Make aws-lc -Werrror clean

schwabe · schwabe · commit f1ae4305bed7 · 2026-03-11T17:49:20.000+01:00
Change-Id: I8ff30785f78fdcda136ef3fe982f8cda2edec059
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -498,7 +498,7 @@ jobs:
           OPENSSL_CFLAGS="-I${{ env.AWS_LC_INSTALL }}/include" \
           OPENSSL_LIBS="-L${{ env.AWS_LC_INSTALL }}/lib -lssl -lcrypto" \
           LDFLAGS="-Wl,-rpath=${{ env.AWS_LC_INSTALL }}/lib" \
-          ./configure --with-crypto-library=openssl
+          ./configure --with-crypto-library=openssl --enable-werror
       - name: make all
         run: make -j3
       - name: Ensure the build uses AWS-LC
diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c
@@ -229,7 +229,7 @@ crypto_clear_error(void)
 void
 crypto_print_openssl_errors(const unsigned int flags)
 {
-    unsigned long err = 0;
+    openssl_err_t err = 0;
     int line, errflags;
     const char *file, *data, *func;
 
@@ -425,7 +425,7 @@ void
 print_digest(EVP_MD *digest, void *unused)
 {
     printf("%s %d bit digest size\n", md_kt_name(EVP_MD_get0_name(digest)),
-           EVP_MD_size(digest) * 8);
+           (int)EVP_MD_size(digest) * 8);
 }
 
 void
@@ -1022,7 +1022,7 @@ md_get(const char *digest)
                    "Message hash algorithm '%s' uses a default hash "
                    "size (%d bytes) which is larger than " PACKAGE_NAME "'s current "
                    "maximum hash size (%d bytes)",
-                   digest, EVP_MD_size(md), MAX_HMAC_KEY_LENGTH);
+                   digest, (int)EVP_MD_size(md), MAX_HMAC_KEY_LENGTH);
     }
     return md;
 }
@@ -1152,7 +1152,7 @@ md_ctx_cleanup(EVP_MD_CTX *ctx)
 int
 md_ctx_size(const EVP_MD_CTX *ctx)
 {
-    return EVP_MD_CTX_size(ctx);
+    return (int)EVP_MD_CTX_size(ctx);
 }
 
 void
@@ -1201,7 +1201,7 @@ hmac_ctx_init(HMAC_CTX *ctx, const uint8_t *key, const char *mdname)
     evp_md_type *kt = md_get(mdname);
     ASSERT(NULL != kt && NULL != ctx);
 
-    int key_len = EVP_MD_size(kt);
+    size_t key_len = EVP_MD_size(kt);
     HMAC_CTX_reset(ctx);
     if (!HMAC_Init_ex(ctx, key, key_len, kt, NULL))
     {
diff --git a/src/openvpn/openssl_compat.h b/src/openvpn/openssl_compat.h
@@ -45,6 +45,15 @@
 #include <openssl/x509.h>
 #include <openssl/err.h>
 
+/* Define the type of error. This is something that is less
+ * intrusive than casts everywhere */
+#if defined(OPENSSL_IS_AWSLC)
+typedef uint32_t openssl_err_t;
+#else
+typedef unsigned long openssl_err_t;
+#endif
+
+
 /* Functionality missing in 1.1.0 */
 #if OPENSSL_VERSION_NUMBER < 0x10101000L && !defined(ENABLE_CRYPTO_WOLFSSL)
 #define SSL_CTX_set1_groups SSL_CTX_set1_curves
@@ -157,12 +166,12 @@ EVP_MD_free(const EVP_MD *md)
     /* OpenSSL 1.1.1 and lower use only const EVP_MD, nothing to free */
 }
 
-static inline unsigned long
+static inline openssl_err_t
 ERR_get_error_all(const char **file, int *line, const char **func, const char **data, int *flags)
 {
     static const char *empty = "";
     *func = empty;
-    unsigned long err = ERR_get_error_line_data(file, line, data, flags);
+    openssl_err_t err = ERR_get_error_line_data(file, line, data, flags);
     return err;
 }
 
diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c
@@ -518,8 +518,9 @@ tls_ctx_restrict_ciphers_tls13(struct tls_root_ctx *ctx, const char *ciphers)
 void
 tls_ctx_set_cert_profile(struct tls_root_ctx *ctx, const char *profile)
 {
-#if OPENSSL_VERSION_NUMBER > 0x10100000L \
-    && (!defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER > 0x3060000fL)
+#if OPENSSL_VERSION_NUMBER > 0x10100000L                                            \
+    && (!defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER > 0x3060000fL) \
+    && !defined(OPENSSL_IS_AWSLC)
     /* OpenSSL does not have certificate profiles, but a complex set of
      * callbacks that we could try to implement to achieve something similar.
      * For now, use OpenSSL's security levels to achieve similar (but not equal)
@@ -549,7 +550,7 @@ tls_ctx_set_cert_profile(struct tls_root_ctx *ctx, const char *profile)
     if (profile)
     {
         msg(M_WARN,
-            "WARNING: OpenSSL 1.1.0 and LibreSSL do not support "
+            "WARNING: OpenSSL 1.1.0, aws-lc and LibreSSL do not support "
             "--tls-cert-profile, ignoring user-set profile: '%s'",
             profile);
     }
@@ -906,7 +907,6 @@ tls_ctx_load_pkcs12(struct tls_root_ctx *ctx, const char *pkcs12_file, bool pkcs
     X509 *cert;
     STACK_OF(X509) *ca = NULL;
     PKCS12 *p12;
-    int i;
     char password[256];
 
     ASSERT(NULL != ctx);
@@ -990,7 +990,7 @@ tls_ctx_load_pkcs12(struct tls_root_ctx *ctx, const char *pkcs12_file, bool pkcs
          */
         if (ca && sk_X509_num(ca))
         {
-            for (i = 0; i < sk_X509_num(ca); i++)
+            for (size_t i = 0; i < (size_t)sk_X509_num(ca); i++)
             {
                 X509_STORE *cert_store = SSL_CTX_get_cert_store(ctx->ctx);
                 if (!X509_STORE_add_cert(cert_store, sk_X509_value(ca, i)))
@@ -1015,7 +1015,7 @@ tls_ctx_load_pkcs12(struct tls_root_ctx *ctx, const char *pkcs12_file, bool pkcs
          */
         if (ca && sk_X509_num(ca))
         {
-            for (i = 0; i < sk_X509_num(ca); i++)
+            for (size_t i = 0; i < (size_t)sk_X509_num(ca); i++)
             {
                 if (!SSL_CTX_add_extra_chain_cert(ctx->ctx, sk_X509_value(ca, i)))
                 {
@@ -1331,7 +1331,7 @@ backend_tls_ctx_reload_crl(struct tls_root_ctx *ssl_ctx, const char *crl_file, b
      * we need to manually find the CRL object from the stack
      * and remove it */
     STACK_OF(X509_OBJECT) *objs = X509_STORE_get0_objects(store);
-    for (int i = 0; i < sk_X509_OBJECT_num(objs); i++)
+    for (size_t i = 0; i < (size_t)sk_X509_OBJECT_num(objs); i++)
     {
         X509_OBJECT *obj = sk_X509_OBJECT_value(objs, i);
         ASSERT(obj);
@@ -1591,7 +1591,7 @@ static int
 ecdsa_sign(int type, const unsigned char *dgst, int dgstlen, unsigned char *sig,
            unsigned int *siglen, const BIGNUM *kinv, const BIGNUM *r, EC_KEY *ec)
 {
-    int capacity = ECDSA_size(ec);
+    int capacity = (int)ECDSA_size(ec);
     /*
      * ECDSA does not seem to have proper constants for paddings since
      * there are only signatures without padding at the moment, use
@@ -1607,12 +1607,14 @@ ecdsa_sign(int type, const unsigned char *dgst, int dgstlen, unsigned char *sig,
     return 0;
 }
 
+#ifndef OPENSSL_IS_AWSLC
 /* EC_KEY_METHOD callback: sign_setup(). We do no precomputations */
 static int
 ecdsa_sign_setup(EC_KEY *ec, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
 {
     return 1;
 }
+#endif
 
 /* EC_KEY_METHOD callback: sign_sig().
  * Sign the hash and return the result as a newly allocated ECDS_SIG
@@ -1623,7 +1625,7 @@ ecdsa_sign_sig(const unsigned char *dgst, int dgstlen, const BIGNUM *in_kinv, co
                EC_KEY *ec)
 {
     ECDSA_SIG *ecsig = NULL;
-    unsigned int len = ECDSA_size(ec);
+    unsigned int len = (unsigned int)ECDSA_size(ec);
     struct gc_arena gc = gc_new();
 
     unsigned char *buf = gc_malloc(len, false, &gc);
@@ -1790,7 +1792,7 @@ tls_ctx_load_ca(struct tls_root_ctx *ctx, const char *ca_file, bool ca_file_inli
     X509_STORE *store = NULL;
     X509_NAME *xn = NULL;
     BIO *in = NULL;
-    int i, added = 0, prev = 0;
+    size_t added = 0, prev = 0;
 
     ASSERT(NULL != ctx);
 
@@ -1819,7 +1821,7 @@ tls_ctx_load_ca(struct tls_root_ctx *ctx, const char *ca_file, bool ca_file_inli
 
         if (info_stack)
         {
-            for (i = 0; i < sk_X509_INFO_num(info_stack); i++)
+            for (size_t i = 0; i < (size_t)sk_X509_INFO_num(info_stack); i++)
             {
                 X509_INFO *info = sk_X509_INFO_value(info_stack, i);
                 if (info->crl)
@@ -1872,19 +1874,19 @@ tls_ctx_load_ca(struct tls_root_ctx *ctx, const char *ca_file, bool ca_file_inli
 
                 if (tls_server)
                 {
-                    int cnum = sk_X509_NAME_num(cert_names);
+                    size_t cnum = sk_X509_NAME_num(cert_names);
                     if (cnum != (prev + 1))
                     {
                         crypto_msg(M_WARN,
-                                   "Cannot load CA certificate file %s (entry %d did not validate)",
+                                   "Cannot load CA certificate file %s (entry %zu did not validate)",
                                    print_key_filename(ca_file, ca_file_inline), added);
                     }
                     prev = cnum;
                 }
             }
             sk_X509_INFO_pop_free(info_stack, X509_INFO_free);
         }
-        int cnum;
+        size_t cnum;
         if (tls_server)
         {
             cnum = sk_X509_NAME_num(cert_names);
@@ -1902,8 +1904,8 @@ tls_ctx_load_ca(struct tls_root_ctx *ctx, const char *ca_file, bool ca_file_inli
             if (cnum != added)
             {
                 crypto_msg(M_FATAL,
-                           "Cannot load CA certificate file %s (only %d "
-                           "of %d entries were valid X509 names)",
+                           "Cannot load CA certificate file %s (only %zu "
+                           "of %zu entries were valid X509 names)",
                            print_key_filename(ca_file, ca_file_inline), cnum, added);
             }
         }
@@ -2552,7 +2554,7 @@ show_available_tls_ciphers_list(const char *cipher_list, const char *tls_cert_pr
 #else
     STACK_OF(SSL_CIPHER) *sk = SSL_get1_supported_ciphers(ssl);
 #endif
-    for (int i = 0; i < sk_SSL_CIPHER_num(sk); i++)
+    for (size_t i = 0; i < (size_t)sk_SSL_CIPHER_num(sk); i++)
     {
         const SSL_CIPHER *c = sk_SSL_CIPHER_value(sk, i);
 
diff --git a/src/openvpn/ssl_verify_openssl.c b/src/openvpn/ssl_verify_openssl.c
@@ -138,10 +138,10 @@ extract_x509_extension(X509 *cert, char *fieldname, char *out, size_t size)
          * one, but we don't depend on it...
          */
 
-        int numalts = sk_GENERAL_NAME_num(extensions);
+        size_t numalts = sk_GENERAL_NAME_num(extensions);
 
         /* loop through all alternatives */
-        for (int i = 0; i < numalts; i++)
+        for (size_t i = 0; i < numalts; i++)
         {
             /* get a handle to alternative name number i */
             const GENERAL_NAME *name = sk_GENERAL_NAME_value(extensions, i);
@@ -344,7 +344,7 @@ x509_get_sha1_fingerprint(X509 *cert, struct gc_arena *gc)
     const EVP_MD *sha1 = EVP_sha1();
     struct buffer hash = alloc_buf_gc((size_t)EVP_MD_size(sha1), gc);
     X509_digest(cert, EVP_sha1(), BPTR(&hash), NULL);
-    ASSERT(buf_inc_len(&hash, EVP_MD_size(sha1)));
+    ASSERT(buf_inc_len(&hash, (int)EVP_MD_size(sha1)));
     return hash;
 }
 
@@ -354,7 +354,7 @@ x509_get_sha256_fingerprint(X509 *cert, struct gc_arena *gc)
     const EVP_MD *sha256 = EVP_sha256();
     struct buffer hash = alloc_buf_gc((size_t)EVP_MD_size(sha256), gc);
     X509_digest(cert, EVP_sha256(), BPTR(&hash), NULL);
-    ASSERT(buf_inc_len(&hash, EVP_MD_size(sha256)));
+    ASSERT(buf_inc_len(&hash, (int)EVP_MD_size(sha256)));
     return hash;
 }
 
@@ -739,10 +739,8 @@ x509_verify_cert_eku(X509 *x509, const char *const expected_oid)
     }
     else
     {
-        int i;
-
         msg(D_HANDSHAKE, "Validating certificate extended key usage");
-        for (i = 0; SUCCESS != fFound && i < sk_ASN1_OBJECT_num(eku); i++)
+        for (size_t i = 0; SUCCESS != fFound && i < (size_t)sk_ASN1_OBJECT_num(eku); i++)
         {
             ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(eku, i);
             char szOid[1024];
@@ -791,7 +789,7 @@ tls_verify_crl_missing(const struct tls_options *opt)
     }
 
     STACK_OF(X509_OBJECT) *objs = X509_STORE_get0_objects(store);
-    for (int i = 0; i < sk_X509_OBJECT_num(objs); i++)
+    for (size_t i = 0; i < (size_t)sk_X509_OBJECT_num(objs); i++)
     {
         X509_OBJECT *obj = sk_X509_OBJECT_value(objs, i);
         ASSERT(obj);

Original file line number	Diff line number	Diff line change
`@@ -229,7 +229,7 @@ crypto_clear_error(void)`
`229`	`229`	`void`
`230`	`230`	`crypto_print_openssl_errors(const unsigned int flags)`
`231`	`231`	`{`
`232`		`- unsigned long err = 0;`
	`232`	`+ openssl_err_t err = 0;`
`233`	`233`	`int line, errflags;`
`234`	`234`	`const char file, data, *func;`
`235`	`235`
`@@ -425,7 +425,7 @@ void`
`425`	`425`	`print_digest(EVP_MD digest, void unused)`
`426`	`426`	`{`
`427`	`427`	`printf("%s %d bit digest size\n", md_kt_name(EVP_MD_get0_name(digest)),`
`428`		`- EVP_MD_size(digest) * 8);`
	`428`	`+ (int)EVP_MD_size(digest) * 8);`
`429`	`429`	`}`
`430`	`430`
`431`	`431`	`void`
`@@ -1022,7 +1022,7 @@ md_get(const char *digest)`
`1022`	`1022`	`"Message hash algorithm '%s' uses a default hash "`
`1023`	`1023`	`"size (%d bytes) which is larger than " PACKAGE_NAME "'s current "`
`1024`	`1024`	`"maximum hash size (%d bytes)",`
`1025`		`- digest, EVP_MD_size(md), MAX_HMAC_KEY_LENGTH);`
	`1025`	`+ digest, (int)EVP_MD_size(md), MAX_HMAC_KEY_LENGTH);`
`1026`	`1026`	`}`
`1027`	`1027`	`return md;`
`1028`	`1028`	`}`
`@@ -1152,7 +1152,7 @@ md_ctx_cleanup(EVP_MD_CTX *ctx)`
`1152`	`1152`	`int`
`1153`	`1153`	`md_ctx_size(const EVP_MD_CTX *ctx)`
`1154`	`1154`	`{`
`1155`		`- return EVP_MD_CTX_size(ctx);`
	`1155`	`+ return (int)EVP_MD_CTX_size(ctx);`
`1156`	`1156`	`}`
`1157`	`1157`
`1158`	`1158`	`void`
`@@ -1201,7 +1201,7 @@ hmac_ctx_init(HMAC_CTX ctx, const uint8_t key, const char *mdname)`
`1201`	`1201`	`evp_md_type *kt = md_get(mdname);`
`1202`	`1202`	`ASSERT(NULL != kt && NULL != ctx);`
`1203`	`1203`
`1204`		`- int key_len = EVP_MD_size(kt);`
	`1204`	`+ size_t key_len = EVP_MD_size(kt);`
`1205`	`1205`	`HMAC_CTX_reset(ctx);`
`1206`	`1206`	`if (!HMAC_Init_ex(ctx, key, key_len, kt, NULL))`
`1207`	`1207`	`{`
Original file line number	Diff line number	Diff line change
`@@ -518,8 +518,9 @@ tls_ctx_restrict_ciphers_tls13(struct tls_root_ctx ctx, const char ciphers)`
`518`	`518`	`void`
`519`	`519`	`tls_ctx_set_cert_profile(struct tls_root_ctx ctx, const char profile)`
`520`	`520`	`{`
`521`		`-#if OPENSSL_VERSION_NUMBER > 0x10100000L \`
`522`		`- && (!defined(LIBRESSL_VERSION_NUMBER) \|\| LIBRESSL_VERSION_NUMBER > 0x3060000fL)`
	`521`	`+#if OPENSSL_VERSION_NUMBER > 0x10100000L \`
	`522`	`+ && (!defined(LIBRESSL_VERSION_NUMBER) \|\| LIBRESSL_VERSION_NUMBER > 0x3060000fL) \`
	`523`	`+ && !defined(OPENSSL_IS_AWSLC)`
`523`	`524`	`/* OpenSSL does not have certificate profiles, but a complex set of`
`524`	`525`	`* callbacks that we could try to implement to achieve something similar.`
`525`	`526`	`* For now, use OpenSSL's security levels to achieve similar (but not equal)`
`@@ -549,7 +550,7 @@ tls_ctx_set_cert_profile(struct tls_root_ctx ctx, const char profile)`
`549`	`550`	`if (profile)`
`550`	`551`	`{`
`551`	`552`	`msg(M_WARN,`
`552`		`- "WARNING: OpenSSL 1.1.0 and LibreSSL do not support "`
	`553`	`+ "WARNING: OpenSSL 1.1.0, aws-lc and LibreSSL do not support "`
`553`	`554`	`"--tls-cert-profile, ignoring user-set profile: '%s'",`
`554`	`555`	`profile);`
`555`	`556`	`}`
`@@ -906,7 +907,6 @@ tls_ctx_load_pkcs12(struct tls_root_ctx ctx, const char pkcs12_file, bool pkcs`
`906`	`907`	`X509 *cert;`
`907`	`908`	`STACK_OF(X509) *ca = NULL;`
`908`	`909`	`PKCS12 *p12;`
`909`		`- int i;`
`910`	`910`	`char password[256];`
`911`	`911`
`912`	`912`	`ASSERT(NULL != ctx);`
`@@ -990,7 +990,7 @@ tls_ctx_load_pkcs12(struct tls_root_ctx ctx, const char pkcs12_file, bool pkcs`
`990`	`990`	`*/`
`991`	`991`	`if (ca && sk_X509_num(ca))`
`992`	`992`	`{`
`993`		`- for (i = 0; i < sk_X509_num(ca); i++)`
	`993`	`+ for (size_t i = 0; i < (size_t)sk_X509_num(ca); i++)`
`994`	`994`	`{`
`995`	`995`	`X509_STORE *cert_store = SSL_CTX_get_cert_store(ctx->ctx);`
`996`	`996`	`if (!X509_STORE_add_cert(cert_store, sk_X509_value(ca, i)))`
`@@ -1015,7 +1015,7 @@ tls_ctx_load_pkcs12(struct tls_root_ctx ctx, const char pkcs12_file, bool pkcs`
`1015`	`1015`	`*/`
`1016`	`1016`	`if (ca && sk_X509_num(ca))`
`1017`	`1017`	`{`
`1018`		`- for (i = 0; i < sk_X509_num(ca); i++)`
	`1018`	`+ for (size_t i = 0; i < (size_t)sk_X509_num(ca); i++)`
`1019`	`1019`	`{`
`1020`	`1020`	`if (!SSL_CTX_add_extra_chain_cert(ctx->ctx, sk_X509_value(ca, i)))`
`1021`	`1021`	`{`
`@@ -1331,7 +1331,7 @@ backend_tls_ctx_reload_crl(struct tls_root_ctx ssl_ctx, const char crl_file, b`
`1331`	`1331`	`* we need to manually find the CRL object from the stack`
`1332`	`1332`	`* and remove it */`
`1333`	`1333`	`STACK_OF(X509_OBJECT) *objs = X509_STORE_get0_objects(store);`
`1334`		`- for (int i = 0; i < sk_X509_OBJECT_num(objs); i++)`
	`1334`	`+ for (size_t i = 0; i < (size_t)sk_X509_OBJECT_num(objs); i++)`
`1335`	`1335`	`{`
`1336`	`1336`	`X509_OBJECT *obj = sk_X509_OBJECT_value(objs, i);`
`1337`	`1337`	`ASSERT(obj);`
`@@ -1591,7 +1591,7 @@ static int`
`1591`	`1591`	`ecdsa_sign(int type, const unsigned char dgst, int dgstlen, unsigned char sig,`
`1592`	`1592`	`unsigned int siglen, const BIGNUM kinv, const BIGNUM r, EC_KEY ec)`
`1593`	`1593`	`{`
`1594`		`- int capacity = ECDSA_size(ec);`
	`1594`	`+ int capacity = (int)ECDSA_size(ec);`
`1595`	`1595`	`/*`
`1596`	`1596`	`* ECDSA does not seem to have proper constants for paddings since`
`1597`	`1597`	`* there are only signatures without padding at the moment, use`
`@@ -1607,12 +1607,14 @@ ecdsa_sign(int type, const unsigned char dgst, int dgstlen, unsigned char sig,`
`1607`	`1607`	`return 0;`
`1608`	`1608`	`}`
`1609`	`1609`
	`1610`	`+#ifndef OPENSSL_IS_AWSLC`
`1610`	`1611`	`/* EC_KEY_METHOD callback: sign_setup(). We do no precomputations */`
`1611`	`1612`	`static int`
`1612`	`1613`	`ecdsa_sign_setup(EC_KEY ec, BN_CTX ctx_in, BIGNUM kinvp, BIGNUM rp)`
`1613`	`1614`	`{`
`1614`	`1615`	`return 1;`
`1615`	`1616`	`}`
	`1617`	`+#endif`
`1616`	`1618`
`1617`	`1619`	`/* EC_KEY_METHOD callback: sign_sig().`
`1618`	`1620`	`* Sign the hash and return the result as a newly allocated ECDS_SIG`
`@@ -1623,7 +1625,7 @@ ecdsa_sign_sig(const unsigned char dgst, int dgstlen, const BIGNUM in_kinv, co`
`1623`	`1625`	`EC_KEY *ec)`
`1624`	`1626`	`{`
`1625`	`1627`	`ECDSA_SIG *ecsig = NULL;`
`1626`		`- unsigned int len = ECDSA_size(ec);`
	`1628`	`+ unsigned int len = (unsigned int)ECDSA_size(ec);`
`1627`	`1629`	`struct gc_arena gc = gc_new();`
`1628`	`1630`
`1629`	`1631`	`unsigned char *buf = gc_malloc(len, false, &gc);`
`@@ -1790,7 +1792,7 @@ tls_ctx_load_ca(struct tls_root_ctx ctx, const char ca_file, bool ca_file_inli`
`1790`	`1792`	`X509_STORE *store = NULL;`
`1791`	`1793`	`X509_NAME *xn = NULL;`
`1792`	`1794`	`BIO *in = NULL;`
`1793`		`- int i, added = 0, prev = 0;`
	`1795`	`+ size_t added = 0, prev = 0;`
`1794`	`1796`
`1795`	`1797`	`ASSERT(NULL != ctx);`
`1796`	`1798`
`@@ -1819,7 +1821,7 @@ tls_ctx_load_ca(struct tls_root_ctx ctx, const char ca_file, bool ca_file_inli`
`1819`	`1821`
`1820`	`1822`	`if (info_stack)`
`1821`	`1823`	`{`
`1822`		`- for (i = 0; i < sk_X509_INFO_num(info_stack); i++)`
	`1824`	`+ for (size_t i = 0; i < (size_t)sk_X509_INFO_num(info_stack); i++)`
`1823`	`1825`	`{`
`1824`	`1826`	`X509_INFO *info = sk_X509_INFO_value(info_stack, i);`
`1825`	`1827`	`if (info->crl)`
`@@ -1872,19 +1874,19 @@ tls_ctx_load_ca(struct tls_root_ctx ctx, const char ca_file, bool ca_file_inli`
`1872`	`1874`
`1873`	`1875`	`if (tls_server)`
`1874`	`1876`	`{`
`1875`		`- int cnum = sk_X509_NAME_num(cert_names);`
	`1877`	`+ size_t cnum = sk_X509_NAME_num(cert_names);`
`1876`	`1878`	`if (cnum != (prev + 1))`
`1877`	`1879`	`{`
`1878`	`1880`	`crypto_msg(M_WARN,`
`1879`		`- "Cannot load CA certificate file %s (entry %d did not validate)",`
	`1881`	`+ "Cannot load CA certificate file %s (entry %zu did not validate)",`
`1880`	`1882`	`print_key_filename(ca_file, ca_file_inline), added);`
`1881`	`1883`	`}`
`1882`	`1884`	`prev = cnum;`
`1883`	`1885`	`}`
`1884`	`1886`	`}`
`1885`	`1887`	`sk_X509_INFO_pop_free(info_stack, X509_INFO_free);`
`1886`	`1888`	`}`
`1887`		`- int cnum;`
	`1889`	`+ size_t cnum;`
`1888`	`1890`	`if (tls_server)`
`1889`	`1891`	`{`
`1890`	`1892`	`cnum = sk_X509_NAME_num(cert_names);`
`@@ -1902,8 +1904,8 @@ tls_ctx_load_ca(struct tls_root_ctx ctx, const char ca_file, bool ca_file_inli`
`1902`	`1904`	`if (cnum != added)`
`1903`	`1905`	`{`
`1904`	`1906`	`crypto_msg(M_FATAL,`
`1905`		`- "Cannot load CA certificate file %s (only %d "`
`1906`		`- "of %d entries were valid X509 names)",`
	`1907`	`+ "Cannot load CA certificate file %s (only %zu "`
	`1908`	`+ "of %zu entries were valid X509 names)",`
`1907`	`1909`	`print_key_filename(ca_file, ca_file_inline), cnum, added);`
`1908`	`1910`	`}`
`1909`	`1911`	`}`
`@@ -2552,7 +2554,7 @@ show_available_tls_ciphers_list(const char cipher_list, const char tls_cert_pr`
`2552`	`2554`	`#else`
`2553`	`2555`	`STACK_OF(SSL_CIPHER) *sk = SSL_get1_supported_ciphers(ssl);`
`2554`	`2556`	`#endif`
`2555`		`- for (int i = 0; i < sk_SSL_CIPHER_num(sk); i++)`
	`2557`	`+ for (size_t i = 0; i < (size_t)sk_SSL_CIPHER_num(sk); i++)`
`2556`	`2558`	`{`
`2557`	`2559`	`const SSL_CIPHER *c = sk_SSL_CIPHER_value(sk, i);`
`2558`	`2560`
Original file line number	Diff line number	Diff line change
`@@ -138,10 +138,10 @@ extract_x509_extension(X509 cert, char fieldname, char *out, size_t size)`
`138`	`138`	`* one, but we don't depend on it...`
`139`	`139`	`*/`
`140`	`140`
`141`		`- int numalts = sk_GENERAL_NAME_num(extensions);`
	`141`	`+ size_t numalts = sk_GENERAL_NAME_num(extensions);`
`142`	`142`
`143`	`143`	`/* loop through all alternatives */`
`144`		`- for (int i = 0; i < numalts; i++)`
	`144`	`+ for (size_t i = 0; i < numalts; i++)`
`145`	`145`	`{`
`146`	`146`	`/* get a handle to alternative name number i */`
`147`	`147`	`const GENERAL_NAME *name = sk_GENERAL_NAME_value(extensions, i);`
`@@ -344,7 +344,7 @@ x509_get_sha1_fingerprint(X509 cert, struct gc_arena gc)`
`344`	`344`	`const EVP_MD *sha1 = EVP_sha1();`
`345`	`345`	`struct buffer hash = alloc_buf_gc((size_t)EVP_MD_size(sha1), gc);`
`346`	`346`	`X509_digest(cert, EVP_sha1(), BPTR(&hash), NULL);`
`347`		`- ASSERT(buf_inc_len(&hash, EVP_MD_size(sha1)));`
	`347`	`+ ASSERT(buf_inc_len(&hash, (int)EVP_MD_size(sha1)));`
`348`	`348`	`return hash;`
`349`	`349`	`}`
`350`	`350`
`@@ -354,7 +354,7 @@ x509_get_sha256_fingerprint(X509 cert, struct gc_arena gc)`
`354`	`354`	`const EVP_MD *sha256 = EVP_sha256();`
`355`	`355`	`struct buffer hash = alloc_buf_gc((size_t)EVP_MD_size(sha256), gc);`
`356`	`356`	`X509_digest(cert, EVP_sha256(), BPTR(&hash), NULL);`
`357`		`- ASSERT(buf_inc_len(&hash, EVP_MD_size(sha256)));`
	`357`	`+ ASSERT(buf_inc_len(&hash, (int)EVP_MD_size(sha256)));`
`358`	`358`	`return hash;`
`359`	`359`	`}`
`360`	`360`
`@@ -739,10 +739,8 @@ x509_verify_cert_eku(X509 x509, const char const expected_oid)`
`739`	`739`	`}`
`740`	`740`	`else`
`741`	`741`	`{`
`742`		`- int i;`
`743`		`-`
`744`	`742`	`msg(D_HANDSHAKE, "Validating certificate extended key usage");`
`745`		`- for (i = 0; SUCCESS != fFound && i < sk_ASN1_OBJECT_num(eku); i++)`
	`743`	`+ for (size_t i = 0; SUCCESS != fFound && i < (size_t)sk_ASN1_OBJECT_num(eku); i++)`
`746`	`744`	`{`
`747`	`745`	`ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(eku, i);`
`748`	`746`	`char szOid[1024];`
`@@ -791,7 +789,7 @@ tls_verify_crl_missing(const struct tls_options *opt)`
`791`	`789`	`}`
`792`	`790`
`793`	`791`	`STACK_OF(X509_OBJECT) *objs = X509_STORE_get0_objects(store);`
`794`		`- for (int i = 0; i < sk_X509_OBJECT_num(objs); i++)`
	`792`	`+ for (size_t i = 0; i < (size_t)sk_X509_OBJECT_num(objs); i++)`
`795`	`793`	`{`
`796`	`794`	`X509_OBJECT *obj = sk_X509_OBJECT_value(objs, i);`
`797`	`795`	`ASSERT(obj);`