imap-send: use the OpenSSL API to access the subject common name
The OpenSSL 4.0 master branch has deprecated the X509_NAME_get_text_by_NID function. Use the recommended replacement APIs instead. They have existed since OpenSSL v1.1.0. Take care to get the constness right for pre-4.0 versions. Signed-off-by: Beat Bolli <dev+git@drbeat.li> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Beat Bolli committed
Mar 11, 2026 at 23:10 UTC
08fd302fc4b8eaf0bb32856231a5fb46430e3c7e
1 file changed
+12
-5
imap-send.c
+12
-5
@@ -233,9 +233,13 @@ static int host_matches(const char *host, const char *pattern)
233
234
static int verify_hostname(X509 *cert, const char *hostname)
235
{
236
- int len;
236
+#if (OPENSSL_VERSION_NUMBER >= 0x40000000L)
237
+ const X509_NAME *subj;
238
+#else
239
X509_NAME *subj;
238
- char cname[1000];
240
+#endif
241
+ const X509_NAME_ENTRY *cname_entry;
242
+ const ASN1_STRING *cname;
243
int i, found;
244
STACK_OF(GENERAL_NAME) *subj_alt_names;
245
@@ -262,12 +266,15 @@ static int verify_hostname(X509 *cert, const char *hostname)
266
/* try the common name */
267
if (!(subj = X509_get_subject_name(cert)))
268
return error("cannot get certificate subject");
265
- if ((len = X509_NAME_get_text_by_NID(subj, NID_commonName, cname, sizeof(cname))) < 0)
269
+ if ((i = X509_NAME_get_index_by_NID(subj, NID_commonName, -1)) < 0 ||
270
+ (cname_entry = X509_NAME_get_entry(subj, i)) == NULL ||
271
+ (cname = X509_NAME_ENTRY_get_data(cname_entry)) == NULL)
272
return error("cannot get certificate common name");
267
- if (strlen(cname) == (size_t)len && host_matches(hostname, cname))
273
+ if (strlen((const char *)ASN1_STRING_get0_data(cname)) == ASN1_STRING_length(cname) &&
274
+ host_matches(hostname, (const char *)ASN1_STRING_get0_data(cname)))
275
return 0;
276
return error("certificate owner '%s' does not match hostname '%s'",
270
- cname, hostname);
277
+ ASN1_STRING_get0_data(cname), hostname);
278
}
279
280
static int ssl_socket_connect(struct imap_socket *sock,