From: William Lallemand <wlallemand@haproxy.com>
Date: Fri, 11 Sep 2026 10:04:30 +0000 (+0000)
Subject: BUILD: ssl: ASN1_STRING_length() is deprecated since OpenSSL 4.1
X-Git-Tag: v3.5-dev7~25
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=c72ba29a621e405003ec718b396c6a83fd946eb7;p=haproxy.git

BUILD: ssl: ASN1_STRING_length() is deprecated since OpenSSL 4.1

OpenSSL 4.1.0-alpha1 deprecates ASN1_STRING_length() in favor of
ASN1_STRING_get_length(), which only differs by returning a size_t
instead of an int. This breaks the build when warnings are fatal:

  src/ssl_sock.c:4655:9: error: 'ASN1_STRING_length' is deprecated: Since OpenSSL 4.1; use ASN1_STRING_get_length() [-Werror=deprecated-declarations]

Let's simply remap the old name on the new function when built with
OpenSSL 4.1 and above, all the call places being compatible with both
return types.

This could be backported to all versions where we want to support
OpenSSL 4.1.
---

diff --git a/include/haproxy/openssl-compat.h b/include/haproxy/openssl-compat.h
index 8ffeebaba..25a8f3ccc 100644
--- a/include/haproxy/openssl-compat.h
+++ b/include/haproxy/openssl-compat.h
@@ -412,6 +412,12 @@ static inline unsigned long ERR_peek_error_func(const char **func)
 #define __X509_NAME_CONST__
 #endif
 
+/* ASN1_STRING_length() was deprecated in OpenSSL 4.1 */
+#if (HA_OPENSSL_VERSION_NUMBER >= 0x40100000L) && !defined(OPENSSL_IS_AWSLC) && \
+    !defined(LIBRESSL_VERSION_NUMBER) && !defined(USE_OPENSSL_WOLFSSL)
+#define ASN1_STRING_length(x) ASN1_STRING_get_length(x)
+#endif
+
 /* ERR_remove_state() was deprecated in 1.0.0 in favor of
  * ERR_remove_thread_state(), which was in turn deprecated in
  * 1.1.0 and does nothing anymore. Let's simply silently kill