mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-10-15 18:27:12 +00:00
thrift: upgrade 0.24.0 -> 0.25.0
This upgrade includes fix for 61 CVEs. Refreshed/removed patches via devtool. Release announcement: [1] Release notes: [2] [1] https://lists.apache.org/thread/prryfzdozvt6t02c9k5jf46or3m7ctzy [2] https://github.com/apache/thrift/blob/v0.25.0/CHANGES.md License-Update: Added notice for MIT license of a Makefile Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Peter Marko authored and 
Khem Raj committed
1 parent
b2486769a3
commit
53ffd4623b
3 files changed
+23
-132
No files matched your search
+21
-16
@@ -7,12 +7,30 @@ Subject: [PATCH] DefineInstallationPaths.cmake: Define libdir in terms of
|
||||
Upstream-Status: Pending
|
||||
Signed-off-by: Khem Raj <raj.khem@gmail.com>
|
||||
---
|
||||
build/cmake/DefineInstallationPaths.cmake | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
build/cmake/DefineCMakeDefaults.cmake | 4 ++--
|
||||
build/cmake/DefineInstallationPaths.cmake | 6 +++---
|
||||
2 files changed, 5 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/build/cmake/DefineCMakeDefaults.cmake b/build/cmake/DefineCMakeDefaults.cmake
|
||||
index 2b0cdbb..6f5022f 100644
|
||||
--- a/build/cmake/DefineCMakeDefaults.cmake
|
||||
+++ b/build/cmake/DefineCMakeDefaults.cmake
|
||||
@@ -44,8 +44,8 @@ include(BuildType)
|
||||
# top of the build tree rather than in hard-to-find leaf
|
||||
# directories. This simplifies manual testing and the use of the build
|
||||
# tree rather than installed thrift libraries.
|
||||
-set(CMAKE_LIBRARY_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/lib)
|
||||
-set(CMAKE_ARCHIVE_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/lib)
|
||||
+set(CMAKE_LIBRARY_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/lib${LIB_SUFFIX})
|
||||
+set(CMAKE_ARCHIVE_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/lib${LIB_SUFFIX})
|
||||
set(CMAKE_RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/bin)
|
||||
|
||||
#
|
||||
diff --git a/build/cmake/DefineInstallationPaths.cmake b/build/cmake/DefineInstallationPaths.cmake
|
||||
index 0c3dd09..9e9b77c 100644
|
||||
--- a/build/cmake/DefineInstallationPaths.cmake
|
||||
+++ b/build/cmake/DefineInstallationPaths.cmake
|
||||
@@ -26,11 +26,11 @@ else()
|
||||
@@ -28,11 +28,11 @@ else()
|
||||
set(LIB_INSTALL_DIR "lib${LIB_SUFFIX}" CACHE PATH "The library install dir (default: lib${LIB_SUFFIX})")
|
||||
endif()
|
||||
set(INCLUDE_INSTALL_DIR "include" CACHE PATH "The library install dir (default: include)")
|
||||
@@ -27,16 +45,3 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
|
||||
+set(libdir "${CMAKE_INSTALL_PREFIX}/lib${LIB_SUFFIX}")
|
||||
set(includedir "${CMAKE_INSTALL_PREFIX}/include")
|
||||
set(cmakedir "${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_DIR}")
|
||||
--- a/build/cmake/DefineCMakeDefaults.cmake
|
||||
+++ b/build/cmake/DefineCMakeDefaults.cmake
|
||||
@@ -44,8 +44,8 @@ include(BuildType)
|
||||
# top of the build tree rather than in hard-to-find leaf
|
||||
# directories. This simplifies manual testing and the use of the build
|
||||
# tree rather than installed thrift libraries.
|
||||
-set(CMAKE_LIBRARY_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/lib)
|
||||
-set(CMAKE_ARCHIVE_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/lib)
|
||||
+set(CMAKE_LIBRARY_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/lib${LIB_SUFFIX})
|
||||
+set(CMAKE_ARCHIVE_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/lib${LIB_SUFFIX})
|
||||
set(CMAKE_RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/bin)
|
||||
|
||||
#
|
||||
-113
@@ -1,113 +0,0 @@
|
||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
|
||||
Date: Thu, 27 Aug 2026 11:00:00 +0000
|
||||
Subject: [PATCH] Fix build with OpenSSL 4.0
|
||||
|
||||
OpenSSL 4.0 removes SSLv3_method(), per-version TLS method functions,
|
||||
ERR_remove_state(), ASN1_STRING_data(), and returns const pointers
|
||||
from X509 accessor functions.
|
||||
|
||||
C++ (TSSLSocket.cpp):
|
||||
- Guard SSLv3 and TLS version methods with version check
|
||||
- Replace ASN1_STRING_data with ASN1_STRING_get0_data
|
||||
- Add const qualifiers for X509_NAME, X509_NAME_ENTRY, ASN1_STRING
|
||||
|
||||
C (thrift_ssl_socket.c):
|
||||
- Remove ERR_remove_state() calls (no-op since OpenSSL 1.1)
|
||||
- Guard SSLv3 and TLS version methods with version check
|
||||
|
||||
Upstream-Status: Submitted [https://github.com/apache/thrift/pull/3752]
|
||||
|
||||
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
|
||||
---
|
||||
diff --git a/lib/cpp/src/thrift/transport/TSSLSocket.cpp b/lib/cpp/src/thrift/transport/TSSLSocket.cpp
|
||||
--- a/lib/cpp/src/thrift/transport/TSSLSocket.cpp 2026-08-27 11:26:40.242005669 +0000
|
||||
+++ b/lib/cpp/src/thrift/transport/TSSLSocket.cpp 2026-08-27 11:26:40.263005736 +0000
|
||||
@@ -182,16 +182,18 @@
|
||||
SSLContext::SSLContext(const SSLProtocol& protocol) {
|
||||
if (protocol == SSLTLS) {
|
||||
ctx_ = SSL_CTX_new(SSLv23_method());
|
||||
-#ifndef OPENSSL_NO_SSL3
|
||||
+#if !defined(OPENSSL_NO_SSL3) && OPENSSL_VERSION_NUMBER < 0x40000000L
|
||||
} else if (protocol == SSLv3) {
|
||||
ctx_ = SSL_CTX_new(SSLv3_method());
|
||||
#endif
|
||||
+#if OPENSSL_VERSION_NUMBER < 0x40000000L
|
||||
} else if (protocol == TLSv1_0) {
|
||||
ctx_ = SSL_CTX_new(TLSv1_method());
|
||||
} else if (protocol == TLSv1_1) {
|
||||
ctx_ = SSL_CTX_new(TLSv1_1_method());
|
||||
} else if (protocol == TLSv1_2) {
|
||||
ctx_ = SSL_CTX_new(TLSv1_2_method());
|
||||
+#endif
|
||||
} else {
|
||||
/// UNKNOWN PROTOCOL!
|
||||
throw TSSLException("SSL_CTX_new: Unknown protocol");
|
||||
@@ -770,7 +772,7 @@
|
||||
if (name == nullptr) {
|
||||
continue;
|
||||
}
|
||||
- char* data = (char*)ASN1_STRING_data(name->d.ia5);
|
||||
+ const char* data = (const char*)ASN1_STRING_get0_data(name->d.ia5);
|
||||
int length = ASN1_STRING_length(name->d.ia5);
|
||||
switch (name->type) {
|
||||
case GEN_DNS:
|
||||
@@ -796,19 +798,19 @@
|
||||
}
|
||||
|
||||
// extract commonName
|
||||
- X509_NAME* name = X509_get_subject_name(cert);
|
||||
+ const X509_NAME* name = X509_get_subject_name(cert);
|
||||
if (name != nullptr) {
|
||||
- X509_NAME_ENTRY* entry;
|
||||
+ const X509_NAME_ENTRY* entry;
|
||||
unsigned char* utf8;
|
||||
int last = -1;
|
||||
while (decision == AccessManager::SKIP) {
|
||||
- last = X509_NAME_get_index_by_NID(name, NID_commonName, last);
|
||||
+ last = X509_NAME_get_index_by_NID((X509_NAME *)name, NID_commonName, last);
|
||||
if (last == -1)
|
||||
break;
|
||||
entry = X509_NAME_get_entry(name, last);
|
||||
if (entry == nullptr)
|
||||
continue;
|
||||
- ASN1_STRING* common = X509_NAME_ENTRY_get_data(entry);
|
||||
+ const ASN1_STRING* common = X509_NAME_ENTRY_get_data(entry);
|
||||
int size = ASN1_STRING_to_UTF8(&utf8, common);
|
||||
if (host.empty()) {
|
||||
host = (server() ? getPeerHost() : getHost());
|
||||
diff --git a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
|
||||
--- a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c 2026-08-27 11:26:40.245005679 +0000
|
||||
+++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c 2026-08-27 11:26:52.923045957 +0000
|
||||
@@ -285,7 +285,6 @@
|
||||
SSL_shutdown(ssl_socket->ssl);
|
||||
SSL_free(ssl_socket->ssl);
|
||||
ssl_socket->ssl = NULL;
|
||||
- ERR_remove_state(0);
|
||||
}
|
||||
return thrift_socket_close(transport, error);
|
||||
}
|
||||
@@ -710,7 +709,6 @@
|
||||
ERR_free_strings();
|
||||
EVP_cleanup();
|
||||
CRYPTO_cleanup_all_ex_data();
|
||||
- ERR_remove_state(0);
|
||||
}
|
||||
|
||||
|
||||
@@ -835,6 +833,7 @@
|
||||
case SSLTLS:
|
||||
context = SSL_CTX_new(SSLv23_method());
|
||||
break;
|
||||
+#if OPENSSL_VERSION_NUMBER < 0x40000000L
|
||||
#ifndef OPENSSL_NO_SSL3
|
||||
case SSLv3:
|
||||
context = SSL_CTX_new(SSLv3_method());
|
||||
@@ -849,6 +848,7 @@
|
||||
case TLSv1_2:
|
||||
context = SSL_CTX_new(TLSv1_2_method());
|
||||
break;
|
||||
+#endif /* OPENSSL_VERSION_NUMBER < 0x40000000L */
|
||||
default:
|
||||
g_set_error (error, THRIFT_TRANSPORT_ERROR,
|
||||
THRIFT_SSL_SOCKET_ERROR_CIPHER_NOT_AVAILABLE,
|
||||
+2
-3
@@ -3,16 +3,15 @@ DESCRIPTION = "A software framework, for scalable cross-language services devel
|
||||
HOMEPAGE = "https://thrift.apache.org/"
|
||||
|
||||
LICENSE = "Apache-2.0"
|
||||
LIC_FILES_CHKSUM = "file://LICENSE;md5=bdfca4cb0874071cc3e42d2ae3b05a77 \
|
||||
LIC_FILES_CHKSUM = "file://LICENSE;md5=62cd1eea65d163fffe0873a5c410a7ec \
|
||||
file://NOTICE;md5=2659b43daca219f99a2f2626ea128f73"
|
||||
|
||||
DEPENDS = "thrift-native boost flex-native bison-native openssl zlib"
|
||||
|
||||
SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \
|
||||
file://0001-DefineInstallationPaths.cmake-Define-libdir-in-terms.patch \
|
||||
file://0001-TSSLSocket-fix-build-with-OpenSSL-4.0.patch \
|
||||
"
|
||||
SRC_URI[sha256sum] = "e0fa5839a4c5c1d631b0931cf2c554ebbfa4e2fee3a9fb3ffd4f82ce4396c6e4"
|
||||
SRC_URI[sha256sum] = "66da4707214c54c94bac082103dc67adaf9e08925662700f269170a7b534b214"
|
||||
|
||||
BBCLASSEXTEND = "native nativesdk"
|
||||
|
||||
Reference in new issue
Block a user