On 7/13/26 16:16, Daniel Gustafsson wrote:
> I've been collecting a few small fixups to the OpenSSL code and figured it was
> time to send them over to keep the number of fixes more manageable.
Nice!
> * 0001: Remove the use of static variable to not interfere with the future
> multithreading efforts
Looks good!
> * 0002: Replace SSLv23_method with TLS_method, it has been an alias to the new
> name since 2015 in OpenSSL
Looks good!
> * 0003: Replace deprecated API X509_NAME_get_text_by_NID with the recommended
> alternative X509_NAME_get_index_by_NID + X509_NAME_get_entry. The API was
> deprecated in OpenSSL 4 and risk getting removed, with the alternatives being
> available in all supported versions.
You should declare entry in the inner scope, not in the function scope.
The comment should maybe also add that entry and peer_cn_asn1 too are
OpenSSL owned pointers. Just saying it for peer_cn_internal seems a bit
odd to me.
Also this is subjective but I am not personally a fan of
MemoryContextAllocZero() + memcpy(). I prefer MemoryContextAlloc() +
memcpy() + peer_cn[len] = 0. I feel that explains better what is going
on. I have also seen us use strncpy() for this purpose which I guess
works too.
> * 0004: Fix TLS protocol detection. We have been using the wrong macro for
> feature test for a long time, replace with the actual feature test macro.
> (There is no protocol downgrade here, it will error out when misconfiguring).
Looks good! That was a funny and easy to make mistake :)
--
Andreas Karlsson
Percona
