Skip to content

[2.4.x] Fix OpenSSL 4.0 compat #642

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
notroj wants to merge 8 commits into
base: 2.4.x
Choose a base branch
from
Open

[2.4.x] Fix OpenSSL 4.0 compat #642

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
fc41cec
Fix OpenSSL 4.0 compatibility and test that in CI.
notroj Apr 30, 2026
61e6751
CI: add OpenSSL build binaries to $PATH
notroj Feb 29, 2024
681eec5
CI: test OpenSSL 3.x using Apache::Test trunk to pick up r1916067.
notroj Mar 1, 2024
053a9cc
Part merge of r1915513 to make the travis_run_linux.sh diff to trunk
notroj May 1, 2026
05b0968
Part merge of r1919524 from trunk:
notroj Jul 26, 2024
17f0d60
CI: The OpenSSL no-engine config option is redundant as of 4.0, remove.
notroj May 1, 2026
3eaf20f
Cherry pick from 0c9cd095ce9081fd225f0da7787419e80de7c701
notroj May 1, 2026
05fea04
CI: Try to fix ab failures during OpenSSL ech job, set RPATH via LDFLAGS
notroj Nov 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 52 additions & 0 deletions .github/workflows/linux.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -260,6 +260,58 @@ jobs:
# APR_VERSION=1.7.3
# APU_VERSION=1.6.3
# APU_CONFIG="--with-crypto --with-ldap"
# -------------------------------------------------------------------------
- name: OpenSSL 3.0 LTS
config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
env: |
TEST_OPENSSL3=3.0.18
APR_VERSION=1.7.6
APU_VERSION=1.6.3
APU_CONFIG="--without-crypto"
pkgs: subversion
# -------------------------------------------------------------------------
- name: OpenSSL 3.4 -Werror
config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
notest-cflags: -Werror -O2
env: |
TEST_OPENSSL3=3.4.4
APR_VERSION=1.7.6
APU_VERSION=1.6.3
APU_CONFIG="--without-crypto"
pkgs: subversion
# -------------------------------------------------------------------------
- name: OpenSSL 3.4 no-engine
config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
env: |
TEST_OPENSSL3=3.4.4
OPENSSL_CONFIG=no-engine
APR_VERSION=1.7.6
APU_VERSION=1.6.3
APU_CONFIG="--without-crypto"
pkgs: subversion
# -------------------------------------------------------------------------
- name: OpenSSL 3.5 no-engine -Werror
config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
notest-cflags: -Werror -O2
env: |
TEST_OPENSSL3=3.5.5
OPENSSL_CONFIG=no-engine
APR_VERSION=1.7.6
APU_VERSION=1.6.3
APU_CONFIG="--without-crypto"
pkgs: subversion
# -------------------------------------------------------------------------
- name: OpenSSL 4.0
config: --enable-mods-shared=most --enable-maintainer-mode --disable-md --disable-http2 --disable-ldap --disable-crypto
notest-cflags: -Werror -O2
env: |
TEST_OPENSSL3=4.0.0
OPENSSL_CONFIG=
APR_VERSION=1.7.6
APU_VERSION=1.6.3
APU_CONFIG="--without-crypto"
pkgs: subversion
# -------------------------------------------------------------------------
runs-on: ${{ matrix.os == '' && 'ubuntu-latest' || matrix.os }}
timeout-minutes: 30
env:
Expand Down
4 changes: 2 additions & 2 deletions modules/ssl/ssl_engine_kernel.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1254,7 +1254,7 @@ int ssl_hook_UserCheck(request_rec *r)
}

if (!sslconn->client_dn) {
X509_NAME *name = X509_get_subject_name(sslconn->client_cert);
const X509_NAME *name = X509_get_subject_name(sslconn->client_cert);
char *cp = X509_NAME_oneline(name, NULL, 0);
sslconn->client_dn = apr_pstrdup(r->connection->pool, cp);
OPENSSL_free(cp);
Expand Down Expand Up @@ -1778,7 +1778,7 @@ int ssl_callback_proxy_cert(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
server_rec *s = mySrvFromConn(c);
SSLSrvConfigRec *sc = mySrvConfig(s);
SSLDirConfigRec *dc = myDirConfigFromConn(c);
X509_NAME *ca_name, *issuer, *ca_issuer;
const X509_NAME *ca_name, *issuer, *ca_issuer;
X509_INFO *info;
X509 *ca_cert;
STACK_OF(X509_NAME) *ca_list;
Expand Down
14 changes: 7 additions & 7 deletions modules/ssl/ssl_engine_log.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,7 @@ void ssl_log_ssl_error(const char *file, int line, int level, server_rec *s)
static void ssl_log_cert_error(const char *file, int line, int level,
apr_status_t rv, const server_rec *s,
const conn_rec *c, const request_rec *r,
apr_pool_t *p, X509 *cert, const char *format,
apr_pool_t *p, const X509 *cert, const char *format,
va_list ap)
{
char buf[HUGE_STRING_LEN];
Expand Down Expand Up @@ -167,14 +167,14 @@ static void ssl_log_cert_error(const char *file, int line, int level,
}

BIO_puts(bio, " / serial: ");
if (i2a_ASN1_INTEGER(bio, X509_get_serialNumber(cert)) == -1)
if (i2a_ASN1_INTEGER(bio, X509_get0_serialNumber(cert)) == -1)
BIO_puts(bio, "(ERROR)");

BIO_puts(bio, " / notbefore: ");
ASN1_TIME_print(bio, X509_get_notBefore(cert));
ASN1_TIME_print(bio, X509_get0_notBefore(cert));

BIO_puts(bio, " / notafter: ");
ASN1_TIME_print(bio, X509_get_notAfter(cert));
ASN1_TIME_print(bio, X509_get0_notAfter(cert));

BIO_puts(bio, "]");

Expand Down Expand Up @@ -209,7 +209,7 @@ static void ssl_log_cert_error(const char *file, int line, int level,
* in the other cases we use the connection and request pool, respectively).
*/
void ssl_log_xerror(const char *file, int line, int level, apr_status_t rv,
apr_pool_t *ptemp, server_rec *s, X509 *cert,
apr_pool_t *ptemp, server_rec *s, const X509 *cert,
const char *fmt, ...)
{
if (APLOG_IS_LEVEL(s,level)) {
Expand All @@ -222,7 +222,7 @@ void ssl_log_xerror(const char *file, int line, int level, apr_status_t rv,
}

void ssl_log_cxerror(const char *file, int line, int level, apr_status_t rv,
conn_rec *c, X509 *cert, const char *fmt, ...)
conn_rec *c, const X509 *cert, const char *fmt, ...)
{
if (APLOG_IS_LEVEL(mySrvFromConn(c),level)) {
va_list ap;
Expand All @@ -234,7 +234,7 @@ void ssl_log_cxerror(const char *file, int line, int level, apr_status_t rv,
}

void ssl_log_rxerror(const char *file, int line, int level, apr_status_t rv,
request_rec *r, X509 *cert, const char *fmt, ...)
request_rec *r, const X509 *cert, const char *fmt, ...)
{
if (APLOG_R_IS_LEVEL(r,level)) {
va_list ap;
Expand Down
4 changes: 2 additions & 2 deletions modules/ssl/ssl_engine_ocsp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,8 @@ static const char *extract_responder_uri(X509 *cert, apr_pool_t *pool)
/* Name found in extension, and is a URI: */
if (OBJ_obj2nid(value->method) == NID_ad_OCSP
&& value->location->type == GEN_URI) {
result = apr_pstrdup(pool,
(char *)value->location->d.uniformResourceIdentifier->data);
const ASN1_STRING *uri = value->location->d.uniformResourceIdentifier;
result = modssl_ASN1_STRING_convert(pool, uri, 0);
}
}

Expand Down
54 changes: 33 additions & 21 deletions modules/ssl/ssl_engine_vars.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,10 +41,10 @@

static char *ssl_var_lookup_ssl(apr_pool_t *p, SSLConnRec *sslconn, request_rec *r, char *var);
static char *ssl_var_lookup_ssl_cert(apr_pool_t *p, request_rec *r, X509 *xs, char *var);
static char *ssl_var_lookup_ssl_cert_dn(apr_pool_t *p, X509_NAME *xsname, const char *var);
static char *ssl_var_lookup_ssl_cert_dn(apr_pool_t *p, const X509_NAME *xsname, const char *var);
static char *ssl_var_lookup_ssl_cert_san(apr_pool_t *p, X509 *xs, char *var);
static char *ssl_var_lookup_ssl_cert_valid(apr_pool_t *p, ASN1_TIME *tm);
static char *ssl_var_lookup_ssl_cert_remain(apr_pool_t *p, ASN1_TIME *tm);
static char *ssl_var_lookup_ssl_cert_valid(apr_pool_t *p, const ASN1_TIME *tm);
static char *ssl_var_lookup_ssl_cert_remain(apr_pool_t *p, const ASN1_TIME *tm);
static char *ssl_var_lookup_ssl_cert_serial(apr_pool_t *p, X509 *xs);
static char *ssl_var_lookup_ssl_cert_chain(apr_pool_t *p, STACK_OF(X509) *sk, char *var);
static char *ssl_var_lookup_ssl_cert_rfc4523_cea(apr_pool_t *p, SSL *ssl);
Expand Down Expand Up @@ -444,7 +444,7 @@ static char *ssl_var_lookup_ssl(apr_pool_t *p, SSLConnRec *sslconn,
}

static char *ssl_var_lookup_ssl_cert_dn_oneline(apr_pool_t *p, request_rec *r,
X509_NAME *xsname)
const X509_NAME *xsname)
{
char *result = NULL;
SSLDirConfigRec *dc;
Expand Down Expand Up @@ -476,7 +476,7 @@ static char *ssl_var_lookup_ssl_cert(apr_pool_t *p, request_rec *r, X509 *xs,
{
char *result;
BOOL resdup;
X509_NAME *xsname;
const X509_NAME *xsname;
int nid;

result = NULL;
Expand All @@ -490,13 +490,13 @@ static char *ssl_var_lookup_ssl_cert(apr_pool_t *p, request_rec *r, X509 *xs,
result = ssl_var_lookup_ssl_cert_serial(p, xs);
}
else if (strcEQ(var, "V_START")) {
result = ssl_var_lookup_ssl_cert_valid(p, X509_get_notBefore(xs));
result = ssl_var_lookup_ssl_cert_valid(p, X509_get0_notBefore(xs));
}
else if (strcEQ(var, "V_END")) {
result = ssl_var_lookup_ssl_cert_valid(p, X509_get_notAfter(xs));
result = ssl_var_lookup_ssl_cert_valid(p, X509_get0_notAfter(xs));
}
else if (strcEQ(var, "V_REMAIN")) {
result = ssl_var_lookup_ssl_cert_remain(p, X509_get_notAfter(xs));
result = ssl_var_lookup_ssl_cert_remain(p, X509_get0_notAfter(xs));
resdup = FALSE;
}
else if (*var && strcEQ(var+1, "_DN")) {
Expand Down Expand Up @@ -583,12 +583,12 @@ static const struct {
{ NULL, 0, 0 }
};

static char *ssl_var_lookup_ssl_cert_dn(apr_pool_t *p, X509_NAME *xsname,
static char *ssl_var_lookup_ssl_cert_dn(apr_pool_t *p, const X509_NAME *xsname,
const char *var)
{
const char *ptr;
char *result;
X509_NAME_ENTRY *xsne;
const X509_NAME_ENTRY *xsne;
int i, j, n, idx = 0, raw = 0;
apr_size_t varlen;

Expand All @@ -615,7 +615,7 @@ static char *ssl_var_lookup_ssl_cert_dn(apr_pool_t *p, X509_NAME *xsname,
for (j = 0; j < X509_NAME_entry_count(xsname); j++) {
xsne = X509_NAME_get_entry(xsname, j);

n =OBJ_obj2nid((ASN1_OBJECT *)X509_NAME_ENTRY_get_object(xsne));
n = OBJ_obj2nid(X509_NAME_ENTRY_get_object(xsne));

if (n == ssl_var_lookup_ssl_cert_dn_rec[i].nid && idx-- == 0) {
result = modssl_X509_NAME_ENTRY_to_string(p, xsne, raw);
Expand Down Expand Up @@ -672,7 +672,7 @@ static char *ssl_var_lookup_ssl_cert_san(apr_pool_t *p, X509 *xs, char *var)
return NULL;
}

static char *ssl_var_lookup_ssl_cert_valid(apr_pool_t *p, ASN1_TIME *tm)
static char *ssl_var_lookup_ssl_cert_valid(apr_pool_t *p, const ASN1_TIME *tm)
{
BIO* bio;

Expand All @@ -687,8 +687,15 @@ static char *ssl_var_lookup_ssl_cert_valid(apr_pool_t *p, ASN1_TIME *tm)

/* Return a string giving the number of days remaining until 'tm', or
* "0" if this can't be determined. */
static char *ssl_var_lookup_ssl_cert_remain(apr_pool_t *p, ASN1_TIME *tm)
static char *ssl_var_lookup_ssl_cert_remain(apr_pool_t *p, const ASN1_TIME *tm)
{
#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
int diff;

if (ASN1_TIME_check(tm) != 1 || ASN1_TIME_diff(&diff, NULL, NULL, tm) != 1) {
return "0";
}
#else
apr_time_t then, now = apr_time_now();
apr_time_exp_t exp = {0};
long diff;
Expand Down Expand Up @@ -723,6 +730,7 @@ static char *ssl_var_lookup_ssl_cert_remain(apr_pool_t *p, ASN1_TIME *tm)
}

diff = (long)((apr_time_sec(then) - apr_time_sec(now)) / (60*60*24));
#endif

return diff > 0 ? apr_ltoa(p, diff) : apr_pstrdup(p, "0");
}
Expand Down Expand Up @@ -772,7 +780,7 @@ static char *ssl_var_lookup_ssl_cert_rfc4523_cea(apr_pool_t *p, SSL *ssl)

serialNumber = X509_get_serialNumber(xs);
if (serialNumber) {
X509_NAME *issuer = X509_get_issuer_name(xs);
const X509_NAME *issuer = X509_get_issuer_name(xs);
if (issuer) {
BIGNUM *bn = ASN1_INTEGER_to_BN(serialNumber, NULL);
char *decimal = BN_bn2dec(bn);
Expand Down Expand Up @@ -896,9 +904,9 @@ static char *ssl_var_lookup_ssl_version(apr_pool_t *p, char *var)
/* Add each RDN in 'xn' to the table 't' where the NID is present in
* 'nids', using key prefix 'pfx'. */
static void extract_dn(apr_table_t *t, apr_hash_t *nids, const char *pfx,
X509_NAME *xn, apr_pool_t *p)
const X509_NAME *xn, apr_pool_t *p)
{
X509_NAME_ENTRY *xsne;
const X509_NAME_ENTRY *xsne;
apr_hash_t *count;
int i, nid;

Expand All @@ -913,7 +921,7 @@ static void extract_dn(apr_table_t *t, apr_hash_t *nids, const char *pfx,

/* Retrieve the nid, and check whether this is one of the nids
* which are to be extracted. */
nid = OBJ_obj2nid((ASN1_OBJECT *)X509_NAME_ENTRY_get_object(xsne));
nid = OBJ_obj2nid(X509_NAME_ENTRY_get_object(xsne));

tag = apr_hash_get(nids, &nid, sizeof nid);
if (tag) {
Expand Down Expand Up @@ -1026,15 +1034,19 @@ void modssl_var_extract_san_entries(apr_table_t *t, SSL *ssl, apr_pool_t *p)
* parse the extension type as a primitive string. This will fail for
* any structured extension type per the docs. Returns non-zero on
* success and writes the string to the given bio. */
static int dump_extn_value(BIO *bio, ASN1_OCTET_STRING *str)
static int dump_extn_value(BIO *bio, const ASN1_OCTET_STRING *str)
{
const unsigned char *pp = str->data;
const unsigned char *pp = ASN1_STRING_get0_data(str);
ASN1_STRING *ret = ASN1_STRING_new();
int rv = 0;

if (!ret) {
return rv;
}

/* This allows UTF8String, IA5String, VisibleString, or BMPString;
* conversion to UTF-8 is forced. */
if (d2i_DISPLAYTEXT(&ret, &pp, str->length)) {
if (d2i_DISPLAYTEXT(&ret, &pp, ASN1_STRING_length(str))) {
ASN1_STRING_print_ex(bio, ret, ASN1_STRFLGS_UTF8_CONVERT);
rv = 1;
}
Expand Down Expand Up @@ -1081,7 +1093,7 @@ apr_array_header_t *ssl_ext_list(apr_pool_t *p, conn_rec *c, int peer,
*/
array = apr_array_make(p, count, sizeof(char *));
for (j = 0; j < count; j++) {
X509_EXTENSION *ext = X509_get_ext(xs, j);
MODSSL_X509_EXT_CONST X509_EXTENSION *ext = X509_get_ext(xs, j);

if (OBJ_cmp(X509_EXTENSION_get_object(ext), oid) == 0) {
BIO *bio = BIO_new(BIO_s_mem());
Expand Down
18 changes: 15 additions & 3 deletions modules/ssl/ssl_private.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,12 @@
#define MODSSL_SSL_METHOD_CONST
#endif

#if OPENSSL_VERSION_NUMBER >= 0x40000000L
#define MODSSL_X509_EXT_CONST const
#else
#define MODSSL_X509_EXT_CONST
#endif

#if defined(LIBRESSL_VERSION_NUMBER)
/* Missing from LibreSSL */
#if LIBRESSL_VERSION_NUMBER < 0x2060000f
Expand Down Expand Up @@ -266,6 +272,12 @@
#define BIO_get_shutdown(x) (x->shutdown)
#define BIO_set_shutdown(x,v) (x->shutdown=v)
#define DH_bits(x) (BN_num_bits(x->p))
#define X509_up_ref(x) (CRYPTO_add(&(x)->references, +1, CRYPTO_LOCK_X509))
#define EVP_PKEY_up_ref(pk) (CRYPTO_add(&(pk)->references, +1, CRYPTO_LOCK_EVP_PKEY))
#define ASN1_STRING_get0_data(x) ((x)->data)
#define ASN1_STRING_length(x) ((int)(x)->length)
#define X509_get0_before(x) X509_get_before(x)
#define X509_get0_after(x) X509_get_after(x)
#else
void init_bio_methods(void);
void free_bio_methods(void);
Expand Down Expand Up @@ -1164,16 +1176,16 @@ void ssl_log_ssl_error(const char *, int, int, server_rec *);
* counterparts. */
void ssl_log_xerror(const char *file, int line, int level,
apr_status_t rv, apr_pool_t *p, server_rec *s,
X509 *cert, const char *format, ...)
const X509 *cert, const char *format, ...)
__attribute__((format(printf,8,9)));

void ssl_log_cxerror(const char *file, int line, int level,
apr_status_t rv, conn_rec *c, X509 *cert,
apr_status_t rv, conn_rec *c, const X509 *cert,
const char *format, ...)
__attribute__((format(printf,7,8)));

void ssl_log_rxerror(const char *file, int line, int level,
apr_status_t rv, request_rec *r, X509 *cert,
apr_status_t rv, request_rec *r, const X509 *cert,
const char *format, ...)
__attribute__((format(printf,7,8)));

Expand Down
Loading
Loading