Treat ASN1_STRING as opaque

[botovq]

OpenSSL plans to make ASN1_STRING opaque along with all the other types sharing the same underlying struct asn1_string_st:

• Make ASN1_STRING opaque and X509 more memory-efficient in 4.x openssl/openssl#29117

For most purposes there are accessors available in all supported libraries. The one exception is the ASN1_BIT_STRING type, which requires new API to deal with the unused bits octet, see:

• Create public API to retrieve length and unused bytes from an ASN1_BIT_STRING. openssl/openssl#29184
• Create a public API to create an ASN1_STRING containing an ASN1_BIT_STRING. openssl/openssl#29185

Dealing with this has to wait until the interface has settled, at which point we can provide a compat-interface, so this PR doesn't touch BIT STRINGS.

The diff in this pull request is almost entirely mechanical.

A better approach might be to move asn1str_to_str to ossl.[ch] (and rename it to ossl_asn1str_to_str()?) and then convert the various calls to rb_str_new() with nested ASN1_STRING unpacking to that.

Finally, in the diff you can see that there's also a /* const_cast: workaround for old OpenSSL */ in ossl_asn1.c that can be removed along with the cast. Happy to send a PR for that.

[botovq]

The test failure seems unrelated.

I forgot to mention: I have versions of this patch that apply to the version of this gem bundled in Ruby 3.3.10 and 3.4.7 which I'm happy to share if it helps you.

[rhenium]

Thanks for the PR! This makes sense.

A better approach might be to move asn1str_to_str to ossl.[ch] (and rename it to ossl_asn1str_to_str()?) and then convert the various calls to rb_str_new() with nested ASN1_STRING unpacking to that.

That sounds even better. Actually, asn1str_to_str() is already usable everywhere (because ossl.h includes ossl_asn1.h) and these should have been using it. The missing ossl_ prefix in the name is just historical.

I'd appreciate if you can update these, but this can also be left for later.

I forgot to mention: I have versions of this patch that apply to the version of this gem bundled in Ruby 3.3.10 and 3.4.7 which I'm happy to share if it helps you.

This is unlikely to be backported since maintenance branches accept bugfixes only. Anyone needing to use an old Ruby with OpenSSL 4.x should be able to skip the bundled openssl and later install a newer version via RubyGems. So let's fix it in master only for now.

[botovq]

I'd appreciate if you can update these, but this can also be left for later.

Done.

This is unlikely to be backported since maintenance branches accept bugfixes only.

Understood. Thanks for the quick turnaround.

[rhenium]

Thanks!