From 10cfb3678293b3485dc73d781428da0205b11144 Mon Sep 17 00:00:00 2001 From: Scott Godin Date: Fri, 18 Sep 2026 16:38:36 -0400 Subject: [PATCH] ssl: modernize deprecated OpenSSL calls; fix upcoming OpenSSL forward-compat break (#489) OpenSSL 3.0 deprecated several APIs the code still called directly, producing warnings on current builds, and issue #489 shows an even newer OpenSSL (which makes X509_get_subject_name()\/X509_get_issuer_name() return const and ASN1_STRING fully opaque) fails to compile outright. Fix both while keeping the project's existing OpenSSL 1.1.1 floor (rutil\/ssl\/OpenSSLInit.cxx and resip\/stack\/DtlsMessage.hxx both already #error below that version) intact. Deprecated since OpenSSL 3.0, version-gated so 1.1.1-2.x is unaffected: - SSL_get_peer_certificate() -> SSL_get1_peer_certificate() on OpenSSL >= 3.0 (TlsConnection.cxx, DtlsSocket.cxx, AsyncTlsSocketBase.cxx, TurnTlsSocket.cxx) - SSLv23_method() -> TLS_method(), a pure alias rename with no behavior change; the SSLv23 vs TLSv1 protocol-version split is unaffected, since that's controlled separately by SSL_CTX_set_min\/max_proto_version (Security.cxx, TlsBaseTransport.cxx) Deprecated since OpenSSL 1.1.0, safe on all currently-supported versions: - RSA_generate_key() -> RSA_generate_key_ex() (makeSelfCert.cxx, makeCert.cxx, CreateCert.cxx) - X509_get_notBefore()\/X509_get_notAfter() -> X509_getm_notBefore()\/ X509_getm_notAfter() (makeSelfCert.cxx, makeCert.cxx) - drop SSL_library_init()\/SSL_load_error_strings()\/ OpenSSL_add_all_algorithms()\/ERR_load_crypto_strings(), which are no-ops since 1.1.0 auto-init (makeSelfCert.cxx, testDtlsWrapper.cxx) Forward-compat fixes for #489: - const-qualify X509_NAME* locals taken from X509_get_subject_name() (Security.cxx, AsyncTlsSocketBase.cxx, TurnTlsSocket.cxx) - testCertSerial.cxx built its subject\/issuer name by mutating the cert's own embedded X509_NAME in place, which only works while that accessor returns non-const; rebuild it via X509_NAME_new() and X509_set_subject_name()\/X509_set_issuer_name() instead, matching the pattern Security.cxx and CreateCert.cxx already use - replace direct ASN1_STRING ->data\/->length member access with ASN1_STRING_get0_data()\/ASN1_STRING_length() in subjectAltName parsing (Security.cxx, AsyncTlsSocketBase.cxx, TurnTlsSocket.cxx) Also remove a dead EVP_MD_CTX_new()\/EVP_MD_CTX_free() shim in DigestStream.cxx guarded by `OPENSSL_VERSION_NUMBER < 0x10100000L` (pre-1.1.0): unreachable given the project's 1.1.1 floor, and misleading since it implied OpenSSL 1.0.x support that doesn't exist. Upstream: https:\/\/github.com\/resiprocate\/resiprocate\/commit\/10cfb3678293b3485dc73d781428da0205b11144 Signed-off-by: Bernd Kuhls --- reTurn\/AsyncTlsSocketBase.cxx | 12 ++-- reTurn\/client\/TurnTlsSocket.cxx | 12 ++-- reflow\/dtls_wrapper\/DtlsSocket.cxx | 5 ++ reflow\/dtls_wrapper\/test\/CreateCert.cxx | 14 ++++- reflow\/dtls_wrapper\/test\/testDtlsWrapper.cxx | 8 +-- resip\/stack\/makeCert.cxx | 19 ++++-- resip\/stack\/ssl\/Security.cxx | 62 ++++++++++---------- resip\/stack\/ssl\/TlsBaseTransport.cxx | 13 ++-- resip\/stack\/ssl\/TlsConnection.cxx | 13 +++- resip\/stack\/test\/makeSelfCert.cxx | 27 ++++++--- rutil\/DigestStream.cxx | 13 +--- 12 files changed, 123 insertions(+), 79 deletions(-) diff --git a\/reTurn\/AsyncTlsSocketBase.cxx b\/reTurn\/AsyncTlsSocketBase.cxx index ef60ca956..1594be1fd 100644 --- a\/reTurn\/AsyncTlsSocketBase.cxx +++ b\/reTurn\/AsyncTlsSocketBase.cxx @@ -141,7 +141,11 @@ AsyncTlsSocketBase::validateServerCertificateHostname() << SSL_CIPHER_get_name(ciph) << " " ); \/\/ get the certificate - should always exist since mode is set for SSL to verify the cert first +#if OPENSSL_VERSION_NUMBER < 0x30000000L X509* cert = SSL_get_peer_certificate(mSocket.native_handle()); +#else + X509* cert = SSL_get1_peer_certificate(mSocket.native_handle()); +#endif resip_assert(cert); \/\/ Look at the SubjectAltName, and if found, set as peerName @@ -157,7 +161,7 @@ AsyncTlsSocketBase::validateServerCertificateHostname() if (gen->type == GEN_DNS) { ASN1_IA5STRING* asn = gen->d.dNSName; - resip::Data dns(asn->data, asn->length); + resip::Data dns(ASN1_STRING_get0_data(asn), ASN1_STRING_length(asn)); InfoLog(<< "subjectAltName of TLS session cert contains DNS <" << dns << ">" ); hostnamePresentInSubjectAltName = true; if(resip::isEqualNoCase(dns, mHostname.c_str())) @@ -182,8 +186,8 @@ AsyncTlsSocketBase::validateServerCertificateHostname() \/\/ If there are no peer names from the subjectAltName, then use the commonName if(!hostnamePresentInSubjectAltName) { - \/\/ look at the Common Name to find the peerName of the cert - X509_NAME* subject = X509_get_subject_name(cert); + \/\/ look at the Common Name to find the peerName of the cert + const X509_NAME* subject = X509_get_subject_name(cert); if(!subject) { ErrLog( << "Invalid certificate: subject not found "); @@ -346,7 +350,7 @@ AsyncTlsSocketBase::handleReadHeader(const asio::error_code& e) \/* ==================================================================== Copyright (c) 2007-2008, Plantronics, Inc. - Copyright (c) 2008-2018, SIP Spectrum, Inc. + Copyright (c) 2008-2026 SIP Spectrum, Inc. https:\/\/www.sipspectrum.com All rights reserved. Redistribution and use in source and binary forms, with or without diff --git a\/reTurn\/client\/TurnTlsSocket.cxx b\/reTurn\/client\/TurnTlsSocket.cxx index c30021e48..bae1ecad0 100644 --- a\/reTurn\/client\/TurnTlsSocket.cxx +++ b\/reTurn\/client\/TurnTlsSocket.cxx @@ -110,7 +110,11 @@ TurnTlsSocket::validateServerCertificateHostname(const std::string& hostname) << SSL_CIPHER_get_name(ciph) << " " ); \/\/ get the certificate - should always exist since mode is set for SSL to verify the cert first +#if OPENSSL_VERSION_NUMBER < 0x30000000L X509* cert = SSL_get_peer_certificate(mSocket.native_handle()); +#else + X509* cert = SSL_get1_peer_certificate(mSocket.native_handle()); +#endif resip_assert(cert); \/\/ Look at the SubjectAltName, and if found, set as peerName @@ -126,7 +130,7 @@ TurnTlsSocket::validateServerCertificateHostname(const std::string& hostname) if (gen->type == GEN_DNS) { ASN1_IA5STRING* asn = gen->d.dNSName; - resip::Data dns(asn->data, asn->length); + resip::Data dns(ASN1_STRING_get0_data(asn), ASN1_STRING_length(asn)); InfoLog(<< "subjectAltName of TLS session cert contains DNS <" << dns << ">" ); hostnamePresentInSubjectAltName = true; if(resip::isEqualNoCase(dns, hostname.c_str())) @@ -151,8 +155,8 @@ TurnTlsSocket::validateServerCertificateHostname(const std::string& hostname) \/\/ If there are no peer names from the subjectAltName, then use the commonName if(!hostnamePresentInSubjectAltName) { - \/\/ look at the Common Name to find the peerName of the cert - X509_NAME* subject = X509_get_subject_name(cert); + \/\/ look at the Common Name to find the peerName of the cert + const X509_NAME* subject = X509_get_subject_name(cert); if(!subject) { ErrLog( << "Invalid certificate: subject not found "); @@ -235,7 +239,7 @@ TurnTlsSocket::cancelSocket() \/* ==================================================================== Copyright (c) 2007-2008, Plantronics, Inc. - Copyright (c) 2008-2018, SIP Spectrum, Inc. + Copyright (c) 2008-2026 SIP Spectrum, Inc. https:\/\/www.sipspectrum.com All rights reserved. Redistribution and use in source and binary forms, with or without diff --git a\/reflow\/dtls_wrapper\/DtlsSocket.cxx b\/reflow\/dtls_wrapper\/DtlsSocket.cxx index 1091350f2..7833f9ac4 100644 --- a\/reflow\/dtls_wrapper\/DtlsSocket.cxx +++ b\/reflow\/dtls_wrapper\/DtlsSocket.cxx @@ -206,7 +206,11 @@ DtlsSocket::getRemoteFingerprint(char *fprint) { X509 *x; +#if OPENSSL_VERSION_NUMBER < 0x30000000L x=SSL_get_peer_certificate(mSsl); +#else + x=SSL_get1_peer_certificate(mSsl); +#endif if(!x) \/\/ No certificate return false; @@ -418,6 +422,7 @@ DtlsSocket::getReadTimeout() \/* ==================================================================== Copyright (c) 2007-2008, Eric Rescorla and Derek MacDonald + Copyright (c) 2026 SIP Spectrum, Inc. https:\/\/www.sipspectrum.com All rights reserved. Redistribution and use in source and binary forms, with or without diff --git a\/reflow\/dtls_wrapper\/test\/CreateCert.cxx b\/reflow\/dtls_wrapper\/test\/CreateCert.cxx index 7e70d0b36..1b2b39c57 100644 --- a\/reflow\/dtls_wrapper\/test\/CreateCert.cxx +++ b\/reflow\/dtls_wrapper\/test\/CreateCert.cxx @@ -1,5 +1,7 @@ #include "CreateCert.hxx" +#include +#include #include #include @@ -22,8 +24,15 @@ int dtls::createCert (const resip::Data& pAor, int expireDays, int keyLen, X509* \/\/ Make sure that necessary algorithms exist: resip_assert(EVP_sha1()); - RSA* rsa = RSA_generate_key(keyLen, RSA_F4, NULL, NULL); - resip_assert(rsa); \/\/ couldn't make key pair + BIGNUM* bn = BN_new(); + BN_set_word(bn, RSA_F4); + + RSA* rsa = RSA_new(); + resip_assert(rsa); + + ret = RSA_generate_key_ex(rsa, keyLen, bn, NULL); + BN_free(bn); + resip_assert(ret); \/\/ couldn't make key pair EVP_PKEY* privkey = EVP_PKEY_new(); resip_assert(privkey); @@ -92,6 +101,7 @@ int dtls::createCert (const resip::Data& pAor, int expireDays, int keyLen, X509* \/* ==================================================================== Copyright (c) 2007-2008, Eric Rescorla and Derek MacDonald + Copyright (c) 2026 SIP Spectrum, Inc. https:\/\/www.sipspectrum.com All rights reserved. Redistribution and use in source and binary forms, with or without diff --git a\/reflow\/dtls_wrapper\/test\/testDtlsWrapper.cxx b\/reflow\/dtls_wrapper\/test\/testDtlsWrapper.cxx index 80ed9102e..5f8d02155 100644 --- a\/reflow\/dtls_wrapper\/test\/testDtlsWrapper.cxx +++ b\/reflow\/dtls_wrapper\/test\/testDtlsWrapper.cxx @@ -68,10 +68,10 @@ class TestDtlsSocketContext : public DtlsSocketContext int main(int argc,char **argv) { - SSL_library_init(); - SSL_load_error_strings(); - ERR_load_crypto_strings(); - srtp_init(); + \/\/ OpenSSL 1.1.0+ initializes itself automatically; explicit calls to + \/\/ SSL_library_init(), SSL_load_error_strings() and ERR_load_crypto_strings() + \/\/ are no longer needed (and are deprecated). + srtp_init(); X509 *clientCert,*serverCert; EVP_PKEY *clientKey,*serverKey; diff --git a\/resip\/stack\/makeCert.cxx b\/resip\/stack\/makeCert.cxx index a3e08d411..8033a0c83 100644 --- a\/resip\/stack\/makeCert.cxx +++ b\/resip\/stack\/makeCert.cxx @@ -7,6 +7,8 @@ #include #include #include +#include +#include #include #include #include "resip\/stack\/X509Contents.hxx" @@ -35,8 +37,14 @@ int main() Random::initialize(); - rsa = RSA_generate_key(1024, RSA_F4, NULL, NULL); - resip_assert(rsa); \/\/ couldn't make key pair + { + BIGNUM* e = BN_new(); + BN_set_word(e, RSA_F4); + rsa = RSA_new(); + resip_assert(rsa); + resip_assert(RSA_generate_key_ex(rsa, 1024, e, NULL)); + BN_free(e); + } EVP_PKEY_assign_RSA(privkey, rsa); resip_assert(privkey); @@ -106,8 +114,8 @@ int makeSelfCert(X509 **cert, EVP_PKEY *privkey) \/\/ should include a Uri type X509_set_issuer_name(selfcert, subject); X509_set_subject_name(selfcert, subject); - X509_gmtime_adj(X509_get_notBefore(selfcert),0); - X509_gmtime_adj(X509_get_notAfter(selfcert), duration); + X509_gmtime_adj(X509_getm_notBefore(selfcert),0); + X509_gmtime_adj(X509_getm_notAfter(selfcert), duration); X509_set_pubkey(selfcert, privkey); @@ -132,7 +140,8 @@ int makeSelfCert(X509 **cert, EVP_PKEY *privkey) \/\/ should include a Uri type * The Vovida Software License, Version 1.0 * * Copyright (c) 2000-2005 Vovida Networks, Inc. All rights reserved. - * + * Copyright (c) 2026 SIP Spectrum, Inc. https:\/\/www.sipspectrum.com + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: diff --git a\/resip\/stack\/ssl\/Security.cxx b\/resip\/stack\/ssl\/Security.cxx index bc18c3671..563700cca 100644 --- a\/resip\/stack\/ssl\/Security.cxx +++ b\/resip\/stack\/ssl\/Security.cxx @@ -125,7 +125,7 @@ verifyCallback(int preverifyOk, X509_STORE_CTX* storeCtx) BIO* bio = BIO_new(BIO_s_mem()); if (bio) { - X509_NAME* subjectName = X509_get_subject_name(cert); + const X509_NAME* subjectName = X509_get_subject_name(cert); if (subjectName) { \/\/ RFC 2253 is the preferred format (readable and reversible) @@ -1209,7 +1209,7 @@ BaseSecurity::BaseSecurity (const CipherList& cipherSuite, const Data& defaultPr SSL_CTX_set_options(mTlsCtx, BaseSecurity::OpenSSLCTXSetOptions); SSL_CTX_clear_options(mTlsCtx, BaseSecurity::OpenSSLCTXClearOptions); - mSslCtx = SSL_CTX_new( SSLv23_method() ); + mSslCtx = SSL_CTX_new( TLS_method() ); resip_assert(mSslCtx); SSL_CTX_set_default_passwd_cb(mSslCtx, pem_passwd_cb); SSL_CTX_set_cert_store(mSslCtx, mRootSslCerts); @@ -2404,7 +2404,7 @@ BaseSecurity::checkSignature(MultipartSignedContents* multi, if (gen->type == GEN_URI) { ASN1_IA5STRING* uri = gen->d.uniformResourceIdentifier; - Data name(uri->data, uri->length); + Data name(ASN1_STRING_get0_data(uri), ASN1_STRING_length(uri)); InfoLog(<< "subjectAltName of signing cert contains <" << name << ">" ); try { @@ -2599,8 +2599,8 @@ BaseSecurity::getCertNames(X509 *cert, std::list &peerNames, Data commonName; - \/\/ look at the Common Name to find the peerName of the cert - X509_NAME* subject = X509_get_subject_name(cert); + \/\/ look at the Common Name to find the peerName of the cert + const X509_NAME* subject = X509_get_subject_name(cert); if(NULL == subject) { ErrLog( << "Invalid certificate: subject not found "); @@ -2666,7 +2666,7 @@ BaseSecurity::getCertNames(X509 *cert, std::list &peerNames, if (gen->type == GEN_DNS) { ASN1_IA5STRING* asn = gen->d.dNSName; - Data dns(asn->data, asn->length); + Data dns(ASN1_STRING_get0_data(asn), ASN1_STRING_length(asn)); PeerName peerName(SubjectAltName, dns); peerNames.push_back(peerName); InfoLog(<< "subjectAltName of TLS session cert contains DNS <" << dns << ">" ); @@ -2677,7 +2677,7 @@ BaseSecurity::getCertNames(X509 *cert, std::list &peerNames, if(useEmailAsSIP) { ASN1_IA5STRING* asn = gen->d.rfc822Name; - Data email(asn->data, asn->length); + Data email(ASN1_STRING_get0_data(asn), ASN1_STRING_length(asn)); PeerName peerName(SubjectAltName, email); peerNames.push_back(peerName); InfoLog(<< "subjectAltName of TLS session cert contains EMAIL <" << email << ">" ); @@ -2692,12 +2692,14 @@ BaseSecurity::getCertNames(X509 *cert, std::list &peerNames, \/\/ MUST contain exactly four octets. For IP Version 6, as specified in \/\/ RFC 1883, the octet string MUST contain exactly sixteen octets." ASN1_OCTET_STRING* asn = gen->d.iPAddress; - if (asn->length == 4) + const unsigned char* asnData = ASN1_STRING_get0_data(asn); + const int asnLen = ASN1_STRING_length(asn); + if (asnLen == 4) { - uint32_t ip = (asn->data[0] << 24) | - (asn->data[1] << 16) | - (asn->data[2] << 8) | - (asn->data[3]); + uint32_t ip = (asnData[0] << 24) | + (asnData[1] << 16) | + (asnData[2] << 8) | + (asnData[3]); sockaddr_in sa; sa.sin_family = AF_INET; @@ -2712,26 +2714,26 @@ BaseSecurity::getCertNames(X509 *cert, std::list &peerNames, InfoLog(<< "subjectAltName of TLS session cert contains IP ADDRESS <" << ipv4 << ">" ); } } - else if (asn->length == 16) + else if (asnLen == 16) { sockaddr_in6 sa; sa.sin6_family = AF_INET6; - sa.sin6_addr.s6_addr[0] = asn->data[0]; - sa.sin6_addr.s6_addr[1] = asn->data[1]; - sa.sin6_addr.s6_addr[2] = asn->data[2]; - sa.sin6_addr.s6_addr[3] = asn->data[3]; - sa.sin6_addr.s6_addr[4] = asn->data[4]; - sa.sin6_addr.s6_addr[5] = asn->data[5]; - sa.sin6_addr.s6_addr[6] = asn->data[6]; - sa.sin6_addr.s6_addr[7] = asn->data[7]; - sa.sin6_addr.s6_addr[8] = asn->data[8]; - sa.sin6_addr.s6_addr[9] = asn->data[9]; - sa.sin6_addr.s6_addr[10] = asn->data[10]; - sa.sin6_addr.s6_addr[11] = asn->data[11]; - sa.sin6_addr.s6_addr[12] = asn->data[12]; - sa.sin6_addr.s6_addr[13] = asn->data[13]; - sa.sin6_addr.s6_addr[14] = asn->data[14]; - sa.sin6_addr.s6_addr[15] = asn->data[15]; + sa.sin6_addr.s6_addr[0] = asnData[0]; + sa.sin6_addr.s6_addr[1] = asnData[1]; + sa.sin6_addr.s6_addr[2] = asnData[2]; + sa.sin6_addr.s6_addr[3] = asnData[3]; + sa.sin6_addr.s6_addr[4] = asnData[4]; + sa.sin6_addr.s6_addr[5] = asnData[5]; + sa.sin6_addr.s6_addr[6] = asnData[6]; + sa.sin6_addr.s6_addr[7] = asnData[7]; + sa.sin6_addr.s6_addr[8] = asnData[8]; + sa.sin6_addr.s6_addr[9] = asnData[9]; + sa.sin6_addr.s6_addr[10] = asnData[10]; + sa.sin6_addr.s6_addr[11] = asnData[11]; + sa.sin6_addr.s6_addr[12] = asnData[12]; + sa.sin6_addr.s6_addr[13] = asnData[13]; + sa.sin6_addr.s6_addr[14] = asnData[14]; + sa.sin6_addr.s6_addr[15] = asnData[15]; char addrStr[INET6_ADDRSTRLEN]; if (inet_ntop(sa.sin6_family, &(sa.sin6_addr), addrStr, INET6_ADDRSTRLEN) != NULL) @@ -2749,7 +2751,7 @@ BaseSecurity::getCertNames(X509 *cert, std::list &peerNames, if(gen->type == GEN_URI) { ASN1_IA5STRING* asn = gen->d.uniformResourceIdentifier; - Uri uri(Data(asn->data, asn->length)); + Uri uri(Data(ASN1_STRING_get0_data(asn), ASN1_STRING_length(asn))); try { PeerName peerName(SubjectAltName, uri.host()); diff --git a\/resip\/stack\/ssl\/TlsBaseTransport.cxx b\/resip\/stack\/ssl\/TlsBaseTransport.cxx index c5dc8ad5e..c8afdf915 100644 --- a\/resip\/stack\/ssl\/TlsBaseTransport.cxx +++ b\/resip\/stack\/ssl\/TlsBaseTransport.cxx @@ -60,11 +60,11 @@ TlsBaseTransport::TlsBaseTransport(Fifo& fifo, switch(sslType) { case SecurityTypes::SSLv23: - DebugLog(<<"Using SSLv23_method"); - mDomainCtx = mSecurity->createDomainCtx(SSLv23_method(), sipDomain, certificateFilename, privateKeyFilename, privateKeyPassPhrase); + DebugLog(<<"Using SecurityTypes::SSLv23"); + mDomainCtx = mSecurity->createDomainCtx(TLS_method(), sipDomain, certificateFilename, privateKeyFilename, privateKeyPassPhrase); break; case SecurityTypes::TLSv1: - DebugLog(<<"Using TLS_method"); + DebugLog(<<"Using SecurityTypes::TLSv1"); mDomainCtx = mSecurity->createDomainCtx(TLS_method(), sipDomain, certificateFilename, privateKeyFilename, privateKeyPassPhrase); if (mDomainCtx) { SSL_CTX_set_min_proto_version(mDomainCtx, TLS1_VERSION); @@ -104,12 +104,12 @@ TlsBaseTransport::getCtx() } else if(mSslType == SecurityTypes::SSLv23) { - DebugLog(<<"Using SSLv23_method"); + DebugLog(<<"Using SecurityTypes::SSLv23 (dynamic version negotiation)"); ctx = mSecurity->getSslCtx(); } else { - DebugLog(<<"Using TLSv1_method"); + DebugLog(<<"Using SecurityTypes::TLSv1 (pinned to TLSv1)"); ctx = mSecurity->getTlsCtx(); } \/\/ FIXME: would be better to do this in a method called asynchronously after onReload @@ -168,7 +168,8 @@ TlsBaseTransport::createConnection(const Tuple& who, Socket fd, bool server) * The Vovida Software License, Version 1.0 * * Copyright (c) 2000 Vovida Networks, Inc. All rights reserved. - * + * Copyright (c) 2026 SIP Spectrum, Inc. https:\/\/www.sipspectrum.com + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: diff --git a\/resip\/stack\/ssl\/TlsConnection.cxx b\/resip\/stack\/ssl\/TlsConnection.cxx index 71f85d299..ed4ffba55 100644 --- a\/resip\/stack\/ssl\/TlsConnection.cxx +++ b\/resip\/stack\/ssl\/TlsConnection.cxx @@ -268,7 +268,11 @@ TlsConnection::checkState() { \/\/ OpenSSL docs: If no peer certificate was presented, the returned result code is X509_V_OK. \/\/ This is because no verification error occurred, it does however not indicate success. +#if OPENSSL_VERSION_NUMBER < 0x30000000L X509* peerCert = SSL_get_peer_certificate(mSsl); +#else + X509* peerCert = SSL_get1_peer_certificate(mSsl); +#endif if (peerCert) { ds << "peer supplied a certificate, it has either not been checked or it was checked successfully"; @@ -724,8 +728,12 @@ TlsConnection::computePeerName() << SSL_CIPHER_get_version(ciph) << " " << SSL_CIPHER_get_name(ciph) << " "); - \/\/ get the certificate if other side has one + \/\/ get the certificate if other side has one +#if OPENSSL_VERSION_NUMBER < 0x30000000L X509* cert = SSL_get_peer_certificate(mSsl); +#else + X509* cert = SSL_get1_peer_certificate(mSsl); +#endif if (!cert) { DebugLog(<< "No peer certificate in TLS connection"); @@ -775,7 +783,8 @@ TlsConnection::computePeerName() * The Vovida Software License, Version 1.0 * * Copyright (c) 2000-2005 Vovida Networks, Inc. All rights reserved. - * + * Copyright (c) 2026 SIP Spectrum, Inc. https:\/\/www.sipspectrum.com + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: diff --git a\/resip\/stack\/test\/makeSelfCert.cxx b\/resip\/stack\/test\/makeSelfCert.cxx index 10ec52b28..89cfcfbc0 100644 --- a\/resip\/stack\/test\/makeSelfCert.cxx +++ b\/resip\/stack\/test\/makeSelfCert.cxx @@ -1,6 +1,8 @@ #include #include #include +#include +#include #include #include #include @@ -29,18 +31,24 @@ int main(int argc, char* argv[]) Log::initialize(Log::Cerr, Log::Err, argv[0]); Log::setLevel(Log::Debug); - SSL_library_init(); - SSL_load_error_strings(); - OpenSSL_add_all_algorithms(); - \/\/OpenSSL_add_ssl_algorithms() is insufficient here... + \/\/ OpenSSL 1.1.0+ initializes itself automatically; explicit calls to + \/\/ SSL_library_init(), SSL_load_error_strings() and OpenSSL_add_all_algorithms() + \/\/ are no longer needed (and are deprecated). \/\/ make sure that necessary algorithms exist: assert(EVP_des_ede3_cbc()); Random::initialize(); - rsa = RSA_generate_key(1024, RSA_F4, NULL, NULL); - assert(rsa); \/\/ couldn't make key pair + { + BIGNUM* e = BN_new(); + assert(e); + assert(BN_set_word(e, RSA_F4)); + rsa = RSA_new(); + assert(rsa); + assert(RSA_generate_key_ex(rsa, 1024, e, NULL)); + BN_free(e); + } \/\/ TODO: remove this once we've tested this stat = PEM_write_RSAPrivateKey( stdout, rsa, NULL, NULL, 0, NULL, NULL); \/\/ Write this out for debugging @@ -133,8 +141,8 @@ int makeSelfCert(X509 **cert, EVP_PKEY *privkey) \/\/ should include a Uri type stat = X509_set_subject_name(selfcert, subject); assert(stat); - X509_gmtime_adj(X509_get_notBefore(selfcert),0); - X509_gmtime_adj(X509_get_notAfter(selfcert), duration); + X509_gmtime_adj(X509_getm_notBefore(selfcert),0); + X509_gmtime_adj(X509_getm_notAfter(selfcert), duration); stat = X509_set_pubkey(selfcert, privkey); assert(stat); @@ -165,7 +173,8 @@ int makeSelfCert(X509 **cert, EVP_PKEY *privkey) \/\/ should include a Uri type * The Vovida Software License, Version 1.0 * * Copyright (c) 2000 Vovida Networks, Inc. All rights reserved. - * + * Copyright (c) 2026 SIP Spectrum, Inc. https:\/\/www.sipspectrum.com + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: diff --git a\/rutil\/DigestStream.cxx b\/rutil\/DigestStream.cxx index 339c8522e..2bc99184d 100644 --- a\/rutil\/DigestStream.cxx +++ b\/rutil\/DigestStream.cxx @@ -9,18 +9,7 @@ #endif #ifdef USE_SSL - #include - #if OPENSSL_VERSION_NUMBER < 0x10100000L \/\/ openssl 1.1.0 api changes - static EVP_MD_CTX* EVP_MD_CTX_new() - { - return new EVP_MD_CTX; - } - static void EVP_MD_CTX_free(EVP_MD_CTX* pCtx) - { - EVP_MD_CTX_cleanup(pCtx); - delete pCtx; - } - #endif + #include #else #include "rutil\/vmd5.hxx" #include "rutil\/Sha1.hxx" -- 2.47.3

Other Versions#

Patches#