UTIL_cmp_timeframe(): improve workaround for deprecations in OpenSSL 4.0#71
UTIL_cmp_timeframe(): improve workaround for deprecations in OpenSSL 4.0#71
UTIL_cmp_timeframe(): improve workaround for deprecations in OpenSSL 4.0#71Conversation
There was a problem hiding this comment.
Pull request overview
This PR improves the workaround for OpenSSL 4.0 API deprecations by implementing a cleaner solution for time comparison. Instead of the previous workaround that created dummy X509 certificates, the new implementation directly converts ASN1_TIME to POSIX time using OpenSSL 4.0's new OPENSSL_tm_to_posix() function. The changes consolidate the code by removing the intermediate OpenSSL 3.0-4.0 branch and updating documentation to clarify behavior with invalid times.
Changes:
- Implemented new helper functions
ASN1_TIME_to_posix()andX509_cmp_time_new()for OpenSSL 4.0+ - Removed the old workaround using dummy X509 certificates for OpenSSL 4.0
- Updated documentation to clarify that null or invalid times are not checked
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| src/libsecutils/src/credentials/cert.c | Implements new time comparison functions for OpenSSL 4.0+ and updates UTIL_cmp_timeframe to use unified logic |
| src/libsecutils/include/secutils/credentials/cert.h | Updates documentation comment to clarify behavior with invalid times |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
DDvO
force-pushed
the
improve_UTIL_cmp_timeframe_v4.0
branch
from
c5d1694 to
a8524fa
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
DDvO
force-pushed
the
improve_UTIL_cmp_timeframe_v4.0
branch
from
a8524fa to
92c199f
Compare
This is a follow-up on #70.
Finally, the related OpenSSL issue has been discussed further, just before the v 4.0 code freeze deadline.
The outcome was not exactly what I suggested, but at least here is an improved workaround for the deprecation of
X509_cmp_timeframe()andX509_cmp_time().