This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
The following commit(s) were added to refs/heads/main by this push:
new 5ef82769a Sync Java code with 12.0.x
5ef82769a is described below
commit 5ef82769ab347f62ef678a1714664ef8eae0da3f
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Oct 21 19:53:30 2026 +0100
Sync Java code with 12.0.x
---
java/org/apache/tomcat/jni/SSL.java | 104 ++++++++++++++++++++++++++++++--
java/org/apache/tomcat/jni/SSLConf.java | 2 +-
2 files changed, 100 insertions(+), 6 deletions(-)
diff --git a/java/org/apache/tomcat/jni/SSL.java
b/java/org/apache/tomcat/jni/SSL.java
index 8825e2ea2..9777736e9 100644
--- a/java/org/apache/tomcat/jni/SSL.java
+++ b/java/org/apache/tomcat/jni/SSL.java
@@ -219,12 +219,34 @@ public final class SSL {
* Enable support for Kernel TLS.
*/
public static final long SSL_OP_ENABLE_KTLS = 0x8L;
+ /**
+ * Obsolete option retained for compatibility. This option has no effect
from OpenSSL 4.1 onwards.
+ */
public static final long SSL_OP_TLSEXT_PADDING = 0x10L;
// Unused = 0x20L
+ /**
+ * Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari
on OS X. OS X 10.8..10.8.3 has broken
+ * support for ECDHE-ECDSA ciphers.
+ */
public static final long SSL_OP_SAFARI_ECDHE_ECDSA_BUG = 0x40L;
+ /**
+ * Treat a closed connection as if the close_notify alert was received, so
the peer does not need to send it. This
+ * is only safe to use when the application protocol independently detects
truncation attacks.
+ */
public static final long SSL_OP_IGNORE_UNEXPECTED_EOF = 0x80L;
+ /**
+ * Enable client-initiated renegotiation, which is disabled by default.
+ */
public static final long SSL_OP_ALLOW_CLIENT_RENEGOTIATION = 0x100L;
+ /**
+ * Disable TLS Extension CA Names. You may want to disable it for security
reasons or for compatibility with some
+ * Windows TLS implementations crashing when this extension is larger than
1024 bytes.
+ */
public static final long SSL_OP_DISABLE_TLSEXT_CA_NAMES = 0x200L;
+ /**
+ * In TLSv1.3 allow a non-(ec)dhe based key exchange mode on resumption.
This means that there will be no forward
+ * secrecy for the resumed session.
+ */
public static final long SSL_OP_ALLOW_NO_DHE_KEX = 0x400L;
/**
@@ -309,9 +331,21 @@ public final class SSL {
* Disable TLSv1.1 protocol.
*/
public static final long SSL_OP_NO_TLSv1_1 = 0x10000000L;
+ /**
+ * Disable TLSv1.3 protocol.
+ */
public static final long SSL_OP_NO_TLSv1_3 = 0x20000000L;
+ /**
+ * Disable DTLSv1.0 protocol.
+ */
public static final long SSL_OP_NO_DTLSv1 = SSL_OP_NO_TLSv1;
+ /**
+ * Disable DTLSv1.2 protocol.
+ */
public static final long SSL_OP_NO_DTLSv1_2 = SSL_OP_NO_TLSv1_2;
+ /**
+ * Disable DTLSv1.3 protocol.
+ */
public static final long SSL_OP_NO_DTLSv1_3 = SSL_OP_NO_TLSv1_3;
/**
* Disallow all renegotiation.
@@ -336,7 +370,16 @@ public final class SSL {
* Enable KTLS TX zerocopy on Linux.
*/
public static final long SSL_OP_ENABLE_KTLS_TX_ZEROCOPY_SENDFILE =
0x400000000L;
+ /**
+ * In TLSv1.3, on resumption let the server prefer a non-(ec)dhe based key
exchange mode over an (ec)dhe based one.
+ * Ignored without SSL_OP_ALLOW_NO_DHE_KEX being set as well. Always
ignored on the client.
+ */
public static final long SSL_OP_PREFER_NO_DHE_KEX = 0x800000000L;
+ /**
+ * Enable use of the legacy point formats for elliptic curves. This option
enables support for the deprecated ANSI
+ * X9.62 prime and char2 compressed point formats, in addition to the
uncompressed format that is enabled by
+ * default.
+ */
public static final long SSL_OP_LEGACY_EC_POINT_FORMATS = 0x1000000000L;
/**
@@ -365,10 +408,16 @@ public final class SSL {
/*
* Option "collections."
*/
+ /**
+ * Mask of options that disable all SSL/TLS protocol versions.
+ */
public static final long SSL_OP_NO_SSL_MASK =
SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 |
SSL_OP_NO_TLSv1_2 | SSL_OP_NO_TLSv1_3;
- public static final long SSL_OP_NO_DTLS_MASK = SSL_OP_NO_DTLSv1 |
SSL_OP_NO_DTLSv1_2;
+ /**
+ * Mask of options that disable all DTLS protocol versions.
+ */
+ public static final long SSL_OP_NO_DTLS_MASK = SSL_OP_NO_DTLSv1 |
SSL_OP_NO_DTLSv1_2 | SSL_OP_NO_DTLSv1_3;
/**
* Various bug workarounds that should be rather harmless.
@@ -380,34 +429,79 @@ public final class SSL {
/*
* OBSOLETE OPTIONS retained for compatibility.
*/
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_MICROSOFT_SESS_ID_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_NETSCAPE_CHALLENGE_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_MSIE_SSLV2_RSA_PADDING = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_SSLEAY_080_CLIENT_DH_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_TLS_D5_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_TLS_BLOCK_PADDING_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_SINGLE_ECDH_USE = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_SINGLE_DH_USE = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_EPHEMERAL_RSA = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_NO_SSLv2 = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_NETSCAPE_CA_DN_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG = 0x0;
@@ -913,8 +1007,8 @@ public final class SSL {
* <br>
* The depth actually is the maximum number of intermediate certificate
issuers, i.e. the number of CA certificates
* which are max allowed to be followed while verifying the client
certificate. A depth of 0 means that self-signed
- * client certificates are accepted only, the default depth of 1 means the
client certificate can be self-signed or
- * has to be signed by a CA which is directly known to the server (i.e.
the CA's certificate is under
+ * client certificates are accepted only. A depth of 1 means the client
certificate can be self-signed or has to be
+ * signed by a CA which is directly known to the server (i.e. the CA's
certificate is under
* {@code setCACertificatePath}, etc).
*
* @param ssl the SSL instance (SSL *)
@@ -973,7 +1067,7 @@ public final class SSL {
public static native String[] getCiphers(long ssl);
/**
- * Set the TLSv1.2 and below ciphers available for negotiation the in TLS
handshake.
+ * Set the TLSv1.2 and below ciphers available for negotiation in the TLS
handshake.
* <p>
* This complex directive uses a colon-separated cipher-spec string
consisting of OpenSSL cipher specifications to
* configure the ciphers the client is permitted to negotiate in the TLS
handshake phase.
@@ -988,7 +1082,7 @@ public final class SSL {
public static native boolean setCipherSuites(long ssl, String cipherList)
throws Exception;
/**
- * Set the TLSv1.3 cipher suites available for negotiation the in TLS
handshake.
+ * Set the TLSv1.3 cipher suites available for negotiation in the TLS
handshake.
* <p>
* This uses a colon-separated list of TLSv1.3 cipher suite names in
preference order.
*
diff --git a/java/org/apache/tomcat/jni/SSLConf.java
b/java/org/apache/tomcat/jni/SSLConf.java
index 755416b29..89e170c00 100644
--- a/java/org/apache/tomcat/jni/SSLConf.java
+++ b/java/org/apache/tomcat/jni/SSLConf.java
@@ -124,7 +124,7 @@ public final class SSLConf {
*
* @return The result of the native {@code SSL_CONF_CTX_finish} call
*
- * @see <a
href="https://www.openssl.org/docs/man1.0.2/ssl/SSL_CONF_CTX_set_flags.html";>OpenSSL
+ * @see <a
href="https://www.openssl.org/docs/man1.0.2/ssl/SSL_CONF_CTX_finish.html";>OpenSSL
* SSL_CONF_CTX_finish</a>
*/
public static native int finish(long cctx);
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
