THRIFT-6174: Make it compatible with OpenSSL 4.0 by sebastianas · Pull Request #3761 · apache/thrift

sebastianas · 2026-08-30T08:23:16Z

Make it compatible with OpenSSL 4.0:

Remove ERR_remove_state(). It has been an empty stub since OpenSSL 1.1.0. Given that it was doing nothingfor so long, there is no need to preserve anything for the earlier versions.
SSLv3_method(), TLSv1_method(), TLSv1_1_method() and TLSv1_2_method() have been removed. The recommendation is to use TLS_method() instead. SSLv23_method() is an alias for TLS_method(). It is possible to allow a different TLS version by using SSL_CTX_set_min_proto_version()/ SSL_CTX_set_max_proto_version() but be aware that TLSv1.2 is usually the lower supported version and TLSv1.3 should be the default.
The return value of a few functions such as X509_get_subject_name() has been made const. The return value should not be modified before that change.

Did you create an Apache Jira ticket? (Request account here, not required for trivial changes)
Now, I guess this is trivial.
Did you squash your changes to a single commit? (not required, but preferred)
Did you do your best to avoid breaking changes? If one was needed, did you label the Jira ticket with "Breaking-Change"?
Yes
If your change does not involve any code, include [skip ci] anywhere in the commit message to free up build resources.

Jens-G · 2026-08-30T10:31:29Z

Really nice we get so maoy patches for the same problem. Just wonder why we need so many.

Jens-G · 2026-08-30T12:27:56Z

Code review

Found 2 issues, plus 3 suggestions:

The C++ SSL test suite is not updated, so it breaks on OpenSSL 4.0 — the very target of this PR (AGENTS.md says "Provide tests for every submitted change")

SecurityTest.cpp and SecurityFromBufferTest.cpp iterate the whole SSLTLS..LATEST protocol matrix and skip SSLv3 only under #ifdef OPENSSL_NO_SSL3, which is not defined on OpenSSL 4.0; the TLSv1_0/TLSv1_1/TLSv1_2 rows have no guard at all. Once SSLContext::SSLContext compiles those branches out, every one of those rows reaches throw TSSLException("SSL_CTX_new: Unknown protocol"). loqs reproduced exactly this on the parallel #3752 and posted a fix there (#if defined(OPENSSL_NO_SSL3) || OPENSSL_VERSION_NUMBER >= 0x40000000L): #3752 (comment)

thrift/lib/cpp/test/SecurityTest.cpp

Lines 359 to 367 in 38b6e3c

    
           #ifdef OPENSSL_NO_SSL3 
        
                           if (si == 2 || ci == 2) 
        
                           { 
        
                               // Skip all SSLv3 cases - protocol not supported 
        
                               continue; 
        
                           } 
        
           #endif

thrift/lib/cpp/test/SecurityFromBufferTest.cpp

Lines 231 to 238 in 38b6e3c

    
           #ifdef OPENSSL_NO_SSL3 
        
                   if (si == 2 || ci == 2) { 
        
                     // Skip all SSLv3 cases - protocol not supported 
        
                     continue; 
        
                   } 
        
           #endif

The guard that makes those protocols unreachable:

thrift/lib/cpp/src/thrift/transport/TSSLSocket.cpp

Lines 184 to 197 in 38b6e3c

    
               ctx_ = SSL_CTX_new(SSLv23_method()); 
        
           #if OPENSSL_VERSION_NUMBER < 0x40000000L 
        
           #ifndef OPENSSL_NO_SSL3 
        
             } else if (protocol == SSLv3) { 
        
               ctx_ = SSL_CTX_new(SSLv3_method()); 
        
           #endif 
        
             } else if (protocol == TLSv1_0) { 
        
               ctx_ = SSL_CTX_new(TLSv1_method()); 
        
             } else if (protocol == TLSv1_1) { 
        
               ctx_ = SSL_CTX_new(TLSv1_1_method()); 
        
             } else if (protocol == TLSv1_2) { 
        
               ctx_ = SSL_CTX_new(TLSv1_2_method()); 
        
           #endif 
        
             } else {

Commit message is missing the Client: trailer (AGENTS.md says "Commit message includes affected Client: languages")

Expected Client: cpp,c_glib. The PR title carries THRIFT-6170: correctly, but a squash-merge takes the body from the commit message, which ends at Signed-off-by: with no Client: line.

thrift/AGENTS.md

Lines 33 to 38 in 38b6e3c

    
           - PR title format: `THRIFT-9999: Short description of the change` 
        
           - Commit message format (required for code changes): 
        
             ``` 
        
             THRIFT-9999: Short description of the change 
        
             Client: cpp,py,java   (comma-separated list of affected languages) 
        
             ```

Suggestions

The new const qualifiers break the build against OpenSSL < 1.1.0. name, entry and common are passed to X509_NAME_get_index_by_NID() (L811), X509_NAME_get_entry() (L814) and ASN1_STRING_to_UTF8() (L818), all of which took non-const parameters before 1.1.0 — a hard compile error there. CI only builds against OpenSSL 3.x, so this would not show up in the checks.

thrift/lib/cpp/src/thrift/transport/TSSLSocket.cpp

Lines 804 to 819 in 38b6e3c

    
           // extract commonName 
        
           const X509_NAME* name = X509_get_subject_name(cert); 
        
           if (name != nullptr) { 
        
             const X509_NAME_ENTRY* entry; 
        
             unsigned char* utf8; 
        
             int last = -1; 
        
             while (decision == AccessManager::SKIP) { 
        
               last = X509_NAME_get_index_by_NID(name, NID_commonName, last); 
        
               if (last == -1) 
        
                 break; 
        
               entry = X509_NAME_get_entry(name, last); 
        
               if (entry == nullptr) 
        
                 continue; 
        
               const ASN1_STRING* common = X509_NAME_ENTRY_get_data(entry); 
        
               int size = ASN1_STRING_to_UTF8(&utf8, common); 
        
               if (host.empty()) {

The same function already handles this exact class of divergence with a version guard, so there is a local precedent to follow:

thrift/lib/cpp/src/thrift/transport/TSSLSocket.cpp

Lines 774 to 780 in 38b6e3c

    
                 } 
        
           #if OPENSSL_VERSION_NUMBER >= 0x10100000 
        
                 const char* data = (const char*)ASN1_STRING_get0_data(name->d.ia5); 
        
           #else 
        
                 char* data = (char*)ASN1_STRING_data(name->d.ia5); 
        
           #endif 
        
                 int length = ASN1_STRING_length(name->d.ia5);

ERR_remove_state(0) is removed unconditionally in c_glib. "Empty stub since OpenSSL 1.1.0" holds for mainline >= 1.1.0, but not for 1.0.x, and not for LibreSSL, which reports OPENSSL_VERSION_NUMBER as 0x20000000L yet ships a working implementation. c_glib has no OPENSSL_thread_stop() anywhere, so both bindings end up inconsistent: the C++ side of this same PR keeps the call under a version guard.

thrift/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c

Lines 283 to 289 in 38b6e3c

    
           ThriftSSLSocket *ssl_socket = THRIFT_SSL_SOCKET(transport); 
        
           if(ssl_socket!=NULL && ssl_socket->ssl) { 
        
               SSL_shutdown(ssl_socket->ssl); 
        
               SSL_free(ssl_socket->ssl); 
        
               ssl_socket->ssl = NULL; 
        
           } 
        
           return thrift_socket_close(transport, error);

thrift/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c

Lines 708 to 712 in 38b6e3c

    
              */ 
        
             ERR_free_strings(); 
        
             EVP_cleanup(); 
        
             CRYPTO_cleanup_all_ex_data(); 
        
           }

Retained, version-gated, in the C++ binding:

thrift/lib/cpp/src/thrift/transport/TSSLSocket.cpp

Lines 159 to 172 in 38b6e3c

    
             CRYPTO_cleanup_all_ex_data(); 
        
           #if OPENSSL_VERSION_NUMBER >= 0x10100000 
        
             // Do nothing unless an openssl derivative is detected 
        
           #  if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC) 
        
             // https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_thread_stop.html 
        
             OPENSSL_thread_stop(); 
        
           #  endif 
        
           #else 
        
             // ERR_remove_state() was deprecated in OpenSSL 1.0.0 and ERR_remove_thread_state() 
        
             // was deprecated in OpenSSL 1.1.0; these functions and should not be used. 
        
             // https://www.openssl.org/docs/manmaster/man3/ERR_remove_state.html 
        
             ERR_remove_state(0); 
        
           #endif 
        
             ERR_free_strings();

On OpenSSL >= 4.0, explicitly requesting SSLv3/TLSv1_0/TLSv1_1/TLSv1_2 — and therefore LATEST, which is TLSv1_2 — falls through to the catch-all and reports "Unknown protocol", with no remap to TLS_method() + SSL_CTX_set_min_proto_version()/SSL_CTX_set_max_proto_version() as the commit message itself suggests. The default SSLTLS is unaffected, but the enum values stay declared and documented as supported.

thrift/lib/cpp/src/thrift/transport/TSSLSocket.h

Lines 39 to 47 in 38b6e3c

    
           enum SSLProtocol { 
        
             SSLTLS  = 0,  // Supports version-flexible TLS negotiation with TLSv1_2 as the default floor. 
        
           //SSLv2   = 1,  // HORRIBLY INSECURE! 
        
             SSLv3   = 2,  // Supports SSLv3 only - also horribly insecure! 
        
             TLSv1_0 = 3,  // Supports TLSv1_0 or later. 
        
             TLSv1_1 = 4,  // Supports TLSv1_1 or later. 
        
             TLSv1_2 = 5,  // Supports TLSv1_2 or later. 
        
             LATEST  = TLSv1_2 
        
           };

thrift/lib/cpp/src/thrift/transport/TSSLSocket.cpp

Lines 195 to 200 in 38b6e3c

    
               ctx_ = SSL_CTX_new(TLSv1_2_method()); 
        
           #endif 
        
             } else { 
        
               /// UNKNOWN PROTOCOL! 
        
               throw TSSLException("SSL_CTX_new: Unknown protocol"); 
        
             }

thrift/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c

Lines 850 to 857 in 38b6e3c

    
                 break; 
        
           #endif 
        
               default: 
        
                 g_set_error (error, THRIFT_TRANSPORT_ERROR, 
        
           		   THRIFT_SSL_SOCKET_ERROR_CIPHER_NOT_AVAILABLE, 
        
           		   "The SSL protocol is unknown for %d", ssl_protocol); 
        
                 return NULL; 
        
                 break;

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

Jens-G · 2026-08-30T12:51:41Z

I want to add that there is an upcoming conflict between #3736 and #3761.
Therefore I would like to suggest that you both discuss this and come up with one patch.

Make it compatible with OpenSSL 4.0: - Don't use ERR_remove_state(). It has been an empty stub since OpenSSL 1.1.0 and got finally removed in 4.0- - SSLv3_method(), TLSv1_method(), TLSv1_1_method() and TLSv1_2_method() have been removed. The recommendation is to use TLS_method() instead. LATEST points to TLSv1_2_method which is not going to work. Make SSLTLS and LATEST point to TLS_method() for newer OpenSSL which uses the highest supported protocol version. Adjust the testsuite to only test those two. - The return value of a few functions such as X509_get_subject_name() has been made const. Use the const pointer only for newer OpenSSL. - While at it, pull the libressl related change from apache#3736 Client: cpp,c_glib. Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

sebastianas · 2026-08-30T15:16:44Z

I want to add that there is an upcoming conflict between #3736 and #3761. Therefore I would like to suggest that you both discuss this and come up with one patch.

I updated my commit based on your suggestions (unless I missed something) and pulled in the change from the reference PR so you have one patch.

The testsuite passes now, too. It is not part of the Debian package so I wasn't aware of the fallout.

Jens-G · 2026-09-01T20:33:19Z

Code review (round 2)

Re-reviewed at 829c7e5. Thanks for turning this around so quickly — four of the five points from the last round are addressed:

✅ Test suite — both matrix tests now skip non-SSLTLS/LATEST rows under OpenSSL ≥ 4.0.
✅ Client: trailer — present (but see issue 2).
✅ const on old OpenSSL — gated at >= 0x40000000L, so < 1.1.0 keeps the non-const types.
✅ c_glib ERR_remove_state — gated < 0x40000000L; LibreSSL (0x20000000L) keeps it.
⚠️ Dropped protocols — SSLTLS/LATEST work; SSLv3/TLSv1_0/TLSv1_1 still throw. See suggestion 3.

I re-swept lib/, test/, tutorial/ and contrib/ for every symbol 4.0 removes — all remaining occurrences sit inside one of the new gated #else arms, nothing was missed. c_glib's own SSL test only ever passes SSLTLS, so it needed no change.

1. On OpenSSL >= 4.0, `LATEST`/`TLSv1_2` ends up with no protocol floor — looser than the default `SSLTLS`

LATEST is an alias for TLSv1_2 (TSSLSocket.h:46), so the new arm routes value 5 to TLS_method(). But the floor block below is still gated on protocol == SSLTLS alone:

thrift/lib/cpp/src/thrift/transport/TSSLSocket.cpp

Lines 212 to 218 in 829c7e5

    
           // Keep version-flexible negotiation for current protocol versions while setting 
        
           // the default protocol floor at TLSv1.2. 
        
           if (protocol == SSLTLS) { 
        
             SSL_CTX_set_options(ctx_, 
        
                                 SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 
        
                                     | SSL_OP_NO_TLSv1_1); 
        
           }

requested	context	options applied
`SSLTLS`	`TLS_method()`	`NO_SSLv2 \| NO_SSLv3 \| NO_TLSv1 \| NO_TLSv1_1`
`LATEST` (== `TLSv1_2`)	`TLS_method()`	none

So explicitly asking for TLSv1_2 now yields a laxer context than taking the default, and the minimum version falls back to the OpenSSL build/openssl.cnf instead of being set by Thrift. Before this patch that same value meant TLSv1_2_method() — TLS 1.2 exactly. That undoes THRIFT-3165 for that enum value.

c_glib has the identical shape, and there it skips the function's only SSL_CTX_set_options call entirely:

thrift/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c

Lines 877 to 882 in 829c7e5

    
             /* Disable horribly insecure SSLv2 and SSLv3 protocols but allow a handshake 
        
                with older clients so they get a graceful denial. */ 
        
             if (ssl_protocol == SSLTLS) { 
        
                 SSL_CTX_set_options(context, SSL_OP_NO_SSLv2); 
        
                 SSL_CTX_set_options(context, SSL_OP_NO_SSLv3);   /* THRIFT-3164 */ 
        
             }

One line either way — widen the condition, or SSL_CTX_set_min_proto_version(ctx_, TLS1_2_VERSION) in the new arm.

2. The trailing `.` in `Client: cpp,c_glib.` silently drops c_glib from the release notes

build/generate-changes.py:303-304 lowercases and strips each token but does not strip punctuation, and unknown tokens are dropped without warning. Run against this exact commit:

'cpp,c_glib.' -> ['C++']
'cpp,c_glib'  -> ['C++', 'C glib']

So the c_glib half of the patch never appears under "C glib". Dropping the period fixes it.

Suggestions

3. TLSv1_0/TLSv1_1/TLSv1_2 don't have to be dropped — and #3752 already keeps them. TLS_method() + SSL_CTX_set_min_proto_version()/set_max_proto_version() reproduce the old per-version methods exactly, which is also OpenSSL's own documented migration. That's the substantive difference between the two PRs and would settle the "one patch" question — it also fixes issue 1 structurally rather than by widening a predicate.

4. The SSLTLS arm didn't need duplicating. SSLv23_method is not removed in 4.0 — it is an unconditional #define SSLv23_method TLS_method with no deprecation guard, as the PR description itself notes. Gating only the four legacy else if branches would leave one shared if (protocol == SSLTLS) head, halve the diff, keep each #if region brace-balanced, and remove the second copy of the predicate that drifted from line 214 in the first place. Same for thrift_ssl_socket.c:845.

5. The behaviour change is untested. The new guard only disables tests: the four surviving cells are {SSLTLS, LATEST}², all expected true, so nothing asserts that SSLv3/TLSv1_0/TLSv1_1 now raise TSSLException("SSL_CTX_new: Unknown protocol"), and the floor regression in issue 1 is invisible to it. SecurityTest.cpp already has the right home next to default_ssl_context_options / custom_ssl_context_options. Worth noting no CI leg compiles any >= 0x40000000L branch, so this all rests on your local build.

6. Enum docs still advertise the dropped protocols — TSSLSocket.h:39-46 and thrift_ssl_socket.h:98-106. TLSv1_2 = 5, // Supports TLSv1_2 or later. also becomes actively wrong per issue 1.

7. Attribution for the #3736 hunk. The two && !defined(LIBRESSL_VERSION_NUMBER) changes are byte-identical to @brad0's still-open #3736. Merging this makes that PR unmergeable while his name never enters history — CONTRIBUTING.md endorses Co-Authored-By: for exactly this. (The fix itself is correct.) Note the retained comment "Do nothing unless an openssl derivative is detected" now sits under a condition that excludes LibreSSL, itself a derivative.

8. Whitespace. Both new test blocks use hard tabs in files that are otherwise entirely space-indented, and in SecurityTest.cpp the if is tab-indented while its own braces and body are space-indented. .clang-format sets UseTab: Never; make style runs it over lib/cpp/test/*.cpp, but no CI job does, so it will land as committed.

9. Out of scope, worth a follow-up ticket: the D binding still calls ERR_remove_state(0) ungated at lib/d/src/thrift/transport/ssl.d:139 and lib/d/src/thrift/async/ssl.d:216, plus ASN1_STRING_data at lib/d/src/thrift/internal/ssl.d:113 — both removed in 4.0. (ssl.d:487 is correctly guarded.) Correctly outside Client: cpp,c_glib, but it means lib/d won't link against libcrypto 4.0.

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

brad0 · 2026-09-01T23:40:19Z

Builds fine on OpenBSD (LibreSSL).

Jens-G · 2026-09-07T07:14:55Z

Any news here?

FinnRG · 2026-09-07T20:31:57Z

For reference (I don't want to open a third PR for this topic), here is the patch I've developed and will propose for Ubuntu (this is against 0.23):

--- a/lib/cpp/src/thrift/transport/TSSLSocket.cpp
+++ b/lib/cpp/src/thrift/transport/TSSLSocket.cpp
@@ -157,7 +157,7 @@
 #endif
   EVP_cleanup();
   CRYPTO_cleanup_all_ex_data();
-#if OPENSSL_VERSION_NUMBER >= 0x10100000
+#if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(LIBRESSL_VERSION_NUMBER)
   // Do nothing unless an openssl derivative is detected
 #  if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
   // https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_thread_stop.html
@@ -180,6 +180,37 @@
 
 // SSLContext implementation
 SSLContext::SSLContext(const SSLProtocol& protocol) {
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+  int version = 0;
+  switch (protocol) {
+  case SSLTLS:
+    break;
+#if !defined(OPENSSL_NO_SSL3) && OPENSSL_VERSION_NUMBER < 0x40000000L
+  case SSLv3:
+    version = SSL3_VERSION;
+    break;
+#endif
+  case TLSv1_0:
+    version = TLS1_VERSION;
+    break;
+  case TLSv1_1:
+    version = TLS1_1_VERSION;
+    break;
+  case TLSv1_2:
+    version = TLS1_2_VERSION;
+    break;
+  default:
+    throw TSSLException("SSL_CTX_new: Unknown protocol");
+  }
+
+  ctx_ = SSL_CTX_new(TLS_method());
+  if (ctx_ != nullptr && version != 0
+      && (SSL_CTX_set_min_proto_version(ctx_, version) != 1
+          || SSL_CTX_set_max_proto_version(ctx_, version) != 1)) {
+    SSL_CTX_free(ctx_);
+    ctx_ = nullptr;
+  }
+#else
   if (protocol == SSLTLS) {
     ctx_ = SSL_CTX_new(SSLv23_method());
 #ifndef OPENSSL_NO_SSL3
@@ -196,6 +227,7 @@
     /// UNKNOWN PROTOCOL!
     throw TSSLException("SSL_CTX_new: Unknown protocol");
   }
+#endif
 
   if (ctx_ == nullptr) {
     string errors;
@@ -398,7 +430,7 @@
     SSL_free(ssl_);
     ssl_ = nullptr;
     handshakeCompleted_ = false;
-#if OPENSSL_VERSION_NUMBER >= 0x10100000
+#if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(LIBRESSL_VERSION_NUMBER)
     // Do nothing unless an openssl derivative is detected
 #  if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
     // https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_thread_stop.html
@@ -763,7 +795,11 @@
       if (name == nullptr) {
         continue;
       }
-      char* data = (char*)ASN1_STRING_data(name->d.ia5);
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+      const char* data = reinterpret_cast<const char*>(ASN1_STRING_get0_data(name->d.ia5));
+#else
+      const char* data = reinterpret_cast<const char*>(ASN1_STRING_data(name->d.ia5));
+#endif
       int length = ASN1_STRING_length(name->d.ia5);
       switch (name->type) {
       case GEN_DNS:
@@ -789,9 +825,17 @@
   }
 
   // extract commonName
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+  const X509_NAME* name = X509_get_subject_name(cert);
+#else
   X509_NAME* name = X509_get_subject_name(cert);
+#endif
   if (name != nullptr) {
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+    const X509_NAME_ENTRY* entry;
+#else
     X509_NAME_ENTRY* entry;
+#endif
     unsigned char* utf8;
     int last = -1;
     while (decision == AccessManager::SKIP) {
@@ -801,7 +845,11 @@
       entry = X509_NAME_get_entry(name, last);
       if (entry == nullptr)
         continue;
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+      const ASN1_STRING* common = X509_NAME_ENTRY_get_data(entry);
+#else
       ASN1_STRING* common = X509_NAME_ENTRY_get_data(entry);
+#endif
       int size = ASN1_STRING_to_UTF8(&utf8, common);
       if (host.empty()) {
         host = (server() ? getPeerHost() : getHost());
--- a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
+++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
@@ -285,7 +285,9 @@
       SSL_shutdown(ssl_socket->ssl);
       SSL_free(ssl_socket->ssl);
       ssl_socket->ssl = NULL;
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
       ERR_remove_state(0);
+#endif
   }
   return thrift_socket_close(transport, error);
 }
@@ -705,7 +707,9 @@
   ERR_free_strings();
   EVP_cleanup();
   CRYPTO_cleanup_all_ex_data();
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
   ERR_remove_state(0);
+#endif
 }
 
 
@@ -826,6 +830,40 @@
 thrift_ssl_socket_context_initialize(ThriftSSLSocketProtocol ssl_protocol, GError **error)
 {
   SSL_CTX* context = NULL;
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+  int version = 0;
+  switch(ssl_protocol){
+    case SSLTLS:
+      break;
+#if !defined(OPENSSL_NO_SSL3) && OPENSSL_VERSION_NUMBER < 0x40000000L
+    case SSLv3:
+      version = SSL3_VERSION;
+      break;
+#endif
+    case TLSv1_0:
+      version = TLS1_VERSION;
+      break;
+    case TLSv1_1:
+      version = TLS1_1_VERSION;
+      break;
+    case TLSv1_2:
+      version = TLS1_2_VERSION;
+      break;
+    default:
+      g_set_error (error, THRIFT_TRANSPORT_ERROR,
+		   THRIFT_SSL_SOCKET_ERROR_CIPHER_NOT_AVAILABLE,
+		   "The SSL protocol is unknown for %d", ssl_protocol);
+      return NULL;
+  }
+
+  context = SSL_CTX_new(TLS_method());
+  if (context != NULL && version != 0
+      && (SSL_CTX_set_min_proto_version(context, version) != 1
+          || SSL_CTX_set_max_proto_version(context, version) != 1)) {
+      SSL_CTX_free(context);
+      context = NULL;
+  }
+#else
   switch(ssl_protocol){
     case SSLTLS:
       context = SSL_CTX_new(SSLv23_method());
@@ -851,6 +889,7 @@
       return NULL;
       break;
   }
+#endif
 
   if (context == NULL) {
       thrift_ssl_socket_get_error((const guchar*)"No cipher overlay", THRIFT_SSL_SOCKET_ERROR_CIPHER_NOT_AVAILABLE, error);
--- a/lib/cpp/test/SecurityFromBufferTest.cpp
+++ b/lib/cpp/test/SecurityFromBufferTest.cpp
@@ -229,7 +229,7 @@
           continue;
         }
 
-#ifdef OPENSSL_NO_SSL3
+#if defined(OPENSSL_NO_SSL3) || OPENSSL_VERSION_NUMBER >= 0x40000000L
         if (si == 2 || ci == 2) {
           // Skip all SSLv3 cases - protocol not supported
           continue;
--- a/lib/cpp/test/SecurityTest.cpp
+++ b/lib/cpp/test/SecurityTest.cpp
@@ -254,7 +254,7 @@
                     continue;
                 }
 
-#ifdef OPENSSL_NO_SSL3
+#if defined(OPENSSL_NO_SSL3) || OPENSSL_VERSION_NUMBER >= 0x40000000L
                 if (si == 2 || ci == 2)
                 {
                     // Skip all SSLv3 cases - protocol not supported

I believe it incorporates the feedback on this PR.

Jens-G · 2026-09-12T21:45:29Z

For reference (I don't want to open a third PR for this topic), here is the patch I've developed and will propose for Ubuntu (this is against 0.23):

Nice, but a patch in a comment is worse than another PR. It has no CI and it is entirely unclear,. who is going to extract it from there into sth useful.

So bottom line right now: We have 3 (or 4) patches from different people but neither one can be merged.

Jens-G · 2026-09-12T23:56:41Z

Superseded by #3850, credits retained.

sebastianas requested review from emmenlau and mhlakhani as code owners August 30, 2026 08:23

mergeable Bot added c_glib c++ Pull requests that update C++ code labels Aug 30, 2026

Jens-G changed the title ~~transport: Make it compatible with OpenSSL 4.0~~ THRIFT-6170: Make it compatible with OpenSSL 4.0 Aug 30, 2026

Jens-G mentioned this pull request Aug 30, 2026

Fix TSSLSocket building with LibreSSL #3736

Closed

2 of 5 tasks

Jens-G self-assigned this Aug 30, 2026

sebastianas force-pushed the openssl4 branch from 38b6e3c to 829c7e5 Compare August 30, 2026 15:14

Jens-G changed the title ~~THRIFT-6170: Make it compatible with OpenSSL 4.0~~ THRIFT-6174: Make it compatible with OpenSSL 4.0 Sep 1, 2026

Jens-G mentioned this pull request Sep 12, 2026

THRIFT-6174: Enable TSSLSocket to build with OpenSSL 4.0 #3850

Merged

Jens-G closed this Sep 12, 2026

Navigation Menu

Repository navigation

THRIFT-6174: Make it compatible with OpenSSL 4.0 - #3761

THRIFT-6174: Make it compatible with OpenSSL 4.0#3761
sebastianas wants to merge 1 commit into
apache:masterfrom
sebastianas:openssl4

sebastianas commented Aug 30, 2026

Uh oh!

Jens-G commented Aug 30, 2026

Uh oh!

Jens-G commented Aug 30, 2026

Uh oh!

Jens-G commented Aug 30, 2026

Uh oh!

sebastianas commented Aug 30, 2026

Uh oh!

Jens-G commented Sep 1, 2026

Uh oh!

brad0 commented Sep 1, 2026 •

edited

Loading

Uh oh!

Jens-G commented Sep 7, 2026

Uh oh!

FinnRG commented Sep 7, 2026 •

edited

Loading

Uh oh!

Jens-G commented Sep 12, 2026

Uh oh!

Jens-G commented Sep 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

sebastianas commented Aug 30, 2026

Uh oh!

Jens-G commented Aug 30, 2026

Uh oh!

Jens-G commented Aug 30, 2026

Code review

Suggestions

Uh oh!

Jens-G commented Aug 30, 2026

Uh oh!

sebastianas commented Aug 30, 2026

Uh oh!

Jens-G commented Sep 1, 2026

Code review (round 2)

1. On OpenSSL >= 4.0, LATEST/TLSv1_2 ends up with no protocol floor — looser than the default SSLTLS

2. The trailing . in Client: cpp,c_glib. silently drops c_glib from the release notes

Suggestions

Uh oh!

brad0 commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Jens-G commented Sep 7, 2026

Uh oh!

FinnRG commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Jens-G commented Sep 12, 2026

Uh oh!

Jens-G commented Sep 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

1. On OpenSSL >= 4.0, `LATEST`/`TLSv1_2` ends up with no protocol floor — looser than the default `SSLTLS`

2. The trailing `.` in `Client: cpp,c_glib.` silently drops c_glib from the release notes

brad0 commented Sep 1, 2026 •

edited

Loading

FinnRG commented Sep 7, 2026 •

edited

Loading