You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by re...@apache.org on 2026/10/16 16:16:17 UTC
(tomcat) 08/25: Correct the FILE check for SSL_CONF commands in the OpenSSL FFM code
This is an automated email from the ASF dual-hosted git repository.
rmaucher pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit ae5bbf6a3c887dbb5b6fb300f56d61c773fede28
Author: opencode <re...@apache.org>
AuthorDate: Fri Oct 16 10:47:53 2026 +0200
Correct the FILE check for SSL_CONF commands in the OpenSSL FFM code
The checkConf() method of the panama OpenSSLContext rejected an
SSL_CONF_TYPE_FILE command only when the configured path was neither a
file nor readable, i.e. when both conditions failed. As a result, a
readable directory or an unreadable regular file passed the check and
the invalid value was only rejected later, when SSL_CONF_cmd tried to
load it, reporting a raw OpenSSL error instead of the clear
opensslconf.badFile message.
Use the intended 'not a file or not readable' test so that only a
readable regular file is accepted. This matches the behaviour of the
JNI/tomcat-native implementation, whose path_check() requires the path
to exist and to be a regular file. Symbolic links to readable regular
files continue to pass, since File.isFile() and File.canRead() resolve
links just like apr_stat() does on the JNI side.
---
java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
index 4ad3b80801..88a99ce4ae 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
@@ -383,7 +383,7 @@ public class OpenSSLContext implements org.apache.tomcat.util.net.SSLContext {
if (code == SSL_CONF_TYPE_FILE()) {
// Check file
File file = new File(value);
- if (!file.isFile() && !file.canRead()) {
+ if (!file.isFile() || !file.canRead()) {
log.error(sm.getString("opensslconf.badFile", name, value));
ok = false;
}
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org