Make ASN1_STRING opaque

This laudable goal, should it land, will be followed
with an issue raised to eat our own dogfood and find
every file with <crypto/asn1.h> added to it in this
commit, and change to the appropriate accessors,
which should be possible in most places we aren't
actually implementing things that change the values

Fixes: https://github.com/openssl/openssl/issues/29860
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 10:14:57 2026
(Merged from https://github.com/openssl/openssl/pull/29862)

diff --git a/CHANGES.md b/CHANGES.md
index 8d154ba26cc165b23837be54aed96a0b5649bda0..16c2e24e279ab29fd7664904497f77b57a4fb19a 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -104,6 +104,14 @@ OpenSSL 4.0
 
    *kovan*
 
+ * ASN1_STRING has been made opaque.
+
+   Access to values from ASN1_STRING and related types should be done with the
+   appropriate accessor functions. The various ASN1_STRING_FLAG values have
+   been made private.
+
+   *Bob Beck*
+
  * Added CSHAKE as per [SP 800-185]
 
    *Shane Lontis*

diff --git a/apps/asn1parse.c b/apps/asn1parse.c
index 0361c28579baaadbabf90c24fc0f0969042b9c65..e23089719400b6242b009d43331bb3a033c083d0 100644 (file)
--- a/apps/asn1parse.c
+++ b/apps/asn1parse.c
@@ -83,7 +83,7 @@ int asn1parse_main(int argc, char **argv)
     int indent = 0, noout = 0, dump = 0, informat = FORMAT_PEM;
     int offset = 0, ret = 1, i, j;
     long num, tmplen;
-    unsigned char *tmpbuf;
+    const unsigned char *tmpbuf;
     unsigned int length = 0;
     OPTION_CHOICE o;
     const ASN1_ITEM *it = NULL;
@@ -271,10 +271,11 @@ int asn1parse_main(int argc, char **argv)
                 goto end;
             }
             /* hmm... this is a little evil but it works */
-            tmpbuf = at->value.asn1_string->data;
-            tmplen = at->value.asn1_string->length;
+            tmpbuf = ASN1_STRING_get0_data(at->value.asn1_string);
+            tmplen = ASN1_STRING_length(at->value.asn1_string);
         }
-        str = tmpbuf;
+        /* XXX casts away const */
+        str = (unsigned char *)tmpbuf;
         num = tmplen;
     }
 

diff --git a/apps/ca.c b/apps/ca.c
index 87fe09ae614185135a9df98d3143ef275edfe18d..c95ef2be4b781a8883b015a61468a7bddbbb5b46 100644 (file)
--- a/apps/ca.c
+++ b/apps/ca.c
@@ -25,6 +25,8 @@
 #include <openssl/ocsp.h>
 #include <openssl/pem.h>
 
+#include <crypto/asn1.h>
+
 #ifndef W_OK
 #ifdef OPENSSL_SYS_VMS
 #include <unistd.h>
@@ -1509,14 +1511,14 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
             continue;
 
         /* check some things */
-        if (nid == NID_pkcs9_emailAddress && str->type != V_ASN1_IA5STRING) {
+        if (nid == NID_pkcs9_emailAddress && ASN1_STRING_type(str) != V_ASN1_IA5STRING) {
             BIO_puts(bio_err,
                 "\nemailAddress type needs to be of type IA5STRING\n");
             goto end;
         }
-        if (str->type != V_ASN1_BMPSTRING && str->type != V_ASN1_UTF8STRING) {
-            j = ASN1_PRINTABLE_type(str->data, str->length);
-            if ((j == V_ASN1_T61STRING && str->type != V_ASN1_T61STRING) || (j == V_ASN1_IA5STRING && str->type == V_ASN1_PRINTABLESTRING)) {
+        if (ASN1_STRING_type(str) != V_ASN1_BMPSTRING && ASN1_STRING_type(str) != V_ASN1_UTF8STRING) {
+            j = ASN1_PRINTABLE_type(ASN1_STRING_get0_data(str), ASN1_STRING_length(str));
+            if ((j == V_ASN1_T61STRING && ASN1_STRING_type(str) != V_ASN1_T61STRING) || (j == V_ASN1_IA5STRING && ASN1_STRING_type(str) == V_ASN1_PRINTABLESTRING)) {
                 BIO_puts(bio_err,
                     "\nThe string contains characters that are illegal for the ASN.1 type\n");
                 goto end;
@@ -1614,8 +1616,8 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
                         "The %s field is different between\n"
                         "CA certificate (%s) and the request (%s)\n",
                         cv->name,
-                        ((str2 == NULL) ? "NULL" : (char *)str2->data),
-                        ((str == NULL) ? "NULL" : (char *)str->data));
+                        ((str2 == NULL) ? "NULL" : (char *)ASN1_STRING_get0_data(str2)),
+                        ((str == NULL) ? "NULL" : (char *)ASN1_STRING_get0_data(str)));
                     goto end;
                 }
             } else {
@@ -1890,9 +1892,9 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
     /* We now just add it to the database as DB_TYPE_VAL('V') */
     row[DB_type] = OPENSSL_strdup("V");
     tm = X509_get0_notAfter(ret);
-    row[DB_exp_date] = app_malloc(tm->length + 1, "row expdate");
-    memcpy(row[DB_exp_date], tm->data, tm->length);
-    row[DB_exp_date][tm->length] = '\0';
+    row[DB_exp_date] = app_malloc(ASN1_STRING_length(tm) + 1, "row expdate");
+    memcpy(row[DB_exp_date], ASN1_STRING_get0_data(tm), ASN1_STRING_length(tm));
+    row[DB_exp_date][ASN1_STRING_length(tm)] = '\0';
     row[DB_rev_date] = NULL;
     row[DB_file] = OPENSSL_strdup("unknown");
     if ((row[DB_type] == NULL) || (row[DB_file] == NULL)
@@ -2126,9 +2128,9 @@ static int do_revoke(X509 *x509, CA_DB *db, REVINFO_TYPE rev_type,
         /* We now just add it to the database as DB_TYPE_REV('V') */
         row[DB_type] = OPENSSL_strdup("V");
         tm = X509_get0_notAfter(x509);
-        row[DB_exp_date] = app_malloc(tm->length + 1, "row exp_data");
-        memcpy(row[DB_exp_date], tm->data, tm->length);
-        row[DB_exp_date][tm->length] = '\0';
+        row[DB_exp_date] = app_malloc(ASN1_STRING_length(tm) + 1, "row exp_data");
+        memcpy(row[DB_exp_date], ASN1_STRING_get0_data(tm), ASN1_STRING_length(tm));
+        row[DB_exp_date][ASN1_STRING_length(tm)] = '\0';
         row[DB_rev_date] = NULL;
         row[DB_file] = OPENSSL_strdup("unknown");
 
@@ -2396,7 +2398,7 @@ static char *make_revocation_str(REVINFO_TYPE rev_type, const char *rev_arg)
     if (!revtm)
         return NULL;
 
-    i = revtm->length + 1;
+    i = ASN1_STRING_length(revtm) + 1;
 
     if (reason)
         i += (int)(strlen(reason) + 1);
@@ -2404,7 +2406,7 @@ static char *make_revocation_str(REVINFO_TYPE rev_type, const char *rev_arg)
         i += (int)(strlen(other) + 1);
 
     str = app_malloc(i, "revocation reason");
-    OPENSSL_strlcpy(str, (char *)revtm->data, i);
+    OPENSSL_strlcpy(str, (const char *)ASN1_STRING_get0_data(revtm), i);
     if (reason) {
         OPENSSL_strlcat(str, ",", i);
         OPENSSL_strlcat(str, reason, i);
@@ -2491,19 +2493,19 @@ static int old_entry_print(const ASN1_OBJECT *obj, const ASN1_STRING *str)
     *(pbuf++) = '\0';
     BIO_puts(bio_err, buf);
 
-    if (str->type == V_ASN1_PRINTABLESTRING)
+    if (ASN1_STRING_type(str) == V_ASN1_PRINTABLESTRING)
         BIO_puts(bio_err, "PRINTABLE:'");
-    else if (str->type == V_ASN1_T61STRING)
+    else if (ASN1_STRING_type(str) == V_ASN1_T61STRING)
         BIO_puts(bio_err, "T61STRING:'");
-    else if (str->type == V_ASN1_IA5STRING)
+    else if (ASN1_STRING_type(str) == V_ASN1_IA5STRING)
         BIO_puts(bio_err, "IA5STRING:'");
-    else if (str->type == V_ASN1_UNIVERSALSTRING)
+    else if (ASN1_STRING_type(str) == V_ASN1_UNIVERSALSTRING)
         BIO_puts(bio_err, "UNIVERSALSTRING:'");
     else
-        BIO_printf(bio_err, "ASN.1 %2d:'", str->type);
+        BIO_printf(bio_err, "ASN.1 %2d:'", ASN1_STRING_type(str));
 
-    p = (const char *)str->data;
-    for (j = str->length; j > 0; j--) {
+    p = (const char *)ASN1_STRING_get0_data(str);
+    for (j = ASN1_STRING_length(str); j > 0; j--) {
         if ((*p >= ' ') && (*p <= '~'))
             BIO_printf(bio_err, "%c", *p);
         else if (*p & 0x80)

diff --git a/apps/crl.c b/apps/crl.c
index f59cdb98b9b3f2385ddf9c44371f87d1b30963fb..2013da72362b29aae8675a61487afe75ba634c04 100644 (file)
--- a/apps/crl.c
+++ b/apps/crl.c
@@ -309,7 +309,11 @@ int crl_main(int argc, char **argv)
         const ASN1_BIT_STRING *sig;
 
         X509_CRL_get0_signature(x, &sig, NULL);
-        corrupt_signature(sig);
+        /* XXX Casts away const, because it mutates the value! */
+        if (!corrupt_signature((ASN1_BIT_STRING *)sig)) {
+            BIO_puts(bio_err, "Error corrupting signature\n");
+            goto end;
+        }
     }
 
     if (num) {

diff --git a/apps/include/apps.h b/apps/include/apps.h
index e9b1b6538e153bb82332ef355a199eb3c2a9d16d..f677f74bf5dac9baf4eeb42084a13ceea84b8988 100644 (file)
--- a/apps/include/apps.h
+++ b/apps/include/apps.h
@@ -78,7 +78,7 @@ void wait_for_async(SSL *s);
 int has_stdin_waiting(void);
 #endif
 
-void corrupt_signature(const ASN1_STRING *signature);
+int corrupt_signature(ASN1_STRING *signature);
 
 /* Helpers for setting X509v3 certificate fields notBefore and notAfter */
 int check_cert_time_string(const char *time, const char *desc);

diff --git a/apps/lib/apps.c b/apps/lib/apps.c
index bf51b291254c3dd7160903cac91c68aef71b9f2a..add16726b632a5d8f50ea62a4333fefb19d2b4b8 100644 (file)
--- a/apps/lib/apps.c
+++ b/apps/lib/apps.c
@@ -3398,12 +3398,23 @@ int has_stdin_waiting(void)
 }
 #endif
 
-/* Corrupt a signature by modifying final byte */
-void corrupt_signature(const ASN1_STRING *signature)
+/*
+ * Corrupt a signature by modifying final byte
+ * (mutates signature)
+ */
+int corrupt_signature(ASN1_STRING *signature)
 {
-    unsigned char *s = signature->data;
+    const unsigned char *valid = ASN1_STRING_get0_data(signature);
+    int length = ASN1_STRING_length(signature);
+    unsigned char *s = OPENSSL_memdup(valid, length);
+
+    if (s == NULL)
+        return 0;
+
+    s[length - 1] ^= 0x1;
 
-    s[signature->length - 1] ^= 0x1;
+    ASN1_STRING_set0(signature, s, length);
+    return 1;
 }
 
 int check_cert_time_string(const char *time, const char *desc)

diff --git a/apps/ocsp.c b/apps/ocsp.c
index f74495fd153b7cf68cb84a69fcf1b26ea171a6eb..f2007725a917465169867065a787058bd5ef7d2d 100644 (file)
--- a/apps/ocsp.c
+++ b/apps/ocsp.c
@@ -1226,7 +1226,9 @@ static void make_ocsp_response(BIO *err, OCSP_RESPONSE **resp, OCSP_REQUEST *req
 
     if (badsig) {
         const ASN1_OCTET_STRING *sig = OCSP_resp_get0_signature(bs);
-        corrupt_signature(sig);
+        /* XXX Casts away const, because it mutates the value! */
+        if (!corrupt_signature((ASN1_STRING *)sig))
+            goto end;
     }
 
     *resp = OCSP_response_create(OCSP_RESPONSE_STATUS_SUCCESSFUL, bs);

diff --git a/apps/pkcs12.c b/apps/pkcs12.c
index 1fb4fb999dae27baaf3661c326c4cd43aa9cdcbc..7a3037b16859ffa616f33ca15534a5a3028ed647 100644 (file)
--- a/apps/pkcs12.c
+++ b/apps/pkcs12.c
@@ -51,7 +51,7 @@ int dump_certs_pkeys_bag(BIO *out, const PKCS12_SAFEBAG *bags,
 void print_attribute(BIO *out, const ASN1_TYPE *av);
 int print_attribs(BIO *out, const STACK_OF(X509_ATTRIBUTE) *attrlst,
     const char *name);
-static void hex_print(BIO *out, unsigned char *buf, int len);
+static void hex_print(BIO *out, const unsigned char *buf, int len);
 static int alg_print(const X509_ALGOR *alg);
 int cert_load(BIO *in, STACK_OF(X509) *sk);
 static int set_pbe(int *ppbe, const char *str);
@@ -1280,26 +1280,26 @@ void print_attribute(BIO *out, const ASN1_TYPE *av)
 
     switch (av->type) {
     case V_ASN1_BMPSTRING:
-        value = OPENSSL_uni2asc(av->value.bmpstring->data,
-            av->value.bmpstring->length);
+        value = OPENSSL_uni2asc(ASN1_STRING_get0_data(av->value.bmpstring),
+            ASN1_STRING_length(av->value.bmpstring));
         BIO_printf(out, "%s\n", value);
         OPENSSL_free(value);
         break;
 
     case V_ASN1_UTF8STRING:
-        BIO_printf(out, "%.*s\n", av->value.utf8string->length,
-            av->value.utf8string->data);
+        BIO_printf(out, "%.*s\n", ASN1_STRING_length(av->value.utf8string),
+            ASN1_STRING_get0_data(av->value.utf8string));
         break;
 
     case V_ASN1_OCTET_STRING:
-        hex_print(out, av->value.octet_string->data,
-            av->value.octet_string->length);
+        hex_print(out, ASN1_STRING_get0_data(av->value.octet_string),
+            ASN1_STRING_length(av->value.octet_string));
         BIO_puts(out, "\n");
         break;
 
     case V_ASN1_BIT_STRING:
-        hex_print(out, av->value.bit_string->data,
-            av->value.bit_string->length);
+        hex_print(out, ASN1_STRING_get0_data(av->value.bit_string),
+            ASN1_STRING_length(av->value.bit_string));
         BIO_puts(out, "\n");
         break;
 
@@ -1359,7 +1359,7 @@ int print_attribs(BIO *out, const STACK_OF(X509_ATTRIBUTE) *attrlst,
     return 1;
 }
 
-static void hex_print(BIO *out, unsigned char *buf, int len)
+static void hex_print(BIO *out, const unsigned char *buf, int len)
 {
     int i;
     for (i = 0; i < len; i++)

diff --git a/apps/s_client.c b/apps/s_client.c
index ab7718df70a65e468045172d443d62729168c7fb..037790a21ae18b2e3d49b243d8260cfb021e7e6b 100644 (file)
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -3039,8 +3039,8 @@ re_start:
         NCONF_free(cnf);
 
         /* Send SSLRequest packet */
-        BIO_write(sbio, atyp->value.sequence->data,
-            atyp->value.sequence->length);
+        BIO_write(sbio, ASN1_STRING_get0_data(atyp->value.sequence),
+            ASN1_STRING_length(atyp->value.sequence));
         (void)BIO_flush(sbio);
         ASN1_TYPE_free(atyp);
 

diff --git a/apps/ts.c b/apps/ts.c
index 3d378570157c507b8e3b812949725d0ff9359c7a..b5f1d569a629964471c860c6a4ea43b1d783f817 100644 (file)
--- a/apps/ts.c
+++ b/apps/ts.c
@@ -567,30 +567,33 @@ err:
 static ASN1_INTEGER *create_nonce(int bits)
 {
     unsigned char buf[20];
+    ASN1_INTEGER *ret = NULL;
     ASN1_INTEGER *nonce = NULL;
     int len = (bits - 1) / 8 + 1;
-    int i;
 
     if (len > (int)sizeof(buf))
         goto err;
-    if (RAND_bytes(buf, len) <= 0)
-        goto err;
 
-    /* Find the first non-zero byte and creating ASN1_INTEGER object. */
-    for (i = 0; i < len && !buf[i]; ++i)
-        continue;
+    /* Make a random nonce with a non-zero first byte */
+    do {
+        if (RAND_bytes(buf, len) <= 0)
+            goto err;
+    } while (!buf[0]);
+
     if ((nonce = ASN1_INTEGER_new()) == NULL)
         goto err;
-    OPENSSL_free(nonce->data);
-    nonce->length = len - i;
-    nonce->data = app_malloc(nonce->length + 1, "nonce buffer");
-    memcpy(nonce->data, buf + i, nonce->length);
-    return nonce;
+
+    if (!ASN1_STRING_set(nonce, buf, len))
+        goto err;
+
+    ret = nonce;
+    nonce = NULL;
 
 err:
-    BIO_puts(bio_err, "could not create nonce\n");
+    if (ret == NULL)
+        BIO_puts(bio_err, "could not create nonce\n");
     ASN1_INTEGER_free(nonce);
-    return NULL;
+    return ret;
 }
 
 /*

diff --git a/apps/x509.c b/apps/x509.c
index b0dc3e683c9c9ca3554263afb98560932a0f6a3e..003dd7b984e8bcb2bf6ce9a0db62282096e23478 100644 (file)
--- a/apps/x509.c
+++ b/apps/x509.c
@@ -1012,7 +1012,9 @@ cert_loop:
         const ASN1_BIT_STRING *signature;
 
         X509_get0_signature(&signature, NULL, x);
-        corrupt_signature(signature);
+        /* XXX Casts away const, because it mutates the value! */
+        if (!corrupt_signature(((ASN1_STRING *)signature)))
+            goto err;
     }
 
     /* Process print options in the given order, as indicated by index i */

diff --git a/crypto/asn1/a_mbstr.c b/crypto/asn1/a_mbstr.c
index 7be233db5e0b2019262336d4456da308dc86ebbf..756bac9543005f453030f684e2ea2a628deacc23 100644 (file)
--- a/crypto/asn1/a_mbstr.c
+++ b/crypto/asn1/a_mbstr.c
@@ -13,6 +13,8 @@
 #include "internal/unicode.h"
 #include <openssl/asn1.h>
 
+#include <crypto/asn1.h>
+
 static int traverse_string(const unsigned char *p, int len, int inform,
     int (*rfunc)(unsigned long value, void *in),
     void *arg);

diff --git a/crypto/asn1/a_print.c b/crypto/asn1/a_print.c
index 54e50425914539cf50021c895272ca12025df503..4e4cf0651e1f69e28e8f5af7223d2a2621b534c7 100644 (file)
--- a/crypto/asn1/a_print.c
+++ b/crypto/asn1/a_print.c
@@ -12,6 +12,8 @@
 #include "internal/cryptlib.h"
 #include <openssl/asn1.h>
 
+#include <crypto/asn1.h>
+
 int ASN1_PRINTABLE_type(const unsigned char *s, int len)
 {
     int c;

diff --git a/crypto/asn1/asn1_parse.c b/crypto/asn1/asn1_parse.c
index 9b7e2a7939b9a44dbc0dc4dd3ae7d11162b2ace2..47f0dfe6f04d961be47fbad2c79b11ac06284f9c 100644 (file)
--- a/crypto/asn1/asn1_parse.c
+++ b/crypto/asn1/asn1_parse.c
@@ -17,6 +17,8 @@
 #define ASN1_PARSE_MAXDEPTH 128
 #endif
 
+#include <crypto/asn1.h>
+
 static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
     int offset, int depth, int indent, int dump);
 static int asn1_print_info(BIO *bp, long offset, int depth, int hl, long len,

diff --git a/crypto/asn1/asn_pack.c b/crypto/asn1/asn_pack.c
index e8b93030a2837dcac5f5486bc3fee4ccc934dfc0..859124a93b2b3d74954166440459645ee8fa929e 100644 (file)
--- a/crypto/asn1/asn_pack.c
+++ b/crypto/asn1/asn_pack.c
@@ -11,6 +11,8 @@
 #include "internal/cryptlib.h"
 #include <openssl/asn1.h>
 
+#include <crypto/asn1.h>
+
 /* ASN1 packing and unpacking functions */
 
 ASN1_STRING *ASN1_item_pack(void *obj, const ASN1_ITEM *it, ASN1_STRING **oct)

diff --git a/crypto/asn1/f_int.c b/crypto/asn1/f_int.c
index b1fd3f9467c35f63d4c8c340b64959ce78589241..733b897aa1b0dcf8b810b648de0ed950e0161716 100644 (file)
--- a/crypto/asn1/f_int.c
+++ b/crypto/asn1/f_int.c
@@ -13,6 +13,8 @@
 #include <openssl/buffer.h>
 #include <openssl/asn1.h>
 
+#include <crypto/asn1.h>
+
 int i2a_ASN1_INTEGER(BIO *bp, const ASN1_INTEGER *a)
 {
     int i, n = 0;

diff --git a/crypto/asn1/f_string.c b/crypto/asn1/f_string.c
index 9fb34f495e10e1c4d37ec4343b9b716357990721..c2f81694fdb7e2d74f74a1da60a4d60332b06e75 100644 (file)
--- a/crypto/asn1/f_string.c
+++ b/crypto/asn1/f_string.c
@@ -13,6 +13,8 @@
 #include <openssl/buffer.h>
 #include <openssl/asn1.h>
 
+#include <crypto/asn1.h>
+
 int i2a_ASN1_STRING(BIO *bp, const ASN1_STRING *a, int type)
 {
     int i, n = 0;

diff --git a/crypto/asn1/p5_scrypt.c b/crypto/asn1/p5_scrypt.c
index 14c672bcb4039e72d0ae011bbe2b7c9aef9ae1ba..d50524d505f51cf500d9f60309fa244a299036be 100644 (file)
--- a/crypto/asn1/p5_scrypt.c
+++ b/crypto/asn1/p5_scrypt.c
@@ -17,6 +17,8 @@
 #include <openssl/rand.h>
 #include "crypto/evp.h"
 
+#include <crypto/asn1.h>
+
 #ifndef OPENSSL_NO_SCRYPT
 /* PKCS#5 scrypt password based encryption structures */
 

diff --git a/crypto/asn1/t_spki.c b/crypto/asn1/t_spki.c
index ab5fca73bca8f56f3b88f0ff1d714fa9a3b67d94..22d11501db762ba4f3603ced60397fba8dd70dbc 100644 (file)
--- a/crypto/asn1/t_spki.c
+++ b/crypto/asn1/t_spki.c
@@ -15,6 +15,8 @@
 #include <openssl/dsa.h>
 #include <openssl/bn.h>
 
+#include <crypto/asn1.h>
+
 /* Print out an SPKI */
 
 int NETSCAPE_SPKI_print(BIO *out, const NETSCAPE_SPKI *spki)

diff --git a/crypto/asn1/tasn_typ.c b/crypto/asn1/tasn_typ.c
index 0e25b75b9f051d8c19034b679a3699a4bf4d48dc..e270dbf8914c887a3652b640819315e9be6b4e47 100644 (file)
--- a/crypto/asn1/tasn_typ.c
+++ b/crypto/asn1/tasn_typ.c
@@ -11,6 +11,8 @@
 #include <openssl/asn1.h>
 #include <openssl/asn1t.h>
 
+#include <crypto/asn1.h>
+
 /* Declarations for string types */
 
 #define IMPLEMENT_ASN1_STRING_FUNCTIONS(sname)                 \

diff --git a/crypto/cms/cms_asn1.c b/crypto/cms/cms_asn1.c
index cf935133c3be7ed8435406d0f3d21934a2880ada..6246ea221f809539c96bfecfad08cc8003bc7652 100644 (file)
--- a/crypto/cms/cms_asn1.c
+++ b/crypto/cms/cms_asn1.c
@@ -13,6 +13,8 @@
 #include <openssl/cms.h>
 #include "cms_local.h"
 
+#include <crypto/asn1.h>
+
 ASN1_SEQUENCE(CMS_IssuerAndSerialNumber) = {
     ASN1_SIMPLE(CMS_IssuerAndSerialNumber, issuer, X509_NAME),
     ASN1_SIMPLE(CMS_IssuerAndSerialNumber, serialNumber, ASN1_INTEGER)

diff --git a/crypto/cms/cms_dd.c b/crypto/cms/cms_dd.c
index 0dada2d08bbb960dba3d8aee0c2e1aca5004b0e0..1e1b8f4b9c7b2ea806c2c2e7ede183393c6dfd5c 100644 (file)
--- a/crypto/cms/cms_dd.c
+++ b/crypto/cms/cms_dd.c
@@ -15,6 +15,8 @@
 #include <openssl/cms.h>
 #include "cms_local.h"
 
+#include <crypto/asn1.h>
+
 /* CMS DigestedData Utilities */
 
 CMS_ContentInfo *ossl_cms_DigestedData_create(const EVP_MD *md,

diff --git a/crypto/cms/cms_io.c b/crypto/cms/cms_io.c
index 14a758da5dc24bb73f4f75ecb3c7cc21322c70f7..6ce752b4453d1a956bb510da5b7697d5ec7be323 100644 (file)
--- a/crypto/cms/cms_io.c
+++ b/crypto/cms/cms_io.c
@@ -14,6 +14,8 @@
 #include <openssl/cms.h>
 #include "cms_local.h"
 
+#include <crypto/asn1.h>
+
 /* unfortunately cannot constify BIO_new_NDEF() due to this and PKCS7_stream() */
 int CMS_stream(unsigned char ***boundary, CMS_ContentInfo *cms)
 {

diff --git a/crypto/cms/cms_kemri.c b/crypto/cms/cms_kemri.c
index 0e21d35c5695f674cc3bc52cdd2b0791c9f3cf93..021ef93d1e8bae2a296fc7e96f9331ffe24ee196 100644 (file)
--- a/crypto/cms/cms_kemri.c
+++ b/crypto/cms/cms_kemri.c
@@ -18,6 +18,8 @@
 #include "crypto/evp.h"
 #include "internal/sizes.h"
 
+#include <crypto/asn1.h>
+
 /* KEM Recipient Info (KEMRI) routines */
 
 int ossl_cms_RecipientInfo_kemri_get0_alg(CMS_RecipientInfo *ri,

diff --git a/crypto/crmf/crmf_pbm.c b/crypto/crmf/crmf_pbm.c
index 7f326a0b6a5cae156957761abff49283e7266b90..466df4887ea7401ccee16afbe82683a2317fbd3d 100644 (file)
--- a/crypto/crmf/crmf_pbm.c
+++ b/crypto/crmf/crmf_pbm.c
@@ -16,6 +16,8 @@
 #include "internal/sizes.h" /* for OSSL_MAX_NAME_SIZE */
 #include <openssl/err.h>
 
+#include <crypto/asn1.h>
+
 /*-
  * creates and initializes OSSL_CRMF_PBMPARAMETER (section 4.4)
  * |slen| SHOULD be at least 8 (16 is common)

diff --git a/crypto/ct/ct_oct.c b/crypto/ct/ct_oct.c
index 770027741c13cfaeb7dece69982db05e5807209a..56ad0d5492fc2a0bbad466160c457d5383860645 100644 (file)
--- a/crypto/ct/ct_oct.c
+++ b/crypto/ct/ct_oct.c
@@ -21,6 +21,8 @@
 
 #include "ct_local.h"
 
+#include <crypto/asn1.h>
+
 int o2i_SCT_signature(SCT *sct, const unsigned char **in, size_t len)
 {
     size_t siglen;

diff --git a/crypto/dh/dh_asn1.c b/crypto/dh/dh_asn1.c
index cd74c659696c1410f17954b7ab24d3715e42cb97..25149123d3944465e52019e09f28024440733d4f 100644 (file)
--- a/crypto/dh/dh_asn1.c
+++ b/crypto/dh/dh_asn1.c
@@ -21,6 +21,8 @@
 #include <openssl/asn1t.h>
 #include "crypto/dh.h"
 
+#include <crypto/asn1.h>
+
 /* Override the default free and new methods */
 static int dh_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
     void *exarg)

diff --git a/crypto/dh/dh_backend.c b/crypto/dh/dh_backend.c
index 264389e0b3eddefd4512dbc3b14837cfd365d6a6..d682eec656a062e1695748e66d970faa483798cb 100644 (file)
--- a/crypto/dh/dh_backend.c
+++ b/crypto/dh/dh_backend.c
@@ -22,6 +22,8 @@
 #include "crypto/dh.h"
 #include "dh_local.h"
 
+#include <crypto/asn1.h>
+
 /*
  * The intention with the "backend" source file is to offer backend functions
  * for legacy backends (EVP_PKEY_ASN1_METHOD) and provider implementations

diff --git a/crypto/dsa/dsa_backend.c b/crypto/dsa/dsa_backend.c
index aca659c82fee92a5359d1fc3496c152fdc9f1795..56945d2497a896e9ff470f8305330462de2ea702 100644 (file)
--- a/crypto/dsa/dsa_backend.c
+++ b/crypto/dsa/dsa_backend.c
@@ -21,6 +21,8 @@
 #include "crypto/dsa.h"
 #include "dsa_local.h"
 
+#include <crypto/asn1.h>
+
 /*
  * The intention with the "backend" source file is to offer backend functions
  * for legacy backends (EVP_PKEY_ASN1_METHOD) and provider implementations

diff --git a/crypto/ec/ec_backend.c b/crypto/ec/ec_backend.c
index 52cb86832382464f4998c79724f32bd7d4198fe2..3e4c6cc6cf4cc421e267807b864ef7476e6a64f7 100644 (file)
--- a/crypto/ec/ec_backend.c
+++ b/crypto/ec/ec_backend.c
@@ -27,6 +27,8 @@
 #include "internal/nelem.h"
 #include "internal/param_build_set.h"
 
+#include <crypto/asn1.h>
+
 /* Mapping between a flag and a name */
 static const OSSL_ITEM encoding_nameid_map[] = {
     { OPENSSL_EC_EXPLICIT_CURVE, OSSL_PKEY_EC_ENCODING_EXPLICIT },

diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c
index 85a0c634d9bdf08a5ba71585fa9a49efe78cf830..275021b5b4e69ef27738334eb4251860f062b8e0 100644 (file)
--- a/crypto/evp/digest.c
+++ b/crypto/evp/digest.c
@@ -21,6 +21,8 @@
 #include "crypto/evp.h"
 #include "evp_local.h"
 
+#include <crypto/asn1.h>
+
 void evp_md_ctx_clear_digest(EVP_MD_CTX *ctx, int force, int keep_fetched)
 {
     if (ctx->algctx != NULL) {

diff --git a/crypto/evp/p5_crpt.c b/crypto/evp/p5_crpt.c
index 570544c79846d40a26c4067c94b94038ffac4699..8ff27909a1a0c4966c4588d5fd6de37d45d36224 100644 (file)
--- a/crypto/evp/p5_crpt.c
+++ b/crypto/evp/p5_crpt.c
@@ -15,6 +15,8 @@
 #include <openssl/core_names.h>
 #include <openssl/kdf.h>
 
+#include <crypto/asn1.h>
+
 /*
  * Doesn't do anything now: Builtin PBE algorithms in static table.
  */

diff --git a/crypto/evp/p5_crpt2.c b/crypto/evp/p5_crpt2.c
index 181ab84ed6fe2d9870643240e248538d7b87e649..b135a46a40f44848e769e16e99e421cd95480316 100644 (file)
--- a/crypto/evp/p5_crpt2.c
+++ b/crypto/evp/p5_crpt2.c
@@ -19,6 +19,8 @@
 #include "crypto/evp.h"
 #include "evp_local.h"
 
+#include <crypto/asn1.h>
+
 int ossl_pkcs5_pbkdf2_hmac_ex(const char *pass, int passlen,
     const unsigned char *salt, int saltlen, int iter,
     const EVP_MD *digest, int keylen, unsigned char *out,

diff --git a/crypto/pkcs12/p12_attr.c b/crypto/pkcs12/p12_attr.c
index d9e647ce7ac9c5ed13c22c59982989e854c05d6c..2edf8f47c7664faebf965671833c4fc4b9593def 100644 (file)
--- a/crypto/pkcs12/p12_attr.c
+++ b/crypto/pkcs12/p12_attr.c
@@ -12,6 +12,8 @@
 #include <openssl/pkcs12.h>
 #include "p12_local.h"
 
+#include <crypto/asn1.h>
+
 /* Add a local keyid to a safebag */
 
 int PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, const unsigned char *name,

diff --git a/crypto/pkcs12/p12_crpt.c b/crypto/pkcs12/p12_crpt.c
index b7519f7b5858c969c513991cb00dc0eab4ae802e..d314a18dd3d806eecb38a4755cdeae9a2a65d1ca 100644 (file)
--- a/crypto/pkcs12/p12_crpt.c
+++ b/crypto/pkcs12/p12_crpt.c
@@ -14,6 +14,8 @@
 #include "crypto/evp.h"
 #include <openssl/pkcs12.h>
 
+#include <crypto/asn1.h>
+
 /* PKCS#12 PBE algorithms now in static table */
 
 void PKCS12_PBE_add(void)

diff --git a/crypto/pkcs12/p12_decr.c b/crypto/pkcs12/p12_decr.c
index ec1d2ee54aed93c51b949d1817a464b3728afa1a..a26be259e9330f53d4cb599d752d247b4509b820 100644 (file)
--- a/crypto/pkcs12/p12_decr.c
+++ b/crypto/pkcs12/p12_decr.c
@@ -12,6 +12,8 @@
 #include <openssl/pkcs12.h>
 #include <openssl/trace.h>
 
+#include <crypto/asn1.h>
+
 /*
  * Encrypt/Decrypt a buffer based on password and algor, result in a
  * OPENSSL_malloc'ed buffer

diff --git a/crypto/pkcs12/p12_mutl.c b/crypto/pkcs12/p12_mutl.c
index 63a3236e245acaf2493316afd212cad15761ffc8..9f502b5170a6356fb5bba201798cb5e677da3fdc 100644 (file)
--- a/crypto/pkcs12/p12_mutl.c
+++ b/crypto/pkcs12/p12_mutl.c
@@ -22,6 +22,8 @@
 #include <openssl/pkcs12.h>
 #include "p12_local.h"
 
+#include <crypto/asn1.h>
+
 static int pkcs12_pbmac1_pbkdf2_key_gen(const char *pass, int passlen,
     unsigned char *salt, int saltlen,
     int id, int iter, int keylen,

diff --git a/crypto/pkcs12/p12_npas.c b/crypto/pkcs12/p12_npas.c
index db0c18c37b3d981a97f2f29d9147f3b2bcb205d4..778b77532f1c47a2a2b93636e597e901c3e5f4c1 100644 (file)
--- a/crypto/pkcs12/p12_npas.c
+++ b/crypto/pkcs12/p12_npas.c
@@ -15,6 +15,8 @@
 #include <openssl/pkcs12.h>
 #include "p12_local.h"
 
+#include <crypto/asn1.h>
+
 /* PKCS#12 password change routine */
 
 static int newpass_p12(PKCS12 *p12, const char *oldpass, const char *newpass);

diff --git a/crypto/pkcs7/pk7_attr.c b/crypto/pkcs7/pk7_attr.c
index e57551f2737f154b8deda2f5ee6244a80294a3c9..23456f0f5ccbc8d3d02885e625602959ea9b8f79 100644 (file)
--- a/crypto/pkcs7/pk7_attr.c
+++ b/crypto/pkcs7/pk7_attr.c
@@ -17,6 +17,8 @@
 #include <openssl/x509.h>
 #include <openssl/err.h>
 
+#include <crypto/asn1.h>
+
 int PKCS7_add_attrib_smimecap(PKCS7_SIGNER_INFO *si,
     STACK_OF(X509_ALGOR) *cap)
 {

diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c
index 1cf2b1ed511cb2f7f1f51dc9522946a525ed641e..e5b142619462afdc64e2d3dd1dfc9463d907c1e9 100644 (file)
--- a/crypto/pkcs7/pk7_doit.c
+++ b/crypto/pkcs7/pk7_doit.c
@@ -18,6 +18,8 @@
 #include "crypto/evp.h"
 #include "pk7_local.h"
 
+#include <crypto/asn1.h>
+
 static int add_attribute(STACK_OF(X509_ATTRIBUTE) **sk, int nid, int atrtype,
     void *value);
 static const ASN1_TYPE *get_attribute(const STACK_OF(X509_ATTRIBUTE) *sk, int nid);

diff --git a/crypto/rsa/rsa_saos.c b/crypto/rsa/rsa_saos.c
index afcc4c9a4d8b7ff8c6547caa6b80ddc01c7a704d..e727f3ae7d505b9d4d6235aa669e75f45dd8f02e 100644 (file)
--- a/crypto/rsa/rsa_saos.c
+++ b/crypto/rsa/rsa_saos.c
@@ -19,6 +19,7 @@
 #include <openssl/rsa.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
+#include <crypto/asn1.h>
 
 int RSA_sign_ASN1_OCTET_STRING(int type,
     const unsigned char *m, unsigned int m_len,

diff --git a/crypto/sm2/sm2_crypt.c b/crypto/sm2/sm2_crypt.c
index 7a8c7585525e9f6f586b4a0581d25f91edf24b8b..28cf5abea2dcd52e7d7c95e939700e688d5343b4 100644 (file)
--- a/crypto/sm2/sm2_crypt.c
+++ b/crypto/sm2/sm2_crypt.c
@@ -25,6 +25,8 @@
 #include <openssl/asn1t.h>
 #include <string.h>
 
+#include <crypto/asn1.h>
+
 typedef struct SM2_Ciphertext_st SM2_Ciphertext;
 DECLARE_ASN1_FUNCTIONS(SM2_Ciphertext)
 

diff --git a/crypto/ts/ts_asn1.c b/crypto/ts/ts_asn1.c
index 115f620720a710597865f6d6fa54bffc4f296383..3cf4ab193ec86dcdad135a1218bade94bdd3a4cb 100644 (file)
--- a/crypto/ts/ts_asn1.c
+++ b/crypto/ts/ts_asn1.c
@@ -12,6 +12,8 @@
 #include <openssl/asn1t.h>
 #include "ts_local.h"
 
+#include <crypto/asn1.h>
+
 ASN1_SEQUENCE(TS_MSG_IMPRINT) = {
     ASN1_SIMPLE(TS_MSG_IMPRINT, hash_algo, X509_ALGOR),
     ASN1_SIMPLE(TS_MSG_IMPRINT, hashed_msg, ASN1_OCTET_STRING)

diff --git a/crypto/ts/ts_rsp_sign.c b/crypto/ts/ts_rsp_sign.c
index cdd8f4d40165de15c46a8a70cade3d4f6313abe1..3e187d61d5d3467572bd1e9bc4aba3aa69c48648 100644 (file)
--- a/crypto/ts/ts_rsp_sign.c
+++ b/crypto/ts/ts_rsp_sign.c
@@ -19,6 +19,8 @@
 #include "crypto/ess.h"
 #include "ts_local.h"
 
+#include <crypto/asn1.h>
+
 DEFINE_STACK_OF_CONST(EVP_MD)
 
 static ASN1_INTEGER *def_serial_cb(struct TS_resp_ctx *, void *);

diff --git a/crypto/ts/ts_rsp_verify.c b/crypto/ts/ts_rsp_verify.c
index 1b12cc715c91b53b93d7885943af57d31271daee..eefa8572827d84e6ad8a3a2149749b52e120c7a5 100644 (file)
--- a/crypto/ts/ts_rsp_verify.c
+++ b/crypto/ts/ts_rsp_verify.c
@@ -16,6 +16,8 @@
 #include "crypto/ess.h"
 #include "ts_local.h"
 
+#include <crypto/asn1.h>
+
 static int ts_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted,
     X509 *signer, STACK_OF(X509) **chain);
 static int ts_check_signing_certs(const PKCS7_SIGNER_INFO *si,

diff --git a/crypto/x509/by_file.c b/crypto/x509/by_file.c
index 5c99557649ec7daac1f703680cd1a65f036e7549..724fcc1f5b11e4695b55a2ff58ac7522119dd341 100644 (file)
--- a/crypto/x509/by_file.c
+++ b/crypto/x509/by_file.c
@@ -17,6 +17,8 @@
 #include <openssl/pem.h>
 #include "x509_local.h"
 
+#include <crypto/asn1.h>
+
 static int by_file_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc,
     long argl, char **ret);
 static int by_file_ctrl_ex(X509_LOOKUP *ctx, int cmd, const char *argc,

diff --git a/crypto/x509/t_acert.c b/crypto/x509/t_acert.c
index 2a79940e9daa45cea0c90238c49c84567095bb76..90886309cf4dd3eb9a4f9e97ee5fe6e1271653a8 100644 (file)
--- a/crypto/x509/t_acert.c
+++ b/crypto/x509/t_acert.c
@@ -14,6 +14,8 @@
 #include <openssl/objects.h>
 #include <openssl/x509_acert.h>
 
+#include <crypto/asn1.h>
+
 static int print_attribute(BIO *bp, X509_ATTRIBUTE *a)
 {
     const ASN1_OBJECT *aobj;

diff --git a/crypto/x509/t_req.c b/crypto/x509/t_req.c
index 418a6eb4accdde5d7bec9d70f8c91c94a8559436..f8704e5d285a542608004f3da54efa78b0bbd9f7 100644 (file)
--- a/crypto/x509/t_req.c
+++ b/crypto/x509/t_req.c
@@ -17,6 +17,8 @@
 #include <openssl/rsa.h>
 #include <openssl/dsa.h>
 
+#include <crypto/asn1.h>
+
 #ifndef OPENSSL_NO_STDIO
 int X509_REQ_print_fp(FILE *fp, const X509_REQ *x)
 {

diff --git a/crypto/x509/v3_ac_tgt.c b/crypto/x509/v3_ac_tgt.c
index 05f05553b4a6c48aa11e3ca3964a5e1c9c67bd81..4d8b7fb7b8a2ccb1f37386a63864f06c121f747e 100644 (file)
--- a/crypto/x509/v3_ac_tgt.c
+++ b/crypto/x509/v3_ac_tgt.c
@@ -20,6 +20,8 @@
 #include "crypto/asn1.h"
 #include "crypto/evp.h"
 
+#include <crypto/asn1.h>
+
 static int i2r_ISSUER_SERIAL(X509V3_EXT_METHOD *method,
     OSSL_ISSUER_SERIAL *iss,
     BIO *out, int indent);

diff --git a/crypto/x509/v3_authattid.c b/crypto/x509/v3_authattid.c
index 829593ed6c8a30445aae5123a973ce2fad111c82..897c37c255002dcd2ff3a9dec317674430c539e7 100644 (file)
--- a/crypto/x509/v3_authattid.c
+++ b/crypto/x509/v3_authattid.c
@@ -14,6 +14,8 @@
 #include "crypto/asn1.h"
 #include "ext_dat.h"
 
+#include <crypto/asn1.h>
+
 DECLARE_ASN1_ITEM(OSSL_ISSUER_SERIAL)
 
 ASN1_ITEM_TEMPLATE(OSSL_AUTHORITY_ATTRIBUTE_ID_SYNTAX) = ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_AUTHORITY_ATTRIBUTE_ID_SYNTAX, OSSL_ISSUER_SERIAL)

diff --git a/crypto/x509/v3_battcons.c b/crypto/x509/v3_battcons.c
index 3d030664027af927f70b34d39aa0d21652698171..15c8b3a608be146b5bfad19d01dc8d1624f20b50 100644 (file)
--- a/crypto/x509/v3_battcons.c
+++ b/crypto/x509/v3_battcons.c
@@ -14,6 +14,8 @@
 #include "x509_local.h"
 #include "ext_dat.h"
 
+#include <crypto/asn1.h>
+
 static STACK_OF(CONF_VALUE) *i2v_OSSL_BASIC_ATTR_CONSTRAINTS(
     X509V3_EXT_METHOD *method,
     OSSL_BASIC_ATTR_CONSTRAINTS *battcons,

diff --git a/crypto/x509/v3_bcons.c b/crypto/x509/v3_bcons.c
index b909966f024dffea7f1de38a36399157e4deee82..563fc09f825a804128062fce2e7d1735ff91858d 100644 (file)
--- a/crypto/x509/v3_bcons.c
+++ b/crypto/x509/v3_bcons.c
@@ -16,6 +16,8 @@
 #include "ext_dat.h"
 #include "x509_local.h"
 
+#include <crypto/asn1.h>
+
 static STACK_OF(CONF_VALUE) *i2v_BASIC_CONSTRAINTS(X509V3_EXT_METHOD *method,
     BASIC_CONSTRAINTS *bcons,
     STACK_OF(CONF_VALUE)

diff --git a/crypto/x509/v3_cpols.c b/crypto/x509/v3_cpols.c
index 9d95a91240bad3d302d16e4aa666582b459cce23..99cbc8cab6743f678db9f5b240a6d6ed2459d610 100644 (file)
--- a/crypto/x509/v3_cpols.c
+++ b/crypto/x509/v3_cpols.c
@@ -18,6 +18,8 @@
 #include "pcy_local.h"
 #include "ext_dat.h"
 
+#include <crypto/asn1.h>
+
 /* Certificate policies extension support: this one is a bit complex... */
 
 static int i2r_certpol(X509V3_EXT_METHOD *method, STACK_OF(POLICYINFO) *pol,

diff --git a/crypto/x509/v3_ia5.c b/crypto/x509/v3_ia5.c
index 6dbf627a1d2654d5e7724f880164c230d3510862..07624b085f0690650d1f859513751271c3316af3 100644 (file)
--- a/crypto/x509/v3_ia5.c
+++ b/crypto/x509/v3_ia5.c
@@ -14,6 +14,8 @@
 #include <openssl/x509v3.h>
 #include "ext_dat.h"
 
+#include <crypto/asn1.h>
+
 const X509V3_EXT_METHOD ossl_v3_ns_ia5_list[8] = {
     EXT_IA5STRING(NID_netscape_base_url),
     EXT_IA5STRING(NID_netscape_revocation_url),

diff --git a/crypto/x509/v3_ist.c b/crypto/x509/v3_ist.c
index 345142464f6da1ece1ee67dad44e158e3ce01f4d..39dffcd30fb02b08d096dfd551378bcfd0e63e58 100644 (file)
--- a/crypto/x509/v3_ist.c
+++ b/crypto/x509/v3_ist.c
@@ -15,6 +15,8 @@
 #include <openssl/x509v3.h>
 #include "ext_dat.h"
 
+#include <crypto/asn1.h>
+
 /*
  * Issuer Sign Tool (1.2.643.100.112) The name of the tool used to signs the subject (ASN1_SEQUENCE)
  * This extension is required to obtain the status of a qualified certificate at Russian Federation.

diff --git a/crypto/x509/v3_pci.c b/crypto/x509/v3_pci.c
index 7d0a5faf4b4317132d449f1fa23d617119432b3c..b89994cab5c0d5cdff852d78bd705996e0282e3f 100644 (file)
--- a/crypto/x509/v3_pci.c
+++ b/crypto/x509/v3_pci.c
@@ -49,6 +49,8 @@
 #include <openssl/x509v3.h>
 #include "ext_dat.h"
 
+#include <crypto/asn1.h>
+
 static int i2r_pci(X509V3_EXT_METHOD *method, PROXY_CERT_INFO_EXTENSION *ext,
     BIO *out, int indent);
 static PROXY_CERT_INFO_EXTENSION *r2i_pci(X509V3_EXT_METHOD *method,

diff --git a/crypto/x509/v3_usernotice.c b/crypto/x509/v3_usernotice.c
index 9bf1502f75897fffa217927fc32eff453d11710a..1835475a225b395232fd46b789c03d58999861bd 100644 (file)
--- a/crypto/x509/v3_usernotice.c
+++ b/crypto/x509/v3_usernotice.c
@@ -11,6 +11,8 @@
 #include <openssl/x509v3.h>
 #include "ext_dat.h"
 
+#include <crypto/asn1.h>
+
 ASN1_ITEM_TEMPLATE(OSSL_USER_NOTICE_SYNTAX) = ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, OSSL_USER_NOTICE_SYNTAX, USERNOTICE)
 ASN1_ITEM_TEMPLATE_END(OSSL_USER_NOTICE_SYNTAX)
 

diff --git a/crypto/x509/v3_utf8.c b/crypto/x509/v3_utf8.c
index e9aaedab8138600a4f187ae1ca6e46895b1328bf..149169e393a983ec64d396e00166ae16a94b62e6 100644 (file)
--- a/crypto/x509/v3_utf8.c
+++ b/crypto/x509/v3_utf8.c
@@ -14,6 +14,8 @@
 #include <openssl/x509v3.h>
 #include "ext_dat.h"
 
+#include <crypto/asn1.h>
+
 /*
  * Subject Sign Tool (1.2.643.100.111) The name of the tool used to signs the subject (UTF8String)
  * This extension is required to obtain the status of a qualified certificate at Russian Federation.

diff --git a/crypto/x509/x509_local.h b/crypto/x509/x509_local.h
index a2c3a6ca8616bdec160b9378ee815b72f61e0a0d..ec6264e788a63c69499a90a5e35cafb8eca67967 100644 (file)
--- a/crypto/x509/x509_local.h
+++ b/crypto/x509/x509_local.h
@@ -11,6 +11,8 @@
 #include "internal/refcount.h"
 #include "internal/hashtable.h"
 
+#include <crypto/asn1.h>
+
 #define X509V3_conf_add_error_name_value(val) \
     ERR_add_error_data(4, "name=", (val)->name, ", value=", (val)->value)
 

diff --git a/crypto/x509/x509_meth.c b/crypto/x509/x509_meth.c
index e7b228a33f3390ba9a3ab715e44245e9ccf07164..0a00b789c44724ddb3ba7b99a28e1be4b8469619 100644 (file)
--- a/crypto/x509/x509_meth.c
+++ b/crypto/x509/x509_meth.c
@@ -17,6 +17,8 @@
 #include <openssl/types.h>
 #include "x509_local.h"
 
+#include <crypto/asn1.h>
+
 X509_LOOKUP_METHOD *X509_LOOKUP_meth_new(const char *name)
 {
     X509_LOOKUP_METHOD *method = OPENSSL_zalloc(sizeof(X509_LOOKUP_METHOD));

diff --git a/crypto/x509/x509_v3.c b/crypto/x509/x509_v3.c
index fe4229e61f53a25dc5fd28f03a0d4a3a17cf9f47..b24950b570ba46df57a66ebcabbcae8914b80d04 100644 (file)
--- a/crypto/x509/x509_v3.c
+++ b/crypto/x509/x509_v3.c
@@ -17,6 +17,8 @@
 #include <openssl/x509v3.h>
 #include "x509_local.h"
 
+#include <crypto/asn1.h>
+
 int X509v3_get_ext_count(const STACK_OF(X509_EXTENSION) *x)
 {
     int ret;

diff --git a/crypto/x509/x509aset.c b/crypto/x509/x509aset.c
index 03afc4ae566dee328821cb6ba37e2c1f32b38a76..b9d059a4e233040ed7e0ebe91f148d1860528862 100644 (file)
--- a/crypto/x509/x509aset.c
+++ b/crypto/x509/x509aset.c
@@ -12,6 +12,8 @@
 #include <openssl/x509v3.h>
 #include "x509_acert.h"
 
+#include <crypto/asn1.h>
+
 static int replace_gentime(ASN1_STRING **dest, const ASN1_GENERALIZEDTIME *src)
 {
     ASN1_STRING *s;

diff --git a/crypto/x509/x_attrib.c b/crypto/x509/x_attrib.c
index f4c225a8ff2be1fa61c0c3c0506fd098d2d229d7..d4babd9ec690ed715ee4fc66e66fa3d03d8b11ae 100644 (file)
--- a/crypto/x509/x_attrib.c
+++ b/crypto/x509/x_attrib.c
@@ -15,6 +15,8 @@
 #include "x509_local.h"
 #include <crypto/x509.h>
 
+#include <crypto/asn1.h>
+
 /*-
  * X509_ATTRIBUTE: this has the following form:
  *

diff --git a/crypto/x509/x_exten.c b/crypto/x509/x_exten.c
index 51b268433dff66f283d83e74df033c13891d2d15..7135013e0c02d13c47019f1bb5274ade3ff6d7ce 100644 (file)
--- a/crypto/x509/x_exten.c
+++ b/crypto/x509/x_exten.c
@@ -13,6 +13,8 @@
 #include <openssl/asn1t.h>
 #include "x509_local.h"
 
+#include <crypto/asn1.h>
+
 ASN1_SEQUENCE(X509_EXTENSION) = {
     ASN1_SIMPLE(X509_EXTENSION, object, ASN1_OBJECT),
     ASN1_OPT(X509_EXTENSION, critical, ASN1_FBOOLEAN),

diff --git a/doc/man7/ossl-guide-migration.pod b/doc/man7/ossl-guide-migration.pod
index ffaf31abee33fcd386e48c25605a676fea5f8f69..247fc0d36c3cca9f4d4dcfb377cebea6edc51dbb 100644 (file)
--- a/doc/man7/ossl-guide-migration.pod
+++ b/doc/man7/ossl-guide-migration.pod
@@ -37,6 +37,15 @@ features available in OpenSSL 4.0.
 Some functions have been removed that were deprecated in previous
 versions of OpenSSL. See L<ossl-removed-api(7)>.
 
+The ASN1_STRING type has been made opaque.  Accessors for the needed
+values from this type have been present since OpenSSL 1.1, Code
+which directly attempts to access internals of ASN1_STRING should be
+converted to use the accessors. The ASN1_FLAGS have also been made
+private, most of which were purely internal. ASN1_STRING_FLAG_BITS_LEFT,
+which used to be exposed to allow manipulating the internal representation
+of a bit string should be replaced by using the appropriate setter for
+an ASN1_BIT_STRING type, instead of direct flag and structure manipulation.
+
 =head2 Upgrading from OpenSSL 3.x
 
 =head3 Removal of atexit() usage

diff --git a/include/crypto/asn1.h b/include/crypto/asn1.h
index 558764869c64493f237e0c652c8f80be1f847ecf..4364532e65e73f2e00fb0554a4eccc5e216d86a1 100644 (file)
--- a/include/crypto/asn1.h
+++ b/include/crypto/asn1.h
@@ -20,6 +20,42 @@
 
 #include <openssl/core.h>
 
+#define ASN1_STRING_FLAG_BITS_LEFT 0x08 /* Set if 0x07 has bits left value */
+/*
+ * This indicates that the ASN1_STRING is not a real value but just a place
+ * holder for the location where indefinite length constructed data should be
+ * inserted in the memory buffer
+ */
+#define ASN1_STRING_FLAG_NDEF 0x010
+
+/*
+ * This flag is used by the CMS code to indicate that a string is not
+ * complete and is a place holder for content when it had all been accessed.
+ * The flag will be reset when content has been written to it.
+ */
+
+#define ASN1_STRING_FLAG_CONT 0x020
+/*
+ * This flag is used by ASN1 code to indicate an ASN1_STRING is an MSTRING
+ * type.
+ */
+#define ASN1_STRING_FLAG_MSTRING 0x040
+/* String is embedded and only content should be freed */
+#define ASN1_STRING_FLAG_EMBED 0x080
+
+/* This is the base type that holds just about everything :-) */
+struct asn1_string_st {
+    int length;
+    int type;
+    unsigned char *data;
+    /*
+     * The value of the following field depends on the type being held.  It
+     * is mostly being used for BIT_STRING so if the input data has a
+     * non-zero 'unused bits' value, it will be handled correctly
+     */
+    long flags;
+};
+
 struct evp_pkey_asn1_method_st {
     int pkey_id;
     int pkey_base_id;

diff --git a/include/crypto/x509.h b/include/crypto/x509.h
index a2f3a24391376a1a91b39089a53df9f5d31b2ad2..bdab2d96d0bad1169da23c0f2a7d20679aedaebd 100644 (file)
--- a/include/crypto/x509.h
+++ b/include/crypto/x509.h
@@ -17,6 +17,8 @@
 #include <openssl/conf.h>
 #include "crypto/types.h"
 
+#include <crypto/asn1.h>
+
 /* Internal X509 structures and functions: not for application use */
 
 /* Note: unless otherwise stated a field pointer is mandatory and should

diff --git a/include/crypto/x509_acert.h b/include/crypto/x509_acert.h
index 083133c8e347322c730680618dd15f4c34c6e34b..e2bc8fbb2ac1e630e2dc07b5b13e3ea8907341a2 100644 (file)
--- a/include/crypto/x509_acert.h
+++ b/include/crypto/x509_acert.h
@@ -13,6 +13,8 @@
 
 #include <openssl/x509_acert.h>
 
+#include <crypto/asn1.h>
+
 #define OSSL_ODI_TYPE_PUBLIC_KEY 0
 #define OSSL_ODI_TYPE_PUBLIC_KEY_CERT 1
 #define OSSL_ODI_TYPE_OTHER 2

diff --git a/include/openssl/asn1.h.in b/include/openssl/asn1.h.in
index 7f792db610f6b2c190bee74dac2710f5680e77ed..e7e2a0097bd2bab61716cbaf732b2eb9d2f1264a 100644 (file)
--- a/include/openssl/asn1.h.in
+++ b/include/openssl/asn1.h.in
@@ -138,40 +138,8 @@ extern "C" {
 -}
 /* clang-format on */
 
-#define ASN1_STRING_FLAG_BITS_LEFT 0x08 /* Set if 0x07 has bits left value */
-/*
- * This indicates that the ASN1_STRING is not a real value but just a place
- * holder for the location where indefinite length constructed data should be
- * inserted in the memory buffer
- */
-#define ASN1_STRING_FLAG_NDEF 0x010
-
-/*
- * This flag is used by the CMS code to indicate that a string is not
- * complete and is a place holder for content when it had all been accessed.
- * The flag will be reset when content has been written to it.
- */
-
-#define ASN1_STRING_FLAG_CONT 0x020
-/*
- * This flag is used by ASN1 code to indicate an ASN1_STRING is an MSTRING
- * type.
- */
-#define ASN1_STRING_FLAG_MSTRING 0x040
-/* String is embedded and only content should be freed */
-#define ASN1_STRING_FLAG_EMBED 0x080
 /* This is the base type that holds just about everything :-) */
-struct asn1_string_st {
-    int length;
-    int type;
-    unsigned char *data;
-    /*
-     * The value of the following field depends on the type being held.  It
-     * is mostly being used for BIT_STRING so if the input data has a
-     * non-zero 'unused bits' value, it will be handled correctly
-     */
-    long flags;
-};
+struct asn1_string_st;
 
 /*
  * ASN1_ENCODING structure: this is used to save the received encoding of an

diff --git a/providers/implementations/encode_decode/decode_epki2pki.c b/providers/implementations/encode_decode/decode_epki2pki.c
index 94b9adb52d13263369970a7f2bbdc76563184c8a..cbc74810beb6f9e9090103217a0c0a13970c9f50 100644 (file)
--- a/providers/implementations/encode_decode/decode_epki2pki.c
+++ b/providers/implementations/encode_decode/decode_epki2pki.c
@@ -26,6 +26,8 @@
 #include "prov/endecoder_local.h"
 #include "providers/implementations/encode_decode/decode_epki2pki.inc"
 
+#include <crypto/asn1.h>
+
 static OSSL_FUNC_decoder_newctx_fn epki2pki_newctx;
 static OSSL_FUNC_decoder_freectx_fn epki2pki_freectx;
 static OSSL_FUNC_decoder_decode_fn epki2pki_decode;

diff --git a/providers/implementations/encode_decode/encode_key2any.c b/providers/implementations/encode_decode/encode_key2any.c
index 963c223cb382d6337505c1f6a966a536a33dff40..b4deb9b59bcbb0e15480ef3f788f572656828d43 100644 (file)
--- a/providers/implementations/encode_decode/encode_key2any.c
+++ b/providers/implementations/encode_decode/encode_key2any.c
@@ -43,6 +43,8 @@
 #include "prov/ml_kem_codecs.h"
 #include "providers/implementations/encode_decode/encode_key2any.inc"
 
+#include <crypto/asn1.h>
+
 #if defined(OPENSSL_NO_DH) && defined(OPENSSL_NO_DSA) && defined(OPENSSL_NO_EC)
 #define OPENSSL_NO_KEYPARAMS
 #endif

diff --git a/ssl/ssl_asn1.c b/ssl/ssl_asn1.c
index e74ae71b7a12e07e8a058ee0dcf8b627e34391b2..ec377ab895db86beb87ac953b037e26559116f88 100644 (file)
--- a/ssl/ssl_asn1.c
+++ b/ssl/ssl_asn1.c
@@ -15,6 +15,8 @@
 #include <openssl/encoder.h>
 #include <openssl/x509.h>
 
+#include <crypto/asn1.h>
+
 typedef struct {
     uint32_t version;
     int32_t ssl_version;

diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c
index 2f458cdf88b94a30dd3c117ccfbaffb645f414e4..74bd78a859c60a2cece7a7bf2a387487cbbfc1bd 100644 (file)
--- a/ssl/statem/statem_srvr.c
+++ b/ssl/statem/statem_srvr.c
@@ -3589,8 +3589,8 @@ static int tls_process_cke_gost(SSL_CONNECTION *s, PACKET *pkt)
         goto err;
     }
 
-    inlen = pKX->kxBlob->value.sequence->length;
-    start = pKX->kxBlob->value.sequence->data;
+    inlen = ASN1_STRING_length(pKX->kxBlob->value.sequence);
+    start = ASN1_STRING_get0_data(pKX->kxBlob->value.sequence);
 
     if (EVP_PKEY_decrypt(pkey_ctx, premaster_secret, &outlen, start,
             inlen)

diff --git a/test/helpers/pkcs12.c b/test/helpers/pkcs12.c
index b9769960173fc5829543f31236dc672b40463765..acd2c9b827a80719d901d49f63bba3be11b83a5e 100644 (file)
--- a/test/helpers/pkcs12.c
+++ b/test/helpers/pkcs12.c
@@ -467,22 +467,22 @@ static int check_asn1_string(const ASN1_TYPE *av, const char *txt)
 
     switch (av->type) {
     case V_ASN1_BMPSTRING:
-        value = OPENSSL_uni2asc(av->value.bmpstring->data,
-            av->value.bmpstring->length);
+        value = OPENSSL_uni2asc(ASN1_STRING_get0_data(av->value.bmpstring),
+            ASN1_STRING_length(av->value.bmpstring));
         if (!TEST_str_eq(txt, (char *)value))
             goto err;
         break;
 
     case V_ASN1_UTF8STRING:
-        if (!TEST_mem_eq(txt, strlen(txt), (char *)av->value.utf8string->data,
-                av->value.utf8string->length))
+        if (!TEST_mem_eq(txt, strlen(txt), ASN1_STRING_get0_data(av->value.utf8string),
+                ASN1_STRING_length(av->value.utf8string)))
             goto err;
         break;
 
     case V_ASN1_OCTET_STRING:
         if (!TEST_mem_eq(txt, strlen(txt),
-                (char *)av->value.octet_string->data,
-                av->value.octet_string->length))
+                (char *)ASN1_STRING_get0_data(av->value.octet_string),
+                ASN1_STRING_length(av->value.octet_string)))
             goto err;
         break;
 

diff --git a/test/time_offset_test.c b/test/time_offset_test.c
index ebfbffff935eba0db712aeaccc8af862e40ed5b9..f2ee9253942afc793b43df66072b4e77f8c8cfa6 100644 (file)
--- a/test/time_offset_test.c
+++ b/test/time_offset_test.c
@@ -18,6 +18,8 @@
 #include "testutil.h"
 #include "internal/nelem.h"
 
+#include <crypto/asn1.h>
+
 typedef struct {
     const char *data;
     int time_result;

diff --git a/test/tls-provider.c b/test/tls-provider.c
index 5b4017543fd050ca435c4d9ff7b4b0d395b46aa7..a97c6a4e7f85e6043f489875bc0e013806ec388e 100644 (file)
--- a/test/tls-provider.c
+++ b/test/tls-provider.c
@@ -26,6 +26,8 @@
 #include "internal/nelem.h"
 #include "internal/refcount.h"
 
+#include <crypto/asn1.h>
+
 /* error codes */
 
 /* xorprovider error codes */

diff --git a/test/v3ext.c b/test/v3ext.c
index fc43cb533a1f5f6f6038fac13d470b177d5ec8b0..382c0b9ca28ad9a7c0060ea01ba97aa1f02ea044 100644 (file)
--- a/test/v3ext.c
+++ b/test/v3ext.c
@@ -17,6 +17,8 @@
 
 #include "testutil.h"
 
+#include <crypto/asn1.h>
+
 static const char *infile;
 
 static int test_pathlen(void)

diff --git a/test/x509_time_test.c b/test/x509_time_test.c
index 4737876de478d1a69be4ab4a909e9ef3d4b1c528..475505bb1831e90c97d6f5f36ca96cab497509f0 100644 (file)
--- a/test/x509_time_test.c
+++ b/test/x509_time_test.c
@@ -17,6 +17,8 @@
 #include "testutil.h"
 #include "internal/nelem.h"
 
+#include <crypto/asn1.h>
+
 typedef struct {
     const char *data;
     int type;