This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new f3cdf3f544 Avoid callback registrations in engine
f3cdf3f544 is described below
commit f3cdf3f5448bd3123f6385b2e27ba4a234a63034
Author: remm <[email protected]>
AuthorDate: Wed Nov 4 00:35:50 2026 +0100
Avoid callback registrations in engine
This is indeed not needed, so better not do it. I did not consider there
was a meaningful cost, so I had left it in.
BZ70305
---
.../util/net/openssl/panama/OpenSSLContext.java | 4 +++
.../util/net/openssl/panama/OpenSSLEngine.java | 10 +++----
java/org/apache/tomcat/util/openssl/openssl_h.java | 32 +++++++++++-----------
webapps/docs/changelog.xml | 4 +++
4 files changed, 28 insertions(+), 22 deletions(-)
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
index 121e95fe7d..06fab40470 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
@@ -72,6 +72,7 @@ import
org.apache.tomcat.util.openssl.SSL_CTX_set_verify$callback;
import org.apache.tomcat.util.openssl.SSL_psk_client_cb_func;
import org.apache.tomcat.util.openssl.SSL_psk_server_cb_func;
import org.apache.tomcat.util.openssl.SSL_psk_use_session_cb_func;
+import org.apache.tomcat.util.openssl.SSL_set_info_callback$cb;
import org.apache.tomcat.util.openssl.openssl_h;
import org.apache.tomcat.util.openssl.openssl_h_Compatibility;
import org.apache.tomcat.util.openssl.pem_password_cb;
@@ -272,6 +273,9 @@ public class OpenSSLContext implements
org.apache.tomcat.util.net.SSLContext {
// Set int pem_password_cb(char *buf, int size, int rwflag, void
*u) callback
SSL_CTX_set_default_passwd_cb(sslCtx,
pem_password_cb.allocate(new PasswordCallback(null), contextArena));
+ // Set ssl_info_callback
+ SSL_CTX_set_info_callback(sslCtx,
SSL_set_info_callback$cb.allocate(new OpenSSLEngine.InfoCallback(),
contextArena));
+
// Set server groups
// Note: It is also possible to override setSSLParameters in
OpenSSLEngine to set the final
// list of groups per connection, but this is less efficient than
setting the configured
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
index b34ec1a39f..6f09163d2f 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
@@ -198,8 +198,6 @@ public final class OpenSSLEngine extends SSLEngine
implements SSLUtil.ProtocolIn
if (MemorySegment.NULL.equals(ssl)) {
throw new IllegalStateException(sm.getString("engine.noSSL",
OpenSSLLibrary.getLastError()));
}
- // Set ssl_info_callback
- SSL_set_info_callback(ssl, SSL_set_info_callback$cb.allocate(new
InfoCallback(), engineArena));
if (clientMode) {
SSL_set_connect_state(ssl);
} else {
@@ -1122,14 +1120,14 @@ public final class OpenSSLEngine extends SSLEngine
implements SSLUtil.ProtocolIn
case REQUIRE -> SSL_VERIFY_PEER() |
SSL_VERIFY_FAIL_IF_NO_PEER_CERT();
case OPTIONAL -> SSL_VERIFY_PEER();
};
- // Note: Since a callback is always set by the context, the
callback here could in theory
- // be set to NULL (at the time of creation of the SSL, the SSL_CTX
will have a non-null callback)
- SSL_set_verify(state.ssl, value,
SSL_set_verify$callback.allocate(new VerifyCallback(), engineArena));
+ // Note: Since a callback is always set by the context, the
callback here can be set to NULL
+ // (at the time of creation of the SSL, the SSL_CTX will have a
non-null callback)
+ SSL_set_verify(state.ssl, value, MemorySegment.NULL);
clientAuth = mode;
}
}
- private static class InfoCallback implements SSL_set_info_callback$cb.Function {
+ static class InfoCallback implements SSL_set_info_callback$cb.Function {
@Override
public void apply(MemorySegment ssl, int where, int ret) {
EngineState state = getState(ssl);
diff --git a/java/org/apache/tomcat/util/openssl/openssl_h.java
b/java/org/apache/tomcat/util/openssl/openssl_h.java
index 1c5ce8ef83..8bff6604e1 100644
--- a/java/org/apache/tomcat/util/openssl/openssl_h.java
+++ b/java/org/apache/tomcat/util/openssl/openssl_h.java
@@ -7803,53 +7803,53 @@ public class openssl_h {
}
}
- private static class SSL_set_info_callback {
+ private static class SSL_CTX_set_info_callback {
public static final FunctionDescriptor DESC =
FunctionDescriptor.ofVoid(openssl_h.C_POINTER,
openssl_h.C_POINTER);
- public static final MemorySegment ADDR = openssl_h.findOrThrow("SSL_set_info_callback");
+ public static final MemorySegment ADDR =
openssl_h.findOrThrow("SSL_CTX_set_info_callback");
public static final MethodHandle HANDLE = Linker.nativeLinker().downcallHandle(ADDR, DESC);
}
/**
* Function descriptor for:
- * {@snippet lang = c : * void SSL_set_info_callback(SSL *ssl, void
(*cb)(const SSL *, int, int))
+ * {@snippet lang = c : * void SSL_CTX_set_info_callback(SSL_CTX *ctx,
void (*cb)(const SSL *, int, int))
* }
*/
- public static FunctionDescriptor SSL_set_info_callback$descriptor() {
- return SSL_set_info_callback.DESC;
+ public static FunctionDescriptor SSL_CTX_set_info_callback$descriptor() {
+ return SSL_CTX_set_info_callback.DESC;
}
/**
* Downcall method handle for:
- * {@snippet lang = c : * void SSL_set_info_callback(SSL *ssl, void
(*cb)(const SSL *, int, int))
+ * {@snippet lang = c : * void SSL_CTX_set_info_callback(SSL_CTX *ctx,
void (*cb)(const SSL *, int, int))
* }
*/
- public static MethodHandle SSL_set_info_callback$handle() {
- return SSL_set_info_callback.HANDLE;
+ public static MethodHandle SSL_CTX_set_info_callback$handle() {
+ return SSL_CTX_set_info_callback.HANDLE;
}
/**
* Address for:
- * {@snippet lang = c : * void SSL_set_info_callback(SSL *ssl, void
(*cb)(const SSL *, int, int))
+ * {@snippet lang = c : * void SSL_CTX_set_info_callback(SSL *ctx, void
(*cb)(const SSL *, int, int))
* }
*/
- public static MemorySegment SSL_set_info_callback$address() {
- return SSL_set_info_callback.ADDR;
+ public static MemorySegment SSL_CTX_set_info_callback$address() {
+ return SSL_CTX_set_info_callback.ADDR;
}
/**
- * {@snippet lang = c : * void SSL_set_info_callback(SSL *ssl, void
(*cb)(const SSL *, int, int))
+ * {@snippet lang = c : * void SSL_CTX_set_info_callback(SSL_CTX *ctx,
void (*cb)(const SSL *, int, int))
* }
*/
- public static void SSL_set_info_callback(MemorySegment ssl, MemorySegment
cb) {
- var mh$ = SSL_set_info_callback.HANDLE;
+ public static void SSL_CTX_set_info_callback(MemorySegment ctx,
MemorySegment cb) {
+ var mh$ = SSL_CTX_set_info_callback.HANDLE;
try {
if (TRACE_DOWNCALLS) {
- traceDowncall("SSL_set_info_callback", ssl, cb);
+ traceDowncall("SSL_CTX_set_info_callback", ctx, cb);
}
- mh$.invokeExact(ssl, cb);
+ mh$.invokeExact(ctx, cb);
} catch (Throwable ex$) {
throw new AssertionError("should not reach here", ex$);
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 27de6fa631..8a7cc42f52 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -708,6 +708,10 @@
frame size limit before writing it and close the connection with an
<code>INTERNAL_ERROR</code> if a header block can not be written.
(markt)
</fix>
+ <fix>
+ <bug>70305</bug>: Move callback registrations in FFM code to the
+ SSL context. (remm)
+ </fix>
</changelog>
</subsection>
<subsection name="Jasper">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
