add support for ML-DSA-* etc., various small fixes; C23 and OpenSSL 4.0 compat

debian/changelog

@@ -1,3 +1,30 @@
+libsecutils (2.3) stable; urgency=medium
+
+    * TODO: complete this and update date below 
+    * extend KEY_new() to support ML-DSA-* and potentially further PQC algs
+    * add KEY_new_ex() for improved provider support
+    * improve STORE_set1_host_ip() behavior on equal 'name' and 'ip' argument
+    * CREDENTIALS_print_cert_verify_cb(): fix print expected IP addr on mismatch
+    * improve CONN_IS_HTTP(S) and use it to replace occurrences of strncasecmp()
+    * credentials.c: fix potential crash of find_update_cb() on NULL tag strings
+    * crl_mgmt.c,cdp_util.{c,h}: fix constness for OpenSSL 4.0 compatibility
+    * basic.h: fix compat with C23 which provides 'true' and 'false' as keywords
+    * build.yml: add 'lintian --fail-on error,warning *deb' after 'make deb'
+    * CMakeLists.txt: improve Windows support, partly clean up gcc warning opts
+    * CMakeLists.txt,debian/etc. major improvements of Debian packaging
+    * CMakeLists.txt,debian/: add library major version to name (libsecutils2)
+    * CMakeLists.txt,debian/control: shorten CPACK_PACKAGE_DESCRIPTION_SUMMARY
+    * CMakeLists.txt: Ensure installed directories get standard 0755 permissions
+    * CMakeLists.txt,build.yml: improve uninstall and CI checks
+    * CMakeLists.txt: simplify (sub-)directory structure of doc/
+    * add icvutil.1 man page and its Debian installation
+    * add placeholder 'icvutil' script in case binary is not available
+    * chore: add pkgconfig file
+    * Makefile_v1: make fallback determination of OPENSSL_LIB more reliable
+    * Makefile_v1: improve dir pattern for auto-determining OPENSSL_LIB on Linux
+
+ -- David von Oheimb <David.von.Oheimb@siemens.com>  Tue, 23 Jun 2026 17:24:50 +0200
+
 libsecutils (2.2) stable; urgency=medium
 
   * add UTIL_cmp_timeframe() and CRL_check() for support of upcoming OpenSSL 4.0

src/libsecutils/include/secutils/certstatus/cdp_util.h

@@ -43,7 +43,7 @@ typedef int CDP_REASON_FLAGS;
 
 /* Copy a one-line representation of the X509_NAME into the buffer */
 bool CDP_get_x509_name(
-    X509_NAME       *name,
+    const X509_NAME *name,
     char            *name_utf8_buf,
     size_t          name_utf8_buf_len,
     unsigned long   flags

src/libsecutils/include/secutils/connections/conn.h

@@ -16,14 +16,22 @@
 #ifndef SECUTILS_CONN_H_
 # define SECUTILS_CONN_H_
 
-# include "../basic.h"
+# include "../util/util.h"
 
+# if OPENSSL_VERSION_NUMBER < OPENSSL_V_3_0_0
+#  undef  OSSL_HTTP_PREFIX
+#  define OSSL_HTTP_PREFIX "http://"
+#  undef  OSSL_HTTPS_PREFIX
+#  define OSSL_HTTPS_PREFIX "https://"
+# else
+#  include <openssl/http.h>
+# endif
 static const char* const CONN_scheme_postfix = "://";
-static const char* const CONN_http_prefix = "http://";
-static const char* const CONN_https_prefix = "https://";
+static const char* const CONN_http_prefix = OSSL_HTTP_PREFIX;
+static const char* const CONN_https_prefix = OSSL_HTTPS_PREFIX;
 
-#define CONN_IS_HTTP( uri) ((uri) != NULL && HAS_PREFIX(uri, OSSL_HTTP_PREFIX ))
-#define CONN_IS_HTTPS(uri) ((uri) != NULL && HAS_PREFIX(uri, OSSL_HTTPS_PREFIX))
+#define CONN_IS_HTTP( uri) ((uri) != NULL && HAS_CASE_PREFIX(uri, OSSL_HTTP_PREFIX ))
+#define CONN_IS_HTTPS(uri) ((uri) != NULL && HAS_CASE_PREFIX(uri, OSSL_HTTPS_PREFIX))
 #define CONN_IS_IP_ADDR(host) CONN_is_IP_address(host)
 
 /*!*****************************************************************************
@@ -35,15 +43,15 @@ static const char* const CONN_https_prefix = "https://";
 bool CONN_is_IP_address(OPTIONAL const char *host);
 
 /*!*****************************************************************************
- * @brief parse hostname or URI of the form "[http[s]://][<userinfo>@]<host>[:<port>][/<path>]"
+ * @brief parse hostname or URI of the form "[http[s]://][<userinfo>@]<host>[:port][/<path>]"
  * @note an IPv6 address must be enclosed in '[' and ']'.
  * @param p_uri pointer to variable holding the URI to be parsed.
  * The variable is advanced past any leading "http[s]://" and "<userinfo>@" parts to the host name/address;
- * anything following it (i.e., <port> and/or <path> URI components) are chopped in the input string buffer.
+ * anything following it (i.e., port and/or path URI components) are chopped in the input string buffer.
  * @param default_port specifies the default port to return:
  * may give an actual default port number or 0, which is replaced by 443 for https else by 80
  * @param p_path if this pointer is not null it will be used to assign on success
- * the pointer to any <path> component (including and query and fragment parts)
+ * the pointer to any path component (including any query and fragment parts)
  * included in the input string, or null if not included.
  * @param desc description of the server to connect to, for use in diagnostic messages, or null
  * @return valid port number from input string or default, or <= 0 on error

src/libsecutils/include/secutils/credentials/credentials.h

@@ -190,19 +190,20 @@ CREDENTIALS* CREDENTIALS_load_dv(OPTIONAL const char* certs, OPTIONAL const char
 
 
 /*!*****************************************************************************
- * @brief save asymmetric credentials (except key held in crypto engine) to the given file(s)
+ * @brief save asymmetric credentials (except key held in crypto engine or provider) to the given file(s)
  * @note If used, encryption indirectly also protects integrity&authenticity of file-based storage.
  *
  * @param creds pointer to the credential structure to save
  * @param certs name of file to store certificates, or null. Any previous contents are overwritten.
- * @param key name of file to store the private key unless the 'source' parameter
- *  refers to an engine (where this parameter may be null). Any previous file contents are overwritten.
+ * @param key name of file to store the private key unless
+ *   the 'source' parameter refers to an engine (where the 'key' parameter may be null).
  * @param source if this parameter is null or of the form "pass:PWD" then the key
  *   is stored to the given key. If present, PWD is taken as password to be
  *   used for key encryption. If the 'source' parameter is of the form "engine:<id>"
  *   the key is not stored because this does not apply for the engine interface.
  * @param desc (optional) is used if present for forming more descriptive error messages
  * @return true on success, else failure
+ * @note Any previous file contents are overwritten.
  * @note If the 'certs' and 'key' arguments are equal and the file name extension is ".p12" or ".pkcs12",
  * the certs and the key are written jointly to the same PKCS#12 file.
  * Otherwise they are written in PEM format, potentially jointly to the same file.

src/libsecutils/include/secutils/credentials/key.h

@@ -19,20 +19,31 @@
 #include <openssl/evp.h>
 
 #include "../basic.h"
+#include "../util/util.h" /* for OSSL_LIB_CTX legacy workaround */
 
 /*!*****************************************************************************
  * @brief generate a new private key according to the given specification
  *
- * @param spec specification for the type of the new key, which may be of the form "EC:<curve>" or "RSA-<length>"
- * @note The RSA key length may be 1024, 2048, or 4096 and the available ECC curves can be shown with the command
- *openssl ecparam -list_curves.
+ * @param spec specification for the type of the new key.
+ * For ECC and RSA keys, this can be of the form "EC:<curve>", "RSA:<length>", "RSA-<length>" or "<length>".
+ * Everything else is considered an ECC curve name if the OpenSSL version is below 3.5,
+ * while for OpenSSL 3.5+, it is taken as an algorithm name, potentially including parameters, such as "ED25519" or "ML-DSA-<level>".
+ * For the full list of available algorithms see the output of openssl list -public-key-algorithms
+ * @param libctx for optional use with providers with OpenSSL 3.0+, otherwise must be null
+ * @param propq may give a provider query string with OpenSSL 3.0+, otherwise must be null
+ * @note The RSA key length may be 1024, 2048, 4096, or 8192 and the available ECC curves
+ * can be shown with the command `openssl ecparam -list_curves`.
  * @note This function cannot be used for generating keys managed by a crypto engine.
  * @note Since OpenSSL 3.0, this may depend on the availability of a suitable provider.
  * @return the new key on success and null otherwise.
  *******************************************************************************/
 /* this function is part of the genCMPClient API */
-EVP_PKEY* KEY_new(const char* spec);
+EVP_PKEY *KEY_new_ex(const char *spec, OPTIONAL OSSL_LIB_CTX *libctx, OPTIONAL const char *propq);
+#define SECUTILS_RSA_STR "RSA"
+#define SECUTILS_EC_STR "EC"
 
+/* this function is part of the genCMPClient API */
+EVP_PKEY *KEY_new(const char *spec); /* same as KEY_new_ex(spec, NULL, NULL) */
 
 /*!*****************************************************************************
  * @brief free an asymmetric (private) key

src/libsecutils/include/secutils/credentials/store.h

@@ -31,7 +31,9 @@
  * @param truststore the trust store (typically returned from TLS_CTX_new()) where to set the host verification options
  * @param name the host DNS name to be expected, which may be given as a URL, or null
  * @param ip the host IP address to be expected, which may be given as a URL, or null
- * @note if both name and ip are non-null and equal, tries to interpret the string first as IP address then as domain name.
+ * @note if both name and ip are non-null and are non-equal strings, both expectations are set.
+ * @note if both name and ip are non-null and equal strings, the function uses CONN_IS_IP_ADDR()
+ * to determine whether to interpret the string as an IP address or as a domain name.
  * @note name and ip strings are copied, so do not need to be preserved after the call.
  * @return true on success, else false
  *******************************************************************************/

src/libsecutils/include/secutils/util/util.h

@@ -48,6 +48,7 @@ static const int UTIL_max_name_len = 128;  /*!< max length of file name */
 # define OPENSSL_V_1_1_0 0x10100000L
 # define OPENSSL_V_1_1_1 0x10101000L
 # define OPENSSL_V_3_0_0 0x30000000L
+# define OPENSSL_V_3_5_0 0x30500000L
 # define OPENSSL_V_4_0_0 0x40000000L
 
 # ifndef OpenSSL_version_num
@@ -194,6 +195,7 @@ typedef u_int64_t uint64_t;
 # endif
 
 # if OPENSSL_VERSION_NUMBER < OPENSSL_V_3_0_0
+typedef void OSSL_LIB_CTX;
 STACK_OF(X509) *X509_STORE_get1_all_certs(X509_STORE *store);
 #  define X509_VERIFY_PARAM_get0_email(vpm) ((void)(vpm), NULL) /* dummy */
 #  define X509_VERIFY_PARAM_get1_ip_asc(vpm) ((void)(vpm), NULL) /* dummy */
@@ -321,8 +323,22 @@ void UTIL_cleanse_free(OPTIONAL char *str);
  */
 bool UTIL_get_random(void *buf, size_t len);
 
+/* Check if |pre|, which must be a string literal, is a prefix of |str| */
 #define HAS_PREFIX(str, pre) (strncmp(str, pre "", sizeof(pre) - 1) == 0)
+/* As before, and if check succeeds, advance |str| past the prefix |pre| */
 #define CHECK_AND_SKIP_PREFIX(str, pre) (HAS_PREFIX(str, pre) ? ((str) += sizeof(pre) - 1, 1) : 0)
+/* Check if the string literal |p| is a case-insensitive prefix of |s| */
+#define HAS_CASE_PREFIX(s, p) (strncasecmp(s, p "", sizeof(p) - 1) == 0)
+/* As before, and if check succeeds, advance |str| past the prefix |pre| */
+#define CHECK_AND_SKIP_CASE_PREFIX(str, pre) (HAS_CASE_PREFIX(str, pre) ? ((str) += sizeof(pre) - 1, 1) : 0)
+/* Advance string pointer s, which must a modifiable lvalue, past scheme according to RFC 3986: ALPHA *( ALPHA / DIGIT / "+" / "-" / "." ) */
+#define UTIL_SKIP_SCHEME(s)                                                        \
+    do {                                                                           \
+        if (isalpha(*(s)))                                                         \
+            while (*(s) != '\0' && (isalnum(*(s)) || strchr("+-.", *(s)) != NULL)) \
+                (s)++;                                                             \
+    } while (0)
+#define UTIL_SCHEME_SUFFIX "://"
 
 /*!
  * @brief The function copies the source string into the destination buffer

src/libsecutils/src/certstatus/cdp_util.c

@@ -1,23 +1,24 @@
-/** 
+/**
 * @file cdp_util.c
-* 
+*
 * @brief Utilities needed by and assisting the CDP functionality
 *
 * @copyright Copyright (c) Siemens Mobility GmbH, 2021
 *
 * @author David von Oheimb <david.von.oheimb@siemens.com>
 *
-* This work is licensed under the terms of the Apache Software License 
+* This work is licensed under the terms of the Apache Software License
 * 2.0. See the COPYING file in the top-level directory.
 *
 * SPDX-License-Identifier: Apache-2.0
 */
 
 #include <certstatus/cdp_util.h>
 #include <certstatus/certstatus.h>
+#include <connections/conn.h> /* for CONN_IS_HTTP(S) */
 
 bool CDP_get_x509_name(
-    X509_NAME       *name,
+    const X509_NAME *name,
     char            *name_utf8_buf,
     size_t          name_utf8_buf_len,
     unsigned long   flags)
@@ -87,9 +88,8 @@ const char *CDP_get_uri_from_general_names(
         if(gtype == GEN_URI && ASN1_STRING_length(uri) > 7)
         {
             /* uri is of type ASN1_STRING */
-            const char* asn1_uri = (char*)ASN1_STRING_get0_data(uri);
-            if(strncasecmp(asn1_uri, "http://", 7) == 0
-               || strncasecmp(asn1_uri, "https://", 8) == 0)
+            const char *asn1_uri = (const char *)ASN1_STRING_get0_data(uri);
+            if (CONN_IS_HTTP(asn1_uri) || CONN_IS_HTTPS(asn1_uri))
             {
                 return asn1_uri;
             }

src/libsecutils/src/certstatus/crl_mgmt.c

@@ -143,8 +143,11 @@ static X509_CRL *get_crl_from_cache(const char * cachefile)
 
         int nextPublishIdx = X509_CRL_get_ext_by_NID(crl, NID_crl_next_publish, 0);
         if (nextPublishIdx >= 0) {
+#if OPENSSL_VERSION_NUMBER >= OPENSSL_V_4_0_0
+            const
+#endif
             X509_EXTENSION *ex = X509_CRL_get_ext(crl, nextPublishIdx);
-            ASN1_OCTET_STRING *data = X509_EXTENSION_get_data(ex);
+            const ASN1_OCTET_STRING *data = X509_EXTENSION_get_data(ex);
             if (B_ASN1_T61STRING == ASN1_STRING_type(data)) {
 #if OPENSSL_VERSION_NUMBER < 0x10101000L
                 LOG(FL_ERR, "CRL nextPublish extension is present, but ASN1_TIME_set_string_X509 is not supported for OpenSSL version <1.1, sorry");

src/libsecutils/src/certstatus/crls.c

@@ -300,8 +300,7 @@ static const char* get_dp_url(DIST_POINT* dp)
         if(gtype is_eq GEN_URI and ASN1_STRING_length(uri) > 6)
         {
             char* uptr = (char*)ASN1_STRING_get0_data(uri);
-            if(strncasecmp(uptr, CONN_http_prefix, strlen(CONN_http_prefix)) is_eq 0
-               or strncasecmp(uptr, "file:", 5) is_eq 0)
+            if (CONN_IS_HTTP(uptr) || HAS_CASE_PREFIX(uptr, "file:"))
             {
                 return uptr;
             }

src/libsecutils/src/connections/conn.c

@@ -1,13 +1,13 @@
-/** 
+/**
 * @file conn.c
-* 
+*
 * @brief Communication via OpenSSL BIO
 *
 * @copyright Copyright (c) Siemens Mobility GmbH, 2021
 *
 * @author David von Oheimb <david.von.oheimb@siemens.com>
 *
-* This work is licensed under the terms of the Apache Software License 
+* This work is licensed under the terms of the Apache Software License
 * 2.0. See the COPYING file in the top-level directory.
 *
 * SPDX-License-Identifier: Apache-2.0
@@ -21,47 +21,32 @@
 # include <openssl/ssl.h>
 #endif
 
-/* for getaddrinfo() and freeaddrinfo() */
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netdb.h>
-#ifdef _WIN32
-# include <winsock2.h>
-# include <ws2tcpip.h>
-#endif
-
 #include <operators.h>
 
 bool CONN_is_IP_address(OPTIONAL const char *host)
 {
-    size_t len;
-    struct addrinfo hints, *res = NULL;
-    int ret;
-
     if (host == NULL)
         return false;
 
     /* presume IPv6 address literal if host has the form "[<other-chars>]" */
-    len = strlen(host);
+    size_t len = strlen(host);
     if (len > 2 && *host == '[' && strchr(host + 1, '[') == NULL
             && strchr(host + 1, ']') == host + len - 1)
         return true;
 
-    memset(&hints, 0, sizeof(hints));
-    hints.ai_flags = AI_NUMERICHOST;
-    ret = getaddrinfo(host, NULL, &hints, &res);
-    if (ret == 0)
-        freeaddrinfo(res);
-    return ret == 0;
+    ERR_set_mark();
+    ASN1_OCTET_STRING *str = a2i_IPADDRESS(host);
+    ERR_pop_to_mark();
+    ASN1_OCTET_STRING_free(str);
+    return str != NULL;
 }
 
-static const char* skip_scheme(const char* str)
+static const char *skip_scheme(const char *str)
 {
-    const char *scheme_end = strstr(str, CONN_scheme_postfix);
-    if(0 not_eq scheme_end)
-    {
-        str = scheme_end + strlen(CONN_scheme_postfix);
-    }
+    const char *scheme_end = str;
+    UTIL_SKIP_SCHEME(scheme_end);
+    if (scheme_end != str && CHECK_AND_SKIP_PREFIX(scheme_end, UTIL_SCHEME_SUFFIX))
+        str = scheme_end;
     return str;
 }
 
@@ -95,7 +80,7 @@ int CONN_parse_uri(char** p_uri, int default_port, const char** p_path, char* de
         desc = "";
     }
 
-    if(strncasecmp(*p_uri, CONN_https_prefix, strlen(CONN_https_prefix)) is_eq 0)
+    if (CONN_IS_HTTPS(*p_uri))
     {
         *p_uri += strlen(CONN_https_prefix);
         if(0 is_eq default_port)
@@ -283,7 +268,7 @@ BIO* CONN_new(const char* host, const char* port)
         return 0;
     }
     if(port not_eq 0 /* else host_port is not null and has been used */
-       and not BIO_set_conn_port(bio, port)) 
+       and not BIO_set_conn_port(bio, port))
     {
         LOG(FL_ERR, "cannot set port for connect BIO");
         BIO_free(bio);