control: tags -1 + patch control: forwarded -1 https://github.com/apache/thrift/pull/3761
Adding patch Sebastian
>From 75ece25e8ec57d6fc65a0fb6c6f68fcc4ff3ed88 Mon Sep 17 00:00:00 2001 From: Sebastian Andrzej Siewior <[email protected]> Date: Sun, 30 Aug 2026 09:51:40 +0200 Subject: [PATCH] transport: Make it compatible with OpenSSL 4.0 Make it compatible with OpenSSL 4.0: - Remove ERR_remove_state(). It has been an empty stub since OpenSSL 1.1.0. Given that it was doing nothingfor so long, there is no need to preserve anything for the earlier versions. - SSLv3_method(), TLSv1_method(), TLSv1_1_method() and TLSv1_2_method() have been removed. The recommendation is to use TLS_method() instead. SSLv23_method() is an alias for TLS_method(). It is possible to allow a different TLS version by using SSL_CTX_set_min_proto_version()/ SSL_CTX_set_max_proto_version() but be aware that TLSv1.2 is usually the lower supported version and TLSv1.3 should be the default. - ASN1_STRING_data() has been removed. ASN1_STRING_get0_data() is doing what ASN1_STRING_data() did except that it returns a const pointer. It has been around since OpenSSL 1.1.0. - The return value of a few functions such as X509_get_subject_name() has been made const. The return value should not be modified before that change. Signed-off-by: Sebastian Andrzej Siewior <[email protected]> --- .../thrift/c_glib/transport/thrift_ssl_socket.c | 4 ++-- lib/cpp/src/thrift/transport/TSSLSocket.cpp | 14 ++++++++------ 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c index 4911120eb6d5..f54c513e5710 100644 --- a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c +++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c @@ -285,7 +285,6 @@ thrift_ssl_socket_close (ThriftTransport *transport, GError **error) SSL_shutdown(ssl_socket->ssl); SSL_free(ssl_socket->ssl); ssl_socket->ssl = NULL; - ERR_remove_state(0); } return thrift_socket_close(transport, error); } @@ -705,7 +704,6 @@ void thrift_ssl_socket_finalize_openssl(void) ERR_free_strings(); EVP_cleanup(); CRYPTO_cleanup_all_ex_data(); - ERR_remove_state(0); } @@ -830,6 +828,7 @@ thrift_ssl_socket_context_initialize(ThriftSSLSocketProtocol ssl_protocol, GErro case SSLTLS: context = SSL_CTX_new(SSLv23_method()); break; +#if OPENSSL_VERSION_NUMBER < 0x40000000L #ifndef OPENSSL_NO_SSL3 case SSLv3: context = SSL_CTX_new(SSLv3_method()); @@ -844,6 +843,7 @@ thrift_ssl_socket_context_initialize(ThriftSSLSocketProtocol ssl_protocol, GErro case TLSv1_2: context = SSL_CTX_new(TLSv1_2_method()); break; +#endif default: g_set_error (error, THRIFT_TRANSPORT_ERROR, THRIFT_SSL_SOCKET_ERROR_CIPHER_NOT_AVAILABLE, diff --git a/lib/cpp/src/thrift/transport/TSSLSocket.cpp b/lib/cpp/src/thrift/transport/TSSLSocket.cpp index db426c85ebe6..d6617afb32bb 100644 --- a/lib/cpp/src/thrift/transport/TSSLSocket.cpp +++ b/lib/cpp/src/thrift/transport/TSSLSocket.cpp @@ -182,6 +182,7 @@ static char uppercase(char c); SSLContext::SSLContext(const SSLProtocol& protocol) { if (protocol == SSLTLS) { ctx_ = SSL_CTX_new(SSLv23_method()); +#if OPENSSL_VERSION_NUMBER < 0x40000000L #ifndef OPENSSL_NO_SSL3 } else if (protocol == SSLv3) { ctx_ = SSL_CTX_new(SSLv3_method()); @@ -192,6 +193,7 @@ SSLContext::SSLContext(const SSLProtocol& protocol) { ctx_ = SSL_CTX_new(TLSv1_1_method()); } else if (protocol == TLSv1_2) { ctx_ = SSL_CTX_new(TLSv1_2_method()); +#endif } else { /// UNKNOWN PROTOCOL! throw TSSLException("SSL_CTX_new: Unknown protocol"); @@ -763,17 +765,17 @@ void TSSLSocket::authorize() { if (name == nullptr) { continue; } - char* data = (char*)ASN1_STRING_data(name->d.ia5); + const unsigned char* data = ASN1_STRING_get0_data(name->d.ia5); int length = ASN1_STRING_length(name->d.ia5); switch (name->type) { case GEN_DNS: if (host.empty()) { host = (server() ? getPeerHost() : getHost()); } - decision = access_->verify(host, data, length); + decision = access_->verify(host, (const char*)data, length); break; case GEN_IPADD: - decision = access_->verify(sa, data, length); + decision = access_->verify(sa, (const char*)data, length); break; } } @@ -789,9 +791,9 @@ void TSSLSocket::authorize() { } // extract commonName - X509_NAME* name = X509_get_subject_name(cert); + const X509_NAME* name = X509_get_subject_name(cert); if (name != nullptr) { - X509_NAME_ENTRY* entry; + const X509_NAME_ENTRY* entry; unsigned char* utf8; int last = -1; while (decision == AccessManager::SKIP) { @@ -801,7 +803,7 @@ void TSSLSocket::authorize() { entry = X509_NAME_get_entry(name, last); if (entry == nullptr) continue; - ASN1_STRING* common = X509_NAME_ENTRY_get_data(entry); + const ASN1_STRING* common = X509_NAME_ENTRY_get_data(entry); int size = ASN1_STRING_to_UTF8(&utf8, common); if (host.empty()) { host = (server() ? getPeerHost() : getHost()); -- 2.55.0
