imap-send: use the OpenSSL API to access the subject common name

The OpenSSL 4.0 master branch has deprecated the
X509_NAME_get_text_by_NID function. Use the recommended replacement APIs
instead. They have existed since OpenSSL v1.1.0.

Take care to get the constness right for pre-4.0 versions.

Signed-off-by: Beat Bolli <dev+git@drbeat.li>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/imap-send.c b/imap-send.c
index 1c934c24877e3fa8d13795294678a81654220f4c..2a904314dd4bfb91e1b0c6126a03a83ea2bc1d85 100644 (file)
--- a/imap-send.c
+++ b/imap-send.c
@@ -233,9 +233,13 @@ static int host_matches(const char *host, const char *pattern)
 
 static int verify_hostname(X509 *cert, const char *hostname)
 {
-       int len;
+#if (OPENSSL_VERSION_NUMBER >= 0x40000000L)
+       const X509_NAME *subj;
+#else
        X509_NAME *subj;
-       char cname[1000];
+#endif
+       const X509_NAME_ENTRY *cname_entry;
+       const ASN1_STRING *cname;
        int i, found;
        STACK_OF(GENERAL_NAME) *subj_alt_names;
 
@@ -262,12 +266,15 @@ static int verify_hostname(X509 *cert, const char *hostname)
        /* try the common name */
        if (!(subj = X509_get_subject_name(cert)))
                return error("cannot get certificate subject");
-       if ((len = X509_NAME_get_text_by_NID(subj, NID_commonName, cname, sizeof(cname))) < 0)
+       if ((i = X509_NAME_get_index_by_NID(subj, NID_commonName, -1)) < 0 ||
+           (cname_entry = X509_NAME_get_entry(subj, i)) == NULL ||
+           (cname = X509_NAME_ENTRY_get_data(cname_entry)) == NULL)
                return error("cannot get certificate common name");
-       if (strlen(cname) == (size_t)len && host_matches(hostname, cname))
+       if (strlen((const char *)ASN1_STRING_get0_data(cname)) == ASN1_STRING_length(cname) &&
+           host_matches(hostname, (const char *)ASN1_STRING_get0_data(cname)))
                return 0;
        return error("certificate owner '%s' does not match hostname '%s'",
-                    cname, hostname);
+                    ASN1_STRING_get0_data(cname), hostname);
 }
 
 static int ssl_socket_connect(struct imap_socket *sock,