This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
The following commit(s) were added to refs/heads/main by this push:
new f6bb04b28 Add support for the extended range of options in OpenSSL 3.x
onwards
f6bb04b28 is described below
commit f6bb04b28f234a35c21a2997963195ae1d86de69
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Aug 26 17:25:38 2026 +0100
Add support for the extended range of options in OpenSSL 3.x onwards
This will need matching changes in Tomcat
---
native/src/ssl.c | 34 ++++++++++++++++++++++++++++------
native/src/sslcontext.c | 35 +++++++++++++++++++++++++++++------
xdocs/miscellaneous/changelog.xml | 6 ++++++
3 files changed, 63 insertions(+), 12 deletions(-)
diff --git a/native/src/ssl.c b/native/src/ssl.c
index 84bad1388..3995cbbf8 100644
--- a/native/src/ssl.c
+++ b/native/src/ssl.c
@@ -1074,16 +1074,38 @@ TCN_IMPLEMENT_CALL(void, SSL, setOptions)(TCN_STDARGS,
jlong ssl,
return;
}
-#ifndef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
- /* Clear the flag if not supported */
- if (opt & 0x00040000) {
- opt &= ~0x00040000;
+ SSL_set_options(ssl_, ((jlong) opt) & 0xFFFFFFFFLL);
+}
+
+TCN_IMPLEMENT_CALL(jint, SSL, getOptions)(TCN_STDARGS, jlong ssl)
+{
+ SSL *ssl_ = J2P(ssl, SSL *);
+
+ UNREFERENCED_STDARGS;
+
+ if (ssl_ == NULL) {
+ tcn_ThrowException(e, "ssl is null");
+ return 0;
}
-#endif
+
+ return SSL_get_options(ssl_);
+}
+
+TCN_IMPLEMENT_CALL(void, SSL, setOptionsLong)(TCN_STDARGS, jlong ssl, jlong
opt)
+{
+ SSL *ssl_ = J2P(ssl, SSL *);
+
+ UNREFERENCED_STDARGS;
+
+ if (ssl_ == NULL) {
+ tcn_ThrowException(e, "ssl is null");
+ return;
+ }
+
SSL_set_options(ssl_, opt);
}
-TCN_IMPLEMENT_CALL(jint, SSL, getOptions)(TCN_STDARGS, jlong ssl)
+TCN_IMPLEMENT_CALL(jlong, SSL, getOptionsLong)(TCN_STDARGS, jlong ssl)
{
SSL *ssl_ = J2P(ssl, SSL *);
diff --git a/native/src/sslcontext.c b/native/src/sslcontext.c
index 6c74b2369..9365cdd3e 100644
--- a/native/src/sslcontext.c
+++ b/native/src/sslcontext.c
@@ -299,12 +299,7 @@ TCN_IMPLEMENT_CALL(void, SSLContext,
setOptions)(TCN_STDARGS, jlong ctx,
UNREFERENCED_STDARGS;
TCN_ASSERT(ctx != 0);
-#ifndef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
- /* Clear the flag if not supported */
- if (opt & 0x00040000)
- opt &= ~0x00040000;
-#endif
- SSL_CTX_set_options(c->ctx, opt);
+ SSL_CTX_set_options(c->ctx, ((jlong) opt) & 0xFFFFFFFFLL);
}
TCN_IMPLEMENT_CALL(jint, SSLContext, getOptions)(TCN_STDARGS, jlong ctx)
@@ -322,6 +317,34 @@ TCN_IMPLEMENT_CALL(void, SSLContext,
clearOptions)(TCN_STDARGS, jlong ctx,
{
tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
+ UNREFERENCED_STDARGS;
+ TCN_ASSERT(ctx != 0);
+ SSL_CTX_clear_options(c->ctx, ((jlong) opt) & 0xFFFFFFFFLL);
+}
+
+TCN_IMPLEMENT_CALL(void, SSLContext, setOptionsLong)(TCN_STDARGS, jlong ctx,
jlong opt)
+{
+ tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
+
+ UNREFERENCED_STDARGS;
+ TCN_ASSERT(ctx != 0);
+ SSL_CTX_set_options(c->ctx, opt);
+}
+
+TCN_IMPLEMENT_CALL(jlong, SSLContext, getOptionsLong)(TCN_STDARGS, jlong ctx)
+{
+ tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
+
+ UNREFERENCED_STDARGS;
+ TCN_ASSERT(ctx != 0);
+
+ return SSL_CTX_get_options(c->ctx);
+}
+
+TCN_IMPLEMENT_CALL(void, SSLContext, clearOptionsLong)(TCN_STDARGS, jlong ctx,
jlong opt)
+{
+ tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
+
UNREFERENCED_STDARGS;
TCN_ASSERT(ctx != 0);
SSL_CTX_clear_options(c->ctx, opt);
diff --git a/xdocs/miscellaneous/changelog.xml
b/xdocs/miscellaneous/changelog.xml
index 50ca0dae9..004efd3ae 100644
--- a/xdocs/miscellaneous/changelog.xml
+++ b/xdocs/miscellaneous/changelog.xml
@@ -55,6 +55,12 @@
protocol in the list, use it rather than the last protocol offered by the
client. (markt)
</fix>
+ <fix>
+ Add support for the extended range of options available from OpenSSL
+ 3.0.x. The options flag is now a 64-bit unsigned int (represented by a
+ Java long) rather than a 32-bit unsigned int (represented by a Java
int).
+ (markt)
+ </fix>
</changelog>
</section>
<section name="2.0.15" rtext="2026-06-15">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
