Jens Geyer created THRIFT-6246:
----------------------------------
Summary: lib/d does not link against OpenSSL 4.0
Key: THRIFT-6246
URL: https://issues.apache.org/jira/browse/THRIFT-6246
Project: Thrift
Issue Type: Bug
Components: D - Library
Reporter: Jens Geyer
OpenSSL 4.0 removes {{ERR_remove_state()}} and {{ASN1_STRING_data()}}. The D
binding calls both without a version guard, so linking {{lib/d}} against
libcrypto 4.0 fails on the missing symbols. Unlike the C and C++ bindings there
is no preprocessor in play here: the declarations come from {{deimos.openssl}},
so the calls are emitted unconditionally.
h2. Unguarded call sites
* {{lib/d/src/thrift/transport/ssl.d:144}} -- {{ERR_remove_state(0);}} in
{{close()}}
* {{lib/d/src/thrift/async/ssl.d:216}} -- {{ERR_remove_state(0);}} in
{{cleanupSSL()}}
* {{lib/d/src/thrift/internal/ssl.d:134}} -- {{ASN1_STRING_data(name.d.ia5)}}
while extracting the subjectAltName
{{lib/d/src/thrift/transport/ssl.d:503}} is *not* affected: it already sits
inside a {{static if (OPENSSL_VERSION_NUMBER < 0x1010000f)}} guard.
h2. Evidence
Symbol tables of two from-source builds:
{code}
$ nm -D --defined-only openssl-3.0.2/lib64/libcrypto.so | grep -E
'ERR_remove_state|ASN1_STRING_data'
ASN1_STRING_data@@OPENSSL_3.0.0
ERR_remove_state@@OPENSSL_3.0.0
$ nm -D --defined-only openssl-4.0.2/lib64/libcrypto.so | grep -E
'ERR_remove_state|ASN1_STRING_data'
(no output)
{code}
The distribution libcrypto.so.3 exports both as well, so this is specific to
4.0.
h2. Suggested fix
The same shape the C++ and C bindings use in THRIFT-6174:
* {{ERR_remove_state()}} has been an empty stub since OpenSSL 1.1.0, so guard
it to where it still does something: before 1.1.0, and on LibreSSL, which does
implement it. That mirrors the guard already present at {{transport/ssl.d:503}}.
* {{ASN1_STRING_data()}} becomes {{ASN1_STRING_get0_data()}} from 1.1.0
onwards, keeping the old call only in the pre-1.1.0 arm.
Out of scope for THRIFT-6174, which is {{Client: cpp,c_glib}}.
h2. Note
Found and verified with AI assistance (Claude Opus 5) while working on
THRIFT-6174.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
