Use const X509_NAME*, not X509_NAME*, on newer OpenSSL

to fix a build error against OpenSSL 4.0.
OpenSSL 4.0 made `X509_NAME*` pointers returned by `X509_get_subject_name()`,
`X509_REQ_get_subject_name()` and related getters const.
In contrast, under OpenSSL 1.x, setters expect non-const pointers,
hence our new typedef `X509NameConstPtr`.

- Use `X509NameConstPtr` parameters in `GetX509NameCN()`, `CreateCert()` and,
  `CreateCertIcingaCA()` to match the const expectations per OpenSSL version
- Replace `X509_REQ_get_subject_name()` with `X509_NAME_new()` +
  `X509_REQ_set_subject_name()` for CSR subject modification,
  since the returned data can't be directly modified now

Author: Al2Klimov

lib/base/tlsutility.cpp

@@ -403,7 +403,7 @@ void AddCRLToSSLContext(X509_STORE *x509_store, const String& crlPath)
 	X509_VERIFY_PARAM_free(param);
 }
 
-static String GetX509NameCN(X509_NAME *name)
+static String GetX509NameCN(X509NameConstPtr name)
 {
 	char errbuf[256];
 	char buffer[256];
@@ -598,8 +598,25 @@ int MakeX509CSR(
 		X509_REQ_set_version(req, 0);
 		X509_REQ_set_pubkey(req, key);
 
-		X509_NAME *name = X509_REQ_get_subject_name(req);
-		X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, (unsigned char *)cn.CStr(), -1, -1, 0);
+		std::unique_ptr<X509_NAME, decltype(&X509_NAME_free)> name{X509_NAME_new(), &X509_NAME_free};
+		if (!name) {
+			unsigned long err = ERR_peek_error();
+			BOOST_THROW_EXCEPTION(openssl_error()
+				<< boost::errinfo_api_function("X509_NAME_new")
+				<< errinfo_openssl_error(err));
+		}
+
+		X509_NAME_add_entry_by_txt(name.get(), "CN", MBSTRING_ASC, (unsigned char *)cn.CStr(), -1, -1, 0);
+
+		if (!X509_REQ_set_subject_name(req, name.get())) {
+			unsigned long err = ERR_peek_error();
+			ERR_error_string_n(err, errbuf, sizeof errbuf);
+			Log(LogCritical, "SSL")
+				<< "Error while setting CSR subject name: " << err << ", \"" << errbuf << "\"";
+			BOOST_THROW_EXCEPTION(openssl_error()
+				<< boost::errinfo_api_function("X509_REQ_set_subject_name")
+				<< errinfo_openssl_error(err));
+		}
 
 		if (!ca) {
 			String san = "DNS:" + cn;
@@ -652,8 +669,8 @@ int MakeX509CSR(
 
 std::shared_ptr<X509> CreateCert(
 	EVP_PKEY* pubkey,
-	X509_NAME* subject,
-	X509_NAME* issuer,
+	X509NameConstPtr subject,
+	X509NameConstPtr issuer,
 	EVP_PKEY* cakey,
 	long validFrom,
 	long validFor,
@@ -746,7 +763,7 @@ String GetIcingaCADir()
 	return Configuration::DataDir + "/ca";
 }
 
-std::shared_ptr<X509> CreateCertIcingaCA(EVP_PKEY *pubkey, X509_NAME *subject, long validFrom, long validFor, bool ca)
+std::shared_ptr<X509> CreateCertIcingaCA(EVP_PKEY *pubkey, X509NameConstPtr subject, long validFrom, long validFor, bool ca)
 {
 	char errbuf[256];
 

lib/base/tlsutility.hpp

@@ -39,6 +39,11 @@ const auto LEAF_VALID_FOR  = 60 * 60 * 24 * 397;
 const auto RENEW_THRESHOLD = 60 * 60 * 24 * 30;
 const auto RENEW_INTERVAL  = 60 * 60 * 24;
 
+// Tracks the constness of X509_NAME* across OpenSSL versions: on 1.x getters return X509_NAME* and
+// setters expect X509_NAME*; on 4.x both sides became const X509_NAME*. Using decltype on the getter
+// gives us the right type automatically, so we can accept getter results and pass to setters cast-free.
+using X509NameConstPtr = decltype(X509_get_subject_name(nullptr));
+
 void InitializeOpenSSL();
 
 String GetOpenSSLVersion();
@@ -66,8 +71,8 @@ int MakeX509CSR(
 );
 std::shared_ptr<X509> CreateCert(
 	EVP_PKEY* pubkey,
-	X509_NAME* subject,
-	X509_NAME* issuer,
+	X509NameConstPtr subject,
+	X509NameConstPtr issuer,
 	EVP_PKEY* cakey,
 	long validFrom,
 	long validFor,
@@ -83,7 +88,7 @@ inline String CertificateToString(const std::shared_ptr<X509>& cert)
 }
 
 std::shared_ptr<X509> StringToCertificate(const String& cert);
-std::shared_ptr<X509> CreateCertIcingaCA(EVP_PKEY *pubkey, X509_NAME *subject, long validFrom, long validFor, bool ca = false);
+std::shared_ptr<X509> CreateCertIcingaCA(EVP_PKEY *pubkey, X509NameConstPtr subject, long validFrom, long validFor, bool ca = false);
 std::shared_ptr<X509> CreateCertIcingaCA(const std::shared_ptr<X509>& cert, long validFrom = 0, long validFor = LEAF_VALID_FOR);
 bool IsCertUptodate(const std::shared_ptr<X509>& cert);
 bool IsCaUptodate(X509* cert);