On Wed, Nov 4, 2026 at 9:00 AM Mark Thomas via dev <[email protected]> wrote: > > Does res/openssl/openssl-tomcat.conf need an update?
To be honest, I'm not using jextract anymore, due to LLMs. So it can be updated, SSL_set_info_callback -> SSL_CTX_set_info_callback, I'll do it. Rémy > Mark > > > On 03/11/2026 23:36, remm.apache.org via dev wrote: > > This is an automated email from the ASF dual-hosted git repository. > > > > rmaucher pushed a commit to branch main > > in repository https://gitbox.apache.org/repos/asf/tomcat.git > > > > > > The following commit(s) were added to refs/heads/main by this push: > > new f3cdf3f544 Avoid callback registrations in engine > > f3cdf3f544 is described below > > > > commit f3cdf3f5448bd3123f6385b2e27ba4a234a63034 > > Author: remm <[email protected]> > > AuthorDate: Wed Nov 4 00:35:50 2026 +0100 > > > > Avoid callback registrations in engine > > > > This is indeed not needed, so better not do it. I did not consider > > there > > was a meaningful cost, so I had left it in. > > BZ70305 > > --- > > .../util/net/openssl/panama/OpenSSLContext.java | 4 +++ > > .../util/net/openssl/panama/OpenSSLEngine.java | 10 +++---- > > java/org/apache/tomcat/util/openssl/openssl_h.java | 32 > > +++++++++++----------- > > webapps/docs/changelog.xml | 4 +++ > > 4 files changed, 28 insertions(+), 22 deletions(-) > > > > diff --git > > a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java > > b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java > > index 121e95fe7d..06fab40470 100644 > > --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java > > +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java > > @@ -72,6 +72,7 @@ import > > org.apache.tomcat.util.openssl.SSL_CTX_set_verify$callback; > > import org.apache.tomcat.util.openssl.SSL_psk_client_cb_func; > > import org.apache.tomcat.util.openssl.SSL_psk_server_cb_func; > > import org.apache.tomcat.util.openssl.SSL_psk_use_session_cb_func; > > +import org.apache.tomcat.util.openssl.SSL_set_info_callback$cb; > > import org.apache.tomcat.util.openssl.openssl_h; > > import org.apache.tomcat.util.openssl.openssl_h_Compatibility; > > import org.apache.tomcat.util.openssl.pem_password_cb; > > @@ -272,6 +273,9 @@ public class OpenSSLContext implements > > org.apache.tomcat.util.net.SSLContext { > > // Set int pem_password_cb(char *buf, int size, int rwflag, > > void *u) callback > > SSL_CTX_set_default_passwd_cb(sslCtx, > > pem_password_cb.allocate(new PasswordCallback(null), contextArena)); > > > > + // Set ssl_info_callback > > + SSL_CTX_set_info_callback(sslCtx, > > SSL_set_info_callback$cb.allocate(new OpenSSLEngine.InfoCallback(), > > contextArena)); > > + > > // Set server groups > > // Note: It is also possible to override setSSLParameters in > > OpenSSLEngine to set the final > > // list of groups per connection, but this is less efficient > > than setting the configured > > diff --git > > a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java > > b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java > > index b34ec1a39f..6f09163d2f 100644 > > --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java > > +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java > > @@ -198,8 +198,6 @@ public final class OpenSSLEngine extends SSLEngine > > implements SSLUtil.ProtocolIn > > if (MemorySegment.NULL.equals(ssl)) { > > throw new IllegalStateException(sm.getString("engine.noSSL", > > OpenSSLLibrary.getLastError())); > > } > > - // Set ssl_info_callback > > - SSL_set_info_callback(ssl, SSL_set_info_callback$cb.allocate(new > > InfoCallback(), engineArena)); > > if (clientMode) { > > SSL_set_connect_state(ssl); > > } else { > > @@ -1122,14 +1120,14 @@ public final class OpenSSLEngine extends SSLEngine > > implements SSLUtil.ProtocolIn > > case REQUIRE -> SSL_VERIFY_PEER() | > > SSL_VERIFY_FAIL_IF_NO_PEER_CERT(); > > case OPTIONAL -> SSL_VERIFY_PEER(); > > }; > > - // Note: Since a callback is always set by the context, the > > callback here could in theory > > - // be set to NULL (at the time of creation of the SSL, the > > SSL_CTX will have a non-null callback) > > - SSL_set_verify(state.ssl, value, > > SSL_set_verify$callback.allocate(new VerifyCallback(), engineArena)); > > + // Note: Since a callback is always set by the context, the > > callback here can be set to NULL > > + // (at the time of creation of the SSL, the SSL_CTX will have > > a non-null callback) > > + SSL_set_verify(state.ssl, value, MemorySegment.NULL); > > clientAuth = mode; > > } > > } > > > > - private static class InfoCallback implements > > SSL_set_info_callback$cb.Function { > > + static class InfoCallback implements SSL_set_info_callback$cb.Function > > { > > @Override > > public void apply(MemorySegment ssl, int where, int ret) { > > EngineState state = getState(ssl); > > diff --git a/java/org/apache/tomcat/util/openssl/openssl_h.java > > b/java/org/apache/tomcat/util/openssl/openssl_h.java > > index 1c5ce8ef83..8bff6604e1 100644 > > --- a/java/org/apache/tomcat/util/openssl/openssl_h.java > > +++ b/java/org/apache/tomcat/util/openssl/openssl_h.java > > @@ -7803,53 +7803,53 @@ public class openssl_h { > > } > > } > > > > - private static class SSL_set_info_callback { > > + private static class SSL_CTX_set_info_callback { > > public static final FunctionDescriptor DESC = > > FunctionDescriptor.ofVoid(openssl_h.C_POINTER, > > openssl_h.C_POINTER); > > > > - public static final MemorySegment ADDR = > > openssl_h.findOrThrow("SSL_set_info_callback"); > > + public static final MemorySegment ADDR = > > openssl_h.findOrThrow("SSL_CTX_set_info_callback"); > > > > public static final MethodHandle HANDLE = > > Linker.nativeLinker().downcallHandle(ADDR, DESC); > > } > > > > /** > > * Function descriptor for: > > - * {@snippet lang = c : * void SSL_set_info_callback(SSL *ssl, void > > (*cb)(const SSL *, int, int)) > > + * {@snippet lang = c : * void SSL_CTX_set_info_callback(SSL_CTX *ctx, > > void (*cb)(const SSL *, int, int)) > > * } > > */ > > - public static FunctionDescriptor SSL_set_info_callback$descriptor() { > > - return SSL_set_info_callback.DESC; > > + public static FunctionDescriptor > > SSL_CTX_set_info_callback$descriptor() { > > + return SSL_CTX_set_info_callback.DESC; > > } > > > > /** > > * Downcall method handle for: > > - * {@snippet lang = c : * void SSL_set_info_callback(SSL *ssl, void > > (*cb)(const SSL *, int, int)) > > + * {@snippet lang = c : * void SSL_CTX_set_info_callback(SSL_CTX *ctx, > > void (*cb)(const SSL *, int, int)) > > * } > > */ > > - public static MethodHandle SSL_set_info_callback$handle() { > > - return SSL_set_info_callback.HANDLE; > > + public static MethodHandle SSL_CTX_set_info_callback$handle() { > > + return SSL_CTX_set_info_callback.HANDLE; > > } > > > > /** > > * Address for: > > - * {@snippet lang = c : * void SSL_set_info_callback(SSL *ssl, void > > (*cb)(const SSL *, int, int)) > > + * {@snippet lang = c : * void SSL_CTX_set_info_callback(SSL *ctx, > > void (*cb)(const SSL *, int, int)) > > * } > > */ > > - public static MemorySegment SSL_set_info_callback$address() { > > - return SSL_set_info_callback.ADDR; > > + public static MemorySegment SSL_CTX_set_info_callback$address() { > > + return SSL_CTX_set_info_callback.ADDR; > > } > > > > /** > > - * {@snippet lang = c : * void SSL_set_info_callback(SSL *ssl, void > > (*cb)(const SSL *, int, int)) > > + * {@snippet lang = c : * void SSL_CTX_set_info_callback(SSL_CTX *ctx, > > void (*cb)(const SSL *, int, int)) > > * } > > */ > > - public static void SSL_set_info_callback(MemorySegment ssl, > > MemorySegment cb) { > > - var mh$ = SSL_set_info_callback.HANDLE; > > + public static void SSL_CTX_set_info_callback(MemorySegment ctx, > > MemorySegment cb) { > > + var mh$ = SSL_CTX_set_info_callback.HANDLE; > > try { > > if (TRACE_DOWNCALLS) { > > - traceDowncall("SSL_set_info_callback", ssl, cb); > > + traceDowncall("SSL_CTX_set_info_callback", ctx, cb); > > } > > - mh$.invokeExact(ssl, cb); > > + mh$.invokeExact(ctx, cb); > > } catch (Throwable ex$) { > > throw new AssertionError("should not reach here", ex$); > > } > > diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml > > index 27de6fa631..8a7cc42f52 100644 > > --- a/webapps/docs/changelog.xml > > +++ b/webapps/docs/changelog.xml > > @@ -708,6 +708,10 @@ > > frame size limit before writing it and close the connection with > > an > > <code>INTERNAL_ERROR</code> if a header block can not be written. > > (markt) > > </fix> > > + <fix> > > + <bug>70305</bug>: Move callback registrations in FFM code to the > > + SSL context. (remm) > > + </fix> > > </changelog> > > </subsection> > > <subsection name="Jasper"> > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: [email protected] > > For additional commands, e-mail: [email protected] > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
