forked from osquery/osquery
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Disable support for TLS 1.0 and TLS 1.1 which are deprecated protocols. - Updated Thrift to 0.19.0 and patched out use of TLS 1.0 and 1.1 functions, to make the library compile.
- Loading branch information
Showing
8 changed files
with
75 additions
and
20 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -12,4 +12,7 @@ importSourceSubmodule( | |
|
|
||
| SHALLOW_SUBMODULES | ||
| "src" | ||
|
|
||
| PATCH | ||
| "src" | ||
| ) | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,26 @@ | ||
| # thrift library build notes | ||
|
|
||
| Keep a build of the osquery `openssl` target ready, one for each architecture and platform, since it will need to be used to properly configure Thrift. | ||
|
|
||
| Prepare a directory with the boost headers in the install structure, which should create a `include` directory toplevel, which is supposed to be saved into the env var `BOOST_HEADERS`. | ||
| The structure of the folder can be obtained with the following script, after having moved inside of it: | ||
| ```sh | ||
| #!/bin/bash | ||
| mkdir -p include/boost | ||
| libs=$(find <osquery source path>/libraries/cmake/source/boost/src/libs -mindepth 1 -maxdepth 1) | ||
|
|
||
| for lib in $libs; do | ||
| if ! [ -d "$lib/include/boost" ]; then | ||
| continue | ||
| fi | ||
|
|
||
| rsync -av "$lib/include/boost/"* include/boost | ||
|
|
||
| done | ||
| ``` | ||
|
|
||
| This can be then used on all platforms. | ||
|
|
||
| ## Linux | ||
|
|
||
| Integrate the osquery-toolchain; you can use the `cmake/toolchain.cmake` as a reference. | ||
|
|
@@ -16,6 +37,7 @@ cmake \ | |
| -DBUILD_SHARED_LIBS=OFF \ | ||
| -DWITH_OPENSSL=ON \ | ||
| -DWITH_ZLIB=ON \ | ||
| -DWITH_LIBEVENT=OFF \ | ||
| -DOSQUERY_TOOLCHAIN_SYSROOT=/usr/local/osquery-toolchain | ||
| ``` | ||
|
|
||
|
|
@@ -24,53 +46,61 @@ cmake \ | |
| ### macOS x86_64 | ||
|
|
||
| ```sh | ||
| export OSQUERY_SRC="<osquery source directory>" | ||
| export OSQUERY_BUILD="<osquery build directory>" | ||
|
|
||
| cmake \ | ||
| -S . \ | ||
| -B b \ | ||
| -DBUILD_SHARED_LIBS=OFF \ | ||
| -DBoost_USE_STATIC_LIBS=ON \ | ||
| -DBoost_INCLUDE_DIR=path/to/osquery/libraries/cmake/source/boost/src/libs/config/include/ \ | ||
| -DBoost_INCLUDE_DIR=${BOOST_HEADERS} \ | ||
| -DWITH_OPENSSL=ON \ | ||
| -DWITH_ZLIB=ON \ | ||
| -DWITH_LIBEVENT=OFF \ | ||
| -DBUILD_COMPILER=OFF \ | ||
| -DBUILD_C_GLIB=OFF \ | ||
| -DBUILD_JAVA=OFF \ | ||
| -DBUILD_JAVASCRIPT=OFF \ | ||
| -DBUILD_NODEJS=OFF \ | ||
| -DBUILD_KOTLIN=OFF \ | ||
| -DBUILD_PYTHON=OFF \ | ||
| -DBUILD_TESTING=OFF \ | ||
| -DCMAKE_BUILD_TYPE=Release \ | ||
| -DCMAKE_OSX_SYSROOT=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX12.3.sdk \ | ||
| -DCMAKE_OSX_DEPLOYMENT_TARGET=10.14 \ | ||
| -DCMAKE_OSX_SYSROOT=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX14.2.sdk \ | ||
| -DCMAKE_OSX_DEPLOYMENT_TARGET=10.15 \ | ||
| -DCMAKE_OSX_ARCHITECTURES=x86_64 \ | ||
| -DOPENSSL_ROOT_DIR=/usr/local/Cellar/openssl@1.1/1.1.1s | ||
| -DOPENSSL_ROOT_DIR=${OSQUERY_BUILD}/installed_formulas/openssl | ||
| ``` | ||
|
|
||
| ### macOS ARM (M1, M2, etc.) | ||
|
|
||
| Pre-requisite: `brew install [email protected]` | ||
|
|
||
| ```sh | ||
| export OSQUERY_SRC="<osquery source directory>" | ||
| export OSQUERY_BUILD="<osquery build directory>" | ||
|
|
||
| cmake \ | ||
| -S . \ | ||
| -B b \ | ||
| -DBUILD_SHARED_LIBS=OFF \ | ||
| -DBoost_USE_STATIC_LIBS=ON \ | ||
| -DBoost_INCLUDE_DIR=path/to/osquery/libraries/cmake/source/boost/src/libs/config/include \ | ||
| -DBoost_INCLUDE_DIR=${BOOST_HEADERS} \ | ||
| -DWITH_OPENSSL=ON \ | ||
| -DWITH_ZLIB=ON \ | ||
| -DWITH_LIBEVENT=OFF \ | ||
| -DBUILD_COMPILER=OFF \ | ||
| -DBUILD_C_GLIB=OFF \ | ||
| -DBUILD_JAVA=OFF \ | ||
| -DBUILD_JAVASCRIPT=OFF \ | ||
| -DBUILD_NODEJS=OFF \ | ||
| -DBUILD_KOTLIN=OFF \ | ||
| -DBUILD_PYTHON=OFF \ | ||
| -DBUILD_TESTING=OFF \ | ||
| -DCMAKE_BUILD_TYPE=Release \ | ||
| -DCMAKE_OSX_SYSROOT=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX13.sdk \ | ||
| -DCMAKE_OSX_SYSROOT=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX14.2.sdk \ | ||
| -DCMAKE_OSX_DEPLOYMENT_TARGET=10.15 \ | ||
| -DCMAKE_OSX_ARCHITECTURES=arm64 \ | ||
| -DOPENSSL_ROOT_DIR=/opt/homebrew/Cellar/openssl@1.1/1.1.1s | ||
| -DOPENSSL_ROOT_DIR=${OSQUERY_BUILD}/installed_formulas/openssl | ||
| ``` | ||
|
|
||
| ## Windows | ||
|
|
@@ -85,6 +115,7 @@ cmake ^ | |
| -DBoost_USE_STATIC_LIBS=ON ^ | ||
| -DWITH_OPENSSL=ON ^ | ||
| -DWITH_ZLIB=ON ^ | ||
| -DWITH_LIBEVENT=OFF ^ | ||
| -DBUILD_COMPILER=OFF ^ | ||
| -DBUILD_C_GLIB=OFF ^ | ||
| -DBUILD_JAVA=OFF ^ | ||
|
|
@@ -107,6 +138,7 @@ cmake ^ | |
| -DBoost_USE_STATIC_LIBS=ON ^ | ||
| -DWITH_OPENSSL=ON ^ | ||
| -DWITH_ZLIB=ON ^ | ||
| -DWITH_LIBEVENT=OFF ^ | ||
| -DBUILD_COMPILER=OFF ^ | ||
| -DBUILD_C_GLIB=OFF ^ | ||
| -DBUILD_JAVA=OFF ^ | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
15 changes: 15 additions & 0 deletions
15
libraries/cmake/source/thrift/patches/src/disable-tlsv1.0-1.1.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| diff --git a/lib/cpp/src/thrift/transport/TSSLSocket.cpp b/lib/cpp/src/thrift/transport/TSSLSocket.cpp | ||
| index dc8fcd9a6..c4588ef4f 100644 | ||
| --- a/lib/cpp/src/thrift/transport/TSSLSocket.cpp | ||
| +++ b/lib/cpp/src/thrift/transport/TSSLSocket.cpp | ||
| @@ -178,10 +178,6 @@ SSLContext::SSLContext(const SSLProtocol& protocol) { | ||
| } else if (protocol == SSLv3) { | ||
| ctx_ = SSL_CTX_new(SSLv3_method()); | ||
| #endif | ||
| - } else if (protocol == TLSv1_0) { | ||
| - ctx_ = SSL_CTX_new(TLSv1_method()); | ||
| - } else if (protocol == TLSv1_1) { | ||
| - ctx_ = SSL_CTX_new(TLSv1_1_method()); | ||
| } else if (protocol == TLSv1_2) { | ||
| ctx_ = SSL_CTX_new(TLSv1_2_method()); | ||
| } else { |