cmcfarlen opened a new pull request, #13482:
URL: https://github.com/apache/trafficserver/pull/13482
Fedora 45 ships OpenSSL 4.0, which breaks the ATS build. This supersedes
#13440 by
@jeredfloyd, which had the right diagnosis but did not build on OpenSSL
1.1.1 and
missed several affected files. Jered is credited via `Co-authored-by`.
Resolves #13427.
## Root cause
Diffing the actual headers from OpenSSL 1.1.1f and 4.0.1, exactly one API
changes in
a way that can break compilation:
| API | 1.1.1 | 3.0 / 4.0 |
| --- | --- | --- |
| `X509_NAME_get_index_by_NID` | takes `X509_NAME *` | takes `const
X509_NAME *` |
Others changed only their **return** type to const in 4.0
(`X509_get_subject_name`,
`X509_get_issuer_name`, `X509_NAME_get_entry`, `X509_NAME_ENTRY_get_data`,
`X509_get0_pubkey_bitstr`), and `ASN1_STRING` became opaque. Receiving those
into a
const-qualified variable is legal on every version.
So hardcoding `const` is required on OpenSSL 4 but *illegal* on 1.1.1 —
which is why
#13440 failed the Ubuntu 20.04 and FreeBSD 13.1 jobs.
## Approach
Let the type be **deduced from the accessor** rather than hardcoded — `auto
*` for
locals, `decltype(&X509_get_subject_name)` for parameter and
function-pointer types.
One source form compiles on 1.1.1, 3.x and 4.0 with no version macros and no
`const_cast`.
One case makes this mandatory rather than merely tidy: `X509_getm_notBefore`
/
`X509_getm_notAfter` changed const in the *opposite* direction (they took
`const X509 *` in 1.1.1 and take `X509 *` in 4.0), so no hardcoded spelling
works
everywhere.
## Beyond #13440
These are also broken on OpenSSL 4 and were not covered by #13440:
- `plugins/lua/ts_lua_client_cert_helpers.h`,
`plugins/lua/ts_lua_client_request.cc`
- `src/cripts/Certs.cc`, `include/cripts/Certs.hpp` — same
opaque-`ASN1_STRING`
issue that #13440 fixed in sslheaders, plus two function-pointer types
- `src/iocore/net/unit_tests/test_SSLDHParams.cc`
- `example/plugins/c-api/client_context_dump/client_context_dump.cc`
- `tests/tools/plugins/ssl_client_verify_test.cc`
Two fixes here are not purely mechanical:
- **`plugins/certifier/certifier.cc`** — the `X509_NAME_dup` approach needs
the copy
freed on the `X509_NAME_add_entry_by_txt` failure path and the `dup` result
null-checked. Reworked onto the file's existing `std::unique_ptr` idiom.
- **`test_SSLDHParams.cc`** — this relied on mutating the subject name *in
place*.
Once the accessor returns const you must dup and then call **both**
`X509_set_subject_name` and `X509_set_issuer_name`, or the generated
self-signed
cert silently loses its CN.
## Verification
Full builds with `BUILD_EXPERIMENTAL_PLUGINS=ON` and
`BUILD_REGRESSION_TESTING=ON`,
Cripts enabled where the platform's fmt allows it, plus `test_tscore` and
`test_net`:
| Platform | OpenSSL | Compiler | Build | Tests |
| --- | --- | --- | --- | --- |
| Fedora 45 | 4.0.1 | gcc | pass | pass |
| Fedora 43 | 3.5.7 | gcc | pass | pass |
| Ubuntu 20.04 | 1.1.1f | clang-12 | pass | pass |
All on linux/arm64.
Caveats:
- `test_SSLDHParams.cc` is gated behind `SSLLIB_IS_AT_LEAST_OPENSSL3`, so
that change
is only exercised on 3.x/4.0.
- Cripts could not be built on Ubuntu 20.04 — its fmt is 6.1.2 against the
8.1
minimum — so the Cripts changes are verified on OpenSSL 3.5 and 4.0 only.
- FreeBSD was covered by proxy (also OpenSSL 1.1.1), not natively.
- `src/tscore/unit_tests/test_X509HostnameValidator.cc` exists but is not
wired into
any CMake target, so `validate_hostname` has no unit coverage.
Pre-existing; left
alone here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
