Hello list. Sebastian Andrzej Siewior reported that the MUA cannot be build with OpenSSL 4.0.x.
So please let me attach patches for v14.9.25 and v14.10.0-alpha that fix the build (it is about using accessor functions instead of directly using structure members). And note that OpenSSL 4.0.x still cannot be compiled with the "no-deprecated" option, for that i need to write code that avoids the X509_NAME_get_text_by_NID() that they have also obsoleted. Sorry for the inconvenience. (Actually a simple email to some formerly used mailing-list half a year in advance would have been possible, ie, some "heads up". But such ships seemed to have sailed.) Ciao! --steffen | |Der Kragenbaer, The moon bear, |der holt sich munter he cheerfully and one by one |einen nach dem anderen runter wa.ks himself off |(By Robert Gernhardt)
From e18fd33710c13947c702143cc3d5a6464ba57019 Mon Sep 17 00:00:00 2001 Message-ID: <e18fd33710c13947c702143cc3d5a6464ba57019.1780696283.git.stef...@sdaoden.eu> From: Steffen Nurpmeso <[email protected]> Date: Sun, 31 May 2026 00:39:35 +0200 Subject: [PATCH] Compat with OpenSSL 4.0.0 (Sebastian Andrzej Siewior) --- src/mx/xtls.c | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-) diff --git a/src/mx/xtls.c b/src/mx/xtls.c index 7e244a56b9..64436c96f3 100644 --- a/src/mx/xtls.c +++ b/src/mx/xtls.c @@ -50,6 +50,7 @@ su_EMPTY_FILE() #ifdef mx_HAVE_XTLS /* Shorthand for mx_HAVE_TLS==mx_TLS_IMPL{...} */ #include <sys/socket.h> +#include <openssl/asn1.h> #include <openssl/crypto.h> #include <openssl/err.h> #include <openssl/evp.h> @@ -150,15 +151,22 @@ CTA(SSL_OP_NO_SSL_MASK != 0, # endif #endif -/* More cute compatibility sighs */ -#if mx_HAVE_XTLS >= 0x10100 +/* More cute compatibility sighs; LibreSSL is "faked" (could use earlier one) */ +#if mx_HAVE_XTLS >= 0x10100 || \ + (mx_HAVE_TLS == mx_TLS_IMPL_RESSL && LIBRESSL_VERSION_NUMBER >= 0x4000000fL) # define a_xtls_X509_get_notBefore X509_get0_notBefore # define a_xtls_X509_get_notAfter X509_get0_notAfter # define a_xtls_SSL_get_verified_chain SSL_get0_verified_chain + +# define a_xtls_ASN1_STRING_get0_data(X) ((char const*)ASN1_STRING_get0_data(X)) +# define a_xtls_ASN1_STRING_length(X) ASN1_STRING_length(X) #else # define a_xtls_X509_get_notBefore X509_get_notBefore # define a_xtls_X509_get_notAfter X509_get_notAfter # define a_xtls_SSL_get_verified_chain SSL_get_peer_cert_chain + +# define a_xtls_ASN1_STRING_get0_data(X) ((char const*)(X)->data) +# define a_xtls_ASN1_STRING_length(X) ((int)(X)->length) #endif #if mx_HAVE_XTLS >= 0x30000 @@ -297,7 +305,7 @@ static struct ssl_method const _ssl_methods[] = { /* TODO obsolete */ * Strictly to be sorted new/up to old/down, [0]=ALL, [x-1]=None! */ static struct a_xtls_protocol const a_xtls_protocols[] = { {"ALL", SSL_OP_NO_SSL_MASK, 0, FAL0, TRU1, FAL0, TRU1, {0}}, - {"TLSv1.3\0", SSL_OP_NO_TLSv1_3, TLS1_3_VERSION, TRU1,TRU1,FAL0,FAL0,{0}}, + {"TLSv1.3", SSL_OP_NO_TLSv1_3, TLS1_3_VERSION, TRU1,TRU1,FAL0,FAL0,{0}}, {"TLSv1.2", SSL_OP_NO_TLSv1_2, TLS1_2_VERSION, TRU1, TRU1, FAL0, FAL0, {0}}, {"TLSv1.1", SSL_OP_NO_TLSv1_1, TLS1_1_VERSION, TRU1, TRU1, FAL0, FAL0, {0}}, {"TLSv1", SSL_OP_NO_TLSv1, TLS1_VERSION, TRU1, TRU1, FAL0, FAL0, {0}}, @@ -702,12 +710,13 @@ a_xtls_parse_asn1_time(ASN1_TIME const *atp, char *bdat, uz blen) mbp = BIO_new(BIO_s_mem()); - if (ASN1_TIME_print(mbp, C(ASN1_TIME*,atp)) && + if(ASN1_TIME_print(mbp, C(ASN1_TIME*,atp)) && (l = BIO_get_mem_data(mbp, &mcp)) > 0) snprintf(bdat, blen, "%.*s", (int)l, mcp); else { snprintf(bdat, blen, _("Bogus certificate date: %.*s"), - /*is (int)*/atp->length, (char const*)atp->data); + /*is (int)*/a_xtls_ASN1_STRING_length(atp), + a_xtls_ASN1_STRING_get0_data(atp)); mcp = NULL; } @@ -1382,7 +1391,7 @@ a_xtls_check_host(struct mx_socket *sop, X509 *peercert, char data[256]; a_XTLS_STACKOF(GENERAL_NAME) *gens; GENERAL_NAME *gen; - X509_NAME *subj; + X509_NAME const *subj; boole rv; NYD_IN; UNUSED(sop); @@ -1398,9 +1407,9 @@ a_xtls_check_host(struct mx_socket *sop, X509 *peercert, if(gen->type == GEN_DNS){ if(n_poption & n_PO_D_V) n_err(_("Comparing subject_alt_name: need<%s> is<%s>\n"), - urlp->url_host.s, (char*)gen->d.ia5->data); + urlp->url_host.s, a_xtls_ASN1_STRING_get0_data(gen->d.ia5)); if((rv = n_tls_rfc2595_hostname_match(urlp->url_host.s, - (char*)gen->d.ia5->data))) + a_xtls_ASN1_STRING_get0_data(gen->d.ia5)))) goto jleave; } } @@ -1434,7 +1443,7 @@ smime_verify(struct message *m, int n, a_XTLS_STACKOF(X509) *chain, a_XTLS_STACKOF(X509) *certs; a_XTLS_STACKOF(GENERAL_NAME) *gens; X509 *cert; - X509_NAME *subj; + X509_NAME const *subj; GENERAL_NAME *gen; NYD_IN; @@ -1522,8 +1531,8 @@ smime_verify(struct message *m, int n, a_XTLS_STACKOF(X509) *chain, if (gen->type == GEN_EMAIL) { if (n_poption & n_PO_D_V) n_err(_("Comparing subject_alt_name: need<%s> is<%s>)\n"), - sender, (char*)gen->d.ia5->data); - if (!su_cs_cmp_case((char*)gen->d.ia5->data, sender)) + sender, a_xtls_ASN1_STRING_get0_data(gen->d.ia5)); + if (!su_cs_cmp_case(a_xtls_ASN1_STRING_get0_data(gen->d.ia5), sender)) goto jfound; } } -- 2.54.0
From 74761c6283f6fbd0f03e5e385323ee65c0ed0a9f Mon Sep 17 00:00:00 2001 Message-ID: <74761c6283f6fbd0f03e5e385323ee65c0ed0a9f.1780696323.git.stef...@sdaoden.eu> From: Steffen Nurpmeso <[email protected]> Date: Sat, 30 May 2026 23:42:00 +0200 Subject: [PATCH] Compat with OpenSSL 4.0.0 (Sebastian Andrzej Siewior) --- src/mx/xtls.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/src/mx/xtls.c b/src/mx/xtls.c index 3931079e16..76f25b663c 100644 --- a/src/mx/xtls.c +++ b/src/mx/xtls.c @@ -49,6 +49,7 @@ su_EMPTY_FILE() #ifdef mx_HAVE_XTLS /* Shorthand for mx_HAVE_TLS==mx_TLS_IMPL{...} */ #include <sys/socket.h> +#include <openssl/asn1.h> #include <openssl/crypto.h> #include <openssl/err.h> #include <openssl/evp.h> @@ -160,15 +161,22 @@ CTA(SSL_OP_NO_SSL_MASK != 0, # endif #endif -/* More cute compatibility sighs */ -#if mx_HAVE_XTLS >= 0x10100 +/* More cute compatibility sighs; LibreSSL is "faked" (could use earlier one) */ +#if mx_HAVE_XTLS >= 0x10100 || \ + (mx_HAVE_TLS == mx_TLS_IMPL_RESSL && LIBRESSL_VERSION_NUMBER >= 0x4000000fL) # define a_xtls_X509_get_notBefore X509_get0_notBefore # define a_xtls_X509_get_notAfter X509_get0_notAfter # define a_xtls_SSL_get_verified_chain SSL_get0_verified_chain + +# define a_xtls_ASN1_STRING_get0_data(X) ((char const*)ASN1_STRING_get0_data(X)) +# define a_xtls_ASN1_STRING_length(X) ASN1_STRING_length(X) #else # define a_xtls_X509_get_notBefore X509_get_notBefore # define a_xtls_X509_get_notAfter X509_get_notAfter # define a_xtls_SSL_get_verified_chain SSL_get_peer_cert_chain + +# define a_xtls_ASN1_STRING_get0_data(X) ((char const*)(X)->data) +# define a_xtls_ASN1_STRING_length(X) ((int)(X)->length) #endif #if mx_HAVE_XTLS >= 0x30000 @@ -721,12 +729,13 @@ a_xtls_parse_asn1_time(ASN1_TIME const *atp, char *bdat, uz blen) mbp = BIO_new(BIO_s_mem()); - if (ASN1_TIME_print(mbp, C(ASN1_TIME*,atp)) && + if(ASN1_TIME_print(mbp, C(ASN1_TIME*,atp)) && (l = BIO_get_mem_data(mbp, &mcp)) > 0) snprintf(bdat, blen, "%.*s", (int)l, mcp); else { snprintf(bdat, blen, _("Bogus certificate date: %.*s"), - /*is (int)*/atp->length, (char const*)atp->data); + /*is (int)*/a_xtls_ASN1_STRING_length(atp), + a_xtls_ASN1_STRING_get0_data(atp)); mcp = NULL; } @@ -1455,8 +1464,8 @@ a_xtls_check_host(struct mx_socket *sop, X509 *peercert,/* TODO GEN_IPADD */ char const *ccp, *host; /* Is a DNS name and thus should be a valid ASCIZ one */ - ccp = R(char const*,gen->d.ia5->data); - l = gen->d.ia5->length; + ccp = a_xtls_ASN1_STRING_get0_data(gen->d.ia5); + l = a_xtls_ASN1_STRING_length(gen->d.ia5); if(l == 0 || ccp[l] != '\0' || su_cs_len(ccp) != l) continue; @@ -1505,7 +1514,7 @@ smime_verify(struct message *m, int n, a_XTLS_STACKOF(X509) *chain, a_XTLS_STACKOF(X509) *certs; a_XTLS_STACKOF(GENERAL_NAME) *gens; X509 *cert; - X509_NAME *subj; + X509_NAME const *subj; GENERAL_NAME *gen; NYD_IN; @@ -1596,8 +1605,8 @@ smime_verify(struct message *m, int n, a_XTLS_STACKOF(X509) *chain, if (gen->type == GEN_EMAIL) { if (n_poption & n_PO_D_V) n_err(_("Comparing subject_alt_name: need<%s> is<%s>)\n"), - sender, (char*)gen->d.ia5->data); - if (!su_cs_cmp_case((char*)gen->d.ia5->data, sender)) + sender, a_xtls_ASN1_STRING_get0_data(gen->d.ia5)); + if (!su_cs_cmp_case(a_xtls_ASN1_STRING_get0_data(gen->d.ia5), sender)) goto jfound; } } -- 2.54.0
