This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
The following commit(s) were added to refs/heads/main by this push:
new ae223f9f7 Restrict permissions of any created SSLKEYLOGFILE file.
ae223f9f7 is described below
commit ae223f9f74f3f3a7cb89d127f183f5a25e2269a4
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Oct 21 19:17:02 2026 +0100
Restrict permissions of any created SSLKEYLOGFILE file.
Co-authored by: Codex / GPT-6.1-Sol-High
---
native/src/ssl.c | 35 +++++++++++++++++------------------
xdocs/miscellaneous/changelog.xml | 4 ++++
2 files changed, 21 insertions(+), 18 deletions(-)
diff --git a/native/src/ssl.c b/native/src/ssl.c
index 3391cccf5..8faaf13f7 100644
--- a/native/src/ssl.c
+++ b/native/src/ssl.c
@@ -28,13 +28,13 @@ extern apr_pool_t *tcn_global_pool;
tcn_pass_cb_t tcn_password_callback;
-static BIO *key_log_file = NULL;
+static apr_file_t *key_log_file = NULL;
static void ssl_keylog_callback(const SSL *ssl, const char *line)
{
if (key_log_file && line && *line) {
- BIO_puts(key_log_file, line);
- BIO_puts(key_log_file, "\n");
+ apr_file_puts(line, key_log_file);
+ apr_file_puts("\n", key_log_file);
}
}
@@ -75,7 +75,7 @@ static apr_status_t ssl_init_cleanup(void *data)
/* Openssl v1.1+ handles all termination automatically. */
if (key_log_file) {
- BIO_free(key_log_file);
+ apr_file_close(key_log_file);
key_log_file = NULL;
}
@@ -195,13 +195,6 @@ TCN_IMPLEMENT_CALL(jint, SSL, initialize)(TCN_STDARGS,
jstring engine)
/* For SSL_get_app_data2(), SSL_get_app_data3() and SSL_get_app_data4() at
request time */
SSL_init_app_data_idx();
- /*
- * Let us cleanup the ssl library when the library is unloaded
- */
- apr_pool_cleanup_register(tcn_global_pool, NULL,
- ssl_init_cleanup,
- apr_pool_cleanup_null);
-
/* Cache the byte[].class for performance reasons */
clazz = (*e)->FindClass(e, "[B");
byteArrayClass = (jclass) (*e)->NewGlobalRef(e, clazz);
@@ -213,17 +206,23 @@ TCN_IMPLEMENT_CALL(jint, SSL, initialize)(TCN_STDARGS,
jstring engine)
if (!key_log_file) {
char *key_log_file_name = getenv("SSLKEYLOGFILE");
if (key_log_file_name) {
- FILE *file = fopen(key_log_file_name, "a");
- if (file) {
- if (setvbuf(file, NULL, _IONBF, 0)) {
- fclose(file);
- } else {
- key_log_file = BIO_new_fp(file, BIO_CLOSE);
- }
+ /* Create the unbuffered log with owner-only read/write
permissions. */
+ if (apr_file_open(&key_log_file, key_log_file_name,
+ APR_FOPEN_WRITE | APR_FOPEN_CREATE |
APR_FOPEN_APPEND,
+ APR_FPROT_UREAD | APR_FPROT_UWRITE,
tcn_global_pool) != APR_SUCCESS) {
+ key_log_file = NULL;
}
}
}
+ /*
+ * Register after opening the log so ssl_init_cleanup() closes it before
+ * the file's pool cleanup runs when the library is unloaded.
+ */
+ apr_pool_cleanup_register(tcn_global_pool, NULL,
+ ssl_init_cleanup,
+ apr_pool_cleanup_null);
+
return (jint)APR_SUCCESS;
}
diff --git a/xdocs/miscellaneous/changelog.xml
b/xdocs/miscellaneous/changelog.xml
index 6c5429d92..1e0868896 100644
--- a/xdocs/miscellaneous/changelog.xml
+++ b/xdocs/miscellaneous/changelog.xml
@@ -48,6 +48,10 @@
(whether a self-signed root or a certificate trusted directly via the
configured trust store) is not subject to OCSP checking. (markt)
</fix>
+ <fix>
+ Limit read and write access to a newly created <code>SSLKEYLOGFILE</code>
+ (if any) to the user under which Tomcat Native is running. (markt)
+ </fix>
</changelog>
</section>
<section name="2.0.16" rtext="2026-09-07">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
