This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 405ec2d03030b7a87c48f7a8b3ab3e9583423f3f Author: opencode <[email protected]> AuthorDate: Fri Oct 16 10:47:53 2026 +0200 Correct the FILE check for SSL_CONF commands in the OpenSSL FFM code The checkConf() method of the panama OpenSSLContext rejected an SSL_CONF_TYPE_FILE command only when the configured path was neither a file nor readable, i.e. when both conditions failed. As a result, a readable directory or an unreadable regular file passed the check and the invalid value was only rejected later, when SSL_CONF_cmd tried to load it, reporting a raw OpenSSL error instead of the clear opensslconf.badFile message. Use the intended 'not a file or not readable' test so that only a readable regular file is accepted. This matches the behaviour of the JNI/tomcat-native implementation, whose path_check() requires the path to exist and to be a regular file. Symbolic links to readable regular files continue to pass, since File.isFile() and File.canRead() resolve links just like apr_stat() does on the JNI side. --- java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java index 4ad3b80801..88a99ce4ae 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java @@ -383,7 +383,7 @@ public class OpenSSLContext implements org.apache.tomcat.util.net.SSLContext { if (code == SSL_CONF_TYPE_FILE()) { // Check file File file = new File(value); - if (!file.isFile() && !file.canRead()) { + if (!file.isFile() || !file.canRead()) { log.error(sm.getString("opensslconf.badFile", name, value)); ok = false; } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
