This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 11.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit fcea01e031d4626cab47f3f23311dc1e3a8b9257 Author: opencode <[email protected]> AuthorDate: Fri Oct 16 11:14:59 2026 +0200 Correct the OpenSSL 3 version boundary in the FFM compatibility layer OpenSSL 3.0.0 (and its pre-releases) report a version number of 0x30000000L, since every release of the 3.x and 4.x series uses a zero status nibble in the synthesised 0xMNN00PP0L version number. The compatibility code used a boundary of 0x3000000fL, a value based on the OpenSSL 1.x convention of released versions ending in 0xf, so exactly OpenSSL 3.0.0 was classified as an OpenSSL 1.x library. On such a system the FIPS handling called FIPS_mode(), a symbol no OpenSSL 3.x library exports, failing library initialisation with an UnsatisfiedLinkError; the same applied to FIPS_mode_set() during destroy(). The peer certificate retrieval used SSL_get_peer_certificate, which is not an exported symbol in 3.x, so retrieving client certificates failed as well. Engines were also set up and the implementation was reported as OpenSSL 1.x. Use 0x30000000L as the boundary between the 1.x and 3.x behaviour at all three places the constant appeared. The affected code branches are the ones every OpenSSL version from 3.0.1 onwards already uses, and all symbols those branches reference are available in OpenSSL 3.0.0. No other version falls between the old and the new boundary. --- java/org/apache/tomcat/util/net/openssl/panama/OpenSSLLibrary.java | 4 ++-- java/org/apache/tomcat/util/openssl/openssl_h_Compatibility.java | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLLibrary.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLLibrary.java index c969385848..30d03d3611 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLLibrary.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLLibrary.java @@ -83,7 +83,7 @@ public class OpenSSLLibrary { if (OpenSSLStatus.isLibraryInitialized()) { return; } - long initParam = (OpenSSL_version_num() >= 0x3000000fL) ? 0 : OPENSSL_INIT_ENGINE_ALL_BUILTIN(); + long initParam = (OpenSSL_version_num() >= 0x30000000L) ? 0 : OPENSSL_INIT_ENGINE_ALL_BUILTIN(); OPENSSL_init_ssl(initParam, MemorySegment.NULL); OpenSSLStatus.setLibraryInitialized(true); } @@ -362,7 +362,7 @@ public class OpenSSLLibrary { OpenSSLStatus.setAvailable(false); try { - if (OpenSSL_version_num() < 0x3000000fL) { + if (OpenSSL_version_num() < 0x30000000L) { // There could be unreferenced SSL_CTX still waiting for GC System.gc(); freeDHParameters(); diff --git a/java/org/apache/tomcat/util/openssl/openssl_h_Compatibility.java b/java/org/apache/tomcat/util/openssl/openssl_h_Compatibility.java index dfb231836d..fc0a9c8689 100644 --- a/java/org/apache/tomcat/util/openssl/openssl_h_Compatibility.java +++ b/java/org/apache/tomcat/util/openssl/openssl_h_Compatibility.java @@ -41,8 +41,8 @@ public class openssl_h_Compatibility { static { String versionString = OpenSSL_version(0).getString(0); OPENSSL = versionString.contains("OpenSSL"); - OPENSSL1 = OPENSSL && OpenSSL_version_num() < 0x3000000fL; - OPENSSL3 = OPENSSL && OpenSSL_version_num() >= 0x3000000fL; + OPENSSL1 = OPENSSL && OpenSSL_version_num() < 0x30000000L; + OPENSSL3 = OPENSSL && OpenSSL_version_num() >= 0x30000000L; BORINGSSL = versionString.contains("BoringSSL"); LIBRESSL = versionString.contains("LibreSSL"); int majorVersion = 0; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
