FinnRG commented on PR #3761:
URL: https://github.com/apache/thrift/pull/3761#issuecomment-5575383850
For reference (I don't want to open a third PR for this topic), here is the
patch I've developed and proposing for Ubuntu (this is against 0.23):
```diff
--- a/lib/cpp/src/thrift/transport/TSSLSocket.cpp
+++ b/lib/cpp/src/thrift/transport/TSSLSocket.cpp
@@ -157,7 +157,7 @@
#endif
EVP_cleanup();
CRYPTO_cleanup_all_ex_data();
-#if OPENSSL_VERSION_NUMBER >= 0x10100000
+#if OPENSSL_VERSION_NUMBER >= 0x10100000 &&
!defined(LIBRESSL_VERSION_NUMBER)
// Do nothing unless an openssl derivative is detected
# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
// https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_thread_stop.html
@@ -180,6 +180,37 @@
// SSLContext implementation
SSLContext::SSLContext(const SSLProtocol& protocol) {
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L &&
!defined(LIBRESSL_VERSION_NUMBER)
+ int version = 0;
+ switch (protocol) {
+ case SSLTLS:
+ break;
+#if !defined(OPENSSL_NO_SSL3) && OPENSSL_VERSION_NUMBER < 0x40000000L
+ case SSLv3:
+ version = SSL3_VERSION;
+ break;
+#endif
+ case TLSv1_0:
+ version = TLS1_VERSION;
+ break;
+ case TLSv1_1:
+ version = TLS1_1_VERSION;
+ break;
+ case TLSv1_2:
+ version = TLS1_2_VERSION;
+ break;
+ default:
+ throw TSSLException("SSL_CTX_new: Unknown protocol");
+ }
+
+ ctx_ = SSL_CTX_new(TLS_method());
+ if (ctx_ != nullptr && version != 0
+ && (SSL_CTX_set_min_proto_version(ctx_, version) != 1
+ || SSL_CTX_set_max_proto_version(ctx_, version) != 1)) {
+ SSL_CTX_free(ctx_);
+ ctx_ = nullptr;
+ }
+#else
if (protocol == SSLTLS) {
ctx_ = SSL_CTX_new(SSLv23_method());
#ifndef OPENSSL_NO_SSL3
@@ -196,6 +227,7 @@
/// UNKNOWN PROTOCOL!
throw TSSLException("SSL_CTX_new: Unknown protocol");
}
+#endif
if (ctx_ == nullptr) {
string errors;
@@ -398,7 +430,7 @@
SSL_free(ssl_);
ssl_ = nullptr;
handshakeCompleted_ = false;
-#if OPENSSL_VERSION_NUMBER >= 0x10100000
+#if OPENSSL_VERSION_NUMBER >= 0x10100000 &&
!defined(LIBRESSL_VERSION_NUMBER)
// Do nothing unless an openssl derivative is detected
# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
// https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_thread_stop.html
@@ -763,7 +795,11 @@
if (name == nullptr) {
continue;
}
- char* data = (char*)ASN1_STRING_data(name->d.ia5);
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L &&
!defined(LIBRESSL_VERSION_NUMBER)
+ const char* data = reinterpret_cast<const
char*>(ASN1_STRING_get0_data(name->d.ia5));
+#else
+ const char* data = reinterpret_cast<const
char*>(ASN1_STRING_data(name->d.ia5));
+#endif
int length = ASN1_STRING_length(name->d.ia5);
switch (name->type) {
case GEN_DNS:
@@ -789,9 +825,17 @@
}
// extract commonName
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L &&
!defined(LIBRESSL_VERSION_NUMBER)
+ const X509_NAME* name = X509_get_subject_name(cert);
+#else
X509_NAME* name = X509_get_subject_name(cert);
+#endif
if (name != nullptr) {
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L &&
!defined(LIBRESSL_VERSION_NUMBER)
+ const X509_NAME_ENTRY* entry;
+#else
X509_NAME_ENTRY* entry;
+#endif
unsigned char* utf8;
int last = -1;
while (decision == AccessManager::SKIP) {
@@ -801,7 +845,11 @@
entry = X509_NAME_get_entry(name, last);
if (entry == nullptr)
continue;
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ const ASN1_STRING* common = X509_NAME_ENTRY_get_data(entry);
+#else
ASN1_STRING* common = X509_NAME_ENTRY_get_data(entry);
+#endif
int size = ASN1_STRING_to_UTF8(&utf8, common);
if (host.empty()) {
host = (server() ? getPeerHost() : getHost());
--- a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
+++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
@@ -285,7 +285,9 @@
SSL_shutdown(ssl_socket->ssl);
SSL_free(ssl_socket->ssl);
ssl_socket->ssl = NULL;
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
ERR_remove_state(0);
+#endif
}
return thrift_socket_close(transport, error);
}
@@ -705,7 +707,9 @@
ERR_free_strings();
EVP_cleanup();
CRYPTO_cleanup_all_ex_data();
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
ERR_remove_state(0);
+#endif
}
@@ -826,6 +830,40 @@
thrift_ssl_socket_context_initialize(ThriftSSLSocketProtocol ssl_protocol,
GError **error)
{
SSL_CTX* context = NULL;
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L &&
!defined(LIBRESSL_VERSION_NUMBER)
+ int version = 0;
+ switch(ssl_protocol){
+ case SSLTLS:
+ break;
+#if !defined(OPENSSL_NO_SSL3) && OPENSSL_VERSION_NUMBER < 0x40000000L
+ case SSLv3:
+ version = SSL3_VERSION;
+ break;
+#endif
+ case TLSv1_0:
+ version = TLS1_VERSION;
+ break;
+ case TLSv1_1:
+ version = TLS1_1_VERSION;
+ break;
+ case TLSv1_2:
+ version = TLS1_2_VERSION;
+ break;
+ default:
+ g_set_error (error, THRIFT_TRANSPORT_ERROR,
+ THRIFT_SSL_SOCKET_ERROR_CIPHER_NOT_AVAILABLE,
+ "The SSL protocol is unknown for %d", ssl_protocol);
+ return NULL;
+ }
+
+ context = SSL_CTX_new(TLS_method());
+ if (context != NULL && version != 0
+ && (SSL_CTX_set_min_proto_version(context, version) != 1
+ || SSL_CTX_set_max_proto_version(context, version) != 1)) {
+ SSL_CTX_free(context);
+ context = NULL;
+ }
+#else
switch(ssl_protocol){
case SSLTLS:
context = SSL_CTX_new(SSLv23_method());
@@ -851,6 +889,7 @@
return NULL;
break;
}
+#endif
if (context == NULL) {
thrift_ssl_socket_get_error((const guchar*)"No cipher overlay",
THRIFT_SSL_SOCKET_ERROR_CIPHER_NOT_AVAILABLE, error);
--- a/lib/cpp/test/SecurityFromBufferTest.cpp
+++ b/lib/cpp/test/SecurityFromBufferTest.cpp
@@ -229,7 +229,7 @@
continue;
}
-#ifdef OPENSSL_NO_SSL3
+#if defined(OPENSSL_NO_SSL3) || OPENSSL_VERSION_NUMBER >= 0x40000000L
if (si == 2 || ci == 2) {
// Skip all SSLv3 cases - protocol not supported
continue;
--- a/lib/cpp/test/SecurityTest.cpp
+++ b/lib/cpp/test/SecurityTest.cpp
@@ -254,7 +254,7 @@
continue;
}
-#ifdef OPENSSL_NO_SSL3
+#if defined(OPENSSL_NO_SSL3) || OPENSSL_VERSION_NUMBER >= 0x40000000L
if (si == 2 || ci == 2)
{
// Skip all SSLv3 cases - protocol not supported
```
I believe it incorporates the feedback on this PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
