Author: markt
Date: Thu Apr 28 19:56:49 2016
New Revision: 1741503
URL: http://svn.apache.org/viewvc?rev=1741503&view=rev
Log:
Work around a known issue in OpenSSL
(https://github.com/openssl/openssl/issues/188) that does not permit the TLS
handshake to be failed if the ALPN negotiation fails.
Modified:
tomcat/tc8.5.x/trunk/ (props changed)
tomcat/tc8.5.x/trunk/java/org/apache/coyote/AbstractProtocol.java
tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml
Propchange: tomcat/tc8.5.x/trunk/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Thu Apr 28 19:56:49 2016
@@ -1 +1 @@
-/tomcat/trunk:1734785,1734799,1734845,1734928,1735041,1735044,1735480,1735577,1735597,1735599-1735600,1735615,1736145,1736162,1736209,1736280,1736297,1736299,1736489,1736646,1736703,1736836,1736849,1737104-1737105,1737112,1737117,1737119-1737120,1737155,1737157,1737192,1737280,1737339,1737632,1737664,1737715,1737748,1737785,1737834,1737860,1737959,1738005,1738007,1738014-1738015,1738018,1738022,1738039,1738043,1738059-1738060,1738147,1738149,1738174-1738175,1738261,1738589,1738623-1738625,1738643,1738816,1738850,1738855,1738946-1738948,1738953-1738954,1738979,1738982,1739079-1739081,1739087,1739113,1739153,1739172,1739176,1739191,1739474,1739726,1739762,1739775,1739814,1739817-1739818,1739975,1740131,1740324,1740465,1740495,1740508-1740509,1740520,1740535,1740707,1740803,1740810,1740969,1740980,1740991,1740997,1741015,1741033,1741036,1741058,1741060,1741080,1741147,1741159,1741164,1741173,1741181,1741190,1741197,1741202,1741208,1741213,1741221,1741225,1741232,1741409
+/tomcat/trunk:1734785,1734799,1734845,1734928,1735041,1735044,1735480,1735577,1735597,1735599-1735600,1735615,1736145,1736162,1736209,1736280,1736297,1736299,1736489,1736646,1736703,1736836,1736849,1737104-1737105,1737112,1737117,1737119-1737120,1737155,1737157,1737192,1737280,1737339,1737632,1737664,1737715,1737748,1737785,1737834,1737860,1737959,1738005,1738007,1738014-1738015,1738018,1738022,1738039,1738043,1738059-1738060,1738147,1738149,1738174-1738175,1738261,1738589,1738623-1738625,1738643,1738816,1738850,1738855,1738946-1738948,1738953-1738954,1738979,1738982,1739079-1739081,1739087,1739113,1739153,1739172,1739176,1739191,1739474,1739726,1739762,1739775,1739814,1739817-1739818,1739975,1740131,1740324,1740465,1740495,1740508-1740509,1740520,1740535,1740707,1740803,1740810,1740969,1740980,1740991,1740997,1741015,1741033,1741036,1741058,1741060,1741080,1741147,1741159,1741164,1741173,1741181,1741190,1741197,1741202,1741208,1741213,1741221,1741225,1741232,1741409,1741501
Modified: tomcat/tc8.5.x/trunk/java/org/apache/coyote/AbstractProtocol.java
URL:
http://svn.apache.org/viewvc/tomcat/tc8.5.x/trunk/java/org/apache/coyote/AbstractProtocol.java?rev=1741503&r1=1741502&r2=1741503&view=diff
==============================================================================
--- tomcat/tc8.5.x/trunk/java/org/apache/coyote/AbstractProtocol.java (original)
+++ tomcat/tc8.5.x/trunk/java/org/apache/coyote/AbstractProtocol.java Thu Apr
28 19:56:49 2016
@@ -733,10 +733,27 @@ public abstract class AbstractProtocol<S
// Explicitly negotiated the default protocol.
// Obtain a processor below.
} else {
+ // TODO:
+ // OpenSSL 1.0.2's ALPN callback doesn't support
+ // failing the handshake with an error if no
+ // protocol can be negotiated. Therefore, we need
to
+ // fail the connection here. Once this is fixed,
+ // replace the code below with the commented out
+ // block.
+ if (getLog().isDebugEnabled()) {
+ getLog().debug(sm.getString(
+
"abstractConnectionHandler.negotiatedProcessor.fail",
+ negotiatedProtocol));
+ }
+ return SocketState.CLOSED;
+ /*
+ * To replace the code above once OpenSSL 1.1.0 is
+ * used.
// Failed to create processor. This is a bug.
throw new IllegalStateException(sm.getString(
"abstractConnectionHandler.negotiatedProcessor.fail",
negotiatedProtocol));
+ */
}
}
}
Modified: tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml
URL:
http://svn.apache.org/viewvc/tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml?rev=1741503&r1=1741502&r2=1741503&view=diff
==============================================================================
--- tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml (original)
+++ tomcat/tc8.5.x/trunk/webapps/docs/changelog.xml Thu Apr 28 19:56:49 2016
@@ -207,6 +207,11 @@
JSSE+OpenSSL with the certificate chain stored in a Java KeyStore.
(markt)
</fix>
+ <fix>
+ Work around <a herf="https://github.com/openssl/openssl/issues/188";>a
+ known issue in OpenSSL</a> that does not permit the TLS handshake to be
+ failed if the ALPN negotiation fails. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="WebSocket">
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
