From d6574bbaf76f3fa34d0b65c341fb3ef7ef835810 Mon Sep 17 00:00:00 2001 From: Joe Schaefer Date: Wed, 29 Apr 2026 09:49:22 -0400 Subject: [PATCH] openssl-v4 --- modules/ssl/ssl_engine_ocsp.c | 4 ++-- modules/ssl/ssl_engine_vars.c | 24 +++++++++++------------- 2 files changed, 13 insertions(+), 15 deletions(-) diff --git a/modules/ssl/ssl_engine_ocsp.c b/modules/ssl/ssl_engine_ocsp.c index 5e045125585..83ac2edde72 100644 --- a/modules/ssl/ssl_engine_ocsp.c +++ b/modules/ssl/ssl_engine_ocsp.c @@ -39,7 +39,7 @@ static const char *extract_responder_uri(X509 *cert, apr_pool_t *pool) if (OBJ_obj2nid(value->method) == NID_ad_OCSP && value->location->type == GEN_URI) { result = apr_pstrdup(pool, - (char *)value->location->d.uniformResourceIdentifier->data); + (char *)ASN1_STRING_get0_data(value->location->d.uniformResourceIdentifier)); } } @@ -140,7 +140,7 @@ static int verify_ocsp_status(X509 *cert, X509_STORE_CTX *ctx, conn_rec *c, ruri = determine_responder_uri(sc, cert, c, pool); if (!ruri) { if (sc->server->ocsp_mask & SSL_OCSPCHECK_NO_OCSP_FOR_CERT_OK) { - ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, c, + ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, c, "Skipping OCSP check for certificate cos no OCSP URL" " found and no_ocsp_for_cert_ok is set"); return V_OCSP_CERTSTATUS_GOOD; diff --git a/modules/ssl/ssl_engine_vars.c b/modules/ssl/ssl_engine_vars.c index 4060c0f6a63..e92048192c7 100644 --- a/modules/ssl/ssl_engine_vars.c +++ b/modules/ssl/ssl_engine_vars.c @@ -343,7 +343,7 @@ char *ssl_var_lookup(apr_pool_t *p, server_rec *s, conn_rec *c, request_rec *r, return (char *)result; } -static char *ssl_var_lookup_ssl(apr_pool_t *p, SSLConnRec *sslconn, +static char *ssl_var_lookup_ssl(apr_pool_t *p, SSLConnRec *sslconn, request_rec *r, char *var) { char *result; @@ -597,7 +597,7 @@ static char *ssl_var_lookup_ssl_cert_dn(apr_pool_t *p, X509_NAME *xsname, var = apr_pstrmemdup(p, var, ptr - var); raw = 1; } - + /* if an _N suffix is used, find the Nth attribute of given name */ ptr = ap_strchr_c(var, '_'); if (ptr != NULL && strspn(ptr + 1, "0123456789") == strlen(ptr + 1)) { @@ -697,19 +697,19 @@ static char *ssl_var_lookup_ssl_cert_remain(apr_pool_t *p, ASN1_TIME *tm) /* Fail if the time isn't a valid ASN.1 TIME; RFC3280 mandates * that the seconds digits are present even though ASN.1 * doesn't. */ - if ((tm->type == V_ASN1_UTCTIME && tm->length < 11) || - (tm->type == V_ASN1_GENERALIZEDTIME && tm->length < 13) || + if ((ASN1_STRING_type(tm) == V_ASN1_UTCTIME && ASN1_STRING_length(tm) < 11) || + (ASN1_STRING_type(tm) == V_ASN1_GENERALIZEDTIME && ASN1_STRING_length(tm) < 13) || !ASN1_TIME_check(tm)) { return apr_pstrdup(p, "0"); } - if (tm->type == V_ASN1_UTCTIME) { - exp.tm_year = DIGIT2NUM(tm->data); + if (ASN1_STRING_type(tm) == V_ASN1_UTCTIME) { + exp.tm_year = DIGIT2NUM(ASN1_STRING_get0_data(tm)); if (exp.tm_year <= 50) exp.tm_year += 100; - dp = tm->data + 2; + dp = ASN1_STRING_get0_data(tm) + 2; } else { - exp.tm_year = DIGIT2NUM(tm->data) * 100 + DIGIT2NUM(tm->data + 2) - 1900; - dp = tm->data + 4; + exp.tm_year = DIGIT2NUM(ASN1_STRING_get0_data(tm)) * 100 + DIGIT2NUM(ASN1_STRING_get0_data(tm) + 2) - 1900; + dp = ASN1_STRING_get0_data(tm) + 4; } exp.tm_mon = DIGIT2NUM(dp) - 1; @@ -1028,13 +1028,13 @@ void modssl_var_extract_san_entries(apr_table_t *t, SSL *ssl, apr_pool_t *p) * success and writes the string to the given bio. */ static int dump_extn_value(BIO *bio, ASN1_OCTET_STRING *str) { - const unsigned char *pp = str->data; + const unsigned char *pp = ASN1_STRING_get0_data(str); ASN1_STRING *ret = ASN1_STRING_new(); int rv = 0; /* This allows UTF8String, IA5String, VisibleString, or BMPString; * conversion to UTF-8 is forced. */ - if (d2i_DISPLAYTEXT(&ret, &pp, str->length)) { + if (d2i_DISPLAYTEXT(&ret, &pp, ASN1_STRING_length(str))) { ASN1_STRING_print_ex(bio, ret, ASN1_STRFLGS_UTF8_CONVERT); rv = 1; } @@ -1228,5 +1228,3 @@ static const char *ssl_var_log_handler_x(request_rec *r, char *a) } return result; } - -