You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2026/09/21 14:08:34 UTC
(tomcat) branch main updated (9e9d3a89b3 -> 44087b688a)
This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a change to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
from 9e9d3a89b3 Fix edge case with long certificate chain
new ea10b19d5c Mirror changes in Native for PSK support with TLS 1.2
new 44087b688a Align with recent Native changes to add PSK support
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../apache/tomcat/jni/PreSharedKeySelector.java | 54 ++++++++++++++++++++++
java/org/apache/tomcat/jni/SSLContext.java | 18 ++++++++
2 files changed, 72 insertions(+)
create mode 100644 java/org/apache/tomcat/jni/PreSharedKeySelector.java
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
(tomcat) 01/02: Mirror changes in Native for PSK support with TLS 1.2
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit ea10b19d5c4fc8b6e07d33e776e39110221d9285
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Mon Sep 21 12:01:00 2026 +0100
Mirror changes in Native for PSK support with TLS 1.2
---
.../apache/tomcat/jni/PreSharedKeySelector.java | 33 ++++++++++++++++++++++
java/org/apache/tomcat/jni/SSLContext.java | 9 ++++++
2 files changed, 42 insertions(+)
diff --git a/java/org/apache/tomcat/jni/PreSharedKeySelector.java b/java/org/apache/tomcat/jni/PreSharedKeySelector.java
new file mode 100644
index 0000000000..0cafc2a90a
--- /dev/null
+++ b/java/org/apache/tomcat/jni/PreSharedKeySelector.java
@@ -0,0 +1,33 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.tomcat.jni;
+
+/**
+ * Is called during a TLSv1.2 handshake and hooked into OpenSSL via {@code SSL_CTX_set_psk_server_callback}.
+ */
+public interface PreSharedKeySelector {
+
+ /**
+ * Selects the pre-shared key for the provided identity.
+ *
+ * @param ssl the SSL instance
+ * @param identity the PSK identity provided by the client
+ *
+ * @return the pre-shared key, or {@code null} if the identity is not recognized
+ */
+ byte[] select(long ssl, String identity);
+}
diff --git a/java/org/apache/tomcat/jni/SSLContext.java b/java/org/apache/tomcat/jni/SSLContext.java
index 24dbbfdd64..ea3ef2c7ab 100644
--- a/java/org/apache/tomcat/jni/SSLContext.java
+++ b/java/org/apache/tomcat/jni/SSLContext.java
@@ -471,6 +471,15 @@ public final class SSLContext {
*/
public static native void setCertVerifyCallback(long ctx, CertificateVerifier verifier);
+ /**
+ * Allow to hook {@link PreSharedKeySelector} into the TLSv1.2 handshake processing. This will call
+ * {@code SSL_CTX_set_psk_server_callback}.
+ *
+ * @param ctx Server context to use.
+ * @param selector the selector to call during handshake, or {@code null} to remove the current selector
+ */
+ public static native void setPskServerCallback(long ctx, PreSharedKeySelector selector);
+
/**
* Set application layer protocol for application layer protocol negotiation extension
*
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: (tomcat) 02/02: Align with recent Native changes to add PSK support
Posted by Mark Thomas <ma...@apache.org>.
On 21/09/2026 15:08, markt@apache.org wrote:
> This is an automated email from the ASF dual-hosted git repository.
>
> markt-asf pushed a commit to branch main
> in repository https://gitbox.apache.org/repos/asf/tomcat.git
>
> commit 44087b688a8abd81fa7856f630838b360a129688
> Author: Mark Thomas <ma...@apache.org>
> AuthorDate: Mon Sep 21 15:07:15 2026 +0100
>
> Align with recent Native changes to add PSK support
>
> Still requires changes in OpenSSLContext for this to be usable.
FYI - I can get this working fairly easily with some hard coded options
in OpenSSLContext.
Next up is a new SSLHostConfigPreSharedKey element. From there I am
expecting it to be mostly plumbing.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
(tomcat) 02/02: Align with recent Native changes to add PSK support
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 44087b688a8abd81fa7856f630838b360a129688
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Mon Sep 21 15:07:15 2026 +0100
Align with recent Native changes to add PSK support
Still requires changes in OpenSSLContext for this to be usable.
---
.../apache/tomcat/jni/PreSharedKeySelector.java | 25 ++++++++++++++++++++--
java/org/apache/tomcat/jni/SSLContext.java | 9 ++++++++
2 files changed, 32 insertions(+), 2 deletions(-)
diff --git a/java/org/apache/tomcat/jni/PreSharedKeySelector.java b/java/org/apache/tomcat/jni/PreSharedKeySelector.java
index 0cafc2a90a..1b4f738f78 100644
--- a/java/org/apache/tomcat/jni/PreSharedKeySelector.java
+++ b/java/org/apache/tomcat/jni/PreSharedKeySelector.java
@@ -17,7 +17,9 @@
package org.apache.tomcat.jni;
/**
- * Is called during a TLSv1.2 handshake and hooked into OpenSSL via {@code SSL_CTX_set_psk_server_callback}.
+ * The interface for the Tomcat code that responds to the callback from the OpenSSL layer in Tomcat Native to allow
+ * Tomcat to select a pre-shared key. It supports TLSv1.2 {@code SSL_CTX_set_psk_server_callback} and TLSv1.3
+ * {@code SSL_CTX_set_psk_find_session_callback}.
*/
public interface PreSharedKeySelector {
@@ -27,7 +29,26 @@ public interface PreSharedKeySelector {
* @param ssl the SSL instance
* @param identity the PSK identity provided by the client
*
- * @return the pre-shared key, or {@code null} if the identity is not recognized
+ * @return the pre-shared key, or {@code null} if the identity is not recognized. OpenSSL limits the key to between
+ * 1 and 512 bytes long (inclusive). If the byte sequence is truly random then 16 bytes are recommended
+ * for 128-bit ciphers and 32 bytes for 256-bit ciphers.
*/
byte[] select(long ssl, String identity);
+
+ /**
+ * Selects the TLSv1.3 pre-shared key and digest for the provided identity.
+ * <p>
+ * The callback is a little more complex for TLSv1.3. The return value is still the pre-shared key but OpenSSL also
+ * needs to know which digest to use. Because the OpenSSL API only exposes a cipher for this, that is what Tomcat
+ * populates the {@code cipherSuite} array with but only the digest is relevant.
+ *
+ * @param ssl the SSL instance
+ * @param identity the PSK identity provided by the client
+ * @param cipherSuite a single-element array that must be populated with a IANA TLSv1.3 cipher suite identifier
+ *
+ * @return the pre-shared key (strictly the input to the KDF), or {@code null} if the identity is not recognized.
+ * OpenSSL limits the key to between 1 and 48 bytes long (inclusive). If the byte sequence is truly
+ * random then 16 bytes are recommended for 128-bit ciphers and 32 bytes for 256-bit ciphers.
+ */
+ byte[] select(long ssl, byte[] identity, int[] cipherSuite);
}
diff --git a/java/org/apache/tomcat/jni/SSLContext.java b/java/org/apache/tomcat/jni/SSLContext.java
index ea3ef2c7ab..1a01d947cc 100644
--- a/java/org/apache/tomcat/jni/SSLContext.java
+++ b/java/org/apache/tomcat/jni/SSLContext.java
@@ -480,6 +480,15 @@ public final class SSLContext {
*/
public static native void setPskServerCallback(long ctx, PreSharedKeySelector selector);
+ /**
+ * Allow to hook {@link PreSharedKeySelector} into the TLSv1.3 handshake processing. This will call
+ * {@code SSL_CTX_set_psk_find_session_callback}.
+ *
+ * @param ctx Server context to use.
+ * @param selector the selector to call during handshake, or {@code null} to remove the current selector
+ */
+ public static native void setPskFindSessionCallback(long ctx, PreSharedKeySelector selector);
+
/**
* Set application layer protocol for application layer protocol negotiation extension
*
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org