83 lines
3.3 KiB
Diff
83 lines
3.3 KiB
Diff
From 45c4b424440a19545ff4271fc61d4290357b1696 Mon Sep 17 00:00:00 2001
|
|
From: Simo Sorce <simo@redhat.com>
|
|
Date: Wed, 29 Apr 2026 18:54:52 -0400
|
|
Subject: [PATCH] Update OpenSSL API for compatibility
|
|
|
|
Add const qualifiers to OpenSSL data structures and replace the deprecated
|
|
ASN1_STRING_data() with ASN1_STRING_get0_data(). This ensures proper
|
|
compilation and compatibility with newer versions of OpenSSL which enforce
|
|
stricter const-correctness for opaque structures and deprecate older data
|
|
accessors.
|
|
|
|
Signed-off-by: Simo Sorce <simo@redhat.com>
|
|
---
|
|
common-src/ssl-security.c | 24 ++++++++++++------------
|
|
1 file changed, 12 insertions(+), 12 deletions(-)
|
|
|
|
diff --git a/common-src/ssl-security.c b/common-src/ssl-security.c
|
|
index 299e6be..70fd910 100644
|
|
--- a/common-src/ssl-security.c
|
|
+++ b/common-src/ssl-security.c
|
|
@@ -397,8 +397,8 @@ ssl_accept(
|
|
int err;
|
|
X509 *remote_cert;
|
|
char *str;
|
|
- X509_NAME *x509_name;
|
|
- char *cert_hostname;
|
|
+ const X509_NAME *x509_name;
|
|
+ const char *cert_hostname;
|
|
SSL_CTX *ctx;
|
|
SSL *ssl;
|
|
int loc;
|
|
@@ -543,7 +543,7 @@ ssl_accept(
|
|
}
|
|
|
|
x509_name = X509_get_subject_name(remote_cert);
|
|
- str = X509_NAME_oneline(X509_get_subject_name(remote_cert), 0, 0);
|
|
+ str = X509_NAME_oneline(x509_name, 0, 0);
|
|
auth_debug(1, _("\t subject: %s\n"), str);
|
|
amfree (str);
|
|
|
|
@@ -554,13 +554,13 @@ ssl_accept(
|
|
loc = -1;
|
|
loc = X509_NAME_get_index_by_NID(x509_name, NID_commonName, loc);
|
|
if (loc != -1) {
|
|
- X509_NAME_ENTRY *x509_entry = X509_NAME_get_entry(x509_name, loc);
|
|
- ASN1_STRING *asn1_string = X509_NAME_ENTRY_get_data(x509_entry);
|
|
- cert_hostname = (char *)ASN1_STRING_data(asn1_string);
|
|
+ const X509_NAME_ENTRY *x509_entry = X509_NAME_get_entry(x509_name, loc);
|
|
+ const ASN1_STRING *asn1_string = X509_NAME_ENTRY_get_data(x509_entry);
|
|
+ cert_hostname = (const char *)ASN1_STRING_get0_data(asn1_string);
|
|
auth_debug(1, "common_name: %s\n", cert_hostname);
|
|
|
|
if (ssl_check_certificate_host &&
|
|
- check_name_give_sockaddr((char*)cert_hostname,
|
|
+ check_name_give_sockaddr(cert_hostname,
|
|
(struct sockaddr *)&sin, &errmsg) < 0) {
|
|
g_debug("Common name of certicate (%s) doesn't resolv to IP (%s)", cert_hostname, str_sockaddr(&sin));
|
|
amfree(errmsg);
|
|
@@ -794,16 +794,16 @@ runssl(
|
|
if (ssl_check_certificate_host) {
|
|
int loc = -1;
|
|
char *errmsg = NULL;
|
|
- X509_NAME *x509_name = X509_get_subject_name(remote_cert);
|
|
+ const X509_NAME *x509_name = X509_get_subject_name(remote_cert);
|
|
|
|
loc = X509_NAME_get_index_by_NID(x509_name, NID_commonName, loc);
|
|
if (loc != -1) {
|
|
- X509_NAME_ENTRY *x509_entry = X509_NAME_get_entry(x509_name, loc);
|
|
- ASN1_STRING *asn1_string = X509_NAME_ENTRY_get_data(x509_entry);
|
|
- char *cert_hostname = (char *)ASN1_STRING_data(asn1_string);
|
|
+ const X509_NAME_ENTRY *x509_entry = X509_NAME_get_entry(x509_name, loc);
|
|
+ const ASN1_STRING *asn1_string = X509_NAME_ENTRY_get_data(x509_entry);
|
|
+ const char *cert_hostname = (const char *)ASN1_STRING_get0_data(asn1_string);
|
|
auth_debug(1, "common_name: %s\n", cert_hostname);
|
|
|
|
- if (check_name_give_sockaddr((char*)cert_hostname,
|
|
+ if (check_name_give_sockaddr(cert_hostname,
|
|
(struct sockaddr *)&rc->peer, &errmsg) < 0) {
|
|
security_seterror(&rh->sech,
|
|
_("Common name of certicate (%s) doesn't resolv to IP (%s): %s"),
|
|
--
|
|
2.53.0
|
|
|