Author: remy.maucherat(a)jboss.com Date: 2010-03-25 13:17:13 -0400 (Thu, 25 Mar 2010) New Revision: 1420 Modified: trunk/java/org/apache/catalina/core/AprLifecycleListener.java trunk/java/org/apache/tomcat/jni/SSL.java trunk/java/org/apache/tomcat/util/net/AprEndpoint.java trunk/java/org/apache/tomcat/util/net/res/LocalStrings.properties Log: - Port SSL renegotiation option. Modified: trunk/java/org/apache/catalina/core/AprLifecycleListener.java =================================================================== --- trunk/java/org/apache/catalina/core/AprLifecycleListener.java 2010-03-25 02:48:03 UTC (rev 1419) +++ trunk/java/org/apache/catalina/core/AprLifecycleListener.java 2010-03-25 17:17:13 UTC (rev 1420) @@ -58,7 +58,7 @@ protected static final int TCN_REQUIRED_MAJOR = 1; protected static final int TCN_REQUIRED_MINOR = 1; protected static final int TCN_REQUIRED_PATCH = 8; - protected static final int TCN_RECOMMENDED_PV = 17; + protected static final int TCN_RECOMMENDED_PV = 21; // ---------------------------------------------- Properties Modified: trunk/java/org/apache/tomcat/jni/SSL.java =================================================================== --- trunk/java/org/apache/tomcat/jni/SSL.java 2010-03-25 02:48:03 UTC (rev 1419) +++ trunk/java/org/apache/tomcat/jni/SSL.java 2010-03-25 17:17:13 UTC (rev 1420) @@ -116,6 +116,10 @@ /* As server, disallow session resumption on renegotiation */ public static final int SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION = 0x00010000; + /* Permit unsafe legacy renegotiation */ + public static final int SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION = 0x00040000; + /* If set, always create a new key when using tmp_eddh parameters */ + public static final int SSL_OP_SINGLE_ECDH_USE = 0x00080000; /* If set, always create a new key when using tmp_dh parameters */ public static final int SSL_OP_SINGLE_DH_USE = 0x00100000; /* Set to always use the tmp_rsa key when doing RSA operations, @@ -323,4 +327,16 @@ * Return last SSL error string */ public static native String getLastError(); + + /** + * Return true if SSL_OP_ if defined. + * <p> + * Currently used for testing weather the + * SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION is supported by OpenSSL. + * <p> + * @param op SSL_OP to test. + * @return true if SSL_OP is supported by OpenSSL library. + */ + public static native boolean hasOp(int op); + } Modified: trunk/java/org/apache/tomcat/util/net/AprEndpoint.java =================================================================== --- trunk/java/org/apache/tomcat/util/net/AprEndpoint.java 2010-03-25 02:48:03 UTC (rev 1419) +++ trunk/java/org/apache/tomcat/util/net/AprEndpoint.java 2010-03-25 17:17:13 UTC (rev 1420) @@ -469,6 +469,14 @@ public void setSSLVerifyDepth(int SSLVerifyDepth) { this.SSLVerifyDepth = SSLVerifyDepth; } + /** + * SSL allow insecure renegotiation for the the client that does not + * support the secure renegotiation. + */ + protected boolean SSLInsecureRenegotiation = false; + public void setSSLInsecureRenegotiation(boolean SSLInsecureRenegotiation) { this.SSLInsecureRenegotiation = SSLInsecureRenegotiation; } + public boolean getSSLInsecureRenegotiation() { return SSLInsecureRenegotiation; } + // --------------------------------------------------------- Public Methods @@ -636,6 +644,16 @@ } // Create SSL Context sslContext = SSLContext.make(rootPool, value, (reverseConnection) ? SSL.SSL_MODE_CLIENT : SSL.SSL_MODE_SERVER); + // SSL renegociation + if (SSLInsecureRenegotiation) { + if (SSL.hasOp(SSL.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) + SSLContext.setOptions(sslContext, SSL.SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION); + else { + // OpenSSL does not support unsafe legacy renegotiation. + log.warn(sm.getString("endpoint.warn.noInsecureReneg", + SSL.versionString())); + } + } // List the ciphers that the client is permitted to negotiate SSLContext.setCipherSuite(sslContext, SSLCipherSuite); // Load Server key and certificate Modified: trunk/java/org/apache/tomcat/util/net/res/LocalStrings.properties =================================================================== --- trunk/java/org/apache/tomcat/util/net/res/LocalStrings.properties 2010-03-25 02:48:03 UTC (rev 1419) +++ trunk/java/org/apache/tomcat/util/net/res/LocalStrings.properties 2010-03-25 17:17:13 UTC (rev 1420) @@ -26,3 +26,4 @@ endpoint.sendfile.error=Unexpected sendfile error endpoint.sendfile.addfail=Sendfile failure: [{0}] {1} endpoint.sendfile.nosupport=Disabling sendfile, since either the APR version or the system doesn't support it +endpoint.warn.noInsecureReneg=Secure renegotation is not supported by the SSL library {0}