From rt-commit at redwax.eu  Wed Jul 22 13:58:00 2026
From: rt-commit at redwax.eu (rt-commit at redwax.eu)
Date: Wed, 22 Jul 2026 11:58:00 -0000
Subject: [rt-commit] r228 - in /redwax-tool/trunk: ChangeLog configure.ac
 redwax-tool.c redwax-tool.h redwax_openssl.c
Message-ID: <20260722115801.737C66AE701@chestnut.redwax.eu>

Author: minfrin at redwax.eu
Date: Wed Jul 22 13:57:58 2026
New Revision: 228

Log:
Add --filter-signature to limit certificates by
key type.

Modified:
    redwax-tool/trunk/ChangeLog
    redwax-tool/trunk/configure.ac
    redwax-tool/trunk/redwax-tool.c
    redwax-tool/trunk/redwax-tool.h
    redwax-tool/trunk/redwax_openssl.c

Modified: redwax-tool/trunk/ChangeLog
==============================================================================
--- redwax-tool/trunk/ChangeLog	(original)
+++ redwax-tool/trunk/ChangeLog	Wed Jul 22 13:57:58 2026
@@ -1,7 +1,12 @@
+
+Changes with v1.1.0
+
+ *) Add --filter-signature to limit certificates by
+    key type. [Graham Leggett]
 
 Changes with v1.0.1
 
- *) Add --pems-out to output certificates as seperate
+ *) Add --pems-out to output certificates as separate
     files. [Graham Leggett]
 
  *) Implement the generation of the secret file when

Modified: redwax-tool/trunk/configure.ac
==============================================================================
--- redwax-tool/trunk/configure.ac	(original)
+++ redwax-tool/trunk/configure.ac	Wed Jul 22 13:57:58 2026
@@ -2,7 +2,7 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ(2.61)
-AC_INIT(redwax-tool, 1.0.1, minfrin at sharp.fm)
+AC_INIT(redwax-tool, 1.1.0, minfrin at sharp.fm)
 AC_CONFIG_AUX_DIR(build-aux)
 AC_CONFIG_MACRO_DIRS([m4])
 AM_INIT_AUTOMAKE([dist-bzip2])

Modified: redwax-tool/trunk/redwax-tool.c
==============================================================================
--- redwax-tool/trunk/redwax-tool.c	(original)
+++ redwax-tool/trunk/redwax-tool.c	Wed Jul 22 13:57:58 2026
@@ -85,6 +85,8 @@
         APR_HOOK_LINK(complete_verify_dane)
         APR_HOOK_LINK(set_purpose)
         APR_HOOK_LINK(complete_purpose)
+        APR_HOOK_LINK(set_signature)
+        APR_HOOK_LINK(complete_signature)
         APR_HOOK_LINK(set_tlsa)
         APR_HOOK_LINK(process_tlsa)
         APR_HOOK_LINK(set_smimea)
@@ -161,6 +163,10 @@
         (redwax_tool_t * r, const char *arg), (r, arg), DECLINED)
 APR_IMPLEMENT_EXTERNAL_HOOK_RUN_ALL(rt, REDWAX, int, complete_purpose,
         (redwax_tool_t * r, apr_hash_t *purposes), (r, purposes), OK, DECLINED)
+APR_IMPLEMENT_EXTERNAL_HOOK_RUN_FIRST(rt, REDWAX, apr_status_t, set_signature,
+        (redwax_tool_t * r, const char *arg), (r, arg), DECLINED)
+APR_IMPLEMENT_EXTERNAL_HOOK_RUN_ALL(rt, REDWAX, int, complete_signature,
+		        (redwax_tool_t * r, apr_hash_t *signatures), (r, signatures), OK, DECLINED)
 APR_IMPLEMENT_EXTERNAL_HOOK_RUN_FIRST(rt, REDWAX, apr_status_t, set_tlsa,
         (redwax_tool_t * r, const char *arg), (r, arg), DECLINED)
 APR_IMPLEMENT_EXTERNAL_HOOK_RUN_FIRST(rt, REDWAX, int, process_tlsa,
@@ -277,61 +283,62 @@
 #define REDWAX_TOOL_FILTER_EXPIRY 270
 #define REDWAX_TOOL_FILTER_DANE 271
 #define REDWAX_TOOL_FILTER_PURPOSE 272
-#define REDWAX_TOOL_FILTER_VERIFY_PARAM 273
-#define REDWAX_TOOL_FILTER_VERIFY_TLSA 274
-#define REDWAX_TOOL_FILTER_VERIFY_SMIMEA 275
-#define REDWAX_TOOL_CERT_OUT 276
-#define REDWAX_TOOL_NO_CERT_OUT 277
-#define REDWAX_TOOL_CHAIN_OUT 278
-#define REDWAX_TOOL_NO_CHAIN_OUT 279
-#define REDWAX_TOOL_ROOT_OUT 280
-#define REDWAX_TOOL_NO_ROOT_OUT 281
-#define REDWAX_TOOL_TRUST_OUT 282
-#define REDWAX_TOOL_NO_TRUST_OUT 283
-#define REDWAX_TOOL_CRL_OUT 284
-#define REDWAX_TOOL_NO_CRL_OUT 285
-#define REDWAX_TOOL_PARAM_OUT 286
-#define REDWAX_TOOL_NO_PARAM_OUT 287
-#define REDWAX_TOOL_KEY_IN 288
-#define REDWAX_TOOL_NO_KEY_IN 289
-#define REDWAX_TOOL_KEY_OUT 290
-#define REDWAX_TOOL_NO_KEY_OUT 291
-#define REDWAX_TOOL_AUTO_OUT 292
-#define REDWAX_TOOL_NO_AUTO_OUT 293
-#define REDWAX_TOOL_SECRET_SUFFIX_IN 294
-#define REDWAX_TOOL_SECRET_SUFFIX_OUT 295
-#define REDWAX_TOOL_SECRET_TOKEN_IN 296
-#define REDWAX_TOOL_SECRET_TOKEN_OUT 297
-#define REDWAX_TOOL_LABEL_OUT 298
-#define REDWAX_TOOL_NSS_OUT 299
-#define REDWAX_TOOL_NSS_SLOT_OUT 300
-#define REDWAX_TOOL_DER_OUT 301
-#define REDWAX_TOOL_PEMS_OUT 302
-#define REDWAX_TOOL_PEM_OUT 303
-#define REDWAX_TOOL_PKCS12_OUT 304
-#define REDWAX_TOOL_PKCS11_OUT 305
-#define REDWAX_TOOL_PKCS11_MODULE_OUT 306
-#define REDWAX_TOOL_METADATA_OUT 307
-#define REDWAX_TOOL_METADATA_THRESHOLD 308
-#define REDWAX_TOOL_FORMAT_OUT 309
-#define REDWAX_TOOL_CALENDAR_OUT 310
-#define REDWAX_TOOL_CALENDAR_ALARM 311
-#define REDWAX_TOOL_REMINDER_OUT 312
-#define REDWAX_TOOL_JWKS_OUT 313
-#define REDWAX_TOOL_TEXT_OUT 314
-#define REDWAX_TOOL_NO_TEXT_OUT 315
-#define REDWAX_TOOL_SSH_PRIVATE_OUT 316
-#define REDWAX_TOOL_SSH_PUBLIC_OUT 317
-#define REDWAX_TOOL_SMIMEA_OUT 318
-#define REDWAX_TOOL_SSHFP_OUT 319
-#define REDWAX_TOOL_TLSA_OUT 320
-#define REDWAX_TOOL_USER_IN 321
-#define REDWAX_TOOL_USER_OUT 322
-#define REDWAX_TOOL_GROUP_IN 323
-#define REDWAX_TOOL_GROUP_OUT 324
-#define REDWAX_TOOL_ORDER_OUT 325
-#define REDWAX_TOOL_DNS_SERVER 326
-#define REDWAX_TOOL_DNS_TRUST_ANCHOR 327
+#define REDWAX_TOOL_FILTER_SIGNATURE 273
+#define REDWAX_TOOL_FILTER_VERIFY_PARAM 274
+#define REDWAX_TOOL_FILTER_VERIFY_TLSA 275
+#define REDWAX_TOOL_FILTER_VERIFY_SMIMEA 276
+#define REDWAX_TOOL_CERT_OUT 277
+#define REDWAX_TOOL_NO_CERT_OUT 278
+#define REDWAX_TOOL_CHAIN_OUT 279
+#define REDWAX_TOOL_NO_CHAIN_OUT 280
+#define REDWAX_TOOL_ROOT_OUT 281
+#define REDWAX_TOOL_NO_ROOT_OUT 282
+#define REDWAX_TOOL_TRUST_OUT 283
+#define REDWAX_TOOL_NO_TRUST_OUT 284
+#define REDWAX_TOOL_CRL_OUT 285
+#define REDWAX_TOOL_NO_CRL_OUT 286
+#define REDWAX_TOOL_PARAM_OUT 287
+#define REDWAX_TOOL_NO_PARAM_OUT 288
+#define REDWAX_TOOL_KEY_IN 289
+#define REDWAX_TOOL_NO_KEY_IN 290
+#define REDWAX_TOOL_KEY_OUT 291
+#define REDWAX_TOOL_NO_KEY_OUT 292
+#define REDWAX_TOOL_AUTO_OUT 293
+#define REDWAX_TOOL_NO_AUTO_OUT 294
+#define REDWAX_TOOL_SECRET_SUFFIX_IN 295
+#define REDWAX_TOOL_SECRET_SUFFIX_OUT 296
+#define REDWAX_TOOL_SECRET_TOKEN_IN 297
+#define REDWAX_TOOL_SECRET_TOKEN_OUT 298
+#define REDWAX_TOOL_LABEL_OUT 299
+#define REDWAX_TOOL_NSS_OUT 300
+#define REDWAX_TOOL_NSS_SLOT_OUT 301
+#define REDWAX_TOOL_DER_OUT 302
+#define REDWAX_TOOL_PEMS_OUT 303
+#define REDWAX_TOOL_PEM_OUT 304
+#define REDWAX_TOOL_PKCS12_OUT 305
+#define REDWAX_TOOL_PKCS11_OUT 306
+#define REDWAX_TOOL_PKCS11_MODULE_OUT 307
+#define REDWAX_TOOL_METADATA_OUT 308
+#define REDWAX_TOOL_METADATA_THRESHOLD 309
+#define REDWAX_TOOL_FORMAT_OUT 310
+#define REDWAX_TOOL_CALENDAR_OUT 311
+#define REDWAX_TOOL_CALENDAR_ALARM 312
+#define REDWAX_TOOL_REMINDER_OUT 313
+#define REDWAX_TOOL_JWKS_OUT 314
+#define REDWAX_TOOL_TEXT_OUT 315
+#define REDWAX_TOOL_NO_TEXT_OUT 316
+#define REDWAX_TOOL_SSH_PRIVATE_OUT 317
+#define REDWAX_TOOL_SSH_PUBLIC_OUT 318
+#define REDWAX_TOOL_SMIMEA_OUT 319
+#define REDWAX_TOOL_SSHFP_OUT 320
+#define REDWAX_TOOL_TLSA_OUT 321
+#define REDWAX_TOOL_USER_IN 322
+#define REDWAX_TOOL_USER_OUT 323
+#define REDWAX_TOOL_GROUP_IN 324
+#define REDWAX_TOOL_GROUP_OUT 325
+#define REDWAX_TOOL_ORDER_OUT 326
+#define REDWAX_TOOL_DNS_SERVER 327
+#define REDWAX_TOOL_DNS_TRUST_ANCHOR 328
 
 #define REDWAX_EXIT_OK 0
 #define REDWAX_EXIT_INIT 1
@@ -490,6 +497,9 @@
     { "filter-purpose", REDWAX_TOOL_FILTER_PURPOSE, 1,
             "  --filter-purpose=purpose\tSet the purpose of the certificate to verify.\n"
             "\t\t\t\tIf unset, it will default to any purpose." },
+    { "filter-signature", REDWAX_TOOL_FILTER_SIGNATURE, 1,
+            "  --filter-signature=algorithm\tSet the signature algorithm of the certificate to verify.\n"
+            "\t\t\t\tIf unset, it will default to any algorithm." },
     { "text-out", REDWAX_TOOL_TEXT_OUT, 0,
         "  --text-out\t\t\tInclude additional text in certificate PEM and\n"
             "\t\t\t\tmetadata output." },
@@ -796,7 +806,7 @@
         (*cp >= '0' && *cp <= '9') ? *cp - '0' : \
         (*cp >= 'A' && *cp <= 'F') ? *cp - 'A' + 10 : \
         (*cp >= 'a' && *cp <= 'f') ? *cp - 'a' + 10 : \
-        (!(error = cp))        /* last line of macro... */
+        ((error = cp) ? 0 : 0) /* last line of macro... */
 
 /*
  * OCTAL_TO_3BITS:
@@ -805,7 +815,7 @@
  */
 #define OCTAL_TO_3BITS(cp,error) \
         (*cp >= '0' && *cp <= '7') ? *cp - '0' : \
-        (!(error = cp))        /* last line of macro... */
+        ((error = cp) ? 0 : 0) /* last line of macro... */
 
 
     if (state_out) {
@@ -1224,10 +1234,10 @@
                 case 'N': /* shift out */ \
                 case 'O': /* shift in */ \
                 case 'P': /* data line escape */ \
-                case 'Q': /* redwax control 1 */ \
-                case 'R': /* redwax control 2 */ \
-                case 'S': /* redwax control 3 */ \
-                case 'T': /* redwax control 4 */ \
+                case 'Q': /* device control 1 */ \
+                case 'R': /* device control 2 */ \
+                case 'S': /* device control 3 */ \
+                case 'T': /* device control 4 */ \
                 case 'U': /* nack */ \
                 case 'V': /* sync idel */ \
                 case 'W': /* end of transmit block */ \
@@ -1292,50 +1302,50 @@
                         case 'P': /* data line escape */ \
                             *cc++ = '\x10'; \
                             break; \
-                        case 'Q': /* redwax control 1 */ \
+                        case 'Q': /* device control 1 */ \
                             *cc++ = '\x11'; \
                             break; \
-                        case 'R': /* redwax control 2 */ \
+                        case 'R': /* device control 2 */ \
                             *cc++ = '\x12'; \
                             break; \
-                        case 'S': /* redwax control 3 */ \
+                        case 'S': /* device control 3 */ \
                             *cc++ = '\x13'; \
                             break; \
-                        case 'T': /* redwax control 4 */ \
-                            *cc++ = '\x24'; \
+                        case 'T': /* device control 4 */ \
+                            *cc++ = '\x14'; \
                             break; \
                         case 'U': /* nack */ \
-                            *cc++ = '\x25'; \
+                            *cc++ = '\x15'; \
                             break; \
                         case 'V': /* sync idel */ \
-                            *cc++ = '\x26'; \
+                            *cc++ = '\x16'; \
                             break; \
                         case 'W': /* end of transmit block */ \
-                            *cc++ = '\x27'; \
+                            *cc++ = '\x17'; \
                             break; \
                         case 'X': /* cancel */ \
-                            *cc++ = '\x28'; \
+                            *cc++ = '\x18'; \
                             break; \
                         case 'Y': /* end of medium */ \
-                            *cc++ = '\x29'; \
+                            *cc++ = '\x19'; \
                             break; \
                         case 'Z': /* substitute */ \
-                            *cc++ = '\x2A'; \
+                            *cc++ = '\x1A'; \
                             break; \
                         case '[': /* escape */ \
-                            *cc++ = '\x2B'; \
+                            *cc++ = '\x1B'; \
                             break; \
                         case '\\': /* file separator */ \
-                            *cc++ = '\x2C'; \
+                            *cc++ = '\x1C'; \
                             break; \
                         case ']': /* group separator */ \
-                            *cc++ = '\x2D'; \
+                            *cc++ = '\x1D'; \
                             break; \
                         case '^': /* record separator */ \
-                            *cc++ = '\x2E'; \
+                            *cc++ = '\x1E'; \
                             break; \
                         case '_': /* unit separator */ \
-                            *cc++ = '\x2F'; \
+                            *cc++ = '\x1F'; \
                             break; \
                         } \
                         if (offset) *offset++ = (cp - arg_str); \
@@ -2909,6 +2919,13 @@
             }
             break;
         }
+        case REDWAX_TOOL_FILTER_SIGNATURE: {
+            if (redwax_set_option(r, optarg, &rt_run_set_signature,
+                    "filter-signature")) {
+                return r->rc;
+            }
+            break;
+        }
         case REDWAX_TOOL_FILTER_VERIFY_TLSA: {
             if (redwax_set_option(r, optarg, &rt_run_set_tlsa,
                     "filter-verify-tlsa")) {
@@ -3334,6 +3351,10 @@
                 redwax_complete_hash(r, optarg, &rt_run_complete_purpose, state.isquoted);
                 break;
             }
+            case REDWAX_TOOL_FILTER_SIGNATURE: {
+                redwax_complete_hash(r, optarg, &rt_run_complete_signature, state.isquoted);
+                break;
+            }
             case REDWAX_TOOL_NSS_OUT: {
                 redwax_complete_directory(r, optarg, state.isquoted);
                 break;
@@ -3560,6 +3581,10 @@
         }
         case REDWAX_TOOL_FILTER_PURPOSE: {
             redwax_complete_hash(r, "", &rt_run_complete_purpose, state.isquoted);
+            break;
+        }
+        case REDWAX_TOOL_FILTER_SIGNATURE: {
+            redwax_complete_hash(r, "", &rt_run_complete_signature, state.isquoted);
             break;
         }
         case REDWAX_TOOL_NSS_OUT: {

Modified: redwax-tool/trunk/redwax-tool.h
==============================================================================
--- redwax-tool/trunk/redwax-tool.h	(original)
+++ redwax-tool/trunk/redwax-tool.h	Wed Jul 22 13:57:58 2026
@@ -143,6 +143,7 @@
     const char *verify_param;
     const char *verify_date;
     const char *purpose;
+    const char *signature;
     const char *secret_suffix_in;
     const char *secret_suffix_out;
     const char *secret_token_in;
@@ -884,6 +885,22 @@
         (redwax_tool_t *r, const char *arg))
 
 /**
+ * Hook to complete signatures.
+ *
+ * @param r The redwax-tool context.
+ */
+APR_DECLARE_EXTERNAL_HOOK(rt, REDWAX, apr_status_t, complete_signature,
+        (redwax_tool_t *r, apr_hash_t *signatures))
+
+/**
+ * Hook to set the signature.
+ *
+ * @param r The redwax-tool context.
+ */
+APR_DECLARE_EXTERNAL_HOOK(rt, REDWAX, apr_status_t, set_signature,
+        (redwax_tool_t *r, const char *arg))
+
+/**
  * Hook to set the tlsa.
  *
  * @param r The redwax-tool context.

Modified: redwax-tool/trunk/redwax_openssl.c
==============================================================================
--- redwax-tool/trunk/redwax_openssl.c	(original)
+++ redwax-tool/trunk/redwax_openssl.c	Wed Jul 22 13:57:58 2026
@@ -1853,6 +1853,64 @@
     return APR_SUCCESS;
 }
 
+static apr_status_t redwax_openssl_set_signature(redwax_tool_t *r, const char *arg)
+{
+	int nid = OBJ_txt2nid(arg);
+
+    if (nid == NID_undef) {
+
+        redwax_print_error(r,
+                "--filter-signature: signature '%s' not found\n", arg);
+
+        return APR_ENOENT;
+    }
+
+    r->signature = arg;
+
+    return APR_SUCCESS;
+}
+
+static void complete_signature_name_cb(const char *name, void *data)
+{
+    apr_hash_t *params = data;
+
+    if (OBJ_txt2obj(name, 1)) {
+    	return;
+    }
+
+    EVP_SIGNATURE *sig = EVP_SIGNATURE_fetch(NULL, name, NULL);
+
+    if (sig) {
+        apr_hash_set(params, name, APR_HASH_KEY_STRING, name);
+        EVP_SIGNATURE_free(sig);
+    }
+}
+
+static void complete_signature_cb(EVP_KEYMGMT *km, void *data)
+{
+    const OSSL_PARAM *params = EVP_KEYMGMT_gettable_params(km);
+
+    if (params) {
+        for (; params->key; params++) {
+            if (strcmp(params->key, OSSL_PKEY_PARAM_BITS) == 0 ||
+                strcmp(params->key, OSSL_PKEY_PARAM_MAX_SIZE) == 0) {
+
+                EVP_KEYMGMT_names_do_all(km, complete_signature_name_cb, data);
+
+                break;
+            }
+        }
+    }
+}
+
+static apr_status_t redwax_openssl_complete_signature(redwax_tool_t *r,
+        apr_hash_t *params)
+{
+    EVP_KEYMGMT_do_all_provided(NULL, complete_signature_cb, params);
+
+    return APR_SUCCESS;
+}
+
 static apr_status_t redwax_openssl_complete_filter_search(redwax_tool_t *r,
         apr_hash_t *filters)
 {
@@ -1882,7 +1940,7 @@
 
             if (purpose == -1) {
                 redwax_print_error(r,
-                        "When searchinging, purpose was not recognised: %s\n", r->purpose);
+                        "search-filter: purpose was not recognised: %s\n", r->purpose);
                 return APR_EINVAL;
             }
 
@@ -1893,6 +1951,16 @@
             purpose = X509_PURPOSE_get_id(xptmp);
 
             if (!X509_check_purpose(x, purpose, 0)) {
+                X509_free(x);
+                return 0;
+            }
+        }
+
+        if (r->signature) {
+
+        	EVP_PKEY *pkey = X509_get0_pubkey(x);
+
+            if (pkey && !EVP_PKEY_is_a(pkey, r->signature)) {
                 X509_free(x);
                 return 0;
             }
@@ -2200,6 +2268,24 @@
     if (!config) {
         config = apr_pcalloc(cert->pool, sizeof(openssl_certificate_config_t));
         redwax_set_module_config(cert->per_module, &openssl_module, config);
+    }
+
+    /* signature check */
+    if (r->signature && current_cert) {
+
+    	EVP_PKEY *pkey = X509_get0_pubkey(current_cert);
+
+        int nid;
+
+        X509_get_signature_info(current_cert, NULL, &nid, NULL, NULL);
+
+        if (!EVP_PKEY_is_a(pkey, r->signature)) {
+            redwax_print_error(r,
+                    "verify-filter: %d: %.*s: %s != %s, skipping\n",
+                    X509_STORE_CTX_get_error_depth(ctx), len, buf,
+                    r->signature, OBJ_nid2sn(nid));
+            return 0;
+        }
     }
 
     /* set verification result */
@@ -3620,7 +3706,7 @@
             status = apr_file_puts(buf, sfile);
 
             if (APR_SUCCESS != status) {
-            	apr_file_remove(template, pool);
+                apr_file_remove(template, pool);
                 redwax_print_error(r,
                         "Could not write to '%s': %pm\n", secret, &status);
                 return NULL;
@@ -3629,7 +3715,7 @@
             status = apr_file_close(sfile);
 
             if (APR_SUCCESS != status) {
-            	apr_file_remove(template, pool);
+                apr_file_remove(template, pool);
                 redwax_print_error(r,
                         "Could not close '%s': %pm\n", secret, &status);
                 return NULL;
@@ -3638,7 +3724,7 @@
             status = apr_file_rename(template, secret, pool);
 
             if (APR_SUCCESS != status) {
-            	apr_file_remove(template, pool);
+                apr_file_remove(template, pool);
                 redwax_print_error(r,
                         "Could not rename '%s': %pm\n", secret, &status);
                 return NULL;
@@ -7258,6 +7344,8 @@
     rt_hook_set_verify_dane(redwax_openssl_set_verify_dane, NULL, NULL, APR_HOOK_MIDDLE);
     rt_hook_complete_purpose(redwax_openssl_complete_purpose, NULL, NULL, APR_HOOK_MIDDLE);
     rt_hook_set_purpose(redwax_openssl_set_purpose, NULL, NULL, APR_HOOK_MIDDLE);
+    rt_hook_complete_signature(redwax_openssl_complete_signature, NULL, NULL, APR_HOOK_MIDDLE);
+    rt_hook_set_signature(redwax_openssl_set_signature, NULL, NULL, APR_HOOK_MIDDLE);
     rt_hook_process_pem_in(redwax_openssl_process_pem_in, NULL, NULL, APR_HOOK_MIDDLE);
     rt_hook_process_trust_pem_in(redwax_openssl_process_trust_pem_in, NULL, NULL, APR_HOOK_MIDDLE);
     rt_hook_process_pkcs12_in(redwax_openssl_process_pkcs12_in, NULL, NULL, APR_HOOK_MIDDLE);


From rt-commit at redwax.eu  Wed Jul 22 17:14:57 2026
From: rt-commit at redwax.eu (rt-commit at redwax.eu)
Date: Wed, 22 Jul 2026 15:14:57 -0000
Subject: [rt-commit] r229 - in /redwax-tool/trunk: ChangeLog config.h.in
 configure.ac redwax_openssl.c
Message-ID: <20260722151458.1F0206AE8A9@chestnut.redwax.eu>

Author: minfrin at redwax.eu
Date: Wed Jul 22 17:14:56 2026
New Revision: 229

Log:
Support OpenSSL4 by using opaque function accessors.

Modified:
    redwax-tool/trunk/ChangeLog
    redwax-tool/trunk/config.h.in
    redwax-tool/trunk/configure.ac
    redwax-tool/trunk/redwax_openssl.c

Modified: redwax-tool/trunk/ChangeLog
==============================================================================
--- redwax-tool/trunk/ChangeLog	(original)
+++ redwax-tool/trunk/ChangeLog	Wed Jul 22 17:14:56 2026
@@ -1,5 +1,8 @@
 
 Changes with v1.1.0
+
+ *) Support OpenSSL4 by using opaque function
+    accessors. [Graham Leggett]
 
  *) Add --filter-signature to limit certificates by
     key type. [Graham Leggett]

Modified: redwax-tool/trunk/config.h.in
==============================================================================
--- redwax-tool/trunk/config.h.in	(original)
+++ redwax-tool/trunk/config.h.in	Wed Jul 22 17:14:56 2026
@@ -116,6 +116,9 @@
 /* Define to 1 if you have the <Security/Security.h> header file. */
 #undef HAVE_SECURITY_SECURITY_H
 
+/* Define to 1 if you have the 'SSL_set1_dnsname' function. */
+#undef HAVE_SSL_SET1_DNSNAME
+
 /* Define to 1 if stdbool.h conforms to C99. */
 #undef HAVE_STDBOOL_H
 
@@ -145,6 +148,9 @@
 
 /* Define to 1 if you have the <unistd.h> header file. */
 #undef HAVE_UNISTD_H
+
+/* Define to 1 if you have the 'X509_check_certificate_times' function. */
+#undef HAVE_X509_CHECK_CERTIFICATE_TIMES
 
 /* Define to 1 if you have the 'X509_get0_extensions' function. */
 #undef HAVE_X509_GET0_EXTENSIONS

Modified: redwax-tool/trunk/configure.ac
==============================================================================
--- redwax-tool/trunk/configure.ac	(original)
+++ redwax-tool/trunk/configure.ac	Wed Jul 22 17:14:56 2026
@@ -158,9 +158,11 @@
  ASN1_TIME_print_ex X509_STORE_get0_param X509_STORE_CTX_set0_trusted_stack \
  X509_STORE_CTX_get_num_untrusted X509_get0_notBefore X509_get0_notAfter \
  X509_get0_tbs_sigalg X509_get0_uids X509_get0_extensions X509_get0_signature \
- X509_get_extension_flags X509_up_ref EVP_PKEY_get0_description EVP_PKEY_CTX_new_from_name \
- EVP_PKEY_get_bn_param RSA_get0_n RSA_get0_e RSA_get0_d RSA_get0_p RSA_get0_q RSA_get0_dmp1 \
+ X509_get_extension_flags X509_up_ref EVP_PKEY_get0_description \
+ X509_check_certificate_times EVP_PKEY_CTX_new_from_name EVP_PKEY_get_bn_param \
+ RSA_get0_n RSA_get0_e RSA_get0_d RSA_get0_p RSA_get0_q RSA_get0_dmp1 \
  RSA_get0_dmq1 RSA_get0_iqmp RSA_set0_key RSA_set0_factors RSA_set0_crt_params \
+ SSL_set1_dnsname \
  NSS_Initialize p11_kit_modules_load_and_initialize apr_crypto_clear])
 
 AC_OUTPUT

Modified: redwax-tool/trunk/redwax_openssl.c
==============================================================================
--- redwax-tool/trunk/redwax_openssl.c	(original)
+++ redwax-tool/trunk/redwax_openssl.c	Wed Jul 22 17:14:56 2026
@@ -906,7 +906,7 @@
     return buf;
 }
 
-static const char *redwax_openssl_name(apr_pool_t *p, X509_NAME *name)
+static const char *redwax_openssl_name(apr_pool_t *p, const X509_NAME *name)
 {
     BIO *bio;
     char *buf = NULL;
@@ -1855,7 +1855,7 @@
 
 static apr_status_t redwax_openssl_set_signature(redwax_tool_t *r, const char *arg)
 {
-	int nid = OBJ_txt2nid(arg);
+    int nid = OBJ_txt2nid(arg);
 
     if (nid == NID_undef) {
 
@@ -1875,7 +1875,7 @@
     apr_hash_t *params = data;
 
     if (OBJ_txt2obj(name, 1)) {
-    	return;
+        return;
     }
 
     EVP_SIGNATURE *sig = EVP_SIGNATURE_fetch(NULL, name, NULL);
@@ -1958,7 +1958,7 @@
 
         if (r->signature) {
 
-        	EVP_PKEY *pkey = X509_get0_pubkey(x);
+            EVP_PKEY *pkey = X509_get0_pubkey(x);
 
             if (pkey && !EVP_PKEY_is_a(pkey, r->signature)) {
                 X509_free(x);
@@ -2273,7 +2273,7 @@
     /* signature check */
     if (r->signature && current_cert) {
 
-    	EVP_PKEY *pkey = X509_get0_pubkey(current_cert);
+        EVP_PKEY *pkey = X509_get0_pubkey(current_cert);
 
         int nid;
 
@@ -3843,12 +3843,14 @@
 
             if (label->type == V_ASN1_BMPSTRING) {
 
+                const ASN1_STRING *bmpstring = (const ASN1_STRING *)label->value.asn1_string;
+
 #if HAVE_OPENSSL_UNI2UTF8
-                key->label = OPENSSL_uni2utf8(label->value.bmpstring->data,
-                        label->value.bmpstring->length);
+                key->label = OPENSSL_uni2utf8(ASN1_STRING_get0_data(bmpstring),
+                        ASN1_STRING_length(bmpstring));
 #else
-                key->label = OPENSSL_uni2asc(label->value.bmpstring->data,
-                        label->value.bmpstring->length);
+                key->label = OPENSSL_uni2asc(ASN1_STRING_get0_data(bmpstring),
+                        ASN1_STRING_length(bmpstring));
 #endif
                 key->label_len = strlen(key->label);
 
@@ -3916,12 +3918,14 @@
 
             if (label->type == V_ASN1_BMPSTRING) {
 
+                const ASN1_STRING *bmpstring = (const ASN1_STRING *)label->value.asn1_string;
+
 #if HAVE_OPENSSL_UNI2UTF8
-                key->label = OPENSSL_uni2utf8(label->value.bmpstring->data,
-                        label->value.bmpstring->length);
+                key->label = OPENSSL_uni2utf8(ASN1_STRING_get0_data(bmpstring),
+                        ASN1_STRING_length(bmpstring));
 #else
-                key->label = OPENSSL_uni2asc(label->value.bmpstring->data,
-                        label->value.bmpstring->length);
+                key->label = OPENSSL_uni2asc(ASN1_STRING_get0_data(bmpstring),
+                        ASN1_STRING_length(bmpstring));
 #endif
                 key->label_len = strlen(key->label);
 
@@ -4012,12 +4016,14 @@
 
             if (label->type == V_ASN1_BMPSTRING) {
 
+                const ASN1_STRING *bmpstring = (const ASN1_STRING *)label->value.asn1_string;
+
 #if HAVE_OPENSSL_UNI2UTF8
-                cert->label = OPENSSL_uni2utf8(label->value.bmpstring->data,
-                        label->value.bmpstring->length);
+                cert->label = OPENSSL_uni2utf8(ASN1_STRING_get0_data(bmpstring),
+                        ASN1_STRING_length(bmpstring));
 #else
-                cert->label = OPENSSL_uni2asc(label->value.bmpstring->data,
-                        label->value.bmpstring->length);
+                cert->label = OPENSSL_uni2asc(ASN1_STRING_get0_data(bmpstring),
+                        ASN1_STRING_length(bmpstring));
 #endif
                 cert->label_len = strlen(cert->label);
 
@@ -4531,10 +4537,17 @@
             return APR_EGENERAL;
         }
 
+#if HAVE_SSL_SET1_DNSNAME
+        if (SSL_set1_dnsname(tls_host->ssl, tls_host->hostname) <= 0) {
+            redwax_openssl_print_errors(r);
+            return APR_EGENERAL;
+        }
+#else
         if (SSL_set1_host(tls_host->ssl, tls_host->hostname) <= 0) {
             redwax_openssl_print_errors(r);
             return APR_EGENERAL;
         }
+#endif
 
         if (SSL_set_tlsext_host_name(tls_host->ssl, tls_host->hostname) <= 0) {
             redwax_openssl_print_errors(r);
@@ -4867,7 +4880,7 @@
     }
     else if (x) {
 
-        X509_NAME *subject = X509_get_subject_name(x);
+        const X509_NAME *subject = X509_get_subject_name(x);
         int lastpos = -1;
 
         if (subject) {
@@ -4876,8 +4889,8 @@
 
         if (lastpos > -1) {
 
-            X509_NAME_ENTRY *e;
-            ASN1_STRING *cn;
+            const X509_NAME_ENTRY *e;
+            const ASN1_STRING *cn;
             BIO *lbio;
             char *buf = NULL;
             int len = 0;
@@ -5071,7 +5084,7 @@
 }
 
 static apr_status_t redwax_openssl_general_name_metadata(redwax_tool_t *r,
-        redwax_metadata_t *m, GENERAL_NAME *gen)
+        redwax_metadata_t *m, const GENERAL_NAME *gen)
 {
     BIO *bio;
 
@@ -5082,18 +5095,27 @@
         return APR_ENOMEM;
     }
 
-    switch (gen->type) {
+    int gen_type;
+    void *gen_data = GENERAL_NAME_get0_value(gen, &gen_type);
+
+    switch (gen_type) {
     case GEN_OTHERNAME: {
 
         int nid;
-
-        nid = OBJ_obj2nid(gen->d.otherName->type_id);
+        ASN1_OBJECT *type_id = NULL;
+        ASN1_TYPE *val = NULL;
+
+        if (!GENERAL_NAME_get0_otherName(gen, &type_id, &val)) {
+            break;
+        }
+
+        nid = OBJ_obj2nid(type_id);
 
 #ifdef NID_SRVName
         if ((nid == NID_SRVName
-             && gen->d.otherName->value->type != V_ASN1_IA5STRING)
+             && val->type != V_ASN1_IA5STRING)
                 || (nid != NID_SRVName
-                    && gen->d.otherName->value->type != V_ASN1_UTF8STRING)) {
+                    && val->type != V_ASN1_UTF8STRING)) {
 
             redwax_print_error(r, "metadata-out: unsupported othername with nid %d, ignoring\n",
                     nid);
@@ -5101,6 +5123,8 @@
             break;
         }
 #endif
+
+        const ASN1_STRING *str = (val != NULL) ? val->value.asn1_string : NULL;
 
         switch (nid) {
 #ifdef NID_id_on_SmtpUTF8Mailbox
@@ -5108,7 +5132,7 @@
             key = "OtherName";
             okey = "SmtpUTF8Mailbox";
             BIO_printf(bio, "%s",
-                       gen->d.otherName->value->value.utf8string->data);
+                       ASN1_STRING_get0_data(str));
             break;
 #endif
 #ifdef NID_XmppAddr
@@ -5116,7 +5140,7 @@
             key = "OtherName";
             okey = "XmppAddr";
             BIO_printf(bio, "%s",
-                       gen->d.otherName->value->value.utf8string->data);
+                       ASN1_STRING_get0_data(str));
             break;
 #endif
 #ifdef NID_SRVName
@@ -5124,21 +5148,21 @@
             key = "OtherName";
             okey = "SRVName";
             BIO_printf(bio, "%s",
-                       gen->d.otherName->value->value.ia5string->data);
+                       ASN1_STRING_get0_data(str));
             break;
 #endif
         case NID_ms_upn:
             key = "OtherName";
             okey = "UPN";
             BIO_printf(bio, "%s",
-                       gen->d.otherName->value->value.utf8string->data);
+                       ASN1_STRING_get0_data(str));
             break;
 #ifdef NID_NAIRealm
         case NID_NAIRealm:
             key = "OtherName";
             okey = "NAIRealm";
             BIO_printf(bio, "%s",
-                       gen->d.otherName->value->value.utf8string->data);
+                       ASN1_STRING_get0_data(str));
             break;
 #endif
         default:
@@ -5187,15 +5211,16 @@
     }
     case GEN_IPADD: {
 
-        unsigned char *p;
+        const ASN1_OCTET_STRING *ip_str = (const ASN1_OCTET_STRING *)gen_data;
+        const unsigned char *p = ASN1_STRING_get0_data(ip_str);
+        int ip_len = ASN1_STRING_length(ip_str);
         int i;
 
-        p = gen->d.ip->data;
-        if (gen->d.ip->length == 4) {
+        if (ip_len == 4) {
             key = "IPAddress";
             BIO_printf(bio, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
         }
-        else if (gen->d.ip->length == 16) {
+        else if (ip_len == 16) {
             key = "IPAddress";
             for (i = 0; i < 8; i++) {
                 if (i) {
@@ -5209,7 +5234,7 @@
     }
     case GEN_RID: {
         key = "RegisteredID";
-        i2a_ASN1_OBJECT(bio, gen->d.rid);
+        i2a_ASN1_OBJECT(bio, (const ASN1_OBJECT *)gen_data);
         break;
     }
     }
@@ -5305,7 +5330,7 @@
 static apr_status_t redwax_openssl_extension_metadata(redwax_tool_t *r,
         redwax_metadata_t *m, X509_EXTENSION *ex)
 {
-    ASN1_OBJECT *obj;
+    const ASN1_OBJECT *obj;
 
     BIO *bio;
     char *buf = NULL;
@@ -5343,7 +5368,7 @@
             redwax_metadata_add_boolean(m, "CA", bs->ca);
 
             if (bs->pathlen) {
-                if ((bs->pathlen->type == V_ASN1_NEG_INTEGER) || !bs->ca) {
+                if (!bs->ca) {
                     redwax_metadata_add_boolean(m, "InvalidPathLength", 1);
                 } else {
                     redwax_metadata_add_long(m, "PathLength",
@@ -5363,10 +5388,12 @@
 
         int i, usages = 0;
 
-        if (usage->length > 0) {
-            ex_kusage = usage->data[0];
-            if (usage->length > 1)
-                ex_kusage |= usage->data[1] << 8;
+        if (usage) {
+            for (i = 0; i < 32; i++) {
+                if (ASN1_BIT_STRING_get_bit(usage, i)) {
+                    ex_kusage |= (1U << i);
+                }
+            }
         }
         else {
             ex_kusage = 0;
@@ -5433,10 +5460,12 @@
 
         int i, nscerts = 0;
 
-        if (nscert->length > 0) {
-            ex_nscert = nscert->data[0];
-            if (nscert->length > 1)
-                ex_nscert |= nscert->data[1] << 8;
+        if (nscert) {
+            for (i = 0; i < 32; i++) {
+                if (ASN1_BIT_STRING_get_bit(nscert, i)) {
+                    ex_nscert |= (1U << i);
+                }
+            }
         }
         else {
             ex_nscert = 0;
@@ -5517,9 +5546,12 @@
 
         ASN1_OCTET_STRING *oct = X509V3_EXT_d2i(ex);
 
+        int oct_len = ASN1_STRING_length((const ASN1_STRING *)oct);
+        const unsigned char *oct_data = ASN1_STRING_get0_data((const ASN1_STRING *)oct);
+
         redwax_metadata_add_string(m, "ID",
                 redwax_pencode_base16_binary(m->pool,
-                        oct->data, oct->length,
+                        oct_data, oct_len,
                         REDWAX_ENCODE_LOWER | REDWAX_ENCODE_COLON, NULL));
 
         break;
@@ -5529,10 +5561,13 @@
         AUTHORITY_KEYID *akeyid = X509V3_EXT_d2i(ex);
 
         if (akeyid->keyid) {
+
+            int length = ASN1_STRING_length((const ASN1_STRING *)akeyid->keyid);
+            const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)akeyid->keyid);
 
             redwax_metadata_add_string(m, "ID",
                     redwax_pencode_base16_binary(m->pool,
-                            akeyid->keyid->data, akeyid->keyid->length,
+                            data, length,
                             REDWAX_ENCODE_LOWER | REDWAX_ENCODE_COLON, NULL));
         }
 
@@ -5545,9 +5580,12 @@
 
         if (akeyid->serial) {
 
+            int length = ASN1_STRING_length((const ASN1_STRING *)akeyid->serial);
+            const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)akeyid->serial);
+
             redwax_metadata_add_string(m, "Serial",
                     redwax_pencode_base16_binary(m->pool,
-                            akeyid->serial->data, akeyid->serial->length,
+                            data, length,
                             REDWAX_ENCODE_LOWER | REDWAX_ENCODE_COLON, NULL));
         }
 
@@ -5609,10 +5647,13 @@
                             switch (OBJ_obj2nid(qualinfo->pqualid)) {
                             case NID_id_qt_cps: {
 
+                                int length = ASN1_STRING_length((const ASN1_STRING *)qualinfo->d.cpsuri);
+                                const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)qualinfo->d.cpsuri);
+
                                 redwax_metadata_add_string(m, "CPS",
                                         apr_psprintf(m->pool, "%.*s",
-                                                qualinfo->d.cpsuri->length,
-                                                qualinfo->d.cpsuri->data));
+                                                length,
+                                                data));
 
                                 break;
 
@@ -5630,14 +5671,16 @@
 
                                     ref = notice->noticeref;
 
-                                    if (ref->organization
-                                            && ref->organization->data) {
+                                    if (ref->organization) {
+
+                                        int length = ASN1_STRING_length((const ASN1_STRING *)ref->organization);
+                                        const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)ref->organization);
 
                                         redwax_metadata_add_string(m,
                                                 "Organization",
                                                 apr_psprintf(m->pool, "%.*s",
-                                                        ref->organization->length,
-                                                        ref->organization->data));
+                                                        length,
+                                                        data));
 
                                     }
 
@@ -5684,11 +5727,14 @@
 
                                 if (notice->exptext) {
 
+                                    int length = ASN1_STRING_length((const ASN1_STRING *)notice->exptext);
+                                    const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)notice->exptext);
+
                                     redwax_metadata_add_string(m,
                                             "ExplicitText",
                                             apr_psprintf(m->pool, "%.*s",
-                                                    notice->exptext->length,
-                                                    notice->exptext->data));
+                                                    length,
+                                                    data));
                                 }
 
                                 redwax_metadata_pop_object(m);
@@ -5970,9 +6016,12 @@
 
     if (sig) {
 
+        int length = ASN1_STRING_length((const ASN1_STRING *)sig);
+        const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)sig);
+
         redwax_metadata_add_string(m, "SignatureValue",
                 redwax_pencode_base16_binary(m->pool,
-                        sig->data, sig->length,
+                        data, length,
                         REDWAX_ENCODE_LOWER | REDWAX_ENCODE_COLON, NULL));
     }
 
@@ -6026,7 +6075,7 @@
 
             const STACK_OF(X509_EXTENSION) *xe;
             const ASN1_BIT_STRING *iuid, *suid;
-            X509_PUBKEY *xpkey;
+            const X509_PUBKEY *xpkey;
 #if (OPENSSL_VERSION_NUMBER < 0x10100000L)
             X509_ALGOR *tsig_alg;
 #else
@@ -6060,9 +6109,12 @@
 
             if (bs) {
 
+                int length = ASN1_STRING_length((const ASN1_STRING *)bs);
+                const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)bs);
+
                 redwax_metadata_add_string(m, "SerialNumber",
                         redwax_pencode_base16_binary(m->pool,
-                                bs->data, bs->length,
+                                data, length,
                                 REDWAX_ENCODE_LOWER | REDWAX_ENCODE_COLON, NULL));
             }
 
@@ -6161,16 +6213,24 @@
             X509_get0_uids(x, &iuid, &suid);
 
             if (iuid) {
+
+                int length = ASN1_STRING_length((const ASN1_STRING *)iuid);
+                const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)iuid);
+
                 redwax_metadata_add_string(m, "IssuerUniqueID",
                         redwax_pencode_base16_binary(m->pool,
-                                iuid->data, iuid->length,
+                                data, length,
                                 REDWAX_ENCODE_LOWER, NULL));
             }
 
             if (suid) {
+
+                int length = ASN1_STRING_length((const ASN1_STRING *)suid);
+                const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)suid);
+
                 redwax_metadata_add_string(m, "SubjectUniqueID",
                         redwax_pencode_base16_binary(m->pool,
-                                suid->data, suid->length,
+                                data, length,
                                 REDWAX_ENCODE_LOWER, NULL));
             }
 
@@ -6567,7 +6627,12 @@
     X509 *x1, *x2;
     const ASN1_TIME *a1, *a2, *b1, *b2;
     const unsigned char *der;
+#if HAVE_X509_CHECK_CERTIFICATE_TIMES
+    X509_VERIFY_PARAM *vpm;
+    int v1, v2;
+#else
     int bc1, bc2, ac1, ac2;
+#endif
     int pday, psec, diff;
 
     /* a present certificate always beats an absent certificate */
@@ -6605,6 +6670,38 @@
         X509_free(x1);
         return LEFT;
     }
+
+#if HAVE_X509_CHECK_CERTIFICATE_TIMES
+
+    /* a valid certificate always beats a not-valid certificate */
+
+    vpm = X509_VERIFY_PARAM_new();
+
+    if (r->now) {
+        X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_USE_CHECK_TIME);
+        X509_VERIFY_PARAM_set_time(vpm, *r->now);
+    }
+
+    v1 = X509_check_certificate_times(vpm, x1, NULL);
+    v2 = X509_check_certificate_times(vpm, x2, NULL);
+
+    X509_VERIFY_PARAM_free(vpm);
+
+    if (v1 == v2) {
+        /* we have a tie */
+    }
+    else if (v1 != 1) {
+        X509_free(x1);
+        X509_free(x2);
+        return RIGHT;
+    }
+    else if (v2 != 1) {
+        X509_free(x1);
+        X509_free(x2);
+        return LEFT;
+    }
+
+#else
 
     /* a valid certificate always beats a not-yet-valid certificate */
 
@@ -6649,6 +6746,8 @@
         X509_free(x2);
         return LEFT;
     }
+
+#endif
 
     /* the longest validity beats the shortest validity */
 
@@ -7069,8 +7168,8 @@
     if (cert->der && !cert->x509) {
 
         X509 *x;
-        X509_NAME *name;
-        X509_PUBKEY *pub;
+        const X509_NAME *name;
+        const X509_PUBKEY *pub;
         ASN1_INTEGER *integer;
         ASN1_OCTET_STRING *skid;
         const ASN1_TIME *before, *after;
@@ -7250,11 +7349,11 @@
             unsigned char *der;
 
             int index = X509_NAME_get_index_by_NID(name, NID_commonName, -1);
-            X509_NAME_ENTRY *cnEntry = X509_NAME_get_entry(name, index);
+            const X509_NAME_ENTRY *cnEntry = X509_NAME_get_entry(name, index);
 
             if (cnEntry) {
 
-                ASN1_STRING *cnASN1 = X509_NAME_ENTRY_get_data(cnEntry);
+                const ASN1_STRING *cnASN1 = X509_NAME_ENTRY_get_data(cnEntry);
 
                 if (cnASN1) {
 
@@ -7280,8 +7379,12 @@
 
         skid = X509_get_ext_d2i(x, NID_subject_key_identifier, NULL, NULL);
         if (skid) {
-            x509->skid_len = skid->length;
-            x509->skid_der = apr_pmemdup(cert->pool, skid->data, skid->length);
+
+            int length = ASN1_STRING_length((const ASN1_STRING *)skid);
+            const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)skid);
+
+            x509->skid_len = length;
+            x509->skid_der = apr_pmemdup(cert->pool, data, length);
             ASN1_OCTET_STRING_free(skid);
         }
 


From rt-commit at redwax.eu  Wed Jul 22 19:06:09 2026
From: rt-commit at redwax.eu (rt-commit at redwax.eu)
Date: Wed, 22 Jul 2026 17:06:09 -0000
Subject: [rt-commit] r230 - /redwax-tool/trunk/redwax_openssl.c
Message-ID: <20260722170609.D62326AE8FA@chestnut.redwax.eu>

Author: minfrin at redwax.eu
Date: Wed Jul 22 19:06:08 2026
New Revision: 230

Log:
Reinstate X509_get0_notAfter for the benefit of the time
difference check when using openssl4.

Modified:
    redwax-tool/trunk/redwax_openssl.c

Modified: redwax-tool/trunk/redwax_openssl.c
==============================================================================
--- redwax-tool/trunk/redwax_openssl.c	(original)
+++ redwax-tool/trunk/redwax_openssl.c	Wed Jul 22 19:06:08 2026
@@ -6625,12 +6625,13 @@
         const redwax_certificate_t *c1, const redwax_certificate_t *c2)
 {
     X509 *x1, *x2;
-    const ASN1_TIME *a1, *a2, *b1, *b2;
+    const ASN1_TIME *a1, *a2;
     const unsigned char *der;
 #if HAVE_X509_CHECK_CERTIFICATE_TIMES
     X509_VERIFY_PARAM *vpm;
     int v1, v2;
 #else
+    const ASN1_TIME *b1, *b2;
     int bc1, bc2, ac1, ac2;
 #endif
     int pday, psec, diff;
@@ -6700,6 +6701,9 @@
         X509_free(x2);
         return LEFT;
     }
+
+    a1 = X509_get0_notAfter(x1);
+    a2 = X509_get0_notAfter(x2);
 
 #else
 


From rt-commit at redwax.eu  Wed Jul 22 19:27:59 2026
From: rt-commit at redwax.eu (rt-commit at redwax.eu)
Date: Wed, 22 Jul 2026 17:27:59 -0000
Subject: [rt-commit] r231 - /redwax-tool/trunk/redwax_openssl.c
Message-ID: <20260722172759.99A336AE8E8@chestnut.redwax.eu>

Author: minfrin at redwax.eu
Date: Wed Jul 22 19:27:58 2026
New Revision: 231

Log:
Limit bit field lengths to the length of the table
descriptions.

Modified:
    redwax-tool/trunk/redwax_openssl.c

Modified: redwax-tool/trunk/redwax_openssl.c
==============================================================================
--- redwax-tool/trunk/redwax_openssl.c	(original)
+++ redwax-tool/trunk/redwax_openssl.c	Wed Jul 22 19:27:58 2026
@@ -5389,7 +5389,7 @@
         int i, usages = 0;
 
         if (usage) {
-            for (i = 0; i < 32; i++) {
+            for (i = 0; key_usage_type_table[i].sname; i++) {
                 if (ASN1_BIT_STRING_get_bit(usage, i)) {
                     ex_kusage |= (1U << i);
                 }
@@ -5433,7 +5433,7 @@
 
             redwax_metadata_push_array(m, "ExtendedKeyUsages", 0);
 
-            for (i = 0; i < sk_ASN1_OBJECT_num(eku); i++) {
+            for (i = 0; i < sk_ASN1_OBJECT_num(eku) && key_usage_type_table[i].sname; i++) {
 
                 char obj_tmp[80];
                 ASN1_OBJECT *obj;
@@ -5461,7 +5461,7 @@
         int i, nscerts = 0;
 
         if (nscert) {
-            for (i = 0; i < 32; i++) {
+            for (i = 0; ns_cert_type_table[i].sname; i++) {
                 if (ASN1_BIT_STRING_get_bit(nscert, i)) {
                     ex_nscert |= (1U << i);
                 }


From rt-commit at redwax.eu  Thu Jul 23 10:49:55 2026
From: rt-commit at redwax.eu (rt-commit at redwax.eu)
Date: Thu, 23 Jul 2026 08:49:55 -0000
Subject: [rt-commit] r232 - /redwax-tool/tags/redwax-tool-1.1.0/
Message-ID: <20260723084955.6F2EE6AE951@chestnut.redwax.eu>

Author: minfrin at redwax.eu
Date: Thu Jul 23 10:49:54 2026
New Revision: 232

Log:
Tag v1.1.0 of redwax-tool.

Added:
    redwax-tool/tags/redwax-tool-1.1.0/
      - copied from r231, redwax-tool/trunk/


From rt-commit at redwax.eu  Thu Jul 23 11:01:36 2026
From: rt-commit at redwax.eu (rt-commit at redwax.eu)
Date: Thu, 23 Jul 2026 09:01:36 -0000
Subject: [rt-commit] r65 - in /dev: ChangeLog-redwax-tool-1.1.0
 redwax-tool-1.1.0.tar.bz2 redwax-tool-1.1.0.tar.bz2.asc
 redwax-tool-1.1.0.tar.bz2.sha256 redwax-tool-1.1.0.tar.gz
 redwax-tool-1.1.0.tar.gz.asc redwax-tool-1.1.0.tar.gz.sha256
Message-ID: <20260723090136.D8D8A6AE951@chestnut.redwax.eu>

Author: minfrin at redwax.eu
Date: Thu Jul 23 11:01:34 2026
New Revision: 65

Log:
Propose redwax-tool-1.1.0 for release.

Added:
    dev/ChangeLog-redwax-tool-1.1.0
    dev/redwax-tool-1.1.0.tar.bz2   (with props)
    dev/redwax-tool-1.1.0.tar.bz2.asc   (with props)
    dev/redwax-tool-1.1.0.tar.bz2.sha256
    dev/redwax-tool-1.1.0.tar.gz   (with props)
    dev/redwax-tool-1.1.0.tar.gz.asc   (with props)
    dev/redwax-tool-1.1.0.tar.gz.sha256

Added: dev/ChangeLog-redwax-tool-1.1.0
==============================================================================
--- dev/ChangeLog-redwax-tool-1.1.0	(added)
+++ dev/ChangeLog-redwax-tool-1.1.0	Thu Jul 23 11:01:34 2026
@@ -0,0 +1,15 @@
+Changes with v1.1.0
+
+ *) Support OpenSSL4 by using opaque function
+    accessors. [Graham Leggett]
+
+ *) Add --filter-signature to limit certificates by
+    key type. [Graham Leggett]
+
+ *) Add --pems-out to output certificates as separate
+    files. [Graham Leggett]
+
+ *) Implement the generation of the secret file when
+    the secret file does not exist. [Graham Leggett]
+
+

Added: dev/redwax-tool-1.1.0.tar.bz2
==============================================================================
Binary file - no diff available.

Propchange: dev/redwax-tool-1.1.0.tar.bz2
------------------------------------------------------------------------------
    svn:mime-type = application/x-bzip2

Added: dev/redwax-tool-1.1.0.tar.bz2.asc
==============================================================================
Binary file - no diff available.

Propchange: dev/redwax-tool-1.1.0.tar.bz2.asc
------------------------------------------------------------------------------
    svn:mime-type = application/pgp-signature

Added: dev/redwax-tool-1.1.0.tar.bz2.sha256
==============================================================================
--- dev/redwax-tool-1.1.0.tar.bz2.sha256	(added)
+++ dev/redwax-tool-1.1.0.tar.bz2.sha256	Thu Jul 23 11:01:34 2026
@@ -0,0 +1 @@
+SHA256 (redwax-tool-1.1.0.tar.bz2) = 2e78aa71ea4828480be48bf5988248243d40f060bba4610d0ece4eac00076939

Added: dev/redwax-tool-1.1.0.tar.gz
==============================================================================
Binary file - no diff available.

Propchange: dev/redwax-tool-1.1.0.tar.gz
------------------------------------------------------------------------------
    svn:mime-type = application/gzip

Added: dev/redwax-tool-1.1.0.tar.gz.asc
==============================================================================
Binary file - no diff available.

Propchange: dev/redwax-tool-1.1.0.tar.gz.asc
------------------------------------------------------------------------------
    svn:mime-type = application/pgp-signature

Added: dev/redwax-tool-1.1.0.tar.gz.sha256
==============================================================================
--- dev/redwax-tool-1.1.0.tar.gz.sha256	(added)
+++ dev/redwax-tool-1.1.0.tar.gz.sha256	Thu Jul 23 11:01:34 2026
@@ -0,0 +1 @@
+SHA256 (redwax-tool-1.1.0.tar.gz) = a3a71c163c7b28c75c577452da5383ad75ecaddd669c55980b341f0122317940


From rt-commit at redwax.eu  Thu Jul 23 13:50:31 2026
From: rt-commit at redwax.eu (rt-commit at redwax.eu)
Date: Thu, 23 Jul 2026 11:50:31 -0000
Subject: [rt-commit] r233 - /redwax-tool/branches/redwax-tool-1.1/
Message-ID: <20260723115032.20B706AE958@chestnut.redwax.eu>

Author: minfrin at redwax.eu
Date: Thu Jul 23 13:50:31 2026
New Revision: 233

Log:
Branch v1.1 of redwax-tool.

Added:
    redwax-tool/branches/redwax-tool-1.1/
      - copied from r232, redwax-tool/trunk/


