[Fix] mime: fix build with OpenSSL 4.0 opaque ASN1_STRING

OpenSSL 4.0 made ASN1_STRING (and thus ASN1_OCTET_STRING) opaque, so
direct access to its length/data fields no longer compiles. Use
ASN1_STRING_length()/ASN1_STRING_get0_data() which are available since
OpenSSL 1.1.0 and LibreSSL 2.7.

Also move the legacy OpenSSL init calls (ERR_load_crypto_strings,
SSL_load_error_strings, OpenSSL_add_all_*) under the pre-1.1.0 guard:
they are redundant on modern OpenSSL and break no-deprecated builds.

Fixes: #6087

diff --git a/src/libmime/mime_parser.c b/src/libmime/mime_parser.c
index 567acc7b1058c892bf6f770f66b7fca563a599cd..7b2ec9d3ced1195fc9bca91da62c12a0aa29eec3 100644 (file)
--- a/src/libmime/mime_parser.c
+++ b/src/libmime/mime_parser.c
@@ -889,22 +889,24 @@ rspamd_mime_parse_normal_part(struct rspamd_task *task,
 
                                                ct_nid = OBJ_obj2nid(p7_signed_content->type);
 
+                                               /* ASN1_STRING is opaque since OpenSSL 4.0, use accessors */
                                                if (ct_nid == NID_pkcs7_data && p7_signed_content->d.data &&
-                                                       p7_signed_content->d.data->length > 0 &&
-                                                       p7_signed_content->d.data->data) {
+                                                       ASN1_STRING_length(p7_signed_content->d.data) > 0 &&
+                                                       ASN1_STRING_get0_data(p7_signed_content->d.data)) {
                                                        int ret;
+                                                       int p7_data_len = ASN1_STRING_length(p7_signed_content->d.data);
+                                                       const unsigned char *p7_data = ASN1_STRING_get0_data(p7_signed_content->d.data);
 
                                                        msg_debug_mime("found an additional part inside of "
                                                                                   "smime structure of type %T/%T; length=%d",
-                                                                                  &ct->type, &ct->subtype, p7_signed_content->d.data->length);
+                                                                                  &ct->type, &ct->subtype, p7_data_len);
                                                        /*
                                                         * Since ASN.1 structures are freed, we need to copy
                                                         * the content
                                                         */
                                                        char *cpy = rspamd_mempool_alloc(task->task_pool,
-                                                                                                                        p7_signed_content->d.data->length);
-                                                       memcpy(cpy, p7_signed_content->d.data->data,
-                                                                  p7_signed_content->d.data->length);
+                                                                                                                        p7_data_len);
+                                                       memcpy(cpy, p7_data, p7_data_len);
 
                                                        /*
                                                         * S/MIME re-enters the parser here without going through
@@ -924,7 +926,7 @@ rspamd_mime_parse_normal_part(struct rspamd_task *task,
                                                        st->nesting++;
                                                        ret = rspamd_mime_process_multipart_node(task,
                                                                                                                                         st, NULL,
-                                                                                                                                        cpy, cpy + p7_signed_content->d.data->length,
+                                                                                                                                        cpy, cpy + p7_data_len,
                                                                                                                                         TRUE, err);
                                                        st->nesting--;
 

diff --git a/src/libserver/ssl_util.c b/src/libserver/ssl_util.c
index af2b360ac49f5cabd28d5d0edac9fd039aca380f..905a6cc9cefb29f2ccc2dfa4205682ba5a4ff256 100644 (file)
--- a/src/libserver/ssl_util.c
+++ b/src/libserver/ssl_util.c
@@ -1224,12 +1224,14 @@ void rspamd_openssl_maybe_init(struct rspamd_external_libs_ctx *ctx)
        static gboolean openssl_initialized = FALSE;
 
        if (!openssl_initialized) {
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
                ERR_load_crypto_strings();
                SSL_load_error_strings();
 
                OpenSSL_add_all_algorithms();
                OpenSSL_add_all_digests();
                OpenSSL_add_all_ciphers();
+#endif
 
 #if OPENSSL_VERSION_NUMBER >= 0x1000104fL && OPENSSL_VERSION_NUMBER < 0x30000000L && !defined(LIBRESSL_VERSION_NUMBER)
                ENGINE_load_builtin_engines();