This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new 9b78fd27a7 Update OpenSSL options constants
9b78fd27a7 is described below
commit 9b78fd27a773b278a56ba4c9c4de9d0861a01758
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Aug 26 17:47:38 2026 +0100
Update OpenSSL options constants
There were very out of date. The updated list is compatible with 1.1.1
through master although some options will get ignored in some versions.
The commit will break tests until a new Tomcat Native release is
available with the new methods for setting the wider range of options.
That will happen before the next Tomcat release
---
java/org/apache/tomcat/jni/SSL.java | 251 ++++++++++++++-------
java/org/apache/tomcat/jni/SSLContext.java | 34 +++
.../tomcat/util/net/openssl/OpenSSLContext.java | 18 +-
.../tomcat/util/net/openssl/OpenSSLEngine.java | 18 +-
4 files changed, 225 insertions(+), 96 deletions(-)
diff --git a/java/org/apache/tomcat/jni/SSL.java
b/java/org/apache/tomcat/jni/SSL.java
index 71d1758eab..d866a82d3c 100644
--- a/java/org/apache/tomcat/jni/SSL.java
+++ b/java/org/apache/tomcat/jni/SSL.java
@@ -264,134 +264,164 @@ public final class SSL {
*/
public static final int SSL_VERIFY_PEER_STRICT = (SSL_VERIFY_PEER |
SSL_VERIFY_FAIL_IF_NO_PEER_CERT);
- /**
- * Workaround for Microsoft session ID bug.
+ /*
+ * Option values are synchronized with OpenSSL master as of 2026-08-26.
They are also confirmed valid for the final
+ * OpenSSL 1.1.1 release so the values can be consistent for all Tomcat
versions.
*/
- public static final int SSL_OP_MICROSOFT_SESS_ID_BUG = 0x00000001;
+
/**
- * Workaround for Netscape challenge bug.
+ * Disable Extended master secret.
*/
- public static final int SSL_OP_NETSCAPE_CHALLENGE_BUG = 0x00000002;
+ public static final long SSL_OP_NO_EXTENDED_MASTER_SECRET = 0x1L;
/**
- * Workaround for Netscape cipher change bug.
+ * Cleanse plaintext copies of data delivered to the application.
*/
- public static final int SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG =
0x00000008;
+ public static final long SSL_OP_CLEANSE_PLAINTEXT = 0x2L;
/**
- * Workaround for SSLREF2 certificate type reuse bug.
+ * Allow initial connection to servers that don't support RI.
*/
- public static final int SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG = 0x00000010;
+ public static final long SSL_OP_LEGACY_SERVER_CONNECT = 0x4L;
/**
- * Workaround for Microsoft SSLv3 buffer bug.
+ * Enable support for Kernel TLS.
*/
- public static final int SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER = 0x00000020;
+ public static final long SSL_OP_ENABLE_KTLS = 0x8L;
+ public static final long SSL_OP_TLSEXT_PADDING = 0x10L;
+ // Unused = 0x20L
+ public static final long SSL_OP_SAFARI_ECDHE_ECDSA_BUG = 0x40L;
+ public static final long SSL_OP_IGNORE_UNEXPECTED_EOF = 0x80L;
+ public static final long SSL_OP_ALLOW_CLIENT_RENEGOTIATION = 0x100L;
+ public static final long SSL_OP_DISABLE_TLSEXT_CA_NAMES = 0x200L;
+ public static final long SSL_OP_ALLOW_NO_DHE_KEX = 0x400L;
+
/**
- * Workaround for MSIE SSLv2 RSA padding bug.
+ * Disable TLS 1.0 CBC vulnerability workaround. Usually (depending on the
application protocol) the workaround is
+ * not needed. Unfortunately some broken SSL/TLS implementations cannot
handle it at all, which is why we include it
+ * in SSL_OP_ALL.
*/
- public static final int SSL_OP_MSIE_SSLV2_RSA_PADDING = 0x00000040;
+ public static final long SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS = 0x800L;
/**
- * Workaround for SSLeay 0.8.0 client DH bug.
+ * DTLS options.
*/
- public static final int SSL_OP_SSLEAY_080_CLIENT_DH_BUG = 0x00000080;
+ public static final long SSL_OP_NO_QUERY_MTU = 0x1000L;
/**
- * Workaround for TLS D5 bug.
+ * Turn on Cookie Exchange (on relevant for servers).
*/
- public static final int SSL_OP_TLS_D5_BUG = 0x00000100;
+ public static final long SSL_OP_COOKIE_EXCHANGE = 0x2000L;
/**
- * Workaround for TLS block padding bug.
- */
- public static final int SSL_OP_TLS_BLOCK_PADDING_BUG = 0x00000200;
-
- /*
- * Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added in
OpenSSL 0.9.6d. Usually (depending on the
- * application protocol) the workaround is not needed. Unfortunately some
broken SSL/TLS implementations cannot
- * handle it at all, which is why we include it in SSL_OP_ALL.
+ * Don't use RFC4507 ticket extension.
*/
+ public static final long SSL_OP_NO_TICKET = 0x4000L;
/**
- * Disable empty fragment insertion for CBC vulnerability workaround.
- */
- public static final int SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS = 0x00000800;
-
- /*
- * SSL_OP_ALL: various bug workarounds that should be rather harmless.
This used to be 0x000FFFFFL before 0.9.7.
+ * Use Cisco's version identifier of DTLS_BAD_VER (only with deprecated
DTLSv1_client_method()).
*/
+ public static final long SSL_OP_CISCO_ANYCONNECT = 0x8000L;
/**
- * All bug workaround options combined.
+ * As server, disallow session resumption on renegotiation.
*/
- public static final int SSL_OP_ALL = 0x00000FFF;
-/* As server, disallow session resumption on renegotiation */
+ public static final long SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION =
0x10000L;
/**
- * Disallow session resumption on renegotiation.
+ * Don't use compression even if supported.
*/
- public static final int SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION =
0x00010000;
- /* Don't use compression even if supported */
+ public static final long SSL_OP_NO_COMPRESSION = 0x20000L;
/**
- * Disable compression.
+ * Permit unsafe legacy renegotiation.
*/
- public static final int SSL_OP_NO_COMPRESSION = 0x00020000;
- /* Permit unsafe legacy renegotiation */
+ public static final long SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION =
0x40000L;
/**
- * Allow unsafe legacy renegotiation.
+ * Disable encrypt-then-mac.
*/
- public static final int SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION =
0x00040000;
- /* If set, always create a new key when using tmp_eddh parameters */
+ public static final long SSL_OP_NO_ENCRYPT_THEN_MAC = 0x80000L;
/**
- * Always create a new key when using ECDH parameters.
+ * Enable TLSv1.3 Compatibility mode. This is on by default. A future
version of OpenSSL may have this disabled by
+ * default.
*/
- public static final int SSL_OP_SINGLE_ECDH_USE = 0x00080000;
- /* If set, always create a new key when using tmp_dh parameters */
+ public static final long SSL_OP_ENABLE_MIDDLEBOX_COMPAT = 0x100000L;
/**
- * Always create a new key when using DH parameters.
- */
- public static final int SSL_OP_SINGLE_DH_USE = 0x00100000;
- /*
- * Set to always use the tmp_rsa key when doing RSA operations, even when
this violates protocol specs
+ * Prioritize Chacha20Poly1305 when client does. Modifies
SSL_OP_SERVER_PREFERENCE.
*/
+ public static final long SSL_OP_PRIORITIZE_CHACHA = 0x200000L;
/**
- * Always use ephemeral RSA key for RSA operations.
- */
- public static final int SSL_OP_EPHEMERAL_RSA = 0x00200000;
- /*
- * Set on servers to choose the cipher according to the server's
preferences
+ * Set on servers to choose cipher, curve or group according to server's
preferences.
*/
+ public static final long SSL_OP_SERVER_PREFERENCE = 0x400000L;
/**
- * Server prefers its own cipher order.
+ * Equivalent definition for backwards compatibility:
*/
- public static final int SSL_OP_CIPHER_SERVER_PREFERENCE = 0x00400000;
- /*
+ public static final long SSL_OP_CIPHER_SERVER_PREFERENCE =
SSL_OP_SERVER_PREFERENCE;
+ /**
* If set, a server will allow a client to issue an SSLv3.0 version number
as latest version supported in the
* premaster secret, even when TLSv1.0 (version 3.1) was announced in the
client hello. Normally this is forbidden
* to prevent version rollback attacks.
*/
+ public static final long SSL_OP_TLS_ROLLBACK_BUG = 0x800000L;
/**
- * Allow TLS rollback bug workaround.
+ * Switches off automatic TLSv1.3 anti-replay protection for early data.
This is a server-side option only (no effect
+ * on the client).
*/
- public static final int SSL_OP_TLS_ROLLBACK_BUG = 0x00800000;
-
- /**
- * Disable SSLv2 protocol.
- */
- public static final int SSL_OP_NO_SSLv2 = 0x01000000;
+ public static final long SSL_OP_NO_ANTI_REPLAY = 0x1000000L;
/**
* Disable SSLv3 protocol.
*/
- public static final int SSL_OP_NO_SSLv3 = 0x02000000;
+ public static final long SSL_OP_NO_SSLv3 = 0x2000000L;
/**
* Disable TLSv1.0 protocol.
*/
- public static final int SSL_OP_NO_TLSv1 = 0x04000000;
+ public static final long SSL_OP_NO_TLSv1 = 0x4000000L;
/**
* Disable TLSv1.2 protocol.
*/
- public static final int SSL_OP_NO_TLSv1_2 = 0x08000000;
+ public static final long SSL_OP_NO_TLSv1_2 = 0x8000000L;
/**
* Disable TLSv1.1 protocol.
*/
- public static final int SSL_OP_NO_TLSv1_1 = 0x10000000;
+ public static final long SSL_OP_NO_TLSv1_1 = 0x10000000L;
+ public static final long SSL_OP_NO_TLSv1_3 = 0x20000000L;
+ public static final long SSL_OP_NO_DTLSv1 = SSL_OP_NO_TLSv1;
+ public static final long SSL_OP_NO_DTLSv1_2 = SSL_OP_NO_TLSv1_2;
+ public static final long SSL_OP_NO_DTLSv1_3 = SSL_OP_NO_TLSv1_3;
+ /**
+ * Disallow all renegotiation.
+ */
+ public static final long SSL_OP_NO_RENEGOTIATION = 0x40000000L;
+ /**
+ * Make server add server-hello extension from early version of cryptopro
draft, when GOST ciphersuite is
+ * negotiated. Required for interoperability with CryptoPro CSP 3.x
+ */
+ public static final long SSL_OP_CRYPTOPRO_TLSEXT_BUG = 0x80000000L;
+ /**
+ * Disable RFC8879 certificate compression. Don't send compressed
certificates, and ignore the extension when
+ * received.
+ */
+ public static final long SSL_OP_NO_TX_CERTIFICATE_COMPRESSION =
0x100000000L;
+ /**
+ * Disable RFC8879 certificate compression. Don't send the extension, and
subsequently indicating that receiving is
+ * not supported.
+ */
+ public static final long SSL_OP_NO_RX_CERTIFICATE_COMPRESSION =
0x200000000L;
+ /**
+ * Enable KTLS TX zerocopy on Linux.
+ */
+ public static final long SSL_OP_ENABLE_KTLS_TX_ZEROCOPY_SENDFILE =
0x400000000L;
+ public static final long SSL_OP_PREFER_NO_DHE_KEX = 0x800000000L;
+ public static final long SSL_OP_LEGACY_EC_POINT_FORMATS = 0x1000000000L;
/**
- * Disable TLS session tickets.
+ * Set this to tell client to emit greased ECH values.
+ */
+ public static final long SSL_OP_ECH_GREASE = 0x2000000000L;
+ /**
+ * If this is set then the server side will attempt trial decryption of
ECHs even if there is no matching ECH
+ * config_id. That's a bit inefficient, but more privacy friendly.
+ */
+ public static final long SSL_OP_ECH_TRIALDECRYPT = 0x4000000000L;
+ /**
+ * If set, clients will ignore the supplied ECH config_id and replace that
with a random value.
+ */
+ public static final long SSL_OP_ECH_IGNORE_CID = 0x8000000000L;
+ /**
+ * If set, servers will add GREASEy ECHConfig values to those sent in
retry_configs.
*/
- public static final int SSL_OP_NO_TICKET = 0x00004000;
+ public static final long SSL_OP_ECH_GREASE_RETRY_CONFIG = 0x10000000000L;
// SSL_OP_PKCS1_CHECK_1 and SSL_OP_PKCS1_CHECK_2 flags are unsupported
// in the current version of OpenSSL library. See ssl.h changes in commit
@@ -407,13 +437,59 @@ public final class SSL {
@Deprecated
public static final int SSL_OP_PKCS1_CHECK_2 = 0x10000000;
/**
- * Workaround for Netscape CA DN bug.
+ * RFC 8701: Send GREASE values in ClientHello.
*/
- public static final int SSL_OP_NETSCAPE_CA_DN_BUG = 0x20000000;
+ public static final long SSL_OP_GREASE = 0x20000000000L;
+
+ /*
+ * Option "collections."
+ */
+ public static final long SSL_OP_NO_SSL_MASK =
+ SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 |
SSL_OP_NO_TLSv1_2 | SSL_OP_NO_TLSv1_3;
+
+ public static final long SSL_OP_NO_DTLS_MASK = SSL_OP_NO_DTLSv1 |
SSL_OP_NO_DTLSv1_2;
+
/**
- * Workaround for Netscape demo cipher change bug.
+ * Various bug workarounds that should be rather harmless.
*/
- public static final int SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG =
0x40000000;
+ public static final long SSL_OP_ALL =
+ SSL_OP_CRYPTOPRO_TLSEXT_BUG | SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS |
SSL_OP_SAFARI_ECDHE_ECDSA_BUG;
+
+
+ /*
+ * OBSOLETE OPTIONS retained for compatibility.
+ */
+ @Deprecated
+ public static final long SSL_OP_MICROSOFT_SESS_ID_BUG = 0x0;
+ @Deprecated
+ public static final long SSL_OP_NETSCAPE_CHALLENGE_BUG = 0x0;
+ @Deprecated
+ public static final long SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG = 0x0;
+ @Deprecated
+ public static final long SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG = 0x0;
+ @Deprecated
+ public static final long SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER = 0x0;
+ @Deprecated
+ public static final long SSL_OP_MSIE_SSLV2_RSA_PADDING = 0x0;
+ @Deprecated
+ public static final long SSL_OP_SSLEAY_080_CLIENT_DH_BUG = 0x0;
+ @Deprecated
+ public static final long SSL_OP_TLS_D5_BUG = 0x0;
+ @Deprecated
+ public static final long SSL_OP_TLS_BLOCK_PADDING_BUG = 0x0;
+ @Deprecated
+ public static final long SSL_OP_SINGLE_ECDH_USE = 0x0;
+ @Deprecated
+ public static final long SSL_OP_SINGLE_DH_USE = 0x0;
+ @Deprecated
+ public static final long SSL_OP_EPHEMERAL_RSA = 0x0;
+ @Deprecated
+ public static final long SSL_OP_NO_SSLv2 = 0x0;
+ @Deprecated
+ public static final long SSL_OP_NETSCAPE_CA_DN_BUG = 0x0;
+ @Deprecated
+ public static final long SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG = 0x0;
+
/**
* Undefined certificate format.
@@ -1419,7 +1495,10 @@ public final class SSL {
*
* @param ssl the SSL instance (SSL *)
* @param options See SSL.SSL_OP_* for option flags.
+ *
+ * @deprecated Use {@link #setOptionsLong(long, long)}
*/
+ @Deprecated
public static native void setOptions(long ssl, int options);
/**
@@ -1428,9 +1507,29 @@ public final class SSL {
* @param ssl the SSL instance (SSL *)
*
* @return options See SSL.SSL_OP_* for option flags.
+ *
+ * @deprecated Use {@link SSL#getOptionsLong(long)}
*/
+ @Deprecated
public static native int getOptions(long ssl);
+ /**
+ * Set OpenSSL Option.
+ *
+ * @param ssl the SSL instance (SSL *)
+ * @param options See SSL.SSL_OP_* for option flags.
+ */
+ public static native void setOptionsLong(long ssl, long options);
+
+ /**
+ * Get OpenSSL Option.
+ *
+ * @param ssl the SSL instance (SSL *)
+ *
+ * @return options See SSL.SSL_OP_* for option flags.
+ */
+ public static native long getOptionsLong(long ssl);
+
/**
* Returns all cipher suites that are enabled for negotiation in an SSL
handshake.
*
diff --git a/java/org/apache/tomcat/jni/SSLContext.java
b/java/org/apache/tomcat/jni/SSLContext.java
index 1cc4fa4978..13fc6e9801 100644
--- a/java/org/apache/tomcat/jni/SSLContext.java
+++ b/java/org/apache/tomcat/jni/SSLContext.java
@@ -119,7 +119,10 @@ public final class SSLContext {
*
* @param ctx Server or Client context to use.
* @param options See SSL.SSL_OP_* for option flags.
+ *
+ * @deprecated Use {@link #setOptionsLong(long,long)}
*/
+ @Deprecated
public static native void setOptions(long ctx, int options);
/**
@@ -128,7 +131,10 @@ public final class SSLContext {
* @param ctx Server or Client context to use.
*
* @return options See SSL.SSL_OP_* for option flags.
+ *
+ * @deprecated Use {@link #getOptionsLong(long)}
*/
+ @Deprecated
public static native int getOptions(long ctx);
/**
@@ -136,9 +142,37 @@ public final class SSLContext {
*
* @param ctx Server or Client context to use.
* @param options See SSL.SSL_OP_* for option flags.
+ *
+ * @deprecated Use {@link #clearOptionsLong(long,long)}
*/
+ @Deprecated
public static native void clearOptions(long ctx, int options);
+ /**
+ * Set OpenSSL Option.
+ *
+ * @param ctx Server or Client context to use.
+ * @param options See SSL.SSL_OP_* for option flags.
+ */
+ public static native void setOptionsLong(long ctx, long options);
+
+ /**
+ * Get OpenSSL Option.
+ *
+ * @param ctx Server or Client context to use.
+ *
+ * @return options See SSL.SSL_OP_* for option flags.
+ */
+ public static native long getOptionsLong(long ctx);
+
+ /**
+ * Clears OpenSSL Options.
+ *
+ * @param ctx Server or Client context to use.
+ * @param options See SSL.SSL_OP_* for option flags.
+ */
+ public static native void clearOptionsLong(long ctx, long options);
+
/**
* Returns all cipher suites that are enabled for negotiation in an SSL
handshake.
*
diff --git a/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java
b/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java
index 418c98b2be..2ce1fc3821 100644
--- a/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java
+++ b/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java
@@ -353,31 +353,31 @@ public class OpenSSLContext implements
org.apache.tomcat.util.net.SSLContext {
}
try {
if (sslHostConfig.getInsecureRenegotiation()) {
- SSLContext.setOptions(ctx,
SSL.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION);
+ SSLContext.setOptionsLong(ctx,
SSL.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION);
} else {
- SSLContext.clearOptions(ctx,
SSL.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION);
+ SSLContext.clearOptionsLong(ctx,
SSL.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION);
}
// Use server's preference order for ciphers (rather than
// client's)
if (sslHostConfig.getHonorCipherOrder()) {
- SSLContext.setOptions(ctx,
SSL.SSL_OP_CIPHER_SERVER_PREFERENCE);
+ SSLContext.setOptionsLong(ctx,
SSL.SSL_OP_CIPHER_SERVER_PREFERENCE);
} else {
- SSLContext.clearOptions(ctx,
SSL.SSL_OP_CIPHER_SERVER_PREFERENCE);
+ SSLContext.clearOptionsLong(ctx,
SSL.SSL_OP_CIPHER_SERVER_PREFERENCE);
}
// Disable compression if requested
if (sslHostConfig.getDisableCompression()) {
- SSLContext.setOptions(ctx, SSL.SSL_OP_NO_COMPRESSION);
+ SSLContext.setOptionsLong(ctx, SSL.SSL_OP_NO_COMPRESSION);
} else {
- SSLContext.clearOptions(ctx, SSL.SSL_OP_NO_COMPRESSION);
+ SSLContext.clearOptionsLong(ctx, SSL.SSL_OP_NO_COMPRESSION);
}
// Disable TLS Session Tickets (RFC4507) to protect perfect
forward secrecy
if (sslHostConfig.getDisableSessionTickets()) {
- SSLContext.setOptions(ctx, SSL.SSL_OP_NO_TICKET);
+ SSLContext.setOptionsLong(ctx, SSL.SSL_OP_NO_TICKET);
} else {
- SSLContext.clearOptions(ctx, SSL.SSL_OP_NO_TICKET);
+ SSLContext.clearOptionsLong(ctx, SSL.SSL_OP_NO_TICKET);
}
// Configure the ciphers that the client is permitted to negotiate
@@ -494,7 +494,7 @@ public class OpenSSLContext implements
org.apache.tomcat.util.net.SSLContext {
throw new
SSLException(sm.getString("openssl.errApplyConf"), e);
}
// Reconfigure the enabled protocols
- int opts = SSLContext.getOptions(ctx);
+ long opts = SSLContext.getOptionsLong(ctx);
List<String> enabled = new ArrayList<>();
// Seems like there is no way to explicitly disable SSLv2Hello
// in OpenSSL so it is always enabled
diff --git a/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java
b/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java
index 4b7f81ca0c..b50dc4e4b1 100644
--- a/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java
+++ b/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java
@@ -78,7 +78,7 @@ public final class OpenSSLEngine extends SSLEngine implements
SSLUtil.ProtocolIn
try {
final long sslCtx = SSLContext.make(aprPool, SSL.SSL_PROTOCOL_ALL,
SSL.SSL_MODE_SERVER);
try {
- SSLContext.setOptions(sslCtx, SSL.SSL_OP_ALL);
+ SSLContext.setOptionsLong(sslCtx, SSL.SSL_OP_ALL);
SSLContext.setCipherSuite(sslCtx, "ALL");
final long ssl = SSL.newSSL(sslCtx, true);
try {
@@ -816,7 +816,7 @@ public final class OpenSSLEngine extends SSLEngine
implements SSLUtil.ProtocolIn
List<String> enabled = new ArrayList<>();
// Seems like there is no way to explicitly disable SSLv2Hello in
OpenSSL so it is always enabled
enabled.add(Constants.SSL_PROTO_SSLv2Hello);
- int opts = SSL.getOptions(ssl);
+ long opts = SSL.getOptionsLong(ssl);
if ((opts & SSL.SSL_OP_NO_TLSv1) == 0) {
enabled.add(Constants.SSL_PROTO_TLSv1);
}
@@ -863,22 +863,18 @@ public final class OpenSSLEngine extends SSLEngine
implements SSLUtil.ProtocolIn
}
}
// Enable all and then disable what we not want
- SSL.setOptions(ssl, SSL.SSL_OP_ALL);
-
- // Always disable SSLv2
- SSL.setOptions(ssl, SSL.SSL_OP_NO_SSLv2);
-
+ SSL.setOptionsLong(ssl, SSL.SSL_OP_ALL);
if (!sslv3) {
- SSL.setOptions(ssl, SSL.SSL_OP_NO_SSLv3);
+ SSL.setOptionsLong(ssl, SSL.SSL_OP_NO_SSLv3);
}
if (!tlsv1) {
- SSL.setOptions(ssl, SSL.SSL_OP_NO_TLSv1);
+ SSL.setOptionsLong(ssl, SSL.SSL_OP_NO_TLSv1);
}
if (!tlsv1_1) {
- SSL.setOptions(ssl, SSL.SSL_OP_NO_TLSv1_1);
+ SSL.setOptionsLong(ssl, SSL.SSL_OP_NO_TLSv1_1);
}
if (!tlsv1_2) {
- SSL.setOptions(ssl, SSL.SSL_OP_NO_TLSv1_2);
+ SSL.setOptionsLong(ssl, SSL.SSL_OP_NO_TLSv1_2);
}
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
