Client: cpp
TSSLSocket::authorize() offered a certificate's IP subjectAltName entries to
the AccessManager on every connection, compared against the address returned
by getpeername(). In client mode that is the address the configured host
resolved to, so a client opened with a host name accepted a certificate that
named only that address.
The IP entries are now consulted in client mode only when the host the socket
was opened with is itself an address literal, recognised the way
TSocket::open() resolves it: getaddrinfo() with AI_NUMERICHOST. Connecting to
an address literal, server mode, and a socket opened from a descriptor with no
host are unchanged. An AccessManager of your own is not asked about IP entries
for a client opened with a host name.
Adds regression cases to SecurityTest, aligns the AccessManager documentation
in TSSLSocket.h and lib/cpp/README.md, and notes the change under Breaking
Changes for 0.26.0.
Co-Authored-By: Jens Geyer <jensg@apache.org>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Client: build
- thriftl.ll: include <stdint.h> in a %top block. Flex defines INT8_MIN and
the other limit macros itself when not compiled as C99, guarded by
#ifndef, and MSVC's stdint.h then redefined them (9 x C4005 per run).
- lib/py/setup.py: pass -std=c++11 only to non-MSVC compilers; cl.exe
warned D9002 and ignored it.
- CMakeLists.txt: set CMP0144 to NEW next to CMP0074. The MSVC build passes
LIBEVENT_ROOT and CMake 3.27+ warned that find_package ignores it.
- FindClangTools.cmake: declare FPHSA_NAME_MISMATCHED; the module finds
three tools under names that differ from its own by design.
- SecurityTest.cpp: cast away the shared_ptr that exists only to make the
constructor throw (C4858).
Left for later, see the ticket: LNK4098 from libevent built /MT (image
change, after THRIFT-6237), C4244 in protocol.tcc (THRIFT-6069 rewrites the
file), and CS0114 in the generated netstd Xception.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Client: cpp,c_glib
OpenSSL 4.0 removes SSLv3_method(), TLSv1_method(), TLSv1_1_method(),
TLSv1_2_method(), ERR_remove_state() and ASN1_STRING_data(), and returns
const pointers from X509_get_subject_name(), X509_NAME_get_entry() and
X509_NAME_ENTRY_get_data(). Neither binding compiles against it.
The per-version methods are replaced by TLS_method() with the protocol
window pinned through SSL_CTX_set_min_proto_version() and
SSL_CTX_set_max_proto_version(), which is OpenSSL's own documented
migration and reproduces the old methods exactly: TLSv1_2_method() meant
TLS 1.2 only, and min == max == TLS1_2_VERSION means the same. No enum
value is dropped, so SSLv3, TLSv1_0, TLSv1_1, TLSv1_2 and LATEST keep
working on 4.0 rather than starting to throw "Unknown protocol".
The replacement is selected from 1.1.0 onwards rather than only on 4.0,
because no CI configuration builds against 4.0: gating it there would ship
a code path that nothing ever compiles, let alone runs. At >= 1.1.0 the
existing SSL matrix tests cover it on the OpenSSL 3.x that CI does have.
The same reasoning applies to the const qualifiers, whose consumers have
all taken const since 1.1.0. LibreSSL is excluded throughout: it reports
OPENSSL_VERSION_NUMBER as 0x20000000L but keeps the pre-1.1.0 signatures,
so it stays on the path it compiles today.
SSLTLS is untouched. SSLv23_method() is not removed in 4.0 -- it is an
unconditional #define for TLS_method() -- so that arm needed no change,
and the protocol floor for it still comes from the SSL_CTX_set_options()
call below, not from a version window.
SSLv3 keeps SSLv3_method() below 4.0, which is the only release that
removes it, rather than becoming a TLS_method() window like the others:
SSL_CTX_set_min_proto_version() consults the security level and would
refuse SSL3_VERSION at the default one, where the method function does not,
and the context is built before TSSLSocketFactory::ciphers() lowers it. On
4.0 the protocol is gone outright and the arm is compiled out.
ERR_remove_state() has been an empty stub since 1.1.0, so in c_glib it is
gated to where it still does something: before 1.1.0, and on LibreSSL,
which implements it and has never shipped OPENSSL_thread_stop(). The C++
binding gets the matching guard so LibreSSL reaches the ERR_remove_state()
arm instead of losing per-thread cleanup on both paths.
Tests:
- SecurityTest gains explicit_protocol_version_window, which asserts the
min/max window per enum value instead of merely that a context was
created -- the latter passes on a remapping that silently leaves the
floor to the library default. Proven two-state: with the window not
pinned it fails 8 assertions, LATEST among them, reporting floor 0.
It also asserts that an unavailable SSLv3 is reported rather than
quietly satisfied with another version.
- Both matrix tests skip SSLv3 on 4.0. OPENSSL_NO_SSL3 is not defined
there, so without this they try SSLv3 and time out.
- testtransportsslsocket gains the same two cases for c_glib.
- TSSLSocketMatchNameTest built its subject name through
X509_get_subject_name(), which is const as of 4.0, then mutated it; it
now builds a separate X509_NAME. It also had no SIGPIPE handler while
deliberately provoking rejected handshakes, so it died with status 141
in 6 of 20 runs before this change and 11 of 20 after -- the allocation
pattern shifts the race. It is ignored now, as SecurityTest already
does, and 25 of 25 runs pass.
Verified by building and running lib/cpp and lib/c_glib against three
libraries: the distribution OpenSSL 3.0.2, a from-source 4.0.2, and a
from-source 3.0.2 configured with enable-ssl3 so that the one otherwise
uncompiled arm is covered. All 16 matrix cells pass identically on the
first two, and all 25 on the third -- cell for cell what master produces
there. Unpatched master fails to compile against 4.0.2 with 7 errors in
C++ and 5 in c_glib.
Co-Authored-By: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Co-Authored-By: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Co-Authored-By: Brad Smith <brad@comstyle.com>
Co-Authored-By: loqs <7595223+loqs@users.noreply.github.com>
Co-Authored-By: Finn R. Gärtner <65015656+FinnRG@users.noreply.github.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Client: cpp
Add explicit SSLContext(SSL_CTX* ctx) to wrap an application-configured
OpenSSL context via the existing SSLContextFactory hook. Document the
injection pattern and add SecurityTest coverage.
This PR fixes the Security tests to build on a clean install of ubuntu
20.04 and ubuntu 22.04 without modifications to the systems openssl
configuration.
* Enable TLS 1.0 and TLS 1.1 on OpenSSL 1.1 with the seclevel=0 flag
* Disable TLS 1.0 and TLS 1.1 on OpenSSL 3.0
While its technically possible to enable it on OpenSSL 3 I think because
of all the issues with these old TLS versions dropping support for it is
better.
This PR builds forth on the work done here: https://github.com/apache/thrift/pull/2811
Tested with the ubuntu 20.04 (OpenSSL 1.1) and 22.04 (OpenSSL 3.0) docker containers.
All lib/cpp tests succeed in both.
Client: Test (C++)
Patch: John Sirois
Instead of using a fixed port, use an ephemeral port to improve
robustness and make way for parallelizability.
This closes#853
Client: Test (C++)
Patch: John Sirois
Previously, the deprecated `linux` symbol was tested, but under both g++
and clang++ using `-std=c++11` this deprecated symbol is not defined.
Test the accepted modern standard of `__linux__` instead to ensure the
SIGPIPE ignore is in-effect and the test runs stably.
This closes#848
