mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-01 04:00:16 +00:00
Code Issues Projects Releases Wiki Activity

thrift: fix build with OpenSSL 4.0

Browse Source 
OpenSSL 4.0 removes SSLv3_method(), per-version TLS method functions,
ERR_remove_state(), ASN1_STRING_data(), and returns const pointers
from X509 accessor functions. Fix both C++ and C GLib bindings.

Upstream-Status: Submitted [https://github.com/apache/thrift/pull/3752]
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Jaipaul Cheernam
2026-08-27 23:33:14 -07:00
committed by Khem Raj
parent c4a28775b9
commit c98c633afe
2 changed files with 114 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-connectivity/thrift/thrift/0001-TSSLSocket-fix-build-with-OpenSSL-4.0.patch
+113
View File
@@ -0,0 +1,113 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Date: Thu, 27 Aug 2026 11:00:00 +0000
Subject: [PATCH] Fix build with OpenSSL 4.0
OpenSSL 4.0 removes SSLv3_method(), per-version TLS method functions,
ERR_remove_state(), ASN1_STRING_data(), and returns const pointers
from X509 accessor functions.
C++ (TSSLSocket.cpp):
- Guard SSLv3 and TLS version methods with version check
- Replace ASN1_STRING_data with ASN1_STRING_get0_data
- Add const qualifiers for X509_NAME, X509_NAME_ENTRY, ASN1_STRING
C (thrift_ssl_socket.c):
- Remove ERR_remove_state() calls (no-op since OpenSSL 1.1)
- Guard SSLv3 and TLS version methods with version check
Upstream-Status: Submitted [https://github.com/apache/thrift/pull/3752]
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
diff --git a/lib/cpp/src/thrift/transport/TSSLSocket.cpp b/lib/cpp/src/thrift/transport/TSSLSocket.cpp
--- a/lib/cpp/src/thrift/transport/TSSLSocket.cpp 2026-08-27 11:26:40.242005669 +0000
+++ b/lib/cpp/src/thrift/transport/TSSLSocket.cpp 2026-08-27 11:26:40.263005736 +0000
@@ -182,16 +182,18 @@
SSLContext::SSLContext(const SSLProtocol& protocol) {
if (protocol == SSLTLS) {
ctx_ = SSL_CTX_new(SSLv23_method());
-#ifndef OPENSSL_NO_SSL3
+#if !defined(OPENSSL_NO_SSL3) && OPENSSL_VERSION_NUMBER < 0x40000000L
} else if (protocol == SSLv3) {
ctx_ = SSL_CTX_new(SSLv3_method());
#endif
+#if OPENSSL_VERSION_NUMBER < 0x40000000L
} else if (protocol == TLSv1_0) {
ctx_ = SSL_CTX_new(TLSv1_method());
} else if (protocol == TLSv1_1) {
ctx_ = SSL_CTX_new(TLSv1_1_method());
} else if (protocol == TLSv1_2) {
ctx_ = SSL_CTX_new(TLSv1_2_method());
+#endif
} else {
/// UNKNOWN PROTOCOL!
throw TSSLException("SSL_CTX_new: Unknown protocol");
@@ -770,7 +772,7 @@
if (name == nullptr) {
continue;
}
- char* data = (char*)ASN1_STRING_data(name->d.ia5);
+ const char* data = (const char*)ASN1_STRING_get0_data(name->d.ia5);
int length = ASN1_STRING_length(name->d.ia5);
switch (name->type) {
case GEN_DNS:
@@ -796,19 +798,19 @@
}
// extract commonName
- X509_NAME* name = X509_get_subject_name(cert);
+ const X509_NAME* name = X509_get_subject_name(cert);
if (name != nullptr) {
- X509_NAME_ENTRY* entry;
+ const X509_NAME_ENTRY* entry;
unsigned char* utf8;
int last = -1;
while (decision == AccessManager::SKIP) {
- last = X509_NAME_get_index_by_NID(name, NID_commonName, last);
+ last = X509_NAME_get_index_by_NID((X509_NAME *)name, NID_commonName, last);
if (last == -1)
break;
entry = X509_NAME_get_entry(name, last);
if (entry == nullptr)
continue;
- ASN1_STRING* common = X509_NAME_ENTRY_get_data(entry);
+ const ASN1_STRING* common = X509_NAME_ENTRY_get_data(entry);
int size = ASN1_STRING_to_UTF8(&utf8, common);
if (host.empty()) {
host = (server() ? getPeerHost() : getHost());
diff --git a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
--- a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c 2026-08-27 11:26:40.245005679 +0000
+++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c 2026-08-27 11:26:52.923045957 +0000
@@ -285,7 +285,6 @@
SSL_shutdown(ssl_socket->ssl);
SSL_free(ssl_socket->ssl);
ssl_socket->ssl = NULL;
- ERR_remove_state(0);
}
return thrift_socket_close(transport, error);
}
@@ -710,7 +709,6 @@
ERR_free_strings();
EVP_cleanup();
CRYPTO_cleanup_all_ex_data();
- ERR_remove_state(0);
}
@@ -835,6 +833,7 @@
case SSLTLS:
context = SSL_CTX_new(SSLv23_method());
break;
+#if OPENSSL_VERSION_NUMBER < 0x40000000L
#ifndef OPENSSL_NO_SSL3
case SSLv3:
context = SSL_CTX_new(SSLv3_method());
@@ -849,6 +848,7 @@
case TLSv1_2:
context = SSL_CTX_new(TLSv1_2_method());
break;
+#endif /* OPENSSL_VERSION_NUMBER < 0x40000000L */
default:
g_set_error (error, THRIFT_TRANSPORT_ERROR,
THRIFT_SSL_SOCKET_ERROR_CIPHER_NOT_AVAILABLE,
meta-oe/recipes-connectivity/thrift/thrift_0.24.0.bb
+1
View File
@@ -10,6 +10,7 @@ DEPENDS = "thrift-native boost flex-native bison-native openssl zlib"
SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \
file://0001-DefineInstallationPaths.cmake-Define-libdir-in-terms.patch \
file://0001-TSSLSocket-fix-build-with-OpenSSL-4.0.patch \
"
SRC_URI[sha256sum] = "e0fa5839a4c5c1d631b0931cf2c554ebbfa4e2fee3a9fb3ffd4f82ce4396c6e4"