jeredfloyd commented on issue #13427:
URL:
https://github.com/apache/trafficserver/issues/13427#issuecomment-5077013370
There are a few other items, including const-iness of things. Here's a
patch that fixes everything to complete a build successfully on F45. If it
looks ok, lmk and I will make it a PR instead. (I haven't yet tested if it
creates issues on older releases, but I think it's unlikely.)
```
--- src/tscore/X509HostnameValidator.cc.orig 2026-07-25 02:15:34.822042537
+0000
+++ src/tscore/X509HostnameValidator.cc 2026-07-25 02:15:32.185006059
+0000
@@ -205,12 +205,12 @@
{
bool retval = false;
- if (!a->data || !a->length || cmp_type != a->type) {
+ if (!ASN1_STRING_get0_data(a) || !ASN1_STRING_length(a) || cmp_type !=
ASN1_STRING_type(a)) {
return false;
}
- retval = equal(a->data, a->length, b, blen);
+ retval = equal(ASN1_STRING_get0_data(a), ASN1_STRING_length(a), b, blen);
if (retval && peername) {
- *peername = ats_strndup((char *)a->data, a->length);
+ *peername = ats_strndup((char *)ASN1_STRING_get0_data(a),
ASN1_STRING_length(a));
}
return retval;
}
@@ -218,11 +218,11 @@
bool
validate_hostname(X509 *x, const unsigned char *hostname, bool is_ip, char
**peername)
{
- GENERAL_NAMES *gens = nullptr;
- X509_NAME *name = nullptr;
- int i;
- int alt_type;
- bool retval = false;
+ GENERAL_NAMES *gens = nullptr;
+ const X509_NAME *name = nullptr;
+ int i;
+ int alt_type;
+ bool retval = false;
;
equal_fn equal;
size_t hostname_len = strlen((char *)hostname);
@@ -267,9 +267,9 @@
name = X509_get_subject_name(x);
while ((i = X509_NAME_get_index_by_NID(name, NID_commonName, i)) >= 0) {
- ASN1_STRING *str;
- int astrlen;
- unsigned char *astr;
+ const ASN1_STRING *str;
+ int astrlen;
+ unsigned char *astr;
str = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name, i));
// Convert to UTF-8
astrlen = ASN1_STRING_to_UTF8(&astr, str);
--- src/iocore/net/SSLNetVConnection.cc.orig 2026-07-25 02:24:07.789952688
+0000
+++ src/iocore/net/SSLNetVConnection.cc 2026-07-25 02:25:36.161167556
+0000
@@ -167,7 +167,7 @@
}
static void
-debug_certificate_name(const char *msg, X509_NAME *name)
+debug_certificate_name(const char *msg, const X509_NAME *name)
{
BIO *bio;
--- src/iocore/net/SSLUtils.cc.orig 2026-07-25 02:25:58.022467139 +0000
+++ src/iocore/net/SSLUtils.cc 2026-07-25 02:37:47.633108283 +0000
@@ -1104,7 +1104,7 @@
} /* CheckServerCertNow() */
static char *
-asn1_strdup(ASN1_STRING *s)
+asn1_strdup(const ASN1_STRING *s)
{
// Make sure we have an 8-bit encoding.
ink_assert(ASN1_STRING_type(s) == V_ASN1_IA5STRING || ASN1_STRING_type(s)
== V_ASN1_UTF8STRING ||
@@ -2407,7 +2407,7 @@
std::set<std::string> name_set;
// Grub through the names in the certs
- X509_NAME *subject = nullptr;
+ const X509_NAME *subject = nullptr;
// Insert a key for the subject CN.
subject = X509_get_subject_name(cert);
@@ -2420,8 +2420,8 @@
break;
}
- X509_NAME_ENTRY *e = X509_NAME_get_entry(subject, pos);
- ASN1_STRING *cn = X509_NAME_ENTRY_get_data(e);
+ const X509_NAME_ENTRY *e = X509_NAME_get_entry(subject, pos);
+ const ASN1_STRING *cn = X509_NAME_ENTRY_get_data(e);
subj_name = asn1_strdup(cn);
Dbg(dbg_ctl_ssl_load, "subj '%s' in certificate %s %p",
subj_name.get(), data.cert_names_list[i].c_str(), cert);
--- src/iocore/net/OCSPStapling.cc.orig 2026-07-25 02:41:18.458968716
+0000
+++ src/iocore/net/OCSPStapling.cc 2026-07-25 02:42:21.478823756 +0000
@@ -489,7 +489,7 @@
}
/* Calculate the issuerKey hash, excluding tag and length */
- if (!EVP_Digest(issuerKey->data, issuerKey->length, md, &i, dgst,
nullptr)) {
+ if (!EVP_Digest(ASN1_STRING_get0_data(issuerKey),
ASN1_STRING_length(issuerKey), md, &i, dgst, nullptr)) {
goto err;
}
@@ -515,7 +515,7 @@
{
const X509_NAME *iname;
const ASN1_INTEGER *serial;
- ASN1_BIT_STRING *ikey;
+ const ASN1_BIT_STRING *ikey;
if (!dgst) {
dgst = EVP_sha1();
--- src/api/InkAPI.cc.orig 2026-07-25 02:59:52.703119493 +0000
+++ src/api/InkAPI.cc 2026-07-25 03:00:42.523798053 +0000
@@ -8307,9 +8307,9 @@
}
// Extract common name
- int pos =
X509_NAME_get_index_by_NID(X509_get_subject_name(cert.get()), NID_commonName,
-1);
- X509_NAME_ENTRY *common_name =
X509_NAME_get_entry(X509_get_subject_name(cert.get()), pos);
- ASN1_STRING *common_name_asn1 =
X509_NAME_ENTRY_get_data(common_name);
+ const int pos =
X509_NAME_get_index_by_NID(X509_get_subject_name(cert.get()), NID_commonName,
-1);
+ const X509_NAME_ENTRY *common_name =
X509_NAME_get_entry(X509_get_subject_name(cert.get()), pos);
+ const ASN1_STRING *common_name_asn1 =
X509_NAME_ENTRY_get_data(common_name);
char *common_name_str = reinterpret_cast<char *>(const_cast<unsigned
char *>(ASN1_STRING_get0_data(common_name_asn1)));
if (ASN1_STRING_length(common_name_asn1) !=
static_cast<int>(strlen(common_name_str))) {
// Embedded null char
--- plugins/experimental/sslheaders/expand.cc.orig 2026-07-25
03:13:24.680182258 +0000
+++ plugins/experimental/sslheaders/expand.cc 2026-07-25
03:15:55.953244848 +0000
@@ -49,14 +49,14 @@
static void
x509_expand_subject(X509 *x509, BIO *bio)
{
- X509_NAME *name = X509_get_subject_name(x509);
+ const X509_NAME *name = X509_get_subject_name(x509);
X509_NAME_print_ex(bio, name, 0 /* indent */, XN_FLAG_ONELINE);
}
static void
x509_expand_issuer(X509 *x509, BIO *bio)
{
- X509_NAME *name = X509_get_issuer_name(x509);
+ const X509_NAME *name = X509_get_issuer_name(x509);
X509_NAME_print_ex(bio, name, 0 /* indent */, XN_FLAG_ONELINE);
}
@@ -72,8 +72,8 @@
{
const ASN1_BIT_STRING *sig;
X509_get0_signature(&sig, nullptr, x509);
- const char *ptr = reinterpret_cast<const char *>(sig->data);
- const char *end = ptr + sig->length;
+ const char *ptr = reinterpret_cast<const char
*>(ASN1_STRING_get0_data(sig));
+ const char *end = ptr + ASN1_STRING_length(sig);
// The canonical OpenSSL way to format the signature seems to be
// X509_signature_dump(). However that separates each byte with a ':',
which is
--- plugins/certifier/certifier.cc.orig 2026-07-25 03:26:32.808935744
+0000
+++ plugins/certifier/certifier.cc 2026-07-25 04:02:32.880866169 +0000
@@ -372,12 +372,18 @@
X509_gmtime_adj(X509_get_notAfter(cert.get()), static_cast<long>(3650) *
24 * 3600);
// Get handle to subject name
- X509_NAME *n = X509_get_subject_name(cert.get());
+ X509_NAME *n = X509_NAME_dup(X509_get_subject_name(cert.get()));
// Set common name field
if (X509_NAME_add_entry_by_txt(n, "CN", MBSTRING_ASC, (unsigned char
*)commonName.c_str(), -1, -1, 0) != 1) {
TSError("[%s] %s: failed to add certificate subject CN", PLUGIN_NAME,
__func__);
return nullptr;
}
+ if (X509_set_subject_name(cert.get(), n) != 1) {
+ TSError("[%s] %s: failed to set certificate subject", PLUGIN_NAME,
__func__);
+ X509_NAME_free(n);
+ return nullptr;
+ }
+ X509_NAME_free(n);
// Set Traffic Server public key
if (X509_set_pubkey(cert.get(), ca_pkey_scoped.get()) == 0) {
--- plugins/experimental/cert_reporting_tool/cert_reporting_tool.cc.orig
2026-07-25 04:25:19.072669506 +0000
+++ plugins/experimental/cert_reporting_tool/cert_reporting_tool.cc
2026-07-25 04:26:01.238251075 +0000
@@ -65,7 +65,7 @@
// expiration date, serial number, common name, and subject
alternative names
const ASN1_TIME *not_after = X509_get_notAfter(cert);
const ASN1_INTEGER *serial = X509_get_serialNumber(cert);
- X509_NAME *subject_name = X509_get_subject_name(cert);
+ const X509_NAME *subject_name = X509_get_subject_name(cert);
// Subject name
BIO *subject_bio = BIO_new(BIO_s_mem());
--- plugins/experimental/txn_box/plugin/src/ts_util.cc.orig 2026-07-25
04:37:47.324945887 +0000
+++ plugins/experimental/txn_box/plugin/src/ts_util.cc 2026-07-25
04:39:21.571239702 +0000
@@ -1106,7 +1106,7 @@
namespace
{
TextView
- ssl_value_for(X509_NAME *name, int nid)
+ ssl_value_for(const X509_NAME *name, int nid)
{
if (int loc = X509_NAME_get_index_by_NID(name, nid, -1); loc >= 0) {
if (auto entry = X509_NAME_get_entry(name, loc); entry != nullptr) {
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
