loqs commented on PR #3761:
URL: https://github.com/apache/thrift/pull/3761#issuecomment-5575971637
@FinnRG this patch can be applied to either 0.23 after cherry-picking
d586077a37e14446cf385893608ea9e60a59d083 and
e94992274272defbd1990037f3510dbbeefd279f and or the current HEAD with this PR
(it should be equivalent to yours with tests added for the C code to match the
C++ code and matching the C code to match this PR):
```patch
diff --git a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
index b734ec914..4987018b2 100644
--- a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
+++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
@@ -833,12 +833,25 @@
thrift_ssl_socket_context_initialize(ThriftSSLSocketProtocol ssl_protocol, GErro
case SSLTLS:
context = SSL_CTX_new(SSLv23_method());
break;
-#if OPENSSL_VERSION_NUMBER < 0x40000000L
-#ifndef OPENSSL_NO_SSL3
+#if !defined(OPENSSL_NO_SSL3) && OPENSSL_VERSION_NUMBER < 0x40000000L
case SSLv3:
context = SSL_CTX_new(SSLv3_method());
break;
#endif
+#if OPENSSL_VERSION_NUMBER >= 0x40000000L
+ case TLSv1_0:
+ case TLSv1_1:
+ case TLSv1_2:
+ context = SSL_CTX_new(TLS_method());
+ if (context != NULL) {
+ int ver = (ssl_protocol == TLSv1_0) ? TLS1_VERSION
+ : (ssl_protocol == TLSv1_1) ? TLS1_1_VERSION
+ : TLS1_2_VERSION;
+ SSL_CTX_set_min_proto_version(context, ver);
+ SSL_CTX_set_max_proto_version(context, ver);
+ }
+ break;
+#else
case TLSv1_0:
context = SSL_CTX_new(TLSv1_method());
break;
@@ -848,7 +861,7 @@
thrift_ssl_socket_context_initialize(ThriftSSLSocketProtocol ssl_protocol, GErro
case TLSv1_2:
context = SSL_CTX_new(TLSv1_2_method());
break;
-#endif /* OPENSSL_VERSION_NUMBER < 0x40000000L */
+#endif
default:
g_set_error (error, THRIFT_TRANSPORT_ERROR,
THRIFT_SSL_SOCKET_ERROR_CIPHER_NOT_AVAILABLE,
diff --git a/lib/c_glib/test/CMakeLists.txt b/lib/c_glib/test/CMakeLists.txt
index 4f60473b2..205390389 100644
--- a/lib/c_glib/test/CMakeLists.txt
+++ b/lib/c_glib/test/CMakeLists.txt
@@ -68,6 +68,12 @@ add_executable(testtransportsocket testtransportsocket.c)
target_link_libraries(testtransportsocket thrift_c_glib)
add_test(NAME testtransportsocket COMMAND testtransportsocket)
+if(OPENSSL_FOUND AND WITH_OPENSSL)
+ add_executable(testtransportsslsocket testtransportsslsocket.c)
+ target_link_libraries(testtransportsslsocket thrift_c_glib)
+ add_test(NAME testtransportsslsocket COMMAND testtransportsslsocket)
+endif()
+
add_executable(testbinaryprotocol testbinaryprotocol.c)
target_link_libraries(testbinaryprotocol thrift_c_glib)
add_test(NAME testbinaryprotocol COMMAND testbinaryprotocol)
diff --git a/lib/c_glib/test/testtransportsslsocket.c
b/lib/c_glib/test/testtransportsslsocket.c
index ba9ffdcae..ec0b86e2a 100644
--- a/lib/c_glib/test/testtransportsslsocket.c
+++ b/lib/c_glib/test/testtransportsslsocket.c
@@ -514,6 +514,65 @@ thrift_socket_server (const int port)
g_object_unref (client);
}
+static void
+test_ssl_context_for_ssl_tls(void)
+{
+ GError *error = NULL;
+ SSL_CTX *ctx = thrift_ssl_socket_context_initialize(SSLTLS, &error);
+ g_assert (ctx != NULL);
+ g_assert_no_error (error);
+ SSL_CTX_free(ctx);
+}
+
+static void
+test_ssl_context_for_sslv3(void)
+{
+ GError *error = NULL;
+ SSL_CTX *ctx = thrift_ssl_socket_context_initialize(SSLv3, &error);
+#if defined(OPENSSL_NO_SSL3) || OPENSSL_VERSION_NUMBER >= 0x40000000L
+ if (ctx == NULL) {
+ g_assert (error != NULL);
+ g_clear_error (&error);
+ } else {
+ SSL_CTX_free(ctx);
+ }
+#else
+ g_assert (ctx != NULL);
+ g_assert_no_error (error);
+ SSL_CTX_free(ctx);
+#endif
+}
+
+static void
+test_ssl_context_for_tlsv1_0(void)
+{
+ GError *error = NULL;
+ SSL_CTX *ctx = thrift_ssl_socket_context_initialize(TLSv1_0, &error);
+ g_assert (ctx != NULL);
+ g_assert_no_error (error);
+ SSL_CTX_free(ctx);
+}
+
+static void
+test_ssl_context_for_tlsv1_1(void)
+{
+ GError *error = NULL;
+ SSL_CTX *ctx = thrift_ssl_socket_context_initialize(TLSv1_1, &error);
+ g_assert (ctx != NULL);
+ g_assert_no_error (error);
+ SSL_CTX_free(ctx);
+}
+
+static void
+test_ssl_context_for_tlsv1_2(void)
+{
+ GError *error = NULL;
+ SSL_CTX *ctx = thrift_ssl_socket_context_initialize(TLSv1_2, &error);
+ g_assert (ctx != NULL);
+ g_assert_no_error (error);
+ SSL_CTX_free(ctx);
+}
+
int
main(int argc, char *argv[])
{
@@ -530,6 +591,11 @@ main(int argc, char *argv[])
g_test_add_func ("/testtransportsslsocket/CreateAndSetProperties",
test_ssl_create_and_set_properties);
g_test_add_func ("/testtransportsslsocket/OpenAndCloseNonSSLServer",
test_ssl_open_and_close_non_ssl_server);
g_test_add_func ("/testtransportsslsocket/OpenAndWriteInvalidSocket",
test_ssl_write_invalid_socket);
+ g_test_add_func ("/testtransportsslsocket/ContextForSSLTLS",
test_ssl_context_for_ssl_tls);
+ g_test_add_func ("/testtransportsslsocket/ContextForSSLv3",
test_ssl_context_for_sslv3);
+ g_test_add_func ("/testtransportsslsocket/ContextForTLSv1_0",
test_ssl_context_for_tlsv1_0);
+ g_test_add_func ("/testtransportsslsocket/ContextForTLSv1_1",
test_ssl_context_for_tlsv1_1);
+ g_test_add_func ("/testtransportsslsocket/ContextForTLSv1_2",
test_ssl_context_for_tlsv1_2);
diff --git a/lib/cpp/test/SecurityFromBufferTest.cpp
b/lib/cpp/test/SecurityFromBufferTest.cpp
index 08f76b3f2..3df15106e 100644
--- a/lib/cpp/test/SecurityFromBufferTest.cpp
+++ b/lib/cpp/test/SecurityFromBufferTest.cpp
@@ -229,7 +229,7 @@ BOOST_AUTO_TEST_CASE(ssl_security_matrix) {
continue;
}
-#ifdef OPENSSL_NO_SSL3
+#if defined(OPENSSL_NO_SSL3) || OPENSSL_VERSION_NUMBER >= 0x40000000L
if (si == 2 || ci == 2) {
// Skip all SSLv3 cases - protocol not supported
continue;
diff --git a/lib/cpp/test/SecurityTest.cpp b/lib/cpp/test/SecurityTest.cpp
index 86640bd68..b133ef0f8 100644
--- a/lib/cpp/test/SecurityTest.cpp
+++ b/lib/cpp/test/SecurityTest.cpp
@@ -357,7 +357,7 @@ BOOST_AUTO_TEST_CASE(ssl_security_matrix)
continue;
}
-#ifdef OPENSSL_NO_SSL3
+#if defined(OPENSSL_NO_SSL3) || OPENSSL_VERSION_NUMBER >= 0x40000000L
if (si == 2 || ci == 2)
{
// Skip all SSLv3 cases - protocol not supported
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
