Skip to content

Commit fc41cec

Browse files
notrojnotroj
committed
Fix OpenSSL 4.0 compatibility and test that in CI.
CI: Update to test OpenSSL 4.0.0 explicitly. CI: No longer disable deprecated-declaration warnings for OpenSSL 3.4 -Werror build. * modules/ssl/ssl_engine_kernel.c (ssl_hook_UserCheck): Change name to const X509_NAME *. (ssl_callback_proxy_cert): Change ca_name, issuer, and ca_issuer to const X509_NAME *. * modules/ssl/ssl_engine_log.c (ssl_log_cert_error): Change cert parameter to const X509 *. Use X509_get0_serialNumber, X509_get0_notBefore, and X509_get0_notAfter instead of non-const variants. (ssl_log_xerror, ssl_log_cxerror, ssl_log_rxerror): Change cert parameter to const X509 *. * modules/ssl/ssl_engine_vars.c (ssl_var_lookup_ssl_cert_dn): Change xsname parameter to const X509_NAME *. (ssl_var_lookup_ssl_cert_dn_oneline): Change xsname parameter to const X509_NAME *. (ssl_var_lookup_ssl_cert): Change xsname to const X509_NAME *. (ssl_var_lookup_ssl_cert_rfc4523_cea): Change issuer to const X509_NAME *. * modules/ssl/ssl_private.h (ssl_log_xerror, ssl_log_cxerror, ssl_log_rxerror): Update declarations to use const X509 *. * modules/ssl/ssl_util_ssl.c (modssl_X509_NAME_to_string): Change dn parameter to const X509_NAME *. (getIDs): Change subj to const X509_NAME *. * modules/ssl/ssl_util_ssl.h (modssl_X509_NAME_to_string): Update declaration to use const X509_NAME *. * support/ab.c (ssl_print_cert_info): Change dn to const X509_NAME *. mod_ssl: use ASN1_STRING accessor API in dump_extn_value: * modules/ssl/ssl_engine_vars.c (dump_extn_value): Use ASN1_STRING_get0_data() and ASN1_STRING_length() rather than directly dereferencing the ASN1_OCTET_STRING structure, which is opaque in OpenSSL 4.0. * modules/ssl/ssl_private.h: Add compat macros for ASN1_STRING_get0_data and ASN1_STRING_length for pre-1.1 API. mod_ssl: constify ASN1_TIME pointers, use X509_get0_not{Before,After}: * modules/ssl/ssl_engine_vars.c (ssl_var_lookup_ssl_cert_valid, ssl_var_lookup_ssl_cert_remain): Constify ASN1_TIME * parameter. (ssl_var_lookup_ssl_cert): Use X509_get0_notBefore() and X509_get0_notAfter() which return const pointers. (ssl_var_lookup_ssl_cert_remain): Use ASN1_TIME_check() directly rather than INVALID_ASN1_TIME macro which dereferences the ASN1_TIME structure. (dump_extn_value): Constify ASN1_OCTET_STRING * parameter. * modules/ssl/ssl_private.h: Add compat macros for X509_get0_before and X509_get0_after for pre-1.1 API. mod_ssl: constify X509_NAME_ENTRY and X509_EXTENSION pointers: * modules/ssl/ssl_engine_vars.c (ssl_var_lookup_ssl_cert_dn, extract_dn): Constify X509_NAME_ENTRY * variables, constify X509_NAME * parameter of extract_dn, drop unnecessary casts on X509_NAME_ENTRY_get_object() calls. (ssl_ext_list): Use MODSSL_X509_EXT_CONST for X509_EXTENSION * since X509_EXTENSION accessors are only constified in OpenSSL 4. * modules/ssl/ssl_util_ssl.c, modules/ssl/ssl_util_ssl.h (modssl_X509_NAME_ENTRY_to_string): Constify X509_NAME_ENTRY * parameter. * modules/ssl/ssl_private.h: Add MODSSL_X509_EXT_CONST, defined as const for OpenSSL 4+ and empty otherwise. * modules/ssl/ssl_util_ssl.c (asn1_string_convert): Constify ASN1_STRING * argument. * modules/ssl/ssl_engine_ocsp.c (extract_responder_uri): Use modssl_ASN1_STRING_convert instead of directly accessing ASN1_STRING data pointer. * modules/ssl/ssl_util_ssl.c (modssl_ASN1_STRING_convert): Rename from asn1_string_convert and export function. (asn1_string_to_utf8): Update to use modssl_ASN1_STRING_convert. (modssl_X509_NAME_ENTRY_to_string): Update to use modssl_ASN1_STRING_convert. * modules/ssl/ssl_util_ssl.h (modssl_ASN1_STRING_convert): Declare new function. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Github: closes #609 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1933586 13f79535-47bb-0310-9956-ffa450edef68
1 parent 8678d13 commit fc41cec

9 files changed

Lines changed: 126 additions & 44 deletions

File tree

‎.github/workflows/linux.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -260,6 +260,58 @@ jobs:
260260
# APR_VERSION=1.7.3
261261
# APU_VERSION=1.6.3
262262
# APU_CONFIG="--with-crypto --with-ldap"
263+
# -------------------------------------------------------------------------
264+
- name: OpenSSL 3.0 LTS
265+
config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
266+
env: |
267+
TEST_OPENSSL3=3.0.18
268+
APR_VERSION=1.7.6
269+
APU_VERSION=1.6.3
270+
APU_CONFIG="--without-crypto"
271+
pkgs: subversion
272+
# -------------------------------------------------------------------------
273+
- name: OpenSSL 3.4 -Werror
274+
config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
275+
notest-cflags: -Werror -O2
276+
env: |
277+
TEST_OPENSSL3=3.4.4
278+
APR_VERSION=1.7.6
279+
APU_VERSION=1.6.3
280+
APU_CONFIG="--without-crypto"
281+
pkgs: subversion
282+
# -------------------------------------------------------------------------
283+
- name: OpenSSL 3.4 no-engine
284+
config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
285+
env: |
286+
TEST_OPENSSL3=3.4.4
287+
OPENSSL_CONFIG=no-engine
288+
APR_VERSION=1.7.6
289+
APU_VERSION=1.6.3
290+
APU_CONFIG="--without-crypto"
291+
pkgs: subversion
292+
# -------------------------------------------------------------------------
293+
- name: OpenSSL 3.5 no-engine -Werror
294+
config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
295+
notest-cflags: -Werror -O2
296+
env: |
297+
TEST_OPENSSL3=3.5.5
298+
OPENSSL_CONFIG=no-engine
299+
APR_VERSION=1.7.6
300+
APU_VERSION=1.6.3
301+
APU_CONFIG="--without-crypto"
302+
pkgs: subversion
303+
# -------------------------------------------------------------------------
304+
- name: OpenSSL 4.0
305+
config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
306+
notest-cflags: -Werror -O2
307+
env: |
308+
TEST_OPENSSL3=4.0.0
309+
OPENSSL_CONFIG=no-engine
310+
APR_VERSION=1.7.6
311+
APU_VERSION=1.6.3
312+
APU_CONFIG="--without-crypto"
313+
pkgs: subversion
314+
# -------------------------------------------------------------------------
263315
runs-on: ${{ matrix.os == '' && 'ubuntu-latest' || matrix.os }}
264316
timeout-minutes: 30
265317
env:

‎modules/ssl/ssl_engine_kernel.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1254,7 +1254,7 @@ int ssl_hook_UserCheck(request_rec *r)
12541254
}
12551255

12561256
if (!sslconn->client_dn) {
1257-
X509_NAME *name = X509_get_subject_name(sslconn->client_cert);
1257+
const X509_NAME *name = X509_get_subject_name(sslconn->client_cert);
12581258
char *cp = X509_NAME_oneline(name, NULL, 0);
12591259
sslconn->client_dn = apr_pstrdup(r->connection->pool, cp);
12601260
OPENSSL_free(cp);
@@ -1778,7 +1778,7 @@ int ssl_callback_proxy_cert(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
17781778
server_rec *s = mySrvFromConn(c);
17791779
SSLSrvConfigRec *sc = mySrvConfig(s);
17801780
SSLDirConfigRec *dc = myDirConfigFromConn(c);
1781-
X509_NAME *ca_name, *issuer, *ca_issuer;
1781+
const X509_NAME *ca_name, *issuer, *ca_issuer;
17821782
X509_INFO *info;
17831783
X509 *ca_cert;
17841784
STACK_OF(X509_NAME) *ca_list;

‎modules/ssl/ssl_engine_log.c‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ void ssl_log_ssl_error(const char *file, int line, int level, server_rec *s)
126126
static void ssl_log_cert_error(const char *file, int line, int level,
127127
apr_status_t rv, const server_rec *s,
128128
const conn_rec *c, const request_rec *r,
129-
apr_pool_t *p, X509 *cert, const char *format,
129+
apr_pool_t *p, const X509 *cert, const char *format,
130130
va_list ap)
131131
{
132132
char buf[HUGE_STRING_LEN];
@@ -167,14 +167,14 @@ static void ssl_log_cert_error(const char *file, int line, int level,
167167
}
168168

169169
BIO_puts(bio, " / serial: ");
170-
if (i2a_ASN1_INTEGER(bio, X509_get_serialNumber(cert)) == -1)
170+
if (i2a_ASN1_INTEGER(bio, X509_get0_serialNumber(cert)) == -1)
171171
BIO_puts(bio, "(ERROR)");
172172

173173
BIO_puts(bio, " / notbefore: ");
174-
ASN1_TIME_print(bio, X509_get_notBefore(cert));
174+
ASN1_TIME_print(bio, X509_get0_notBefore(cert));
175175

176176
BIO_puts(bio, " / notafter: ");
177-
ASN1_TIME_print(bio, X509_get_notAfter(cert));
177+
ASN1_TIME_print(bio, X509_get0_notAfter(cert));
178178

179179
BIO_puts(bio, "]");
180180

@@ -209,7 +209,7 @@ static void ssl_log_cert_error(const char *file, int line, int level,
209209
* in the other cases we use the connection and request pool, respectively).
210210
*/
211211
void ssl_log_xerror(const char *file, int line, int level, apr_status_t rv,
212-
apr_pool_t *ptemp, server_rec *s, X509 *cert,
212+
apr_pool_t *ptemp, server_rec *s, const X509 *cert,
213213
const char *fmt, ...)
214214
{
215215
if (APLOG_IS_LEVEL(s,level)) {
@@ -222,7 +222,7 @@ void ssl_log_xerror(const char *file, int line, int level, apr_status_t rv,
222222
}
223223

224224
void ssl_log_cxerror(const char *file, int line, int level, apr_status_t rv,
225-
conn_rec *c, X509 *cert, const char *fmt, ...)
225+
conn_rec *c, const X509 *cert, const char *fmt, ...)
226226
{
227227
if (APLOG_IS_LEVEL(mySrvFromConn(c),level)) {
228228
va_list ap;
@@ -234,7 +234,7 @@ void ssl_log_cxerror(const char *file, int line, int level, apr_status_t rv,
234234
}
235235

236236
void ssl_log_rxerror(const char *file, int line, int level, apr_status_t rv,
237-
request_rec *r, X509 *cert, const char *fmt, ...)
237+
request_rec *r, const X509 *cert, const char *fmt, ...)
238238
{
239239
if (APLOG_R_IS_LEVEL(r,level)) {
240240
va_list ap;

‎modules/ssl/ssl_engine_ocsp.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,8 @@ static const char *extract_responder_uri(X509 *cert, apr_pool_t *pool)
3838
/* Name found in extension, and is a URI: */
3939
if (OBJ_obj2nid(value->method) == NID_ad_OCSP
4040
&& value->location->type == GEN_URI) {
41-
result = apr_pstrdup(pool,
42-
(char *)value->location->d.uniformResourceIdentifier->data);
41+
const ASN1_STRING *uri = value->location->d.uniformResourceIdentifier;
42+
result = modssl_ASN1_STRING_convert(pool, uri, 0);
4343
}
4444
}
4545

‎modules/ssl/ssl_engine_vars.c‎

Lines changed: 33 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,10 @@
4141

4242
static char *ssl_var_lookup_ssl(apr_pool_t *p, SSLConnRec *sslconn, request_rec *r, char *var);
4343
static char *ssl_var_lookup_ssl_cert(apr_pool_t *p, request_rec *r, X509 *xs, char *var);
44-
static char *ssl_var_lookup_ssl_cert_dn(apr_pool_t *p, X509_NAME *xsname, const char *var);
44+
static char *ssl_var_lookup_ssl_cert_dn(apr_pool_t *p, const X509_NAME *xsname, const char *var);
4545
static char *ssl_var_lookup_ssl_cert_san(apr_pool_t *p, X509 *xs, char *var);
46-
static char *ssl_var_lookup_ssl_cert_valid(apr_pool_t *p, ASN1_TIME *tm);
47-
static char *ssl_var_lookup_ssl_cert_remain(apr_pool_t *p, ASN1_TIME *tm);
46+
static char *ssl_var_lookup_ssl_cert_valid(apr_pool_t *p, const ASN1_TIME *tm);
47+
static char *ssl_var_lookup_ssl_cert_remain(apr_pool_t *p, const ASN1_TIME *tm);
4848
static char *ssl_var_lookup_ssl_cert_serial(apr_pool_t *p, X509 *xs);
4949
static char *ssl_var_lookup_ssl_cert_chain(apr_pool_t *p, STACK_OF(X509) *sk, char *var);
5050
static char *ssl_var_lookup_ssl_cert_rfc4523_cea(apr_pool_t *p, SSL *ssl);
@@ -444,7 +444,7 @@ static char *ssl_var_lookup_ssl(apr_pool_t *p, SSLConnRec *sslconn,
444444
}
445445

446446
static char *ssl_var_lookup_ssl_cert_dn_oneline(apr_pool_t *p, request_rec *r,
447-
X509_NAME *xsname)
447+
const X509_NAME *xsname)
448448
{
449449
char *result = NULL;
450450
SSLDirConfigRec *dc;
@@ -476,7 +476,7 @@ static char *ssl_var_lookup_ssl_cert(apr_pool_t *p, request_rec *r, X509 *xs,
476476
{
477477
char *result;
478478
BOOL resdup;
479-
X509_NAME *xsname;
479+
const X509_NAME *xsname;
480480
int nid;
481481

482482
result = NULL;
@@ -490,13 +490,13 @@ static char *ssl_var_lookup_ssl_cert(apr_pool_t *p, request_rec *r, X509 *xs,
490490
result = ssl_var_lookup_ssl_cert_serial(p, xs);
491491
}
492492
else if (strcEQ(var, "V_START")) {
493-
result = ssl_var_lookup_ssl_cert_valid(p, X509_get_notBefore(xs));
493+
result = ssl_var_lookup_ssl_cert_valid(p, X509_get0_notBefore(xs));
494494
}
495495
else if (strcEQ(var, "V_END")) {
496-
result = ssl_var_lookup_ssl_cert_valid(p, X509_get_notAfter(xs));
496+
result = ssl_var_lookup_ssl_cert_valid(p, X509_get0_notAfter(xs));
497497
}
498498
else if (strcEQ(var, "V_REMAIN")) {
499-
result = ssl_var_lookup_ssl_cert_remain(p, X509_get_notAfter(xs));
499+
result = ssl_var_lookup_ssl_cert_remain(p, X509_get0_notAfter(xs));
500500
resdup = FALSE;
501501
}
502502
else if (*var && strcEQ(var+1, "_DN")) {
@@ -583,12 +583,12 @@ static const struct {
583583
{ NULL, 0, 0 }
584584
};
585585

586-
static char *ssl_var_lookup_ssl_cert_dn(apr_pool_t *p, X509_NAME *xsname,
586+
static char *ssl_var_lookup_ssl_cert_dn(apr_pool_t *p, const X509_NAME *xsname,
587587
const char *var)
588588
{
589589
const char *ptr;
590590
char *result;
591-
X509_NAME_ENTRY *xsne;
591+
const X509_NAME_ENTRY *xsne;
592592
int i, j, n, idx = 0, raw = 0;
593593
apr_size_t varlen;
594594

@@ -615,7 +615,7 @@ static char *ssl_var_lookup_ssl_cert_dn(apr_pool_t *p, X509_NAME *xsname,
615615
for (j = 0; j < X509_NAME_entry_count(xsname); j++) {
616616
xsne = X509_NAME_get_entry(xsname, j);
617617

618-
n =OBJ_obj2nid((ASN1_OBJECT *)X509_NAME_ENTRY_get_object(xsne));
618+
n = OBJ_obj2nid(X509_NAME_ENTRY_get_object(xsne));
619619

620620
if (n == ssl_var_lookup_ssl_cert_dn_rec[i].nid && idx-- == 0) {
621621
result = modssl_X509_NAME_ENTRY_to_string(p, xsne, raw);
@@ -672,7 +672,7 @@ static char *ssl_var_lookup_ssl_cert_san(apr_pool_t *p, X509 *xs, char *var)
672672
return NULL;
673673
}
674674

675-
static char *ssl_var_lookup_ssl_cert_valid(apr_pool_t *p, ASN1_TIME *tm)
675+
static char *ssl_var_lookup_ssl_cert_valid(apr_pool_t *p, const ASN1_TIME *tm)
676676
{
677677
BIO* bio;
678678

@@ -687,8 +687,15 @@ static char *ssl_var_lookup_ssl_cert_valid(apr_pool_t *p, ASN1_TIME *tm)
687687

688688
/* Return a string giving the number of days remaining until 'tm', or
689689
* "0" if this can't be determined. */
690-
static char *ssl_var_lookup_ssl_cert_remain(apr_pool_t *p, ASN1_TIME *tm)
690+
static char *ssl_var_lookup_ssl_cert_remain(apr_pool_t *p, const ASN1_TIME *tm)
691691
{
692+
#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
693+
int diff;
694+
695+
if (ASN1_TIME_check(tm) != 1 || ASN1_TIME_diff(&diff, NULL, NULL, tm) != 1) {
696+
return "0";
697+
}
698+
#else
692699
apr_time_t then, now = apr_time_now();
693700
apr_time_exp_t exp = {0};
694701
long diff;
@@ -723,6 +730,7 @@ static char *ssl_var_lookup_ssl_cert_remain(apr_pool_t *p, ASN1_TIME *tm)
723730
}
724731

725732
diff = (long)((apr_time_sec(then) - apr_time_sec(now)) / (60*60*24));
733+
#endif
726734

727735
return diff > 0 ? apr_ltoa(p, diff) : apr_pstrdup(p, "0");
728736
}
@@ -772,7 +780,7 @@ static char *ssl_var_lookup_ssl_cert_rfc4523_cea(apr_pool_t *p, SSL *ssl)
772780

773781
serialNumber = X509_get_serialNumber(xs);
774782
if (serialNumber) {
775-
X509_NAME *issuer = X509_get_issuer_name(xs);
783+
const X509_NAME *issuer = X509_get_issuer_name(xs);
776784
if (issuer) {
777785
BIGNUM *bn = ASN1_INTEGER_to_BN(serialNumber, NULL);
778786
char *decimal = BN_bn2dec(bn);
@@ -896,9 +904,9 @@ static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var)
896904
/* Add each RDN in 'xn' to the table 't' where the NID is present in
897905
* 'nids', using key prefix 'pfx'. */
898906
static void extract_dn(apr_table_t *t, apr_hash_t *nids, const char *pfx,
899-
X509_NAME *xn, apr_pool_t *p)
907+
const X509_NAME *xn, apr_pool_t *p)
900908
{
901-
X509_NAME_ENTRY *xsne;
909+
const X509_NAME_ENTRY *xsne;
902910
apr_hash_t *count;
903911
int i, nid;
904912

@@ -913,7 +921,7 @@ static void extract_dn(apr_table_t *t, apr_hash_t *nids, const char *pfx,
913921

914922
/* Retrieve the nid, and check whether this is one of the nids
915923
* which are to be extracted. */
916-
nid = OBJ_obj2nid((ASN1_OBJECT *)X509_NAME_ENTRY_get_object(xsne));
924+
nid = OBJ_obj2nid(X509_NAME_ENTRY_get_object(xsne));
917925

918926
tag = apr_hash_get(nids, &nid, sizeof nid);
919927
if (tag) {
@@ -1026,15 +1034,19 @@ void modssl_var_extract_san_entries(apr_table_t *t, SSL *ssl, apr_pool_t *p)
10261034
* parse the extension type as a primitive string. This will fail for
10271035
* any structured extension type per the docs. Returns non-zero on
10281036
* success and writes the string to the given bio. */
1029-
static int dump_extn_value(BIO *bio, ASN1_OCTET_STRING *str)
1037+
static int dump_extn_value(BIO *bio, const ASN1_OCTET_STRING *str)
10301038
{
1031-
const unsigned char *pp = str->data;
1039+
const unsigned char *pp = ASN1_STRING_get0_data(str);
10321040
ASN1_STRING *ret = ASN1_STRING_new();
10331041
int rv = 0;
10341042

1043+
if (!ret) {
1044+
return rv;
1045+
}
1046+
10351047
/* This allows UTF8String, IA5String, VisibleString, or BMPString;
10361048
* conversion to UTF-8 is forced. */
1037-
if (d2i_DISPLAYTEXT(&ret, &pp, str->length)) {
1049+
if (d2i_DISPLAYTEXT(&ret, &pp, ASN1_STRING_length(str))) {
10381050
ASN1_STRING_print_ex(bio, ret, ASN1_STRFLGS_UTF8_CONVERT);
10391051
rv = 1;
10401052
}
@@ -1081,7 +1093,7 @@ apr_array_header_t *ssl_ext_list(apr_pool_t *p, conn_rec *c, int peer,
10811093
*/
10821094
array = apr_array_make(p, count, sizeof(char *));
10831095
for (j = 0; j < count; j++) {
1084-
X509_EXTENSION *ext = X509_get_ext(xs, j);
1096+
MODSSL_X509_EXT_CONST X509_EXTENSION *ext = X509_get_ext(xs, j);
10851097

10861098
if (OBJ_cmp(X509_EXTENSION_get_object(ext), oid) == 0) {
10871099
BIO *bio = BIO_new(BIO_s_mem());

‎modules/ssl/ssl_private.h‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,12 @@
145145
#define MODSSL_SSL_METHOD_CONST
146146
#endif
147147

148+
#if OPENSSL_VERSION_NUMBER >= 0x40000000L
149+
#define MODSSL_X509_EXT_CONST const
150+
#else
151+
#define MODSSL_X509_EXT_CONST
152+
#endif
153+
148154
#if defined(LIBRESSL_VERSION_NUMBER)
149155
/* Missing from LibreSSL */
150156
#if LIBRESSL_VERSION_NUMBER < 0x2060000f
@@ -266,6 +272,12 @@
266272
#define BIO_get_shutdown(x) (x->shutdown)
267273
#define BIO_set_shutdown(x,v) (x->shutdown=v)
268274
#define DH_bits(x) (BN_num_bits(x->p))
275+
#define X509_up_ref(x) (CRYPTO_add(&(x)->references, +1, CRYPTO_LOCK_X509))
276+
#define EVP_PKEY_up_ref(pk) (CRYPTO_add(&(pk)->references, +1, CRYPTO_LOCK_EVP_PKEY))
277+
#define ASN1_STRING_get0_data(x) ((x)->data)
278+
#define ASN1_STRING_length(x) ((int)(x)->length)
279+
#define X509_get0_before(x) X509_get_before(x)
280+
#define X509_get0_after(x) X509_get_after(x)
269281
#else
270282
void init_bio_methods(void);
271283
void free_bio_methods(void);
@@ -1164,16 +1176,16 @@ void ssl_log_ssl_error(const char *, int, int, server_rec *);
11641176
* counterparts. */
11651177
void ssl_log_xerror(const char *file, int line, int level,
11661178
apr_status_t rv, apr_pool_t *p, server_rec *s,
1167-
X509 *cert, const char *format, ...)
1179+
const X509 *cert, const char *format, ...)
11681180
__attribute__((format(printf,8,9)));
11691181

11701182
void ssl_log_cxerror(const char *file, int line, int level,
1171-
apr_status_t rv, conn_rec *c, X509 *cert,
1183+
apr_status_t rv, conn_rec *c, const X509 *cert,
11721184
const char *format, ...)
11731185
__attribute__((format(printf,7,8)));
11741186

11751187
void ssl_log_rxerror(const char *file, int line, int level,
1176-
apr_status_t rv, request_rec *r, X509 *cert,
1188+
apr_status_t rv, request_rec *r, const X509 *cert,
11771189
const char *format, ...)
11781190
__attribute__((format(printf,7,8)));
11791191

0 commit comments

Comments
 (0)