From 81af1ac55f924c466562d885c269b9c559b52b7f Mon Sep 17 00:00:00 2001 From: Jeremy Barton Date: Tue, 17 Mar 2026 15:15:38 -0700 Subject: [PATCH 1/4] Handle OSSL4 sk_X509 thunk in portable builds --- .../openssl.c | 19 +++++++++++++++++++ .../opensslshim.h | 3 --- .../pal_x509.c | 7 +++++-- 3 files changed, 24 insertions(+), 5 deletions(-) diff --git a/src/native/libs/System.Security.Cryptography.Native/openssl.c b/src/native/libs/System.Security.Cryptography.Native/openssl.c index 2d953bb33bab54..6e626e20ada1bf 100644 --- a/src/native/libs/System.Security.Cryptography.Native/openssl.c +++ b/src/native/libs/System.Security.Cryptography.Native/openssl.c @@ -1041,6 +1041,13 @@ int32_t CryptoNative_BioSeek(BIO* bio, int32_t ofs) return BIO_seek(bio, ofs); } +#ifdef FEATURE_DISTRO_AGNOSTIC_SSL +static void local_sk_X509_freefunc_thunk(OPENSSL_sk_freefunc freefunc_arg, void *ptr) +{ + freefunc_arg(ptr); +} +#endif + /* Function: NewX509Stack @@ -1054,7 +1061,19 @@ A STACK_OF(X509*) with no comparator. STACK_OF(X509) * CryptoNative_NewX509Stack(void) { ERR_clear_error(); + +#ifdef FEATURE_DISTRO_AGNOSTIC_SSL + OPENSSL_STACK* sk = OPENSSL_sk_new_null(); + + if (API_EXISTS(OPENSSL_sk_set_thunks)) + { + OPENSSL_sk_set_thunks(sk, local_sk_X509_freefunc_thunk); + } + + return (STACK_OF(X509)*)sk; +#else return sk_X509_new_null(); +#endif } /* diff --git a/src/native/libs/System.Security.Cryptography.Native/opensslshim.h b/src/native/libs/System.Security.Cryptography.Native/opensslshim.h index 43f93f86dcccfd..5ec8bde682bd4f 100644 --- a/src/native/libs/System.Security.Cryptography.Native/opensslshim.h +++ b/src/native/libs/System.Security.Cryptography.Native/opensslshim.h @@ -1423,9 +1423,6 @@ extern TYPEOF(OPENSSL_gmtime)* OPENSSL_gmtime_ptr; #define sk_X509_NAME_num(stack) OPENSSL_sk_num((const OPENSSL_STACK*)(1 ? stack : (const STACK_OF(X509_NAME)*)0)) #define sk_X509_num(stack) OPENSSL_sk_num((const OPENSSL_STACK*)(1 ? stack : (const STACK_OF(X509)*)0)) -// type-safe OPENSSL_sk_new_null -#define sk_X509_new_null() (STACK_OF(X509)*)OPENSSL_sk_new_null() - // type-safe OPENSSL_sk_push #define sk_X509_push(stack,value) OPENSSL_sk_push((OPENSSL_STACK*)(1 ? stack : (STACK_OF(X509)*)0), (const void*)(1 ? value : (X509*)0)) diff --git a/src/native/libs/System.Security.Cryptography.Native/pal_x509.c b/src/native/libs/System.Security.Cryptography.Native/pal_x509.c index cf5b6b4b07edf2..2de119a565a325 100644 --- a/src/native/libs/System.Security.Cryptography.Native/pal_x509.c +++ b/src/native/libs/System.Security.Cryptography.Native/pal_x509.c @@ -11,10 +11,13 @@ #include #include +#include "openssl.h" + #ifndef NAME_MAX #error "NAME_MAX is not defined" #endif + c_static_assert(PAL_X509_V_OK == X509_V_OK); c_static_assert(PAL_X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT); c_static_assert(PAL_X509_V_ERR_UNABLE_TO_GET_CRL == X509_V_ERR_UNABLE_TO_GET_CRL); @@ -625,7 +628,7 @@ int32_t CryptoNative_X509StackAddDirectoryStore(X509Stack* stack, char* storePat if (storeDir != NULL) { X509* cert; - X509Stack* tmpStack = sk_X509_new_null(); + X509Stack* tmpStack = CryptoNative_NewX509Stack(); if (tmpStack == NULL) { @@ -1348,7 +1351,7 @@ int32_t CryptoNative_X509DecodeOcspToExpiration(const uint8_t* buf, int32_t len, if (store != NULL) { - bag = sk_X509_new_null(); + bag = CryptoNative_NewX509Stack(); } if (bag != NULL) From d443ff92a8d6af6e7d335312a86c960c2a7c93ff Mon Sep 17 00:00:00 2001 From: Jeremy Barton Date: Tue, 17 Mar 2026 15:18:31 -0700 Subject: [PATCH 2/4] Add OSSL4 to the shim probe list --- .../libs/System.Security.Cryptography.Native/opensslshim.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/native/libs/System.Security.Cryptography.Native/opensslshim.c b/src/native/libs/System.Security.Cryptography.Native/opensslshim.c index 6d9ba5deaeff82..127fbf977a7eb3 100644 --- a/src/native/libs/System.Security.Cryptography.Native/opensslshim.c +++ b/src/native/libs/System.Security.Cryptography.Native/opensslshim.c @@ -123,6 +123,12 @@ static void OpenLibraryOnce(void) { DlOpen(MAKELIB("1.1")); } + + // While it's still in alpha, OpenSSl 4 is probed, but not preferred. + if (libssl == NULL) + { + DlOpen(MAKELIB("4")); + } } static pthread_once_t g_openLibrary = PTHREAD_ONCE_INIT; From d6c4b396278311f87b2a79d1c9a365bdf363aff5 Mon Sep 17 00:00:00 2001 From: Jeremy Barton Date: Tue, 17 Mar 2026 15:22:32 -0700 Subject: [PATCH 3/4] Remove stray blank line --- src/native/libs/System.Security.Cryptography.Native/pal_x509.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/native/libs/System.Security.Cryptography.Native/pal_x509.c b/src/native/libs/System.Security.Cryptography.Native/pal_x509.c index 2de119a565a325..65a369585df6e7 100644 --- a/src/native/libs/System.Security.Cryptography.Native/pal_x509.c +++ b/src/native/libs/System.Security.Cryptography.Native/pal_x509.c @@ -17,7 +17,6 @@ #error "NAME_MAX is not defined" #endif - c_static_assert(PAL_X509_V_OK == X509_V_OK); c_static_assert(PAL_X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT); c_static_assert(PAL_X509_V_ERR_UNABLE_TO_GET_CRL == X509_V_ERR_UNABLE_TO_GET_CRL); From 5636767e1e8f127e85dd754fe71e0fc060fe3058 Mon Sep 17 00:00:00 2001 From: Jeremy Barton Date: Tue, 17 Mar 2026 15:44:12 -0700 Subject: [PATCH 4/4] Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- src/native/libs/System.Security.Cryptography.Native/openssl.c | 2 +- .../libs/System.Security.Cryptography.Native/opensslshim.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/native/libs/System.Security.Cryptography.Native/openssl.c b/src/native/libs/System.Security.Cryptography.Native/openssl.c index 6e626e20ada1bf..546f63e7500437 100644 --- a/src/native/libs/System.Security.Cryptography.Native/openssl.c +++ b/src/native/libs/System.Security.Cryptography.Native/openssl.c @@ -1042,7 +1042,7 @@ int32_t CryptoNative_BioSeek(BIO* bio, int32_t ofs) } #ifdef FEATURE_DISTRO_AGNOSTIC_SSL -static void local_sk_X509_freefunc_thunk(OPENSSL_sk_freefunc freefunc_arg, void *ptr) +static void local_sk_X509_freefunc_thunk(OPENSSL_sk_freefunc freefunc_arg, void* ptr) { freefunc_arg(ptr); } diff --git a/src/native/libs/System.Security.Cryptography.Native/opensslshim.c b/src/native/libs/System.Security.Cryptography.Native/opensslshim.c index 127fbf977a7eb3..df1e7c65d06e2c 100644 --- a/src/native/libs/System.Security.Cryptography.Native/opensslshim.c +++ b/src/native/libs/System.Security.Cryptography.Native/opensslshim.c @@ -124,7 +124,7 @@ static void OpenLibraryOnce(void) DlOpen(MAKELIB("1.1")); } - // While it's still in alpha, OpenSSl 4 is probed, but not preferred. + // While it's still in alpha, OpenSSL 4 is probed, but not preferred. if (libssl == NULL) { DlOpen(MAKELIB("4"));