Re: Grab bag of smaller OpenSSL fixups

On 7/13/26 16:16, Daniel Gustafsson wrote:
> I've been collecting a few small fixups to the OpenSSL code and figured it was
> time to send them over to keep the number of fixes more manageable.

Nice!

> * 0001: Remove the use of static variable to not interfere with the future
> multithreading efforts

Looks good!

> * 0002: Replace SSLv23_method with TLS_method, it has been an alias to the new
> name since 2015 in OpenSSL

Looks good!

> * 0003: Replace deprecated API X509_NAME_get_text_by_NID with the recommended
> alternative X509_NAME_get_index_by_NID + X509_NAME_get_entry. The API was
> deprecated in OpenSSL 4 and risk getting removed, with the alternatives being
> available in all supported versions.

You should declare entry in the inner scope, not in the function scope.

The comment should maybe also add that entry and peer_cn_asn1 too are
OpenSSL owned pointers. Just saying it for peer_cn_internal seems a bit
odd to me.

Also this is subjective but I am not personally a fan of
MemoryContextAllocZero() + memcpy(). I prefer MemoryContextAlloc() +
memcpy() + peer_cn[len] = 0. I feel that explains better what is going
on. I have also seen us use strncpy() for this purpose which I guess
works too.

> * 0004: Fix TLS protocol detection. We have been using the wrong macro for
> feature test for a long time, replace with the actual feature test macro.
> (There is no protocol downgrade here, it will error out when misconfiguring).

Looks good! That was a funny and easy to make mistake :)

--
Andreas Karlsson
Percona