tls/openssl: build with the constified X509 name accessors in OpenSSL 4

OpenSSL 4.0 changed X509_get_subject_name() and X509_get_issuer_name() to
return a const X509_NAME *, so assigning the result to a plain
X509_NAME * fails the -Wignored-qualifiers -Werror build:

  openssl-x509.c:140:20: error: assignment discards 'const' qualifier
    from pointer target type [-Werror=discarded-qualifiers]

Make the read-only users const, and cast at the two sites that fill in
the subject name of a cert that has not been signed yet. All of this
also compiles against OpenSSL 3, where the accessors return non-const.

Signed-off-by: Rudi Heitbaum <rudi@heitbaum.com>

Author: heitbaum

lib/tls/openssl/openssl-client.c

@@ -216,7 +216,7 @@ OpenSSL_client_verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx)
 				char cert_cn[256] = "unknown";
 				X509 *cert = X509_STORE_CTX_get_current_cert(x509_ctx);
 				if (cert) {
-					X509_NAME *subject = X509_get_subject_name(cert);
+					const X509_NAME *subject = X509_get_subject_name(cert);
 					if (subject)
 						X509_NAME_get_text_by_NID(subject, NID_commonName, cert_cn, sizeof(cert_cn));
 				}

lib/tls/openssl/openssl-server.c

@@ -644,7 +644,7 @@ lws_tls_vhost_backend_create_ctx(struct lws_vhost *vhost)
 					SSL_CTX_set_cert_store(tls->ssl_ctx, x509_store);
 					STACK_OF(X509_NAME) *calist = sk_X509_NAME_new_null();
 					if (calist) {
-						X509_NAME *name = X509_get_subject_name(client_CA);
+						const X509_NAME *name = X509_get_subject_name(client_CA);
 						if (name)
 							sk_X509_NAME_push(calist, X509_NAME_dup(name));
 						SSL_CTX_set_client_CA_list(tls->ssl_ctx, calist);
@@ -940,7 +940,11 @@ lws_tls_acme_sni_cert_create(struct lws_vhost *vhost, const char *san_a,
 
 	X509_set_pubkey(vhost->tls.ss->x509, vhost->tls.ss->pkey);
 
-	name = X509_get_subject_name(vhost->tls.ss->x509);
+	/*
+	 * OpenSSL 4 constified the accessor, but the name is still owned by
+	 * the unsigned cert and is meant to be filled in here
+	 */
+	name = (X509_NAME *)X509_get_subject_name(vhost->tls.ss->x509);
 	X509_NAME_add_entry_by_txt(name, "C",  MBSTRING_ASC,
 				   (unsigned char *)"GB",          -1, -1, 0);
 	X509_NAME_add_entry_by_txt(name, "O",  MBSTRING_ASC,

lib/tls/openssl/openssl-x509.c

@@ -100,7 +100,7 @@ lws_tls_openssl_cert_info(X509 *x509, enum lws_tls_cert_info type,
 	int tag, xclass, r = 1;
 	long xlen, loc;
 #endif
-	X509_NAME *xn;
+	const X509_NAME *xn;
 #if !defined(LWS_PLAT_OPTEE)
 	char *p, *p1;
 	size_t rl;
@@ -487,7 +487,7 @@ lws_x509_verify(struct lws_x509_cert *x509, struct lws_x509_cert *trusted,
 	int ret;
 
 	if (common_name) {
-		X509_NAME *xn = X509_get_subject_name(x509->cert);
+		const X509_NAME *xn = X509_get_subject_name(x509->cert);
 		if (!xn)
 			return -1;
 
@@ -1020,7 +1020,11 @@ lws_x509_create_cert(struct lws_context *context,
 
 	X509_set_pubkey(x509, pkey);
 
-	name = X509_get_subject_name(x509);
+	/*
+	 * OpenSSL 4 constified the accessor, but the name is still owned by
+	 * the unsigned cert and is meant to be filled in here
+	 */
+	name = (X509_NAME *)X509_get_subject_name(x509);
 	X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC,
 				   (unsigned char *)info->san, -1, -1, 0);