Attached the patch this time. -- Karl
On Wed, Jul 22, 2026 at 12:37 PM Karl Smeltzer <[email protected]> wrote: > > I ran into this FTBFS as well and have a patch that replaces direct > access on the opaque struts and keeps the old behavior under > HAVE_OLD_OPENSSL. I didn't fix any of the warnings, but hopefully this > will get the package working again. > > The patch has also been forwarded upstream: > https://github.com/cisco/libest/pull/136 > > -- > Karl
Subject: Use accessors for opaque ASN1_STRING (OpenSSL 4 compatibility) Author: Karl Smeltzer <[email protected]> Forwarded: https://github.com/cisco/libest/pull/136 Last-Update: 2026-07-22 OpenSSL 4.0 makes ASN1_STRING (and its typedefs ASN1_OCTET_STRING / ASN1_BIT_STRING) opaque: struct asn1_string_st is no longer defined in the public headers, so direct ->data / ->length field access no longer compiles: est_client.c:5314:67: error: invalid use of incomplete typedef 'ASN1_OCTET_STRING' {aka 'struct asn1_string_st'} est_server.c:1137:46: error: invalid use of incomplete typedef 'ASN1_BIT_STRING' {aka 'struct asn1_string_st'} Use the ASN1_STRING_get0_data() and ASN1_STRING_length() accessors instead, keeping the direct access under HAVE_OLD_OPENSSL for pre-1.1.0 builds, matching how the rest of the codebase already handles this (e.g. check->d.ia5 in est_client.c). The accessors exist since OpenSSL 1.1.0, so this builds against 1.0.x, 1.1/3.x, and 4.0. --- a/src/est/est_client.c +++ b/src/est/est_client.c @@ -5308,11 +5308,15 @@ return (EST_ERR_CLIENT_BRSKI_VOUCHER_VERIFY_FAILED); } +#ifdef HAVE_OLD_OPENSSL ctx->brski_retrieved_voucher = pkcs7->d.sign->contents->d.data->data; - ctx->brski_retrieved_voucher_len = pkcs7->d.sign->contents->d.data->length; +#else + ctx->brski_retrieved_voucher = (unsigned char *)ASN1_STRING_get0_data(pkcs7->d.sign->contents->d.data); +#endif + ctx->brski_retrieved_voucher_len = ASN1_STRING_length(pkcs7->d.sign->contents->d.data); EST_LOG_INFO("Voucher verify passed. Voucher =\n %s", - pkcs7->d.sign->contents->d.data->data); + ctx->brski_retrieved_voucher); return (EST_ERR_NONE); } --- a/src/est/est_server.c +++ b/src/est/est_server.c @@ -1134,7 +1134,11 @@ */ tls_uid = est_get_tls_uid(ssl, &uid_len, 0); if (tls_uid) { +#ifdef HAVE_OLD_OPENSSL i = memcmp_s(tls_uid, uid_len, bs->data, uid_len, &diff); +#else + i = memcmp_s(tls_uid, uid_len, ASN1_STRING_get0_data(bs), uid_len, &diff); +#endif if (i == EOK && !diff) { EST_LOG_INFO("PoP is valid"); rv = EST_ERR_NONE;
