loqs commented on PR #3752:
URL: https://github.com/apache/thrift/pull/3752#issuecomment-5576175607
This additional patch adds SSL_CTX_set_min_proto_version and
SSL_CTX_set_max_proto_version use to the C bindings matching the C++ bindings
and adds unit tests for the C bings for SSL3, TLSv1, TLSv1.1, TLSv1.2 it does
not check the result of SSL_CTX_set_min_proto_version or
SSL_CTX_set_max_proto_version as @FinnRG's patch does to match the current PR.
```patch
diff --git a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
index b734ec914..4987018b2 100644
--- a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
+++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
@@ -833,12 +833,25 @@
thrift_ssl_socket_context_initialize(ThriftSSLSocketProtocol ssl_protocol, GErro
case SSLTLS:
context = SSL_CTX_new(SSLv23_method());
break;
-#if OPENSSL_VERSION_NUMBER < 0x40000000L
-#ifndef OPENSSL_NO_SSL3
+#if !defined(OPENSSL_NO_SSL3) && OPENSSL_VERSION_NUMBER < 0x40000000L
case SSLv3:
context = SSL_CTX_new(SSLv3_method());
break;
#endif
+#if OPENSSL_VERSION_NUMBER >= 0x40000000L
+ case TLSv1_0:
+ case TLSv1_1:
+ case TLSv1_2:
+ context = SSL_CTX_new(TLS_method());
+ if (context != NULL) {
+ int ver = (ssl_protocol == TLSv1_0) ? TLS1_VERSION
+ : (ssl_protocol == TLSv1_1) ? TLS1_1_VERSION
+ : TLS1_2_VERSION;
+ SSL_CTX_set_min_proto_version(context, ver);
+ SSL_CTX_set_max_proto_version(context, ver);
+ }
+ break;
+#else
case TLSv1_0:
context = SSL_CTX_new(TLSv1_method());
break;
@@ -848,7 +861,7 @@
thrift_ssl_socket_context_initialize(ThriftSSLSocketProtocol ssl_protocol, GErro
case TLSv1_2:
context = SSL_CTX_new(TLSv1_2_method());
break;
-#endif /* OPENSSL_VERSION_NUMBER < 0x40000000L */
+#endif
default:
g_set_error (error, THRIFT_TRANSPORT_ERROR,
THRIFT_SSL_SOCKET_ERROR_CIPHER_NOT_AVAILABLE,
diff --git a/lib/c_glib/test/CMakeLists.txt b/lib/c_glib/test/CMakeLists.txt
index 4f60473b2..205390389 100644
--- a/lib/c_glib/test/CMakeLists.txt
+++ b/lib/c_glib/test/CMakeLists.txt
@@ -68,6 +68,12 @@ add_executable(testtransportsocket testtransportsocket.c)
target_link_libraries(testtransportsocket thrift_c_glib)
add_test(NAME testtransportsocket COMMAND testtransportsocket)
+if(OPENSSL_FOUND AND WITH_OPENSSL)
+ add_executable(testtransportsslsocket testtransportsslsocket.c)
+ target_link_libraries(testtransportsslsocket thrift_c_glib)
+ add_test(NAME testtransportsslsocket COMMAND testtransportsslsocket)
+endif()
+
add_executable(testbinaryprotocol testbinaryprotocol.c)
target_link_libraries(testbinaryprotocol thrift_c_glib)
add_test(NAME testbinaryprotocol COMMAND testbinaryprotocol)
diff --git a/lib/c_glib/test/testtransportsslsocket.c
b/lib/c_glib/test/testtransportsslsocket.c
index ba9ffdcae..ec0b86e2a 100644
--- a/lib/c_glib/test/testtransportsslsocket.c
+++ b/lib/c_glib/test/testtransportsslsocket.c
@@ -514,6 +514,65 @@ thrift_socket_server (const int port)
g_object_unref (client);
}
+static void
+test_ssl_context_for_ssl_tls(void)
+{
+ GError *error = NULL;
+ SSL_CTX *ctx = thrift_ssl_socket_context_initialize(SSLTLS, &error);
+ g_assert (ctx != NULL);
+ g_assert_no_error (error);
+ SSL_CTX_free(ctx);
+}
+
+static void
+test_ssl_context_for_sslv3(void)
+{
+ GError *error = NULL;
+ SSL_CTX *ctx = thrift_ssl_socket_context_initialize(SSLv3, &error);
+#if defined(OPENSSL_NO_SSL3) || OPENSSL_VERSION_NUMBER >= 0x40000000L
+ if (ctx == NULL) {
+ g_assert (error != NULL);
+ g_clear_error (&error);
+ } else {
+ SSL_CTX_free(ctx);
+ }
+#else
+ g_assert (ctx != NULL);
+ g_assert_no_error (error);
+ SSL_CTX_free(ctx);
+#endif
+}
+
+static void
+test_ssl_context_for_tlsv1_0(void)
+{
+ GError *error = NULL;
+ SSL_CTX *ctx = thrift_ssl_socket_context_initialize(TLSv1_0, &error);
+ g_assert (ctx != NULL);
+ g_assert_no_error (error);
+ SSL_CTX_free(ctx);
+}
+
+static void
+test_ssl_context_for_tlsv1_1(void)
+{
+ GError *error = NULL;
+ SSL_CTX *ctx = thrift_ssl_socket_context_initialize(TLSv1_1, &error);
+ g_assert (ctx != NULL);
+ g_assert_no_error (error);
+ SSL_CTX_free(ctx);
+}
+
+static void
+test_ssl_context_for_tlsv1_2(void)
+{
+ GError *error = NULL;
+ SSL_CTX *ctx = thrift_ssl_socket_context_initialize(TLSv1_2, &error);
+ g_assert (ctx != NULL);
+ g_assert_no_error (error);
+ SSL_CTX_free(ctx);
+}
+
int
main(int argc, char *argv[])
{
@@ -530,6 +591,11 @@ main(int argc, char *argv[])
g_test_add_func ("/testtransportsslsocket/CreateAndSetProperties",
test_ssl_create_and_set_properties);
g_test_add_func ("/testtransportsslsocket/OpenAndCloseNonSSLServer",
test_ssl_open_and_close_non_ssl_server);
g_test_add_func ("/testtransportsslsocket/OpenAndWriteInvalidSocket",
test_ssl_write_invalid_socket);
+ g_test_add_func ("/testtransportsslsocket/ContextForSSLTLS",
test_ssl_context_for_ssl_tls);
+ g_test_add_func ("/testtransportsslsocket/ContextForSSLv3",
test_ssl_context_for_sslv3);
+ g_test_add_func ("/testtransportsslsocket/ContextForTLSv1_0",
test_ssl_context_for_tlsv1_0);
+ g_test_add_func ("/testtransportsslsocket/ContextForTLSv1_1",
test_ssl_context_for_tlsv1_1);
+ g_test_add_func ("/testtransportsslsocket/ContextForTLSv1_2",
test_ssl_context_for_tlsv1_2);
diff --git a/lib/cpp/test/SecurityFromBufferTest.cpp
b/lib/cpp/test/SecurityFromBufferTest.cpp
index 08f76b3f2..3df15106e 100644
--- a/lib/cpp/test/SecurityFromBufferTest.cpp
+++ b/lib/cpp/test/SecurityFromBufferTest.cpp
@@ -229,7 +229,7 @@ BOOST_AUTO_TEST_CASE(ssl_security_matrix) {
continue;
}
-#ifdef OPENSSL_NO_SSL3
+#if defined(OPENSSL_NO_SSL3) || OPENSSL_VERSION_NUMBER >= 0x40000000L
if (si == 2 || ci == 2) {
// Skip all SSLv3 cases - protocol not supported
continue;
diff --git a/lib/cpp/test/SecurityTest.cpp b/lib/cpp/test/SecurityTest.cpp
index 86640bd68..b133ef0f8 100644
--- a/lib/cpp/test/SecurityTest.cpp
+++ b/lib/cpp/test/SecurityTest.cpp
@@ -357,7 +357,7 @@ BOOST_AUTO_TEST_CASE(ssl_security_matrix)
continue;
}
-#ifdef OPENSSL_NO_SSL3
+#if defined(OPENSSL_NO_SSL3) || OPENSSL_VERSION_NUMBER >= 0x40000000L
if (si == 2 || ci == 2)
{
// Skip all SSLv3 cases - protocol not supported
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
