ssl_sess.c: deprecate SSL_SESSION_get_time/SSL_SESSION_set_time

[kanavin]

Fixes: #23648

[kanavin]

Signed CLA sent by email as specified in https://www.openssl.org/policies/cla.html

[kanavin]

CLA issue fixed, please re-trigger the CI.

[t8m]

This is strange. The CI failure is relevant but I do not see what is causing it.

[mattcaswell]

Probably this should have an entry in CHANGES.md. We should also update the documentation to show that these are deprecated (in the same style as we have done other deprecations in the docs)

[t8m]

This is strange. The CI failure is relevant but I do not see what is causing it.

Ah, this is most probably caused by using the OSSL_DEPRECATEDIN...FOR() macro instead of just OSSL_DEPRECATED_IN_... macro. The parser updating the .num files would have to be changed. Please use just OSSL_DEPRECATED_IN_....

[kanavin]

This is strange. The CI failure is relevant but I do not see what is causing it.

Ah, this is most probably caused by using the OSSL_DEPRECATEDIN...FOR() macro instead of just OSSL_DEPRECATED_IN_... macro. The parser updating the .num files would have to be changed. Please use just OSSL_DEPRECATED_IN_....

But that doesn't include a message advising what to use instead. You ok with that?

[mattcaswell]

Ah, yeah OSSL_DEPRECATEDIN..FOR() is quite a new addition

The parser updating the .num files would have to be changed.

We should really do that

[kanavin]

I'm also baffled by the other fail as the lines don't match to where I think the problem is:

sslapitest.c
..\test\sslapitest.c(9380): error C2220: the following warning is treated as an error
..\test\sslapitest.c(9380): warning C4244: 'function': conversion from 'time_t' to 'long', possible loss of data
..\test\sslapitest.c(9387): warning C4244: 'function': conversion from 'time_t' to 'long', possible loss of data
..\test\sslapitest.c(9394): warning C4244: 'function': conversion from 'time_t' to 'long', possible loss of data

The culprit I believe is:

void SSL_CTX_flush_sessions(SSL_CTX *ctx, long tm);

I guess SSL_CTX_flush_sessions_ex is needed as well, taking time_t?

[mattcaswell]

I'm also baffled by the other fail as the lines don't match to where I think the problem is:

That's github playing tricks on you. When the CI runs it automatically merges your PR against the latest master and tests the resulting code. Most likely there have been changes in sslapitest.c on master since you opened this PR which have shifted the line numbers. The problem is definitely the 3 SSL_CTX_flush_sessions calls.

[kanavin]

So should SSL_CTX_flush_sessions_ex() introduction be a separate PR or can I bundle that here?

[t8m]

So should SSL_CTX_flush_sessions_ex() introduction be a separate PR or can I bundle that here?

IMO you can bundle it here (in a separate commit for clarity).

[mattcaswell]

The parser updating the .num files would have to be changed.

This seems to fix it. @kanavin - do you want to incorporate that into this PR?

diff --git a/util/perl/OpenSSL/ParseC.pm b/util/perl/OpenSSL/ParseC.pm
index 661bd11818..f7f8a5827e 100644
--- a/util/perl/OpenSSL/ParseC.pm
+++ b/util/perl/OpenSSL/ParseC.pm
@@ -266,9 +266,15 @@ my @opensslchandlers = (
     { regexp   => qr/OSSL_DEPRECATEDIN_\d+_\d+(?:_\d+)?\s+(.*)/,
       massager => sub { return $1; },
     },
+    { regexp   => qr/OSSL_DEPRECATEDIN_\d+_\d+(?:_\d+)?_FOR<<<.*>>>(.*)/,
+      massager => sub { return $1; },
+    },
     { regexp   => qr/(.*?)\s+OSSL_DEPRECATEDIN_\d+_\d+(?:_\d+)?\s+(.*)/,
       massager => sub { return "$1 $2"; },
     },
+    { regexp   => qr/(.*?)\s+OSSL_DEPRECATEDIN_\d+_\d+(?:_\d+)?_FOR<<<.*>>>(.*)/,
+      massager => sub { return "$1 $2"; },
+    },
 
     #####
     # Core stuff

[kanavin]

The parser updating the .num files would have to be changed.

This seems to fix it. @kanavin - do you want to incorporate that into this PR?

diff --git a/util/perl/OpenSSL/ParseC.pm b/util/perl/OpenSSL/ParseC.pm
index 661bd11818..f7f8a5827e 100644
--- a/util/perl/OpenSSL/ParseC.pm
+++ b/util/perl/OpenSSL/ParseC.pm
@@ -266,9 +266,15 @@ my @opensslchandlers = (
     { regexp   => qr/OSSL_DEPRECATEDIN_\d+_\d+(?:_\d+)?\s+(.*)/,
       massager => sub { return $1; },
     },
+    { regexp   => qr/OSSL_DEPRECATEDIN_\d+_\d+(?:_\d+)?_FOR<<<.*>>>(.*)/,
+      massager => sub { return $1; },
+    },
     { regexp   => qr/(.*?)\s+OSSL_DEPRECATEDIN_\d+_\d+(?:_\d+)?\s+(.*)/,
       massager => sub { return "$1 $2"; },
     },
+    { regexp   => qr/(.*?)\s+OSSL_DEPRECATEDIN_\d+_\d+(?:_\d+)?_FOR<<<.*>>>(.*)/,
+      massager => sub { return "$1 $2"; },
+    },
 
     #####
     # Core stuff

Yes, of course. Thanks!

[kanavin]

Alright, I hopefully have addressed both CI fails and review comments.

[t8m]

OTC: Do we want to deprecate SSL_SESSION_get_time()/SSL_SESSION_set_time()/SSL_CTX_flush_sessions() in 3.4 or at some later point?