mirror of
https://git.haproxy.org/git/haproxy.git/
synced 2026-03-14 19:41:33 +01:00
73732abfb2
Starting with OpenSSL 4.0, X509_get_subject_name(), X509_get_issuer_name(), and X509_CRL_get_issuer() return a const-qualified X509_NAME pointer. Similarly, X509_NAME_get_entry() returns a const X509_NAME_ENTRY *, and X509_NAME_ENTRY_get_data() returns a const ASN1_STRING *. Introduce the __X509_NAME_CONST__ macro (defined to 'const' for OpenSSL >= 4.0.0, empty for WolfSSL and older OpenSSL version which lacks const on these APIs) and use it to qualify X509_NAME * variables and the parameters of the three DN helper functions ssl_sock_get_dn_entry(), ssl_sock_get_dn_formatted(), and ssl_sock_get_dn_oneline(). This avoids both const-qualifier warnings on OpenSSL 4.0 and discarded-qualifier warnings on WolfSSL, without needing explicit casts at call sites. In ssl_sock.c (ssl_get_client_ca_file) and ssl_gencert.c (ssl_sock_do_create_cert), a __X509_NAME_CONST__ X509_NAME * variable was being reused to store the result of X509_NAME_dup() and then passed to mutating functions (X509_NAME_add_entry_by_txt, X509_NAME_free). Introduce separate X509_NAME * variables (xn_dup, subject) to hold the mutable duplicate. Original patch from Alexandr Nedvedicky <sashan@openssl.org>: https://www.mail-archive.com/haproxy@formilux.org/msg46696.html
66 lines
2.7 KiB
C
66 lines
2.7 KiB
C
/*
|
|
* include/haproxy/ssl_utils.h
|
|
*
|
|
* Utility functions for SSL:
|
|
* Mostly generic functions that retrieve information from certificates
|
|
*
|
|
* Copyright (C) 2012 EXCELIANCE, Emeric Brun <ebrun@exceliance.fr>
|
|
* Copyright (C) 2020 HAProxy Technologies, William Lallemand <wlallemand@haproxy.com>
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation, version 2.1
|
|
* exclusively.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
|
*/
|
|
|
|
#ifndef _HAPROXY_SSL_UTILS_H
|
|
#define _HAPROXY_SSL_UTILS_H
|
|
|
|
#ifdef USE_OPENSSL
|
|
|
|
#include <haproxy/buf-t.h>
|
|
#include <haproxy/openssl-compat.h>
|
|
|
|
int cert_get_pkey_algo(X509 *crt, struct buffer *out);
|
|
int ssl_sock_get_serial(X509 *crt, struct buffer *out);
|
|
int ssl_sock_crt2der(X509 *crt, struct buffer *out);
|
|
int ssl_sock_get_time(ASN1_TIME *tm, struct buffer *out);
|
|
int ssl_sock_get_dn_entry(__X509_NAME_CONST__ X509_NAME *a, const struct buffer *entry, int pos,
|
|
struct buffer *out);
|
|
int ssl_sock_get_dn_formatted(__X509_NAME_CONST__ X509_NAME *a, const struct buffer *format, struct buffer *out);
|
|
int ssl_sock_get_dn_oneline(__X509_NAME_CONST__ X509_NAME *a, struct buffer *out);
|
|
X509* ssl_sock_get_peer_certificate(SSL *ssl);
|
|
X509* ssl_sock_get_verified_chain_root(SSL *ssl);
|
|
unsigned int openssl_version_parser(const char *version);
|
|
void exclude_tls_grease(char *input, int len, struct buffer *output);
|
|
int x509_v_err_str_to_int(const char *str);
|
|
const char *x509_v_err_int_to_str(int code);
|
|
long asn1_generalizedtime_to_epoch(ASN1_GENERALIZEDTIME *d);
|
|
const char *x509_get_notbefore(X509 *cert);
|
|
const char *x509_get_notafter(X509 *cert);
|
|
#ifdef HAVE_ASN1_TIME_TO_TM
|
|
time_t ASN1_to_time_t(ASN1_TIME *asn1_time);
|
|
time_t x509_get_notafter_time_t(X509 *cert);
|
|
time_t x509_get_notbefore_time_t(X509 *cert);
|
|
#endif
|
|
int curves2nid(const char *curve);
|
|
const char *nid2nist(int nid);
|
|
const char *sigalg2str(int sigalg);
|
|
const char *curveid2str(int curve_id);
|
|
|
|
int aes_process(struct buffer *data, struct buffer *nonce, struct buffer *key, int key_size,
|
|
struct buffer *aead_tag, struct buffer *aad, struct buffer *out, int decrypt, int gcm);
|
|
|
|
#endif /* _HAPROXY_SSL_UTILS_H */
|
|
#endif /* USE_OPENSSL */
|
|
|