This is an automated email from the ASF dual-hosted git repository.
remm pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new d96ab437d6 Use FFM to resolve OpenSSL profiles
d96ab437d6 is described below
commit d96ab437d6be7fffdc07817ff2b1c988d74be1c2
Author: remm <[email protected]>
AuthorDate: Tue Oct 24 11:53:48 2023 +0200
Use FFM to resolve OpenSSL profiles
---
java/org/apache/tomcat/util/net/SSLUtilBase.java | 4 ++--
.../ciphers/OpenSSLCipherConfigurationParser.java | 21 +++++++++++++++------
2 files changed, 17 insertions(+), 8 deletions(-)
diff --git a/java/org/apache/tomcat/util/net/SSLUtilBase.java
b/java/org/apache/tomcat/util/net/SSLUtilBase.java
index 70735293eb..410a80c5d8 100644
--- a/java/org/apache/tomcat/util/net/SSLUtilBase.java
+++ b/java/org/apache/tomcat/util/net/SSLUtilBase.java
@@ -59,6 +59,7 @@ import javax.net.ssl.X509KeyManager;
import org.apache.juli.logging.Log;
import org.apache.juli.logging.LogFactory;
+import org.apache.tomcat.util.compat.JreCompat;
import org.apache.tomcat.util.file.ConfigFileLoader;
import org.apache.tomcat.util.net.jsse.JSSEKeyManager;
import org.apache.tomcat.util.net.jsse.PEMFile;
@@ -124,9 +125,8 @@ public abstract class SSLUtilBase implements SSLUtil {
sslHostConfig.setTls13RenegotiationAvailable(isTls13RenegAuthAvailable());
// Calculate the enabled ciphers
- if (/*!JreCompat.isJre22Available() &&
*/sslHostConfig.getCiphers().startsWith("PROFILE=")) {
+ if (!JreCompat.isJre22Available() &&
sslHostConfig.getCiphers().startsWith("PROFILE=")) {
// OpenSSL profiles cannot be resolved without Java 22
- // TODO: sslHostConfig should query that with Panama if possible
this.enabledCiphers = new String[0];
} else {
boolean warnOnSkip =
!sslHostConfig.getCiphers().equals(SSLHostConfig.DEFAULT_TLS_CIPHERS);
diff --git
a/java/org/apache/tomcat/util/net/openssl/ciphers/OpenSSLCipherConfigurationParser.java
b/java/org/apache/tomcat/util/net/openssl/ciphers/OpenSSLCipherConfigurationParser.java
index 2599bf24c2..917f72074a 100644
---
a/java/org/apache/tomcat/util/net/openssl/ciphers/OpenSSLCipherConfigurationParser.java
+++
b/java/org/apache/tomcat/util/net/openssl/ciphers/OpenSSLCipherConfigurationParser.java
@@ -30,7 +30,10 @@ import java.util.Set;
import org.apache.juli.logging.Log;
import org.apache.juli.logging.LogFactory;
+import org.apache.tomcat.util.ExceptionUtils;
+import org.apache.tomcat.util.compat.JreCompat;
import org.apache.tomcat.util.net.Constants;
+import org.apache.tomcat.util.net.openssl.OpenSSLStatus;
import org.apache.tomcat.util.res.StringManager;
/**
@@ -714,13 +717,20 @@ public class OpenSSLCipherConfigurationParser {
String[] elements = expression.split(SEPARATOR);
// Handle PROFILE= using OpenSSL (if present, otherwise warn), then
replace elements with that
if (elements.length == 1 && elements[0].startsWith("PROFILE=")) {
- // Only use with Panama and if OpenSSL has been successfully
loaded before
- /* FIXME: Merge OpenSSL Panama code
+ // Only use with Java 22 and if OpenSSL has been successfully
loaded before
if (JreCompat.isJre22Available()) {
if (OpenSSLStatus.isLibraryInitialized()) {
- List<String> cipherList =
OpenSSLLibrary.findCiphers(elements[0]);
- // Replace the original list with the profile contents
- elements = cipherList.toArray(new String[0]);
+ try {
+ Class<?> openSSLLibraryClass =
Class.forName("org.apache.tomcat.util.net.openssl.panama.OpenSSLLibrary");
+ @SuppressWarnings("unchecked")
+ List<String> cipherList = (List<String>)
openSSLLibraryClass.getMethod("findCiphers").invoke(null, elements[0]);
+ // Replace the original list with the profile contents
+ elements = cipherList.toArray(new String[0]);
+ } catch (Throwable t) {
+ t = ExceptionUtils.unwrapInvocationTargetException(t);
+ ExceptionUtils.handleThrowable(t);
+
log.error(sm.getString("opensslCipherConfigurationParser.unknownProfile",
elements[0]), t);
+ }
} else {
// OpenSSL is not available
log.error(sm.getString("opensslCipherConfigurationParser.unknownProfile",
elements[0]));
@@ -730,7 +740,6 @@ public class OpenSSLCipherConfigurationParser {
// but it might still work if using tomcat-native
log.info(sm.getString("opensslCipherConfigurationParser.unknownProfile",
elements[0]));
}
- */
}
LinkedHashSet<Cipher> ciphers = new LinkedHashSet<>();
Set<Cipher> removedCiphers = new HashSet<>();
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
