Client: cpp,c_glib
OpenSSL 4.0 removes SSLv3_method(), TLSv1_method(), TLSv1_1_method(),
TLSv1_2_method(), ERR_remove_state() and ASN1_STRING_data(), and returns
const pointers from X509_get_subject_name(), X509_NAME_get_entry() and
X509_NAME_ENTRY_get_data(). Neither binding compiles against it.
The per-version methods are replaced by TLS_method() with the protocol
window pinned through SSL_CTX_set_min_proto_version() and
SSL_CTX_set_max_proto_version(), which is OpenSSL's own documented
migration and reproduces the old methods exactly: TLSv1_2_method() meant
TLS 1.2 only, and min == max == TLS1_2_VERSION means the same. No enum
value is dropped, so SSLv3, TLSv1_0, TLSv1_1, TLSv1_2 and LATEST keep
working on 4.0 rather than starting to throw "Unknown protocol".
The replacement is selected from 1.1.0 onwards rather than only on 4.0,
because no CI configuration builds against 4.0: gating it there would ship
a code path that nothing ever compiles, let alone runs. At >= 1.1.0 the
existing SSL matrix tests cover it on the OpenSSL 3.x that CI does have.
The same reasoning applies to the const qualifiers, whose consumers have
all taken const since 1.1.0. LibreSSL is excluded throughout: it reports
OPENSSL_VERSION_NUMBER as 0x20000000L but keeps the pre-1.1.0 signatures,
so it stays on the path it compiles today.
SSLTLS is untouched. SSLv23_method() is not removed in 4.0 -- it is an
unconditional #define for TLS_method() -- so that arm needed no change,
and the protocol floor for it still comes from the SSL_CTX_set_options()
call below, not from a version window.
SSLv3 keeps SSLv3_method() below 4.0, which is the only release that
removes it, rather than becoming a TLS_method() window like the others:
SSL_CTX_set_min_proto_version() consults the security level and would
refuse SSL3_VERSION at the default one, where the method function does not,
and the context is built before TSSLSocketFactory::ciphers() lowers it. On
4.0 the protocol is gone outright and the arm is compiled out.
ERR_remove_state() has been an empty stub since 1.1.0, so in c_glib it is
gated to where it still does something: before 1.1.0, and on LibreSSL,
which implements it and has never shipped OPENSSL_thread_stop(). The C++
binding gets the matching guard so LibreSSL reaches the ERR_remove_state()
arm instead of losing per-thread cleanup on both paths.
Tests:
- SecurityTest gains explicit_protocol_version_window, which asserts the
min/max window per enum value instead of merely that a context was
created -- the latter passes on a remapping that silently leaves the
floor to the library default. Proven two-state: with the window not
pinned it fails 8 assertions, LATEST among them, reporting floor 0.
It also asserts that an unavailable SSLv3 is reported rather than
quietly satisfied with another version.
- Both matrix tests skip SSLv3 on 4.0. OPENSSL_NO_SSL3 is not defined
there, so without this they try SSLv3 and time out.
- testtransportsslsocket gains the same two cases for c_glib.
- TSSLSocketMatchNameTest built its subject name through
X509_get_subject_name(), which is const as of 4.0, then mutated it; it
now builds a separate X509_NAME. It also had no SIGPIPE handler while
deliberately provoking rejected handshakes, so it died with status 141
in 6 of 20 runs before this change and 11 of 20 after -- the allocation
pattern shifts the race. It is ignored now, as SecurityTest already
does, and 25 of 25 runs pass.
Verified by building and running lib/cpp and lib/c_glib against three
libraries: the distribution OpenSSL 3.0.2, a from-source 4.0.2, and a
from-source 3.0.2 configured with enable-ssl3 so that the one otherwise
uncompiled arm is covered. All 16 matrix cells pass identically on the
first two, and all 25 on the third -- cell for cell what master produces
there. Unpatched master fails to compile against 4.0.2 with 7 errors in
C++ and 5 in c_glib.
Co-Authored-By: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Co-Authored-By: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Co-Authored-By: Brad Smith <brad@comstyle.com>
Co-Authored-By: loqs <7595223+loqs@users.noreply.github.com>
Co-Authored-By: Finn R. Gärtner <65015656+FinnRG@users.noreply.github.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This PR fixes the Security tests to build on a clean install of ubuntu
20.04 and ubuntu 22.04 without modifications to the systems openssl
configuration.
* Enable TLS 1.0 and TLS 1.1 on OpenSSL 1.1 with the seclevel=0 flag
* Disable TLS 1.0 and TLS 1.1 on OpenSSL 3.0
While its technically possible to enable it on OpenSSL 3 I think because
of all the issues with these old TLS versions dropping support for it is
better.
This PR builds forth on the work done here: https://github.com/apache/thrift/pull/2811
Tested with the ubuntu 20.04 (OpenSSL 1.1) and 22.04 (OpenSSL 3.0) docker containers.
All lib/cpp tests succeed in both.
