Package: openvpn3-client Followup-For: Bug #1138369 X-Debbugs-Cc: [email protected] Control: tags -1 patch ftbfs
Dear Maintainer, The patch fixes the build issue. I have also forwarded it upstream. -- System Information: Debian Release: trixie/sid APT prefers noble-updates APT policy: (500, 'noble-updates'), (500, 'noble-security'), (500, 'noble'), (100, 'noble-backports') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 6.8.0-124-generic (SMP w/12 CPU threads; PREEMPT) Kernel taint flags: TAINT_WARN Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled
Description: Fix build with OpenSSL 4.0 - const-correctness and opaque ASN1_INTEGER OpenSSL 4.0 made X509_NAME, X509_NAME_ENTRY, ASN1_STRING, and X509_EXTENSION accessors return const pointers, and made ASN1_INTEGER opaque. Add const to pointer declarations and use ASN1_STRING accessors instead of direct struct member access. Author: Ravi Kant Sharma <[email protected]> Bug-Ubuntu: https://launchpad.net/bugs/2154917 Bug-Debian: https://bugs.debian.org/1138369 Forwarded: https://github.com/OpenVPN/openvpn3/pull/438 Last-Update: 2026-08-04 Index: openvpn3-client/openvpn3-core/openvpn/openssl/pki/x509certinfo.hpp =================================================================== --- a/openvpn3-core/openvpn/openssl/pki/x509certinfo.hpp +++ b/openvpn3-core/openvpn/openssl/pki/x509certinfo.hpp @@ -139,14 +139,14 @@ static inline std::string x509_get_field(::X509 *cert, const int nid) { static const char nullc = '\0'; std::string ret; - X509_NAME *x509_name = X509_get_subject_name(cert); + const X509_NAME *x509_name = X509_get_subject_name(cert); int i = X509_NAME_get_index_by_NID(x509_name, nid, -1); if (i >= 0) { - X509_NAME_ENTRY *ent = X509_NAME_get_entry(x509_name, i); + const X509_NAME_ENTRY *ent = X509_NAME_get_entry(x509_name, i); if (ent) { - ASN1_STRING *val = X509_NAME_ENTRY_get_data(ent); + const ASN1_STRING *val = X509_NAME_ENTRY_get_data(ent); unsigned char *buf; buf = (unsigned char *)1; // bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8 // requires this workaround @@ -164,7 +164,11 @@ static inline std::string x509_get_field(::X509 *cert, const int nid) i = X509_get_ext_by_NID(cert, nid, -1); if (i >= 0) { +#if OPENSSL_VERSION_NUMBER < 0x40000000L X509_EXTENSION *ext = X509_get_ext(cert, i); +#else + const X509_EXTENSION *ext = X509_get_ext(cert, i); +#endif if (ext) { BIO *bio = BIO_new(BIO_s_mem()); @@ -225,7 +229,7 @@ static inline std::string x509_get_serial(::X509 *cert) static inline std::string x509_get_serial_hex(::X509 *cert) { const ASN1_INTEGER *asn1_i = X509_get_serialNumber(cert); - return render_hex_sep(asn1_i->data, asn1_i->length, ':', false); + return render_hex_sep(ASN1_STRING_get0_data(asn1_i), ASN1_STRING_length(asn1_i), ':', false); } /** Index: openvpn3-client/openvpn3-core/openvpn/openssl/ssl/sslctx.hpp =================================================================== --- a/openvpn3-core/openvpn/openssl/ssl/sslctx.hpp +++ b/openvpn3-core/openvpn/openssl/ssl/sslctx.hpp @@ -1804,7 +1804,7 @@ static void load_serial_number_into_authcert(AuthCert &authcert, ::X509 *cert) const ASN1_INTEGER *ai = X509_get_serialNumber(cert); if (!ai) return; - if (ai->type == V_ASN1_NEG_INTEGER) // negative serial number is considered to be undefined + if (ASN1_STRING_type(ai) == V_ASN1_NEG_INTEGER) // negative serial number is considered to be undefined return; if (!is_safe_conversion<int>(authcert.serial.size())) return;
