From c98c633afe1dd67f1ea9c69a86f055641390d4ac Mon Sep 17 00:00:00 2001 From: Jaipaul Cheernam Date: Thu, 27 Aug 2026 20:53:13 +0200 Subject: [PATCH] thrift: fix build with OpenSSL 4.0 OpenSSL 4.0 removes SSLv3_method(), per-version TLS method functions, ERR_remove_state(), ASN1_STRING_data(), and returns const pointers from X509 accessor functions. Fix both C++ and C GLib bindings. Upstream-Status: Submitted [https://github.com/apache/thrift/pull/3752] Signed-off-by: Jaipaul Cheernam Signed-off-by: Khem Raj --- ...SSLSocket-fix-build-with-OpenSSL-4.0.patch | 113 ++++++++++++++++++ .../thrift/thrift_0.24.0.bb | 1 + 2 files changed, 114 insertions(+) create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/0001-TSSLSocket-fix-build-with-OpenSSL-4.0.patch diff --git a/meta-oe/recipes-connectivity/thrift/thrift/0001-TSSLSocket-fix-build-with-OpenSSL-4.0.patch b/meta-oe/recipes-connectivity/thrift/thrift/0001-TSSLSocket-fix-build-with-OpenSSL-4.0.patch new file mode 100644 index 0000000000..965f024b6e --- /dev/null +++ b/meta-oe/recipes-connectivity/thrift/thrift/0001-TSSLSocket-fix-build-with-OpenSSL-4.0.patch @@ -0,0 +1,113 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Jaipaul Cheernam +Date: Thu, 27 Aug 2026 11:00:00 +0000 +Subject: [PATCH] Fix build with OpenSSL 4.0 + +OpenSSL 4.0 removes SSLv3_method(), per-version TLS method functions, +ERR_remove_state(), ASN1_STRING_data(), and returns const pointers +from X509 accessor functions. + +C++ (TSSLSocket.cpp): +- Guard SSLv3 and TLS version methods with version check +- Replace ASN1_STRING_data with ASN1_STRING_get0_data +- Add const qualifiers for X509_NAME, X509_NAME_ENTRY, ASN1_STRING + +C (thrift_ssl_socket.c): +- Remove ERR_remove_state() calls (no-op since OpenSSL 1.1) +- Guard SSLv3 and TLS version methods with version check + +Upstream-Status: Submitted [https://github.com/apache/thrift/pull/3752] + +Signed-off-by: Jaipaul Cheernam +--- +diff --git a/lib/cpp/src/thrift/transport/TSSLSocket.cpp b/lib/cpp/src/thrift/transport/TSSLSocket.cpp +--- a/lib/cpp/src/thrift/transport/TSSLSocket.cpp 2026-08-27 11:26:40.242005669 +0000 ++++ b/lib/cpp/src/thrift/transport/TSSLSocket.cpp 2026-08-27 11:26:40.263005736 +0000 +@@ -182,16 +182,18 @@ + SSLContext::SSLContext(const SSLProtocol& protocol) { + if (protocol == SSLTLS) { + ctx_ = SSL_CTX_new(SSLv23_method()); +-#ifndef OPENSSL_NO_SSL3 ++#if !defined(OPENSSL_NO_SSL3) && OPENSSL_VERSION_NUMBER < 0x40000000L + } else if (protocol == SSLv3) { + ctx_ = SSL_CTX_new(SSLv3_method()); + #endif ++#if OPENSSL_VERSION_NUMBER < 0x40000000L + } else if (protocol == TLSv1_0) { + ctx_ = SSL_CTX_new(TLSv1_method()); + } else if (protocol == TLSv1_1) { + ctx_ = SSL_CTX_new(TLSv1_1_method()); + } else if (protocol == TLSv1_2) { + ctx_ = SSL_CTX_new(TLSv1_2_method()); ++#endif + } else { + /// UNKNOWN PROTOCOL! + throw TSSLException("SSL_CTX_new: Unknown protocol"); +@@ -770,7 +772,7 @@ + if (name == nullptr) { + continue; + } +- char* data = (char*)ASN1_STRING_data(name->d.ia5); ++ const char* data = (const char*)ASN1_STRING_get0_data(name->d.ia5); + int length = ASN1_STRING_length(name->d.ia5); + switch (name->type) { + case GEN_DNS: +@@ -796,19 +798,19 @@ + } + + // extract commonName +- X509_NAME* name = X509_get_subject_name(cert); ++ const X509_NAME* name = X509_get_subject_name(cert); + if (name != nullptr) { +- X509_NAME_ENTRY* entry; ++ const X509_NAME_ENTRY* entry; + unsigned char* utf8; + int last = -1; + while (decision == AccessManager::SKIP) { +- last = X509_NAME_get_index_by_NID(name, NID_commonName, last); ++ last = X509_NAME_get_index_by_NID((X509_NAME *)name, NID_commonName, last); + if (last == -1) + break; + entry = X509_NAME_get_entry(name, last); + if (entry == nullptr) + continue; +- ASN1_STRING* common = X509_NAME_ENTRY_get_data(entry); ++ const ASN1_STRING* common = X509_NAME_ENTRY_get_data(entry); + int size = ASN1_STRING_to_UTF8(&utf8, common); + if (host.empty()) { + host = (server() ? getPeerHost() : getHost()); +diff --git a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c +--- a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c 2026-08-27 11:26:40.245005679 +0000 ++++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c 2026-08-27 11:26:52.923045957 +0000 +@@ -285,7 +285,6 @@ + SSL_shutdown(ssl_socket->ssl); + SSL_free(ssl_socket->ssl); + ssl_socket->ssl = NULL; +- ERR_remove_state(0); + } + return thrift_socket_close(transport, error); + } +@@ -710,7 +709,6 @@ + ERR_free_strings(); + EVP_cleanup(); + CRYPTO_cleanup_all_ex_data(); +- ERR_remove_state(0); + } + + +@@ -835,6 +833,7 @@ + case SSLTLS: + context = SSL_CTX_new(SSLv23_method()); + break; ++#if OPENSSL_VERSION_NUMBER < 0x40000000L + #ifndef OPENSSL_NO_SSL3 + case SSLv3: + context = SSL_CTX_new(SSLv3_method()); +@@ -849,6 +848,7 @@ + case TLSv1_2: + context = SSL_CTX_new(TLSv1_2_method()); + break; ++#endif /* OPENSSL_VERSION_NUMBER < 0x40000000L */ + default: + g_set_error (error, THRIFT_TRANSPORT_ERROR, + THRIFT_SSL_SOCKET_ERROR_CIPHER_NOT_AVAILABLE, diff --git a/meta-oe/recipes-connectivity/thrift/thrift_0.24.0.bb b/meta-oe/recipes-connectivity/thrift/thrift_0.24.0.bb index 6a5efdabdf..aa822d8696 100644 --- a/meta-oe/recipes-connectivity/thrift/thrift_0.24.0.bb +++ b/meta-oe/recipes-connectivity/thrift/thrift_0.24.0.bb @@ -10,6 +10,7 @@ DEPENDS = "thrift-native boost flex-native bison-native openssl zlib" SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \ file://0001-DefineInstallationPaths.cmake-Define-libdir-in-terms.patch \ + file://0001-TSSLSocket-fix-build-with-OpenSSL-4.0.patch \ " SRC_URI[sha256sum] = "e0fa5839a4c5c1d631b0931cf2c554ebbfa4e2fee3a9fb3ffd4f82ce4396c6e4"