Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package libtcnative-1-0 for openSUSE:Factory
checked in at 2026-10-29 16:11:29
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/libtcnative-1-0 (Old)
and /work/SRC/openSUSE:Factory/.libtcnative-1-0.new.1255 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libtcnative-1-0"
Thu Oct 29 16:11:29 2026 rev:47 rq:1393635 version:1.3.10
Changes:
--------
--- /work/SRC/openSUSE:Factory/libtcnative-1-0/libtcnative-1-0.changes
2026-09-28 10:42:43.586587028 +0200
+++
/work/SRC/openSUSE:Factory/.libtcnative-1-0.new.1255/libtcnative-1-0.changes
2026-10-29 16:13:07.640139252 +0100
@@ -1,0 +2,22 @@
+Thu Oct 29 13:27:49 UTC 2026 - Fridrich Strba <[email protected]>
+
+- Upgrade to 1.3.10
+ * Changes:
+ + Fix: Align the OCSP checking performed by ssl_verify_OCSP()
+ with the behaviour of Tomcat's JSSE based SSLEngine
+ implementation so that a certificate that is itself a trust
+ anchor (whether a self-signed root or a certificate trusted
+ directly via the configured trust store) is not subject to
+ OCSP checking.
+ + Fix: Restore support for OpenSSL 1.1.1 which was accidentally
+ broken in 1.3.8 and then deliberately removed in 1.3.9.
+ + Fix: Limit read and write access to a newly created
+ SSLKEYLOGFILE (if any) to the user under which Tomcat Native
+ is running.
+ + Update the recommended minimum version of OpenSSL to 3.5.9.
+ + Fix: Generate the HTML changelog as UTF-8.
+- Removed patch:
+ * 0001-Bring-back-OpenSSL-1.1.1-support.patch
+ + Integrated in this version
+
+-------------------------------------------------------------------
Old:
----
0001-Bring-back-OpenSSL-1.1.1-support.patch
tomcat-native-1.3.9-src.tar.gz
tomcat-native-1.3.9-src.tar.gz.asc
New:
----
tomcat-native-1.3.10-src.tar.gz
tomcat-native-1.3.10-src.tar.gz.asc
----------(Old B)----------
Old:- Removed patch:
* 0001-Bring-back-OpenSSL-1.1.1-support.patch
+ Integrated in this version
----------(Old E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ libtcnative-1-0.spec ++++++
--- /var/tmp/diff_new_pack.vzyusW/_old 2026-10-29 16:13:08.403171251 +0100
+++ /var/tmp/diff_new_pack.vzyusW/_new 2026-10-29 16:13:08.405171335 +0100
@@ -18,7 +18,7 @@
%{!?make_build:%global make_build make %{?_smp_mflags}}
Name: libtcnative-1-0
-Version: 1.3.9
+Version: 1.3.10
Release: 0
Summary: Tomcat resources for performance, compatibility, etc
License: Apache-2.0
@@ -28,7 +28,6 @@
Source1:
https://www.apache.org/dist/tomcat/tomcat-connectors/native/%{version}/source/tomcat-native-%{version}-src.tar.gz.asc
# https://downloads.apache.org/tomcat/tomcat-connectors/KEYS
Source2: %{name}.keyring
-Patch0: 0001-Bring-back-OpenSSL-1.1.1-support.patch
BuildRequires: fdupes
BuildRequires: java-devel
BuildRequires: javapackages-tools
@@ -94,7 +93,6 @@
%prep
%setup -q -n tomcat-native-%{version}-src
-%patch -P 0 -p1
%build
cd native
++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.vzyusW/_old 2026-10-29 16:13:08.440172803 +0100
+++ /var/tmp/diff_new_pack.vzyusW/_new 2026-10-29 16:13:08.443172929 +0100
@@ -1,6 +1,6 @@
-mtime: 1790319634
-commit: 52c7a530c9636393e568451177e0bda574f83614674200a1020ed56d28077baa
+mtime: 1793281116
+commit: 3eb69137ad0063746f5d3fe28b83c5397a5809bb5dc60eee68fc84aab769bfb9
url: https://src.opensuse.org/java-packages/libtcnative-1-0
-revision: 52c7a530c9636393e568451177e0bda574f83614674200a1020ed56d28077baa
+revision: 3eb69137ad0063746f5d3fe28b83c5397a5809bb5dc60eee68fc84aab769bfb9
projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj
++++++ build.specials.obscpio ++++++
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-10-29 14:38:36.000000000 +0100
@@ -0,0 +1 @@
+.osc
++++++ tomcat-native-1.3.9-src.tar.gz -> tomcat-native-1.3.10-src.tar.gz ++++++
++++ 2664 lines of diff (skipped)
++++ retrying with extended exclude list
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/CHANGELOG.txt
new/tomcat-native-1.3.10-src/CHANGELOG.txt
--- old/tomcat-native-1.3.9-src/CHANGELOG.txt 2026-09-02 15:27:48.000000000
+0200
+++ new/tomcat-native-1.3.10-src/CHANGELOG.txt 2026-10-22 17:50:02.000000000
+0200
@@ -3,7 +3,23 @@
This is the Changelog for Tomcat Native 1.3.x. The Tomcat Native 1.3.x
branch started from the 1.2.39 tag.
- 1.3.9
+ 1.3.10
+
+ * Fix: Align the OCSP checking performed by ssl_verify_OCSP() with the
+ behaviour of Tomcat's JSSE based SSLEngine implementation so that a
+ certificate that is itself a trust anchor (whether a self-signed root
+ or a certificate trusted directly via the configured trust store) is
+ not subject to OCSP checking. (markt)
+ * Fix: Restore support for OpenSSL 1.1.1 which was accidentally broken
+ in 1.3.8 and then deliberately removed in 1.3.9. Based on pull request
+ #46 by Fridrich Strba. (markt)
+ * Fix: Limit read and write access to a newly created SSLKEYLOGFILE (if
+ any) to the user under which Tomcat Native is running. (markt)
+ * Update: Update the recommended minimum version of OpenSSL to 3.5.9.
+ (markt)
+ * Fix: Generate the HTML changelog as UTF-8. (markt)
+
+ 2026-09-07 1.3.9
* Code: Remove call to ERR_remove_thread_state() from Windows specific
code to allow building with OpenSSL 4.0.x. ERR_remove_thread_state()
@@ -170,4 +186,4 @@
Please see the 1.1.x changelog.
- Copyright � 2008-2026, The Apache Software Foundation
+ Copyright © 2008-2026, The Apache Software Foundation
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/HOWTO-RELEASE.txt
new/tomcat-native-1.3.10-src/HOWTO-RELEASE.txt
--- old/tomcat-native-1.3.9-src/HOWTO-RELEASE.txt 2026-09-02
15:26:44.000000000 +0200
+++ new/tomcat-native-1.3.10-src/HOWTO-RELEASE.txt 2026-10-22
17:48:47.000000000 +0200
@@ -32,6 +32,8 @@
Review the open issues in Bugzilla.
Review open PRs in GitHub.
+Check the versions in native/srclib/VERSIONS
+
If you haven't already, add your public PGP key to KEYS.
Ensure dates and/or version numbers are up to date:
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/build.properties.default
new/tomcat-native-1.3.10-src/build.properties.default
--- old/tomcat-native-1.3.9-src/build.properties.default 2026-09-02
15:26:44.000000000 +0200
+++ new/tomcat-native-1.3.10-src/build.properties.default 2026-10-22
17:48:47.000000000 +0200
@@ -18,7 +18,7 @@
# ----- Version Control Flags -----
version.major=1
version.minor=3
-version.build=9
+version.build=10
version.patch=0
version.suffix=
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/docs/index.html
new/tomcat-native-1.3.10-src/docs/index.html
--- old/tomcat-native-1.3.9-src/docs/index.html 2026-09-02 15:27:48.000000000
+0200
+++ new/tomcat-native-1.3.10-src/docs/index.html 2026-10-22
17:50:02.000000000 +0200
@@ -28,10 +28,10 @@
</div><h3 id="Headlines">Headlines</h3><div class="text">
<ul>
-<li><a href="news/2026.html#20260615">15 June 2026 - <b>Tomcat-Native-1.3.8
+<li><a href="news/2026.html#20260907">7 September 2026 - <b>Tomcat-Native-1.3.9
released</b></a>
<p>The Apache Tomcat team is proud to announce the immediate availability of
-Tomcat Native 1.3.8 Stable.</p>
+Tomcat Native 1.3.9 Stable.</p>
<p>
The sources and the binaries for selected platforms are available from the
<a href="../download-native.cgi">Download page</a>.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/docs/miscellaneous/changelog.html
new/tomcat-native-1.3.10-src/docs/miscellaneous/changelog.html
--- old/tomcat-native-1.3.9-src/docs/miscellaneous/changelog.html
2026-09-02 15:27:48.000000000 +0200
+++ new/tomcat-native-1.3.10-src/docs/miscellaneous/changelog.html
2026-10-22 17:50:02.000000000 +0200
@@ -4,7 +4,32 @@
This is the Changelog for Tomcat Native 1.3.x. The Tomcat Native 1.3.x branch
started from the 1.2.39 tag.
</p>
-</div><h3 id="1.3.9"><span style="float: right;"></span> 1.3.9</h3><div
class="text">
+</div><h3 id="1.3.10"><span style="float: right;"></span> 1.3.10</h3><div
class="text">
+ <ul class="changelog">
+ <li><img alt="Fix: " class="icon" src="../images/fix.gif">
+ Align the OCSP checking performed by <code>ssl_verify_OCSP()</code> with
+ the behaviour of Tomcat's JSSE based <code>SSLEngine</code>
+ implementation so that a certificate that is itself a trust anchor
+ (whether a self-signed root or a certificate trusted directly via the
+ configured trust store) is not subject to OCSP checking. (markt)
+ </li>
+ <li><img alt="Fix: " class="icon" src="../images/fix.gif">
+ Restore support for OpenSSL 1.1.1 which was accidentally broken in 1.3.8
+ and then deliberately removed in 1.3.9. Based on pull request <a
href="https://github.com/apache/tomcat-native/pull/46";>#46</a>
+ by Fridrich Strba. (markt)
+ </li>
+ <li><img alt="Fix: " class="icon" src="../images/fix.gif">
+ Limit read and write access to a newly created <code>SSLKEYLOGFILE</code>
+ (if any) to the user under which Tomcat Native is running. (markt)
+ </li>
+ <li><img alt="Update: " class="icon" src="../images/update.gif">
+ Update the recommended minimum version of OpenSSL to 3.5.9. (markt)
+ </li>
+ <li><img alt="Fix: " class="icon" src="../images/fix.gif">
+ Generate the HTML changelog as UTF-8. (markt)
+ </li>
+ </ul>
+</div><h3 id="1.3.9"><span style="float: right;">2026-09-07</span>
1.3.9</h3><div class="text">
<ul class="changelog">
<li><img alt="Code: " class="icon" src="../images/code.gif">
Remove call to ERR_remove_thread_state() from Windows specific code to
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/docs/news/2026.html
new/tomcat-native-1.3.10-src/docs/news/2026.html
--- old/tomcat-native-1.3.9-src/docs/news/2026.html 2026-09-02
15:27:48.000000000 +0200
+++ new/tomcat-native-1.3.10-src/docs/news/2026.html 2026-10-22
17:50:02.000000000 +0200
@@ -1,6 +1,11 @@
<!DOCTYPE html SYSTEM "about:legacy-compat">
<html lang="en"><head><META http-equiv="Content-Type" content="text/html;
charset=UTF-8"><link href="../images/docs-stylesheet.css" rel="stylesheet"
type="text/css"><link href="../images/style.css" rel="stylesheet"
type="text/css"><title>The Apache Tomcat Native Library 1.3 - News - 2026 News
and Status</title></head><body><div id="wrapper"><header><div
id="header"><div><div><div class="logo noPrint"><a
href="https://tomcat.apache.org/";><img alt="Tomcat Home"
src="../images/tomcat.png"></a></div><div style="height: 1px;"></div><div
class="asfLogo noPrint"><a href="http://www.apache.org/"; target="_blank"><img
src="../images/asf-logo.svg" alt="The Apache Software Foundation" style="width:
266px; height: 83px;"></a></div><h1>The Apache Tomcat Native Library 1.3 -
News</h1><div style="height: 1px;"></div><div style="clear:
left;"></div></div></div></div></header><div id="middle"><div><div
id="mainLeft"
class="noprint"><div><nav><div><h2><strong>Links</strong></h2><ul><li><a
href="../ind
ex.html">Docs Home</a></li></ul></div><div><h2><strong>Miscellaneous
Documentation</strong></h2><ul><li><a
href="../miscellaneous/changelog.html">Changelog</a></li><li><a
href="../miscellaneous/tls-renegotiation.html">TLS
renegotiation</a></li></ul></div><div><h2><strong>News</strong></h2><ul><li><a
href="../news/2026.html">2026</a></li><li><a
href="../news/2024.html">2024</a></li></ul></div></nav></div></div><div
id="mainRight"><div id="content"><h2>2026 News and Status</h2><h3
id="2026_News_&_Status">2026 News & Status</h3><div class="text">
+ <div class="subsection"><h4 id="20260907">7 September 2026 -
Tomcat-Native-1.3.9 released</h4><div class="text">
+ <p>The Apache Tomcat team is proud to announce the immediate
+ availability of Tomcat Native 1.3.9.</p>
+ </div></div>
+
<div class="subsection"><h4 id="20260615">15 June 2026 -
Tomcat-Native-1.3.8 released</h4><div class="text">
<p>The Apache Tomcat team is proud to announce the immediate
availability of Tomcat Native 1.3.8.</p>
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/java/org/apache/tomcat/jni/Library.java
new/tomcat-native-1.3.10-src/java/org/apache/tomcat/jni/Library.java
--- old/tomcat-native-1.3.9-src/java/org/apache/tomcat/jni/Library.java
2026-09-02 15:26:44.000000000 +0200
+++ new/tomcat-native-1.3.10-src/java/org/apache/tomcat/jni/Library.java
2026-10-22 17:48:47.000000000 +0200
@@ -309,42 +309,49 @@
APR_PATCH_VERSION = version(0x13);
APR_IS_DEV_VERSION = version(0x14);
- APR_SIZEOF_VOIDP = size(1);
- APR_PATH_MAX = size(2);
- APRMAXHOSTLEN = size(3);
- APR_MAX_IOVEC_SIZE = size(4);
- APR_MAX_SECS_TO_LINGER = size(5);
- APR_MMAP_THRESHOLD = size(6);
- APR_MMAP_LIMIT = size(7);
+ /*
+ * Only try and initialise these with Tomcat Native 1.x. The
necessary methods don't exist with Native 2.x
+ * and neither does the support for the related JNI calls.
+ */
+ if (TCN_MAJOR_VERSION == 1) {
+ APR_SIZEOF_VOIDP = size(1);
+ APR_PATH_MAX = size(2);
+ APRMAXHOSTLEN = size(3);
+ APR_MAX_IOVEC_SIZE = size(4);
+ APR_MAX_SECS_TO_LINGER = size(5);
+ APR_MMAP_THRESHOLD = size(6);
+ APR_MMAP_LIMIT = size(7);
- APR_HAVE_IPV6 = has(0);
- APR_HAS_SHARED_MEMORY = has(1);
- APR_HAS_THREADS = has(2);
- APR_HAS_SENDFILE = has(3);
- APR_HAS_MMAP = has(4);
- APR_HAS_FORK = has(5);
- APR_HAS_RANDOM = has(6);
- APR_HAS_OTHER_CHILD = has(7);
- APR_HAS_DSO = has(8);
- APR_HAS_SO_ACCEPTFILTER = has(9);
- APR_HAS_UNICODE_FS = has(10);
- APR_HAS_PROC_INVOKED = has(11);
- APR_HAS_USER = has(12);
- APR_HAS_LARGE_FILES = has(13);
- APR_HAS_XTHREAD_FILES = has(14);
- APR_HAS_OS_UUID = has(15);
- APR_IS_BIGENDIAN = has(16);
- APR_FILES_AS_SOCKETS = has(17);
- APR_CHARSET_EBCDIC = has(18);
- APR_TCP_NODELAY_INHERITED = has(19);
- APR_O_NONBLOCK_INHERITED = has(20);
- APR_POLLSET_WAKEABLE = has(21);
- APR_HAVE_UNIX = has(22);
- if (APR_MAJOR_VERSION < 1) {
- throw new UnsatisfiedLinkError("Unsupported APR Version (" +
aprVersionString() + ")");
- }
- if (!APR_HAS_THREADS) {
- throw new UnsatisfiedLinkError("Missing threading support from
APR");
+ APR_HAVE_IPV6 = has(0);
+ APR_HAS_SHARED_MEMORY = has(1);
+ APR_HAS_THREADS = has(2);
+ APR_HAS_SENDFILE = has(3);
+ APR_HAS_MMAP = has(4);
+ APR_HAS_FORK = has(5);
+ APR_HAS_RANDOM = has(6);
+ APR_HAS_OTHER_CHILD = has(7);
+ APR_HAS_DSO = has(8);
+ APR_HAS_SO_ACCEPTFILTER = has(9);
+ APR_HAS_UNICODE_FS = has(10);
+ APR_HAS_PROC_INVOKED = has(11);
+ APR_HAS_USER = has(12);
+ APR_HAS_LARGE_FILES = has(13);
+ APR_HAS_XTHREAD_FILES = has(14);
+ APR_HAS_OS_UUID = has(15);
+ APR_IS_BIGENDIAN = has(16);
+ APR_FILES_AS_SOCKETS = has(17);
+ APR_CHARSET_EBCDIC = has(18);
+ APR_TCP_NODELAY_INHERITED = has(19);
+ APR_O_NONBLOCK_INHERITED = has(20);
+ APR_POLLSET_WAKEABLE = has(21);
+ APR_HAVE_UNIX = has(22);
+
+ if (APR_MAJOR_VERSION < 1) {
+ throw new UnsatisfiedLinkError("Unsupported APR Version ("
+ aprVersionString() + ")");
+ }
+ if (!APR_HAS_THREADS) {
+ throw new UnsatisfiedLinkError("Missing threading support
from APR");
+ }
}
}
return initialize();
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/java/org/apache/tomcat/jni/SSL.java
new/tomcat-native-1.3.10-src/java/org/apache/tomcat/jni/SSL.java
--- old/tomcat-native-1.3.9-src/java/org/apache/tomcat/jni/SSL.java
2026-09-02 15:26:44.000000000 +0200
+++ new/tomcat-native-1.3.10-src/java/org/apache/tomcat/jni/SSL.java
2026-10-22 17:48:47.000000000 +0200
@@ -285,12 +285,34 @@
* Enable support for Kernel TLS.
*/
public static final long SSL_OP_ENABLE_KTLS = 0x8L;
+ /**
+ * Obsolete option retained for compatibility. This option has no effect
from OpenSSL 4.1 onwards.
+ */
public static final long SSL_OP_TLSEXT_PADDING = 0x10L;
// Unused = 0x20L
+ /**
+ * Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari
on OS X. OS X 10.8..10.8.3 has broken
+ * support for ECDHE-ECDSA ciphers.
+ */
public static final long SSL_OP_SAFARI_ECDHE_ECDSA_BUG = 0x40L;
+ /**
+ * Treat a closed connection as if the close_notify alert was received, so
the peer does not need to send it. This
+ * is only safe to use when the application protocol independently detects
truncation attacks.
+ */
public static final long SSL_OP_IGNORE_UNEXPECTED_EOF = 0x80L;
+ /**
+ * Enable client-initiated renegotiation, which is disabled by default.
+ */
public static final long SSL_OP_ALLOW_CLIENT_RENEGOTIATION = 0x100L;
+ /**
+ * Disable TLS Extension CA Names. You may want to disable it for security
reasons or for compatibility with some
+ * Windows TLS implementations crashing when this extension is larger than
1024 bytes.
+ */
public static final long SSL_OP_DISABLE_TLSEXT_CA_NAMES = 0x200L;
+ /**
+ * In TLSv1.3 allow a non-(ec)dhe based key exchange mode on resumption.
This means that there will be no forward
+ * secrecy for the resumed session.
+ */
public static final long SSL_OP_ALLOW_NO_DHE_KEX = 0x400L;
/**
@@ -375,9 +397,21 @@
* Disable TLSv1.1 protocol.
*/
public static final long SSL_OP_NO_TLSv1_1 = 0x10000000L;
+ /**
+ * Disable TLSv1.3 protocol.
+ */
public static final long SSL_OP_NO_TLSv1_3 = 0x20000000L;
+ /**
+ * Disable DTLSv1.0 protocol.
+ */
public static final long SSL_OP_NO_DTLSv1 = SSL_OP_NO_TLSv1;
+ /**
+ * Disable DTLSv1.2 protocol.
+ */
public static final long SSL_OP_NO_DTLSv1_2 = SSL_OP_NO_TLSv1_2;
+ /**
+ * Disable DTLSv1.3 protocol.
+ */
public static final long SSL_OP_NO_DTLSv1_3 = SSL_OP_NO_TLSv1_3;
/**
* Disallow all renegotiation.
@@ -402,7 +436,16 @@
* Enable KTLS TX zerocopy on Linux.
*/
public static final long SSL_OP_ENABLE_KTLS_TX_ZEROCOPY_SENDFILE =
0x400000000L;
+ /**
+ * In TLSv1.3, on resumption let the server prefer a non-(ec)dhe based key
exchange mode over an (ec)dhe based one.
+ * Ignored without SSL_OP_ALLOW_NO_DHE_KEX being set as well. Always
ignored on the client.
+ */
public static final long SSL_OP_PREFER_NO_DHE_KEX = 0x800000000L;
+ /**
+ * Enable use of the legacy point formats for elliptic curves. This option
enables support for the deprecated ANSI
+ * X9.62 prime and char2 compressed point formats, in addition to the
uncompressed format that is enabled by
+ * default.
+ */
public static final long SSL_OP_LEGACY_EC_POINT_FORMATS = 0x1000000000L;
/**
@@ -444,10 +487,16 @@
/*
* Option "collections."
*/
+ /**
+ * Mask of options that disable all SSL/TLS protocol versions.
+ */
public static final long SSL_OP_NO_SSL_MASK =
SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 |
SSL_OP_NO_TLSv1_2 | SSL_OP_NO_TLSv1_3;
- public static final long SSL_OP_NO_DTLS_MASK = SSL_OP_NO_DTLSv1 |
SSL_OP_NO_DTLSv1_2;
+ /**
+ * Mask of options that disable all DTLS protocol versions.
+ */
+ public static final long SSL_OP_NO_DTLS_MASK = SSL_OP_NO_DTLSv1 |
SSL_OP_NO_DTLSv1_2 | SSL_OP_NO_DTLSv1_3;
/**
* Various bug workarounds that should be rather harmless.
@@ -459,34 +508,79 @@
/*
* OBSOLETE OPTIONS retained for compatibility.
*/
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_MICROSOFT_SESS_ID_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_NETSCAPE_CHALLENGE_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_MSIE_SSLV2_RSA_PADDING = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_SSLEAY_080_CLIENT_DH_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_TLS_D5_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_TLS_BLOCK_PADDING_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_SINGLE_ECDH_USE = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_SINGLE_DH_USE = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_EPHEMERAL_RSA = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_NO_SSLv2 = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_NETSCAPE_CA_DN_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG = 0x0;
@@ -1480,8 +1574,8 @@
* <br>
* The depth actually is the maximum number of intermediate certificate
issuers, i.e. the number of CA certificates
* which are max allowed to be followed while verifying the client
certificate. A depth of 0 means that self-signed
- * client certificates are accepted only, the default depth of 1 means the
client certificate can be self-signed or
- * has to be signed by a CA which is directly known to the server (i.e.
the CA's certificate is under
+ * client certificates are accepted only. A depth of 1 means the client
certificate can be self-signed or has to be
+ * signed by a CA which is directly known to the server (i.e. the CA's
certificate is under
* {@code setCACertificatePath}, etc).
*
* @param ssl the SSL instance (SSL *)
@@ -1540,7 +1634,7 @@
public static native String[] getCiphers(long ssl);
/**
- * Set the TLSv1.2 and below ciphers available for negotiation the in TLS
handshake.
+ * Set the TLSv1.2 and below ciphers available for negotiation in the TLS
handshake.
* <p>
* This complex directive uses a colon-separated cipher-spec string
consisting of OpenSSL cipher specifications to
* configure the ciphers the client is permitted to negotiate in the TLS
handshake phase.
@@ -1555,7 +1649,7 @@
public static native boolean setCipherSuites(long ssl, String cipherList)
throws Exception;
/**
- * Set the TLSv1.3 cipher suites available for negotiation the in TLS
handshake.
+ * Set the TLSv1.3 cipher suites available for negotiation in the TLS
handshake.
* <p>
* This uses a colon-separated list of TLSv1.3 cipher suite names in
preference order.
*
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/java/org/apache/tomcat/jni/SSLConf.java
new/tomcat-native-1.3.10-src/java/org/apache/tomcat/jni/SSLConf.java
--- old/tomcat-native-1.3.9-src/java/org/apache/tomcat/jni/SSLConf.java
2026-09-02 15:26:44.000000000 +0200
+++ new/tomcat-native-1.3.10-src/java/org/apache/tomcat/jni/SSLConf.java
2026-10-22 17:48:47.000000000 +0200
@@ -124,7 +124,7 @@
*
* @return The result of the native {@code SSL_CONF_CTX_finish} call
*
- * @see <a
href="https://www.openssl.org/docs/man1.0.2/ssl/SSL_CONF_CTX_set_flags.html";>OpenSSL
+ * @see <a
href="https://www.openssl.org/docs/man1.0.2/ssl/SSL_CONF_CTX_finish.html";>OpenSSL
* SSL_CONF_CTX_finish</a>
*/
public static native int finish(long cctx);
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/java/org/apache/tomcat/jni/SSLContext.java
new/tomcat-native-1.3.10-src/java/org/apache/tomcat/jni/SSLContext.java
--- old/tomcat-native-1.3.9-src/java/org/apache/tomcat/jni/SSLContext.java
2026-09-02 15:26:44.000000000 +0200
+++ new/tomcat-native-1.3.10-src/java/org/apache/tomcat/jni/SSLContext.java
2026-10-22 17:48:47.000000000 +0200
@@ -204,7 +204,7 @@
public static native void setQuietShutdown(long ctx, boolean mode);
/**
- * Set the TLSv1.2 and below ciphers available for negotiation the in TLS
handshake.
+ * Set the TLSv1.2 and below ciphers available for negotiation in the TLS
handshake.
* <p>
* This complex directive uses a colon-separated cipher-spec string
consisting of OpenSSL cipher specifications to
* configure the ciphers the client is permitted to negotiate in the TLS
handshake phase.
@@ -219,7 +219,7 @@
public static native boolean setCipherSuite(long ctx, String cipherList)
throws Exception;
/**
- * Set the TLSv1.3 cipher suites available for negotiation the in TLS
handshake.
+ * Set the TLSv1.3 cipher suites available for negotiation in the TLS
handshake.
* <p>
* This uses a colon-separated list of TLSv1.3 cipher suite names in
preference order.
*
@@ -283,7 +283,7 @@
* @param ctx Server or Client context to use.
* @param cert Certificate file.
* @param key Private Key file to use if not in cert.
- * @param password Certificate password. If null and certificate is
encrypted, password prompt will be displayed.
+ * @param password Certificate password. If null and the certificate is
encrypted, loading the certificate will fail.
* @param idx Certificate index SSL_AIDX_RSA or SSL_AIDX_DSA.
*
* @return <code>true</code> if the operation was successful
@@ -339,7 +339,7 @@
* @param ctx Server or Client context to use.
* @param mode The mode to set
*
- * @return the value set
+ * @return the previous mode
*/
public static native long setSessionCacheMode(long ctx, long mode);
@@ -348,7 +348,7 @@
*
* @param ctx Server or Client context to use.
*
- * @return the value set
+ * @return the current mode
*/
public static native long getSessionCacheMode(long ctx);
@@ -731,7 +731,7 @@
public static native void setTmpECDHByCurveName(long ctx, String
curveName) throws Exception;
/**
- * Set the context within which session be reused (server side only)
+ * Set the context within which sessions can be reused (server side only)
* http://www.openssl.org/docs/ssl/SSL_CTX_set_session_id_context.html
*
* @param ctx Server context to use.
@@ -744,7 +744,7 @@
/**
* Set CertificateRaw <br>
- * Use keystore a certificate and key to fill the BIOP
+ * Use a keystore certificate and key to fill the BIO
*
* @param ctx Server or Client context to use.
* @param cert Byte array with the certificate in DER encoding.
@@ -758,7 +758,7 @@
/**
* Add a certificate to the certificate chain. Certs should be added in
order starting with the issuer of the host
* certs and working up the certificate chain to the CA. <br>
- * Use keystore a certificate chain to fill the BIOP
+ * Use a keystore certificate chain to fill the BIO
*
* @param ctx Server or Client context to use.
* @param cert Byte array with the certificate in DER encoding.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/jnirelease.sh
new/tomcat-native-1.3.10-src/jnirelease.sh
--- old/tomcat-native-1.3.9-src/jnirelease.sh 2026-09-02 15:26:44.000000000
+0200
+++ new/tomcat-native-1.3.10-src/jnirelease.sh 2026-10-22 17:48:47.000000000
+0200
@@ -91,9 +91,9 @@
fi
# Check for links, elinks or w3m
-w3m_opts="-dump -cols 80 -t 4 -S -O iso-8859-1 -T text/html"
-elinks_opts="-dump -dump-width 80 -dump-charset iso-8859-1 -no-numbering
-no-references -no-home"
-links_opts="-dump -width 80 -codepage iso-8859-1 -no-g -html-numbered-links 0"
+w3m_opts="-dump -cols 80 -t 4 -S -O utf-8 -T text/html"
+elinks_opts="-dump -dump-width 80 -dump-charset utf-8 -no-numbering
-no-references -no-home"
+links_opts="-dump -width 80 -codepage utf-8 -no-g -html-numbered-links 0"
EXPTOOL=""
EXPOPTS=""
for i in w3m elinks links
@@ -244,7 +244,7 @@
fi
# Remove page navigation data from converted file.
cp -p ../CHANGELOG.txt ../CHANGELOG.txt.tmp
-awk '/Preface/ {o=1} o>0' ../CHANGELOG.txt.tmp > ../CHANGELOG.txt
+LC_ALL=C.UTF-8 awk '/Preface/ {o=1} o>0' ../CHANGELOG.txt.tmp >
../CHANGELOG.txt
rm ../CHANGELOG.txt.tmp
cd "$top"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/native/include/ssl_private.h
new/tomcat-native-1.3.10-src/native/include/ssl_private.h
--- old/tomcat-native-1.3.9-src/native/include/ssl_private.h 2026-09-02
15:26:44.000000000 +0200
+++ new/tomcat-native-1.3.10-src/native/include/ssl_private.h 2026-10-22
17:48:47.000000000 +0200
@@ -48,8 +48,8 @@
#include <openssl/bn.h>
#if OPENSSL_VERSION_NUMBER > 0x2FFFFFFFL && !defined(LIBRESSL_VERSION_NUMBER)
#include <openssl/provider.h>
-#endif
#include <openssl/core_names.h>
+#endif
#ifndef RAND_MAX
#include <limits.h>
@@ -345,10 +345,18 @@
void SSL_BIO_close(BIO *);
void SSL_BIO_doref(BIO *);
DH *SSL_get_dh_params(unsigned keylen);
+#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
+DH *SSL_dh_GetParamFromFile(const char *);
+#else
EVP_PKEY *SSL_dh_GetParamFromFile(const char *);
+#endif
#ifdef HAVE_ECC
+#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
+EC_GROUP *SSL_ec_GetParamFromFile(const char *);
+#else
int SSL_ec_GetParamFromFile(const char *);
#endif
+#endif
DH *SSL_callback_tmp_DH(SSL *, int, int);
void SSL_callback_handshake(const SSL *, int, int);
int SSL_CTX_use_certificate_chain(SSL_CTX *, const char *, int);
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/native/include/tcn_version.h
new/tomcat-native-1.3.10-src/native/include/tcn_version.h
--- old/tomcat-native-1.3.9-src/native/include/tcn_version.h 2026-09-02
15:26:44.000000000 +0200
+++ new/tomcat-native-1.3.10-src/native/include/tcn_version.h 2026-10-22
17:48:47.000000000 +0200
@@ -63,7 +63,7 @@
#define TCN_MINOR_VERSION 3
/** patch level */
-#define TCN_PATCH_VERSION 9
+#define TCN_PATCH_VERSION 10
/**
* This symbol is defined for internal, "development" copies of TCN. This
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/native/os/win32/libtcnative.rc
new/tomcat-native-1.3.10-src/native/os/win32/libtcnative.rc
--- old/tomcat-native-1.3.9-src/native/os/win32/libtcnative.rc 2026-09-02
15:26:44.000000000 +0200
+++ new/tomcat-native-1.3.10-src/native/os/win32/libtcnative.rc 2026-10-22
17:48:47.000000000 +0200
@@ -19,7 +19,7 @@
"See the License for the specific language governing " \
"permissions and limitations under the License."
-#define TCN_VERSION "1.3.9"
+#define TCN_VERSION "1.3.10"
1000 ICON "apache.ico"
1001 DIALOGEX 0, 0, 252, 51
@@ -35,8 +35,8 @@
END
1 VERSIONINFO
- FILEVERSION 1,3,9,0
- PRODUCTVERSION 1,3,9,0
+ FILEVERSION 1,3,10,0
+ PRODUCTVERSION 1,3,10,0
FILEFLAGSMASK 0x3fL
#ifdef _DEBUG
FILEFLAGS 0x1L
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/native/src/ssl.c
new/tomcat-native-1.3.10-src/native/src/ssl.c
--- old/tomcat-native-1.3.9-src/native/src/ssl.c 2026-09-02
15:26:44.000000000 +0200
+++ new/tomcat-native-1.3.10-src/native/src/ssl.c 2026-10-22
17:48:47.000000000 +0200
@@ -29,13 +29,13 @@
tcn_pass_cb_t tcn_password_callback;
-static BIO *key_log_file = NULL;
+static apr_file_t *key_log_file = NULL;
static void ssl_keylog_callback(const SSL *ssl, const char *line)
{
if (key_log_file && line && *line) {
- BIO_puts(key_log_file, line);
- BIO_puts(key_log_file, "\n");
+ apr_file_puts(line, key_log_file);
+ apr_file_puts("\n", key_log_file);
}
}
@@ -234,7 +234,7 @@
/* Openssl v1.1+ handles all termination automatically. */
if (key_log_file) {
- BIO_free(key_log_file);
+ apr_file_close(key_log_file);
key_log_file = NULL;
}
@@ -424,12 +424,6 @@
init_bio_methods();
- /*
- * Let us cleanup the ssl library when the library is unloaded
- */
- apr_pool_cleanup_register(tcn_global_pool, NULL,
- ssl_init_cleanup,
- apr_pool_cleanup_null);
TCN_FREE_CSTRING(engine);
/* Cache the byte[].class for performance reasons */
@@ -443,17 +437,23 @@
if (!key_log_file) {
char *key_log_file_name = getenv("SSLKEYLOGFILE");
if (key_log_file_name) {
- FILE *file = fopen(key_log_file_name, "a");
- if (file) {
- if (setvbuf(file, NULL, _IONBF, 0)) {
- fclose(file);
- } else {
- key_log_file = BIO_new_fp(file, BIO_CLOSE);
- }
+ /* Create the unbuffered log with owner-only read/write
permissions. */
+ if (apr_file_open(&key_log_file, key_log_file_name,
+ APR_FOPEN_WRITE | APR_FOPEN_CREATE |
APR_FOPEN_APPEND,
+ APR_FPROT_UREAD | APR_FPROT_UWRITE,
tcn_global_pool) != APR_SUCCESS) {
+ key_log_file = NULL;
}
}
}
+ /*
+ * Register after opening the log so ssl_init_cleanup() closes it before
+ * the file's pool cleanup runs when the library is unloaded.
+ */
+ apr_pool_cleanup_register(tcn_global_pool, NULL,
+ ssl_init_cleanup,
+ apr_pool_cleanup_null);
+
return (jint)APR_SUCCESS;
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/native/src/sslcontext.c
new/tomcat-native-1.3.10-src/native/src/sslcontext.c
--- old/tomcat-native-1.3.9-src/native/src/sslcontext.c 2026-09-02
15:26:44.000000000 +0200
+++ new/tomcat-native-1.3.10-src/native/src/sslcontext.c 2026-10-22
17:48:47.000000000 +0200
@@ -985,9 +985,19 @@
const char *p;
char err[TCN_OPENSSL_ERROR_STRING_LENGTH];
#ifdef HAVE_ECC
+#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
+ EC_GROUP *ecparams = NULL;
+ int nid;
+ EC_KEY *eckey = NULL;
+#else
int nid;
#endif
+#endif
+#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
+ DH *dhparams;
+#else
EVP_PKEY *evp;
+#endif
UNREFERENCED(o);
TCN_ASSERT(ctx != 0);
@@ -1062,10 +1072,17 @@
*/
/* XXX Does this also work for pkcs12 or only for PEM files?
* If only for PEM files move above to the PEM handling */
+#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
+ if ((idx == 0) && (dhparams = SSL_dh_GetParamFromFile(cert_file))) {
+ SSL_CTX_set_tmp_dh(c->ctx, dhparams);
+ DH_free(dhparams);
+ }
+#else
if ((idx == 0) && (evp = SSL_dh_GetParamFromFile(cert_file))) {
SSL_CTX_set0_tmp_dh_pkey(c->ctx, evp);
EVP_PKEY_free(evp);
}
+#endif
#ifdef HAVE_ECC
/*
@@ -1073,11 +1090,22 @@
*/
/* XXX Does this also work for pkcs12 or only for PEM files?
* If only for PEM files move above to the PEM handling */
+#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
+ if ((ecparams = SSL_ec_GetParamFromFile(cert_file)) &&
+ (nid = EC_GROUP_get_curve_name(ecparams)) &&
+ (eckey = EC_KEY_new_by_curve_name(nid))) {
+ SSL_CTX_set_tmp_ecdh(c->ctx, eckey);
+ }
+ /* OpenSSL assures us that _free() is NULL-safe */
+ EC_KEY_free(eckey);
+ EC_GROUP_free(ecparams);
+#else
nid = SSL_ec_GetParamFromFile(cert_file);
if (nid != NID_undef) {
SSL_CTX_set1_groups(c->ctx, &nid, 1);
}
#endif
+#endif
SSL_CTX_set_dh_auto(c->ctx, 1);
cleanup:
@@ -1667,13 +1695,19 @@
return rv;
}
-#define TICKET_KEYS_SIZE 80
+#define TICKET_KEYS_SIZE_1_1 48
+#define TICKET_KEYS_SIZE_3_0 80
TCN_IMPLEMENT_CALL(void, SSLContext, setSessionTicketKeys)(TCN_STDARGS, jlong
ctx, jbyteArray keys)
{
tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
jbyte* b;
+ int len = (*e)->GetArrayLength(e, keys);
- if ((*e)->GetArrayLength(e, keys) != TICKET_KEYS_SIZE) {
+#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
+ if (len != TICKET_KEYS_SIZE_1_1) {
+#else
+ if (len != TICKET_KEYS_SIZE_3_0) {
+#endif
if (c->bio_os) {
BIO_printf(c->bio_os, "[ERROR] Session ticket keys provided were
wrong size.\n");
}
@@ -1684,7 +1718,7 @@
}
b = (*e)->GetByteArrayElements(e, keys, NULL);
- SSL_CTX_set_tlsext_ticket_keys(c->ctx, b, TICKET_KEYS_SIZE);
+ SSL_CTX_set_tlsext_ticket_keys(c->ctx, b, len);
(*e)->ReleaseByteArrayElements(e, keys, b, 0);
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/native/src/sslutils.c
new/tomcat-native-1.3.10-src/native/src/sslutils.c
--- old/tomcat-native-1.3.9-src/native/src/sslutils.c 2026-09-02
15:26:44.000000000 +0200
+++ new/tomcat-native-1.3.10-src/native/src/sslutils.c 2026-10-22
17:48:47.000000000 +0200
@@ -202,6 +202,19 @@
** Custom (EC)DH parameter support
** _________________________________________________________________
*/
+#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
+DH *SSL_dh_GetParamFromFile(const char *file)
+{
+ DH *dh = NULL;
+ BIO *bio;
+
+ if ((bio = BIO_new_file(file, "r")) == NULL)
+ return NULL;
+ dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
+ BIO_free(bio);
+ return dh;
+}
+#else
EVP_PKEY *SSL_dh_GetParamFromFile(const char *file)
{
EVP_PKEY *evp = NULL;
@@ -217,8 +230,22 @@
}
return evp;
}
+#endif
#ifdef HAVE_ECC
+#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
+EC_GROUP *SSL_ec_GetParamFromFile(const char *file)
+{
+ EC_GROUP *group = NULL;
+ BIO *bio;
+
+ if ((bio = BIO_new_file(file, "r")) == NULL)
+ return NULL;
+ group = PEM_read_bio_ECPKParameters(bio, NULL, NULL, NULL);
+ BIO_free(bio);
+ return (group);
+}
+#else
int SSL_ec_GetParamFromFile(const char *file)
{
EVP_PKEY *evp = NULL;
@@ -256,6 +283,7 @@
return nid; /* Returns the curve's NID, or NID_undef on failure */
}
#endif
+#endif
/*
* Read a file that optionally contains the server certificate in PEM
@@ -546,8 +574,14 @@
* is called if OpenSSL already successfully verified the certificate
* (parameter "ok" in SSL_callback_SSL_verify() must be true).
*/
- else if (X509_check_issued(cert,cert) == X509_V_OK) {
- /* don't do OCSP checking for valid self-issued certs */
+ else if (X509_check_issued(cert,cert) == X509_V_OK
+ || X509_STORE_CTX_get_error_depth(ctx) >=
X509_STORE_CTX_get_num_untrusted(ctx)) {
+ /* Don't do OCSP checking for valid self-issued certs, nor for a
certificate that is itself
+ * a trust anchor (present directly in the configured trust store
rather than supplied by the
+ * peer). A trust anchor is trusted unconditionally, so its own
revocation status is not
+ * checked. This aligns with JSSE's PKIXRevocationChecker, which
excludes the trust anchor
+ * of the certification path from revocation checking regardless of
whether it is self-signed.
+ */
X509_STORE_CTX_set_error(ctx, X509_V_OK);
return OCSP_STATUS_UNKNOWN;
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/native/srclib/VERSIONS
new/tomcat-native-1.3.10-src/native/srclib/VERSIONS
--- old/tomcat-native-1.3.9-src/native/srclib/VERSIONS 2026-09-02
15:26:44.000000000 +0200
+++ new/tomcat-native-1.3.10-src/native/srclib/VERSIONS 2026-10-22
17:48:47.000000000 +0200
@@ -1,11 +1,11 @@
The current minimum versions are:
-- OpenSSL 3.0.0
+- OpenSSL 1.1.1
- APR 1.6.3
The following version of the libraries are recommended:
- APR 1.7.6 or later, http://apr.apache.org
-- OpenSSL 3.5.8 or later, http://www.openssl.org
+- OpenSSL 3.5.9 or later, http://www.openssl.org
Older versions should also work but are not as thoroughly tested by the Tomcat
Native team
@@ -23,6 +23,9 @@
- OpenSSL 3.0.13 in Ubuntu 24.04 LTS (EOL in April 2029)
- OpenSSL 3.5.5 in Ubuntu 26.04 LTS (EOL in April 2031)
+And in SUSE:
+- OpenSSL 1.1.1 in SUSE Linux Enterprise 15 (General support to July 2031)
+
The minimum version of APR is driven by the version of APR used by
downstream distributions.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/native/tcnative.spec
new/tomcat-native-1.3.10-src/native/tcnative.spec
--- old/tomcat-native-1.3.9-src/native/tcnative.spec 2026-09-02
15:27:50.000000000 +0200
+++ new/tomcat-native-1.3.10-src/native/tcnative.spec 2026-10-22
17:50:05.000000000 +0200
@@ -21,7 +21,7 @@
Summary: Tomcat Native Java library
Name: tcnative
-Version: 1.3.9
+Version: 1.3.10
Release: 1
License: Apache Software License
Group: System Environment/Libraries
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/xdocs/index.xml
new/tomcat-native-1.3.10-src/xdocs/index.xml
--- old/tomcat-native-1.3.9-src/xdocs/index.xml 2026-09-02 15:26:44.000000000
+0200
+++ new/tomcat-native-1.3.10-src/xdocs/index.xml 2026-10-22
17:48:47.000000000 +0200
@@ -60,10 +60,10 @@
<section name="Headlines">
<ul>
-<li><a href="news/2026.html#20260615">15 June 2026 - <b>Tomcat-Native-1.3.8
+<li><a href="news/2026.html#20260907">7 September 2026 - <b>Tomcat-Native-1.3.9
released</b></a>
<p>The Apache Tomcat team is proud to announce the immediate availability of
-Tomcat Native 1.3.8 Stable.</p>
+Tomcat Native 1.3.9 Stable.</p>
<p>
The sources and the binaries for selected platforms are available from the
<a href="../download-native.cgi">Download page</a>.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/xdocs/miscellaneous/changelog.xml
new/tomcat-native-1.3.10-src/xdocs/miscellaneous/changelog.xml
--- old/tomcat-native-1.3.9-src/xdocs/miscellaneous/changelog.xml
2026-09-02 15:26:44.000000000 +0200
+++ new/tomcat-native-1.3.10-src/xdocs/miscellaneous/changelog.xml
2026-10-22 17:48:47.000000000 +0200
@@ -31,7 +31,33 @@
started from the 1.2.39 tag.
</p>
</section>
-<section name="1.3.9" rtext="">
+<section name="1.3.10" rtext="">
+ <changelog>
+ <fix>
+ Align the OCSP checking performed by <code>ssl_verify_OCSP()</code> with
+ the behaviour of Tomcat's JSSE based <code>SSLEngine</code>
+ implementation so that a certificate that is itself a trust anchor
+ (whether a self-signed root or a certificate trusted directly via the
+ configured trust store) is not subject to OCSP checking. (markt)
+ </fix>
+ <fix>
+ Restore support for OpenSSL 1.1.1 which was accidentally broken in 1.3.8
+ and then deliberately removed in 1.3.9. Based on pull request <pr>46</pr>
+ by Fridrich Strba. (markt)
+ </fix>
+ <fix>
+ Limit read and write access to a newly created <code>SSLKEYLOGFILE</code>
+ (if any) to the user under which Tomcat Native is running. (markt)
+ </fix>
+ <update>
+ Update the recommended minimum version of OpenSSL to 3.5.9. (markt)
+ </update>
+ <fix>
+ Generate the HTML changelog as UTF-8. (markt)
+ </fix>
+ </changelog>
+</section>
+<section name="1.3.9" rtext="2026-09-07">
<changelog>
<scode>
Remove call to ERR_remove_thread_state() from Windows specific code to
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-1.3.9-src/xdocs/news/2026.xml
new/tomcat-native-1.3.10-src/xdocs/news/2026.xml
--- old/tomcat-native-1.3.9-src/xdocs/news/2026.xml 2026-09-02
15:26:44.000000000 +0200
+++ new/tomcat-native-1.3.10-src/xdocs/news/2026.xml 2026-10-22
17:48:47.000000000 +0200
@@ -30,6 +30,11 @@
<section name="2026 News & Status">
+ <subsection anchor="20260907" name="7 September 2026 -
Tomcat-Native-1.3.9 released">
+ <p>The Apache Tomcat team is proud to announce the immediate
+ availability of Tomcat Native 1.3.9.</p>
+ </subsection>
+
<subsection anchor="20260615" name="15 June 2026 - Tomcat-Native-1.3.8
released">
<p>The Apache Tomcat team is proud to announce the immediate
availability of Tomcat Native 1.3.8.</p>
