Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package libtcnative-2-0 for openSUSE:Factory
checked in at 2026-10-29 16:11:29
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/libtcnative-2-0 (Old)
and /work/SRC/openSUSE:Factory/.libtcnative-2-0.new.1255 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libtcnative-2-0"
Thu Oct 29 16:11:29 2026 rev:5 rq:1393634 version:2.0.17
Changes:
--------
--- /work/SRC/openSUSE:Factory/libtcnative-2-0/libtcnative-2-0.changes
2026-09-28 10:43:25.072324324 +0200
+++
/work/SRC/openSUSE:Factory/.libtcnative-2-0.new.1255/libtcnative-2-0.changes
2026-10-29 16:13:06.374086157 +0100
@@ -1,0 +2,20 @@
+Thu Oct 29 13:31:34 UTC 2026 - Fridrich Strba <[email protected]>
+
+- Upgrade to version 2.0.17
+ * Changes
+ + Add: Add support for configuring server-side TLSv1.2 and
+ TLSv1.3 pre-shared key callbacks.
+ + Fix: Align the OCSP checking performed by ssl_verify_OCSP()
+ with the behaviour of Tomcat's JSSE based SSLEngine
+ implementation so that a certificate that is itself a trust
+ anchor (whether a self-signed root or a certificate trusted
+ directly via the configured trust store) is not subject to
+ OCSP checking.
+ + Fix: Limit read and write access to a newly created
+ SSLKEYLOGFILE (if any) to the user under which Tomcat Native
+ is running.
+ + Update: Update the recommended minimum version of OpenSSL to
+ 3.5.9.
+ + Fix: Generate the HTML changelog as UTF-8.
+
+-------------------------------------------------------------------
Old:
----
tomcat-native-2.0.16-src.tar.gz
tomcat-native-2.0.16-src.tar.gz.asc
New:
----
tomcat-native-2.0.17-src.tar.gz
tomcat-native-2.0.17-src.tar.gz.asc
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ libtcnative-2-0.spec ++++++
--- /var/tmp/diff_new_pack.wEPYpo/_old 2026-10-29 16:13:07.148118618 +0100
+++ /var/tmp/diff_new_pack.wEPYpo/_new 2026-10-29 16:13:07.150118702 +0100
@@ -18,7 +18,7 @@
%{!?make_build:%global make_build make %{?_smp_mflags}}
Name: libtcnative-2-0
-Version: 2.0.16
+Version: 2.0.17
Release: 0
Summary: Tomcat resources for performance, compatibility, etc
License: Apache-2.0
++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.wEPYpo/_old 2026-10-29 16:13:07.184120127 +0100
+++ /var/tmp/diff_new_pack.wEPYpo/_new 2026-10-29 16:13:07.187120253 +0100
@@ -1,6 +1,6 @@
-mtime: 1790314819
-commit: fc0eb220e2d5e00e3562e54cea619df33e00a924c2a0e211563b2a330e679f78
+mtime: 1793281035
+commit: 096921866fe455d6b1d82aea96214d75ebfc56695294906dfbbb15139901296b
url: https://src.opensuse.org/java-packages/libtcnative-2-0
-revision: fc0eb220e2d5e00e3562e54cea619df33e00a924c2a0e211563b2a330e679f78
+revision: 096921866fe455d6b1d82aea96214d75ebfc56695294906dfbbb15139901296b
projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj
++++++ build.specials.obscpio ++++++
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-10-29 14:37:15.000000000 +0100
@@ -0,0 +1 @@
+.osc
++++++ tomcat-native-2.0.16-src.tar.gz -> tomcat-native-2.0.17-src.tar.gz ++++++
++++ 9588 lines of diff (skipped)
++++ retrying with extended exclude list
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/CHANGELOG.txt
new/tomcat-native-2.0.17-src/CHANGELOG.txt
--- old/tomcat-native-2.0.16-src/CHANGELOG.txt 2026-09-02 14:58:40.000000000
+0200
+++ new/tomcat-native-2.0.17-src/CHANGELOG.txt 2026-10-22 13:47:42.000000000
+0200
@@ -3,7 +3,24 @@
This is the Changelog for Apache Tomcat Native 2.0.x. The Tomcat Native
2.0.x branch started from the 1.2.33 tag.
- 2.0.16
+ 2.0.17
+
+ * Add: Add support for configuring server-side TLSv1.2 and TLSv1.3
+ pre-shared key callbacks. (markt)
+ * Add: Add support for configuring client-side TLSv1.2 and TLSv1.3
+ pre-shared key callbacks. (markt)
+ * Fix: Align the OCSP checking performed by ssl_verify_OCSP() with the
+ behaviour of Tomcat's JSSE based SSLEngine implementation so that a
+ certificate that is itself a trust anchor (whether a self-signed root
+ or a certificate trusted directly via the configured trust store) is
+ not subject to OCSP checking. (markt)
+ * Fix: Limit read and write access to a newly created SSLKEYLOGFILE (if
+ any) to the user under which Tomcat Native is running. (markt)
+ * Update: Update the recommended minimum version of OpenSSL to 3.5.9.
+ (markt)
+ * Fix: Generate the HTML changelog as UTF-8. (markt)
+
+ 2026-09-07 2.0.16
* Code: Remove call to ERR_remove_thread_state() from Windows specific
code to allow building with OpenSSL 4.0.x. ERR_remove_thread_state()
@@ -247,4 +264,4 @@
Please see the 1.1.x changelog.
- Copyright � 2008-2026, The Apache Software Foundation
+ Copyright © 2008-2026, The Apache Software Foundation
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/HOWTO-RELEASE.txt
new/tomcat-native-2.0.17-src/HOWTO-RELEASE.txt
--- old/tomcat-native-2.0.16-src/HOWTO-RELEASE.txt 2026-09-02
14:56:15.000000000 +0200
+++ new/tomcat-native-2.0.17-src/HOWTO-RELEASE.txt 2026-10-22
13:45:19.000000000 +0200
@@ -32,6 +32,8 @@
Review the open issues in Bugzilla.
Review open PRs in GitHub.
+Check the versions in native/srclib/VERSIONS
+
If you haven't already, add your public PGP key to KEYS.
Ensure dates and/or version numbers are up to date:
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/build.properties.default
new/tomcat-native-2.0.17-src/build.properties.default
--- old/tomcat-native-2.0.16-src/build.properties.default 2026-09-02
14:56:15.000000000 +0200
+++ new/tomcat-native-2.0.17-src/build.properties.default 2026-10-22
13:45:19.000000000 +0200
@@ -18,7 +18,7 @@
# ----- Version Control Flags -----
version.major=2
version.minor=0
-version.build=16
+version.build=17
version.patch=0
version.suffix=
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/docs/index.html
new/tomcat-native-2.0.17-src/docs/index.html
--- old/tomcat-native-2.0.16-src/docs/index.html 2026-09-02
14:58:40.000000000 +0200
+++ new/tomcat-native-2.0.17-src/docs/index.html 2026-10-22
13:47:42.000000000 +0200
@@ -10,10 +10,10 @@
</div><h3 id="Headlines">Headlines</h3><div class="text">
<ul>
-<li><a href="news/2026.html#20260615">15 June 2026 - <b>Tomcat-Native-2.0.15
+<li><a href="news/2026.html#20260907">7 September June 2026 -
<b>Tomcat-Native-2.0.16
released</b></a>
<p>The Apache Tomcat team is proud to announce the immediate availability of
-Tomcat Native 2.0.15 Stable.</p>
+Tomcat Native 2.0.16 Stable.</p>
<p>
The sources and the binaries for selected platforms are available from the
<a href="../download-native.cgi">Download page</a>.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/docs/miscellaneous/changelog.html
new/tomcat-native-2.0.17-src/docs/miscellaneous/changelog.html
--- old/tomcat-native-2.0.16-src/docs/miscellaneous/changelog.html
2026-09-02 14:58:40.000000000 +0200
+++ new/tomcat-native-2.0.17-src/docs/miscellaneous/changelog.html
2026-10-22 13:47:42.000000000 +0200
@@ -4,7 +4,35 @@
This is the Changelog for Apache Tomcat Native 2.0.x. The Tomcat Native 2.0.x
branch started from the 1.2.33 tag.
</p>
-</div><h3 id="2.0.16"><span style="float: right;"></span> 2.0.16</h3><div
class="text">
+</div><h3 id="2.0.17"><span style="float: right;"></span> 2.0.17</h3><div
class="text">
+ <ul class="changelog">
+ <li><img alt="Add: " class="icon" src="../images/add.gif">
+ Add support for configuring server-side TLSv1.2 and TLSv1.3 pre-shared
+ key callbacks. (markt)
+ </li>
+ <li><img alt="Add: " class="icon" src="../images/add.gif">
+ Add support for configuring client-side TLSv1.2 and TLSv1.3 pre-shared
+ key callbacks. (markt)
+ </li>
+ <li><img alt="Fix: " class="icon" src="../images/fix.gif">
+ Align the OCSP checking performed by <code>ssl_verify_OCSP()</code> with
+ the behaviour of Tomcat's JSSE based <code>SSLEngine</code>
+ implementation so that a certificate that is itself a trust anchor
+ (whether a self-signed root or a certificate trusted directly via the
+ configured trust store) is not subject to OCSP checking. (markt)
+ </li>
+ <li><img alt="Fix: " class="icon" src="../images/fix.gif">
+ Limit read and write access to a newly created <code>SSLKEYLOGFILE</code>
+ (if any) to the user under which Tomcat Native is running. (markt)
+ </li>
+ <li><img alt="Update: " class="icon" src="../images/update.gif">
+ Update the recommended minimum version of OpenSSL to 3.5.9. (markt)
+ </li>
+ <li><img alt="Fix: " class="icon" src="../images/fix.gif">
+ Generate the HTML changelog as UTF-8. (markt)
+ </li>
+ </ul>
+</div><h3 id="2.0.16"><span style="float: right;">2026-09-07</span>
2.0.16</h3><div class="text">
<ul class="changelog">
<li><img alt="Code: " class="icon" src="../images/code.gif">
Remove call to ERR_remove_thread_state() from Windows specific code to
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/docs/news/2026.html
new/tomcat-native-2.0.17-src/docs/news/2026.html
--- old/tomcat-native-2.0.16-src/docs/news/2026.html 2026-09-02
14:58:40.000000000 +0200
+++ new/tomcat-native-2.0.17-src/docs/news/2026.html 2026-10-22
13:47:42.000000000 +0200
@@ -1,6 +1,11 @@
<!DOCTYPE html SYSTEM "about:legacy-compat">
<html lang="en"><head><META http-equiv="Content-Type" content="text/html;
charset=UTF-8"><link href="../images/docs-stylesheet.css" rel="stylesheet"
type="text/css"><link href="../images/style.css" rel="stylesheet"
type="text/css"><title>The Apache Tomcat Native Library 2.0 - News - 2026 News
and Status</title></head><body><div id="wrapper"><header><div
id="header"><div><div><div class="logo noPrint"><a
href="https://tomcat.apache.org/";><img alt="Tomcat Home"
src="../images/tomcat.png"></a></div><div style="height: 1px;"></div><div
class="asfLogo noPrint"><a href="http://www.apache.org/"; target="_blank"><img
src="../images/asf-logo.svg" alt="The Apache Software Foundation" style="width:
266px; height: 83px;"></a></div><h1>The Apache Tomcat Native Library 2.0 -
News</h1><div style="height: 1px;"></div><div style="clear:
left;"></div></div></div></div></header><div id="middle"><div><div
id="mainLeft"
class="noprint"><div><nav><div><h2><strong>Links</strong></h2><ul><li><a
href="../ind
ex.html">Docs Home</a></li></ul></div><div><h2><strong>Miscellaneous
Documentation</strong></h2><ul><li><a
href="../miscellaneous/changelog.html">Changelog</a></li><li><a
href="../miscellaneous/tls-renegotiation.html">TLS
renegotiation</a></li></ul></div><div><h2><strong>News</strong></h2><ul><li><a
href="../news/2026.html">2026</a></li><li><a
href="../news/2025.html">2025</a></li><li><a
href="../news/2024.html">2024</a></li><li><a
href="../news/2023.html">2023</a></li><li><a
href="../news/2022.html">2022</a></li></ul></div></nav></div></div><div
id="mainRight"><div id="content"><h2>2026 News and Status</h2><h3
id="2026_News_&_Status">2026 News & Status</h3><div class="text">
+ <div class="subsection"><h4 id="20260907">7 September 2026 -
Tomcat-Native-2.0.16 released</h4><div class="text">
+ <p>The Apache Tomcat team is proud to announce the immediate
+ availability of Tomcat Native 2.0.16.</p>
+ </div></div>
+
<div class="subsection"><h4 id="20260615">15 June 2026 -
Tomcat-Native-2.0.15 released</h4><div class="text">
<p>The Apache Tomcat team is proud to announce the immediate
availability of Tomcat Native 2.0.15.</p>
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/java/org/apache/tomcat/jni/PreSharedKeySelector.java
new/tomcat-native-2.0.17-src/java/org/apache/tomcat/jni/PreSharedKeySelector.java
---
old/tomcat-native-2.0.16-src/java/org/apache/tomcat/jni/PreSharedKeySelector.java
1970-01-01 01:00:00.000000000 +0100
+++
new/tomcat-native-2.0.17-src/java/org/apache/tomcat/jni/PreSharedKeySelector.java
2026-10-22 13:45:19.000000000 +0200
@@ -0,0 +1,78 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.tomcat.jni;
+
+/**
+ * The interface for the Tomcat code that responds to the callback from the
OpenSSL layer in Tomcat Native to allow
+ * Tomcat to select a pre-shared key. It supports server-side TLSv1.2 {@code
SSL_CTX_set_psk_server_callback},
+ * server-side TLSv1.3 {@code SSL_CTX_set_psk_find_session_callback},
client-side TLSv1.2
+ * {@code SSL_CTX_set_psk_client_callback} and client-side
+ * TLSv1.3 {@code SSL_CTX_set_psk_use_session_callback} call-backs.
+ */
+public interface PreSharedKeySelector {
+
+ /**
+ * Selects the TLSv1.2 pre-shared key on the server side given the
provided client identity.
+ *
+ * @param ssl the SSL instance
+ * @param identity the PSK identity provided by the client
+ *
+ * @return the pre-shared key, or {@code null} if the identity is not
recognized. OpenSSL limits the key to between
+ * 1 and 512 bytes long (inclusive). If the byte sequence is
truly random then 16 bytes are recommended
+ * for 128-bit ciphers and 32 bytes for 256-bit ciphers.
+ */
+ byte[] select(long ssl, String identity);
+
+ /**
+ * Selects the TLSv1.3 pre-shared key and digest on the server side given
the provided client identity.
+ * <p>
+ * The callback is a little more complex for TLSv1.3. The return value is
still the pre-shared key but OpenSSL also
+ * needs to know which digest to use. Because the OpenSSL API only exposes
a cipher for this, that is what Tomcat
+ * populates the {@code cipherSuite} array with but only the digest is
relevant.
+ *
+ * @param ssl the SSL instance
+ * @param identity the PSK identity provided by the client
+ * @param cipherSuite a single-element array that must be populated with a
IANA TLSv1.3 cipher suite identifier
+ *
+ * @return the pre-shared key (strictly the input to the KDF), or {@code
null} if the identity is not recognized.
+ * OpenSSL limits the key to between 1 and 48 bytes long
(inclusive). If the byte sequence is truly
+ * random then 16 bytes are recommended for 128-bit ciphers
and 32 bytes for 256-bit ciphers.
+ */
+ byte[] select(long ssl, byte[] identity, int[] cipherSuite);
+
+
+ /**
+ * Selects the TLSv1.2 identity and pre-shared key that the client will
present to a server.
+ *
+ * @param ssl the SSL instance
+ * @param identity a single-element array that must be populated with the
PSK identity
+ *
+ * @return the pre-shared key, or {@code null} if no key is available
+ */
+ byte[] selectClient(long ssl, String[] identity);
+
+ /**
+ * Selects the TLSv1.3 identity, pre-shared key and digest that the client
will present to a server.
+ *
+ * @param ssl the SSL instance
+ * @param identity a single-element array that must be populated with
the PSK identity
+ * @param cipherSuite a single-element array that must be populated with a
IANA TLSv1.3 cipher suite identifier
+ *
+ * @return the pre-shared key (strictly the input to the KDF), or {@code
null} if no key is available
+ */
+ byte[] selectClient(long ssl, String[] identity, int[] cipherSuite);
+}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/java/org/apache/tomcat/jni/SSL.java
new/tomcat-native-2.0.17-src/java/org/apache/tomcat/jni/SSL.java
--- old/tomcat-native-2.0.16-src/java/org/apache/tomcat/jni/SSL.java
2026-09-02 14:56:15.000000000 +0200
+++ new/tomcat-native-2.0.17-src/java/org/apache/tomcat/jni/SSL.java
2026-10-22 13:45:19.000000000 +0200
@@ -219,12 +219,34 @@
* Enable support for Kernel TLS.
*/
public static final long SSL_OP_ENABLE_KTLS = 0x8L;
+ /**
+ * Obsolete option retained for compatibility. This option has no effect
from OpenSSL 4.1 onwards.
+ */
public static final long SSL_OP_TLSEXT_PADDING = 0x10L;
// Unused = 0x20L
+ /**
+ * Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari
on OS X. OS X 10.8..10.8.3 has broken
+ * support for ECDHE-ECDSA ciphers.
+ */
public static final long SSL_OP_SAFARI_ECDHE_ECDSA_BUG = 0x40L;
+ /**
+ * Treat a closed connection as if the close_notify alert was received, so
the peer does not need to send it. This
+ * is only safe to use when the application protocol independently detects
truncation attacks.
+ */
public static final long SSL_OP_IGNORE_UNEXPECTED_EOF = 0x80L;
+ /**
+ * Enable client-initiated renegotiation, which is disabled by default.
+ */
public static final long SSL_OP_ALLOW_CLIENT_RENEGOTIATION = 0x100L;
+ /**
+ * Disable TLS Extension CA Names. You may want to disable it for security
reasons or for compatibility with some
+ * Windows TLS implementations crashing when this extension is larger than
1024 bytes.
+ */
public static final long SSL_OP_DISABLE_TLSEXT_CA_NAMES = 0x200L;
+ /**
+ * In TLSv1.3 allow a non-(ec)dhe based key exchange mode on resumption.
This means that there will be no forward
+ * secrecy for the resumed session.
+ */
public static final long SSL_OP_ALLOW_NO_DHE_KEX = 0x400L;
/**
@@ -309,9 +331,21 @@
* Disable TLSv1.1 protocol.
*/
public static final long SSL_OP_NO_TLSv1_1 = 0x10000000L;
+ /**
+ * Disable TLSv1.3 protocol.
+ */
public static final long SSL_OP_NO_TLSv1_3 = 0x20000000L;
+ /**
+ * Disable DTLSv1.0 protocol.
+ */
public static final long SSL_OP_NO_DTLSv1 = SSL_OP_NO_TLSv1;
+ /**
+ * Disable DTLSv1.2 protocol.
+ */
public static final long SSL_OP_NO_DTLSv1_2 = SSL_OP_NO_TLSv1_2;
+ /**
+ * Disable DTLSv1.3 protocol.
+ */
public static final long SSL_OP_NO_DTLSv1_3 = SSL_OP_NO_TLSv1_3;
/**
* Disallow all renegotiation.
@@ -336,7 +370,16 @@
* Enable KTLS TX zerocopy on Linux.
*/
public static final long SSL_OP_ENABLE_KTLS_TX_ZEROCOPY_SENDFILE =
0x400000000L;
+ /**
+ * In TLSv1.3, on resumption let the server prefer a non-(ec)dhe based key
exchange mode over an (ec)dhe based one.
+ * Ignored without SSL_OP_ALLOW_NO_DHE_KEX being set as well. Always
ignored on the client.
+ */
public static final long SSL_OP_PREFER_NO_DHE_KEX = 0x800000000L;
+ /**
+ * Enable use of the legacy point formats for elliptic curves. This option
enables support for the deprecated ANSI
+ * X9.62 prime and char2 compressed point formats, in addition to the
uncompressed format that is enabled by
+ * default.
+ */
public static final long SSL_OP_LEGACY_EC_POINT_FORMATS = 0x1000000000L;
/**
@@ -365,10 +408,16 @@
/*
* Option "collections."
*/
+ /**
+ * Mask of options that disable all SSL/TLS protocol versions.
+ */
public static final long SSL_OP_NO_SSL_MASK =
SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 |
SSL_OP_NO_TLSv1_2 | SSL_OP_NO_TLSv1_3;
- public static final long SSL_OP_NO_DTLS_MASK = SSL_OP_NO_DTLSv1 |
SSL_OP_NO_DTLSv1_2;
+ /**
+ * Mask of options that disable all DTLS protocol versions.
+ */
+ public static final long SSL_OP_NO_DTLS_MASK = SSL_OP_NO_DTLSv1 |
SSL_OP_NO_DTLSv1_2 | SSL_OP_NO_DTLSv1_3;
/**
* Various bug workarounds that should be rather harmless.
@@ -380,34 +429,79 @@
/*
* OBSOLETE OPTIONS retained for compatibility.
*/
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_MICROSOFT_SESS_ID_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_NETSCAPE_CHALLENGE_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_MSIE_SSLV2_RSA_PADDING = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_SSLEAY_080_CLIENT_DH_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_TLS_D5_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_TLS_BLOCK_PADDING_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_SINGLE_ECDH_USE = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_SINGLE_DH_USE = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_EPHEMERAL_RSA = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_NO_SSLv2 = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_NETSCAPE_CA_DN_BUG = 0x0;
+ /**
+ * Obsolete option retained for compatibility. This option no longer has
any effect.
+ */
@Deprecated
public static final long SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG = 0x0;
@@ -913,8 +1007,8 @@
* <br>
* The depth actually is the maximum number of intermediate certificate
issuers, i.e. the number of CA certificates
* which are max allowed to be followed while verifying the client
certificate. A depth of 0 means that self-signed
- * client certificates are accepted only, the default depth of 1 means the
client certificate can be self-signed or
- * has to be signed by a CA which is directly known to the server (i.e.
the CA's certificate is under
+ * client certificates are accepted only. A depth of 1 means the client
certificate can be self-signed or has to be
+ * signed by a CA which is directly known to the server (i.e. the CA's
certificate is under
* {@code setCACertificatePath}, etc).
*
* @param ssl the SSL instance (SSL *)
@@ -973,7 +1067,7 @@
public static native String[] getCiphers(long ssl);
/**
- * Set the TLSv1.2 and below ciphers available for negotiation the in TLS
handshake.
+ * Set the TLSv1.2 and below ciphers available for negotiation in the TLS
handshake.
* <p>
* This complex directive uses a colon-separated cipher-spec string
consisting of OpenSSL cipher specifications to
* configure the ciphers the client is permitted to negotiate in the TLS
handshake phase.
@@ -988,7 +1082,7 @@
public static native boolean setCipherSuites(long ssl, String cipherList)
throws Exception;
/**
- * Set the TLSv1.3 cipher suites available for negotiation the in TLS
handshake.
+ * Set the TLSv1.3 cipher suites available for negotiation in the TLS
handshake.
* <p>
* This uses a colon-separated list of TLSv1.3 cipher suite names in
preference order.
*
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/java/org/apache/tomcat/jni/SSLConf.java
new/tomcat-native-2.0.17-src/java/org/apache/tomcat/jni/SSLConf.java
--- old/tomcat-native-2.0.16-src/java/org/apache/tomcat/jni/SSLConf.java
2026-09-02 14:56:15.000000000 +0200
+++ new/tomcat-native-2.0.17-src/java/org/apache/tomcat/jni/SSLConf.java
2026-10-22 13:45:19.000000000 +0200
@@ -124,7 +124,7 @@
*
* @return The result of the native {@code SSL_CONF_CTX_finish} call
*
- * @see <a
href="https://www.openssl.org/docs/man1.0.2/ssl/SSL_CONF_CTX_set_flags.html";>OpenSSL
+ * @see <a
href="https://www.openssl.org/docs/man1.0.2/ssl/SSL_CONF_CTX_finish.html";>OpenSSL
* SSL_CONF_CTX_finish</a>
*/
public static native int finish(long cctx);
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/java/org/apache/tomcat/jni/SSLContext.java
new/tomcat-native-2.0.17-src/java/org/apache/tomcat/jni/SSLContext.java
--- old/tomcat-native-2.0.16-src/java/org/apache/tomcat/jni/SSLContext.java
2026-09-02 14:56:15.000000000 +0200
+++ new/tomcat-native-2.0.17-src/java/org/apache/tomcat/jni/SSLContext.java
2026-10-22 13:45:19.000000000 +0200
@@ -472,6 +472,42 @@
public static native void setCertVerifyCallback(long ctx,
CertificateVerifier verifier);
/**
+ * Sets the TLSv1.2 server-side pre-shared key callback to a {@link
PreSharedKeySelector} instance. This will call
+ * {@code SSL_CTX_set_psk_server_callback}.
+ *
+ * @param ctx Server context to use.
+ * @param selector the selector to call during handshake, or {@code null}
to remove the current selector
+ */
+ public static native void setPskServerCallback(long ctx,
PreSharedKeySelector selector);
+
+ /**
+ * Sets the TLSv1.3 server-side pre-shared key callback to a {@link
PreSharedKeySelector} instance. This will call
+ * {@code SSL_CTX_set_psk_find_session_callback}.
+ *
+ * @param ctx Server context to use.
+ * @param selector the selector to call during handshake, or {@code null}
to remove the current selector
+ */
+ public static native void setPskFindSessionCallback(long ctx,
PreSharedKeySelector selector);
+
+ /**
+ * Sets the TLSv1.2 client-side pre-shared key callback to a {@link
PreSharedKeySelector} instance. This will call
+ * {@code SSL_CTX_set_psk_client_callback}.
+ *
+ * @param ctx Client context to use
+ * @param selector pre-shared key selector
+ */
+ public static native void setPskClientCallback(long ctx,
PreSharedKeySelector selector);
+
+ /**
+ * Sets the TLSv1.3 client-side pre-shared key callback to a {@link
PreSharedKeySelector} instance. This will call
+ * {@code SSL_CTX_set_psk_use_session_callback}.
+ *
+ * @param ctx Client context to use
+ * @param selector pre-shared key selector
+ */
+ public static native void setPskUseSessionCallback(long ctx,
PreSharedKeySelector selector);
+
+ /**
* Set application layer protocol for application layer protocol
negotiation extension
*
* @param ctx Server context to use.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/jnirelease.sh
new/tomcat-native-2.0.17-src/jnirelease.sh
--- old/tomcat-native-2.0.16-src/jnirelease.sh 2026-09-02 14:56:15.000000000
+0200
+++ new/tomcat-native-2.0.17-src/jnirelease.sh 2026-10-22 13:45:19.000000000
+0200
@@ -91,9 +91,9 @@
fi
# Check for links, elinks or w3m
-w3m_opts="-dump -cols 80 -t 4 -S -O iso-8859-1 -T text/html"
-elinks_opts="-dump -dump-width 80 -dump-charset iso-8859-1 -no-numbering
-no-references -no-home"
-links_opts="-dump -width 80 -codepage iso-8859-1 -no-g -html-numbered-links 0"
+w3m_opts="-dump -cols 80 -t 4 -S -O utf-8 -T text/html"
+elinks_opts="-dump -dump-width 80 -dump-charset utf-8 -no-numbering
-no-references -no-home"
+links_opts="-dump -width 80 -codepage utf-8 -no-g -html-numbered-links 0"
EXPTOOL=""
EXPOPTS=""
for i in w3m elinks links
@@ -244,7 +244,7 @@
fi
# Remove page navigation data from converted file.
cp -p ../CHANGELOG.txt ../CHANGELOG.txt.tmp
-awk '/Preface/ {o=1} o>0' ../CHANGELOG.txt.tmp > ../CHANGELOG.txt
+LC_ALL=C.UTF-8 awk '/Preface/ {o=1} o>0' ../CHANGELOG.txt.tmp >
../CHANGELOG.txt
rm ../CHANGELOG.txt.tmp
cd "$top"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/native/BUILDING
new/tomcat-native-2.0.17-src/native/BUILDING
--- old/tomcat-native-2.0.16-src/native/BUILDING 2026-09-02
14:56:15.000000000 +0200
+++ new/tomcat-native-2.0.17-src/native/BUILDING 2026-10-22
13:45:19.000000000 +0200
@@ -36,10 +36,10 @@
3. Build
- > configure --with-apr=apr_install_location
--with-ssl=openssl_install_location
+ > ./configure --with-apr=apr_install_location
--with-ssl=openssl_install_location --with-java-home=java_home
> make
- This should produce a file named libtcnative-2.so
+ This should produce files in .libs/ named libtcnative-2.so or
libtcnative-2.dylib, etc.
Linux / Unix / OSX (static linking)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/native/include/ssl_private.h
new/tomcat-native-2.0.17-src/native/include/ssl_private.h
--- old/tomcat-native-2.0.16-src/native/include/ssl_private.h 2026-09-02
14:56:15.000000000 +0200
+++ new/tomcat-native-2.0.17-src/native/include/ssl_private.h 2026-10-22
13:45:19.000000000 +0200
@@ -17,6 +17,9 @@
#ifndef SSL_PRIVATE_H
#define SSL_PRIVATE_H
+#include "apr_hash.h"
+#include "apr_thread_mutex.h"
+
/* Exclude unused OpenSSL features
* even if the OpenSSL supports them
*/
@@ -195,6 +198,24 @@
jobject verifier;
jmethodID verifier_method;
+ /* TLSv1.2 server-side pre-shared key selector */
+ jobject psk_selector;
+ jmethodID psk_selector_method;
+
+ /* TLSv1.3 server-side pre-shared key selector */
+ jobject psk_find_session_selector;
+ jmethodID psk_find_session_selector_method;
+
+ /* TLSv1.2 client-side pre-shared key selector */
+ jobject psk_client_selector;
+ jmethodID psk_client_selector_method;
+
+ /* TLSv1.3 client-side pre-shared key selector */
+ jobject psk_use_session_selector;
+ jmethodID psk_use_session_selector_method;
+ apr_hash_t *psk_use_session_identities;
+ apr_thread_mutex_t *psk_use_session_identities_lock;
+
/* Holds the alpn protocols, each of them prefixed with the len of the
protocol */
unsigned char *alpn_proto_data;
unsigned int alpn_proto_len;
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/native/include/tcn_version.h
new/tomcat-native-2.0.17-src/native/include/tcn_version.h
--- old/tomcat-native-2.0.16-src/native/include/tcn_version.h 2026-09-02
14:56:15.000000000 +0200
+++ new/tomcat-native-2.0.17-src/native/include/tcn_version.h 2026-10-22
13:45:19.000000000 +0200
@@ -63,7 +63,7 @@
#define TCN_MINOR_VERSION 0
/** patch level */
-#define TCN_PATCH_VERSION 16
+#define TCN_PATCH_VERSION 17
/**
* This symbol is defined for internal, "development" copies of TCN. This
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/native/os/win32/libtcnative.rc
new/tomcat-native-2.0.17-src/native/os/win32/libtcnative.rc
--- old/tomcat-native-2.0.16-src/native/os/win32/libtcnative.rc 2026-09-02
14:56:15.000000000 +0200
+++ new/tomcat-native-2.0.17-src/native/os/win32/libtcnative.rc 2026-10-22
13:45:19.000000000 +0200
@@ -19,7 +19,7 @@
"See the License for the specific language governing " \
"permissions and limitations under the License."
-#define TCN_VERSION "2.0.16"
+#define TCN_VERSION "2.0.17"
1000 ICON "apache.ico"
1001 DIALOGEX 0, 0, 252, 51
@@ -35,8 +35,8 @@
END
1 VERSIONINFO
- FILEVERSION 2,0,16,0
- PRODUCTVERSION 2,0,16,0
+ FILEVERSION 2,0,17,0
+ PRODUCTVERSION 2,0,17,0
FILEFLAGSMASK 0x3fL
#ifdef _DEBUG
FILEFLAGS 0x1L
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/native/src/ssl.c
new/tomcat-native-2.0.17-src/native/src/ssl.c
--- old/tomcat-native-2.0.16-src/native/src/ssl.c 2026-09-02
14:56:15.000000000 +0200
+++ new/tomcat-native-2.0.17-src/native/src/ssl.c 2026-10-22
13:45:19.000000000 +0200
@@ -28,13 +28,13 @@
tcn_pass_cb_t tcn_password_callback;
-static BIO *key_log_file = NULL;
+static apr_file_t *key_log_file = NULL;
static void ssl_keylog_callback(const SSL *ssl, const char *line)
{
if (key_log_file && line && *line) {
- BIO_puts(key_log_file, line);
- BIO_puts(key_log_file, "\n");
+ apr_file_puts(line, key_log_file);
+ apr_file_puts("\n", key_log_file);
}
}
@@ -75,7 +75,7 @@
/* Openssl v1.1+ handles all termination automatically. */
if (key_log_file) {
- BIO_free(key_log_file);
+ apr_file_close(key_log_file);
key_log_file = NULL;
}
@@ -195,13 +195,6 @@
/* For SSL_get_app_data2(), SSL_get_app_data3() and SSL_get_app_data4() at
request time */
SSL_init_app_data_idx();
- /*
- * Let us cleanup the ssl library when the library is unloaded
- */
- apr_pool_cleanup_register(tcn_global_pool, NULL,
- ssl_init_cleanup,
- apr_pool_cleanup_null);
-
/* Cache the byte[].class for performance reasons */
clazz = (*e)->FindClass(e, "[B");
byteArrayClass = (jclass) (*e)->NewGlobalRef(e, clazz);
@@ -213,17 +206,23 @@
if (!key_log_file) {
char *key_log_file_name = getenv("SSLKEYLOGFILE");
if (key_log_file_name) {
- FILE *file = fopen(key_log_file_name, "a");
- if (file) {
- if (setvbuf(file, NULL, _IONBF, 0)) {
- fclose(file);
- } else {
- key_log_file = BIO_new_fp(file, BIO_CLOSE);
- }
+ /* Create the unbuffered log with owner-only read/write
permissions. */
+ if (apr_file_open(&key_log_file, key_log_file_name,
+ APR_FOPEN_WRITE | APR_FOPEN_CREATE |
APR_FOPEN_APPEND,
+ APR_FPROT_UREAD | APR_FPROT_UWRITE,
tcn_global_pool) != APR_SUCCESS) {
+ key_log_file = NULL;
}
}
}
+ /*
+ * Register after opening the log so ssl_init_cleanup() closes it before
+ * the file's pool cleanup runs when the library is unloaded.
+ */
+ apr_pool_cleanup_register(tcn_global_pool, NULL,
+ ssl_init_cleanup,
+ apr_pool_cleanup_null);
+
return (jint)APR_SUCCESS;
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/native/src/sslcontext.c
new/tomcat-native-2.0.17-src/native/src/sslcontext.c
--- old/tomcat-native-2.0.16-src/native/src/sslcontext.c 2026-09-02
14:56:15.000000000 +0200
+++ new/tomcat-native-2.0.17-src/native/src/sslcontext.c 2026-10-22
13:45:19.000000000 +0200
@@ -21,6 +21,7 @@
#include "apr_file_io.h"
#include "apr_thread_mutex.h"
+#include "apr_hash.h"
#include "apr_poll.h"
#include "apr_pools.h"
@@ -61,6 +62,38 @@
}
c->verifier_method = NULL;
+ if (c->psk_selector) {
+ JNIEnv *e;
+ tcn_get_java_env(&e);
+ (*e)->DeleteGlobalRef(e, c->psk_selector);
+ c->psk_selector = NULL;
+ }
+ c->psk_selector_method = NULL;
+
+ if (c->psk_client_selector) {
+ JNIEnv *e;
+ tcn_get_java_env(&e);
+ (*e)->DeleteGlobalRef(e, c->psk_client_selector);
+ c->psk_client_selector = NULL;
+ }
+ c->psk_client_selector_method = NULL;
+
+ if (c->psk_use_session_selector) {
+ JNIEnv *e;
+ tcn_get_java_env(&e);
+ (*e)->DeleteGlobalRef(e, c->psk_use_session_selector);
+ c->psk_use_session_selector = NULL;
+ }
+ c->psk_use_session_selector_method = NULL;
+
+ if (c->psk_find_session_selector) {
+ JNIEnv *e;
+ tcn_get_java_env(&e);
+ (*e)->DeleteGlobalRef(e, c->psk_find_session_selector);
+ c->psk_find_session_selector = NULL;
+ }
+ c->psk_find_session_selector_method = NULL;
+
if (c->alpn_proto_data) {
free(c->alpn_proto_data);
c->alpn_proto_data = NULL;
@@ -1482,6 +1515,536 @@
}
}
+#ifndef OPENSSL_NO_PSK
+static unsigned int SSL_psk_server(SSL *ssl, const char *identity, unsigned
char *psk, unsigned int max_psk_len)
+{
+ tcn_ssl_ctxt_t *c = SSL_get_app_data2(ssl);
+ JNIEnv *e;
+ jstring identity_string = NULL;
+ jbyteArray key = NULL;
+ jsize key_len;
+ unsigned int result = 0;
+
+ if (c == NULL || c->psk_selector == NULL || c->psk_selector_method == NULL
|| identity == NULL ||
+ tcn_get_java_env(&e) != JNI_OK) {
+ return 0;
+ }
+
+ identity_string = (*e)->NewStringUTF(e, identity);
+ if (identity_string == NULL) {
+ goto cleanup;
+ }
+
+ key = (*e)->CallObjectMethod(e, c->psk_selector, c->psk_selector_method,
P2J(ssl), identity_string);
+ if ((*e)->ExceptionCheck(e) || key == NULL) {
+ goto cleanup;
+ }
+
+ key_len = (*e)->GetArrayLength(e, key);
+ if (key_len <= 0 || (unsigned int) key_len > max_psk_len) {
+ goto cleanup;
+ }
+
+ (*e)->GetByteArrayRegion(e, key, 0, key_len, (jbyte *)psk);
+ if ((*e)->ExceptionCheck(e)) {
+ goto cleanup;
+ }
+ result = (unsigned int) key_len;
+
+cleanup:
+ if ((*e)->ExceptionCheck(e)) {
+ (*e)->ExceptionClear(e);
+ }
+ if (key != NULL) {
+ (*e)->DeleteLocalRef(e, key);
+ }
+ if (identity_string != NULL) {
+ (*e)->DeleteLocalRef(e, identity_string);
+ }
+ return result;
+}
+#endif
+
+#ifndef OPENSSL_NO_PSK
+static unsigned int SSL_psk_client(SSL *ssl, const char *hint, char *identity,
unsigned int max_identity_len,
+ unsigned char *psk, unsigned int
max_psk_len)
+{
+ tcn_ssl_ctxt_t *c = SSL_get_app_data2(ssl);
+ JNIEnv *e;
+ jobjectArray identity_array = NULL;
+ jstring identity_string = NULL;
+ jbyteArray key = NULL;
+ const char *identity_utf = NULL;
+ jsize key_len;
+ size_t identity_len;
+ unsigned int result = 0;
+
+ UNREFERENCED(hint);
+ if (c == NULL || c->psk_client_selector == NULL ||
c->psk_client_selector_method == NULL ||
+ tcn_get_java_env(&e) != JNI_OK) {
+ return 0;
+ }
+
+ identity_array = (*e)->NewObjectArray(e, 1, (*e)->FindClass(e,
"java/lang/String"), NULL);
+ if (identity_array == NULL) {
+ goto cleanup;
+ }
+ key = (*e)->CallObjectMethod(e, c->psk_client_selector,
c->psk_client_selector_method, P2J(ssl), identity_array);
+ if ((*e)->ExceptionCheck(e) || key == NULL) {
+ goto cleanup;
+ }
+ identity_string = (*e)->GetObjectArrayElement(e, identity_array, 0);
+ if (identity_string == NULL) {
+ goto cleanup;
+ }
+ identity_utf = (*e)->GetStringUTFChars(e, identity_string, NULL);
+ if (identity_utf == NULL) {
+ goto cleanup;
+ }
+ identity_len = strlen(identity_utf);
+ key_len = (*e)->GetArrayLength(e, key);
+ if (identity_len + 1 > max_identity_len || key_len <= 0 || (unsigned int)
key_len > max_psk_len) {
+ goto cleanup;
+ }
+ memcpy(identity, identity_utf, identity_len + 1);
+ (*e)->GetByteArrayRegion(e, key, 0, key_len, (jbyte *)psk);
+ if (!(*e)->ExceptionCheck(e)) {
+ result = (unsigned int) key_len;
+ }
+
+cleanup:
+ if (identity_utf != NULL) {
+ (*e)->ReleaseStringUTFChars(e, identity_string, identity_utf);
+ }
+ if ((*e)->ExceptionCheck(e)) {
+ (*e)->ExceptionClear(e);
+ }
+ if (key != NULL) {
+ (*e)->DeleteLocalRef(e, key);
+ }
+ if (identity_string != NULL) {
+ (*e)->DeleteLocalRef(e, identity_string);
+ }
+ if (identity_array != NULL) {
+ (*e)->DeleteLocalRef(e, identity_array);
+ }
+ return result;
+}
+#endif
+
+TCN_IMPLEMENT_CALL(void, SSLContext, setPskClientCallback)(TCN_STDARGS, jlong
ctx, jobject selector)
+{
+#ifdef OPENSSL_NO_PSK
+ UNREFERENCED(o);
+ UNREFERENCED(ctx);
+ UNREFERENCED(selector);
+ tcn_Throw(e, "OpenSSL does not support PSK");
+#else
+ tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
+ jobject new_selector = NULL;
+ jmethodID new_method = NULL;
+
+ UNREFERENCED(o);
+ TCN_ASSERT(ctx != 0);
+
+ if (selector != NULL) {
+ jclass selector_class = (*e)->GetObjectClass(e, selector);
+ new_method = (*e)->GetMethodID(e, selector_class, "selectClient",
"(J[Ljava/lang/String;)[B");
+ (*e)->DeleteLocalRef(e, selector_class);
+ if (new_method == NULL) {
+ return;
+ }
+ new_selector = (*e)->NewGlobalRef(e, selector);
+ if (new_selector == NULL) {
+ return;
+ }
+ }
+ SSL_CTX_set_psk_client_callback(c->ctx, selector == NULL ? NULL :
SSL_psk_client);
+ if (c->psk_client_selector != NULL) {
+ (*e)->DeleteGlobalRef(e, c->psk_client_selector);
+ }
+ c->psk_client_selector = new_selector;
+ c->psk_client_selector_method = new_method;
+#endif
+}
+
+#if defined(HAVE_TLSV1_3) && !defined(LIBRESSL_VERSION_NUMBER)
+/*
+ * Tomcat always configures SSL_CTX_set_session_id_context() with this value
(see
+ * org.apache.tomcat.jni.SSLContext.DEFAULT_SESSION_ID_CONTEXT). A synthetic
SSL_SESSION built by the TLSv1.3 PSK
+ * callbacks must carry a matching id context, otherwise OpenSSL rejects it
internally with
+ * SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT ("attempt to reuse
session in different context").
+ */
+static const unsigned char TCN_PSK_SESSION_ID_CONTEXT[] = { 'd', 'e', 'f',
'a', 'u', 'l', 't' };
+
+static int SSL_psk_use_session(SSL *ssl, const EVP_MD *md, const unsigned char
**identity, size_t *identity_len,
+ SSL_SESSION **sess)
+{
+ tcn_ssl_ctxt_t *c = SSL_get_app_data2(ssl);
+ JNIEnv *e;
+ jobjectArray identity_array = NULL;
+ jstring identity_string = NULL;
+ const char *identity_utf = NULL;
+ jintArray cipher_suite_array = NULL;
+ jbyteArray key = NULL;
+ jint cipher_suite;
+ jsize key_len = 0;
+ unsigned char cipher_id[2];
+ unsigned char *key_data = NULL;
+ const unsigned char *cached_identity = NULL;
+ const SSL_CIPHER *cipher;
+ const EVP_MD *cipher_md;
+ SSL_SESSION *session = NULL;
+ int result = 0;
+
+ *identity = NULL;
+ *identity_len = 0;
+ *sess = NULL;
+ if (c == NULL || c->psk_use_session_selector == NULL ||
c->psk_use_session_selector_method == NULL ||
+ tcn_get_java_env(&e) != JNI_OK) {
+ return 0;
+ }
+
+ identity_array = (*e)->NewObjectArray(e, 1, stringClass, NULL);
+ cipher_suite_array = (*e)->NewIntArray(e, 1);
+ if (identity_array == NULL || cipher_suite_array == NULL) {
+ goto cleanup;
+ }
+
+ key = (*e)->CallObjectMethod(e, c->psk_use_session_selector,
c->psk_use_session_selector_method, P2J(ssl),
+ identity_array, cipher_suite_array);
+ if ((*e)->ExceptionCheck(e)) {
+ goto cleanup;
+ }
+ if (key == NULL) {
+ result = 1;
+ goto cleanup;
+ }
+
+ identity_string = (*e)->GetObjectArrayElement(e, identity_array, 0);
+ if (identity_string == NULL) {
+ goto cleanup;
+ }
+ identity_utf = (*e)->GetStringUTFChars(e, identity_string, NULL);
+ if (identity_utf == NULL) {
+ goto cleanup;
+ }
+ *identity_len = strlen(identity_utf);
+
+ (*e)->GetIntArrayRegion(e, cipher_suite_array, 0, 1, &cipher_suite);
+ if ((*e)->ExceptionCheck(e) || cipher_suite <= 0 || cipher_suite > 0xffff)
{
+ goto cleanup;
+ }
+ cipher_id[0] = (unsigned char)(cipher_suite >> 8);
+ cipher_id[1] = (unsigned char)cipher_suite;
+ cipher = SSL_CIPHER_find(ssl, cipher_id);
+ if (cipher == NULL || strcmp(SSL_CIPHER_get_version(cipher), "TLSv1.3") !=
0) {
+ goto cleanup;
+ }
+ cipher_md = SSL_CIPHER_get_handshake_digest(cipher);
+ if (md != NULL && (cipher_md == NULL || EVP_MD_type(md) !=
EVP_MD_type(cipher_md))) {
+ goto cleanup;
+ }
+
+ key_len = (*e)->GetArrayLength(e, key);
+ if (key_len <= 0) {
+ goto cleanup;
+ }
+ key_data = OPENSSL_malloc((size_t)key_len);
+ if (key_data == NULL) {
+ goto cleanup;
+ }
+ (*e)->GetByteArrayRegion(e, key, 0, key_len, (jbyte *)key_data);
+ if ((*e)->ExceptionCheck(e)) {
+ goto cleanup;
+ }
+
+ session = SSL_SESSION_new();
+ if (session == NULL || !SSL_SESSION_set1_master_key(session, key_data,
(size_t)key_len) ||
+ !SSL_SESSION_set_cipher(session, cipher) ||
+ !SSL_SESSION_set_protocol_version(session, TLS1_3_VERSION) ||
+ !SSL_SESSION_set1_id_context(session, TCN_PSK_SESSION_ID_CONTEXT,
+ (unsigned int)sizeof(TCN_PSK_SESSION_ID_CONTEXT))) {
+ goto cleanup;
+ }
+
+ if (apr_thread_mutex_lock(c->psk_use_session_identities_lock) !=
APR_SUCCESS) {
+ goto cleanup;
+ }
+ cached_identity = apr_hash_get(c->psk_use_session_identities,
identity_utf, (apr_ssize_t)*identity_len);
+ if (cached_identity == NULL) {
+ cached_identity = (const unsigned char *)apr_pstrmemdup(c->pool,
identity_utf, *identity_len);
+ if (cached_identity != NULL) {
+ apr_hash_set(c->psk_use_session_identities, cached_identity,
(apr_ssize_t)*identity_len, cached_identity);
+ }
+ }
+ apr_thread_mutex_unlock(c->psk_use_session_identities_lock);
+ if (cached_identity == NULL) {
+ goto cleanup;
+ }
+
+ *identity = cached_identity;
+ *sess = session;
+ session = NULL;
+ result = 1;
+
+cleanup:
+ if ((*e)->ExceptionCheck(e)) {
+ (*e)->ExceptionClear(e);
+ }
+ SSL_SESSION_free(session);
+ if (key_data != NULL) {
+ OPENSSL_clear_free(key_data, (size_t)key_len);
+ }
+ if (key != NULL) {
+ (*e)->DeleteLocalRef(e, key);
+ }
+ if (cipher_suite_array != NULL) {
+ (*e)->DeleteLocalRef(e, cipher_suite_array);
+ }
+ if (identity_utf != NULL) {
+ (*e)->ReleaseStringUTFChars(e, identity_string, identity_utf);
+ }
+ if (identity_string != NULL) {
+ (*e)->DeleteLocalRef(e, identity_string);
+ }
+ if (identity_array != NULL) {
+ (*e)->DeleteLocalRef(e, identity_array);
+ }
+ return result;
+}
+#endif
+
+TCN_IMPLEMENT_CALL(void, SSLContext, setPskUseSessionCallback)(TCN_STDARGS,
jlong ctx, jobject selector)
+{
+#if defined(HAVE_TLSV1_3) && !defined(LIBRESSL_VERSION_NUMBER)
+ tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
+ jobject new_selector = NULL;
+ jmethodID new_method = NULL;
+
+ UNREFERENCED(o);
+ TCN_ASSERT(ctx != 0);
+
+ if (selector != NULL) {
+ jclass selector_class = (*e)->GetObjectClass(e, selector);
+ new_method = (*e)->GetMethodID(e, selector_class, "selectClient",
"(J[Ljava/lang/String;[I)[B");
+ (*e)->DeleteLocalRef(e, selector_class);
+ if (new_method == NULL) {
+ return;
+ }
+ new_selector = (*e)->NewGlobalRef(e, selector);
+ if (new_selector == NULL) {
+ return;
+ }
+ if (c->psk_use_session_identities == NULL) {
+ c->psk_use_session_identities = apr_hash_make(c->pool);
+ if (c->psk_use_session_identities == NULL ||
+
apr_thread_mutex_create(&c->psk_use_session_identities_lock,
APR_THREAD_MUTEX_DEFAULT,
+ c->pool) != APR_SUCCESS) {
+ (*e)->DeleteGlobalRef(e, new_selector);
+ tcn_ThrowException(e, "Unable to initialize TLSv1.3 PSK
identity cache");
+ return;
+ }
+ }
+ }
+
+ SSL_CTX_set_psk_use_session_callback(c->ctx, selector == NULL ? NULL :
SSL_psk_use_session);
+
+ if (c->psk_use_session_selector != NULL) {
+ (*e)->DeleteGlobalRef(e, c->psk_use_session_selector);
+ }
+ c->psk_use_session_selector = new_selector;
+ c->psk_use_session_selector_method = new_method;
+#else
+ UNREFERENCED(o);
+ UNREFERENCED(ctx);
+ UNREFERENCED(selector);
+ tcn_Throw(e, "OpenSSL does not support TLSv1.3 PSK");
+#endif
+}
+
+TCN_IMPLEMENT_CALL(void, SSLContext, setPskServerCallback)(TCN_STDARGS, jlong
ctx, jobject selector)
+{
+#ifdef OPENSSL_NO_PSK
+ UNREFERENCED(o);
+ UNREFERENCED(ctx);
+ UNREFERENCED(selector);
+ tcn_Throw(e, "OpenSSL does not support PSK");
+#else
+ tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
+ jobject new_selector = NULL;
+ jmethodID new_method = NULL;
+
+ UNREFERENCED(o);
+ TCN_ASSERT(ctx != 0);
+
+ if (selector != NULL) {
+ jclass selector_class = (*e)->GetObjectClass(e, selector);
+ new_method = (*e)->GetMethodID(e, selector_class, "select",
"(JLjava/lang/String;)[B");
+ (*e)->DeleteLocalRef(e, selector_class);
+ if (new_method == NULL) {
+ return;
+ }
+
+ new_selector = (*e)->NewGlobalRef(e, selector);
+ if (new_selector == NULL) {
+ return;
+ }
+ }
+
+ SSL_CTX_set_psk_server_callback(c->ctx, selector == NULL ? NULL :
SSL_psk_server);
+
+ if (c->psk_selector != NULL) {
+ (*e)->DeleteGlobalRef(e, c->psk_selector);
+ }
+ c->psk_selector = new_selector;
+ c->psk_selector_method = new_method;
+#endif
+}
+
+#if defined(HAVE_TLSV1_3) && !defined(LIBRESSL_VERSION_NUMBER)
+static int SSL_psk_find_session(SSL *ssl, const unsigned char *identity,
size_t identity_len, SSL_SESSION **sess)
+{
+ tcn_ssl_ctxt_t *c = SSL_get_app_data2(ssl);
+ JNIEnv *e;
+ jbyteArray identity_array = NULL;
+ jintArray cipher_suite_array = NULL;
+ jbyteArray key = NULL;
+ jint cipher_suite;
+ jsize key_len = 0;
+ unsigned char cipher_id[2];
+ unsigned char *key_data = NULL;
+ const SSL_CIPHER *cipher;
+ SSL_SESSION *session = NULL;
+ int result = 0;
+
+ *sess = NULL;
+ if (c == NULL || c->psk_find_session_selector == NULL ||
c->psk_find_session_selector_method == NULL ||
+ identity == NULL || tcn_get_java_env(&e) != JNI_OK) {
+ return 0;
+ }
+
+ identity_array = (*e)->NewByteArray(e, (jsize)identity_len);
+ if (identity_array == NULL) {
+ goto cleanup;
+ }
+ (*e)->SetByteArrayRegion(e, identity_array, 0, (jsize)identity_len, (const
jbyte *)identity);
+ if ((*e)->ExceptionCheck(e)) {
+ goto cleanup;
+ }
+
+ cipher_suite_array = (*e)->NewIntArray(e, 1);
+ if (cipher_suite_array == NULL) {
+ goto cleanup;
+ }
+
+ key = (*e)->CallObjectMethod(e, c->psk_find_session_selector,
c->psk_find_session_selector_method, P2J(ssl),
+ identity_array, cipher_suite_array);
+ if ((*e)->ExceptionCheck(e)) {
+ goto cleanup;
+ }
+ if (key == NULL) {
+ result = 1;
+ goto cleanup;
+ }
+
+ (*e)->GetIntArrayRegion(e, cipher_suite_array, 0, 1, &cipher_suite);
+ if ((*e)->ExceptionCheck(e) || cipher_suite <= 0 || cipher_suite > 0xffff)
{
+ goto cleanup;
+ }
+ cipher_id[0] = (unsigned char)(cipher_suite >> 8);
+ cipher_id[1] = (unsigned char)cipher_suite;
+ cipher = SSL_CIPHER_find(ssl, cipher_id);
+ if (cipher == NULL || strcmp(SSL_CIPHER_get_version(cipher), "TLSv1.3") !=
0) {
+ goto cleanup;
+ }
+
+ key_len = (*e)->GetArrayLength(e, key);
+ if (key_len <= 0) {
+ goto cleanup;
+ }
+ key_data = OPENSSL_malloc((size_t)key_len);
+ if (key_data == NULL) {
+ goto cleanup;
+ }
+ (*e)->GetByteArrayRegion(e, key, 0, key_len, (jbyte *)key_data);
+ if ((*e)->ExceptionCheck(e)) {
+ goto cleanup;
+ }
+
+ session = SSL_SESSION_new();
+ if (session == NULL || !SSL_SESSION_set1_master_key(session, key_data,
(size_t)key_len) ||
+ !SSL_SESSION_set_cipher(session, cipher) ||
+ !SSL_SESSION_set_protocol_version(session, TLS1_3_VERSION) ||
+ !SSL_SESSION_set1_id_context(session, TCN_PSK_SESSION_ID_CONTEXT,
+ (unsigned int)sizeof(TCN_PSK_SESSION_ID_CONTEXT))) {
+ goto cleanup;
+ }
+
+ *sess = session;
+ session = NULL;
+ result = 1;
+
+cleanup:
+ if ((*e)->ExceptionCheck(e)) {
+ (*e)->ExceptionClear(e);
+ }
+ SSL_SESSION_free(session);
+ if (key_data != NULL) {
+ OPENSSL_clear_free(key_data, (size_t)key_len);
+ }
+ if (key != NULL) {
+ (*e)->DeleteLocalRef(e, key);
+ }
+ if (cipher_suite_array != NULL) {
+ (*e)->DeleteLocalRef(e, cipher_suite_array);
+ }
+ if (identity_array != NULL) {
+ (*e)->DeleteLocalRef(e, identity_array);
+ }
+ return result;
+}
+#endif
+
+TCN_IMPLEMENT_CALL(void, SSLContext, setPskFindSessionCallback)(TCN_STDARGS,
jlong ctx, jobject selector)
+{
+#if defined(HAVE_TLSV1_3) && !defined(LIBRESSL_VERSION_NUMBER)
+ tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
+ jobject new_selector = NULL;
+ jmethodID new_method = NULL;
+
+ UNREFERENCED(o);
+ TCN_ASSERT(ctx != 0);
+
+ if (selector != NULL) {
+ jclass selector_class = (*e)->GetObjectClass(e, selector);
+ new_method = (*e)->GetMethodID(e, selector_class, "select",
"(J[B[I)[B");
+ (*e)->DeleteLocalRef(e, selector_class);
+ if (new_method == NULL) {
+ return;
+ }
+
+ new_selector = (*e)->NewGlobalRef(e, selector);
+ if (new_selector == NULL) {
+ return;
+ }
+ }
+
+ SSL_CTX_set_psk_find_session_callback(c->ctx, selector == NULL ? NULL :
SSL_psk_find_session);
+
+ if (c->psk_find_session_selector != NULL) {
+ (*e)->DeleteGlobalRef(e, c->psk_find_session_selector);
+ }
+ c->psk_find_session_selector = new_selector;
+ c->psk_find_session_selector_method = new_method;
+#else
+ UNREFERENCED(o);
+ UNREFERENCED(ctx);
+ UNREFERENCED(selector);
+ tcn_Throw(e, "OpenSSL does not support TLSv1.3 PSK");
+#endif
+}
+
TCN_IMPLEMENT_CALL(jboolean, SSLContext, setSessionIdContext)(TCN_STDARGS,
jlong ctx, jbyteArray sidCtx)
{
tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/native/src/sslutils.c
new/tomcat-native-2.0.17-src/native/src/sslutils.c
--- old/tomcat-native-2.0.16-src/native/src/sslutils.c 2026-09-02
14:56:15.000000000 +0200
+++ new/tomcat-native-2.0.17-src/native/src/sslutils.c 2026-10-22
13:45:19.000000000 +0200
@@ -476,8 +476,14 @@
* is called if OpenSSL already successfully verified the certificate
* (parameter "ok" in SSL_callback_SSL_verify() must be true).
*/
- else if (X509_check_issued(cert,cert) == X509_V_OK) {
- /* don't do OCSP checking for valid self-issued certs */
+ else if (X509_check_issued(cert,cert) == X509_V_OK
+ || X509_STORE_CTX_get_error_depth(ctx) >=
X509_STORE_CTX_get_num_untrusted(ctx)) {
+ /* Don't do OCSP checking for valid self-issued certs, nor for a
certificate that is itself
+ * a trust anchor (present directly in the configured trust store
rather than supplied by the
+ * peer). A trust anchor is trusted unconditionally, so its own
revocation status is not
+ * checked. This aligns with JSSE's PKIXRevocationChecker, which
excludes the trust anchor
+ * of the certification path from revocation checking regardless of
whether it is self-signed.
+ */
X509_STORE_CTX_set_error(ctx, X509_V_OK);
return OCSP_STATUS_UNKNOWN;
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/native/srclib/VERSIONS
new/tomcat-native-2.0.17-src/native/srclib/VERSIONS
--- old/tomcat-native-2.0.16-src/native/srclib/VERSIONS 2026-09-02
14:56:15.000000000 +0200
+++ new/tomcat-native-2.0.17-src/native/srclib/VERSIONS 2026-10-22
13:45:19.000000000 +0200
@@ -5,7 +5,7 @@
The following version of the libraries are recommended:
- APR 1.7.6 or later, http://apr.apache.org
-- OpenSSL 3.5.8 or later, http://www.openssl.org
+- OpenSSL 3.5.9 or later, http://www.openssl.org
Older versions should also work but are not as thoroughly tested by the Tomcat
Native team
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/native/tcnative.spec
new/tomcat-native-2.0.17-src/native/tcnative.spec
--- old/tomcat-native-2.0.16-src/native/tcnative.spec 2026-09-02
14:58:43.000000000 +0200
+++ new/tomcat-native-2.0.17-src/native/tcnative.spec 2026-10-22
13:47:45.000000000 +0200
@@ -21,7 +21,7 @@
Summary: Tomcat Native Java library
Name: tcnative
-Version: 2.0.16
+Version: 2.0.17
Release: 1
License: Apache Software License
Group: System Environment/Libraries
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/xdocs/index.xml
new/tomcat-native-2.0.17-src/xdocs/index.xml
--- old/tomcat-native-2.0.16-src/xdocs/index.xml 2026-09-02
14:56:15.000000000 +0200
+++ new/tomcat-native-2.0.17-src/xdocs/index.xml 2026-10-22
13:45:19.000000000 +0200
@@ -42,10 +42,10 @@
<section name="Headlines">
<ul>
-<li><a href="news/2026.html#20260615">15 June 2026 - <b>Tomcat-Native-2.0.15
+<li><a href="news/2026.html#20260907">7 September June 2026 -
<b>Tomcat-Native-2.0.16
released</b></a>
<p>The Apache Tomcat team is proud to announce the immediate availability of
-Tomcat Native 2.0.15 Stable.</p>
+Tomcat Native 2.0.16 Stable.</p>
<p>
The sources and the binaries for selected platforms are available from the
<a href="../download-native.cgi">Download page</a>.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/xdocs/miscellaneous/changelog.xml
new/tomcat-native-2.0.17-src/xdocs/miscellaneous/changelog.xml
--- old/tomcat-native-2.0.16-src/xdocs/miscellaneous/changelog.xml
2026-09-02 14:56:15.000000000 +0200
+++ new/tomcat-native-2.0.17-src/xdocs/miscellaneous/changelog.xml
2026-10-22 13:45:19.000000000 +0200
@@ -31,7 +31,36 @@
branch started from the 1.2.33 tag.
</p>
</section>
-<section name="2.0.16" rtext="">
+<section name="2.0.17" rtext="">
+ <changelog>
+ <add>
+ Add support for configuring server-side TLSv1.2 and TLSv1.3 pre-shared
+ key callbacks. (markt)
+ </add>
+ <add>
+ Add support for configuring client-side TLSv1.2 and TLSv1.3 pre-shared
+ key callbacks. (markt)
+ </add>
+ <fix>
+ Align the OCSP checking performed by <code>ssl_verify_OCSP()</code> with
+ the behaviour of Tomcat's JSSE based <code>SSLEngine</code>
+ implementation so that a certificate that is itself a trust anchor
+ (whether a self-signed root or a certificate trusted directly via the
+ configured trust store) is not subject to OCSP checking. (markt)
+ </fix>
+ <fix>
+ Limit read and write access to a newly created <code>SSLKEYLOGFILE</code>
+ (if any) to the user under which Tomcat Native is running. (markt)
+ </fix>
+ <update>
+ Update the recommended minimum version of OpenSSL to 3.5.9. (markt)
+ </update>
+ <fix>
+ Generate the HTML changelog as UTF-8. (markt)
+ </fix>
+ </changelog>
+</section>
+<section name="2.0.16" rtext="2026-09-07">
<changelog>
<scode>
Remove call to ERR_remove_thread_state() from Windows specific code to
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude
config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4
--exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh
old/tomcat-native-2.0.16-src/xdocs/news/2026.xml
new/tomcat-native-2.0.17-src/xdocs/news/2026.xml
--- old/tomcat-native-2.0.16-src/xdocs/news/2026.xml 2026-09-02
14:56:15.000000000 +0200
+++ new/tomcat-native-2.0.17-src/xdocs/news/2026.xml 2026-10-22
13:45:19.000000000 +0200
@@ -30,6 +30,11 @@
<section name="2026 News & Status">
+ <subsection anchor="20260907" name="7 September 2026 -
Tomcat-Native-2.0.16 released">
+ <p>The Apache Tomcat team is proud to announce the immediate
+ availability of Tomcat Native 2.0.16.</p>
+ </subsection>
+
<subsection anchor="20260615" name="15 June 2026 - Tomcat-Native-2.0.15
released">
<p>The Apache Tomcat team is proud to announce the immediate
availability of Tomcat Native 2.0.15.</p>
