*CONFIG_TLS_PSK_FILE;

+#endif

 ZBX_THREAD_LOCAL static char		*my_psk_identity	= NULL;

 ZBX_THREAD_LOCAL static size_t		my_psk_identity_len	= 0;

@@ -216,11 +219,13 @@ ZBX_THREAD_LOCAL static const SSL_METHOD

 ZBX_THREAD_LOCAL static SSL_CTX			*ctx_cert		= NULL;

 ZBX_THREAD_LOCAL static SSL_CTX			*ctx_psk		= NULL;

 ZBX_THREAD_LOCAL static SSL_CTX			*ctx_all		= NULL;

+#ifndef OPENSSL_NO_PSK

 /* variables for passing required PSK identity and PSK info to client callback function */

 ZBX_THREAD_LOCAL static char			*psk_identity_for_cb	= NULL;

 ZBX_THREAD_LOCAL static size_t			psk_identity_len_for_cb	= 0;

 ZBX_THREAD_LOCAL static char			*psk_for_cb		= NULL;

 ZBX_THREAD_LOCAL static size_t			psk_len_for_cb		= 0;

+#endif

 static int					init_done 		= 0;

 /* buffer for messages produced by zbx_openssl_info_cb() */

 ZBX_THREAD_LOCAL char				info_buf[256];

@@ -532,11 +537,13 @@ static const char	*zbx_tls_parameter_nam

 	if (&CONFIG_TLS_KEY_FILE == param)

 		return ZBX_TLS_PARAMETER_CONFIG_FILE == type ? "TLSKeyFile" : "--tls-key-file";

+#ifndef OPENSSL_NO_PSK

 	if (&CONFIG_TLS_PSK_IDENTITY == param)

 		return ZBX_TLS_PARAMETER_CONFIG_FILE == type ? "TLSPSKIdentity" : "--tls-psk-identity";

 	if (&CONFIG_TLS_PSK_FILE == param)

 		return ZBX_TLS_PARAMETER_CONFIG_FILE == type ? "TLSPSKFile" : "--tls-psk-file";

+#endif

 	THIS_SHOULD_NEVER_HAPPEN;

@@ -742,8 +749,10 @@ void	zbx_tls_validate_config(void)

 	zbx_tls_parameter_not_empty(&CONFIG_TLS_SERVER_CERT_SUBJECT);

 	zbx_tls_parameter_not_empty(&CONFIG_TLS_CERT_FILE);

 	zbx_tls_parameter_not_empty(&CONFIG_TLS_KEY_FILE);

+#ifndef OPENSSL_NO_PSK

 	zbx_tls_parameter_not_empty(&CONFIG_TLS_PSK_IDENTITY);

 	zbx_tls_parameter_not_empty(&CONFIG_TLS_PSK_FILE);

+#endif

 	/* parse and validate 'TLSConnect' parameter (in zabbix_proxy.conf, zabbix_agentd.conf) and '--tls-connect' */

 	/* parameter (in zabbix_get and zabbix_sender) */

@@ -756,8 +765,10 @@ void	zbx_tls_validate_config(void)

 			configured_tls_connect_mode = ZBX_TCP_SEC_UNENCRYPTED;

 		else if (0 == strcmp(CONFIG_TLS_CONNECT, ZBX_TCP_SEC_TLS_CERT_TXT))

 			configured_tls_connect_mode = ZBX_TCP_SEC_TLS_CERT;

+#ifndef OPENSSL_NO_PSK

 		else if (0 == strcmp(CONFIG_TLS_CONNECT, ZBX_TCP_SEC_TLS_PSK_TXT))

 			configured_tls_connect_mode = ZBX_TCP_SEC_TLS_PSK;

+#endif

 		else

 			zbx_tls_validation_error(ZBX_TLS_VALIDATION_INVALID, &CONFIG_TLS_CONNECT, NULL);

 	}

@@ -785,8 +796,10 @@ void	zbx_tls_validate_config(void)

 				accept_modes_tmp |= ZBX_TCP_SEC_UNENCRYPTED;

 			else if (0 == strcmp(p, ZBX_TCP_SEC_TLS_CERT_TXT))

 				accept_modes_tmp |= ZBX_TCP_SEC_TLS_CERT;

+#ifndef OPENSSL_NO_PSK

 			else if (0 == strcmp(p, ZBX_TCP_SEC_TLS_PSK_TXT))

 				accept_modes_tmp |= ZBX_TCP_SEC_TLS_PSK;

+#endif

 			else

 			{

 				zbx_free(s);

@@ -841,6 +854,7 @@ void	zbx_tls_validate_config(void)

 				&CONFIG_TLS_CERT_FILE);

 	}

+#ifndef OPENSSL_NO_PSK

 	/* either both a PSK and a PSK identity must be defined or none of them */

 	if (NULL != CONFIG_TLS_PSK_FILE && NULL == CONFIG_TLS_PSK_IDENTITY)

@@ -852,6 +866,7 @@ void	zbx_tls_validate_config(void)

 	/* PSK identity must be a valid UTF-8 string (RFC 4279 says Unicode) */

 	if (NULL != CONFIG_TLS_PSK_IDENTITY && SUCCEED != zbx_is_utf8(CONFIG_TLS_PSK_IDENTITY))

 		zbx_tls_validation_error(ZBX_TLS_VALIDATION_UTF8, &CONFIG_TLS_PSK_IDENTITY, NULL);

+#endif

 	/* active agentd, active proxy, zabbix_get, and zabbix_sender specific validation */

@@ -867,11 +882,13 @@ void	zbx_tls_validate_config(void)

 					&CONFIG_TLS_CONNECT);

 		}

+#ifndef OPENSSL_NO_PSK

 		if (NULL != CONFIG_TLS_PSK_FILE && NULL == CONFIG_TLS_CONNECT)

 		{

 			zbx_tls_validation_error(ZBX_TLS_VALIDATION_DEPENDENCY, &CONFIG_TLS_PSK_FILE,

 					&CONFIG_TLS_CONNECT);

 		}

+#endif

 		if (0 != (configured_tls_connect_mode & ZBX_TCP_SEC_TLS_CERT) && NULL == CONFIG_TLS_CERT_FILE)

 		{

@@ -879,11 +896,13 @@ void	zbx_tls_validate_config(void)

 					&CONFIG_TLS_CERT_FILE);

 		}

+#ifndef OPENSSL_NO_PSK

 		if (0 != (configured_tls_connect_mode & ZBX_TCP_SEC_TLS_PSK) && NULL == CONFIG_TLS_PSK_FILE)

 		{

 			zbx_tls_validation_error(ZBX_TLS_VALIDATION_REQUIREMENT, &CONFIG_TLS_CONNECT,

 					&CONFIG_TLS_PSK_FILE);

 		}

+#endif

 	}

 	/* passive agentd and passive proxy specific validation */

@@ -899,11 +918,13 @@ void	zbx_tls_validate_config(void)

 					&CONFIG_TLS_ACCEPT);

 		}

+#ifndef OPENSSL_NO_PSK

 		if (NULL != CONFIG_TLS_PSK_FILE && NULL == CONFIG_TLS_ACCEPT)

 		{

 			zbx_tls_validation_error(ZBX_TLS_VALIDATION_DEPENDENCY, &CONFIG_TLS_PSK_FILE,

 					&CONFIG_TLS_ACCEPT);

 		}

+#endif

 		if (0 != (configured_tls_accept_modes & ZBX_TCP_SEC_TLS_CERT) && NULL == CONFIG_TLS_CERT_FILE)

 		{

@@ -911,11 +932,13 @@ void	zbx_tls_validate_config(void)

 					&CONFIG_TLS_CERT_FILE);

 		}

+#ifndef OPENSSL_NO_PSK

 		if (0 != (configured_tls_accept_modes & ZBX_TCP_SEC_TLS_PSK) && NULL == CONFIG_TLS_PSK_FILE)

 		{

 			zbx_tls_validation_error(ZBX_TLS_VALIDATION_REQUIREMENT, &CONFIG_TLS_ACCEPT,

 					&CONFIG_TLS_PSK_FILE);

 		}

+#endif

 	}

 }

 #endif	/* defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || defined(HAVE_OPENSSL) */

@@ -1363,6 +1386,7 @@ static int	zbx_psk_cb(gnutls_session_t s

  *     by this callback function. We use global variables to pass this info.  *

  *                                                                            *

  ******************************************************************************/

+#ifndef OPENSSL_NO_PSK

 static unsigned int	zbx_psk_client_cb(SSL *ssl, const char *hint, char *identity,

 		unsigned int max_identity_len, unsigned char *psk, unsigned int max_psk_len)

 {

@@ -1396,6 +1420,7 @@ static unsigned int	zbx_psk_client_cb(SS

 	return (unsigned int)psk_len_for_cb;

 }

+#endif

 /******************************************************************************

  *                                                                            *

@@ -1529,6 +1554,7 @@ static void	zbx_check_psk_identity_len(s

  *     at runtime.                                                            *

  *                                                                            *

  ******************************************************************************/

+#ifndef OPENSSL_NO_PSK

 static void	zbx_read_psk_file(void)

 {

 	FILE		*f;

@@ -1593,6 +1619,7 @@ out:

 	zbx_tls_free();

 	exit(EXIT_FAILURE);

 }

+#endif /* OPENSSL_NO_PSK */

 #endif

 #if defined(HAVE_POLARSSL)

@@ -3152,6 +3179,7 @@ void	zbx_tls_init_child(void)

 	/* Create context for PSK-only authentication. PSK can come from configuration file (in proxy, agentd) */

 	/* and later from database (in server, proxy). */

+#ifndef OPENSSL_NO_PSK

 	if (NULL != CONFIG_TLS_PSK_FILE || 0 != (program_type & (ZBX_PROGRAM_TYPE_SERVER | ZBX_PROGRAM_TYPE_PROXY)))

 	{

 		if (NULL == (ctx_psk = SSL_CTX_new(method)))

@@ -3160,6 +3188,7 @@ void	zbx_tls_init_child(void)

 		if (1 != SSL_CTX_set_min_proto_version(ctx_psk, TLS1_2_VERSION))

 			goto out_method;

 	}

+#endif

 	/* Sometimes we need to be ready for both certificate and PSK whichever comes in. Set up a universal context */

 	/* for certificate and PSK authentication to prepare for both. */

@@ -3314,6 +3343,7 @@ void	zbx_tls_init_child(void)

 	/* 'TLSPSKIdentity' and 'TLSPSKFile' parameters (in zabbix_proxy.conf, zabbix_agentd.conf). */

 	/*  Load pre-shared key and identity to be used with the pre-shared key. */

+#ifndef OPENSSL_NO_PSK

 	if (NULL != CONFIG_TLS_PSK_FILE)

 	{

 		my_psk_identity = CONFIG_TLS_PSK_IDENTITY;

@@ -3339,6 +3369,7 @@ void	zbx_tls_init_child(void)

 		psk_for_cb = my_psk;

 		psk_len_for_cb = my_psk_len;

 	}

+#endif

 	if (NULL != ctx_cert)

 	{

@@ -3375,6 +3406,7 @@ void	zbx_tls_init_child(void)

 		zbx_log_ciphersuites(__function_name, "certificate", ctx_cert);

 	}

+#ifndef OPENSSL_NO_PSK

 	if (NULL != ctx_psk)

 	{

 		const char	*ciphers;

@@ -3408,6 +3440,7 @@ void	zbx_tls_init_child(void)

 		zbx_log_ciphersuites(__function_name, "PSK", ctx_psk);

 	}

+#endif

 	if (NULL != ctx_all)

 	{

@@ -3415,8 +3448,10 @@ void	zbx_tls_init_child(void)

 		SSL_CTX_set_info_callback(ctx_all, zbx_openssl_info_cb);

+#ifndef OPENSSL_NO_PSK

 		if (0 != (program_type & (ZBX_PROGRAM_TYPE_SERVER | ZBX_PROGRAM_TYPE_PROXY | ZBX_PROGRAM_TYPE_AGENTD)))

 			SSL_CTX_set_psk_server_callback(ctx_all, zbx_psk_server_cb);

+#endif

 		SSL_CTX_set_mode(ctx_all, SSL_MODE_AUTO_RETRY);

 		SSL_CTX_set_options(ctx_all, SSL_OP_CIPHER_SERVER_PREFERENCE | SSL_OP_NO_TICKET);

@@ -4188,6 +4223,7 @@ int	zbx_tls_connect(zbx_socket_t *s, uns

 			goto out;

 		}

 	}

+#ifndef OPENSSL_NO_PSK

 	else if (ZBX_TCP_SEC_TLS_PSK == tls_connect)

 	{

 		zabbix_log(LOG_LEVEL_DEBUG, "In %s(): psk_identity:\"%s\"", __function_name,

@@ -4242,6 +4278,7 @@ int	zbx_tls_connect(zbx_socket_t *s, uns

 			psk_len_for_cb = (size_t)psk_len;

 		}

 	}

+#endif

 	else

 	{

 		*error = zbx_strdup(*error, "invalid connection parameters");

@@ -5675,7 +5712,8 @@ int	zbx_tls_get_attr_cert(const zbx_sock

 }

 #endif

-#if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || defined(HAVE_OPENSSL)

+#if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) \

+	|| (defined(HAVE_OPENSSL) && !defined(OPENSSL_NO_PSK))

 /******************************************************************************

  *                                                                            *

  * Function: zbx_tls_get_attr_psk                                             *

--- src/libs/zbxcrypto/tls.h.orig	2016-12-21 08:08:40 UTC

+++ src/libs/zbxcrypto/tls.h

@@ -60,11 +60,13 @@ typedef struct

 	gnutls_priority_t			ciphersuites_psk;

 #elif defined(HAVE_OPENSSL)

 	SSL_CTX			*ctx_cert;

+#ifndef OPENSSL_NO_PSK

 	SSL_CTX			*ctx_psk;

 	char			*psk_identity_for_cb;

 	size_t			psk_identity_len_for_cb;

 	char			*psk_for_cb;

 	size_t			psk_len_for_cb;

+#endif /* OPENSSL_NO_PSKOPENSSL_NO_PSK */

 #endif

 }

 ZBX_THREAD_SENDVAL_TLS_ARGS;

--- src/libs/zbxdbcache/dbconfig.c.orig	2016-12-21 08:08:40 UTC

+++ src/libs/zbxdbcache/dbconfig.c

@@ -33,6 +33,7 @@

 #include "zbxregexp.h"

 #include "cfg.h"

 #include "../zbxcrypto/tls_tcp_active.h"

+#include <openssl/opensslconf.h>

 static int	sync_in_progress = 0;

@@ -273,7 +274,8 @@ ZBX_DC_CALCITEM;

 typedef zbx_item_history_value_t	ZBX_DC_DELTAITEM;

-#if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || defined(HAVE_OPENSSL)

+#if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || \

+	(defined(HAVE_OPENSSL) && !defined(OPENSSL_NO_PSK))

 typedef struct

 {

 	const char	*tls_psk_identity;	/* pre-shared key identity           */

@@ -321,7 +323,9 @@ typedef struct

 #if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || defined(HAVE_OPENSSL)

 	const char	*tls_issuer;

 	const char	*tls_subject;

+#ifndef OPENSSL_NO_PSK

 	ZBX_DC_PSK	*tls_dc_psk;

+#endif /* OPENSSL_NO_PSK */

 #endif

 	const char	*error;

 	const char	*snmp_error;

@@ -1370,7 +1374,8 @@ static void	DCsync_hosts(DB_RESULT resul

 	time_t			now;

 	signed char		ipmi_authtype;

 	unsigned char		ipmi_privilege;

-#if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || defined(HAVE_OPENSSL)

+#if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || \

+	(defined(HAVE_OPENSSL) && !defined(OPENSSL_NO_PSK))

 	ZBX_DC_PSK		*psk_i, psk_i_local;

 	zbx_ptr_pair_t		*psk_owner, psk_owner_local;

 	zbx_hashset_t		psk_owners;

@@ -1380,7 +1385,8 @@ static void	DCsync_hosts(DB_RESULT resul

 	zbx_vector_uint64_create(&ids);

 	zbx_vector_uint64_reserve(&ids, config->hosts.num_data + 32);

-#if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || defined(HAVE_OPENSSL)

+#if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || \

+	(defined(HAVE_OPENSSL) && !defined(OPENSSL_NO_PSK))

 	zbx_hashset_create(&psk_owners, 0, ZBX_DEFAULT_PTR_HASH_FUNC, ZBX_DEFAULT_PTR_COMPARE_FUNC);

 #endif

 	now = time(NULL);

@@ -1523,7 +1529,7 @@ static void	DCsync_hosts(DB_RESULT resul

 		/*                               done                                        */

 		/*                                                                           */

 		/*****************************************************************************/

-

+#ifndef OPENSSL_NO_PSK

 		psk_owner = NULL;

 		if ('\0' == *row[33] || '\0' == *row[34])	/* new PSKid or value empty */

@@ -1645,6 +1651,7 @@ done:

 				zbx_hashset_insert(&psk_owners, &psk_owner_local, sizeof(psk_owner_local));

 			}

 		}

+#endif /* OPENSSL_NO_PSK */

 #endif

 		ZBX_STR2UCHAR(host->tls_connect, row[29]);

 		ZBX_STR2UCHAR(host->tls_accept, row[30]);

@@ -1841,6 +1848,7 @@ done:

 		zbx_strpool_release(host->tls_issuer);

 		zbx_strpool_release(host->tls_subject);

+#ifndef OPENSSL_NO_PSK

 		/* Maintain 'psks' index. Unlink and delete the PSK identity. */

 		if (NULL != host->tls_dc_psk)

 		{

@@ -1854,13 +1862,15 @@ done:

 				zbx_hashset_remove_direct(&config->psks, psk_i);

 			}

 		}

+#endif /* OPENSSL_NO_PSK */

 #endif

 		zbx_hashset_iter_remove(&iter);

 	}

 	zbx_vector_uint64_destroy(&ids);

-#if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || defined(HAVE_OPENSSL)

+#if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || \

+	(defined(HAVE_OPENSSL) && !defined(OPENSSL_NO_PSK))

 	zbx_hashset_destroy(&psk_owners);

 #endif

 	zabbix_log(LOG_LEVEL_DEBUG, "End of %s()", __function_name);

@@ -5169,7 +5179,8 @@ static int	__config_regexp_compare(const

 	return r1->name == r2->name ? 0 : strcmp(r1->name, r2->name);

 }

-#if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || defined(HAVE_OPENSSL)

+#if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || \

+	(defined(HAVE_OPENSSL) && !defined(OPENSSL_NO_PSK))

 static zbx_hash_t	__config_psk_hash(const void *data)

 {

 	const ZBX_DC_PSK	*psk_i = (const ZBX_DC_PSK *)data;

@@ -5284,7 +5295,8 @@ void	init_configuration_cache(void)

 	CREATE_HASHSET_EXT(config->interface_snmpaddrs, 0, __config_interface_addr_hash, __config_interface_addr_compare);

 	CREATE_HASHSET_EXT(config->regexps, 0, __config_regexp_hash, __config_regexp_compare);

-#if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || defined(HAVE_OPENSSL)

+#if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || \

+	(defined(HAVE_OPENSSL) && !defined(OPENSSL_NO_PSK))

 	CREATE_HASHSET_EXT(config->psks, 0, __config_psk_hash, __config_psk_compare);

 #endif

 	for (i = 0; i < CONFIG_TIMER_FORKS; i++)

@@ -5473,6 +5485,7 @@ static void	DCget_host(DC_HOST *dst_host

 	strscpy(dst_host->tls_issuer, src_host->tls_issuer);

 	strscpy(dst_host->tls_subject, src_host->tls_subject);

+#ifndef OPENSSL_NO_PSK

 	if (NULL == src_host->tls_dc_psk)

 	{

 		*dst_host->tls_psk_identity = '\0';

@@ -5483,6 +5496,7 @@ static void	DCget_host(DC_HOST *dst_host

 		strscpy(dst_host->tls_psk_identity, src_host->tls_dc_psk->tls_psk_identity);

 		strscpy(dst_host->tls_psk, src_host->tls_dc_psk->tls_psk);

 	}

+#endif /* OPENSSL_NO_PSK */

 #endif

 	if (NULL != (ipmihost = zbx_hashset_search(&config->ipmihosts, &src_host->hostid)))

 	{

@@ -5573,6 +5587,7 @@ int	DCcheck_proxy_permissions(const char

 			return FAIL;

 		}

 	}

+#ifndef OPENSSL_NO_PSK

 	else if (ZBX_TCP_SEC_TLS_PSK == sock->connection_type)

 	{

 		if (SUCCEED != zbx_tls_get_attr_psk(sock, &attr))

@@ -5582,6 +5597,7 @@ int	DCcheck_proxy_permissions(const char

 			return FAIL;

 		}

 	}

+#endif

 	else if (ZBX_TCP_SEC_UNENCRYPTED != sock->connection_type)

 	{

 		*error = zbx_strdup(*error, "internal error: invalid connection type");

@@ -5632,6 +5648,7 @@ int	DCcheck_proxy_permissions(const char

 			return FAIL;

 		}

 	}

+#ifndef OPENSSL_NO_PSK

 	else if (ZBX_TCP_SEC_TLS_PSK == sock->connection_type)

 	{

 		if (NULL != dc_host->tls_dc_psk)

@@ -5653,6 +5670,7 @@ int	DCcheck_proxy_permissions(const char

 			return FAIL;

 		}

 	}

+#endif /* OPENSSL_NO_PSK */

 #endif

 	*hostid = dc_host->hostid;

@@ -5661,7 +5679,8 @@ int	DCcheck_proxy_permissions(const char

 	return SUCCEED;

 }

-#if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || defined(HAVE_OPENSSL)

+#if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || \

+	(defined(HAVE_OPENSSL) && !defined(OPENSSL_NO_PSK))

 /******************************************************************************

  *                                                                            *

  * Function: DCget_psk_by_identity                                            *

@@ -7987,11 +8006,13 @@ static void	DCget_proxy(DC_PROXY *dst_pr

 			strscpy(dst_proxy->tls_arg1, host->tls_issuer);

 			strscpy(dst_proxy->tls_arg2, host->tls_subject);

 		}

+#ifndef OPENSSL_NO_PSK

 		else if (ZBX_TCP_SEC_TLS_PSK == host->tls_connect && NULL != host->tls_dc_psk)

 		{

 			strscpy(dst_proxy->tls_arg1, host->tls_dc_psk->tls_psk_identity);

 			strscpy(dst_proxy->tls_arg2, host->tls_dc_psk->tls_psk);

 		}

+#endif /* OPENSSL_NO_PSK */

 		else	/* ZBX_TCP_SEC_UNENCRYPTED */

 #endif

 		{

--- src/libs/zbxdbhigh/proxy.c.orig	2016-12-21 08:08:41 UTC

+++ src/libs/zbxdbhigh/proxy.c

@@ -28,6 +28,7 @@

 #include "discovery.h"

 #include "zbxalgo.h"

 #include "../zbxcrypto/tls_tcp_active.h"

+#include <openssl/opensslconf.h>

 extern unsigned int	configured_tls_accept_modes;

@@ -2054,9 +2055,13 @@ void	process_mass_data(zbx_socket_t *soc

 #if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || defined(HAVE_OPENSSL)

 	if (0 == proxy_hostid &&

 			((ZBX_TCP_SEC_TLS_CERT == sock->connection_type &&

-				SUCCEED != zbx_tls_get_attr_cert(sock, &attr)) ||

-			(ZBX_TCP_SEC_TLS_PSK == sock->connection_type &&

-				SUCCEED != zbx_tls_get_attr_psk(sock, &attr))))

+				SUCCEED != zbx_tls_get_attr_cert(sock, &attr))

+#ifndef OPENSSL_NO_PSK

+			|| (ZBX_TCP_SEC_TLS_PSK == sock->connection_type &&

+				SUCCEED != zbx_tls_get_attr_psk(sock, &attr))

+#endif

+			)

+		)

 	{

 		THIS_SHOULD_NEVER_HAPPEN;

 		return;

--- src/zabbix_server/trapper/active.c.orig	2016-12-21 08:08:40 UTC

+++ src/zabbix_server/trapper/active.c

@@ -26,6 +26,7 @@

 #include "active.h"

 #include "../../libs/zbxcrypto/tls_tcp_active.h"

+#include <openssl/opensslconf.h>

 extern unsigned char	program_type;

@@ -131,6 +132,7 @@ static int	get_hostid_by_host(const zbx_

 					goto done;

 				}

 			}

+#ifndef OPENSSL_NO_PSK

 			else if (ZBX_TCP_SEC_TLS_PSK == sock->connection_type)

 			{

 				zbx_tls_conn_attr_t	attr;

@@ -151,6 +153,7 @@ static int	get_hostid_by_host(const zbx_

 					goto done;

 				}

 			}

+#endif /* OPENSSL_NO_PSK */

 #endif

 			ZBX_STR2UINT64(*hostid, row[0]);

--- src/zabbix_server/trapper/trapper.c.orig	2016-12-21 08:08:40 UTC

+++ src/zabbix_server/trapper/trapper.c

@@ -37,6 +37,7 @@

 #include "daemon.h"

 #include "../../libs/zbxcrypto/tls.h"

+#include <openssl/opensslconf.h>

 extern unsigned char	process_type, program_type;

 extern int		server_num, process_num;

@@ -677,8 +678,10 @@ ZBX_THREAD_ENTRY(trapper_thread, args)

 #if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || defined(HAVE_OPENSSL)

 	zbx_tls_init_child();

+#ifndef OPENSSL_NO_PSK

 	find_psk_in_cache = DCget_psk_by_identity;

 #endif

+#endif

 	zbx_setproctitle("%s #%d [connecting to the database]", get_process_type_string(process_type), process_num);

 	DBconnect(ZBX_DB_CONNECT_NORMAL);

%%LIBRESSL_MSG%%