WolfSSL
/
wolfssljni
mirror of https://github.com/wolfSSL/wolfssljni.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #400 from cconlon/fenrirAug13_2 

Fenrir fixes for resource cleanup, JNI type handling, and protocol/key-size validation
pull/399/head
Ruby Martin 2026-08-17 14:25:27 -05:00 committed by GitHub
parent b2006025ba 3a2c837632
commit 752ebf6abd
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
8 changed files with 74 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
native/com_wolfssl_WolfSSL.c
View File

@ -2644,15 +2644,17 @@ JNIEXPORT jstring JNICALL Java_com_wolfssl_WolfSSL_getAvailableCipherSuitesIana
ianaName = cipherName;
#endif
if (ianaName != NULL) {
/* colon separated list */
if (i != 0 && (XSTRLEN(cipherList) + 1) < sizeof(cipherList)) {
/* colon separated list, only prepend separator once cipherList
* already holds a name */
if (cipherList[0] != '\0' &&
(XSTRLEN(cipherList) + 1) < sizeof(cipherList)) {
XSTRNCAT(cipherList, ":",
sizeof(cipherList) - XSTRLEN(cipherList) - 1);
sizeof(cipherList) - XSTRLEN(cipherList) - 1);
}
if ((XSTRLEN(ianaName) + XSTRLEN(cipherList) + 1) <
sizeof(cipherList)) {
sizeof(cipherList)) {
XSTRNCAT(cipherList, ianaName,
sizeof(cipherList) - XSTRLEN(cipherList) - 1);
sizeof(cipherList) - XSTRLEN(cipherList) - 1);
}
}
}
@ -2914,7 +2916,7 @@ JNIEXPORT jobjectArray JNICALL Java_com_wolfssl_WolfSSL_getProtocolsMask
}
#endif /* WOLFSSL_ALLOW_TLSv10 */
#endif /* !NO_OLD_TLS */
#ifdef WOLFSSL_ALLOW_SSLv3
#ifdef WOLFSSL_ALLOW_SSLV3
if(!(mask & SSL_OP_NO_SSLv3)) {
numProtocols += 1;
}
@ -2977,7 +2979,7 @@ JNIEXPORT jobjectArray JNICALL Java_com_wolfssl_WolfSSL_getProtocolsMask
#endif /* WOLFSSL_ALLOW_TLSv10 */
#endif /* !NO_OLD_TLS */
#ifdef WOLFSSL_ALLOW_SSLv3
#ifdef WOLFSSL_ALLOW_SSLV3
if(!(mask & SSL_OP_NO_SSLv3)) {
(*jenv)->SetObjectArrayElement(jenv, ret, idx++,
(*jenv)->NewStringUTF(jenv, "SSLv3"));

1
native/com_wolfssl_WolfSSLCertRequest.c
View File

@ -509,6 +509,7 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_WolfSSLCertRequest_X509_1REQ_1get_
if (derArr == NULL) {
throwWolfSSLJNIException(jenv,
"Failed to create byte array in native X509_REQ_get_der");
XFREE(der, NULL, DYNAMIC_TYPE_OPENSSL);
return NULL;
}

2
native/com_wolfssl_WolfSSLCertificate.c
View File

@ -2898,7 +2898,7 @@ JNIEXPORT jobjectArray JNICALL Java_com_wolfssl_WolfSSLCertificate_X509_1get_1su
/* If we got fewer entries than expected, create a trimmed array */
if (idx < numNames) {
jobjectArray trimmedArray = (*jenv)->NewObjectArray(jenv, idx,
objectClass, NULL);
objectArrayClass, NULL);
if (trimmedArray != NULL && !(*jenv)->ExceptionCheck(jenv)) {
for (i = 0; i < idx; i++) {
jobject elem = (*jenv)->GetObjectArrayElement(jenv,

24
native/com_wolfssl_WolfSSLContext.c
View File

@ -7088,11 +7088,17 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLContext_setMinDhKeySz
WOLFSSL_CTX* ctx = (WOLFSSL_CTX*)(uintptr_t)ctxPtr;
(void)obj;
/* wolfSSL_CTX_SetMinDhKey_Sz() sanitizes ctx and keySzBits */
/* wolfSSL_CTX_SetMinDhKey_Sz() sanitizes ctx */
if (jenv == NULL) {
return (jint)BAD_FUNC_ARG;
}
/* Validate range before narrowing to word16, otherwise out of range
* value can wrap to a smaller key size */
if ((keySzBits < 0) || (keySzBits > (jint)WOLFSSL_MAX_16BIT)) {
return (jint)BAD_FUNC_ARG;
}
return (jint)wolfSSL_CTX_SetMinDhKey_Sz(ctx, (word16)keySzBits);
#else
(void)jenv;
@ -7110,11 +7116,17 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLContext_setMinRsaKeySz
WOLFSSL_CTX* ctx = (WOLFSSL_CTX*)(uintptr_t)ctxPtr;
(void)obj;
/* wolfSSL_CTX_SetMinRsaKey_Sz() sanitizes ctx and keySzBits */
/* wolfSSL_CTX_SetMinRsaKey_Sz() sanitizes ctx */
if (jenv == NULL) {
return (jint)BAD_FUNC_ARG;
}
/* Validate range before narrowing to short, otherwise out of range value
* can wrap to a smaller key size */
if ((keySzBits < 0) || (keySzBits > INT16_MAX)) {
return (jint)BAD_FUNC_ARG;
}
return (jint)wolfSSL_CTX_SetMinRsaKey_Sz(ctx, (short)keySzBits);
#else
(void)jenv;
@ -7132,11 +7144,17 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLContext_setMinEccKeySz
WOLFSSL_CTX* ctx = (WOLFSSL_CTX*)(uintptr_t)ctxPtr;
(void)obj;
/* wolfSSL_CTX_SetMinEccKey_Sz() sanitizes ctx and keySzBits */
/* wolfSSL_CTX_SetMinEccKey_Sz() sanitizes ctx */
if (jenv == NULL) {
return (jint)BAD_FUNC_ARG;
}
/* Validate range before narrowing to short, otherwise out of range value
* can wrap to a smaller key size */
if ((keySzBits < 0) || (keySzBits > INT16_MAX)) {
return (jint)BAD_FUNC_ARG;
}
return (jint)wolfSSL_CTX_SetMinEccKey_Sz(ctx, (short)keySzBits);
#else
(void)jenv;

13
native/com_wolfssl_WolfSSLSession.c
View File

@ -1562,6 +1562,8 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLSession_read__J_3BIII
* 0 is used here to both commit and free */
(*jenv)->ReleaseByteArrayElements(jenv, raw, (jbyte*)data, 0);
}
} else {
return BAD_FUNC_ARG;
}
return size;
@ -3575,6 +3577,9 @@ JNIEXPORT jstring JNICALL Java_com_wolfssl_WolfSSLSession_getPeerX509AltName
}
altname = wolfSSL_X509_get_next_altname(x509);
if (altname == NULL) {
return NULL;
}
retString = (*jenv)->NewStringUTF(jenv, altname);
return retString;
@ -5003,7 +5008,8 @@ JNIEXPORT void JNICALL Java_com_wolfssl_WolfSSLSession_setVerify
*verifyCb = (*jenv)->NewGlobalRef(jenv, callbackIface);
if (*verifyCb == NULL) {
printf("error storing global callback interface\n");
XFREE(verifyCb, NULL, DYNAMIC_TYPE_TMP_BUFFER);
XFREE(verifyCb, NULL, DYNAMIC_TYPE_TMP_BUFFER);
verifyCb = NULL;
}
else {
/* Publish under g_verifyCbMutex so a concurrent callback
@ -5016,6 +5022,11 @@ JNIEXPORT void JNICALL Java_com_wolfssl_WolfSSLSession_setVerify
wolfSSL_set_verify(ssl, mode, NativeSSLVerifyCallback);
}
}
/* If callback could not be registered, still apply requested mode */
if ((appData == NULL) || (verifyCb == NULL)) {
wolfSSL_set_verify(ssl, mode, NULL);
}
}
}

10
src/java/com/wolfssl/provider/jsse/WolfSSLEngine.java
View File

@ -2676,14 +2676,14 @@ public class WolfSSLEngine extends SSLEngine {
return 0;
}
/* If we have more data than internal static buffer,
* grow buffer 2x (or up to sz needed) and copy data over */
/* If we have more data than internal static buffer, grow buffer
* 2x (or up to offset + sz needed) and copy data over */
if ((this.internalIOSendBufSz -
this.internalIOSendBufOffset) < sz) {
/* Allocate new buffer to hold data to be sent */
int needed = this.internalIOSendBufOffset + sz;
int newSz = this.internalIOSendBufSz * 2;
if (newSz < sz) {
newSz = sz;
if (newSz < needed) {
newSz = needed;
}
byte[] newBuf = new byte[newSz];
System.arraycopy(this.internalIOSendBuf, 0,

4
src/java/com/wolfssl/provider/jsse/WolfSSLUtil.java
View File

@ -94,6 +94,10 @@ public class WolfSSLUtil {
WolfSSLDebug.log(WolfSSLUtil.class, WolfSSLDebug.INFO,
() -> "jdk.tls.disabledAlgorithms: " + tmpDisabledAlgos);
if (disabledAlgos == null) {
disabledAlgos = "";
}
/*
* WolfJSSE only supports DTLSv1.3, automatically add DTLSv1,
* and DTLSv1.2 to disabled algorithms for now */

21
src/test/com/wolfssl/test/WolfSSLContextTest.java
View File

@ -762,6 +762,13 @@ public class WolfSSLContextTest {
fail("setMinRSAKeySize should fail with negative key size");
}
/* value that wraps across the 16-bit boundary should fail,
* 66560 wraps to 1024. */
ret = ctx.setMinRSAKeySize(66560);
if (ret != WolfSSL.BAD_FUNC_ARG) {
fail("setMinRSAKeySize should fail for out-of-range value");
}
/* key length not % 8 should fail */
ret = ctx.setMinRSAKeySize(1023);
if (ret != WolfSSL.BAD_FUNC_ARG) {
@ -814,6 +821,13 @@ public class WolfSSLContextTest {
fail("setMinECCKeySize should fail with negative key size");
}
/* value that wraps across the 16-bit boundary should fail,
* 66048 narrows to 512. */
ret = ctx.setMinECCKeySize(66048);
if (ret != WolfSSL.BAD_FUNC_ARG) {
fail("setMinECCKeySize should fail for out-of-range value");
}
/* valid key length should succeed */
ret = ctx.setMinECCKeySize(128);
if (ret != WolfSSL.SSL_SUCCESS) {
@ -868,6 +882,13 @@ public class WolfSSLContextTest {
fail("setMinDHKeySize should fail with key size too large");
}
/* value that wraps across the 16-bit boundary should fail,
* 66560 narrows to 1024. */
ret = ctx.setMinDHKeySize(66560);
if (ret != WolfSSL.BAD_FUNC_ARG) {
fail("setMinDHKeySize should fail for out-of-range value");
}
/* key length not % 8 should fail */
ret = ctx.setMinDHKeySize(1023);
if (ret != WolfSSL.BAD_FUNC_ARG) {