From: Bob Beck <beck@openssl.org>
Date: Sat, 21 Feb 2026 20:44:17 +0000 (-0700)
Subject: Constify X509_check[host, email, ip, ip_asc]
X-Git-Tag: openssl-4.0.0-alpha1~145
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ce7733175050a99ddb5d627496bcf79cd50f9840;p=thirdparty%2Fopenssl.git

Constify X509_check[host, email, ip, ip_asc]

For #30052
For #30095

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Feb 24 19:32:57 2026
(Merged from https://github.com/openssl/openssl/pull/30127)
---

diff --git a/crypto/x509/v3_utl.c b/crypto/x509/v3_utl.c
index ff17565317c..0cb4279295c 100644
--- a/crypto/x509/v3_utl.c
+++ b/crypto/x509/v3_utl.c
@@ -866,7 +866,7 @@ static int do_check_string(const ASN1_STRING *a, int cmp_type, equal_fn equal,
     return rv;
 }
 
-static int do_x509_check(X509 *x, const char *chk, size_t chklen,
+static int do_x509_check(const X509 *x, const char *chk, size_t chklen,
     unsigned int flags, int check_type, int othername_nid, char **peername)
 {
     GENERAL_NAMES *gens = NULL;
@@ -1001,7 +1001,7 @@ static int do_x509_check(X509 *x, const char *chk, size_t chklen,
     return 0;
 }
 
-int X509_check_host(X509 *x, const char *chk, size_t chklen,
+int X509_check_host(const X509 *x, const char *chk, size_t chklen,
     unsigned int flags, char **peername)
 {
     if (chk == NULL)
@@ -1034,7 +1034,7 @@ int ossl_x509_check_smtputf8(X509 *x, const char *chk, size_t chklen,
         == 1;
 }
 
-int X509_check_email(X509 *x, const char *chk, size_t chklen,
+int X509_check_email(const X509 *x, const char *chk, size_t chklen,
     unsigned int flags)
 {
     if (chk == NULL)
@@ -1060,7 +1060,7 @@ int X509_check_email(X509 *x, const char *chk, size_t chklen,
         NID_id_on_SmtpUTF8Mailbox, NULL);
 }
 
-int X509_check_ip(X509 *x, const unsigned char *chk, size_t chklen,
+int X509_check_ip(const X509 *x, const unsigned char *chk, size_t chklen,
     unsigned int flags)
 {
     if (chk == NULL)
@@ -1068,7 +1068,7 @@ int X509_check_ip(X509 *x, const unsigned char *chk, size_t chklen,
     return do_x509_check(x, (char *)chk, chklen, flags, GEN_IPADD, 0, NULL);
 }
 
-int X509_check_ip_asc(X509 *x, const char *ipasc, unsigned int flags)
+int X509_check_ip_asc(const X509 *x, const char *ipasc, unsigned int flags)
 {
     unsigned char ipout[16];
     size_t iplen;
diff --git a/doc/man3/X509_check_host.pod b/doc/man3/X509_check_host.pod
index 0156194c991..242ca8d8cfe 100644
--- a/doc/man3/X509_check_host.pod
+++ b/doc/man3/X509_check_host.pod
@@ -8,13 +8,13 @@ X509_check_host, X509_check_email, X509_check_ip, X509_check_ip_asc - X.509 cert
 
  #include <openssl/x509v3.h>
 
- int X509_check_host(X509 *, const char *name, size_t namelen,
+ int X509_check_host(const X509 *, const char *name, size_t namelen,
                      unsigned int flags, char **peername);
- int X509_check_email(X509 *, const char *address, size_t addresslen,
+ int X509_check_email(const X509 *, const char *address, size_t addresslen,
                       unsigned int flags);
- int X509_check_ip(X509 *, const unsigned char *address, size_t addresslen,
+ int X509_check_ip(const X509 *, const unsigned char *address, size_t addresslen,
                    unsigned int flags);
- int X509_check_ip_asc(X509 *, const char *address, unsigned int flags);
+ int X509_check_ip_asc(const X509 *, const char *address, unsigned int flags);
 
 =head1 DESCRIPTION
 
diff --git a/include/openssl/x509v3.h.in b/include/openssl/x509v3.h.in
index d2d9ccb991e..ca1d0a7b4d9 100644
--- a/include/openssl/x509v3.h.in
+++ b/include/openssl/x509v3.h.in
@@ -805,13 +805,13 @@ STACK_OF(OPENSSL_STRING) *X509_get1_ocsp(const X509 *x);
  */
 #define _X509_CHECK_FLAG_DOT_SUBDOMAINS 0x8000
 
-int X509_check_host(X509 *x, const char *chk, size_t chklen,
+int X509_check_host(const X509 *x, const char *chk, size_t chklen,
     unsigned int flags, char **peername);
-int X509_check_email(X509 *x, const char *chk, size_t chklen,
+int X509_check_email(const X509 *x, const char *chk, size_t chklen,
     unsigned int flags);
-int X509_check_ip(X509 *x, const unsigned char *chk, size_t chklen,
+int X509_check_ip(const X509 *x, const unsigned char *chk, size_t chklen,
     unsigned int flags);
-int X509_check_ip_asc(X509 *x, const char *ipasc, unsigned int flags);
+int X509_check_ip_asc(const X509 *x, const char *ipasc, unsigned int flags);
 
 ASN1_OCTET_STRING *a2i_IPADDRESS(const char *ipasc);
 ASN1_OCTET_STRING *a2i_IPADDRESS_NC(const char *ipasc);