[Buildroot] [PATCH 1/2] package/thrift: Fix build with LibreSSL and OpenSSL 4.x
Bernd Kuhls
bernd at kuhls.net
Sat Sep 12 20:24:46 UTC 2026
Buildroot commit cf2471a9d958b0eaa2db3508e96b465eaa481f3e bumped the
package from 0.14.1 to 0.22.0 which includes upstream commit
https://github.com/apache/thrift/commit/98be76fc033f1d66bcfd09d4a22b86e8061e89c2
This commit added OPENSSL_thread_stop() which is not provided by
LibreSSL causing a build error.
To fix the problem we add an upstream patch which is a merged version
of LibreSSL fixes[1] and fixes for the upcoming OpenSSL bump to 4.0.0.
Fixes:
https://autobuild.buildroot.net/results/242/242ea99f1c1c29fcc364d59a6a7efc8f11bcf76e/
[1] https://github.com/apache/thrift/pull/3736
Signed-off-by: Bernd Kuhls <bernd at kuhls.net>
---
...sport-Make-it-compatible-with-OpenSS.patch | 193 ++++++++++++++++++
1 file changed, 193 insertions(+)
create mode 100644 package/thrift/0002-THRIFT-6170-transport-Make-it-compatible-with-OpenSS.patch
diff --git a/package/thrift/0002-THRIFT-6170-transport-Make-it-compatible-with-OpenSS.patch b/package/thrift/0002-THRIFT-6170-transport-Make-it-compatible-with-OpenSS.patch
new file mode 100644
index 0000000000..7a5cfc5ce1
--- /dev/null
+++ b/package/thrift/0002-THRIFT-6170-transport-Make-it-compatible-with-OpenSS.patch
@@ -0,0 +1,193 @@
+From e460f4277fabede007c751969ab8fc161eadaa16 Mon Sep 17 00:00:00 2001
+From: Sebastian Andrzej Siewior <sebastian at breakpoint.cc>
+Date: Sun, 30 Aug 2026 10:19:00 +0200
+Subject: [PATCH] THRIFT-6170: transport: Make it compatible with OpenSSL 4.0
+
+Make it compatible with OpenSSL 4.0:
+- Don't use ERR_remove_state(). It has been an empty stub since OpenSSL
+ 1.1.0 and got finally removed in 4.0-
+
+- SSLv3_method(), TLSv1_method(), TLSv1_1_method() and TLSv1_2_method()
+ have been removed. The recommendation is to use TLS_method() instead.
+ LATEST points to TLSv1_2_method which is not going to work.
+ Make SSLTLS and LATEST point to TLS_method() for newer OpenSSL which
+ uses the highest supported protocol version.
+ Adjust the testsuite to only test those two.
+
+- The return value of a few functions such as X509_get_subject_name()
+ has been made const. Use the const pointer only for newer OpenSSL.
+
+- While at it, pull the libressl related change from #3736
+
+Client: cpp,c_glib.
+
+Signed-off-by: Sebastian Andrzej Siewior <sebastian at breakpoint.cc>
+
+Upstream: https://github.com/apache/thrift/pull/3761
+
+Signed-off-by: Bernd Kuhls <bernd at kuhls.net>
+---
+ .../c_glib/transport/thrift_ssl_socket.c | 11 ++++++++++
+ lib/cpp/src/thrift/transport/TSSLSocket.cpp | 20 +++++++++++++++----
+ lib/cpp/test/SecurityFromBufferTest.cpp | 10 ++++++++++
+ lib/cpp/test/SecurityTest.cpp | 10 ++++++++++
+ 4 files changed, 47 insertions(+), 4 deletions(-)
+
+diff --git a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
+index d6c7bb2ba..0681831cb 100644
+--- a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
++++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c
+@@ -285,7 +285,9 @@ thrift_ssl_socket_close (ThriftTransport *transport, GError **error)
+ SSL_shutdown(ssl_socket->ssl);
+ SSL_free(ssl_socket->ssl);
+ ssl_socket->ssl = NULL;
++#if OPENSSL_VERSION_NUMBER < 0x40000000L
+ ERR_remove_state(0);
++#endif
+ }
+ return thrift_socket_close(transport, error);
+ }
+@@ -710,7 +712,9 @@ void thrift_ssl_socket_finalize_openssl(void)
+ ERR_free_strings();
+ EVP_cleanup();
+ CRYPTO_cleanup_all_ex_data();
++#if OPENSSL_VERSION_NUMBER < 0x40000000L
+ ERR_remove_state(0);
++#endif
+ }
+
+
+@@ -832,6 +836,12 @@ thrift_ssl_socket_context_initialize(ThriftSSLSocketProtocol ssl_protocol, GErro
+ {
+ SSL_CTX* context = NULL;
+ switch(ssl_protocol){
++#if OPENSSL_VERSION_NUMBER >= 0x40000000L
++ case SSLTLS:
++ case LATEST:
++ context = SSL_CTX_new(TLS_method());
++ break;
++#else
+ case SSLTLS:
+ context = SSL_CTX_new(SSLv23_method());
+ break;
+@@ -849,6 +859,7 @@ thrift_ssl_socket_context_initialize(ThriftSSLSocketProtocol ssl_protocol, GErro
+ case TLSv1_2:
+ context = SSL_CTX_new(TLSv1_2_method());
+ break;
++#endif
+ default:
+ g_set_error (error, THRIFT_TRANSPORT_ERROR,
+ THRIFT_SSL_SOCKET_ERROR_CIPHER_NOT_AVAILABLE,
+diff --git a/lib/cpp/src/thrift/transport/TSSLSocket.cpp b/lib/cpp/src/thrift/transport/TSSLSocket.cpp
+index 48b96ebf7..e8d69a329 100644
+--- a/lib/cpp/src/thrift/transport/TSSLSocket.cpp
++++ b/lib/cpp/src/thrift/transport/TSSLSocket.cpp
+@@ -157,7 +157,7 @@ void cleanupOpenSSL() {
+ #endif
+ EVP_cleanup();
+ CRYPTO_cleanup_all_ex_data();
+-#if OPENSSL_VERSION_NUMBER >= 0x10100000
++#if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(LIBRESSL_VERSION_NUMBER)
+ // Do nothing unless an openssl derivative is detected
+ # if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
+ // https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_thread_stop.html
+@@ -180,6 +180,10 @@ static char uppercase(char c);
+
+ // SSLContext implementation
+ SSLContext::SSLContext(const SSLProtocol& protocol) {
++#if OPENSSL_VERSION_NUMBER >= 0x40000000L
++ if (protocol == SSLTLS || protocol == LATEST) {
++ ctx_ = SSL_CTX_new(TLS_method());
++#else
+ if (protocol == SSLTLS) {
+ ctx_ = SSL_CTX_new(SSLv23_method());
+ #ifndef OPENSSL_NO_SSL3
+@@ -192,6 +196,7 @@ SSLContext::SSLContext(const SSLProtocol& protocol) {
+ ctx_ = SSL_CTX_new(TLSv1_1_method());
+ } else if (protocol == TLSv1_2) {
+ ctx_ = SSL_CTX_new(TLSv1_2_method());
++#endif
+ } else {
+ /// UNKNOWN PROTOCOL!
+ throw TSSLException("SSL_CTX_new: Unknown protocol");
+@@ -405,7 +410,7 @@ void TSSLSocket::close() {
+ SSL_free(ssl_);
+ ssl_ = nullptr;
+ handshakeCompleted_ = false;
+-#if OPENSSL_VERSION_NUMBER >= 0x10100000
++#if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(LIBRESSL_VERSION_NUMBER)
+ // Do nothing unless an openssl derivative is detected
+ # if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
+ // https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_thread_stop.html
+@@ -800,9 +805,16 @@ void TSSLSocket::authorize() {
+ }
+
+ // extract commonName
++#if OPENSSL_VERSION_NUMBER >= 0x40000000L
++ const X509_NAME* name = X509_get_subject_name(cert);
++ const X509_NAME_ENTRY* entry;
++ const ASN1_STRING* common;
++#else
+ X509_NAME* name = X509_get_subject_name(cert);
++ X509_NAME_ENTRY* entry;
++ ASN1_STRING* common;
++#endif
+ if (name != nullptr) {
+- X509_NAME_ENTRY* entry;
+ unsigned char* utf8;
+ int last = -1;
+ while (decision == AccessManager::SKIP) {
+@@ -812,7 +824,7 @@ void TSSLSocket::authorize() {
+ entry = X509_NAME_get_entry(name, last);
+ if (entry == nullptr)
+ continue;
+- ASN1_STRING* common = X509_NAME_ENTRY_get_data(entry);
++ common = X509_NAME_ENTRY_get_data(entry);
+ int size = ASN1_STRING_to_UTF8(&utf8, common);
+ if (host.empty()) {
+ host = (server() ? getPeerHost() : getHost());
+diff --git a/lib/cpp/test/SecurityFromBufferTest.cpp b/lib/cpp/test/SecurityFromBufferTest.cpp
+index 08f76b3f2..1ff64087a 100644
+--- a/lib/cpp/test/SecurityFromBufferTest.cpp
++++ b/lib/cpp/test/SecurityFromBufferTest.cpp
+@@ -235,6 +235,16 @@ BOOST_AUTO_TEST_CASE(ssl_security_matrix) {
+ continue;
+ }
+ #endif
++#if OPENSSL_VERSION_NUMBER >= 0x40000000L
++ if (!(si == apache::thrift::transport::SSLTLS ||
++ si == apache::thrift::transport::LATEST) ||
++ !(ci == apache::thrift::transport::SSLTLS ||
++ ci == apache::thrift::transport::LATEST))
++ {
++ // Only SSLTLS / LATEST is supported.
++ continue;
++ }
++#endif
+
+ boost::mutex::scoped_lock lock(mMutex);
+
+diff --git a/lib/cpp/test/SecurityTest.cpp b/lib/cpp/test/SecurityTest.cpp
+index 86640bd68..44815dfc7 100644
+--- a/lib/cpp/test/SecurityTest.cpp
++++ b/lib/cpp/test/SecurityTest.cpp
+@@ -364,6 +364,16 @@ BOOST_AUTO_TEST_CASE(ssl_security_matrix)
+ continue;
+ }
+ #endif
++#if OPENSSL_VERSION_NUMBER >= 0x40000000L
++ if (!(si == apache::thrift::transport::SSLTLS ||
++ si == apache::thrift::transport::LATEST) ||
++ !(ci == apache::thrift::transport::SSLTLS ||
++ ci == apache::thrift::transport::LATEST))
++ {
++ // Only SSLTLS / LATEST is supported.
++ continue;
++ }
++#endif
+
+ boost::mutex::scoped_lock lock(mMutex);
+
+--
+2.47.3
+
--
2.47.3
More information about the buildroot
mailing list