Constify more X509 arguments and return values

X509_get0_distinguishing_id
X509_keyid_get0
X509_alias_get0
X509_CRL_get0_by_cert
X509_issuer_name_hash
X509_issuer_name_hash_old
X509_subject_name_hash_old

are all const corrected

And PKCS12_add_localkeyid
as a result

X509_getm_notBefore
X509_getm_notAfter=

are const "corrected" by making their argument non-const

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Feb 24 16:32:45 2026
(Merged from https://github.com/openssl/openssl/pull/30036)

diff --git a/CHANGES.md b/CHANGES.md
index fc64bf76600c6f53c55047e1cedf1d3ee3afa2bd..9a6d5c04ebaf36820955b81eec18a1331d93d7ee 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -239,6 +239,10 @@ OpenSSL 4.0
 
    *Daniel Kubec and Eugene Syromiatnikov*
 
+ * X509_get0_distinguishing_id now takes and returns const objects.
+
+   * Bob Beck *
+
  * Added `-hmac-env` and `-hmac-stdin` options to openssl-dgst.
 
    *Igor Ustinov*

diff --git a/apps/x509.c b/apps/x509.c
index d98d1433a0f8eef1b8dc7397124f0d71bebc2a31..c1e0a8fa2c00b198f74cf6897829fee2833c80c8 100644 (file)
--- a/apps/x509.c
+++ b/apps/x509.c
@@ -1047,7 +1047,7 @@ cert_loop:
                 BIO_printf(out, "%s\n", sk_OPENSSL_STRING_value(emlst, j));
             X509_email_free(emlst);
         } else if (i == aliasout) {
-            unsigned char *alstr = X509_alias_get0(x, NULL);
+            const unsigned char *alstr = X509_alias_get0(x, NULL);
 
             if (alstr)
                 BIO_printf(out, "%s\n", alstr);

diff --git a/crypto/pkcs12/p12_attr.c b/crypto/pkcs12/p12_attr.c
index eaa3811e246eb66b89cbcb84ec42e8ba97a0624b..d9e647ce7ac9c5ed13c22c59982989e854c05d6c 100644 (file)
--- a/crypto/pkcs12/p12_attr.c
+++ b/crypto/pkcs12/p12_attr.c
@@ -14,7 +14,7 @@
 
 /* Add a local keyid to a safebag */
 
-int PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, unsigned char *name,
+int PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, const unsigned char *name,
     int namelen)
 {
     if (X509at_add1_attr_by_NID(&bag->attrib, NID_localKeyID,

diff --git a/crypto/pkcs12/p12_crt.c b/crypto/pkcs12/p12_crt.c
index 90a6fe1182dd944d4909d7577626c85b79c7c7a2..684c00986d9e95338d2592e706f643c732e6bc9a 100644 (file)
--- a/crypto/pkcs12/p12_crt.c
+++ b/crypto/pkcs12/p12_crt.c
@@ -20,7 +20,7 @@ static PKCS12_SAFEBAG *pkcs12_add_cert_bag(STACK_OF(PKCS12_SAFEBAG) **pbags,
     X509 *cert,
     const char *name,
     int namelen,
-    unsigned char *keyid,
+    const unsigned char *keyid,
     int keyidlen);
 
 static int copy_bag_attr(PKCS12_SAFEBAG *bag, EVP_PKEY *pkey, int nid)
@@ -46,7 +46,7 @@ PKCS12 *PKCS12_create_ex2(const char *pass, const char *name, EVP_PKEY *pkey,
     unsigned char keyid[EVP_MAX_MD_SIZE];
     unsigned int keyidlen = 0;
     int namelen = -1;
-    unsigned char *pkeyid = NULL;
+    const unsigned char *pkeyid = NULL;
     int pkeyidlen = -1;
 
     /* Set defaults */
@@ -190,7 +190,7 @@ static PKCS12_SAFEBAG *pkcs12_add_cert_bag(STACK_OF(PKCS12_SAFEBAG) **pbags,
     X509 *cert,
     const char *name,
     int namelen,
-    unsigned char *keyid,
+    const unsigned char *keyid,
     int keyidlen)
 {
     PKCS12_SAFEBAG *bag = NULL;
@@ -219,7 +219,7 @@ PKCS12_SAFEBAG *PKCS12_add_cert(STACK_OF(PKCS12_SAFEBAG) **pbags, X509 *cert)
 {
     char *name = NULL;
     int namelen = -1;
-    unsigned char *keyid = NULL;
+    const unsigned char *keyid = NULL;
     int keyidlen = -1;
 
     /*

diff --git a/crypto/x509/x509_set.c b/crypto/x509/x509_set.c
index ec795faa57866703fa11353e601b3962e164b569..75b5e7794528434ffa826985385d5b19c0af6ee5 100644 (file)
--- a/crypto/x509/x509_set.c
+++ b/crypto/x509/x509_set.c
@@ -140,12 +140,12 @@ const ASN1_TIME *X509_get0_notAfter(const X509 *x)
     return x->cert_info.validity.notAfter;
 }
 
-ASN1_TIME *X509_getm_notBefore(const X509 *x)
+ASN1_TIME *X509_getm_notBefore(X509 *x)
 {
     return x->cert_info.validity.notBefore;
 }
 
-ASN1_TIME *X509_getm_notAfter(const X509 *x)
+ASN1_TIME *X509_getm_notAfter(X509 *x)
 {
     return x->cert_info.validity.notAfter;
 }

diff --git a/crypto/x509/x_x509.c b/crypto/x509/x_x509.c
index 2c62e0cd8a1e7ac0936b18ade3333339cc9b93a5..08435a4517446f12feb44327fdf3d7e7e456a204 100644 (file)
--- a/crypto/x509/x_x509.c
+++ b/crypto/x509/x_x509.c
@@ -304,7 +304,7 @@ void X509_set0_distinguishing_id(X509 *x, ASN1_OCTET_STRING *d_id)
     x->distinguishing_id = d_id;
 }
 
-ASN1_OCTET_STRING *X509_get0_distinguishing_id(X509 *x)
+const ASN1_OCTET_STRING *X509_get0_distinguishing_id(const X509 *x)
 {
     return x->distinguishing_id;
 }

diff --git a/crypto/x509/x_x509a.c b/crypto/x509/x_x509a.c
index 8a9ff6eb88ee7d4dc6dbaa31c9d387c088eea7f4..617e4142d5ffc85bf6362d7b1f1e5317903315fa 100644 (file)
--- a/crypto/x509/x_x509a.c
+++ b/crypto/x509/x_x509a.c
@@ -82,7 +82,7 @@ int X509_keyid_set1(X509 *x, const unsigned char *id, int len)
     return ASN1_STRING_set(aux->keyid, id, len);
 }
 
-unsigned char *X509_alias_get0(const X509 *x, int *len)
+const unsigned char *X509_alias_get0(const X509 *x, int *len)
 {
     if (!x->aux || !x->aux->alias)
         return NULL;
@@ -91,7 +91,7 @@ unsigned char *X509_alias_get0(const X509 *x, int *len)
     return x->aux->alias->data;
 }
 
-unsigned char *X509_keyid_get0(const X509 *x, int *len)
+const unsigned char *X509_keyid_get0(const X509 *x, int *len)
 {
     if (!x->aux || !x->aux->keyid)
         return NULL;

diff --git a/doc/man3/PKCS12_add_localkeyid.pod b/doc/man3/PKCS12_add_localkeyid.pod
index 6d9ff9883ef74c0d5fb48381bd98eecbc7cf308e..6e952c623757b9eb8d592f756c445589c5e3da39 100644 (file)
--- a/doc/man3/PKCS12_add_localkeyid.pod
+++ b/doc/man3/PKCS12_add_localkeyid.pod
@@ -8,7 +8,7 @@ PKCS12_add_localkeyid - Add the localKeyId attribute to a PKCS#12 safeBag
 
  #include <openssl/pkcs12.h>
 
- int PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, const char *name,
+ int PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, const unsigned char *name,
                            int namelen);
 
 =head1 DESCRIPTION

diff --git a/doc/man3/X509_get0_distinguishing_id.pod b/doc/man3/X509_get0_distinguishing_id.pod
index 7db260cdce0b8af3f09ee7503534c016aa0f386c..5ca8bb981f0e713d6db465bc7fe669fc9cf76f5a 100644 (file)
--- a/doc/man3/X509_get0_distinguishing_id.pod
+++ b/doc/man3/X509_get0_distinguishing_id.pod
@@ -10,7 +10,7 @@ X509_REQ_get0_distinguishing_id, X509_REQ_set0_distinguishing_id
 
  #include <openssl/x509.h>
 
- ASN1_OCTET_STRING *X509_get0_distinguishing_id(X509 *x);
+ const ASN1_OCTET_STRING *X509_get0_distinguishing_id(const X509 *x);
  void X509_set0_distinguishing_id(X509 *x, ASN1_OCTET_STRING *distid);
  ASN1_OCTET_STRING *X509_REQ_get0_distinguishing_id(X509_REQ *x);
  void X509_REQ_set0_distinguishing_id(X509_REQ *x, ASN1_OCTET_STRING *distid);

diff --git a/include/openssl/pkcs12.h.in b/include/openssl/pkcs12.h.in
index 66b49a6b0557e359eed75bf2139f019bd817222a..4a96b93cb220abf53df7ac77b0079c3714b3a175 100644 (file)
--- a/include/openssl/pkcs12.h.in
+++ b/include/openssl/pkcs12.h.in
@@ -191,7 +191,7 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_p7encdata(PKCS7 *p7, const char *pass,
 int PKCS12_pack_authsafes(PKCS12 *p12, STACK_OF(PKCS7) *safes);
 STACK_OF(PKCS7) *PKCS12_unpack_authsafes(const PKCS12 *p12);
 
-int PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, unsigned char *name,
+int PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, const unsigned char *name,
     int namelen);
 int PKCS12_add_friendlyname_asc(PKCS12_SAFEBAG *bag, const char *name,
     int namelen);

diff --git a/include/openssl/x509.h.in b/include/openssl/x509.h.in
index 5832eaa146b3a156f02aa8509a1821d4a02513e1..b5b519ecf0027f86287760a5495100e3cd3fe463 100644 (file)
--- a/include/openssl/x509.h.in
+++ b/include/openssl/x509.h.in
@@ -596,14 +596,14 @@ void X509_get0_signature(const ASN1_BIT_STRING **psig,
 int X509_get_signature_nid(const X509 *x);
 
 void X509_set0_distinguishing_id(X509 *x, ASN1_OCTET_STRING *d_id);
-ASN1_OCTET_STRING *X509_get0_distinguishing_id(X509 *x);
+const ASN1_OCTET_STRING *X509_get0_distinguishing_id(const X509 *x);
 void X509_REQ_set0_distinguishing_id(X509_REQ *x, ASN1_OCTET_STRING *d_id);
 ASN1_OCTET_STRING *X509_REQ_get0_distinguishing_id(X509_REQ *x);
 
 int X509_alias_set1(X509 *x, const unsigned char *name, int len);
 int X509_keyid_set1(X509 *x, const unsigned char *id, int len);
-unsigned char *X509_alias_get0(const X509 *x, int *len);
-unsigned char *X509_keyid_get0(const X509 *x, int *len);
+const unsigned char *X509_alias_get0(const X509 *x, int *len);
+const unsigned char *X509_keyid_get0(const X509 *x, int *len);
 
 DECLARE_ASN1_FUNCTIONS(X509_REVOKED)
 DECLARE_ASN1_FUNCTIONS(X509_CRL_INFO)
@@ -667,10 +667,10 @@ X509_NAME *X509_get_issuer_name(const X509 *a);
 int X509_set_subject_name(X509 *x, const X509_NAME *name);
 X509_NAME *X509_get_subject_name(const X509 *a);
 const ASN1_TIME *X509_get0_notBefore(const X509 *x);
-ASN1_TIME *X509_getm_notBefore(const X509 *x);
+ASN1_TIME *X509_getm_notBefore(X509 *x);
 int X509_set1_notBefore(X509 *x, const ASN1_TIME *tm);
 const ASN1_TIME *X509_get0_notAfter(const X509 *x);
-ASN1_TIME *X509_getm_notAfter(const X509 *x);
+ASN1_TIME *X509_getm_notAfter(X509 *x);
 int X509_set1_notAfter(X509 *x, const ASN1_TIME *tm);
 int X509_up_ref(X509 *x);
 int X509_get_signature_type(const X509 *x);

diff --git a/test/verify_extra_test.c b/test/verify_extra_test.c
index f3e431d1406e71625aec872db5bc468e55681eb3..7dea18d19297b8e85473267861ede1c170d97183 100644 (file)
--- a/test/verify_extra_test.c
+++ b/test/verify_extra_test.c
@@ -108,7 +108,8 @@ static int test_distinguishing_id(void)
 {
     X509 *x = NULL;
     int ret = 0;
-    ASN1_OCTET_STRING *v = NULL, *v2 = NULL;
+    ASN1_OCTET_STRING *v = NULL;
+    const ASN1_OCTET_STRING *v2 = NULL;
     char *distid = "this is an ID";
 
     x = load_cert_from_file(bad_f);