Skip to content

Commit 38647b3

Browse files
panvapanva
authored
src: enable compilation/linking with OpenSSL 4.0
PR-URL: #62410 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>
1 parent 1baafcc commit 38647b3

File tree

7 files changed

+52
-33
lines changed

7 files changed

+52
-33
lines changed

‎deps/ncrypto/ncrypto.cc‎

Lines changed: 34 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -777,19 +777,25 @@ bool PrintGeneralName(const BIOPointer& out, const GENERAL_NAME* gen) {
777777
// Note that the preferred name syntax (see RFCs 5280 and 1034) with
778778
// wildcards is a subset of what we consider "safe", so spec-compliant DNS
779779
// names will never need to be escaped.
780-
PrintAltName(out, reinterpret_cast<const char*>(name->data), name->length);
780+
PrintAltName(out,
781+
reinterpret_cast<const char*>(ASN1_STRING_get0_data(name)),
782+
ASN1_STRING_length(name));
781783
} else if (gen->type == GEN_EMAIL) {
782784
ASN1_IA5STRING* name = gen->d.rfc822Name;
783785
BIO_write(out.get(), "email:", 6);
784-
PrintAltName(out, reinterpret_cast<const char*>(name->data), name->length);
786+
PrintAltName(out,
787+
reinterpret_cast<const char*>(ASN1_STRING_get0_data(name)),
788+
ASN1_STRING_length(name));
785789
} else if (gen->type == GEN_URI) {
786790
ASN1_IA5STRING* name = gen->d.uniformResourceIdentifier;
787791
BIO_write(out.get(), "URI:", 4);
788792
// The set of "safe" names was designed to include just about any URI,
789793
// with a few exceptions, most notably URIs that contains commas (see
790794
// RFC 2396). In other words, most legitimate URIs will not require
791795
// escaping.
792-
PrintAltName(out, reinterpret_cast<const char*>(name->data), name->length);
796+
PrintAltName(out,
797+
reinterpret_cast<const char*>(ASN1_STRING_get0_data(name)),
798+
ASN1_STRING_length(name));
793799
} else if (gen->type == GEN_DIRNAME) {
794800
// Earlier versions of Node.js used X509_NAME_oneline to print the X509_NAME
795801
// object. The format was non standard and should be avoided. The use of
@@ -822,17 +828,18 @@ bool PrintGeneralName(const BIOPointer& out, const GENERAL_NAME* gen) {
822828
} else if (gen->type == GEN_IPADD) {
823829
BIO_printf(out.get(), "IP Address:");
824830
const ASN1_OCTET_STRING* ip = gen->d.ip;
825-
const unsigned char* b = ip->data;
826-
if (ip->length == 4) {
831+
const unsigned char* b = ASN1_STRING_get0_data(ip);
832+
int ip_len = ASN1_STRING_length(ip);
833+
if (ip_len == 4) {
827834
BIO_printf(out.get(), "%d.%d.%d.%d", b[0], b[1], b[2], b[3]);
828-
} else if (ip->length == 16) {
835+
} else if (ip_len == 16) {
829836
for (unsigned int j = 0; j < 8; j++) {
830837
uint16_t pair = (b[2 * j] << 8) | b[2 * j + 1];
831838
BIO_printf(out.get(), (j == 0) ? "%X" : ":%X", pair);
832839
}
833840
} else {
834841
#if OPENSSL_VERSION_MAJOR >= 3
835-
BIO_printf(out.get(), "<invalid length=%d>", ip->length);
842+
BIO_printf(out.get(), "<invalid length=%d>", ip_len);
836843
#else
837844
BIO_printf(out.get(), "<invalid>");
838845
#endif
@@ -882,15 +889,15 @@ bool PrintGeneralName(const BIOPointer& out, const GENERAL_NAME* gen) {
882889
if (unicode) {
883890
auto name = gen->d.otherName->value->value.utf8string;
884891
PrintAltName(out,
885-
reinterpret_cast<const char*>(name->data),
886-
name->length,
892+
reinterpret_cast<const char*>(ASN1_STRING_get0_data(name)),
893+
ASN1_STRING_length(name),
887894
AltNameOption::UTF8,
888895
prefix);
889896
} else {
890897
auto name = gen->d.otherName->value->value.ia5string;
891898
PrintAltName(out,
892-
reinterpret_cast<const char*>(name->data),
893-
name->length,
899+
reinterpret_cast<const char*>(ASN1_STRING_get0_data(name)),
900+
ASN1_STRING_length(name),
894901
AltNameOption::NONE,
895902
prefix);
896903
}
@@ -911,11 +918,14 @@ bool PrintGeneralName(const BIOPointer& out, const GENERAL_NAME* gen) {
911918
}
912919
} // namespace
913920

914-
bool SafeX509SubjectAltNamePrint(const BIOPointer& out, X509_EXTENSION* ext) {
915-
auto ret = OBJ_obj2nid(X509_EXTENSION_get_object(ext));
921+
bool SafeX509SubjectAltNamePrint(const BIOPointer& out,
922+
const X509_EXTENSION* ext) {
923+
// const_cast needed for OpenSSL < 4.0 which lacks const-correctness
924+
auto* mext = const_cast<X509_EXTENSION*>(ext);
925+
auto ret = OBJ_obj2nid(X509_EXTENSION_get_object(mext));
916926
if (ret != NID_subject_alt_name) return false;
917927

918-
GENERAL_NAMES* names = static_cast<GENERAL_NAMES*>(X509V3_EXT_d2i(ext));
928+
GENERAL_NAMES* names = static_cast<GENERAL_NAMES*>(X509V3_EXT_d2i(mext));
919929
if (names == nullptr) return false;
920930

921931
bool ok = true;
@@ -934,12 +944,14 @@ bool SafeX509SubjectAltNamePrint(const BIOPointer& out, X509_EXTENSION* ext) {
934944
return ok;
935945
}
936946

937-
bool SafeX509InfoAccessPrint(const BIOPointer& out, X509_EXTENSION* ext) {
938-
auto ret = OBJ_obj2nid(X509_EXTENSION_get_object(ext));
947+
bool SafeX509InfoAccessPrint(const BIOPointer& out, const X509_EXTENSION* ext) {
948+
// const_cast needed for OpenSSL < 4.0 which lacks const-correctness
949+
auto* mext = const_cast<X509_EXTENSION*>(ext);
950+
auto ret = OBJ_obj2nid(X509_EXTENSION_get_object(mext));
939951
if (ret != NID_info_access) return false;
940952

941953
AUTHORITY_INFO_ACCESS* descs =
942-
static_cast<AUTHORITY_INFO_ACCESS*>(X509V3_EXT_d2i(ext));
954+
static_cast<AUTHORITY_INFO_ACCESS*>(X509V3_EXT_d2i(mext));
943955
if (descs == nullptr) return false;
944956

945957
bool ok = true;
@@ -1083,7 +1095,7 @@ BIOPointer X509View::getValidFrom() const {
10831095
if (cert_ == nullptr) return {};
10841096
BIOPointer bio(BIO_new(BIO_s_mem()));
10851097
if (!bio) return {};
1086-
ASN1_TIME_print(bio.get(), X509_get_notBefore(cert_));
1098+
ASN1_TIME_print(bio.get(), X509_get0_notBefore(cert_));
10871099
return bio;
10881100
}
10891101

@@ -1092,7 +1104,7 @@ BIOPointer X509View::getValidTo() const {
10921104
if (cert_ == nullptr) return {};
10931105
BIOPointer bio(BIO_new(BIO_s_mem()));
10941106
if (!bio) return {};
1095-
ASN1_TIME_print(bio.get(), X509_get_notAfter(cert_));
1107+
ASN1_TIME_print(bio.get(), X509_get0_notAfter(cert_));
10961108
return bio;
10971109
}
10981110

@@ -4643,12 +4655,12 @@ bool X509Name::Iterator::operator!=(const Iterator& other) const {
46434655
std::pair<std::string, std::string> X509Name::Iterator::operator*() const {
46444656
if (loc_ == name_.total_) return {{}, {}};
46454657

4646-
X509_NAME_ENTRY* entry = X509_NAME_get_entry(name_, loc_);
4658+
const X509_NAME_ENTRY* entry = X509_NAME_get_entry(name_, loc_);
46474659
if (entry == nullptr) [[unlikely]]
46484660
return {{}, {}};
46494661

4650-
ASN1_OBJECT* name = X509_NAME_ENTRY_get_object(entry);
4651-
ASN1_STRING* value = X509_NAME_ENTRY_get_data(entry);
4662+
const ASN1_OBJECT* name = X509_NAME_ENTRY_get_object(entry);
4663+
const ASN1_STRING* value = X509_NAME_ENTRY_get_data(entry);
46524664

46534665
if (name == nullptr || value == nullptr) [[unlikely]] {
46544666
return {{}, {}};

‎deps/ncrypto/ncrypto.h‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1578,8 +1578,9 @@ int NoPasswordCallback(char* buf, int size, int rwflag, void* u);
15781578

15791579
int PasswordCallback(char* buf, int size, int rwflag, void* u);
15801580

1581-
bool SafeX509SubjectAltNamePrint(const BIOPointer& out, X509_EXTENSION* ext);
1582-
bool SafeX509InfoAccessPrint(const BIOPointer& out, X509_EXTENSION* ext);
1581+
bool SafeX509SubjectAltNamePrint(const BIOPointer& out,
1582+
const X509_EXTENSION* ext);
1583+
bool SafeX509InfoAccessPrint(const BIOPointer& out, const X509_EXTENSION* ext);
15831584

15841585
// ============================================================================
15851586
// SPKAC

‎test/parallel/test-tls-client-auth.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,8 +82,9 @@ connect({
8282
}, common.mustCall((err, pair, cleanup) => {
8383
assert.strictEqual(pair.server.err.code,
8484
'ERR_SSL_PEER_DID_NOT_RETURN_A_CERTIFICATE');
85-
const expectedErr = hasOpenSSL(3, 2) ?
86-
'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
85+
const expectedErr = hasOpenSSL(4, 0) ?
86+
'ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE' : hasOpenSSL(3, 2) ?
87+
'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
8788
assert.strictEqual(pair.client.err.code,
8889
expectedErr);
8990
return cleanup();

‎test/parallel/test-tls-empty-sni-context.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,9 @@ const server = tls.createServer(options, (c) => {
2626
}, common.mustNotCall());
2727

2828
c.on('error', common.mustCall((err) => {
29-
const expectedErr = hasOpenSSL(3, 2) ?
30-
'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
29+
const expectedErr = hasOpenSSL(4, 0) ?
30+
'ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE' : hasOpenSSL(3, 2) ?
31+
'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
3132
assert.strictEqual(err.code, expectedErr);
3233
}));
3334
}));

‎test/parallel/test-tls-psk-circuit.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,8 +64,9 @@ test({ psk: USERS.UserA, identity: 'UserA' }, { minVersion: 'TLSv1.3' });
6464
test({ psk: USERS.UserB, identity: 'UserB' });
6565
test({ psk: USERS.UserB, identity: 'UserB' }, { minVersion: 'TLSv1.3' });
6666
// Unrecognized user should fail handshake
67-
const expectedHandshakeErr = hasOpenSSL(3, 2) ?
68-
'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
67+
const expectedHandshakeErr = hasOpenSSL(4, 0) ?
68+
'ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE' : hasOpenSSL(3, 2) ?
69+
'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
6970
test({ psk: USERS.UserB, identity: 'UserC' }, {}, expectedHandshakeErr);
7071
// Recognized user but incorrect secret should fail handshake
7172
const expectedIllegalParameterErr = hasOpenSSL(3, 4) ? 'ERR_SSL_TLSV1_ALERT_DECRYPT_ERROR' :

‎test/parallel/test-tls-set-ciphers.js‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,9 @@ function test(cciphers, sciphers, cipher, cerr, serr, options) {
9090
const U = undefined;
9191

9292
let expectedTLSAlertError = 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
93-
if (hasOpenSSL(3, 2)) {
93+
if (hasOpenSSL(4, 0)) {
94+
expectedTLSAlertError = 'ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE';
95+
} else if (hasOpenSSL(3, 2)) {
9496
expectedTLSAlertError = 'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE';
9597
}
9698

‎test/parallel/test-tls-set-sigalgs.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,8 +66,9 @@ test('RSA-PSS+SHA256:RSA-PSS+SHA512:ECDSA+SHA256',
6666
['RSA-PSS+SHA256', 'ECDSA+SHA256']);
6767

6868
// Do not have shared sigalgs.
69-
const handshakeErr = hasOpenSSL(3, 2) ?
70-
'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
69+
const handshakeErr = hasOpenSSL(4, 0) ?
70+
'ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE' : hasOpenSSL(3, 2) ?
71+
'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
7172
test('RSA-PSS+SHA384', 'ECDSA+SHA256',
7273
undefined, handshakeErr,
7374
'ERR_SSL_NO_SHARED_SIGNATURE_ALGORITHMS');

0 commit comments

Comments
 (0)