[rt-commit] r229 - in /redwax-tool/trunk: ChangeLog config.h.in configure.ac redwax_openssl.c
rt-commit at redwax.eu
rt-commit at redwax.eu
Wed Jul 22 17:14:57 CEST 2026
Author: minfrin at redwax.eu
Date: Wed Jul 22 17:14:56 2026
New Revision: 229
Log:
Support OpenSSL4 by using opaque function accessors.
Modified:
redwax-tool/trunk/ChangeLog
redwax-tool/trunk/config.h.in
redwax-tool/trunk/configure.ac
redwax-tool/trunk/redwax_openssl.c
Modified: redwax-tool/trunk/ChangeLog
==============================================================================
--- redwax-tool/trunk/ChangeLog (original)
+++ redwax-tool/trunk/ChangeLog Wed Jul 22 17:14:56 2026
@@ -1,5 +1,8 @@
Changes with v1.1.0
+
+ *) Support OpenSSL4 by using opaque function
+ accessors. [Graham Leggett]
*) Add --filter-signature to limit certificates by
key type. [Graham Leggett]
Modified: redwax-tool/trunk/config.h.in
==============================================================================
--- redwax-tool/trunk/config.h.in (original)
+++ redwax-tool/trunk/config.h.in Wed Jul 22 17:14:56 2026
@@ -116,6 +116,9 @@
/* Define to 1 if you have the <Security/Security.h> header file. */
#undef HAVE_SECURITY_SECURITY_H
+/* Define to 1 if you have the 'SSL_set1_dnsname' function. */
+#undef HAVE_SSL_SET1_DNSNAME
+
/* Define to 1 if stdbool.h conforms to C99. */
#undef HAVE_STDBOOL_H
@@ -145,6 +148,9 @@
/* Define to 1 if you have the <unistd.h> header file. */
#undef HAVE_UNISTD_H
+
+/* Define to 1 if you have the 'X509_check_certificate_times' function. */
+#undef HAVE_X509_CHECK_CERTIFICATE_TIMES
/* Define to 1 if you have the 'X509_get0_extensions' function. */
#undef HAVE_X509_GET0_EXTENSIONS
Modified: redwax-tool/trunk/configure.ac
==============================================================================
--- redwax-tool/trunk/configure.ac (original)
+++ redwax-tool/trunk/configure.ac Wed Jul 22 17:14:56 2026
@@ -158,9 +158,11 @@
ASN1_TIME_print_ex X509_STORE_get0_param X509_STORE_CTX_set0_trusted_stack \
X509_STORE_CTX_get_num_untrusted X509_get0_notBefore X509_get0_notAfter \
X509_get0_tbs_sigalg X509_get0_uids X509_get0_extensions X509_get0_signature \
- X509_get_extension_flags X509_up_ref EVP_PKEY_get0_description EVP_PKEY_CTX_new_from_name \
- EVP_PKEY_get_bn_param RSA_get0_n RSA_get0_e RSA_get0_d RSA_get0_p RSA_get0_q RSA_get0_dmp1 \
+ X509_get_extension_flags X509_up_ref EVP_PKEY_get0_description \
+ X509_check_certificate_times EVP_PKEY_CTX_new_from_name EVP_PKEY_get_bn_param \
+ RSA_get0_n RSA_get0_e RSA_get0_d RSA_get0_p RSA_get0_q RSA_get0_dmp1 \
RSA_get0_dmq1 RSA_get0_iqmp RSA_set0_key RSA_set0_factors RSA_set0_crt_params \
+ SSL_set1_dnsname \
NSS_Initialize p11_kit_modules_load_and_initialize apr_crypto_clear])
AC_OUTPUT
Modified: redwax-tool/trunk/redwax_openssl.c
==============================================================================
--- redwax-tool/trunk/redwax_openssl.c (original)
+++ redwax-tool/trunk/redwax_openssl.c Wed Jul 22 17:14:56 2026
@@ -906,7 +906,7 @@
return buf;
}
-static const char *redwax_openssl_name(apr_pool_t *p, X509_NAME *name)
+static const char *redwax_openssl_name(apr_pool_t *p, const X509_NAME *name)
{
BIO *bio;
char *buf = NULL;
@@ -1855,7 +1855,7 @@
static apr_status_t redwax_openssl_set_signature(redwax_tool_t *r, const char *arg)
{
- int nid = OBJ_txt2nid(arg);
+ int nid = OBJ_txt2nid(arg);
if (nid == NID_undef) {
@@ -1875,7 +1875,7 @@
apr_hash_t *params = data;
if (OBJ_txt2obj(name, 1)) {
- return;
+ return;
}
EVP_SIGNATURE *sig = EVP_SIGNATURE_fetch(NULL, name, NULL);
@@ -1958,7 +1958,7 @@
if (r->signature) {
- EVP_PKEY *pkey = X509_get0_pubkey(x);
+ EVP_PKEY *pkey = X509_get0_pubkey(x);
if (pkey && !EVP_PKEY_is_a(pkey, r->signature)) {
X509_free(x);
@@ -2273,7 +2273,7 @@
/* signature check */
if (r->signature && current_cert) {
- EVP_PKEY *pkey = X509_get0_pubkey(current_cert);
+ EVP_PKEY *pkey = X509_get0_pubkey(current_cert);
int nid;
@@ -3843,12 +3843,14 @@
if (label->type == V_ASN1_BMPSTRING) {
+ const ASN1_STRING *bmpstring = (const ASN1_STRING *)label->value.asn1_string;
+
#if HAVE_OPENSSL_UNI2UTF8
- key->label = OPENSSL_uni2utf8(label->value.bmpstring->data,
- label->value.bmpstring->length);
+ key->label = OPENSSL_uni2utf8(ASN1_STRING_get0_data(bmpstring),
+ ASN1_STRING_length(bmpstring));
#else
- key->label = OPENSSL_uni2asc(label->value.bmpstring->data,
- label->value.bmpstring->length);
+ key->label = OPENSSL_uni2asc(ASN1_STRING_get0_data(bmpstring),
+ ASN1_STRING_length(bmpstring));
#endif
key->label_len = strlen(key->label);
@@ -3916,12 +3918,14 @@
if (label->type == V_ASN1_BMPSTRING) {
+ const ASN1_STRING *bmpstring = (const ASN1_STRING *)label->value.asn1_string;
+
#if HAVE_OPENSSL_UNI2UTF8
- key->label = OPENSSL_uni2utf8(label->value.bmpstring->data,
- label->value.bmpstring->length);
+ key->label = OPENSSL_uni2utf8(ASN1_STRING_get0_data(bmpstring),
+ ASN1_STRING_length(bmpstring));
#else
- key->label = OPENSSL_uni2asc(label->value.bmpstring->data,
- label->value.bmpstring->length);
+ key->label = OPENSSL_uni2asc(ASN1_STRING_get0_data(bmpstring),
+ ASN1_STRING_length(bmpstring));
#endif
key->label_len = strlen(key->label);
@@ -4012,12 +4016,14 @@
if (label->type == V_ASN1_BMPSTRING) {
+ const ASN1_STRING *bmpstring = (const ASN1_STRING *)label->value.asn1_string;
+
#if HAVE_OPENSSL_UNI2UTF8
- cert->label = OPENSSL_uni2utf8(label->value.bmpstring->data,
- label->value.bmpstring->length);
+ cert->label = OPENSSL_uni2utf8(ASN1_STRING_get0_data(bmpstring),
+ ASN1_STRING_length(bmpstring));
#else
- cert->label = OPENSSL_uni2asc(label->value.bmpstring->data,
- label->value.bmpstring->length);
+ cert->label = OPENSSL_uni2asc(ASN1_STRING_get0_data(bmpstring),
+ ASN1_STRING_length(bmpstring));
#endif
cert->label_len = strlen(cert->label);
@@ -4531,10 +4537,17 @@
return APR_EGENERAL;
}
+#if HAVE_SSL_SET1_DNSNAME
+ if (SSL_set1_dnsname(tls_host->ssl, tls_host->hostname) <= 0) {
+ redwax_openssl_print_errors(r);
+ return APR_EGENERAL;
+ }
+#else
if (SSL_set1_host(tls_host->ssl, tls_host->hostname) <= 0) {
redwax_openssl_print_errors(r);
return APR_EGENERAL;
}
+#endif
if (SSL_set_tlsext_host_name(tls_host->ssl, tls_host->hostname) <= 0) {
redwax_openssl_print_errors(r);
@@ -4867,7 +4880,7 @@
}
else if (x) {
- X509_NAME *subject = X509_get_subject_name(x);
+ const X509_NAME *subject = X509_get_subject_name(x);
int lastpos = -1;
if (subject) {
@@ -4876,8 +4889,8 @@
if (lastpos > -1) {
- X509_NAME_ENTRY *e;
- ASN1_STRING *cn;
+ const X509_NAME_ENTRY *e;
+ const ASN1_STRING *cn;
BIO *lbio;
char *buf = NULL;
int len = 0;
@@ -5071,7 +5084,7 @@
}
static apr_status_t redwax_openssl_general_name_metadata(redwax_tool_t *r,
- redwax_metadata_t *m, GENERAL_NAME *gen)
+ redwax_metadata_t *m, const GENERAL_NAME *gen)
{
BIO *bio;
@@ -5082,18 +5095,27 @@
return APR_ENOMEM;
}
- switch (gen->type) {
+ int gen_type;
+ void *gen_data = GENERAL_NAME_get0_value(gen, &gen_type);
+
+ switch (gen_type) {
case GEN_OTHERNAME: {
int nid;
-
- nid = OBJ_obj2nid(gen->d.otherName->type_id);
+ ASN1_OBJECT *type_id = NULL;
+ ASN1_TYPE *val = NULL;
+
+ if (!GENERAL_NAME_get0_otherName(gen, &type_id, &val)) {
+ break;
+ }
+
+ nid = OBJ_obj2nid(type_id);
#ifdef NID_SRVName
if ((nid == NID_SRVName
- && gen->d.otherName->value->type != V_ASN1_IA5STRING)
+ && val->type != V_ASN1_IA5STRING)
|| (nid != NID_SRVName
- && gen->d.otherName->value->type != V_ASN1_UTF8STRING)) {
+ && val->type != V_ASN1_UTF8STRING)) {
redwax_print_error(r, "metadata-out: unsupported othername with nid %d, ignoring\n",
nid);
@@ -5101,6 +5123,8 @@
break;
}
#endif
+
+ const ASN1_STRING *str = (val != NULL) ? val->value.asn1_string : NULL;
switch (nid) {
#ifdef NID_id_on_SmtpUTF8Mailbox
@@ -5108,7 +5132,7 @@
key = "OtherName";
okey = "SmtpUTF8Mailbox";
BIO_printf(bio, "%s",
- gen->d.otherName->value->value.utf8string->data);
+ ASN1_STRING_get0_data(str));
break;
#endif
#ifdef NID_XmppAddr
@@ -5116,7 +5140,7 @@
key = "OtherName";
okey = "XmppAddr";
BIO_printf(bio, "%s",
- gen->d.otherName->value->value.utf8string->data);
+ ASN1_STRING_get0_data(str));
break;
#endif
#ifdef NID_SRVName
@@ -5124,21 +5148,21 @@
key = "OtherName";
okey = "SRVName";
BIO_printf(bio, "%s",
- gen->d.otherName->value->value.ia5string->data);
+ ASN1_STRING_get0_data(str));
break;
#endif
case NID_ms_upn:
key = "OtherName";
okey = "UPN";
BIO_printf(bio, "%s",
- gen->d.otherName->value->value.utf8string->data);
+ ASN1_STRING_get0_data(str));
break;
#ifdef NID_NAIRealm
case NID_NAIRealm:
key = "OtherName";
okey = "NAIRealm";
BIO_printf(bio, "%s",
- gen->d.otherName->value->value.utf8string->data);
+ ASN1_STRING_get0_data(str));
break;
#endif
default:
@@ -5187,15 +5211,16 @@
}
case GEN_IPADD: {
- unsigned char *p;
+ const ASN1_OCTET_STRING *ip_str = (const ASN1_OCTET_STRING *)gen_data;
+ const unsigned char *p = ASN1_STRING_get0_data(ip_str);
+ int ip_len = ASN1_STRING_length(ip_str);
int i;
- p = gen->d.ip->data;
- if (gen->d.ip->length == 4) {
+ if (ip_len == 4) {
key = "IPAddress";
BIO_printf(bio, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
}
- else if (gen->d.ip->length == 16) {
+ else if (ip_len == 16) {
key = "IPAddress";
for (i = 0; i < 8; i++) {
if (i) {
@@ -5209,7 +5234,7 @@
}
case GEN_RID: {
key = "RegisteredID";
- i2a_ASN1_OBJECT(bio, gen->d.rid);
+ i2a_ASN1_OBJECT(bio, (const ASN1_OBJECT *)gen_data);
break;
}
}
@@ -5305,7 +5330,7 @@
static apr_status_t redwax_openssl_extension_metadata(redwax_tool_t *r,
redwax_metadata_t *m, X509_EXTENSION *ex)
{
- ASN1_OBJECT *obj;
+ const ASN1_OBJECT *obj;
BIO *bio;
char *buf = NULL;
@@ -5343,7 +5368,7 @@
redwax_metadata_add_boolean(m, "CA", bs->ca);
if (bs->pathlen) {
- if ((bs->pathlen->type == V_ASN1_NEG_INTEGER) || !bs->ca) {
+ if (!bs->ca) {
redwax_metadata_add_boolean(m, "InvalidPathLength", 1);
} else {
redwax_metadata_add_long(m, "PathLength",
@@ -5363,10 +5388,12 @@
int i, usages = 0;
- if (usage->length > 0) {
- ex_kusage = usage->data[0];
- if (usage->length > 1)
- ex_kusage |= usage->data[1] << 8;
+ if (usage) {
+ for (i = 0; i < 32; i++) {
+ if (ASN1_BIT_STRING_get_bit(usage, i)) {
+ ex_kusage |= (1U << i);
+ }
+ }
}
else {
ex_kusage = 0;
@@ -5433,10 +5460,12 @@
int i, nscerts = 0;
- if (nscert->length > 0) {
- ex_nscert = nscert->data[0];
- if (nscert->length > 1)
- ex_nscert |= nscert->data[1] << 8;
+ if (nscert) {
+ for (i = 0; i < 32; i++) {
+ if (ASN1_BIT_STRING_get_bit(nscert, i)) {
+ ex_nscert |= (1U << i);
+ }
+ }
}
else {
ex_nscert = 0;
@@ -5517,9 +5546,12 @@
ASN1_OCTET_STRING *oct = X509V3_EXT_d2i(ex);
+ int oct_len = ASN1_STRING_length((const ASN1_STRING *)oct);
+ const unsigned char *oct_data = ASN1_STRING_get0_data((const ASN1_STRING *)oct);
+
redwax_metadata_add_string(m, "ID",
redwax_pencode_base16_binary(m->pool,
- oct->data, oct->length,
+ oct_data, oct_len,
REDWAX_ENCODE_LOWER | REDWAX_ENCODE_COLON, NULL));
break;
@@ -5529,10 +5561,13 @@
AUTHORITY_KEYID *akeyid = X509V3_EXT_d2i(ex);
if (akeyid->keyid) {
+
+ int length = ASN1_STRING_length((const ASN1_STRING *)akeyid->keyid);
+ const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)akeyid->keyid);
redwax_metadata_add_string(m, "ID",
redwax_pencode_base16_binary(m->pool,
- akeyid->keyid->data, akeyid->keyid->length,
+ data, length,
REDWAX_ENCODE_LOWER | REDWAX_ENCODE_COLON, NULL));
}
@@ -5545,9 +5580,12 @@
if (akeyid->serial) {
+ int length = ASN1_STRING_length((const ASN1_STRING *)akeyid->serial);
+ const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)akeyid->serial);
+
redwax_metadata_add_string(m, "Serial",
redwax_pencode_base16_binary(m->pool,
- akeyid->serial->data, akeyid->serial->length,
+ data, length,
REDWAX_ENCODE_LOWER | REDWAX_ENCODE_COLON, NULL));
}
@@ -5609,10 +5647,13 @@
switch (OBJ_obj2nid(qualinfo->pqualid)) {
case NID_id_qt_cps: {
+ int length = ASN1_STRING_length((const ASN1_STRING *)qualinfo->d.cpsuri);
+ const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)qualinfo->d.cpsuri);
+
redwax_metadata_add_string(m, "CPS",
apr_psprintf(m->pool, "%.*s",
- qualinfo->d.cpsuri->length,
- qualinfo->d.cpsuri->data));
+ length,
+ data));
break;
@@ -5630,14 +5671,16 @@
ref = notice->noticeref;
- if (ref->organization
- && ref->organization->data) {
+ if (ref->organization) {
+
+ int length = ASN1_STRING_length((const ASN1_STRING *)ref->organization);
+ const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)ref->organization);
redwax_metadata_add_string(m,
"Organization",
apr_psprintf(m->pool, "%.*s",
- ref->organization->length,
- ref->organization->data));
+ length,
+ data));
}
@@ -5684,11 +5727,14 @@
if (notice->exptext) {
+ int length = ASN1_STRING_length((const ASN1_STRING *)notice->exptext);
+ const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)notice->exptext);
+
redwax_metadata_add_string(m,
"ExplicitText",
apr_psprintf(m->pool, "%.*s",
- notice->exptext->length,
- notice->exptext->data));
+ length,
+ data));
}
redwax_metadata_pop_object(m);
@@ -5970,9 +6016,12 @@
if (sig) {
+ int length = ASN1_STRING_length((const ASN1_STRING *)sig);
+ const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)sig);
+
redwax_metadata_add_string(m, "SignatureValue",
redwax_pencode_base16_binary(m->pool,
- sig->data, sig->length,
+ data, length,
REDWAX_ENCODE_LOWER | REDWAX_ENCODE_COLON, NULL));
}
@@ -6026,7 +6075,7 @@
const STACK_OF(X509_EXTENSION) *xe;
const ASN1_BIT_STRING *iuid, *suid;
- X509_PUBKEY *xpkey;
+ const X509_PUBKEY *xpkey;
#if (OPENSSL_VERSION_NUMBER < 0x10100000L)
X509_ALGOR *tsig_alg;
#else
@@ -6060,9 +6109,12 @@
if (bs) {
+ int length = ASN1_STRING_length((const ASN1_STRING *)bs);
+ const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)bs);
+
redwax_metadata_add_string(m, "SerialNumber",
redwax_pencode_base16_binary(m->pool,
- bs->data, bs->length,
+ data, length,
REDWAX_ENCODE_LOWER | REDWAX_ENCODE_COLON, NULL));
}
@@ -6161,16 +6213,24 @@
X509_get0_uids(x, &iuid, &suid);
if (iuid) {
+
+ int length = ASN1_STRING_length((const ASN1_STRING *)iuid);
+ const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)iuid);
+
redwax_metadata_add_string(m, "IssuerUniqueID",
redwax_pencode_base16_binary(m->pool,
- iuid->data, iuid->length,
+ data, length,
REDWAX_ENCODE_LOWER, NULL));
}
if (suid) {
+
+ int length = ASN1_STRING_length((const ASN1_STRING *)suid);
+ const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)suid);
+
redwax_metadata_add_string(m, "SubjectUniqueID",
redwax_pencode_base16_binary(m->pool,
- suid->data, suid->length,
+ data, length,
REDWAX_ENCODE_LOWER, NULL));
}
@@ -6567,7 +6627,12 @@
X509 *x1, *x2;
const ASN1_TIME *a1, *a2, *b1, *b2;
const unsigned char *der;
+#if HAVE_X509_CHECK_CERTIFICATE_TIMES
+ X509_VERIFY_PARAM *vpm;
+ int v1, v2;
+#else
int bc1, bc2, ac1, ac2;
+#endif
int pday, psec, diff;
/* a present certificate always beats an absent certificate */
@@ -6605,6 +6670,38 @@
X509_free(x1);
return LEFT;
}
+
+#if HAVE_X509_CHECK_CERTIFICATE_TIMES
+
+ /* a valid certificate always beats a not-valid certificate */
+
+ vpm = X509_VERIFY_PARAM_new();
+
+ if (r->now) {
+ X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_USE_CHECK_TIME);
+ X509_VERIFY_PARAM_set_time(vpm, *r->now);
+ }
+
+ v1 = X509_check_certificate_times(vpm, x1, NULL);
+ v2 = X509_check_certificate_times(vpm, x2, NULL);
+
+ X509_VERIFY_PARAM_free(vpm);
+
+ if (v1 == v2) {
+ /* we have a tie */
+ }
+ else if (v1 != 1) {
+ X509_free(x1);
+ X509_free(x2);
+ return RIGHT;
+ }
+ else if (v2 != 1) {
+ X509_free(x1);
+ X509_free(x2);
+ return LEFT;
+ }
+
+#else
/* a valid certificate always beats a not-yet-valid certificate */
@@ -6649,6 +6746,8 @@
X509_free(x2);
return LEFT;
}
+
+#endif
/* the longest validity beats the shortest validity */
@@ -7069,8 +7168,8 @@
if (cert->der && !cert->x509) {
X509 *x;
- X509_NAME *name;
- X509_PUBKEY *pub;
+ const X509_NAME *name;
+ const X509_PUBKEY *pub;
ASN1_INTEGER *integer;
ASN1_OCTET_STRING *skid;
const ASN1_TIME *before, *after;
@@ -7250,11 +7349,11 @@
unsigned char *der;
int index = X509_NAME_get_index_by_NID(name, NID_commonName, -1);
- X509_NAME_ENTRY *cnEntry = X509_NAME_get_entry(name, index);
+ const X509_NAME_ENTRY *cnEntry = X509_NAME_get_entry(name, index);
if (cnEntry) {
- ASN1_STRING *cnASN1 = X509_NAME_ENTRY_get_data(cnEntry);
+ const ASN1_STRING *cnASN1 = X509_NAME_ENTRY_get_data(cnEntry);
if (cnASN1) {
@@ -7280,8 +7379,12 @@
skid = X509_get_ext_d2i(x, NID_subject_key_identifier, NULL, NULL);
if (skid) {
- x509->skid_len = skid->length;
- x509->skid_der = apr_pmemdup(cert->pool, skid->data, skid->length);
+
+ int length = ASN1_STRING_length((const ASN1_STRING *)skid);
+ const unsigned char *data = ASN1_STRING_get0_data((const ASN1_STRING *)skid);
+
+ x509->skid_len = length;
+ x509->skid_der = apr_pmemdup(cert->pool, data, length);
ASN1_OCTET_STRING_free(skid);
}
More information about the rt-commit
mailing list