This is an automated email from the ASF dual-hosted git repository.
maskit pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficserver.git
The following commit(s) were added to refs/heads/master by this push:
new bdefaf97b6 Resolve OpenSSL 4.0 build issues (#13476)
bdefaf97b6 is described below
commit bdefaf97b6a00af1d6bcfe7f6ba810469fcfd69c
Author: Masakazu Kitajo <[email protected]>
AuthorDate: Wed Aug 5 10:26:21 2026 -0600
Resolve OpenSSL 4.0 build issues (#13476)
* Resolve OpenSSL 4.0 build issues - accessors for ASN1_STRING and
const-iness
* Ran clang-format to fix formatting
* Fix X509_NAME_get_index_by_NID const mismatch on OpenSSL 1.1.1
OpenSSL 1.1.1 declares the first argument as non-const while newer
releases declare it const, so building against different versions
failed depending on which signature was in effect. Add a const_cast
at each call site to keep the const-qualified variables introduced by
this PR buildable against both, matching the existing precedent in
OCSPStapling.cc.
* Drop const_cast in favor of auto for local X509_NAME variables
X509_get_subject_name and X509_NAME_get_index_by_NID have their
argument constness changed together across OpenSSL versions, so a
local variable declared with auto tracks whatever type is correct for
the OpenSSL version in use, without a cast. This applies only to the
two purely local variables; ts_util.cc ssl_value_for keeps its
const_cast since its parameter type is shared across multiple
callers.
* Fix const-cast style and X509_NAME leak flagged by Copilot review
X509HostnameValidator.cc cast ASN1_STRING_get0_data return value to
non-const before an ats_strndup call that only wants const char *;
drop the const instead of adding it back needlessly.
certifier.cc leaked the duplicated X509_NAME on the
X509_NAME_add_entry_by_txt failure path, and never checked
X509_NAME_dup for allocation failure.
* Make Cripts X509 accessors OpenSSL-4-compatible
CertBase::X509Value took hardcoded function pointer types for
X509_get_subject_name, X509_get_issuer_name, X509_getm_notBefore, and
X509_getm_notAfter, but those accessors change constness in different
directions across OpenSSL versions, so no single hardcoded signature
builds everywhere. Deduce the parameter type from the actual accessor
via decltype instead.
Signature::_load and _write_ip_address also read ASN1_STRING fields
directly, which breaks once the struct is opaque; switch to the
accessor functions used elsewhere in this codebase.
* Fix lua plugin X509_NAME/ASN1_STRING OpenSSL 4 compatibility
get_x509_name_string only reads through the name via
X509_NAME_print_ex, so accept a const X509_NAME * to match callers
that pass X509_get_subject_name/X509_get_issuer_name results
directly. get_x509_signature_string read the ASN1_STRING struct
fields directly, which breaks once the struct is opaque; use
ASN1_STRING_get0_data/ASN1_STRING_length instead.
* Fix self-signed test cert losing its CN under OpenSSL 4
make_cert_and_key mutated the X509_NAME returned by
X509_get_subject_name in place, which stops compiling once that
accessor can return const, and was already fragile since the
returned name is only a view into the certificate internal state.
Duplicate it, add the CN to the duplicate, and set it back as both
subject and issuer name since this is a self-signed certificate.
* Fix OpenSSL 4 X509_NAME const mismatches in example plugin and test tool
client_context_dump.cc, verify_cert.cc, and ssl_client_verify_test.cc
all held X509_get_subject_name/X509_NAME_get_entry/
X509_NAME_ENTRY_get_data results in hardcoded non-const locals or
parameters, which stops compiling once those accessors return const.
Switch to auto for the local variables and const for the
debug_certificate parameter, matching the read-only usage in each
case.
* Drop last const_cast in txn_box ssl_value_for via a template
ssl_value_for is shared by four callers, each already deducing its
X509_NAME pointer type with auto from X509_get_subject_name or
X509_get_issuer_name, so unlike the other three call sites fixed
earlier in this series, a single hardcoded parameter type cannot
track the underlying accessor across OpenSSL versions. Templating
the parameter on the callers deduced type removes the cast entirely.
* Alias the Cripts X509 getter decltypes for readability
Bare decltype(&X509_get_subject_name) in a parameter list reads
poorly at each of the four call sites; name each getter type once
via using so the declarations and out-of-line definitions just say
what kind of accessor they take.
* Adopt RAII and decltype(func(nullptr)) patterns from PR #13482
certifier.cc freed the duplicated X509_NAME manually on every path;
switch to a scoped_X509_NAME unique_ptr matching the file existing
scoped_X509/scoped_EVP_PKEY/scoped_SSL_CTX aliases so no path can
forget to free it.
ts_util.cc templated ssl_value_for just to defer the parameter type
to the caller; decltype(X509_get_subject_name(nullptr)) deduces the
same pointer type directly without turning it into a template.
Also drop the last C-style cast this series introduced in
X509HostnameValidator.cc in favor of reinterpret_cast.
---------
Co-authored-by: Jered Floyd <[email protected]>
---
.../client_context_dump/client_context_dump.cc | 2 +-
example/plugins/c-api/verify_cert/verify_cert.cc | 2 +-
include/cripts/Certs.hpp | 13 +++++++++----
plugins/certifier/certifier.cc | 21 +++++++++++++++------
.../cert_reporting_tool/cert_reporting_tool.cc | 2 +-
plugins/experimental/sslheaders/expand.cc | 8 ++++----
plugins/experimental/txn_box/plugin/src/ts_util.cc | 4 +++-
plugins/lua/ts_lua_client_cert_helpers.h | 11 +++++++----
src/api/InkAPI.cc | 6 +++---
src/cripts/Certs.cc | 16 ++++++++--------
src/iocore/net/OCSPStapling.cc | 8 ++++----
src/iocore/net/SSLNetVConnection.cc | 2 +-
src/iocore/net/SSLUtils.cc | 11 +++++------
src/iocore/net/unit_tests/test_SSLDHParams.cc | 5 ++++-
src/tscore/X509HostnameValidator.cc | 17 ++++++++---------
tests/tools/plugins/ssl_client_verify_test.cc | 10 +++++-----
16 files changed, 79 insertions(+), 59 deletions(-)
diff --git a/example/plugins/c-api/client_context_dump/client_context_dump.cc
b/example/plugins/c-api/client_context_dump/client_context_dump.cc
index f8572d775c..6dcb94919b 100644
--- a/example/plugins/c-api/client_context_dump/client_context_dump.cc
+++ b/example/plugins/c-api/client_context_dump/client_context_dump.cc
@@ -65,7 +65,7 @@ dump_context(const char *ca_path, const char *ck_path)
// expiration date, serial number, common name, and subject
alternative names
const ASN1_TIME *not_after = X509_get_notAfter(cert);
const ASN1_INTEGER *serial = X509_get_serialNumber(cert);
- X509_NAME *subject_name = X509_get_subject_name(cert);
+ auto *subject_name = X509_get_subject_name(cert);
// Subject name
BIO *subject_bio = BIO_new(BIO_s_mem());
diff --git a/example/plugins/c-api/verify_cert/verify_cert.cc
b/example/plugins/c-api/verify_cert/verify_cert.cc
index a3f553057f..4c3c75446e 100644
--- a/example/plugins/c-api/verify_cert/verify_cert.cc
+++ b/example/plugins/c-api/verify_cert/verify_cert.cc
@@ -37,7 +37,7 @@ namespace
DbgCtl dbg_ctl{PLUGIN_NAME};
static void
-debug_certificate(const char *msg, X509_NAME *name)
+debug_certificate(const char *msg, const X509_NAME *name)
{
BIO *bio;
diff --git a/include/cripts/Certs.hpp b/include/cripts/Certs.hpp
index f19fb8f41b..9b402a070e 100644
--- a/include/cripts/Certs.hpp
+++ b/include/cripts/Certs.hpp
@@ -107,10 +107,15 @@ public:
}
}
- void _load_name(X509_NAME *(*getter)(const X509 *)) const;
- void _load_integer(ASN1_INTEGER *(*getter)(X509 *)) const;
- void _load_long(long (*getter)(const X509 *)) const;
- void _load_time(ASN1_TIME *(*getter)(const X509 *)) const;
+ using NameGetter = decltype(&X509_get_subject_name);
+ using IntegerGetter = decltype(&X509_get_serialNumber);
+ using LongGetter = decltype(&X509_get_version);
+ using TimeGetter = decltype(&X509_get_notBefore);
+
+ void _load_name(NameGetter getter) const;
+ void _load_integer(IntegerGetter getter) const;
+ void _load_long(LongGetter getter) const;
+ void _load_time(TimeGetter getter) const;
CertBase *_owner = nullptr;
mutable std::unique_ptr<BIO, decltype(&BIO_free)> _bio{nullptr, BIO_free};
diff --git a/plugins/certifier/certifier.cc b/plugins/certifier/certifier.cc
index 563a39bd40..94a490c2fb 100644
--- a/plugins/certifier/certifier.cc
+++ b/plugins/certifier/certifier.cc
@@ -88,10 +88,11 @@ template <> struct default_delete<SSL_CTX> {
} // namespace std
/// Name aliases for unique pts to openSSL objects
-using scoped_X509 = std::unique_ptr<X509>;
-using scoped_X509_REQ = std::unique_ptr<X509_REQ>;
-using scoped_EVP_PKEY = std::unique_ptr<EVP_PKEY>;
-using scoped_SSL_CTX = std::unique_ptr<SSL_CTX>;
+using scoped_X509 = std::unique_ptr<X509>;
+using scoped_X509_REQ = std::unique_ptr<X509_REQ>;
+using scoped_EVP_PKEY = std::unique_ptr<EVP_PKEY>;
+using scoped_SSL_CTX = std::unique_ptr<SSL_CTX>;
+using scoped_X509_NAME = std::unique_ptr<X509_NAME, decltype(&X509_NAME_free)>;
class SslLRUList
{
@@ -401,12 +402,20 @@ mkcrt(const std::string &commonName, int serial)
X509_gmtime_adj(X509_get_notAfter(cert.get()), static_cast<long>(3650) * 24
* 3600);
// Get handle to subject name
- X509_NAME *n = X509_get_subject_name(cert.get());
+ scoped_X509_NAME n{X509_NAME_dup(X509_get_subject_name(cert.get())),
X509_NAME_free};
+ if (n == nullptr) {
+ TSError("[%s] %s: failed to duplicate certificate subject", PLUGIN_NAME,
__func__);
+ return nullptr;
+ }
// Set common name field
- if (X509_NAME_add_entry_by_txt(n, "CN", MBSTRING_ASC, (unsigned char
*)commonName.c_str(), -1, -1, 0) != 1) {
+ if (X509_NAME_add_entry_by_txt(n.get(), "CN", MBSTRING_ASC, (unsigned char
*)commonName.c_str(), -1, -1, 0) != 1) {
TSError("[%s] %s: failed to add certificate subject CN", PLUGIN_NAME,
__func__);
return nullptr;
}
+ if (X509_set_subject_name(cert.get(), n.get()) != 1) {
+ TSError("[%s] %s: failed to set certificate subject", PLUGIN_NAME,
__func__);
+ return nullptr;
+ }
// Set Traffic Server public key
if (X509_set_pubkey(cert.get(), ca_pkey_scoped.get()) == 0) {
diff --git a/plugins/experimental/cert_reporting_tool/cert_reporting_tool.cc
b/plugins/experimental/cert_reporting_tool/cert_reporting_tool.cc
index fd1d49f148..3613508890 100644
--- a/plugins/experimental/cert_reporting_tool/cert_reporting_tool.cc
+++ b/plugins/experimental/cert_reporting_tool/cert_reporting_tool.cc
@@ -65,7 +65,7 @@ dump_context(const char *ca_path, const char *ck_path)
// expiration date, serial number, common name, and subject
alternative names
const ASN1_TIME *not_after = X509_get_notAfter(cert);
const ASN1_INTEGER *serial = X509_get_serialNumber(cert);
- X509_NAME *subject_name = X509_get_subject_name(cert);
+ const X509_NAME *subject_name = X509_get_subject_name(cert);
// Subject name
BIO *subject_bio = BIO_new(BIO_s_mem());
diff --git a/plugins/experimental/sslheaders/expand.cc
b/plugins/experimental/sslheaders/expand.cc
index f6a8a0c754..cbba659424 100644
--- a/plugins/experimental/sslheaders/expand.cc
+++ b/plugins/experimental/sslheaders/expand.cc
@@ -49,14 +49,14 @@ x509_expand_certificate(X509 *x509, BIO *bio)
static void
x509_expand_subject(X509 *x509, BIO *bio)
{
- X509_NAME *name = X509_get_subject_name(x509);
+ const X509_NAME *name = X509_get_subject_name(x509);
X509_NAME_print_ex(bio, name, 0 /* indent */, XN_FLAG_ONELINE);
}
static void
x509_expand_issuer(X509 *x509, BIO *bio)
{
- X509_NAME *name = X509_get_issuer_name(x509);
+ const X509_NAME *name = X509_get_issuer_name(x509);
X509_NAME_print_ex(bio, name, 0 /* indent */, XN_FLAG_ONELINE);
}
@@ -72,8 +72,8 @@ x509_expand_signature(X509 *x509, BIO *bio)
{
const ASN1_BIT_STRING *sig;
X509_get0_signature(&sig, nullptr, x509);
- const char *ptr = reinterpret_cast<const char *>(sig->data);
- const char *end = ptr + sig->length;
+ const char *ptr = reinterpret_cast<const char *>(ASN1_STRING_get0_data(sig));
+ const char *end = ptr + ASN1_STRING_length(sig);
// The canonical OpenSSL way to format the signature seems to be
// X509_signature_dump(). However that separates each byte with a ':', which
is
diff --git a/plugins/experimental/txn_box/plugin/src/ts_util.cc
b/plugins/experimental/txn_box/plugin/src/ts_util.cc
index a188176895..c63de2f2fd 100644
--- a/plugins/experimental/txn_box/plugin/src/ts_util.cc
+++ b/plugins/experimental/txn_box/plugin/src/ts_util.cc
@@ -1111,8 +1111,10 @@ ssl_nid(swoc::TextView const &name)
namespace
{
+ using X509_NAME_ptr = decltype(X509_get_subject_name(nullptr));
+
TextView
- ssl_value_for(X509_NAME *name, int nid)
+ ssl_value_for(X509_NAME_ptr name, int nid)
{
if (int loc = X509_NAME_get_index_by_NID(name, nid, -1); loc >= 0) {
if (auto entry = X509_NAME_get_entry(name, loc); entry != nullptr) {
diff --git a/plugins/lua/ts_lua_client_cert_helpers.h
b/plugins/lua/ts_lua_client_cert_helpers.h
index c7f20b50eb..a7098ed2c0 100644
--- a/plugins/lua/ts_lua_client_cert_helpers.h
+++ b/plugins/lua/ts_lua_client_cert_helpers.h
@@ -18,7 +18,7 @@
// Helper functions for certificate data extraction
static std::string
-get_x509_name_string(X509_NAME *name)
+get_x509_name_string(const X509_NAME *name)
{
if (!name) {
return "";
@@ -157,12 +157,15 @@ get_x509_signature_string(X509 *cert)
return "";
}
- for (int i = 0; i < sig->length; i++) {
- if (BIO_printf(bio, "%02x", sig->data[i]) <= 0) {
+ const unsigned char *sig_data = ASN1_STRING_get0_data(sig);
+ int sig_len = ASN1_STRING_length(sig);
+
+ for (int i = 0; i < sig_len; i++) {
+ if (BIO_printf(bio, "%02x", sig_data[i]) <= 0) {
BIO_free(bio);
return "";
}
- if (i < sig->length - 1) {
+ if (i < sig_len - 1) {
if (BIO_printf(bio, ":") <= 0) {
BIO_free(bio);
return "";
diff --git a/src/api/InkAPI.cc b/src/api/InkAPI.cc
index 8858e90a4c..581dae8998 100644
--- a/src/api/InkAPI.cc
+++ b/src/api/InkAPI.cc
@@ -8317,9 +8317,9 @@ TSSslServerCertUpdate(const char *cert_path, const char
*key_path)
}
// Extract common name
- int pos =
X509_NAME_get_index_by_NID(X509_get_subject_name(cert.get()), NID_commonName,
-1);
- X509_NAME_ENTRY *common_name =
X509_NAME_get_entry(X509_get_subject_name(cert.get()), pos);
- ASN1_STRING *common_name_asn1 = X509_NAME_ENTRY_get_data(common_name);
+ const int pos =
X509_NAME_get_index_by_NID(X509_get_subject_name(cert.get()), NID_commonName,
-1);
+ const X509_NAME_ENTRY *common_name =
X509_NAME_get_entry(X509_get_subject_name(cert.get()), pos);
+ const ASN1_STRING *common_name_asn1 =
X509_NAME_ENTRY_get_data(common_name);
char *common_name_str = reinterpret_cast<char *>(const_cast<unsigned char
*>(ASN1_STRING_get0_data(common_name_asn1)));
if (ASN1_STRING_length(common_name_asn1) !=
static_cast<int>(strlen(common_name_str))) {
// Embedded null char
diff --git a/src/cripts/Certs.cc b/src/cripts/Certs.cc
index 8f893c14dc..006effcb90 100644
--- a/src/cripts/Certs.cc
+++ b/src/cripts/Certs.cc
@@ -54,8 +54,8 @@ CertBase::Signature::_load() const
if (!_ready && _owner->_x509) {
const ASN1_BIT_STRING *sig;
X509_get0_signature(&sig, nullptr, _owner->_x509);
- const char *ptr = reinterpret_cast<const char *>(sig->data);
- const char *end = ptr + sig->length;
+ const char *ptr = reinterpret_cast<const char
*>(ASN1_STRING_get0_data(sig));
+ const char *end = ptr + ASN1_STRING_length(sig);
super_type::_load();
for (; ptr < end; ++ptr) {
@@ -78,7 +78,7 @@ CertBase::X509Value::_update_value() const
}
void
-CertBase::X509Value::_load_name(X509_NAME *(*getter)(const X509 *)) const
+CertBase::X509Value::_load_name(NameGetter getter) const
{
if (!_ready && _owner->_x509) {
auto *name = getter(_owner->_x509);
@@ -95,7 +95,7 @@ CertBase::X509Value::_load_name(X509_NAME *(*getter)(const
X509 *)) const
}
void
-CertBase::X509Value::_load_integer(ASN1_INTEGER *(*getter)(X509 *)) const
+CertBase::X509Value::_load_integer(IntegerGetter getter) const
{
if (!_ready && _owner->_x509) {
auto *value = getter(_owner->_x509);
@@ -107,7 +107,7 @@ CertBase::X509Value::_load_integer(ASN1_INTEGER
*(*getter)(X509 *)) const
}
void
-CertBase::X509Value::_load_long(long (*getter)(const X509 *)) const
+CertBase::X509Value::_load_long(LongGetter getter) const
{
if (!_ready && _owner->_x509) {
auto value = getter(_owner->_x509);
@@ -119,7 +119,7 @@ CertBase::X509Value::_load_long(long (*getter)(const X509
*)) const
}
void
-CertBase::X509Value::_load_time(ASN1_TIME *(*getter)(const X509 *)) const
+CertBase::X509Value::_load_time(TimeGetter getter) const
{
if (!_ready && _owner->_x509) {
auto *time = getter(_owner->_x509);
@@ -153,8 +153,8 @@ namespace
_write_ip_address(const ASN1_OCTET_STRING *ip, BIO *_bio)
{
char buffer[INET6_ADDRSTRLEN];
- const unsigned char *raw = ip->data;
- int len = ip->length;
+ const unsigned char *raw = ASN1_STRING_get0_data(ip);
+ int len = ASN1_STRING_length(ip);
if (inet_ntop(len == 4 ? AF_INET : AF_INET6, raw, buffer, sizeof(buffer)))
{
BIO_printf(_bio, "%s", buffer);
diff --git a/src/iocore/net/OCSPStapling.cc b/src/iocore/net/OCSPStapling.cc
index 9a0592f49b..e07f18418a 100644
--- a/src/iocore/net/OCSPStapling.cc
+++ b/src/iocore/net/OCSPStapling.cc
@@ -490,7 +490,7 @@ TS_OCSP_cert_id_new(const EVP_MD *dgst, const X509_NAME
*issuerName, const ASN1_
}
/* Calculate the issuerKey hash, excluding tag and length */
- if (!EVP_Digest(issuerKey->data, issuerKey->length, md, &i, dgst, nullptr)) {
+ if (!EVP_Digest(ASN1_STRING_get0_data(issuerKey),
ASN1_STRING_length(issuerKey), md, &i, dgst, nullptr)) {
goto err;
}
@@ -514,9 +514,9 @@ err:
TS_OCSP_CERTID *
TS_OCSP_cert_to_id(const EVP_MD *dgst, const X509 *subject, const X509 *issuer)
{
- const X509_NAME *iname;
- const ASN1_INTEGER *serial;
- ASN1_BIT_STRING *ikey;
+ const X509_NAME *iname;
+ const ASN1_INTEGER *serial;
+ const ASN1_BIT_STRING *ikey;
if (!dgst) {
dgst = EVP_sha1();
diff --git a/src/iocore/net/SSLNetVConnection.cc
b/src/iocore/net/SSLNetVConnection.cc
index bb7ccb5dde..8d2abaf7af 100644
--- a/src/iocore/net/SSLNetVConnection.cc
+++ b/src/iocore/net/SSLNetVConnection.cc
@@ -167,7 +167,7 @@ SSLNetVConnection::_unbindSSLObject()
}
static void
-debug_certificate_name(const char *msg, X509_NAME *name)
+debug_certificate_name(const char *msg, const X509_NAME *name)
{
BIO *bio;
diff --git a/src/iocore/net/SSLUtils.cc b/src/iocore/net/SSLUtils.cc
index a79efe962f..2a1e8cf1e9 100644
--- a/src/iocore/net/SSLUtils.cc
+++ b/src/iocore/net/SSLUtils.cc
@@ -980,7 +980,7 @@ SSLMultiCertConfigLoader::check_server_cert_now(X509 *cert,
const char *certname
} /* CheckServerCertNow() */
static char *
-asn1_strdup(ASN1_STRING *s)
+asn1_strdup(const ASN1_STRING *s)
{
// Make sure we have an 8-bit encoding.
ink_assert(ASN1_STRING_type(s) == V_ASN1_IA5STRING || ASN1_STRING_type(s) ==
V_ASN1_UTF8STRING ||
@@ -2188,10 +2188,9 @@
SSLMultiCertConfigLoader::load_certs_and_cross_reference_names(
std::set<std::string> name_set;
// Grub through the names in the certs
- X509_NAME *subject = nullptr;
// Insert a key for the subject CN.
- subject = X509_get_subject_name(cert);
+ auto *subject = X509_get_subject_name(cert);
ats_scoped_str subj_name;
if (subject) {
int pos = -1;
@@ -2201,9 +2200,9 @@
SSLMultiCertConfigLoader::load_certs_and_cross_reference_names(
break;
}
- X509_NAME_ENTRY *e = X509_NAME_get_entry(subject, pos);
- ASN1_STRING *cn = X509_NAME_ENTRY_get_data(e);
- subj_name = asn1_strdup(cn);
+ const X509_NAME_ENTRY *e = X509_NAME_get_entry(subject, pos);
+ const ASN1_STRING *cn = X509_NAME_ENTRY_get_data(e);
+ subj_name = asn1_strdup(cn);
Dbg(dbg_ctl_ssl_load, "subj '%s' in certificate %s %p",
subj_name.get(), data.cert_names_list[i].c_str(), cert);
name_set.insert(subj_name.get());
diff --git a/src/iocore/net/unit_tests/test_SSLDHParams.cc
b/src/iocore/net/unit_tests/test_SSLDHParams.cc
index 3e75f5fe09..8d0e44a4a0 100644
--- a/src/iocore/net/unit_tests/test_SSLDHParams.cc
+++ b/src/iocore/net/unit_tests/test_SSLDHParams.cc
@@ -132,9 +132,12 @@ make_cert_and_key(EVP_CIPHER const *cipher = nullptr, char
*pass = nullptr)
X509_gmtime_adj(X509_getm_notAfter(x509), 60L * 60L * 24L * 365L);
REQUIRE(X509_set_pubkey(x509, pkey) == 1);
- X509_NAME *name = X509_get_subject_name(x509);
+ X509_NAME *name = X509_NAME_dup(X509_get_subject_name(x509));
+ REQUIRE(name != nullptr);
X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC,
reinterpret_cast<unsigned char const *>("ats-test"), -1, -1, 0);
+ REQUIRE(X509_set_subject_name(x509, name) == 1);
REQUIRE(X509_set_issuer_name(x509, name) == 1);
+ X509_NAME_free(name);
REQUIRE(X509_sign(x509, pkey, EVP_sha256()) > 0);
BIO *cert_bio = BIO_new(BIO_s_mem());
diff --git a/src/tscore/X509HostnameValidator.cc
b/src/tscore/X509HostnameValidator.cc
index 5d98b73f05..36cba94714 100644
--- a/src/tscore/X509HostnameValidator.cc
+++ b/src/tscore/X509HostnameValidator.cc
@@ -206,12 +206,12 @@ do_check_string(ASN1_STRING *a, int cmp_type, equal_fn
equal, const unsigned cha
{
bool retval = false;
- if (!a->data || !a->length || cmp_type != a->type) {
+ if (!ASN1_STRING_get0_data(a) || !ASN1_STRING_length(a) || cmp_type !=
ASN1_STRING_type(a)) {
return false;
}
- retval = equal(a->data, a->length, b, blen);
+ retval = equal(ASN1_STRING_get0_data(a), ASN1_STRING_length(a), b, blen);
if (retval && peername) {
- *peername = ats_strndup((char *)a->data, a->length);
+ *peername = ats_strndup(reinterpret_cast<const char
*>(ASN1_STRING_get0_data(a)), ASN1_STRING_length(a));
}
return retval;
}
@@ -220,7 +220,6 @@ bool
validate_hostname(X509 *x, std::string_view hostname, bool is_ip, char
**peername)
{
GENERAL_NAMES *gens = nullptr;
- X509_NAME *name = nullptr;
int i;
int alt_type;
bool retval = false;
@@ -269,13 +268,13 @@ validate_hostname(X509 *x, std::string_view hostname,
bool is_ip, char **peernam
}
}
// No SAN match -- check the subject
- i = -1;
- name = X509_get_subject_name(x);
+ i = -1;
+ auto *name = X509_get_subject_name(x);
while ((i = X509_NAME_get_index_by_NID(name, NID_commonName, i)) >= 0) {
- ASN1_STRING *str;
- int astrlen;
- unsigned char *astr;
+ const ASN1_STRING *str;
+ int astrlen;
+ unsigned char *astr;
str = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name, i));
// Convert to UTF-8
astrlen = ASN1_STRING_to_UTF8(&astr, str);
diff --git a/tests/tools/plugins/ssl_client_verify_test.cc
b/tests/tools/plugins/ssl_client_verify_test.cc
index 7f3ae7c375..a4243818e0 100644
--- a/tests/tools/plugins/ssl_client_verify_test.cc
+++ b/tests/tools/plugins/ssl_client_verify_test.cc
@@ -58,7 +58,7 @@ check_names(X509 *cert)
bool retval = false;
// Check the common name
- X509_NAME *subject = X509_get_subject_name(cert);
+ auto *subject = X509_get_subject_name(cert);
if (subject) {
int pos = -1;
for (; !retval;) {
@@ -67,10 +67,10 @@ check_names(X509 *cert)
break;
}
- X509_NAME_ENTRY *e = X509_NAME_get_entry(subject, pos);
- ASN1_STRING *cn = X509_NAME_ENTRY_get_data(e);
- char *subj_name = strndup(reinterpret_cast<const char
*>(ASN1_STRING_get0_data(cn)), ASN1_STRING_length(cn));
- retval = check_name(subj_name);
+ auto *e = X509_NAME_get_entry(subject, pos);
+ auto *cn = X509_NAME_ENTRY_get_data(e);
+ char *subj_name = strndup(reinterpret_cast<const char
*>(ASN1_STRING_get0_data(cn)), ASN1_STRING_length(cn));
+ retval = check_name(subj_name);
free(subj_name);
}
}
