This is an automated email from the ASF dual-hosted git repository. markt-asf pushed a commit to branch 1.3.x in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
commit 10bcda977009b0c59dfff9ca20978482f1dbc824 Author: Mark Thomas <[email protected]> AuthorDate: Thu Oct 22 16:18:15 2026 +0100 Update Java code to latest 9.0.x --- java/org/apache/tomcat/jni/Library.java | 77 +++++++++++---------- java/org/apache/tomcat/jni/SSL.java | 104 +++++++++++++++++++++++++++-- java/org/apache/tomcat/jni/SSLConf.java | 2 +- java/org/apache/tomcat/jni/SSLContext.java | 16 ++--- 4 files changed, 150 insertions(+), 49 deletions(-) diff --git a/java/org/apache/tomcat/jni/Library.java b/java/org/apache/tomcat/jni/Library.java index 2944a52b1..80873f965 100644 --- a/java/org/apache/tomcat/jni/Library.java +++ b/java/org/apache/tomcat/jni/Library.java @@ -309,42 +309,49 @@ public final class Library { APR_PATCH_VERSION = version(0x13); APR_IS_DEV_VERSION = version(0x14); - APR_SIZEOF_VOIDP = size(1); - APR_PATH_MAX = size(2); - APRMAXHOSTLEN = size(3); - APR_MAX_IOVEC_SIZE = size(4); - APR_MAX_SECS_TO_LINGER = size(5); - APR_MMAP_THRESHOLD = size(6); - APR_MMAP_LIMIT = size(7); + /* + * Only try and initialise these with Tomcat Native 1.x. The necessary methods don't exist with Native 2.x + * and neither does the support for the related JNI calls. + */ + if (TCN_MAJOR_VERSION == 1) { + APR_SIZEOF_VOIDP = size(1); + APR_PATH_MAX = size(2); + APRMAXHOSTLEN = size(3); + APR_MAX_IOVEC_SIZE = size(4); + APR_MAX_SECS_TO_LINGER = size(5); + APR_MMAP_THRESHOLD = size(6); + APR_MMAP_LIMIT = size(7); - APR_HAVE_IPV6 = has(0); - APR_HAS_SHARED_MEMORY = has(1); - APR_HAS_THREADS = has(2); - APR_HAS_SENDFILE = has(3); - APR_HAS_MMAP = has(4); - APR_HAS_FORK = has(5); - APR_HAS_RANDOM = has(6); - APR_HAS_OTHER_CHILD = has(7); - APR_HAS_DSO = has(8); - APR_HAS_SO_ACCEPTFILTER = has(9); - APR_HAS_UNICODE_FS = has(10); - APR_HAS_PROC_INVOKED = has(11); - APR_HAS_USER = has(12); - APR_HAS_LARGE_FILES = has(13); - APR_HAS_XTHREAD_FILES = has(14); - APR_HAS_OS_UUID = has(15); - APR_IS_BIGENDIAN = has(16); - APR_FILES_AS_SOCKETS = has(17); - APR_CHARSET_EBCDIC = has(18); - APR_TCP_NODELAY_INHERITED = has(19); - APR_O_NONBLOCK_INHERITED = has(20); - APR_POLLSET_WAKEABLE = has(21); - APR_HAVE_UNIX = has(22); - if (APR_MAJOR_VERSION < 1) { - throw new UnsatisfiedLinkError("Unsupported APR Version (" + aprVersionString() + ")"); - } - if (!APR_HAS_THREADS) { - throw new UnsatisfiedLinkError("Missing threading support from APR"); + APR_HAVE_IPV6 = has(0); + APR_HAS_SHARED_MEMORY = has(1); + APR_HAS_THREADS = has(2); + APR_HAS_SENDFILE = has(3); + APR_HAS_MMAP = has(4); + APR_HAS_FORK = has(5); + APR_HAS_RANDOM = has(6); + APR_HAS_OTHER_CHILD = has(7); + APR_HAS_DSO = has(8); + APR_HAS_SO_ACCEPTFILTER = has(9); + APR_HAS_UNICODE_FS = has(10); + APR_HAS_PROC_INVOKED = has(11); + APR_HAS_USER = has(12); + APR_HAS_LARGE_FILES = has(13); + APR_HAS_XTHREAD_FILES = has(14); + APR_HAS_OS_UUID = has(15); + APR_IS_BIGENDIAN = has(16); + APR_FILES_AS_SOCKETS = has(17); + APR_CHARSET_EBCDIC = has(18); + APR_TCP_NODELAY_INHERITED = has(19); + APR_O_NONBLOCK_INHERITED = has(20); + APR_POLLSET_WAKEABLE = has(21); + APR_HAVE_UNIX = has(22); + + if (APR_MAJOR_VERSION < 1) { + throw new UnsatisfiedLinkError("Unsupported APR Version (" + aprVersionString() + ")"); + } + if (!APR_HAS_THREADS) { + throw new UnsatisfiedLinkError("Missing threading support from APR"); + } } } return initialize(); diff --git a/java/org/apache/tomcat/jni/SSL.java b/java/org/apache/tomcat/jni/SSL.java index d866a82d3..85d6267df 100644 --- a/java/org/apache/tomcat/jni/SSL.java +++ b/java/org/apache/tomcat/jni/SSL.java @@ -285,12 +285,34 @@ public final class SSL { * Enable support for Kernel TLS. */ public static final long SSL_OP_ENABLE_KTLS = 0x8L; + /** + * Obsolete option retained for compatibility. This option has no effect from OpenSSL 4.1 onwards. + */ public static final long SSL_OP_TLSEXT_PADDING = 0x10L; // Unused = 0x20L + /** + * Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X. OS X 10.8..10.8.3 has broken + * support for ECDHE-ECDSA ciphers. + */ public static final long SSL_OP_SAFARI_ECDHE_ECDSA_BUG = 0x40L; + /** + * Treat a closed connection as if the close_notify alert was received, so the peer does not need to send it. This + * is only safe to use when the application protocol independently detects truncation attacks. + */ public static final long SSL_OP_IGNORE_UNEXPECTED_EOF = 0x80L; + /** + * Enable client-initiated renegotiation, which is disabled by default. + */ public static final long SSL_OP_ALLOW_CLIENT_RENEGOTIATION = 0x100L; + /** + * Disable TLS Extension CA Names. You may want to disable it for security reasons or for compatibility with some + * Windows TLS implementations crashing when this extension is larger than 1024 bytes. + */ public static final long SSL_OP_DISABLE_TLSEXT_CA_NAMES = 0x200L; + /** + * In TLSv1.3 allow a non-(ec)dhe based key exchange mode on resumption. This means that there will be no forward + * secrecy for the resumed session. + */ public static final long SSL_OP_ALLOW_NO_DHE_KEX = 0x400L; /** @@ -375,9 +397,21 @@ public final class SSL { * Disable TLSv1.1 protocol. */ public static final long SSL_OP_NO_TLSv1_1 = 0x10000000L; + /** + * Disable TLSv1.3 protocol. + */ public static final long SSL_OP_NO_TLSv1_3 = 0x20000000L; + /** + * Disable DTLSv1.0 protocol. + */ public static final long SSL_OP_NO_DTLSv1 = SSL_OP_NO_TLSv1; + /** + * Disable DTLSv1.2 protocol. + */ public static final long SSL_OP_NO_DTLSv1_2 = SSL_OP_NO_TLSv1_2; + /** + * Disable DTLSv1.3 protocol. + */ public static final long SSL_OP_NO_DTLSv1_3 = SSL_OP_NO_TLSv1_3; /** * Disallow all renegotiation. @@ -402,7 +436,16 @@ public final class SSL { * Enable KTLS TX zerocopy on Linux. */ public static final long SSL_OP_ENABLE_KTLS_TX_ZEROCOPY_SENDFILE = 0x400000000L; + /** + * In TLSv1.3, on resumption let the server prefer a non-(ec)dhe based key exchange mode over an (ec)dhe based one. + * Ignored without SSL_OP_ALLOW_NO_DHE_KEX being set as well. Always ignored on the client. + */ public static final long SSL_OP_PREFER_NO_DHE_KEX = 0x800000000L; + /** + * Enable use of the legacy point formats for elliptic curves. This option enables support for the deprecated ANSI + * X9.62 prime and char2 compressed point formats, in addition to the uncompressed format that is enabled by + * default. + */ public static final long SSL_OP_LEGACY_EC_POINT_FORMATS = 0x1000000000L; /** @@ -444,10 +487,16 @@ public final class SSL { /* * Option "collections." */ + /** + * Mask of options that disable all SSL/TLS protocol versions. + */ public static final long SSL_OP_NO_SSL_MASK = SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2 | SSL_OP_NO_TLSv1_3; - public static final long SSL_OP_NO_DTLS_MASK = SSL_OP_NO_DTLSv1 | SSL_OP_NO_DTLSv1_2; + /** + * Mask of options that disable all DTLS protocol versions. + */ + public static final long SSL_OP_NO_DTLS_MASK = SSL_OP_NO_DTLSv1 | SSL_OP_NO_DTLSv1_2 | SSL_OP_NO_DTLSv1_3; /** * Various bug workarounds that should be rather harmless. @@ -459,34 +508,79 @@ public final class SSL { /* * OBSOLETE OPTIONS retained for compatibility. */ + /** + * Obsolete option retained for compatibility. This option no longer has any effect. + */ @Deprecated public static final long SSL_OP_MICROSOFT_SESS_ID_BUG = 0x0; + /** + * Obsolete option retained for compatibility. This option no longer has any effect. + */ @Deprecated public static final long SSL_OP_NETSCAPE_CHALLENGE_BUG = 0x0; + /** + * Obsolete option retained for compatibility. This option no longer has any effect. + */ @Deprecated public static final long SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG = 0x0; + /** + * Obsolete option retained for compatibility. This option no longer has any effect. + */ @Deprecated public static final long SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG = 0x0; + /** + * Obsolete option retained for compatibility. This option no longer has any effect. + */ @Deprecated public static final long SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER = 0x0; + /** + * Obsolete option retained for compatibility. This option no longer has any effect. + */ @Deprecated public static final long SSL_OP_MSIE_SSLV2_RSA_PADDING = 0x0; + /** + * Obsolete option retained for compatibility. This option no longer has any effect. + */ @Deprecated public static final long SSL_OP_SSLEAY_080_CLIENT_DH_BUG = 0x0; + /** + * Obsolete option retained for compatibility. This option no longer has any effect. + */ @Deprecated public static final long SSL_OP_TLS_D5_BUG = 0x0; + /** + * Obsolete option retained for compatibility. This option no longer has any effect. + */ @Deprecated public static final long SSL_OP_TLS_BLOCK_PADDING_BUG = 0x0; + /** + * Obsolete option retained for compatibility. This option no longer has any effect. + */ @Deprecated public static final long SSL_OP_SINGLE_ECDH_USE = 0x0; + /** + * Obsolete option retained for compatibility. This option no longer has any effect. + */ @Deprecated public static final long SSL_OP_SINGLE_DH_USE = 0x0; + /** + * Obsolete option retained for compatibility. This option no longer has any effect. + */ @Deprecated public static final long SSL_OP_EPHEMERAL_RSA = 0x0; + /** + * Obsolete option retained for compatibility. This option no longer has any effect. + */ @Deprecated public static final long SSL_OP_NO_SSLv2 = 0x0; + /** + * Obsolete option retained for compatibility. This option no longer has any effect. + */ @Deprecated public static final long SSL_OP_NETSCAPE_CA_DN_BUG = 0x0; + /** + * Obsolete option retained for compatibility. This option no longer has any effect. + */ @Deprecated public static final long SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG = 0x0; @@ -1480,8 +1574,8 @@ public final class SSL { * <br> * The depth actually is the maximum number of intermediate certificate issuers, i.e. the number of CA certificates * which are max allowed to be followed while verifying the client certificate. A depth of 0 means that self-signed - * client certificates are accepted only, the default depth of 1 means the client certificate can be self-signed or - * has to be signed by a CA which is directly known to the server (i.e. the CA's certificate is under + * client certificates are accepted only. A depth of 1 means the client certificate can be self-signed or has to be + * signed by a CA which is directly known to the server (i.e. the CA's certificate is under * {@code setCACertificatePath}, etc). * * @param ssl the SSL instance (SSL *) @@ -1540,7 +1634,7 @@ public final class SSL { public static native String[] getCiphers(long ssl); /** - * Set the TLSv1.2 and below ciphers available for negotiation the in TLS handshake. + * Set the TLSv1.2 and below ciphers available for negotiation in the TLS handshake. * <p> * This complex directive uses a colon-separated cipher-spec string consisting of OpenSSL cipher specifications to * configure the ciphers the client is permitted to negotiate in the TLS handshake phase. @@ -1555,7 +1649,7 @@ public final class SSL { public static native boolean setCipherSuites(long ssl, String cipherList) throws Exception; /** - * Set the TLSv1.3 cipher suites available for negotiation the in TLS handshake. + * Set the TLSv1.3 cipher suites available for negotiation in the TLS handshake. * <p> * This uses a colon-separated list of TLSv1.3 cipher suite names in preference order. * diff --git a/java/org/apache/tomcat/jni/SSLConf.java b/java/org/apache/tomcat/jni/SSLConf.java index 755416b29..89e170c00 100644 --- a/java/org/apache/tomcat/jni/SSLConf.java +++ b/java/org/apache/tomcat/jni/SSLConf.java @@ -124,7 +124,7 @@ public final class SSLConf { * * @return The result of the native {@code SSL_CONF_CTX_finish} call * - * @see <a href="https://www.openssl.org/docs/man1.0.2/ssl/SSL_CONF_CTX_set_flags.html";>OpenSSL + * @see <a href="https://www.openssl.org/docs/man1.0.2/ssl/SSL_CONF_CTX_finish.html";>OpenSSL * SSL_CONF_CTX_finish</a> */ public static native int finish(long cctx); diff --git a/java/org/apache/tomcat/jni/SSLContext.java b/java/org/apache/tomcat/jni/SSLContext.java index 13fc6e980..df2ff2081 100644 --- a/java/org/apache/tomcat/jni/SSLContext.java +++ b/java/org/apache/tomcat/jni/SSLContext.java @@ -204,7 +204,7 @@ public final class SSLContext { public static native void setQuietShutdown(long ctx, boolean mode); /** - * Set the TLSv1.2 and below ciphers available for negotiation the in TLS handshake. + * Set the TLSv1.2 and below ciphers available for negotiation in the TLS handshake. * <p> * This complex directive uses a colon-separated cipher-spec string consisting of OpenSSL cipher specifications to * configure the ciphers the client is permitted to negotiate in the TLS handshake phase. @@ -219,7 +219,7 @@ public final class SSLContext { public static native boolean setCipherSuite(long ctx, String cipherList) throws Exception; /** - * Set the TLSv1.3 cipher suites available for negotiation the in TLS handshake. + * Set the TLSv1.3 cipher suites available for negotiation in the TLS handshake. * <p> * This uses a colon-separated list of TLSv1.3 cipher suite names in preference order. * @@ -283,7 +283,7 @@ public final class SSLContext { * @param ctx Server or Client context to use. * @param cert Certificate file. * @param key Private Key file to use if not in cert. - * @param password Certificate password. If null and certificate is encrypted, password prompt will be displayed. + * @param password Certificate password. If null and the certificate is encrypted, loading the certificate will fail. * @param idx Certificate index SSL_AIDX_RSA or SSL_AIDX_DSA. * * @return <code>true</code> if the operation was successful @@ -339,7 +339,7 @@ public final class SSLContext { * @param ctx Server or Client context to use. * @param mode The mode to set * - * @return the value set + * @return the previous mode */ public static native long setSessionCacheMode(long ctx, long mode); @@ -348,7 +348,7 @@ public final class SSLContext { * * @param ctx Server or Client context to use. * - * @return the value set + * @return the current mode */ public static native long getSessionCacheMode(long ctx); @@ -731,7 +731,7 @@ public final class SSLContext { public static native void setTmpECDHByCurveName(long ctx, String curveName) throws Exception; /** - * Set the context within which session be reused (server side only) + * Set the context within which sessions can be reused (server side only) * http://www.openssl.org/docs/ssl/SSL_CTX_set_session_id_context.html * * @param ctx Server context to use. @@ -744,7 +744,7 @@ public final class SSLContext { /** * Set CertificateRaw <br> - * Use keystore a certificate and key to fill the BIOP + * Use a keystore certificate and key to fill the BIO * * @param ctx Server or Client context to use. * @param cert Byte array with the certificate in DER encoding. @@ -758,7 +758,7 @@ public final class SSLContext { /** * Add a certificate to the certificate chain. Certs should be added in order starting with the issuer of the host * certs and working up the certificate chain to the CA. <br> - * Use keystore a certificate chain to fill the BIOP + * Use a keystore certificate chain to fill the BIO * * @param ctx Server or Client context to use. * @param cert Byte array with the certificate in DER encoding. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
