This is an automated email from the ASF dual-hosted git repository. markt-asf pushed a commit to branch 1.3.x in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
commit 2a6031b9d767f31a2e9942c08036e7a92cfddc8d Author: Mark Thomas <[email protected]> AuthorDate: Tue Sep 1 15:56:37 2026 +0100 Use automatic config of DH parameters. Manual config will be ignored. --- native/src/sslcontext.c | 47 ++++----------------------------------- xdocs/miscellaneous/changelog.xml | 4 ++++ 2 files changed, 8 insertions(+), 43 deletions(-) diff --git a/native/src/sslcontext.c b/native/src/sslcontext.c index 97d9e07ef..9a8d144d5 100644 --- a/native/src/sslcontext.c +++ b/native/src/sslcontext.c @@ -801,49 +801,10 @@ cleanup: TCN_IMPLEMENT_CALL(void, SSLContext, setTmpDH)(TCN_STDARGS, jlong ctx, jstring file) { - tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *); - BIO *bio = NULL; - DH *dh = NULL; - TCN_ALLOC_CSTRING(file); - UNREFERENCED(o); - TCN_ASSERT(ctx != 0); - TCN_ASSERT(file); - - if (!J2S(file)) { - tcn_Throw(e, "Error while configuring DH: no dh param file given"); - return; - } - - bio = BIO_new_file(J2S(file), "r"); - if (!bio) { - char err[TCN_OPENSSL_ERROR_STRING_LENGTH]; - ERR_error_string_n(SSL_ERR_get(), err, TCN_OPENSSL_ERROR_STRING_LENGTH); - tcn_Throw(e, "Error while configuring DH using %s: %s", J2S(file), err); - TCN_FREE_CSTRING(file); - return; - } - - dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); - BIO_free(bio); - if (!dh) { - char err[TCN_OPENSSL_ERROR_STRING_LENGTH]; - ERR_error_string_n(SSL_ERR_get(), err, TCN_OPENSSL_ERROR_STRING_LENGTH); - tcn_Throw(e, "Error while configuring DH: no DH parameter found in %s (%s)", J2S(file), err); - TCN_FREE_CSTRING(file); - return; - } - - if (1 != SSL_CTX_set_tmp_dh(c->ctx, dh)) { - char err[TCN_OPENSSL_ERROR_STRING_LENGTH]; - DH_free(dh); - ERR_error_string_n(SSL_ERR_get(), err, TCN_OPENSSL_ERROR_STRING_LENGTH); - tcn_Throw(e, "Error while configuring DH with file %s: %s", J2S(file), err); - TCN_FREE_CSTRING(file); - return; - } - - DH_free(dh); - TCN_FREE_CSTRING(file); + UNREFERENCED_STDARGS; + UNREFERENCED(ctx); + UNREFERENCED(file); + // NO-OP } TCN_IMPLEMENT_CALL(void, SSLContext, setTmpECDHByCurveName)(TCN_STDARGS, jlong ctx, diff --git a/xdocs/miscellaneous/changelog.xml b/xdocs/miscellaneous/changelog.xml index 3255b44fc..11729ae08 100644 --- a/xdocs/miscellaneous/changelog.xml +++ b/xdocs/miscellaneous/changelog.xml @@ -96,6 +96,10 @@ OpenSSL (and the version that windows binaries will be built with) now follows the 3.5.x LTS branch. (markt) </update> + <fix> + Switch to automatic configuration of DH parameters. Manual configuration + attempts will be ignored. (markt) + </fix> </changelog> </section> <section name="1.3.8" rtext="2026-06-15"> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
