Const-correct a bunch more of <openssl/x509.h> Bug: 442860745 Change-Id: Ib5e4780c74378bbde5c6ca0c9a6e1efd881f72ae Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/81947 Auto-Submit: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com>
diff --git a/crypto/asn1/a_i2d_fp.cc b/crypto/asn1/a_i2d_fp.cc index fcde9fb..f583d35 100644 --- a/crypto/asn1/a_i2d_fp.cc +++ b/crypto/asn1/a_i2d_fp.cc
@@ -19,7 +19,7 @@ #include <openssl/mem.h> -int ASN1_item_i2d_fp(const ASN1_ITEM *it, FILE *out, void *x) { +int ASN1_item_i2d_fp(const ASN1_ITEM *it, FILE *out, const void *x) { BIO *b = BIO_new_fp(out, BIO_NOCLOSE); if (b == NULL) { OPENSSL_PUT_ERROR(ASN1, ERR_R_BUF_LIB); @@ -30,9 +30,10 @@ return ret; } -int ASN1_item_i2d_bio(const ASN1_ITEM *it, BIO *out, void *x) { +int ASN1_item_i2d_bio(const ASN1_ITEM *it, BIO *out, const void *x) { unsigned char *b = NULL; - int n = ASN1_item_i2d(reinterpret_cast<ASN1_VALUE *>(x), &b, it); + int n = ASN1_item_i2d(reinterpret_cast<ASN1_VALUE *>(const_cast<void *>(x)), + &b, it); if (b == NULL) { return 0; }
diff --git a/crypto/x509/t_crl.cc b/crypto/x509/t_crl.cc index aca2df0..b78404f 100644 --- a/crypto/x509/t_crl.cc +++ b/crypto/x509/t_crl.cc
@@ -21,7 +21,7 @@ #include <openssl/x509.h> -int X509_CRL_print_fp(FILE *fp, X509_CRL *x) { +int X509_CRL_print_fp(FILE *fp, const X509_CRL *x) { BIO *b = BIO_new_fp(fp, BIO_NOCLOSE); if (b == NULL) { OPENSSL_PUT_ERROR(X509, ERR_R_BUF_LIB); @@ -32,7 +32,7 @@ return ret; } -int X509_CRL_print(BIO *out, X509_CRL *x) { +int X509_CRL_print(BIO *out, const X509_CRL *x) { long version = X509_CRL_get_version(x); assert(X509_CRL_VERSION_1 <= version && version <= X509_CRL_VERSION_2); const X509_ALGOR *sig_alg; @@ -76,7 +76,9 @@ return 0; } - const STACK_OF(X509_REVOKED) *rev = X509_CRL_get_REVOKED(x); + // TODO(crbug.com/442860745): |X509_CRL_get_REVOKED| is not const-correct. + const STACK_OF(X509_REVOKED) *rev = + X509_CRL_get_REVOKED(const_cast<X509_CRL *>(x)); if (sk_X509_REVOKED_num(rev) > 0) { if (BIO_printf(out, "Revoked Certificates:\n") <= 0) { return 0;
diff --git a/crypto/x509/t_req.cc b/crypto/x509/t_req.cc index 5076e55..6852611 100644 --- a/crypto/x509/t_req.cc +++ b/crypto/x509/t_req.cc
@@ -24,7 +24,7 @@ #include "internal.h" -int X509_REQ_print_fp(FILE *fp, X509_REQ *x) { +int X509_REQ_print_fp(FILE *fp, const X509_REQ *x) { BIO *bio = BIO_new_fp(fp, BIO_NOCLOSE); if (bio == NULL) { OPENSSL_PUT_ERROR(X509, ERR_R_BUF_LIB); @@ -35,7 +35,7 @@ return ret; } -int X509_REQ_print_ex(BIO *bio, X509_REQ *x, unsigned long nmflags, +int X509_REQ_print_ex(BIO *bio, const X509_REQ *x, unsigned long nmflags, unsigned long cflag) { long l; STACK_OF(X509_ATTRIBUTE) *sk; @@ -52,7 +52,7 @@ nmindent = 16; } - X509_REQ_INFO *ri = x->req_info; + const X509_REQ_INFO *ri = x->req_info; if (!(cflag & X509_FLAG_NO_HEADER)) { if (BIO_write(bio, "Certificate Request:\n", 21) <= 0 || BIO_write(bio, " Data:\n", 10) <= 0) { @@ -106,8 +106,10 @@ } else { size_t i; for (i = 0; i < sk_X509_ATTRIBUTE_num(sk); i++) { + // TODO(crbug.com/442860745): |X509_ATTRIBUTE| accessors are not + // const-correct. X509_ATTRIBUTE *a = sk_X509_ATTRIBUTE_value(sk, i); - ASN1_OBJECT *aobj = X509_ATTRIBUTE_get0_object(a); + const ASN1_OBJECT *aobj = X509_ATTRIBUTE_get0_object(a); if (X509_REQ_extension_nid(OBJ_obj2nid(aobj))) { continue; @@ -131,7 +133,7 @@ for (j = 0; j < num_attrs; j++) { const ASN1_TYPE *at = X509_ATTRIBUTE_get0_type(a, j); const int type = at->type; - ASN1_BIT_STRING *bs = at->value.asn1_string; + const ASN1_BIT_STRING *bs = at->value.asn1_string; int k; for (k = 25 - obj_str_len; k > 0; k--) { @@ -146,7 +148,8 @@ if (type == V_ASN1_PRINTABLESTRING || type == V_ASN1_UTF8STRING || type == V_ASN1_IA5STRING || type == V_ASN1_T61STRING) { - if (BIO_write(bio, (char *)bs->data, bs->length) != bs->length) { + if (BIO_write(bio, (const char *)bs->data, bs->length) != + bs->length) { goto err; } BIO_puts(bio, "\n"); @@ -198,6 +201,6 @@ return 0; } -int X509_REQ_print(BIO *bio, X509_REQ *req) { +int X509_REQ_print(BIO *bio, const X509_REQ *req) { return X509_REQ_print_ex(bio, req, XN_FLAG_COMPAT, X509_FLAG_COMPAT); }
diff --git a/crypto/x509/t_x509.cc b/crypto/x509/t_x509.cc index 94d64f7..d21256b 100644 --- a/crypto/x509/t_x509.cc +++ b/crypto/x509/t_x509.cc
@@ -26,7 +26,7 @@ #include "internal.h" -int X509_print_ex_fp(FILE *fp, X509 *x, unsigned long nmflag, +int X509_print_ex_fp(FILE *fp, const X509 *x, unsigned long nmflag, unsigned long cflag) { BIO *b = BIO_new_fp(fp, BIO_NOCLOSE); if (b == NULL) { @@ -38,15 +38,15 @@ return ret; } -int X509_print_fp(FILE *fp, X509 *x) { +int X509_print_fp(FILE *fp, const X509 *x) { return X509_print_ex_fp(fp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT); } -int X509_print(BIO *bp, X509 *x) { +int X509_print(BIO *bp, const X509 *x) { return X509_print_ex(bp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT); } -int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, +int X509_print_ex(BIO *bp, const X509 *x, unsigned long nmflags, unsigned long cflag) { char mlch = ' '; int nmindent = 0; @@ -130,13 +130,13 @@ if (BIO_write(bp, " Not Before: ", 24) <= 0) { return 0; } - if (!ASN1_TIME_print(bp, X509_get_notBefore(x))) { + if (!ASN1_TIME_print(bp, X509_get0_notBefore(x))) { return 0; } if (BIO_write(bp, "\n Not After : ", 25) <= 0) { return 0; } - if (!ASN1_TIME_print(bp, X509_get_notAfter(x))) { + if (!ASN1_TIME_print(bp, X509_get0_notAfter(x))) { return 0; } if (BIO_write(bp, "\n", 1) <= 0) {
diff --git a/crypto/x509/x_all.cc b/crypto/x509/x_all.cc index 9167aa6..985a1e4 100644 --- a/crypto/x509/x_all.cc +++ b/crypto/x509/x_all.cc
@@ -122,7 +122,7 @@ ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl)); } -int i2d_X509_CRL_fp(FILE *fp, X509_CRL *crl) { +int i2d_X509_CRL_fp(FILE *fp, const X509_CRL *crl) { return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl); } @@ -131,7 +131,7 @@ ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl)); } -int i2d_X509_CRL_bio(BIO *bp, X509_CRL *crl) { +int i2d_X509_CRL_bio(BIO *bp, const X509_CRL *crl) { return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl); } @@ -140,7 +140,7 @@ ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_REQ), fp, req)); } -int i2d_X509_REQ_fp(FILE *fp, X509_REQ *req) { +int i2d_X509_REQ_fp(FILE *fp, const X509_REQ *req) { return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509_REQ), fp, req); } @@ -149,7 +149,7 @@ ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_REQ), bp, req)); } -int i2d_X509_REQ_bio(BIO *bp, X509_REQ *req) { +int i2d_X509_REQ_bio(BIO *bp, const X509_REQ *req) { return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509_REQ), bp, req); } @@ -166,7 +166,7 @@ } #define IMPLEMENT_I2D_FP(type, name, bio_func) \ - int name(FILE *fp, type *obj) { \ + int name(FILE *fp, const type *obj) { \ BIO *bio = BIO_new_fp(fp, BIO_NOCLOSE); \ if (bio == NULL) { \ return 0; \ @@ -202,7 +202,7 @@ } #define IMPLEMENT_I2D_BIO(type, name, i2d_func) \ - int name(BIO *bio, type *obj) { \ + int name(BIO *bio, const type *obj) { \ uint8_t *data = NULL; \ int len = i2d_func(obj, &data); \ if (len < 0) { \ @@ -301,7 +301,7 @@ IMPLEMENT_I2D_FP(PKCS8_PRIV_KEY_INFO, i2d_PKCS8_PRIV_KEY_INFO_fp, i2d_PKCS8_PRIV_KEY_INFO_bio) -int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, EVP_PKEY *key) { +int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, const EVP_PKEY *key) { PKCS8_PRIV_KEY_INFO *p8inf; int ret; p8inf = EVP_PKEY2PKCS8(key); @@ -343,4 +343,4 @@ IMPLEMENT_I2D_BIO(EVP_PKEY, i2d_PUBKEY_bio, i2d_PUBKEY) IMPLEMENT_D2I_BIO(DH, d2i_DHparams_bio, d2i_DHparams) -IMPLEMENT_I2D_BIO(const DH, i2d_DHparams_bio, i2d_DHparams) +IMPLEMENT_I2D_BIO(DH, i2d_DHparams_bio, i2d_DHparams)
diff --git a/include/openssl/asn1.h b/include/openssl/asn1.h index ada13f4..7a251b5 100644 --- a/include/openssl/asn1.h +++ b/include/openssl/asn1.h
@@ -331,8 +331,10 @@ // // These functions may not be used with |ASN1_ITEM|s whose C type is // |ASN1_BOOLEAN|. -OPENSSL_EXPORT int ASN1_item_i2d_fp(const ASN1_ITEM *it, FILE *out, void *in); -OPENSSL_EXPORT int ASN1_item_i2d_bio(const ASN1_ITEM *it, BIO *out, void *in); +OPENSSL_EXPORT int ASN1_item_i2d_fp(const ASN1_ITEM *it, FILE *out, + const void *in); +OPENSSL_EXPORT int ASN1_item_i2d_bio(const ASN1_ITEM *it, BIO *out, + const void *in); // ASN1_item_unpack parses |oct|'s contents as |it|'s ASN.1 type. It returns a // newly-allocated instance of |it|'s C type on success, or NULL on error.
diff --git a/include/openssl/x509.h b/include/openssl/x509.h index fb61dee..ca3942d 100644 --- a/include/openssl/x509.h +++ b/include/openssl/x509.h
@@ -4003,40 +4003,40 @@ // returns one on success and zero on error. |nmflags| is the flags parameter // for |X509_NAME_print_ex| when printing the subject and issuer. |cflag| should // be some combination of the |X509_FLAG_*| and |X509V3_EXT_*| constants. -OPENSSL_EXPORT int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflag, +OPENSSL_EXPORT int X509_print_ex(BIO *bp, const X509 *x, unsigned long nmflag, unsigned long cflag); // X509_print_ex_fp behaves like |X509_print_ex| but writes to |fp|. -OPENSSL_EXPORT int X509_print_ex_fp(FILE *fp, X509 *x, unsigned long nmflag, - unsigned long cflag); +OPENSSL_EXPORT int X509_print_ex_fp(FILE *fp, const X509 *x, + unsigned long nmflag, unsigned long cflag); // X509_print calls |X509_print_ex| with |XN_FLAG_COMPAT| and |X509_FLAG_COMPAT| // flags. -OPENSSL_EXPORT int X509_print(BIO *bp, X509 *x); +OPENSSL_EXPORT int X509_print(BIO *bp, const X509 *x); // X509_print_fp behaves like |X509_print| but writes to |fp|. -OPENSSL_EXPORT int X509_print_fp(FILE *fp, X509 *x); +OPENSSL_EXPORT int X509_print_fp(FILE *fp, const X509 *x); // X509_CRL_print writes a human-readable representation of |x| to |bp|. It // returns one on success and zero on error. -OPENSSL_EXPORT int X509_CRL_print(BIO *bp, X509_CRL *x); +OPENSSL_EXPORT int X509_CRL_print(BIO *bp, const X509_CRL *x); // X509_CRL_print_fp behaves like |X509_CRL_print| but writes to |fp|. -OPENSSL_EXPORT int X509_CRL_print_fp(FILE *fp, X509_CRL *x); +OPENSSL_EXPORT int X509_CRL_print_fp(FILE *fp, const X509_CRL *x); // X509_REQ_print_ex writes a human-readable representation of |x| to |bp|. It // returns one on success and zero on error. |nmflags| is the flags parameter // for |X509_NAME_print_ex|, when printing the subject. |cflag| should be some // combination of the |X509_FLAG_*| and |X509V3_EXT_*| constants. -OPENSSL_EXPORT int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflag, - unsigned long cflag); +OPENSSL_EXPORT int X509_REQ_print_ex(BIO *bp, const X509_REQ *x, + unsigned long nmflag, unsigned long cflag); // X509_REQ_print calls |X509_REQ_print_ex| with |XN_FLAG_COMPAT| and // |X509_FLAG_COMPAT| flags. -OPENSSL_EXPORT int X509_REQ_print(BIO *bp, X509_REQ *req); +OPENSSL_EXPORT int X509_REQ_print(BIO *bp, const X509_REQ *req); // X509_REQ_print_fp behaves like |X509_REQ_print| but writes to |fp|. -OPENSSL_EXPORT int X509_REQ_print_fp(FILE *fp, X509_REQ *req); +OPENSSL_EXPORT int X509_REQ_print_fp(FILE *fp, const X509_REQ *req); // The following flags are control |X509_NAME_print_ex|. They must not collide // with |ASN1_STRFLGS_*|. @@ -4255,21 +4255,21 @@ // functions, but write the result to |bp|. They return one on success and zero // on error. Callers using them with memory |BIO|s to encode structures to // memory should use |i2d_*| directly instead. -OPENSSL_EXPORT int i2d_X509_bio(BIO *bp, X509 *x509); -OPENSSL_EXPORT int i2d_X509_CRL_bio(BIO *bp, X509_CRL *crl); -OPENSSL_EXPORT int i2d_X509_REQ_bio(BIO *bp, X509_REQ *req); -OPENSSL_EXPORT int i2d_RSAPrivateKey_bio(BIO *bp, RSA *rsa); -OPENSSL_EXPORT int i2d_RSAPublicKey_bio(BIO *bp, RSA *rsa); -OPENSSL_EXPORT int i2d_RSA_PUBKEY_bio(BIO *bp, RSA *rsa); -OPENSSL_EXPORT int i2d_DSA_PUBKEY_bio(BIO *bp, DSA *dsa); -OPENSSL_EXPORT int i2d_DSAPrivateKey_bio(BIO *bp, DSA *dsa); -OPENSSL_EXPORT int i2d_EC_PUBKEY_bio(BIO *bp, EC_KEY *eckey); -OPENSSL_EXPORT int i2d_ECPrivateKey_bio(BIO *bp, EC_KEY *eckey); -OPENSSL_EXPORT int i2d_PKCS8_bio(BIO *bp, X509_SIG *p8); -OPENSSL_EXPORT int i2d_PKCS8_PRIV_KEY_INFO_bio(BIO *bp, - PKCS8_PRIV_KEY_INFO *p8inf); -OPENSSL_EXPORT int i2d_PrivateKey_bio(BIO *bp, EVP_PKEY *pkey); -OPENSSL_EXPORT int i2d_PUBKEY_bio(BIO *bp, EVP_PKEY *pkey); +OPENSSL_EXPORT int i2d_X509_bio(BIO *bp, const X509 *x509); +OPENSSL_EXPORT int i2d_X509_CRL_bio(BIO *bp, const X509_CRL *crl); +OPENSSL_EXPORT int i2d_X509_REQ_bio(BIO *bp, const X509_REQ *req); +OPENSSL_EXPORT int i2d_RSAPrivateKey_bio(BIO *bp, const RSA *rsa); +OPENSSL_EXPORT int i2d_RSAPublicKey_bio(BIO *bp, const RSA *rsa); +OPENSSL_EXPORT int i2d_RSA_PUBKEY_bio(BIO *bp, const RSA *rsa); +OPENSSL_EXPORT int i2d_DSA_PUBKEY_bio(BIO *bp, const DSA *dsa); +OPENSSL_EXPORT int i2d_DSAPrivateKey_bio(BIO *bp, const DSA *dsa); +OPENSSL_EXPORT int i2d_EC_PUBKEY_bio(BIO *bp, const EC_KEY *eckey); +OPENSSL_EXPORT int i2d_ECPrivateKey_bio(BIO *bp, const EC_KEY *eckey); +OPENSSL_EXPORT int i2d_PKCS8_bio(BIO *bp, const X509_SIG *p8); +OPENSSL_EXPORT int i2d_PKCS8_PRIV_KEY_INFO_bio( + BIO *bp, const PKCS8_PRIV_KEY_INFO *p8inf); +OPENSSL_EXPORT int i2d_PrivateKey_bio(BIO *bp, const EVP_PKEY *pkey); +OPENSSL_EXPORT int i2d_PUBKEY_bio(BIO *bp, const EVP_PKEY *pkey); OPENSSL_EXPORT int i2d_DHparams_bio(BIO *bp, const DH *dh); // i2d_PKCS8PrivateKeyInfo_bio encodes |key| as a PKCS#8 PrivateKeyInfo @@ -4297,22 +4297,22 @@ // The following functions behave like the corresponding |i2d_*_bio| functions, // but write to |fp| instead. -OPENSSL_EXPORT int i2d_X509_fp(FILE *fp, X509 *x509); -OPENSSL_EXPORT int i2d_X509_CRL_fp(FILE *fp, X509_CRL *crl); -OPENSSL_EXPORT int i2d_X509_REQ_fp(FILE *fp, X509_REQ *req); -OPENSSL_EXPORT int i2d_RSAPrivateKey_fp(FILE *fp, RSA *rsa); -OPENSSL_EXPORT int i2d_RSAPublicKey_fp(FILE *fp, RSA *rsa); -OPENSSL_EXPORT int i2d_RSA_PUBKEY_fp(FILE *fp, RSA *rsa); -OPENSSL_EXPORT int i2d_DSA_PUBKEY_fp(FILE *fp, DSA *dsa); -OPENSSL_EXPORT int i2d_DSAPrivateKey_fp(FILE *fp, DSA *dsa); -OPENSSL_EXPORT int i2d_EC_PUBKEY_fp(FILE *fp, EC_KEY *eckey); -OPENSSL_EXPORT int i2d_ECPrivateKey_fp(FILE *fp, EC_KEY *eckey); -OPENSSL_EXPORT int i2d_PKCS8_fp(FILE *fp, X509_SIG *p8); +OPENSSL_EXPORT int i2d_X509_fp(FILE *fp, const X509 *x509); +OPENSSL_EXPORT int i2d_X509_CRL_fp(FILE *fp, const X509_CRL *crl); +OPENSSL_EXPORT int i2d_X509_REQ_fp(FILE *fp, const X509_REQ *req); +OPENSSL_EXPORT int i2d_RSAPrivateKey_fp(FILE *fp, const RSA *rsa); +OPENSSL_EXPORT int i2d_RSAPublicKey_fp(FILE *fp, const RSA *rsa); +OPENSSL_EXPORT int i2d_RSA_PUBKEY_fp(FILE *fp, const RSA *rsa); +OPENSSL_EXPORT int i2d_DSA_PUBKEY_fp(FILE *fp, const DSA *dsa); +OPENSSL_EXPORT int i2d_DSAPrivateKey_fp(FILE *fp, const DSA *dsa); +OPENSSL_EXPORT int i2d_EC_PUBKEY_fp(FILE *fp, const EC_KEY *eckey); +OPENSSL_EXPORT int i2d_ECPrivateKey_fp(FILE *fp, const EC_KEY *eckey); +OPENSSL_EXPORT int i2d_PKCS8_fp(FILE *fp, const X509_SIG *p8); OPENSSL_EXPORT int i2d_PKCS8_PRIV_KEY_INFO_fp(FILE *fp, - PKCS8_PRIV_KEY_INFO *p8inf); -OPENSSL_EXPORT int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, EVP_PKEY *key); -OPENSSL_EXPORT int i2d_PrivateKey_fp(FILE *fp, EVP_PKEY *pkey); -OPENSSL_EXPORT int i2d_PUBKEY_fp(FILE *fp, EVP_PKEY *pkey); + const PKCS8_PRIV_KEY_INFO *p8inf); +OPENSSL_EXPORT int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, const EVP_PKEY *key); +OPENSSL_EXPORT int i2d_PrivateKey_fp(FILE *fp, const EVP_PKEY *pkey); +OPENSSL_EXPORT int i2d_PUBKEY_fp(FILE *fp, const EVP_PKEY *pkey); // X509_find_by_issuer_and_serial returns the first |X509| in |sk| whose issuer // and serial are |name| and |serial|, respectively. If no match is found, it