From c3e0d4652574c592c1061e61643e713fcb619434 Mon Sep 17 00:00:00 2001 From: xiehan <52160700+Barenboim@users.noreply.github.com> Date: Thu, 23 Oct 2025 17:59:08 +0800 Subject: [PATCH 1/4] Remove support for OpenSSL 1.0.x and below. (#1777) --- src/factory/MySQLTaskImpl.cc | 3 --- src/manager/RouteManager.h | 2 -- src/manager/WFGlobal.cc | 50 ------------------------------------ src/protocol/MySQLMessage.cc | 2 +- src/protocol/SSLWrapper.cc | 11 -------- 5 files changed, 1 insertion(+), 67 deletions(-) diff --git a/src/factory/MySQLTaskImpl.cc b/src/factory/MySQLTaskImpl.cc index ad3dd231..d167f8c5 100644 --- a/src/factory/MySQLTaskImpl.cc +++ b/src/factory/MySQLTaskImpl.cc @@ -213,9 +213,6 @@ CommMessageOut *ComplexMySQLTask::message_out() auth_switch_req->set_password(password_); auth_switch_req->set_auth_plugin_name(std::move(conn->str)); auth_switch_req->set_seed(conn->seed); -#if OPENSSL_VERSION_NUMBER < 0x10100000L - WFGlobal::get_ssl_client_ctx(); -#endif break; case ST_SHA256_PUBLIC_KEY_REQUEST: diff --git a/src/manager/RouteManager.h b/src/manager/RouteManager.h index cd660d43..82865391 100644 --- a/src/manager/RouteManager.h +++ b/src/manager/RouteManager.h @@ -46,7 +46,6 @@ public: class RouteTarget : public CommSchedTarget { -#if OPENSSL_VERSION_NUMBER >= 0x10100000L public: int init(const struct sockaddr *addr, socklen_t addrlen, SSL_CTX *ssl_ctx, int connect_timeout, int ssl_connect_timeout, int response_timeout, @@ -70,7 +69,6 @@ public: if (ssl_ctx) SSL_CTX_free(ssl_ctx); } -#endif public: int state; diff --git a/src/manager/WFGlobal.cc b/src/manager/WFGlobal.cc index c776f5d7..f8abbe88 100644 --- a/src/manager/WFGlobal.cc +++ b/src/manager/WFGlobal.cc @@ -31,12 +31,6 @@ #include #include #include -#if OPENSSL_VERSION_NUMBER < 0x10100000L -# include -# include -# include -# include -#endif #include "CommScheduler.h" #include "Executor.h" #include "WFResourcePool.h" @@ -179,18 +173,6 @@ __WFGlobal::__WFGlobal() sync_max_ = 0; } -#if OPENSSL_VERSION_NUMBER < 0x10100000L -static std::mutex *__ssl_mutex; - -static void ssl_locking_callback(int mode, int type, const char* file, int line) -{ - if (mode & CRYPTO_LOCK) - __ssl_mutex[type].lock(); - else if (mode & CRYPTO_UNLOCK) - __ssl_mutex[type].unlock(); -} -#endif - class __SSLManager { public: @@ -206,15 +188,6 @@ public: private: __SSLManager() { -#if OPENSSL_VERSION_NUMBER < 0x10100000L - __ssl_mutex = new std::mutex[CRYPTO_num_locks()]; - CRYPTO_set_locking_callback(ssl_locking_callback); - SSL_library_init(); - SSL_load_error_strings(); - //ERR_load_crypto_strings(); - //OpenSSL_add_all_algorithms(); -#endif - ssl_client_ctx_ = SSL_CTX_new(SSLv23_client_method()); if (ssl_client_ctx_ == NULL) abort(); @@ -223,29 +196,6 @@ private: ~__SSLManager() { SSL_CTX_free(ssl_client_ctx_); - -#if OPENSSL_VERSION_NUMBER < 0x10100000L - //free ssl to avoid memory leak - FIPS_mode_set(0); - CRYPTO_set_locking_callback(NULL); -# ifdef CRYPTO_LOCK_ECDH - CRYPTO_THREADID_set_callback(NULL); -# else - CRYPTO_set_id_callback(NULL); -# endif - ENGINE_cleanup(); - CONF_modules_unload(1); - ERR_free_strings(); - EVP_cleanup(); -# ifdef CRYPTO_LOCK_ECDH - ERR_remove_thread_state(NULL); -# else - ERR_remove_state(0); -# endif - CRYPTO_cleanup_all_ex_data(); - sk_SSL_COMP_free(SSL_COMP_get_compression_methods()); - delete []__ssl_mutex; -#endif } private: diff --git a/src/protocol/MySQLMessage.cc b/src/protocol/MySQLMessage.cc index 22a78781..0e20eb39 100644 --- a/src/protocol/MySQLMessage.cc +++ b/src/protocol/MySQLMessage.cc @@ -583,7 +583,7 @@ int MySQLRSAAuthRequest::encode(struct iovec vectors[], int max) EVP_PKEY_CTX *pkey_ctx; int ret = -1; - bio = BIO_new_mem_buf((void *)public_key_.c_str(), public_key_.size()); + bio = BIO_new_mem_buf(public_key_.c_str(), public_key_.size()); if (bio) { pkey = PEM_read_bio_PUBKEY(bio, NULL, NULL, NULL); diff --git a/src/protocol/SSLWrapper.cc b/src/protocol/SSLWrapper.cc index 6c29be5a..f7a80474 100644 --- a/src/protocol/SSLWrapper.cc +++ b/src/protocol/SSLWrapper.cc @@ -25,17 +25,6 @@ namespace protocol { -#if OPENSSL_VERSION_NUMBER < 0x10100000L -static inline BIO *__get_wbio(SSL *ssl) -{ - BIO *wbio = SSL_get_wbio(ssl); - BIO *next = BIO_next(wbio); - return next ? next : wbio; -} - -# define SSL_get_wbio(ssl) __get_wbio(ssl) -#endif - int SSLHandshaker::encode(struct iovec vectors[], int max) { BIO *wbio = SSL_get_wbio(this->ssl); From 7a9c71b77e77f90f08c4a21ed53db620fc19cda1 Mon Sep 17 00:00:00 2001 From: xiehan <52160700+Barenboim@users.noreply.github.com> Date: Fri, 24 Oct 2025 16:27:20 +0800 Subject: [PATCH 2/4] Update tutorial-14-consul_cli.cc --- tutorial/tutorial-14-consul_cli.cc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tutorial/tutorial-14-consul_cli.cc b/tutorial/tutorial-14-consul_cli.cc index 49cc973d..6674c950 100644 --- a/tutorial/tutorial-14-consul_cli.cc +++ b/tutorial/tutorial-14-consul_cli.cc @@ -158,9 +158,9 @@ void sig_handler(int signo) { } int main(int argc, char *argv[]) { - if (argc < 3) + if (argc != 3) { - fprintf(stderr, "USAGE: %s url type(discover/register/deregister)

\n", argv[0]); + fprintf(stderr, "USAGE: %s \n", argv[0]); exit(1); } @@ -213,7 +213,7 @@ int main(int argc, char *argv[]) } else { - fprintf(stderr, "USAGE: %s url

[compress_type/d]\n", argv[0]); + fprintf(stderr, "USAGE: %s \n", argv[0]); exit(1); } From 0c965d4cc8ad566293b2a2e9a70a151fe92669e6 Mon Sep 17 00:00:00 2001 From: Xie Han <63350856@qq.com> Date: Fri, 24 Oct 2025 17:07:45 +0800 Subject: [PATCH 3/4] Update README's description of OpenSSL requirement. --- README.md | 2 +- README_cn.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index accd7b27..c464504d 100644 --- a/README.md +++ b/README.md @@ -49,7 +49,7 @@ int main() * This project supports `Linux`, `macOS`, `Windows`, `Android` and other operating systems. * `Windows` version is currently released as an independent [branch](https://github.com/sogou/workflow/tree/windows), using `iocp` to implement asynchronous networking. All user interfaces are consistent with the `Linux` version. * Supports all CPU platforms, including 32 or 64-bit `x86` processors, big-endian or little-endian `arm` processors, `loongson` processors. -* Master branch requires SSL and `OpenSSL 1.1` or above is recommended. Fully compatible with BoringSSL. If you don't like SSL, you may checkout the [nossl](https://github.com/sogou/workflow/tree/nossl) branch. +* Master branch requires `OpenSSL 1.1` or above, and BoringSSL is fully compatible. If you don't like SSL, you may checkout the [nossl](https://github.com/sogou/workflow/tree/nossl) branch. * Uses the `C++11` standard and therefore, it should be compiled with a compiler which supports `C++11`. Does not rely on `boost` or `asio`. * No other dependencies. However, if you need `Kafka` protocol, some compression libraries should be installed, including `lz4`, `zstd` and `snappy`. diff --git a/README_cn.md b/README_cn.md index 97b64af3..1a55a3f3 100644 --- a/README_cn.md +++ b/README_cn.md @@ -44,7 +44,7 @@ int main() * 项目支持``Linux``，``macOS``，``Windows``，``Android``等操作系统。 * ``Windows``版以[windows](https://github.com/sogou/workflow/tree/windows)分支发布，使用``iocp``实现异步网络。用户接口与``Linux``版一致。 * 支持所有CPU平台，包括32或64位``x86``处理器，大端或小端``arm``处理器，国产``loongson``龙芯处理器实测支持。 -* 需要依赖于``OpenSSL``，推荐``OpenSSL 1.1``及以上版本。 +* 需要依赖于``OpenSSL 1.1``或以上版本，也兼容BoringSSL。 * 不喜欢SSL的用户可以使用[nossl](https://github.com/sogou/workflow/tree/nossl)分支，代码更简洁。 * 项目使用了``C++11``标准，需要用支持``C++11``的编译器编译。但不依赖``boost``或``asio``。 * 项目无其它依赖。如需使用``kafka``协议，需自行安装``lz4``，``zstd``和``snappy``几个压缩库。 From 65f044b5e7d5a5a53295a12609b24b7f19b3b071 Mon Sep 17 00:00:00 2001 From: xiehan <52160700+Barenboim@users.noreply.github.com> Date: Fri, 24 Oct 2025 21:09:32 +0800 Subject: [PATCH 4/4] Remove 'setsockopt()' on an accepted sockfd. (#1789) --- src/server/WFServer.cc | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/src/server/WFServer.cc b/src/server/WFServer.cc index bfd7e194..1a2733d3 100644 --- a/src/server/WFServer.cc +++ b/src/server/WFServer.cc @@ -177,18 +177,15 @@ int WFServerBase::create_listen_fd() WFConnection *WFServerBase::new_connection(int accept_fd) { - if (++this->conn_count <= this->params.max_connections || - this->drain(1) == 1) + if (++this->conn_count > this->params.max_connections && + this->drain(1) <= 0) { - int reuse = 1; - setsockopt(accept_fd, SOL_SOCKET, SO_REUSEADDR, - &reuse, sizeof (int)); - return new WFServerConnection(&this->conn_count); + this->conn_count--; + errno = EMFILE; + return NULL; } - this->conn_count--; - errno = EMFILE; - return NULL; + return new WFServerConnection(&this->conn_count); } void WFServerBase::delete_connection(WFConnection *conn)