]> git.ipfire.org Git - thirdparty/haproxy.git/commit
MEDIUM: ssl: porting to X509_STORE_get1_objects() for OpenSSL 4.0
authorWilliam Lallemand <wlallemand@irq6.net>
Mon, 24 Nov 2025 20:44:46 +0000 (21:44 +0100)
committerWilliam Lallemand <wlallemand@haproxy.com>
Thu, 29 Jan 2026 16:08:41 +0000 (17:08 +0100)
commit23e8ed6ea6668ec79064083c36cecbfbb4d87079
treeea3f432bb48a9b3d75a6ce7a918a3a9f2788e4de
parentfa094d0b619343f61fab877ef65f43b404262dd9
MEDIUM: ssl: porting to X509_STORE_get1_objects() for OpenSSL 4.0

OpenSSL 4.0 is deprecating X509_STORE_get0_objects().

Every occurence of X509_STORE_get0_objects() was first replaced by
X509_STORE_get1_objects().
This changes the ref count of the STACK_OF(X509_OBJECT) everywhere, and
need it to be sk_X509_OBJECT_pop_free(objs, X509_OBJECT_free) each time.

X509_STORE_get1_objects() is not available in AWS-LC, OpenSSL < 3.2,
LibreSSL and WolfSSL, so we need to still be compatible with get0.
To achieve this, 2 macros were added X509_STORE_getX_objects() and
sk_X509_OBJECT_popX_free(), these macros will use either the get0 or the
get1 macro depending on their availability. In the case of get0,
sk_X509_OBJECT_popX_free() will just do nothing instead of trying to
free.

Don't backport that unless really needed if we want to be compatible
with OpenSSL 4.0. It changes all the refcounts.
include/haproxy/openssl-compat.h
src/ssl_ckch.c
src/ssl_sock.c