Bitrot: More OpenSSL 1.1.0 API constification

The accessors for ASN1_STRING and X509 before/after dates have new
names and now return const data.  Deal with the fallout.

diff --git a/postfix/src/tls/tls.h b/postfix/src/tls/tls.h
index a6b890d0e82828f167413bfd0509ad3771c70f2a..7d521939a38302369c07674db01cffe9a99db161 100644 (file)
--- a/postfix/src/tls/tls.h
+++ b/postfix/src/tls/tls.h
@@ -96,6 +96,9 @@ extern const NAME_CODE tls_level_table[];
 #define X509_STORE_CTX_get0_untrusted(ctx) ((ctx)->untrusted)
 #define X509_STORE_CTX_set0_untrusted X509_STORE_CTX_set_chain
 #define X509_STORE_CTX_set0_trusted_stack X509_STORE_CTX_trusted_stack
+#define ASN1_STRING_get0_data ASN1_STRING_data
+#define X509_getm_notBefore X509_get_notBefore
+#define X509_getm_notAfter X509_get_notAfter
 #endif
 
 /* SSL_CIPHER_get_name() got constified in 0.9.7g */

diff --git a/postfix/src/tls/tls_dane.c b/postfix/src/tls/tls_dane.c
index 9f8821c7dc9e226ba8dcbe6b5d24289d41803438..4308108a48a58ba4870f6129a58380b6ef4f10f5 100644 (file)
--- a/postfix/src/tls/tls_dane.c
+++ b/postfix/src/tls/tls_dane.c
@@ -1465,7 +1465,7 @@ static int add_akid(X509 *cert, AUTHORITY_KEYID *akid)
      * self-signature checks!
      */
     id = ((akid && akid->keyid) ? akid->keyid : 0);
-    if (id && ASN1_STRING_length(id) == 1 && *ASN1_STRING_data(id) == c)
+    if (id && ASN1_STRING_length(id) == 1 && *ASN1_STRING_get0_data(id) == c)
        c = 1;
 
     if ((akid = AUTHORITY_KEYID_new()) != 0
@@ -1583,10 +1583,10 @@ static void wrap_key(TLS_SESS_STATE *TLScontext, int depth,
      */
     if (!X509_set_version(cert, 2)
        || !set_serial(cert, akid, subject)
-       || !X509_set_subject_name(cert, name)
        || !set_issuer_name(cert, akid)
-       || !X509_gmtime_adj(X509_get_notBefore(cert), -30 * 86400L)
-       || !X509_gmtime_adj(X509_get_notAfter(cert), 30 * 86400L)
+       || !X509_gmtime_adj(X509_getm_notBefore(cert), -30 * 86400L)
+       || !X509_gmtime_adj(X509_getm_notAfter(cert), 30 * 86400L)
+       || !X509_set_subject_name(cert, name)
        || !X509_set_pubkey(cert, key ? key : signkey)
        || !add_ext(0, cert, NID_basic_constraints, "CA:TRUE")
        || (key && !add_akid(cert, akid))

diff --git a/postfix/src/tls/tls_verify.c b/postfix/src/tls/tls_verify.c
index 42bfc1033a96ad5095a8ea0326d3a245d6b35c2f..87af0c6f7d87e98db9019a87bae43a2865e70b33 100644 (file)
--- a/postfix/src/tls/tls_verify.c
+++ b/postfix/src/tls/tls_verify.c
@@ -440,7 +440,7 @@ const char *tls_dns_name(const GENERAL_NAME * gn,
     /*
      * Safe to treat as an ASCII string possibly holding a DNS name
      */
-    dnsname = (char *) ASN1_STRING_data(gn->d.ia5);
+    dnsname = (const char *) ASN1_STRING_get0_data(gn->d.ia5);
     len = ASN1_STRING_length(gn->d.ia5);
     TRIM0(dnsname, len);