This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/10.1.x by this push:
new 721c731e65 Align with recent Native changes to add PSK support
721c731e65 is described below
commit 721c731e65e5eecc045cfe55c4bd47a0f9f2f3cd
Author: Mark Thomas <[email protected]>
AuthorDate: Mon Sep 21 15:07:15 2026 +0100
Align with recent Native changes to add PSK support
Still requires changes in OpenSSLContext for this to be usable.
---
.../apache/tomcat/jni/PreSharedKeySelector.java | 25 ++++++++++++++++++++--
java/org/apache/tomcat/jni/SSLContext.java | 9 ++++++++
2 files changed, 32 insertions(+), 2 deletions(-)
diff --git a/java/org/apache/tomcat/jni/PreSharedKeySelector.java
b/java/org/apache/tomcat/jni/PreSharedKeySelector.java
index 0cafc2a90a..1b4f738f78 100644
--- a/java/org/apache/tomcat/jni/PreSharedKeySelector.java
+++ b/java/org/apache/tomcat/jni/PreSharedKeySelector.java
@@ -17,7 +17,9 @@
package org.apache.tomcat.jni;
/**
- * Is called during a TLSv1.2 handshake and hooked into OpenSSL via {@code
SSL_CTX_set_psk_server_callback}.
+ * The interface for the Tomcat code that responds to the callback from the
OpenSSL layer in Tomcat Native to allow
+ * Tomcat to select a pre-shared key. It supports TLSv1.2 {@code
SSL_CTX_set_psk_server_callback} and TLSv1.3
+ * {@code SSL_CTX_set_psk_find_session_callback}.
*/
public interface PreSharedKeySelector {
@@ -27,7 +29,26 @@ public interface PreSharedKeySelector {
* @param ssl the SSL instance
* @param identity the PSK identity provided by the client
*
- * @return the pre-shared key, or {@code null} if the identity is not
recognized
+ * @return the pre-shared key, or {@code null} if the identity is not
recognized. OpenSSL limits the key to between
+ * 1 and 512 bytes long (inclusive). If the byte sequence is
truly random then 16 bytes are recommended
+ * for 128-bit ciphers and 32 bytes for 256-bit ciphers.
*/
byte[] select(long ssl, String identity);
+
+ /**
+ * Selects the TLSv1.3 pre-shared key and digest for the provided identity.
+ * <p>
+ * The callback is a little more complex for TLSv1.3. The return value is
still the pre-shared key but OpenSSL also
+ * needs to know which digest to use. Because the OpenSSL API only exposes
a cipher for this, that is what Tomcat
+ * populates the {@code cipherSuite} array with but only the digest is
relevant.
+ *
+ * @param ssl the SSL instance
+ * @param identity the PSK identity provided by the client
+ * @param cipherSuite a single-element array that must be populated with a
IANA TLSv1.3 cipher suite identifier
+ *
+ * @return the pre-shared key (strictly the input to the KDF), or {@code
null} if the identity is not recognized.
+ * OpenSSL limits the key to between 1 and 48 bytes long
(inclusive). If the byte sequence is truly
+ * random then 16 bytes are recommended for 128-bit ciphers
and 32 bytes for 256-bit ciphers.
+ */
+ byte[] select(long ssl, byte[] identity, int[] cipherSuite);
}
diff --git a/java/org/apache/tomcat/jni/SSLContext.java
b/java/org/apache/tomcat/jni/SSLContext.java
index 3e0f74a79f..8dfc2de0b2 100644
--- a/java/org/apache/tomcat/jni/SSLContext.java
+++ b/java/org/apache/tomcat/jni/SSLContext.java
@@ -519,6 +519,15 @@ public final class SSLContext {
*/
public static native void setPskServerCallback(long ctx,
PreSharedKeySelector selector);
+ /**
+ * Allow to hook {@link PreSharedKeySelector} into the TLSv1.3 handshake
processing. This will call
+ * {@code SSL_CTX_set_psk_find_session_callback}.
+ *
+ * @param ctx Server context to use.
+ * @param selector the selector to call during handshake, or {@code null}
to remove the current selector
+ */
+ public static native void setPskFindSessionCallback(long ctx,
PreSharedKeySelector selector);
+
/**
* Set application layer protocol for application layer protocol
negotiation extension
*
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
