From: shiliyang <shiliyang(a)huawei.com&gt; This patch fixes error style problems found by checkpatch.pl: ERROR: spaces required around that '*' ERROR: space required after that ',' ERROR: spaces required around that '|' Reviewed-by: Philippe Mathieu-Daudé <philmd(a)redhat.com&gt; Signed-off-by: Liyang Shi <shiliyang(a)huawei.com&gt; Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com&gt; --- crypto/aes.c | 2 +- crypto/desrfb.c | 2 +- crypto/tlscredsx509.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/crypto/aes.c b/crypto/aes.c index 159800df65..56efc95196 100644 --- a/crypto/aes.c +++ b/crypto/aes.c @@ -1182,7 +1182,7 @@ int AES_set_decrypt_key(const unsigned char *userKey, const int bits, rk = key->rd_key; /* invert the order of the round keys: */ - for (i = 0, j = 4*(key->rounds); i < j; i += 4, j -= 4) { + for (i = 0, j = 4 * (key->rounds); i < j; i += 4, j -= 4) { temp = rk[i ]; rk[i ] = rk[j ]; rk[j ] = temp; temp = rk[i + 1]; rk[i + 1] = rk[j + 1]; rk[j + 1] = temp; temp = rk[i + 2]; rk[i + 2] = rk[j + 2]; rk[j + 2] = temp; diff --git a/crypto/desrfb.c b/crypto/desrfb.c index 3274c36510..675847c93b 100644 --- a/crypto/desrfb.c +++ b/crypto/desrfb.c @@ -56,7 +56,7 @@ static const unsigned char pc1[56] = { 13, 5, 60, 52, 44, 36, 28, 20, 12, 4, 27, 19, 11, 3 }; static const unsigned char totrot[16] = { - 1,2,4,6,8,10,12,14,15,17,19,21,23,25,27,28 }; + 1, 2, 4, 6, 8, 10, 12, 14, 15, 17, 19, 21, 23, 25, 27, 28 }; static const unsigned char pc2[48] = { 13, 16, 10, 23, 0, 4, 2, 27, 14, 5, 20, 9, diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c index dd7267ccdb..c89dd62435 100644 --- a/crypto/tlscredsx509.c +++ b/crypto/tlscredsx509.c @@ -143,7 +143,7 @@ qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCredsX509 *creds, if (status < 0) { if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) { usage = isCA ? GNUTLS_KEY_KEY_CERT_SIGN : - GNUTLS_KEY_DIGITAL_SIGNATURE|GNUTLS_KEY_KEY_ENCIPHERMENT; + GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT; } else { error_setg(errp, "Unable to query certificate %s key usage: %s", -- 2.29.2

From: Kevin Wolf <kwolf(a)redhat.com&gt; qcrypto_secret_prop_set_loaded() forgets to reset secret->rawdata after unloading a secret, which will lead to a double free at some point. Because there is no use case for unloading an already loaded secret (apart from deleting the whole secret object) and we know that nobody could use this because it would lead to crashes, let's just forbid the operation instead of fixing the unloading. Eventually, we'll want to get rid of 'loaded' in the external interface, but for the meantime this is more consistent with rng, which has a similar property 'opened' that also can't be reset to false after it became true. Signed-off-by: Kevin Wolf <kwolf(a)redhat.com&gt; Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com&gt; --- crypto/secret_common.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/crypto/secret_common.c b/crypto/secret_common.c index 35b82cb531..714a15d5e5 100644 --- a/crypto/secret_common.c +++ b/crypto/secret_common.c @@ -191,9 +191,9 @@ qcrypto_secret_prop_set_loaded(Object *obj, secret->rawdata = input; secret->rawlen = inputlen; - } else { - g_free(secret->rawdata); - secret->rawlen = 0; + } else if (secret->rawdata) { + error_setg(errp, "Cannot unload secret"); + return; } } -- 2.29.2

The -enable-fips option was added a long time ago to prevent the use of single DES when VNC when FIPS mode is enabled. It should never have been added, because apps are supposed to unconditionally honour FIPS mode based on the '/proc/sys/crypto/fips_enabled' file contents. In addition there is more to achieving FIPS compliance than merely blocking use of certain algorithms. Those algorithms which are used need to perform self-tests at runtime. QEMU's built-in cryptography provider has no support for self-tests, and neither does the nettle library. If QEMU is required to be used in a FIPS enabled host, then it must be built with the libgcrypt library enabled, which will unconditionally enforce FIPS compliance in any algorithm usage. Thus there is no need to keep either the -enable-fips option in QEMU, or QEMU's internal FIPS checking methods. Reviewed-by: John Snow <jsnow(a)redhat.com&gt; Reviewed-by: Thomas Huth <thuth(a)redhat.com&gt; Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com&gt; --- docs/system/deprecated.rst | 12 ++++++++++++ os-posix.c | 3 +++ 2 files changed, 15 insertions(+) diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst index 9de663526a..6ac757ed9f 100644 --- a/docs/system/deprecated.rst +++ b/docs/system/deprecated.rst @@ -134,6 +134,18 @@ Boolean options such as ``share=on``/``share=off`` could be written in short form as ``share`` and ``noshare``. This is now deprecated and will cause a warning. +``--enable-fips`` (since 6.0) +''''''''''''''''''''''''''''' + +This option restricts usage of certain cryptographic algorithms when +the host is operating in FIPS mode. + +If FIPS compliance is required, QEMU should be built with the ``libgcrypt`` +library enabled as a cryptography provider. + +Neither the ``nettle`` library, or the built-in cryptography provider are +supported on FIPS enabled hosts. + QEMU Machine Protocol (QMP) commands ------------------------------------ diff --git a/os-posix.c b/os-posix.c index 1de2839554..a6846f51c1 100644 --- a/os-posix.c +++ b/os-posix.c @@ -153,6 +153,9 @@ int os_parse_cmd_args(int index, const char *optarg) break; #if defined(CONFIG_LINUX) case QEMU_OPTION_enablefips: + warn_report("-enable-fips is deprecated, please build QEMU with " + "the `libgcrypt` library as the cryptography provider " + "to enable FIPS compliance"); fips_set_state(true); break; #endif -- 2.29.2

The distinction between short life and long life Linux distributions turned out to be redundant. They can both be covered in a simple way by noting support will target the current release, and the previous release for a period of two years or until its EOL. This rule can also apply to the other UNIX based distros, leaving only Windows needing a different set of rules. This also clarifies that Debian LTS is out of scope, because the LTS support is provided by a separate group from the main Debian maintainer team. Reviewed-by: Eduardo Habkost <ehabkost(a)redhat.com&gt; Reviewed-by: Thomas Huth <thuth(a)redhat.com&gt; Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com&gt; --- docs/system/build-platforms.rst | 63 ++++++++++++--------------------- 1 file changed, 23 insertions(+), 40 deletions(-) diff --git a/docs/system/build-platforms.rst b/docs/system/build-platforms.rst index 9734eba2f1..692323609e 100644 --- a/docs/system/build-platforms.rst +++ b/docs/system/build-platforms.rst @@ -25,55 +25,38 @@ software in their distro, QEMU upstream code will not add explicit support for those backports, unless the feature is auto-detectable in a manner that works for the upstream releases too. -The Repology site https://repology.org is a useful resource to identify +The `Repology`_ site is a useful resource to identify currently shipped versions of software in various operating systems, though it does not cover all distros listed below. -Linux OS --------- +Linux OS, macOS, FreeBSD, NetBSD, OpenBSD +----------------------------------------- -For distributions with frequent, short-lifetime releases, the project -will aim to support all versions that are not end of life by their -respective vendors. For the purposes of identifying supported software -versions, the project will look at Fedora, Ubuntu, and openSUSE distros. -Other short- lifetime distros will be assumed to ship similar software -versions. +The project aims to support the most recent major version at all times. Support +for the previous major version will be dropped 2 years after the new major +version is released or when the vendor itself drops support, whichever comes +first. In this context, third-party efforts to extend the lifetime of a distro +are not considered, even when they are endorsed by the vendor (eg. Debian LTS). -For distributions with long-lifetime releases, the project will aim to -support the most recent major version at all times. Support for the -previous major version will be dropped 2 years after the new major -version is released, or when it reaches "end of life". For the purposes -of identifying supported software versions, the project will look at -RHEL, Debian, Ubuntu LTS, and SLES distros. Other long-lifetime distros -will be assumed to ship similar software versions. +For the purposes of identifying supported software versions available on Linux, +the project will look at CentOS, Debian, Fedora, openSUSE, RHEL, SLES and +Ubuntu LTS. Other distros will be assumed to ship similar software versions. -Windows -------- - -The project supports building with current versions of the MinGW -toolchain, hosted on Linux. - -macOS ------ +For FreeBSD and OpenBSD, decisions will be made based on the contents of the +respective ports repository, while NetBSD will use the pkgsrc repository. -The project supports building with the two most recent versions of -macOS, with the current Homebrew package set available. +For macOS, `HomeBrew`_ will be used, although `MacPorts`_ is expected to carry +similar versions. -FreeBSD +Windows ------- -The project aims to support all versions which are not end of -life. - -NetBSD ------- +The project supports building with current versions of the MinGW toolchain, +hosted on Linux (Debian/Fedora). -The project aims to support the most recent major version at all times. -Support for the previous major version will be dropped 2 years after the -new major version is released. - -OpenBSD -------- +The version of the Windows API that's currently targeted is Vista / Server +2008. -The project aims to support all versions which are not end of -life. +.. _HomeBrew: https://brew.sh/ +.. _MacPorts: https://www.macports.org/ +.. _Repology: https://repology.org/ -- 2.29.2

From: Dan Streetman <ddstreet(a)canonical.com&gt; Replace the --enable-git-update and --disable-git-update configure params with the param --with-git-submodules=(update|validate|ignore) to allow 3 options for building from a git repo. This is needed because downstream packagers, e.g. Debian, Ubuntu, etc, also keep the source code in git, but do not want to enable the 'git_update' mode; with the current code, that's not possible even if the downstream package specifies --disable-git-update. The previous parameters are deprecated but still available; the --enable-git-update parameter maps to --with-git-submodules=update and --disable-git-update parameter maps to --with-git-submodules=validate. The configure script behavior is slightly modified, where previously the dtc, capstone, and slirp submodules were not validated when --disable-git-update was specified (but were updated with git-update enabled), now they are validated when using --with-git-submodules=validate and are only ignored when using --with-git-submodules=ignore. Signed-off-by: Dan Streetman <ddstreet(a)canonical.com&gt; Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com&gt; --- Makefile | 24 ++----------------- configure | 51 ++++++++++++++++++++++++++++++---------- scripts/git-submodule.sh | 34 ++++++++++++++++++++------- 3 files changed, 66 insertions(+), 43 deletions(-) diff --git a/Makefile b/Makefile index 291ea19f2e..b0dff73904 100644 --- a/Makefile +++ b/Makefile @@ -47,30 +47,10 @@ git-submodule-update: Makefile: .git-submodule-status .PHONY: git-submodule-update - -git_module_status := $(shell \ - cd '$(SRC_PATH)' && \ - GIT="$(GIT)" ./scripts/git-submodule.sh status $(GIT_SUBMODULES); \ - echo $$?; \ -) - -ifeq (1,$(git_module_status)) -ifeq (no,$(GIT_UPDATE)) git-submodule-update: $(call quiet-command, \ - echo && \ - echo "GIT submodule checkout is out of date. Please run" && \ - echo " scripts/git-submodule.sh update $(GIT_SUBMODULES)" && \ - echo "from the source directory checkout $(SRC_PATH)" && \ - echo && \ - exit 1) -else -git-submodule-update: - $(call quiet-command, \ - (cd $(SRC_PATH) && GIT="$(GIT)" ./scripts/git-submodule.sh update $(GIT_SUBMODULES)), \ - "GIT","$(GIT_SUBMODULES)") -endif -endif + (GIT="$(GIT)" "$(SRC_PATH)/scripts/git-submodule.sh" $(GIT_SUBMODULES_ACTION) $(GIT_SUBMODULES)), \ + "GIT","$(GIT_SUBMODULES)") # 0. ensure the build tree is okay diff --git a/configure b/configure index 87de49e2c2..8fc59848b2 100755 --- a/configure +++ b/configure @@ -254,12 +254,12 @@ gdb_bin=$(command -v "gdb-multiarch" || command -v "gdb") if test -e "$source_path/.git" then - git_update=yes + git_submodules_action="update" git_submodules="ui/keycodemapdb" git_submodules="$git_submodules tests/fp/berkeley-testfloat-3" git_submodules="$git_submodules tests/fp/berkeley-softfloat-3" else - git_update=no + git_submodules_action="ignore" git_submodules="" if ! test -f "$source_path/ui/keycodemapdb/README" @@ -1508,9 +1508,16 @@ for opt do ;; --with-git=*) git="$optarg" ;; - --enable-git-update) git_update=yes + --enable-git-update) + git_submodules_action="update" + echo "--enable-git-update deprecated, use --with-git-submodules=update" ;; - --disable-git-update) git_update=no + --disable-git-update) + git_submodules_action="validate" + echo "--disable-git-update deprecated, use --with-git-submodules=validate" + ;; + --with-git-submodules=*) + git_submodules_action="$optarg" ;; --enable-debug-mutex) debug_mutex=yes ;; @@ -1566,6 +1573,21 @@ for opt do esac done +case $git_submodules_action in + update|validate) + if test ! -e "$source_path/.git"; then + echo "ERROR: cannot $git_submodules_action git submodules without .git" + exit 1 + fi + ;; + ignore) + ;; + *) + echo "ERROR: invalid --with-git-submodules= value '$git_submodules_action'" + exit 1 + ;; +esac + libdir="${libdir:-$prefix/lib}" libexecdir="${libexecdir:-$prefix/libexec}" includedir="${includedir:-$prefix/include}" @@ -1710,6 +1732,9 @@ Advanced options (experts only): --ninja=NINJA use specified ninja [$ninja] --smbd=SMBD use specified smbd [$smbd] --with-git=GIT use specified git [$git] + --with-git-submodules=update update git submodules (default if .git dir exists) + --with-git-submodules=validate fail if git submodules are not up to date + --with-git-submodules=ignore do not update or check git submodules (default if no .git dir) --static enable static build [$static] --mandir=PATH install man pages in PATH --datadir=PATH install firmware in PATH/$qemu_suffix @@ -1926,7 +1951,7 @@ python="$python -B" if test -z "$meson"; then if test "$explicit_python" = no && has meson && version_ge "$(meson --version)" 0.55.3; then meson=meson - elif test -e "${source_path}/.git" && test $git_update = 'yes' ; then + elif test $git_submodules_action != 'ignore' ; then meson=git elif test -e "${source_path}/meson/meson.py" ; then meson=internal @@ -1994,7 +2019,7 @@ fi # Consult white-list to determine whether to enable werror # by default. Only enable by default for git builds if test -z "$werror" ; then - if test -e "$source_path/.git" && \ + if test "$git_submodules_action" != "ignore" && \ { test "$linux" = "yes" || test "$mingw32" = "yes"; }; then werror="yes" else @@ -3550,7 +3575,7 @@ fi case "$fdt" in auto | enabled | internal) # Simpler to always update submodule, even if not needed. - if test -e "${source_path}/.git" && test $git_update = 'yes' ; then + if test "$git_submodules_action" != "ignore"; then git_submodules="${git_submodules} dtc" fi ;; @@ -4264,7 +4289,7 @@ fi case "$capstone" in auto | enabled | internal) # Simpler to always update submodule, even if not needed. - if test -e "${source_path}/.git" && test $git_update = 'yes' ; then + if test "$git_submodules_action" != "ignore"; then git_submodules="${git_submodules} capstone" fi ;; @@ -5211,7 +5236,7 @@ fi case "$slirp" in auto | enabled | internal) # Simpler to always update submodule, even if not needed. - if test -e "${source_path}/.git" && test $git_update = 'yes' ; then + if test "$git_submodules_action" != "ignore"; then git_submodules="${git_submodules} slirp" fi ;; @@ -5385,7 +5410,7 @@ if test "$cpu" = "s390x" ; then roms="$roms s390-ccw" # SLOF is required for building the s390-ccw firmware on s390x, # since it is using the libnet code from SLOF for network booting. - if test -e "${source_path}/.git" ; then + if test "$git_submodules_action" != "ignore"; then git_submodules="${git_submodules} roms/SLOF" fi fi @@ -5423,8 +5448,8 @@ else cxx= fi -if test $git_update = 'yes' ; then - (cd "${source_path}" && GIT="$git" "./scripts/git-submodule.sh" update "$git_submodules") +if !(GIT="$git" "$source_path/scripts/git-submodule.sh" "$git_submodules_action" "$git_submodules"); then + exit 1 fi config_host_mak="config-host.mak" @@ -5435,7 +5460,7 @@ echo >> $config_host_mak echo all: >> $config_host_mak echo "GIT=$git" >> $config_host_mak echo "GIT_SUBMODULES=$git_submodules" >> $config_host_mak -echo "GIT_UPDATE=$git_update" >> $config_host_mak +echo "GIT_SUBMODULES_ACTION=$git_submodules_action" >> $config_host_mak echo "ARCH=$ARCH" >> $config_host_mak diff --git a/scripts/git-submodule.sh b/scripts/git-submodule.sh index 65ed877aef..e225d3a963 100755 --- a/scripts/git-submodule.sh +++ b/scripts/git-submodule.sh @@ -9,9 +9,14 @@ command=$1 shift maybe_modules="$@" +# if --with-git-submodules=ignore, do nothing +test "$command" = "ignore" && exit 0 + test -z "$GIT" && GIT=git -error() { +cd "$(dirname "$0")/.." + +update_error() { echo "$0: $*" echo echo "Unable to automatically checkout GIT submodules '$modules'." @@ -24,7 +29,7 @@ error() { echo "Alternatively you may disable automatic GIT submodule checkout" echo "with:" echo - echo " $ ./configure --disable-git-update" + echo " $ ./configure --with-git-submodules=validate" echo echo "and then manually update submodules prior to running make, with:" echo @@ -33,6 +38,19 @@ error() { exit 1 } +validate_error() { + if test "$1" = "validate"; then + echo "GIT submodules checkout is out of date, and submodules" + echo "configured for validate only. Please run" + echo " scripts/git-submodule.sh update $maybe_modules" + echo "from the source directory or call configure with" + echo " --with-git-submodules=update" + echo "To disable GIT submodules validation, use" + echo " --with-git-submodules=ignore" + fi + exit 1 +} + modules="" for m in $maybe_modules do @@ -52,18 +70,18 @@ then fi case "$command" in -status) +status|validate) if test -z "$maybe_modules" then - test -s ${substat} && exit 1 || exit 0 + test -s ${substat} && validate_error "$command" || exit 0 fi - test -f "$substat" || exit 1 + test -f "$substat" || validate_error "$command" for module in $modules; do CURSTATUS=$($GIT submodule status $module) OLDSTATUS=$(cat $substat | grep $module) if test "$CURSTATUS" != "$OLDSTATUS"; then - exit 1 + validate_error "$command" fi done exit 0 @@ -76,10 +94,10 @@ update) fi $GIT submodule update --init $modules 1>/dev/null - test $? -ne 0 && error "failed to update modules" + test $? -ne 0 && update_error "failed to update modules" $GIT submodule status $modules > "${substat}" - test $? -ne 0 && error "failed to save git submodule status" >&2 + test $? -ne 0 && update_error "failed to save git submodule status" >&2 ;; esac -- 2.29.2

Primarily this is to pull in a fix for Win32 keycodes. The other useful change is the removal of build timestamp from generated files which is desirable for reproducable builds. The make rules need updating due to slightly changed CLI syntax - more args must now come after the command name. 6119e6e19a050df847418de7babe5166779955e4 Fix scan codes for Korean keys 685684a8404301780714e8a89a871981e7cae988 Fix argument order in output headers b3774853042c951b200d767697285781cc59a83c Add HTML entries for Korean layout keys 8e54850d800e4697a2798fb82ac740e760f8530b Add macOS entries for Japanese keyboards 27acf0ef828bf719b2053ba398b195829413dbdd Fix win32 keycode for VK_OEM_102 317d3eeb963a515e15a63fa356d8ebcda7041a51 Add support for generating RST formatted docs pages 7381b9bfadd31c4c9e9a10b5bb5032f9189d4352 Introduce separate args for title & subtitle with docs generator 6280c94f306df6a20bbc100ba15a5a81af0366e6 keymap-gen: Name sections in pod output df4e56f8fab65ba714ec18f4e7338a966a1620ad Add an empty meson project 16e5b0787687d8904dad2c026107409eb9bfcb95 remove buildtime from generated files 044f21dd0d4f62519aae9f1d53a026407a0b664f add header file generators 7779876a6b06755e3bb2c94ee3ded50635bcb0fa c++: add extern declaration to the generated file 0e0a317889464397d6f1ae03aad0d2ca593aab04 move CLanguageGenerator closer to CLanguageGenerator itself Reviewed-by: Philippe Mathieu-Daudé <philmd(a)redhat.com&gt; Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com&gt; --- ui/keycodemapdb | 2 +- ui/meson.build | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/ui/keycodemapdb b/ui/keycodemapdb index 6b3d716e2b..6119e6e19a 160000 --- a/ui/keycodemapdb +++ b/ui/keycodemapdb @@ -1 +1 @@ -Subproject commit 6b3d716e2b6472eb7189d3220552280ef3d832ce +Subproject commit 6119e6e19a050df847418de7babe5166779955e4 diff --git a/ui/meson.build b/ui/meson.build index 634fabab0d..156b600a99 100644 --- a/ui/meson.build +++ b/ui/meson.build @@ -127,9 +127,10 @@ if have_system or xkbcommon.found() capture: true, input: files('keycodemapdb/data/keymaps.csv'), command: [python.full_path(), files('keycodemapdb/tools/keymap-gen'), + 'code-map', '--lang', 'glib2', '--varname', &#39;qemu_input_map_@0@_to_@1(a)&#39;.format(e[0], e[1]), - 'code-map', '@INPUT0@', e[0], e[1]]) + '@INPUT0@', e[0], e[1]]) endforeach endif -- 2.29.2

From: Stefan Weil <sw(a)weilnetz.de&gt; This fixes several compiler warnings on MacOS with Homebrew. The git development branch for forthcoming libtasn1 4.17.0 has introduced deprecation warnings for several macros/types that we use. Signed-off-by: Stefan Weil <sw(a)weilnetz.de&gt; Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com&gt; --- tests/crypto-tls-x509-helpers.c | 10 +++++----- tests/crypto-tls-x509-helpers.h | 2 +- tests/pkix_asn1_tab.c | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/tests/crypto-tls-x509-helpers.c b/tests/crypto-tls-x509-helpers.c index 01b3daf358..97658592a2 100644 --- a/tests/crypto-tls-x509-helpers.c +++ b/tests/crypto-tls-x509-helpers.c @@ -30,7 +30,7 @@ * This stores some static data that is needed when * encoding extensions in the x509 certs */ -ASN1_TYPE pkix_asn1; +asn1_node pkix_asn1; /* * To avoid consuming random entropy to generate keys, @@ -139,7 +139,7 @@ void test_tls_cleanup(const char *keyfile) /* * Turns an ASN1 object into a DER encoded byte array */ -static void test_tls_der_encode(ASN1_TYPE src, +static void test_tls_der_encode(asn1_node src, const char *src_name, gnutls_datum_t *res) { @@ -317,7 +317,7 @@ test_tls_generate_cert(QCryptoTLSTestCertReq *req, * the 'critical' field which we want control over */ if (req->basicConstraintsEnable) { - ASN1_TYPE ext = ASN1_TYPE_EMPTY; + asn1_node ext = NULL; asn1_create_element(pkix_asn1, "PKIX1.BasicConstraints", &ext); asn1_write_value(ext, "cA", @@ -344,7 +344,7 @@ test_tls_generate_cert(QCryptoTLSTestCertReq *req, * to be 'critical' */ if (req->keyUsageEnable) { - ASN1_TYPE ext = ASN1_TYPE_EMPTY; + asn1_node ext = NULL; char str[2]; str[0] = req->keyUsageValue & 0xff; @@ -374,7 +374,7 @@ test_tls_generate_cert(QCryptoTLSTestCertReq *req, * set this the hard way building up ASN1 data ourselves */ if (req->keyPurposeEnable) { - ASN1_TYPE ext = ASN1_TYPE_EMPTY; + asn1_node ext = NULL; asn1_create_element(pkix_asn1, "PKIX1.ExtKeyUsageSyntax", &ext); if (req->keyPurposeOID1) { diff --git a/tests/crypto-tls-x509-helpers.h b/tests/crypto-tls-x509-helpers.h index 08efba4e19..8fcd7785ab 100644 --- a/tests/crypto-tls-x509-helpers.h +++ b/tests/crypto-tls-x509-helpers.h @@ -125,7 +125,7 @@ void test_tls_cleanup(const char *keyfile); }; \ test_tls_generate_cert(&varname, NULL) -extern const ASN1_ARRAY_TYPE pkix_asn1_tab[]; +extern const asn1_static_node pkix_asn1_tab[]; #endif /* QCRYPTO_HAVE_TLS_TEST_SUPPORT */ diff --git a/tests/pkix_asn1_tab.c b/tests/pkix_asn1_tab.c index f15fc515cb..4aaf736d3f 100644 --- a/tests/pkix_asn1_tab.c +++ b/tests/pkix_asn1_tab.c @@ -8,7 +8,7 @@ #ifdef QCRYPTO_HAVE_TLS_TEST_SUPPORT -const ASN1_ARRAY_TYPE pkix_asn1_tab[] = { +const asn1_static_node pkix_asn1_tab[] = { {"PKIX1", 536875024, 0}, {0, 1073741836, 0}, {"id-ce", 1879048204, 0}, -- 2.29.2