From 5e95244b12d4f7762afd07a2be52f778b38d4abf Mon Sep 17 00:00:00 2001 From: Sam James Date: Wed, 4 Nov 2026 03:47:20 +0000 Subject: [PATCH] grpc: fix build w/ OpenSSL 4 Hacked up version of fb056ab0bb3ed003febe82f069ff41514288a4f3 from grpc upstream. Signed-off-by: Sam James --- .../call/external/aws_request_signer.cc | 16 ++++++++++ .../transport/tls/grpc_tls_crl_provider.cc | 4 +-- .../src/core/tsi/ssl_transport_security.cc | 32 +++++++++++++------ .../core/tsi/ssl_transport_security_utils.cc | 14 ++++---- 4 files changed, 49 insertions(+), 17 deletions(-) diff --git a/src/third_party/grpc/dist/src/core/credentials/call/external/aws_request_signer.cc b/src/third_party/grpc/dist/src/core/credentials/call/external/aws_request_signer.cc index f7fb7a2..d3f506d 100644 --- a/src/third_party/grpc/dist/src/core/credentials/call/external/aws_request_signer.cc +++ b/src/third_party/grpc/dist/src/core/credentials/call/external/aws_request_signer.cc @@ -18,12 +18,15 @@ #include #include #include +#if OPENSSL_VERSION_NUMBER < 0x30000000L #include +#endif #include #include #include +//#include "src/core/util/grpc_check.h" #include "absl/status/statusor.h" #include "absl/strings/ascii.h" #include "absl/strings/escaping.h" @@ -41,6 +44,7 @@ namespace { #if OPENSSL_VERSION_NUMBER >= 0x30000000L const char kSha256[] = "SHA256"; +const char kHmacName[] = "HMAC"; #endif const char kAlgorithm[] = "AWS4-HMAC-SHA256"; const char kDateFormat[] = "%a, %d %b %E4Y %H:%M:%S %Z"; @@ -67,12 +71,24 @@ std::string SHA256Hex(const std::string& str) { } std::string HMAC(const std::string& key, const std::string& msg) { +#if OPENSSL_VERSION_NUMBER < 0x30000000L unsigned int len; unsigned char digest[EVP_MAX_MD_SIZE]; HMAC(EVP_sha256(), key.c_str(), key.length(), reinterpret_cast(msg.c_str()), msg.length(), digest, &len); return std::string(digest, digest + len); +#else + size_t len = 0; + unsigned char digest[EVP_MAX_MD_SIZE]; + CHECK_NE(EVP_Q_mac(nullptr, kHmacName, nullptr, kSha256, nullptr, + reinterpret_cast(key.c_str()), + key.length(), + reinterpret_cast(msg.c_str()), + msg.length(), digest, sizeof(digest), &len), + nullptr); + return std::string(digest, digest + len); +#endif } } // namespace diff --git a/src/third_party/grpc/dist/src/core/credentials/transport/tls/grpc_tls_crl_provider.cc b/src/third_party/grpc/dist/src/core/credentials/transport/tls/grpc_tls_crl_provider.cc index a882cf3..4e4b484 100644 --- a/src/third_party/grpc/dist/src/core/credentials/transport/tls/grpc_tls_crl_provider.cc +++ b/src/third_party/grpc/dist/src/core/credentials/transport/tls/grpc_tls_crl_provider.cc @@ -56,12 +56,12 @@ absl::StatusOr IssuerFromCrl(X509_CRL* crl) { if (crl == nullptr) { return absl::InvalidArgumentError("crl cannot be null"); } - X509_NAME* issuer = X509_CRL_get_issuer(crl); + auto* issuer = X509_CRL_get_issuer(crl); if (issuer == nullptr) { return absl::InvalidArgumentError("crl cannot have null issuer"); } unsigned char* buf = nullptr; - int len = i2d_X509_NAME(issuer, &buf); + int len = i2d_X509_NAME(const_cast(issuer), &buf); if (len < 0 || buf == nullptr) { return absl::InvalidArgumentError("crl cannot have null issuer"); } diff --git a/src/third_party/grpc/dist/src/core/tsi/ssl_transport_security.cc b/src/third_party/grpc/dist/src/core/tsi/ssl_transport_security.cc index f7d44bf..bd6561d 100644 --- a/src/third_party/grpc/dist/src/core/tsi/ssl_transport_security.cc +++ b/src/third_party/grpc/dist/src/core/tsi/ssl_transport_security.cc @@ -42,7 +42,9 @@ #include #include #include // For OPENSSL_free +#if !defined(OPENSSL_NO_ENGINE) #include +#endif #include #include #include @@ -398,9 +400,7 @@ static int looks_like_ip_address(absl::string_view name) { static tsi_result ssl_get_x509_common_name(X509* cert, unsigned char** utf8, size_t* utf8_size) { int common_name_index = -1; - X509_NAME_ENTRY* common_name_entry = nullptr; - ASN1_STRING* common_name_asn1 = nullptr; - X509_NAME* subject_name = X509_get_subject_name(cert); + auto* subject_name = X509_get_subject_name(cert); int utf8_returned_size = 0; if (subject_name == nullptr) { VLOG(2) << "Could not get subject name from certificate."; @@ -412,12 +412,13 @@ static tsi_result ssl_get_x509_common_name(X509* cert, unsigned char** utf8, VLOG(2) << "Could not get common name of subject from certificate."; return TSI_NOT_FOUND; } - common_name_entry = X509_NAME_get_entry(subject_name, common_name_index); + auto* common_name_entry = + X509_NAME_get_entry(subject_name, common_name_index); if (common_name_entry == nullptr) { LOG(ERROR) << "Could not get common name entry from certificate."; return TSI_INTERNAL_ERROR; } - common_name_asn1 = X509_NAME_ENTRY_get_data(common_name_entry); + auto* common_name_asn1 = X509_NAME_ENTRY_get_data(common_name_entry); if (common_name_asn1 == nullptr) { LOG(ERROR) << "Could not get common name entry asn1 from certificate."; return TSI_INTERNAL_ERROR; @@ -458,7 +459,7 @@ static tsi_result peer_property_from_x509_common_name( static tsi_result peer_property_from_x509_subject(X509* cert, tsi_peer_property* property, bool is_verified_root_cert) { - X509_NAME* subject_name = X509_get_subject_name(cert); + auto* subject_name = X509_get_subject_name(cert); if (subject_name == nullptr) { GRPC_TRACE_LOG(tsi, INFO) << "Could not get subject name from certificate."; return TSI_NOT_FOUND; @@ -554,17 +555,30 @@ static tsi_result add_subject_alt_names_properties_to_peer( char ntop_buf[INET6_ADDRSTRLEN]; int af; +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + if (ASN1_STRING_length(subject_alt_name->d.iPAddress) == 4) { + af = AF_INET; + } else if (ASN1_STRING_length(subject_alt_name->d.iPAddress) == 16) { + af = AF_INET6; +#else if (subject_alt_name->d.iPAddress->length == 4) { af = AF_INET; } else if (subject_alt_name->d.iPAddress->length == 16) { af = AF_INET6; +#endif } else { LOG(ERROR) << "SAN IP Address contained invalid IP"; result = TSI_INTERNAL_ERROR; break; } +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + const char* name = + inet_ntop(af, ASN1_STRING_get0_data(subject_alt_name->d.iPAddress), + ntop_buf, INET6_ADDRSTRLEN); +#else const char* name = inet_ntop(af, subject_alt_name->d.iPAddress->data, ntop_buf, INET6_ADDRSTRLEN); +#endif if (name == nullptr) { LOG(ERROR) << "Could not get IP string from asn1 octet."; result = TSI_INTERNAL_ERROR; @@ -847,13 +861,13 @@ static tsi_result x509_store_load_certs(X509_STORE* cert_store, break; // We're at the end of stream. } if (root_names != nullptr) { - root_name = X509_get_subject_name(root); - if (root_name == nullptr) { + auto* root_subject = X509_get_subject_name(root); + if (root_subject == nullptr) { LOG(ERROR) << "Could not get name from root certificate."; result = TSI_INVALID_ARGUMENT; break; } - root_name = X509_NAME_dup(root_name); + root_name = X509_NAME_dup(const_cast(root_subject)); if (root_name == nullptr) { result = TSI_OUT_OF_RESOURCES; break; diff --git a/src/third_party/grpc/dist/src/core/tsi/ssl_transport_security_utils.cc b/src/third_party/grpc/dist/src/core/tsi/ssl_transport_security_utils.cc index 5c3b828..c59acd5 100644 --- a/src/third_party/grpc/dist/src/core/tsi/ssl_transport_security_utils.cc +++ b/src/third_party/grpc/dist/src/core/tsi/ssl_transport_security_utils.cc @@ -281,11 +281,11 @@ bool VerifyCrlCertIssuerNamesMatch(X509_CRL* crl, X509* cert) { if (cert == nullptr || crl == nullptr) { return false; } - X509_NAME* cert_issuer_name = X509_get_issuer_name(cert); + auto* cert_issuer_name = X509_get_issuer_name(cert); if (cert == nullptr) { return false; } - X509_NAME* crl_issuer_name = X509_CRL_get_issuer(crl); + auto* crl_issuer_name = X509_CRL_get_issuer(crl); if (crl_issuer_name == nullptr) { return false; } @@ -316,9 +316,9 @@ absl::StatusOr IssuerFromCert(X509* cert) { if (cert == nullptr) { return absl::InvalidArgumentError("cert cannot be null"); } - X509_NAME* issuer = X509_get_issuer_name(cert); + auto* issuer = X509_get_issuer_name(cert); unsigned char* buf = nullptr; - int len = i2d_X509_NAME(issuer, &buf); + int len = i2d_X509_NAME(const_cast(issuer), &buf); if (len < 0 || buf == nullptr) { return absl::InvalidArgumentError("could not read issuer name from cert"); } @@ -338,7 +338,8 @@ absl::StatusOr AkidFromCertificate(X509* cert) { if (X509_get_ext_by_NID(cert, NID_authority_key_identifier, j) != -1) { return absl::InvalidArgumentError("Could not get AKID from certificate."); } - akid = X509_EXTENSION_get_data(X509_get_ext(cert, j)); + akid = const_cast( + X509_EXTENSION_get_data(X509_get_ext(cert, j))); } else { return absl::InvalidArgumentError("Could not get AKID from certificate."); } @@ -363,7 +364,8 @@ absl::StatusOr AkidFromCrl(X509_CRL* crl) { if (X509_CRL_get_ext_by_NID(crl, NID_authority_key_identifier, j) != -1) { return absl::InvalidArgumentError("Could not get AKID from crl."); } - akid = X509_EXTENSION_get_data(X509_CRL_get_ext(crl, j)); + akid = const_cast( + X509_EXTENSION_get_data(X509_CRL_get_ext(crl, j))); } else { return absl::InvalidArgumentError("Could not get AKID from crl."); } -- 2.56.0