(tomcat-native) branch 1.3.x updated: Add support for the extended range of options in OpenSSL 3.x onwards

This is an automated email from the ASF dual-hosted git repository.

markt-asf pushed a commit to branch 1.3.x
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git


The following commit(s) were added to refs/heads/1.3.x by this push:
     new 77a879910 Add support for the extended range of options in OpenSSL 3.x onwards
77a879910 is described below

commit 77a87991079211805f41ddb2c51067bb807dcb40
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Aug 26 17:25:38 2026 +0100

    Add support for the extended range of options in OpenSSL 3.x onwards
    
    This will need matching changes in Tomcat
---
 native/src/ssl.c                  | 34 ++++++++++++++++++++++++++++------
 native/src/sslcontext.c           | 35 +++++++++++++++++++++++++++++------
 xdocs/miscellaneous/changelog.xml |  6 ++++++
 3 files changed, 63 insertions(+), 12 deletions(-)

diff --git a/native/src/ssl.c b/native/src/ssl.c
index 5a5db774b..99705d88c 100644
--- a/native/src/ssl.c
+++ b/native/src/ssl.c
@@ -1609,16 +1609,38 @@ TCN_IMPLEMENT_CALL(void, SSL, setOptions)(TCN_STDARGS, jlong ssl,
         return;
     }
 
-#ifndef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
-    /* Clear the flag if not supported */
-    if (opt & 0x00040000) {
-        opt &= ~0x00040000;
+    SSL_set_options(ssl_, ((jlong) opt) & 0xFFFFFFFFLL);
+}
+
+TCN_IMPLEMENT_CALL(jint, SSL, getOptions)(TCN_STDARGS, jlong ssl)
+{
+    SSL *ssl_ = J2P(ssl, SSL *);
+
+    UNREFERENCED_STDARGS;
+
+    if (ssl_ == NULL) {
+        tcn_ThrowException(e, "ssl is null");
+        return 0;
     }
-#endif
+
+    return SSL_get_options(ssl_);
+}
+
+TCN_IMPLEMENT_CALL(void, SSL, setOptionsLong)(TCN_STDARGS, jlong ssl, jlong opt)
+{
+    SSL *ssl_ = J2P(ssl, SSL *);
+
+    UNREFERENCED_STDARGS;
+
+    if (ssl_ == NULL) {
+        tcn_ThrowException(e, "ssl is null");
+        return;
+    }
+
     SSL_set_options(ssl_, opt);
 }
 
-TCN_IMPLEMENT_CALL(jint, SSL, getOptions)(TCN_STDARGS, jlong ssl)
+TCN_IMPLEMENT_CALL(jlong, SSL, getOptionsLong)(TCN_STDARGS, jlong ssl)
 {
     SSL *ssl_ = J2P(ssl, SSL *);
 
diff --git a/native/src/sslcontext.c b/native/src/sslcontext.c
index 3fec8e5a7..6a14afa03 100644
--- a/native/src/sslcontext.c
+++ b/native/src/sslcontext.c
@@ -481,12 +481,7 @@ TCN_IMPLEMENT_CALL(void, SSLContext, setOptions)(TCN_STDARGS, jlong ctx,
 
     UNREFERENCED_STDARGS;
     TCN_ASSERT(ctx != 0);
-#ifndef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
-    /* Clear the flag if not supported */
-    if (opt & 0x00040000)
-        opt &= ~0x00040000;
-#endif
-    SSL_CTX_set_options(c->ctx, opt);
+    SSL_CTX_set_options(c->ctx, ((jlong) opt) & 0xFFFFFFFFLL);
 }
 
 TCN_IMPLEMENT_CALL(jint, SSLContext, getOptions)(TCN_STDARGS, jlong ctx)
@@ -504,6 +499,34 @@ TCN_IMPLEMENT_CALL(void, SSLContext, clearOptions)(TCN_STDARGS, jlong ctx,
 {
     tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
 
+    UNREFERENCED_STDARGS;
+    TCN_ASSERT(ctx != 0);
+    SSL_CTX_clear_options(c->ctx, ((jlong) opt) & 0xFFFFFFFFLL);
+}
+
+TCN_IMPLEMENT_CALL(void, SSLContext, setOptionsLong)(TCN_STDARGS, jlong ctx, jlong opt)
+{
+    tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
+
+    UNREFERENCED_STDARGS;
+    TCN_ASSERT(ctx != 0);
+    SSL_CTX_set_options(c->ctx, opt);
+}
+
+TCN_IMPLEMENT_CALL(jlong, SSLContext, getOptionsLong)(TCN_STDARGS, jlong ctx)
+{
+    tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
+
+    UNREFERENCED_STDARGS;
+    TCN_ASSERT(ctx != 0);
+
+    return SSL_CTX_get_options(c->ctx);
+}
+
+TCN_IMPLEMENT_CALL(void, SSLContext, clearOptionsLong)(TCN_STDARGS, jlong ctx, jlong opt)
+{
+    tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
+
     UNREFERENCED_STDARGS;
     TCN_ASSERT(ctx != 0);
     SSL_CTX_clear_options(c->ctx, opt);
diff --git a/xdocs/miscellaneous/changelog.xml b/xdocs/miscellaneous/changelog.xml
index 60108f558..2630de66c 100644
--- a/xdocs/miscellaneous/changelog.xml
+++ b/xdocs/miscellaneous/changelog.xml
@@ -46,6 +46,12 @@
       protocol in the list, use it rather than the last protocol offered by the
       client. (markt)
     </fix>
+    <fix>
+      Add support for the extended range of options available from OpenSSL
+      3.0.x. The options flag is now a 64-bit unsigned int (represented by a
+      Java long) rather than a 32-bit unsigned int (represented by a Java int). 
+      (markt)
+    </fix>
   </changelog>
 </section>
 <section name="1.3.8" rtext="2026-06-15">