Jens-G commented on PR #3600: URL: https://github.com/apache/thrift/pull/3600#issuecomment-4731783206
### Code review Found 2 issues: 1. `ctx_.reset()` is called outside the mutex in the destructor, regressing the fix from THRIFT-2225 (commit `301dfa94d`). That commit explicitly placed `ctx_.reset()` inside `Guard guard(mutex_)` to prevent a race between concurrent destructor calls and `createSocket()` threads reading `ctx_` without the lock. The refactor here splits the lock into `cleanupOpenSSLState()` but leaves the reset unguarded. https://github.com/apache/thrift/blob/009a524b8a33ddd6b37675d40121613066e99ee2/lib/cpp/src/thrift/transport/TSSLSocket.cpp#L925-L929 2. The `SSL_OP_NO_TLSv1` and `SSL_OP_NO_TLSv1_1` assertions in the new test cases are not wrapped in `#if` guards, unlike the adjacent `SSL_OP_NO_SSLv2` check on line 236. On OpenSSL 3.0+ these constants can evaluate to 0, making the unguarded `BOOST_CHECK((options & SSL_OP_NO_TLSv1) != 0)` assertions fail unconditionally even when the protocol floor is correctly set. https://github.com/apache/thrift/blob/009a524b8a33ddd6b37675d40121613066e99ee2/lib/cpp/test/SecurityTest.cpp#L235-L242 🤖 Generated with [Claude Code](https://claude.ai/code) <sub>- If this code review was useful, please react with 👍. Otherwise, react with 👎.</sub> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
