This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit d98758895ef762565e7ee19d9819e9aeb559838f Author: opencode <[email protected]> AuthorDate: Fri Oct 16 07:56:28 2026 +0200 Account for TLS 1.3 in the enabled protocol management of the JNI OpenSSL SSLEngine The Tomcat Native based SSLEngine implementation advertised TLS 1.3 as an implemented protocol (OpenSSL 1.1.1+) but never accounted for it in its enabled-protocol bookkeeping: - getEnabledProtocols() only inspected the SSL_OP_NO_SSLv3, NO_TLSv1, NO_TLSv1_1 and NO_TLSv1_2 options, so it always omitted TLSv1.3 from the returned list even when TLS 1.3 was enabled. Since the base SSLEngine.getSSLParameters() is built from getEnabledProtocols(), web applications using the SSLEngine request attribute saw an incomplete list. - setEnabledProtocols() had no TLSv1.3 case and never set the SSL_OP_NO_TLSv1_3 option, so a requested protocol list excluding TLS 1.3 silently left TLS 1.3 enabled. Fix both by mirroring the Panama implementation which already handles TLS 1.3 in these places, using the existing SSL.SSL_OP_NO_TLSv1_3 constant. This complements the equivalent fix recently applied to the OpenSSLContext init reconfigure block. --- java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java index 48ba32f77e..13340afc09 100644 --- a/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java +++ b/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java @@ -832,6 +832,9 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn if ((opts & SSL.SSL_OP_NO_TLSv1_2) == 0) { enabled.add(Constants.SSL_PROTO_TLSv1_2); } + if ((opts & SSL.SSL_OP_NO_TLSv1_3) == 0) { + enabled.add(Constants.SSL_PROTO_TLSv1_3); + } if ((opts & SSL.SSL_OP_NO_SSLv3) == 0) { enabled.add(Constants.SSL_PROTO_SSLv3); } @@ -854,6 +857,7 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn boolean tlsv1 = false; boolean tlsv1_1 = false; boolean tlsv1_2 = false; + boolean tlsv1_3 = false; for (String p : protocols) { if (!IMPLEMENTED_PROTOCOLS_SET.contains(p)) { throw new IllegalArgumentException(sm.getString("engine.unsupportedProtocol", p)); @@ -866,6 +870,8 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn tlsv1_1 = true; } else if (p.equals(Constants.SSL_PROTO_TLSv1_2)) { tlsv1_2 = true; + } else if (p.equals(Constants.SSL_PROTO_TLSv1_3)) { + tlsv1_3 = true; } } // Enable all and then disable what we not want @@ -882,6 +888,9 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn if (!tlsv1_2) { SSL.setOptionsLong(ssl, SSL.SSL_OP_NO_TLSv1_2); } + if (!tlsv1_3) { + SSL.setOptionsLong(state.ssl, SSL.SSL_OP_NO_TLSv1_3); + } } @Override --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
