This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 8379f1a20a078f21fa67bcc1fb91a79e3611c146 Author: opencode <[email protected]> AuthorDate: Fri Oct 16 07:56:28 2026 +0200 Account for TLS 1.3 in the enabled protocol management of the JNI OpenSSL SSLEngine The Tomcat Native based SSLEngine implementation advertised TLS 1.3 as an implemented protocol (OpenSSL 1.1.1+) but never accounted for it in its enabled-protocol bookkeeping: - getEnabledProtocols() only inspected the SSL_OP_NO_SSLv3, NO_TLSv1, NO_TLSv1_1 and NO_TLSv1_2 options, so it always omitted TLSv1.3 from the returned list even when TLS 1.3 was enabled. Since the base SSLEngine.getSSLParameters() is built from getEnabledProtocols(), web applications using the SSLEngine request attribute saw an incomplete list. - setEnabledProtocols() had no TLSv1.3 case and never set the SSL_OP_NO_TLSv1_3 option, so a requested protocol list excluding TLS 1.3 silently left TLS 1.3 enabled. Fix both by mirroring the Panama implementation which already handles TLS 1.3 in these places, using the existing SSL.SSL_OP_NO_TLSv1_3 constant. This complements the equivalent fix recently applied to the OpenSSLContext init reconfigure block. --- java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java index bcb4a6fb88..1322f42fcc 100644 --- a/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java +++ b/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java @@ -824,6 +824,9 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn if ((opts & SSL.SSL_OP_NO_TLSv1_2) == 0) { enabled.add(Constants.SSL_PROTO_TLSv1_2); } + if ((opts & SSL.SSL_OP_NO_TLSv1_3) == 0) { + enabled.add(Constants.SSL_PROTO_TLSv1_3); + } if ((opts & SSL.SSL_OP_NO_SSLv3) == 0) { enabled.add(Constants.SSL_PROTO_SSLv3); } @@ -846,6 +849,7 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn boolean tlsv1 = false; boolean tlsv1_1 = false; boolean tlsv1_2 = false; + boolean tlsv1_3 = false; for (String p : protocols) { if (!IMPLEMENTED_PROTOCOLS_SET.contains(p)) { throw new IllegalArgumentException(sm.getString("engine.unsupportedProtocol", p)); @@ -855,6 +859,7 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn case Constants.SSL_PROTO_TLSv1 -> tlsv1 = true; case Constants.SSL_PROTO_TLSv1_1 -> tlsv1_1 = true; case Constants.SSL_PROTO_TLSv1_2 -> tlsv1_2 = true; + case Constants.SSL_PROTO_TLSv1_3 -> tlsv1_3 = true; } } // Enable all and then disable what we not want @@ -871,6 +876,9 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn if (!tlsv1_2) { SSL.setOptionsLong(state.ssl, SSL.SSL_OP_NO_TLSv1_2); } + if (!tlsv1_3) { + SSL.setOptionsLong(state.ssl, SSL.SSL_OP_NO_TLSv1_3); + } } @Override --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
