commit 84311cec95da26b3a9f81eb073e6d4336e04ccf5
author David Benjamin <davidben@google.com> Sun Jul 10 01:01:13 2022 -0400
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> Fri Jul 15 17:22:14 2022 +0000
tree edb3176f950f60caa47171ce704e9c9d128066c3
parent 892b9bc658f4e5e5989bb62b8c1356f3550e96a2

Const-correct X509_REVOKED as well.

Although it contains an X509_NAME (by way of GENERAL_NAME), the
GENERAL_NAME field does not participate in serialization, so it is
actually const.

Bug: 407
Change-Id: I299815789744597e2b355cb0b996ba90c3b6a72f
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/53334
Reviewed-by: Bob Beck <bbe@google.com>
Commit-Queue: David Benjamin <davidben@google.com>

crypto/x509/x_crl.c

diff --git a/crypto/x509/x_crl.c b/crypto/x509/x_crl.c
index f65afba..a8e6c74 100644
--- a/crypto/x509/x_crl.c
+++ b/crypto/x509/x_crl.c
@@ -348,9 +348,11 @@
     ASN1_SIMPLE(X509_CRL, signature, ASN1_BIT_STRING),
 } ASN1_SEQUENCE_END_ref(X509_CRL, X509_CRL)
 
-IMPLEMENT_ASN1_FUNCTIONS(X509_REVOKED)
-
-IMPLEMENT_ASN1_DUP_FUNCTION(X509_REVOKED)
+// Although |X509_REVOKED| contains an |X509_NAME|, it can be const. It is not
+// affected by https://crbug.com/boringssl/407 because the  |X509_NAME| does
+// not participate in serialization.
+IMPLEMENT_ASN1_FUNCTIONS_const(X509_REVOKED)
+IMPLEMENT_ASN1_DUP_FUNCTION_const(X509_REVOKED)
 
 IMPLEMENT_ASN1_FUNCTIONS(X509_CRL_INFO)
 IMPLEMENT_ASN1_FUNCTIONS(X509_CRL)

include/openssl/x509.h

diff --git a/include/openssl/x509.h b/include/openssl/x509.h
index 453fb0b..cbb2f67 100644
--- a/include/openssl/x509.h
+++ b/include/openssl/x509.h
@@ -1551,7 +1551,7 @@
 OPENSSL_EXPORT X509_ATTRIBUTE *X509_ATTRIBUTE_dup(const X509_ATTRIBUTE *xa);
 OPENSSL_EXPORT X509_EXTENSION *X509_EXTENSION_dup(const X509_EXTENSION *ex);
 OPENSSL_EXPORT X509_CRL *X509_CRL_dup(X509_CRL *crl);
-OPENSSL_EXPORT X509_REVOKED *X509_REVOKED_dup(X509_REVOKED *rev);
+OPENSSL_EXPORT X509_REVOKED *X509_REVOKED_dup(const X509_REVOKED *rev);
 OPENSSL_EXPORT X509_REQ *X509_REQ_dup(X509_REQ *req);
 OPENSSL_EXPORT X509_ALGOR *X509_ALGOR_dup(const X509_ALGOR *xn);
 
@@ -1622,9 +1622,7 @@
 
 OPENSSL_EXPORT int X509_TRUST_set(int *t, int trust);
 
-// TODO(https://crbug.com/boringssl/407): This is not const because it contains
-// an |X509_NAME|.
-DECLARE_ASN1_FUNCTIONS(X509_REVOKED)
+DECLARE_ASN1_FUNCTIONS_const(X509_REVOKED)
 
 OPENSSL_EXPORT int X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev);
 OPENSSL_EXPORT int X509_CRL_get0_by_serial(X509_CRL *crl, X509_REVOKED **ret,