This is an automated email from the ASF dual-hosted git repository. markt-asf pushed a commit to branch 1.3.x in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
commit 72f682d46dbe954ef782efd6fe38b6b5b47524e6 Author: Mark Thomas <[email protected]> AuthorDate: Wed Oct 21 19:17:02 2026 +0100 Restrict permissions of any created SSLKEYLOGFILE file. Co-authored by: Codex / GPT-6.1-Sol-High (cherry picked from commit ae223f9f74f3f3a7cb89d127f183f5a25e2269a4) --- native/src/ssl.c | 34 +++++++++++++++++----------------- xdocs/miscellaneous/changelog.xml | 4 ++++ 2 files changed, 21 insertions(+), 17 deletions(-) diff --git a/native/src/ssl.c b/native/src/ssl.c index 55301175e..13278b733 100644 --- a/native/src/ssl.c +++ b/native/src/ssl.c @@ -29,13 +29,13 @@ extern apr_pool_t *tcn_global_pool; tcn_pass_cb_t tcn_password_callback; -static BIO *key_log_file = NULL; +static apr_file_t *key_log_file = NULL; static void ssl_keylog_callback(const SSL *ssl, const char *line) { if (key_log_file && line && *line) { - BIO_puts(key_log_file, line); - BIO_puts(key_log_file, "\n"); + apr_file_puts(line, key_log_file); + apr_file_puts("\n", key_log_file); } } @@ -234,7 +234,7 @@ static apr_status_t ssl_init_cleanup(void *data) /* Openssl v1.1+ handles all termination automatically. */ if (key_log_file) { - BIO_free(key_log_file); + apr_file_close(key_log_file); key_log_file = NULL; } @@ -424,12 +424,6 @@ TCN_IMPLEMENT_CALL(jint, SSL, initialize)(TCN_STDARGS, jstring engine) init_bio_methods(); - /* - * Let us cleanup the ssl library when the library is unloaded - */ - apr_pool_cleanup_register(tcn_global_pool, NULL, - ssl_init_cleanup, - apr_pool_cleanup_null); TCN_FREE_CSTRING(engine); /* Cache the byte[].class for performance reasons */ @@ -443,17 +437,23 @@ TCN_IMPLEMENT_CALL(jint, SSL, initialize)(TCN_STDARGS, jstring engine) if (!key_log_file) { char *key_log_file_name = getenv("SSLKEYLOGFILE"); if (key_log_file_name) { - FILE *file = fopen(key_log_file_name, "a"); - if (file) { - if (setvbuf(file, NULL, _IONBF, 0)) { - fclose(file); - } else { - key_log_file = BIO_new_fp(file, BIO_CLOSE); - } + /* Create the unbuffered log with owner-only read/write permissions. */ + if (apr_file_open(&key_log_file, key_log_file_name, + APR_FOPEN_WRITE | APR_FOPEN_CREATE | APR_FOPEN_APPEND, + APR_FPROT_UREAD | APR_FPROT_UWRITE, tcn_global_pool) != APR_SUCCESS) { + key_log_file = NULL; } } } + /* + * Register after opening the log so ssl_init_cleanup() closes it before + * the file's pool cleanup runs when the library is unloaded. + */ + apr_pool_cleanup_register(tcn_global_pool, NULL, + ssl_init_cleanup, + apr_pool_cleanup_null); + return (jint)APR_SUCCESS; } diff --git a/xdocs/miscellaneous/changelog.xml b/xdocs/miscellaneous/changelog.xml index 7d3eddc45..2333044f9 100644 --- a/xdocs/miscellaneous/changelog.xml +++ b/xdocs/miscellaneous/changelog.xml @@ -45,6 +45,10 @@ and then deliberately removed in 1.3.9. Based on pull request <pr>46</pr> by Fridrich Strba. (markt) </fix> + <fix> + Limit read and write access to a newly created <code>SSLKEYLOGFILE</code> + (if any) to the user under which Tomcat Native is running. (markt) + </fix> </changelog> </section> <section name="1.3.9" rtext="2026-09-07"> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
