https://bugs.openldap.org/show_bug.cgi?id=10498
Issue ID: 10498 Summary: libldap OpenSSL 4 compatibility Product: OpenLDAP Version: 2.6.13 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs@openldap.org Reporter: rainer.jung@kippdata.de Target Milestone: ---
Created attachment 1145 --> https://bugs.openldap.org/attachment.cgi?id=1145&action=edit Patch for libldap OpenSSL 4 compatibility
libldap uses direct access to struct members made opaque in OpenSSL 4. Alternative getter methods needed to access the struct members seem to be available since OpenSSL 1.1.0, so very long ago. I suggest the attached (trivial) patch to replace direct access with getter methods.
The patch is based on OpenLDAP 2.6.13. From visual code inspection it seems the problem also exists in the master branch.
I did not try to compile the rest of OpenLDAP with OpenSSL 4, just libldap.
https://bugs.openldap.org/show_bug.cgi?id=10498
Quanah Gibson-Mount quanah@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Keywords|needs_review | Assignee|bugs@openldap.org |hyc@openldap.org Target Milestone|--- |2.6.14
https://bugs.openldap.org/show_bug.cgi?id=10498
Howard Chu hyc@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |RESOLVED Resolution|--- |TEST
--- Comment #1 from Howard Chu hyc@openldap.org --- Fixed in master a599597cb3cb6d36f888bffcbd0b010a644b92c5
https://bugs.openldap.org/show_bug.cgi?id=10498
--- Comment #2 from Simon Pichugin simon.pichugin@gmail.com --- Created attachment 1148 --> https://bugs.openldap.org/attachment.cgi?id=1148&action=edit libldap: more const-correctness for OpenSSL 4
Hi Howard and Rainer,
I tested a599597cb3 against OpenSSL 4. The CN block now builds cleanly. There are still a few related warnings in tls_o.c and autoca.c from the same underlying API change: several X509 getters now return const, and some locals weren't updated to match.
The attached patch covers:
tls_o.c: const-qualify the affected locals in tlso_ca_list, tlso_session_my_dn, tlso_session_peer_dn, the SAN and CN blocks of tlso_session_chkhost, and tlso_verify_cb.
autoca.c: guard the local X509_get_notBefore and X509_get_notAfter macros with #ifndef (OpenSSL 4 defines them itself now), and const-qualify issuer_name.
It's const additions plus one #ifndef guard, no behavior change. I tested the build on Fedora with our 389 Directory Server - all good!
Thanks, Simon
https://bugs.openldap.org/show_bug.cgi?id=10498
--- Comment #3 from Howard Chu hyc@openldap.org --- Comment on attachment 1148 --> https://bugs.openldap.org/attachment.cgi?id=1148 libldap: more const-correctness for OpenSSL 4
Thanks for the patch. It's noisy on OpenSSL 3.0.13 though:
libtool: compile: cc -g -O2 -I../../include -I../../../head/include -DLDAP_LIBRARY -c ../../../head/libraries/libldap/tls_o.c -fPIC -DPIC -o .libs/tls_o.o ../../../head/libraries/libldap/tls_o.c: In function ‘tlso_session_chkhost’: ../../../head/libraries/libldap/tls_o.c:1044:38: warning: passing argument 1 of ‘X509V3_EXT_d2i’ discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] 1044 | alt = X509V3_EXT_d2i(ex); | ^~ In file included from ../../../head/libraries/libldap/tls_o.c:42: /usr/include/openssl/x509v3.h:951:38: note: expected ‘X509_EXTENSION *’ {aka ‘struct X509_extension_st *’} but argument is of type ‘const X509_EXTENSION *’ {aka ‘const struct X509_extension_st *’} 951 | void *X509V3_EXT_d2i(X509_EXTENSION *ext); | ~~~~~~~~~~~~~~~~^~~
https://bugs.openldap.org/show_bug.cgi?id=10498
--- Comment #4 from Howard Chu hyc@openldap.org --- More in https://git.openldap.org/openldap/openldap/-/merge_requests/873
These gratuitous const qualifiers don't make the code more robust and certainly make it the opposite of useful.
https://bugs.openldap.org/show_bug.cgi?id=10498
--- Comment #5 from Simon Pichugin simon.pichugin@gmail.com --- Thanks Howard for the follow up, and thanks Ondřej and Quanah for the review and merge! And the follow-up fix is a reasonable compromise given X509V3_EXT_d2i and X509_NAME_dup take non-const on both OpenSSL 3 and 4 :)
https://bugs.openldap.org/show_bug.cgi?id=10498
--- Comment #6 from Quanah Gibson-Mount quanah@openldap.org --- head:
• a599597c by Howard Chu at 2026-04-28T16:49:32+01:00 ITS#10498 libldap: fix for OpenSSL 4 compatibility
• 75b624f4 by Simon Pichugin at 2026-05-03T12:57:45+01:00 ITS#10498 libldap: more const-correctness for OpenSSL 4
• a7043734 by Howard Chu at 2026-05-04T15:35:20+01:00 ITS#10498 libldap: silence a couple more warnings
RE26:
• 8db14ac8 by Howard Chu at 2026-05-06T17:56:37+00:00 ITS#10498 libldap: fix for OpenSSL 4 compatibility
-
openldap-its＠openldap.org