imap-send: use the OpenSSL API to access the subject common name
The OpenSSL 4.0 master branch has deprecated the X509_NAME_get_text_by_NID function. Use the recommended replacement APIs instead. They have existed since OpenSSL v1.1.0. Take care to get the constness right for pre-4.0 versions. Signed-off-by: Beat Bolli <dev+git@drbeat.li> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Beat Bolli committed
Mar 11, 2026 at 23:10 UTC
08fd302fc4b8eaf0bb32856231a5fb46430e3c7e
1 file changed
+12
-5
imap-send.c
+12
-5
index 1c934c2487..2a904314dd 100644
--- a/imap-send.c
+++ b/imap-send.c
@@ -233,9 +233,13 @@ static int host_matches(const char *host, const char *pattern)
static int verify_hostname(X509 *cert, const char *hostname)
{
- int len;
+#if (OPENSSL_VERSION_NUMBER >= 0x40000000L)
+ const X509_NAME *subj;
+#else
X509_NAME *subj;
- char cname[1000];
+#endif
+ const X509_NAME_ENTRY *cname_entry;
+ const ASN1_STRING *cname;
int i, found;
STACK_OF(GENERAL_NAME) *subj_alt_names;
@@ -262,12 +266,15 @@ static int verify_hostname(X509 *cert, const char *hostname)
/* try the common name */
if (!(subj = X509_get_subject_name(cert)))
return error("cannot get certificate subject");
- if ((len = X509_NAME_get_text_by_NID(subj, NID_commonName, cname, sizeof(cname))) < 0)
+ if ((i = X509_NAME_get_index_by_NID(subj, NID_commonName, -1)) < 0 ||
+ (cname_entry = X509_NAME_get_entry(subj, i)) == NULL ||
+ (cname = X509_NAME_ENTRY_get_data(cname_entry)) == NULL)
return error("cannot get certificate common name");
- if (strlen(cname) == (size_t)len && host_matches(hostname, cname))
+ if (strlen((const char *)ASN1_STRING_get0_data(cname)) == ASN1_STRING_length(cname) &&
+ host_matches(hostname, (const char *)ASN1_STRING_get0_data(cname)))
return 0;
return error("certificate owner '%s' does not match hostname '%s'",
- cname, hostname);
+ ASN1_STRING_get0_data(cname), hostname);
}
static int ssl_socket_connect(struct imap_socket *sock,