You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2021/12/01 16:46:56 UTC
[tomcat] branch 9.0.x updated: Align behaviour on MacOs with Linux/Windows
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new 4cd533b Align behaviour on MacOs with Linux/Windows
4cd533b is described below
commit 4cd533b7b298a83bc96a74ebc37f8b92b898fd39
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Wed Dec 1 16:39:31 2021 +0000
Align behaviour on MacOs with Linux/Windows
---
.../apache/tomcat/util/net/openssl/OpenSSLContext.java | 18 ++++++++++++++----
webapps/docs/changelog.xml | 5 +++++
2 files changed, 19 insertions(+), 4 deletions(-)
diff --git a/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java b/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java
index ed0b5af..d942d4c 100644
--- a/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java
+++ b/java/org/apache/tomcat/util/net/openssl/OpenSSLContext.java
@@ -379,10 +379,20 @@ public class OpenSSLContext implements org.apache.tomcat.util.net.SSLContext {
}
}
} else {
- // Client certificate verification based on trusted CA files and dirs
- SSLContext.setCACertificate(ctx,
- SSLHostConfig.adjustRelativePath(sslHostConfig.getCaCertificateFile()),
- SSLHostConfig.adjustRelativePath(sslHostConfig.getCaCertificatePath()));
+ if (sslHostConfig.getCaCertificateFile() == null && sslHostConfig.getCaCertificatePath() == null) {
+ // No CA certificates configured. Reject all client certificates.
+ SSLContext.setCertVerifyCallback(ctx, new CertificateVerifier() {
+ @Override
+ public boolean verify(long ssl, byte[][] chain, String auth) {
+ return false;
+ }
+ });
+ } else {
+ // Client certificate verification based on trusted CA files and dirs
+ SSLContext.setCACertificate(ctx,
+ SSLHostConfig.adjustRelativePath(sslHostConfig.getCaCertificateFile()),
+ SSLHostConfig.adjustRelativePath(sslHostConfig.getCaCertificatePath()));
+ }
}
if (negotiableProtocols != null && negotiableProtocols.size() > 0) {
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 8bd4b5c..bbc985a 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -172,6 +172,11 @@
and the first request received after starting is an HTTP request to a
TLS enabled NIO2 connector. (markt)
</fix>
+ <add>
+ Ensure that using NIO or NIO2 with OpenSSL for TLS behaves the same way
+ on MacOS as it does on Linux and Windows when no trusted certificate
+ authorities are configured and reject all client certificates. (markt)
+ </add>
</changelog>
</subsection>
<subsection name="Other">
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org