Skip to content

Commit c4354e3

Browse files
heitbaumheitbaum
committed
openvpn: allow build with OpenSSL 4.0.0
1 parent 25ed30d commit c4354e3

File tree

3 files changed

+148
-0
lines changed

3 files changed

+148
-0
lines changed

‎packages/network/openvpn/package.mk‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ PKG_CONFIGURE_OPTS_TARGET="ac_cv_have_decl_TUNSETPERSIST=no \
1717
--enable-iproute2 IPROUTE=/sbin/ip \
1818
--enable-management \
1919
--enable-fragment \
20+
--without-openssl-engine \
2021
--disable-port-share \
2122
--disable-debug"
2223

‎packages/network/openvpn/patches/openvpn-0001-ssl_verify_openssl-Clean-up-extract_x509_extension.patch‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
From a07f388d3aeb7a23df19fac82789b5d0928de90f Mon Sep 17 00:00:00 2001
2+
From: Rudi Heitbaum <rudi@heitbaum.com>
3+
Date: Sun, 22 Mar 2026 04:45:58 +0000
4+
Subject: [PATCH] ssl_verify_openssl: Clean up extract_x509_extension
5+
6+
* Avoid sign-compare warning when comparing string
7+
lengths
8+
* Use the nicer alias rfc822Name instead of the general ia5
9+
from the GENERAL_NAME union.
10+
* Use the official ASN1_STRING_length API instead of accessing
11+
the struct directly.
12+
* C11 changes
13+
14+
Change-Id: I23cc00aee47aef007ab2e7d50b52c6de299505db
15+
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>
16+
Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org>
17+
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1507
18+
Message-Id: <20260309133236.29732-1-frank@lichtenheld.com>
19+
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg35980.html
20+
Signed-off-by: Gert Doering <gert@greenie.muc.de>
21+
---
22+
src/openvpn/ssl_verify_openssl.c | 14 ++++++--------
23+
1 file changed, 6 insertions(+), 8 deletions(-)
24+
25+
diff --git a/src/openvpn/ssl_verify_openssl.c b/src/openvpn/ssl_verify_openssl.c
26+
index 60d5756a..46401cd3 100644
27+
--- a/src/openvpn/ssl_verify_openssl.c
28+
+++ b/src/openvpn/ssl_verify_openssl.c
29+
@@ -122,7 +122,6 @@ static bool
30+
extract_x509_extension(X509 *cert, char *fieldname, char *out, size_t size)
31+
{
32+
bool retval = false;
33+
- char *buf = 0;
34+
35+
if (!x509_username_field_ext_supported(fieldname))
36+
{
37+
@@ -134,29 +133,28 @@ extract_x509_extension(X509 *cert, char *fieldname, char *out, size_t size)
38+
GENERAL_NAMES *extensions = X509_get_ext_d2i(cert, nid, NULL, NULL);
39+
if (extensions)
40+
{
41+
- int numalts;
42+
- int i;
43+
/* get amount of alternatives,
44+
* RFC2459 claims there MUST be at least
45+
* one, but we don't depend on it...
46+
*/
47+
48+
- numalts = sk_GENERAL_NAME_num(extensions);
49+
+ int numalts = sk_GENERAL_NAME_num(extensions);
50+
51+
/* loop through all alternatives */
52+
- for (i = 0; i < numalts; i++)
53+
+ for (int i = 0; i < numalts; i++)
54+
{
55+
/* get a handle to alternative name number i */
56+
const GENERAL_NAME *name = sk_GENERAL_NAME_value(extensions, i);
57+
+ char *buf = NULL;
58+
59+
switch (name->type)
60+
{
61+
case GEN_EMAIL:
62+
- if (ASN1_STRING_to_UTF8((unsigned char **)&buf, name->d.ia5) < 0)
63+
+ if (ASN1_STRING_to_UTF8((unsigned char **)&buf, name->d.rfc822Name) < 0)
64+
{
65+
continue;
66+
}
67+
- if (strlen(buf) != name->d.ia5->length)
68+
+ if ((ssize_t)strlen(buf) != ASN1_STRING_length(name->d.rfc822Name))
69+
{
70+
msg(D_TLS_ERRORS, "ASN1 ERROR: string contained terminating zero");
71+
OPENSSL_free(buf);
72+
@@ -170,7 +168,7 @@ extract_x509_extension(X509 *cert, char *fieldname, char *out, size_t size)
73+
break;
74+
75+
default:
76+
- msg(D_TLS_DEBUG, "%s: ignoring general name field type %i", __func__,
77+
+ msg(D_TLS_DEBUG, "%s: ignoring general name field type %d", __func__,
78+
name->type);
79+
break;
80+
}
81+
--
82+
2.53.0
83+

‎packages/network/openvpn/patches/openvpn-0002-ssl_verify_openssl-use-official-ASN1_STRING_-API.patch‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
From 17b35e1d635cd70f6d6589031f5f846a369b4748 Mon Sep 17 00:00:00 2001
2+
From: Rudi Heitbaum <rudi@heitbaum.com>
3+
Date: Sun, 22 Mar 2026 00:14:23 +0000
4+
Subject: [PATCH 18/18] ssl_verify_openssl: use official ASN1_STRING_ API
5+
MIME-Version: 1.0
6+
Content-Type: text/plain; charset=UTF-8
7+
Content-Transfer-Encoding: 8bit
8+
9+
ASN1_STRING are now opaque types in OpenSSL 4.x — the internal data and
10+
length fields are no longer directly accessible. Use the accessor API
11+
instead. Accessors have been available since OpenSSL 1.1.0
12+
13+
The ASN1_STRING_length accessor is already in use, but not consistently
14+
applied. Standardise on using ASN1_STRING_length and ASN1_STRING_get0_data
15+
which allows for successful build of OpenSSL 4.x
16+
17+
Signed-off-by: Rudi Heitbaum <rudi@heitbaum.com>
18+
---
19+
src/openvpn/ssl_verify_openssl.c | 8 ++++----
20+
1 file changed, 4 insertions(+), 4 deletions(-)
21+
22+
diff --git a/src/openvpn/ssl_verify_openssl.c b/src/openvpn/ssl_verify_openssl.c
23+
index 46401cd3..d96879bd 100644
24+
--- a/src/openvpn/ssl_verify_openssl.c
25+
+++ b/src/openvpn/ssl_verify_openssl.c
26+
@@ -259,7 +259,7 @@ backend_x509_get_username(char *common_name, size_t cn_len, char *x509_username_
27+
{
28+
ASN1_INTEGER *asn1_i = X509_get_serialNumber(peer_cert);
29+
struct gc_arena gc = gc_new();
30+
- char *serial = format_hex_ex(asn1_i->data, asn1_i->length, 0, 1 | FHE_CAPS, NULL, &gc);
31+
+ char *serial = format_hex_ex(ASN1_STRING_get0_data(asn1_i), ASN1_STRING_length(asn1_i), 0, 1 | FHE_CAPS, NULL, &gc);
32+
33+
if (!serial || cn_len <= strlen(serial) + 2)
34+
{
35+
@@ -313,7 +313,7 @@ backend_x509_get_serial_hex(openvpn_x509_cert_t *cert, struct gc_arena *gc)
36+
{
37+
const ASN1_INTEGER *asn1_i = X509_get_serialNumber(cert);
38+
39+
- return format_hex_ex(asn1_i->data, asn1_i->length, 0, 1, ":", gc);
40+
+ return format_hex_ex(ASN1_STRING_get0_data(asn1_i), ASN1_STRING_length(asn1_i), 0, 1, ":", gc);
41+
}
42+
43+
result_t
44+
@@ -626,7 +626,7 @@ x509_verify_ns_cert_type(openvpn_x509_cert_t *peer_cert, const int usage)
45+
{
46+
ASN1_BIT_STRING *ns;
47+
ns = X509_get_ext_d2i(peer_cert, NID_netscape_cert_type, NULL, NULL);
48+
- result = (ns && ns->length > 0 && (ns->data[0] & NS_SSL_CLIENT)) ? SUCCESS : FAILURE;
49+
+ result = (ns && ASN1_STRING_length(ns) > 0 && (ASN1_STRING_get0_data(ns)[0] & NS_SSL_CLIENT)) ? SUCCESS : FAILURE;
50+
if (result == SUCCESS)
51+
{
52+
msg(M_WARN, "X509: Certificate is a client certificate yet it's purpose "
53+
@@ -654,7 +654,7 @@ x509_verify_ns_cert_type(openvpn_x509_cert_t *peer_cert, const int usage)
54+
{
55+
ASN1_BIT_STRING *ns;
56+
ns = X509_get_ext_d2i(peer_cert, NID_netscape_cert_type, NULL, NULL);
57+
- result = (ns && ns->length > 0 && (ns->data[0] & NS_SSL_SERVER)) ? SUCCESS : FAILURE;
58+
+ result = (ns && ASN1_STRING_length(ns) > 0 && (ASN1_STRING_get0_data(ns)[0] & NS_SSL_SERVER)) ? SUCCESS : FAILURE;
59+
if (result == SUCCESS)
60+
{
61+
msg(M_WARN, "X509: Certificate is a server certificate yet it's purpose "
62+
--
63+
2.53.0
64+

0 commit comments

Comments
 (0)