--- ice-3.7.10/cpp/src/IceSSL/OpenSSLCertificateI.cpp +++ ice-3.7.10/cpp/src/IceSSL/OpenSSLCertificateI.cpp @@ -14,6 +14,12 @@ #include #include +/* ASN1_STRING_get_length() was added in OpenSSL 4.1; ASN1_STRING_length() + * is the equivalent on OpenSSL < 4.1 and returns int rather than size_t. */ +#if OPENSSL_VERSION_NUMBER < 0x40100000L +# define ASN1_STRING_get_length(x) ((size_t)ASN1_STRING_length(x)) +#endif + using namespace IceSSL; using namespace std; @@ -49,7 +55,7 @@ { static string -convertX509NameToString(X509_name_st* name) +convertX509NameToString(const X509_name_st* name) { BIO* out = BIO_new(BIO_s_mem()); X509_NAME_print_ex(out, name, 0, XN_FLAG_RFC2253); @@ -78,18 +84,18 @@ case GEN_EMAIL: { ASN1_IA5STRING* str = gen->d.rfc822Name; - if (str && str->type == V_ASN1_IA5STRING && str->data && str->length > 0) + if (str && ASN1_STRING_type(str) == V_ASN1_IA5STRING && ASN1_STRING_get0_data(str) && ASN1_STRING_get_length(str) > 0) { - p.second = string(reinterpret_cast(str->data), str->length); + p.second = string(reinterpret_cast(ASN1_STRING_get0_data(str)), ASN1_STRING_get_length(str)); } break; } case GEN_DNS: { ASN1_IA5STRING* str = gen->d.dNSName; - if (str && str->type == V_ASN1_IA5STRING && str->data && str->length > 0) + if (str && ASN1_STRING_type(str) == V_ASN1_IA5STRING && ASN1_STRING_get0_data(str) && ASN1_STRING_get_length(str) > 0) { - p.second = string(reinterpret_cast(str->data), str->length); + p.second = string(reinterpret_cast(ASN1_STRING_get0_data(str)), ASN1_STRING_get_length(str)); } break; } @@ -101,9 +107,9 @@ case GEN_URI: { ASN1_IA5STRING* str = gen->d.uniformResourceIdentifier; - if (str && str->type == V_ASN1_IA5STRING && str->data && str->length > 0) + if (str && ASN1_STRING_type(str) == V_ASN1_IA5STRING && ASN1_STRING_get0_data(str) && ASN1_STRING_get_length(str) > 0) { - p.second = string(reinterpret_cast(str->data), str->length); + p.second = string(reinterpret_cast(ASN1_STRING_get0_data(str)), ASN1_STRING_get_length(str)); } break; } @@ -111,7 +117,7 @@ { ASN1_OCTET_STRING* addr = gen->d.iPAddress; // TODO: Support IPv6 someday. - if (addr && addr->type == V_ASN1_OCTET_STRING && addr->data && addr->length == 4) + if (addr && ASN1_STRING_type(addr) == V_ASN1_OCTET_STRING && ASN1_STRING_get0_data(addr) && ASN1_STRING_get_length(addr) == 4) { ostringstream ostr; for (int j = 0; j < 4; ++j) @@ -120,7 +126,7 @@ { ostr << '.'; } - ostr << static_cast(addr->data[j]); + ostr << static_cast(ASN1_STRING_get0_data(addr)[j]); } p.second = ostr.str(); } @@ -194,24 +200,25 @@ memset(&tm, '\0', sizeof tm); # define g2(p) (((p)[0]-'0')*10+(p)[1]-'0') - tm.tm_year = g2(s->data); + const unsigned char* d = ASN1_STRING_get0_data(s); + tm.tm_year = g2(d); if(tm.tm_year < 50) { tm.tm_year += 100; } - tm.tm_mon = g2(s->data + 2) - 1; - tm.tm_mday = g2(s->data + 4); - tm.tm_hour = g2(s->data + 6); - tm.tm_min = g2(s->data + 8); - tm.tm_sec = g2(s->data + 10); - if(s->data[12] == 'Z') + tm.tm_mon = g2(d + 2) - 1; + tm.tm_mday = g2(d + 4); + tm.tm_hour = g2(d + 6); + tm.tm_min = g2(d + 8); + tm.tm_sec = g2(d + 10); + if(d[12] == 'Z') { offset = 0; } else { - offset = g2(s->data + 13) * 60 + g2(s->data + 15); - if(s->data[12] == '-') + offset = g2(d + 13) * 60 + g2(d + 15); + if(d[12] == '-') { offset = -offset; } @@ -248,7 +255,7 @@ public: - OpenSSLX509ExtensionI(struct X509_extension_st*, const string&, x509_st*); + OpenSSLX509ExtensionI(const struct X509_extension_st*, const string&, x509_st*); ~OpenSSLX509ExtensionI(); virtual bool isCritical() const; virtual string getOID() const; @@ -256,7 +263,7 @@ private: - struct X509_extension_st* _extension; + const struct X509_extension_st* _extension; string _oid; x509_st* _cert; }; @@ -306,7 +313,7 @@ } // end anonymous namespace -OpenSSLX509ExtensionI::OpenSSLX509ExtensionI(struct X509_extension_st* extension, const string& oid, x509_st* cert): +OpenSSLX509ExtensionI::OpenSSLX509ExtensionI(const struct X509_extension_st* extension, const string& oid, x509_st* cert): _extension(extension), _oid(oid), _cert(cert) @@ -339,10 +346,10 @@ OpenSSLX509ExtensionI::getData() const { vector data; - ASN1_OCTET_STRING* buffer = X509_EXTENSION_get_data(_extension); + const ASN1_OCTET_STRING* buffer = X509_EXTENSION_get_data(_extension); assert(buffer); - data.resize(buffer->length); - memcpy(&data[0], buffer->data, buffer->length); + data.resize(ASN1_STRING_get_length(buffer)); + memcpy(&data[0], ASN1_STRING_get0_data(buffer), ASN1_STRING_get_length(buffer)); return data; } @@ -388,7 +395,7 @@ int index = X509_get_ext_by_NID(_cert, NID_authority_key_identifier, -1); if(index >= 0) { - X509_EXTENSION* ext = X509_get_ext(_cert, index); + const X509_EXTENSION* ext = X509_get_ext(_cert, index); if(ext) { AUTHORITY_KEYID* decoded = (AUTHORITY_KEYID*)X509V3_EXT_d2i(ext); @@ -396,8 +403,8 @@ { throw IceSSL::CertificateEncodingException(__FILE__, __LINE__, "the extension could not be decoded"); } - keyid.resize(decoded->keyid->length); - memcpy(&keyid[0], decoded->keyid->data, decoded->keyid->length); + keyid.resize(ASN1_STRING_get_length(decoded->keyid)); + memcpy(&keyid[0], ASN1_STRING_get0_data(decoded->keyid), ASN1_STRING_get_length(decoded->keyid)); AUTHORITY_KEYID_free(decoded); } } @@ -411,7 +418,7 @@ int index = X509_get_ext_by_NID(_cert, NID_subject_key_identifier, -1); if(index >= 0) { - X509_EXTENSION* ext = X509_get_ext(_cert, index); + const X509_EXTENSION* ext = X509_get_ext(_cert, index); if(ext) { ASN1_OCTET_STRING* decoded = static_cast(X509V3_EXT_d2i(ext)); @@ -419,8 +426,8 @@ { throw IceSSL::CertificateEncodingException(__FILE__, __LINE__, "the extension could not be decoded"); } - keyid.resize(decoded->length); - memcpy(&keyid[0], decoded->data, decoded->length); + keyid.resize(ASN1_STRING_get_length(decoded)); + memcpy(&keyid[0], ASN1_STRING_get0_data(decoded), ASN1_STRING_get_length(decoded)); ASN1_OCTET_STRING_free(decoded); } } @@ -534,8 +541,8 @@ int sz = X509_get_ext_count(_cert); for(int i = 0; i < sz; i++) { - X509_EXTENSION* ext = X509_get_ext(_cert, i); - ASN1_OBJECT* obj = X509_EXTENSION_get_object(ext); + const X509_EXTENSION* ext = X509_get_ext(_cert, i); + const ASN1_OBJECT* obj = X509_EXTENSION_get_object(ext); string oid; // // According to OBJ_obj2txt doc a buffer of length 80 should be more than enough to --- ice-3.7.10/cpp/src/IceSSL/OpenSSLPluginI.cpp +++ ice-3.7.10/cpp/src/IceSSL/OpenSSLPluginI.cpp @@ -41,7 +41,7 @@ Ice::Long PluginI::getOpenSSLVersion() const { - return SSLeay(); + return OpenSSL_version_num(); } IceSSL::CertificatePtr --- ice-3.7.10/cpp/src/IceSSL/OpenSSLUtil.cpp +++ ice-3.7.10/cpp/src/IceSSL/OpenSSLUtil.cpp @@ -162,8 +162,19 @@ BIO_free(bio); return false; } +#if OPENSSL_VERSION_NUMBER >= 0x30000000L + EVP_PKEY* pkey = PEM_read_bio_Parameters(bio, 0); + BIO_free(bio); + if(!pkey) + { + return false; + } + DH* dh = EVP_PKEY_get1_DH(pkey); + EVP_PKEY_free(pkey); +#else DH* dh = PEM_read_bio_DHparams(bio, 0, 0, 0); BIO_free(bio); +#endif if(!dh) { return false;