This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 1.3.x
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
The following commit(s) were added to refs/heads/1.3.x by this push:
new 3dc73c118 Keep connection and context verification settings separate
3dc73c118 is described below
commit 3dc73c118d2202c8dfc6053787cc6d61416ddce6
Author: Mark Thomas <[email protected]>
AuthorDate: Thu Aug 27 15:51:54 2026 +0100
Keep connection and context verification settings separate
---
native/include/ssl_private.h | 5 +++++
native/src/ssl.c | 37 +++++++++++++++----------------------
native/src/sslcontext.c | 11 +++++++----
native/src/sslnetwork.c | 37 ++++++++++++++++++++++++++-----------
native/src/sslutils.c | 12 +++++++++---
xdocs/miscellaneous/changelog.xml | 5 +++++
6 files changed, 67 insertions(+), 40 deletions(-)
diff --git a/native/include/ssl_private.h b/native/include/ssl_private.h
index 62bc979de..f4e04e783 100644
--- a/native/include/ssl_private.h
+++ b/native/include/ssl_private.h
@@ -255,6 +255,8 @@ struct tcn_ssl_ctxt_t {
/* for client or downstream server authentication */
int verify_depth;
int verify_mode;
+
+ /* Password callback */
tcn_pass_cb_t *cb_data;
/* for client: List of protocols to request via ALPN.
@@ -318,6 +320,9 @@ typedef struct {
* connection
*/
} reneg_state;
+ /* for client or downstream server authentication */
+ int verify_depth;
+ int verify_mode;
enum {
PHA_NONE = 0, /* Before PHA */
PHA_STARTED, /* PHA req sent to client but no response */
diff --git a/native/src/ssl.c b/native/src/ssl.c
index c1bf2813d..d9ccc8892 100644
--- a/native/src/ssl.c
+++ b/native/src/ssl.c
@@ -1085,6 +1085,8 @@ TCN_IMPLEMENT_CALL(jlong /* SSL * */, SSL,
newSSL)(TCN_STDARGS,
con->ctx = c;
con->ssl = ssl;
con->shutdown_type = c->shutdown_type;
+ con->verify_mode = SSL_CVERIFY_UNSET;
+ con->verify_depth = c->verify_depth;
/* Store the handshakeCount in the SSL instance. */
*handshakeCount = 0;
@@ -1555,41 +1557,32 @@ TCN_IMPLEMENT_CALL(jlong, SSL, getTime)(TCN_STDARGS,
jlong ssl)
}
}
-TCN_IMPLEMENT_CALL(void, SSL, setVerify)(TCN_STDARGS, jlong ssl,
- jint level, jint depth)
+TCN_IMPLEMENT_CALL(void, SSL, setVerify)(TCN_STDARGS, jlong ssl, jint level,
jint depth)
{
- tcn_ssl_ctxt_t *c;
- int verify;
SSL *ssl_ = J2P(ssl, SSL *);
+ int verify = SSL_VERIFY_NONE;
+ UNREFERENCED(o);
if (ssl_ == NULL) {
- tcn_ThrowException(e, "ssl is null");
+ tcn_ThrowException(e, "SSL is null");
return;
}
- c = SSL_get_app_data2(ssl_);
-
- verify = SSL_VERIFY_NONE;
-
- UNREFERENCED(o);
+ tcn_ssl_conn_t *con = SSL_get_app_data(ssl_);
- if (c == NULL) {
- tcn_ThrowException(e, "context is null");
- return;
- }
- c->verify_mode = level;
+ con->verify_mode = level;
- if (c->verify_mode == SSL_CVERIFY_UNSET)
- c->verify_mode = SSL_CVERIFY_NONE;
+ if (con->verify_mode == SSL_CVERIFY_UNSET)
+ con->verify_mode = SSL_CVERIFY_NONE;
if (depth > 0)
- c->verify_depth = depth;
+ con->verify_depth = depth;
/*
- * Configure callbacks for SSL context
+ * Configure callbacks for SSL
*/
- if (c->verify_mode == SSL_CVERIFY_REQUIRE)
+ if (con->verify_mode == SSL_CVERIFY_REQUIRE)
verify |= SSL_VERIFY_PEER_STRICT;
- if ((c->verify_mode == SSL_CVERIFY_OPTIONAL) ||
- (c->verify_mode == SSL_CVERIFY_OPTIONAL_NO_CA))
+ if ((con->verify_mode == SSL_CVERIFY_OPTIONAL) ||
+ (con->verify_mode == SSL_CVERIFY_OPTIONAL_NO_CA))
verify |= SSL_VERIFY_PEER;
SSL_set_verify(ssl_, verify, SSL_callback_SSL_verify);
diff --git a/native/src/sslcontext.c b/native/src/sslcontext.c
index d05eb553c..b2a36f607 100644
--- a/native/src/sslcontext.c
+++ b/native/src/sslcontext.c
@@ -900,14 +900,17 @@ TCN_IMPLEMENT_CALL(void, SSLContext,
setShutdownType)(TCN_STDARGS, jlong ctx,
c->shutdown_type = type;
}
-TCN_IMPLEMENT_CALL(void, SSLContext, setVerify)(TCN_STDARGS, jlong ctx,
- jint level, jint depth)
+TCN_IMPLEMENT_CALL(void, SSLContext, setVerify)(TCN_STDARGS, jlong ctx, jint
level, jint depth)
{
tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
int verify = SSL_VERIFY_NONE;
-
UNREFERENCED(o);
- TCN_ASSERT(ctx != 0);
+
+ if (c == NULL) {
+ tcn_ThrowException(e, "SSLContext is null");
+ return;
+ }
+
c->verify_mode = level;
if (c->verify_mode == SSL_CVERIFY_UNSET)
diff --git a/native/src/sslnetwork.c b/native/src/sslnetwork.c
index 6e5960f91..0619763e8 100644
--- a/native/src/sslnetwork.c
+++ b/native/src/sslnetwork.c
@@ -137,6 +137,8 @@ static tcn_ssl_conn_t *ssl_create(JNIEnv *env,
tcn_ssl_ctxt_t *ctx, apr_pool_t *
con->ctx = ctx;
con->ssl = ssl;
con->shutdown_type = ctx->shutdown_type;
+ con->verify_mode = SSL_CVERIFY_UNSET;
+ con->verify_depth = ctx->verify_depth;
apr_pollset_create(&(con->pollset), 1, pool, 0);
SSL_set_app_data(ssl, (void *)con);
@@ -311,6 +313,7 @@ TCN_IMPLEMENT_CALL(jint, SSLSocket, handshake)(TCN_STDARGS,
jlong sock)
long vr;
apr_status_t rv;
X509 *peer;
+ int verify;
UNREFERENCED_STDARGS;
TCN_ASSERT(sock != 0);
@@ -364,11 +367,16 @@ TCN_IMPLEMENT_CALL(jint, SSLSocket,
handshake)(TCN_STDARGS, jlong sock)
/*
* Check for failed client authentication
*/
- if (con->ctx->verify_mode != SSL_VERIFY_NONE &&
+ if (con->verify_mode == SSL_CVERIFY_UNSET) {
+ verify = con->ctx->verify_mode;
+ } else {
+ verify = con->verify_mode;
+ }
+ if (verify != SSL_VERIFY_NONE &&
(vr = SSL_get_verify_result(con->ssl)) != X509_V_OK) {
if (SSL_VERIFY_ERROR_IS_OPTIONAL(vr) &&
- con->ctx->verify_mode == SSL_CVERIFY_OPTIONAL_NO_CA) {
+ verify == SSL_CVERIFY_OPTIONAL_NO_CA) {
/* TODO: Log optionalNoCA */
} else {
/* TODO: Log SSL client authentication failed */
@@ -743,20 +751,27 @@ TCN_IMPLEMENT_CALL(void, SSLSocket,
setVerify)(TCN_STDARGS,
tcn_socket_t *s = J2P(sock, tcn_socket_t *);
tcn_ssl_conn_t *con;
int verify = SSL_VERIFY_NONE;
-
UNREFERENCED_STDARGS;
- TCN_ASSERT(sock != 0);
+
+ if (sock == NULL) {
+ tcn_ThrowException(e, "SSLSocket is null");
+ return;
+ }
+
con = (tcn_ssl_conn_t *)s->opaque;
- if (cverify == SSL_CVERIFY_UNSET)
- cverify = SSL_CVERIFY_NONE;
- if (depth > 0)
- SSL_set_verify_depth(con->ssl, depth);
+ con->verify_mode = cverify;
- if (cverify == SSL_CVERIFY_REQUIRE)
+ if (con->verify_mode == SSL_CVERIFY_UNSET)
+ con->verify_mode = SSL_CVERIFY_NONE;
+ if (depth > 0) {
+ con->verify_depth = depth;
+ SSL_set_verify_depth(con->ssl, depth);
+ }
+ if (con->verify_mode == SSL_CVERIFY_REQUIRE)
verify |= SSL_VERIFY_PEER_STRICT;
- if ((cverify == SSL_CVERIFY_OPTIONAL) ||
- (cverify == SSL_CVERIFY_OPTIONAL_NO_CA))
+ if ((con->verify_mode == SSL_CVERIFY_OPTIONAL) ||
+ (con->verify_mode == SSL_CVERIFY_OPTIONAL_NO_CA))
verify |= SSL_VERIFY_PEER;
SSL_set_verify(con->ssl, verify, NULL);
diff --git a/native/src/sslutils.c b/native/src/sslutils.c
index 5f1ceb35b..fb5ee41c9 100644
--- a/native/src/sslutils.c
+++ b/native/src/sslutils.c
@@ -315,10 +315,10 @@ int SSL_CTX_use_certificate_chain(SSL_CTX *ctx, const
char *file,
int SSL_callback_SSL_verify(int ok, X509_STORE_CTX *ctx)
{
/* Get Apache context back through OpenSSL context */
- SSL *ssl = X509_STORE_CTX_get_ex_data(ctx,
-
SSL_get_ex_data_X509_STORE_CTX_idx());
+ SSL *ssl = X509_STORE_CTX_get_ex_data(ctx,
SSL_get_ex_data_X509_STORE_CTX_idx());
tcn_ssl_conn_t *con = (tcn_ssl_conn_t *)SSL_get_app_data(ssl);
- /* Get verify ingredients */
+
+ /* Set verify defaults from SSL Context */
int errnum = X509_STORE_CTX_get_error(ctx);
int errdepth = X509_STORE_CTX_get_error_depth(ctx);
int verify = con->ctx->verify_mode;
@@ -328,6 +328,12 @@ int SSL_callback_SSL_verify(int ok, X509_STORE_CTX *ctx)
int ocsp_timeout = con->ctx->ocsp_timeout;
int ocsp_verify_flags = con->ctx->ocsp_verify_flags;
+ /* Check for SSL specific configuration */
+ if (con->verify_mode != SSL_CVERIFY_UNSET) {
+ verify = con->verify_mode;
+ depth = con->verify_depth;
+ }
+
#if defined(SSL_OP_NO_TLSv1_3)
con->pha_state = PHA_COMPLETE;
#endif
diff --git a/xdocs/miscellaneous/changelog.xml
b/xdocs/miscellaneous/changelog.xml
index ce466f635..97d7c0c68 100644
--- a/xdocs/miscellaneous/changelog.xml
+++ b/xdocs/miscellaneous/changelog.xml
@@ -55,6 +55,11 @@
<scode>
Remove unused code. (markt)
</scode>
+ <fix>
+ Ensure that per connection changes to certificate verification settings,
+ e.g. to support client certificate authentication, do not modify the
+ certificate verification settings for other connections. (markt)
+ </fix>
</changelog>
</section>
<section name="1.3.8" rtext="2026-06-15">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
