WolfSSL
/
wolfssljni
mirror of https://github.com/wolfSSL/wolfssljni.git
1
0
Fork 0
Code Issues Releases Wiki Activity

JNI/JSSE: Fix visibility and access modifiers found by SpotBugs 

- Add missing final to WOLFSSL_LEFT_MOST_WILDCARD_ONLY constant
- Update generated JNI header for WOLFSSL_LEFT_MOST_WILDCARD_ONLY
- Make WolfSSLProvider.setDevId() static
- Reduce visibility of WolfSSLCustomUser fields to package-protected
- Make WolfSSLEngine debug flags private
- Rename internal PascalCase methods to camelCase
  (LoadKeyAndCertChain, GetJavaHome, LoadKeyStoreFileByType,
  GetCtxAttributes)
pull/344/head
Chris Conlon 2026-03-18 11:20:01 -06:00
parent dbcdcf3bbc
commit bd8606dcb5
12 changed files with 27 additions and 84 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
native/com_wolfssl_WolfSSL.h
View File

@ -311,6 +311,8 @@ extern "C" {
#define com_wolfssl_WolfSSL_WOLFSSL_FFDHE_8192 260L
#undef com_wolfssl_WolfSSL_INVALID_DEVID
#define com_wolfssl_WolfSSL_INVALID_DEVID -2L
#undef com_wolfssl_WolfSSL_WOLFSSL_LEFT_MOST_WILDCARD_ONLY
#define com_wolfssl_WolfSSL_WOLFSSL_LEFT_MOST_WILDCARD_ONLY 64L
/*
* Class: com_wolfssl_WolfSSL
* Method: init

59
spotbugs-exclude.xml
View File

@ -299,19 +299,6 @@
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
</Match>
<!--
IS2_INCONSISTENT_SYNC: WolfSSLParameters objects are copied
via copy() before being shared across threads. The copy()
method is synchronized to protect the source object during
copying. Individual getters/setters are intentionally not
synchronized to match JDK SSLParameters behavior.
-->
<Match>
<Class name=
"com.wolfssl.provider.jsse.WolfSSLParameters"/>
<Bug pattern="IS2_INCONSISTENT_SYNC"/>
</Match>
<!--
NM_METHOD_NAMING_CONVENTION: Public native JNI methods use
PascalCase to match native wolfSSL C function naming.
@ -461,50 +448,4 @@
<Bug pattern="PA_PUBLIC_PRIMITIVE_ATTRIBUTE"/>
</Match>
<!--
AT_STALE_THREAD_WRITE_OF_PRIMITIVE: WolfSSLParameters
objects are copied via copy() before being shared across
threads, providing the thread-safety boundary. Matching
the JDK SSLParameters pattern which also does not
synchronize primitive getters/setters.
WolfSSLImplementSSLSession.side is set once during setup
before the session is used across threads.
-->
<Match>
<Class name=
"com.wolfssl.provider.jsse.WolfSSLParameters"/>
<Bug pattern="AT_STALE_THREAD_WRITE_OF_PRIMITIVE"/>
</Match>
<Match>
<Class name=
"com.wolfssl.provider.jsse.WolfSSLImplementSSLSession"/>
<Field name="side"/>
<Bug pattern="AT_STALE_THREAD_WRITE_OF_PRIMITIVE"/>
</Match>
<!--
RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE: Defensive null
check on getSession() return value. The session could be
null depending on engine state, keeping as defensive check.
-->
<Match>
<Class name="com.wolfssl.provider.jsse.WolfSSLEngine"/>
<Method name="cacheRequestedServerNamesFromNetData"/>
<Bug pattern="RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE"/>
</Match>
<!--
RCN_REDUNDANT_NULLCHECK_OF_NULL_VALUE: Defensive null check
on certPem in catch block after constructor threw. Kept as
defensive coding to free native resources if constructor
behavior changes in the future.
-->
<Match>
<Class name=
"com.wolfssl.provider.jsse.WolfSSLTrustManager"/>
<Method name="LoadAndroidSystemCertsManually"/>
<Bug pattern="RCN_REDUNDANT_NULLCHECK_OF_NULL_VALUE"/>
</Match>
</FindBugsFilter>

2
src/java/com/wolfssl/WolfSSL.java
View File

@ -586,7 +586,7 @@ public class WolfSSL {
/* ------------------------- Flag Values ---------------------------- */
/** WolfSSLCertificate.checkHost() match only wildcards in left-most
* position, used for LDAPS hostname verification. */
public static int WOLFSSL_LEFT_MOST_WILDCARD_ONLY = 0x40;
public static final int WOLFSSL_LEFT_MOST_WILDCARD_ONLY = 0x40;
/* ------------------------ Internal state -------------------------- */

2
src/java/com/wolfssl/provider/jsse/WolfSSLContext.java
View File

@ -86,7 +86,7 @@ public class WolfSSLContext extends SSLContextSpi {
/* Allow ability for user to hard-code and override version, cipher
* suite, and NO_* disable options. Otherwise just sets defaults
* into ctxAttr. */
WolfSSLCustomUser ctxAttr = WolfSSLCustomUser.GetCtxAttributes
WolfSSLCustomUser ctxAttr = WolfSSLCustomUser.getCtxAttributes
(this.currentVersion, ciphersIana);
/* Explicitly set SSLContext version if overridden by

8
src/java/com/wolfssl/provider/jsse/WolfSSLCustomUser.java
View File

@ -39,11 +39,11 @@ import com.wolfssl.WolfSSL.TLS_VERSION;
*/
public class WolfSSLCustomUser {
/** SSL/TLS version to be used with new SSLContext objects. */
public TLS_VERSION version;
TLS_VERSION version;
/** String array of allowed cipher suites for new SSLContext objects */
public String[] list;
String[] list;
/** Mask of options to set for the associated native WOLFSSL_CTX */
public long noOptions;
long noOptions;
/** Default WolfSSLCustomUser constructor */
public WolfSSLCustomUser() { }
@ -65,7 +65,7 @@ public class WolfSSLCustomUser {
* list needs to contain a subset of the default cipher
* list. If it is null, default list is applied.
*/
public static WolfSSLCustomUser GetCtxAttributes(TLS_VERSION version,
public static WolfSSLCustomUser getCtxAttributes(TLS_VERSION version,
String[] list) {
WolfSSLCustomUser ctxAttr = new WolfSSLCustomUser();

8
src/java/com/wolfssl/provider/jsse/WolfSSLEngine.java
View File

@ -167,12 +167,12 @@ public class WolfSSLEngine extends SSLEngine {
protected BiFunction<SSLEngine, List<String>, String> alpnSelector = null;
/** Turn on extra/verbose SSLEngine debug logging */
public boolean extraDebugEnabled = false;
private boolean extraDebugEnabled = false;
/** Turn on Send/Recv callback debug to print out bytes sent/received.
* WARNING: enabling this will slow down sending and receiving data,
* enough so that app may run into timeouts. Enable with caution. */
public boolean ioDebugEnabled = false;
private boolean ioDebugEnabled = false;
/**
* Turns on additional debugging based on system properties set.
@ -264,7 +264,7 @@ public class WolfSSLEngine extends SSLEngine {
}
try {
this.engineHelper.LoadKeyAndCertChain(null, this);
this.engineHelper.loadKeyAndCertChain(null, this);
certKeyLoaded = true;
} catch (CertificateEncodingException | IOException |
WolfSSLException e) {
@ -281,7 +281,7 @@ public class WolfSSLEngine extends SSLEngine {
*
* This logic is not included directly in WolfSSLEngine constructors
* to avoid possible 'this' escape before subclass is fully initialized
* when using 'this' in LoadKeyAndCertChain().
* when using 'this' in loadKeyAndCertChain().
*
* @throws SSLException if initialization fails
*/

2
src/java/com/wolfssl/provider/jsse/WolfSSLEngineHelper.java
View File

@ -329,7 +329,7 @@ public class WolfSSLEngineHelper {
* @throws IOException on error concatenating certificate chain into
* single byte array
*/
protected synchronized void LoadKeyAndCertChain(
protected synchronized void loadKeyAndCertChain(
Socket sock, SSLEngine engine)
throws WolfSSLException, CertificateEncodingException, IOException {

8
src/java/com/wolfssl/provider/jsse/WolfSSLKeyManager.java
View File

@ -106,7 +106,7 @@ public class WolfSSLKeyManager extends KeyManagerFactorySpi {
"KeyStore type from wolfjsse.keystore.type.required");
}
sysStore = WolfSSLUtil.LoadKeyStoreFileByType(
sysStore = WolfSSLUtil.loadKeyStoreFileByType(
file, this.pswd, type);
}
else {
@ -114,7 +114,7 @@ public class WolfSSLKeyManager extends KeyManagerFactorySpi {
* FIPS is being used */
if (wksAvailable &&
(requiredType == null || requiredType.equals("WKS"))) {
sysStore = WolfSSLUtil.LoadKeyStoreFileByType(
sysStore = WolfSSLUtil.loadKeyStoreFileByType(
file, this.pswd, "WKS");
}
@ -123,7 +123,7 @@ public class WolfSSLKeyManager extends KeyManagerFactorySpi {
(requiredType == null || requiredType.equals("BKS"))) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "Detected Android VM, trying BKS KeyStore type");
sysStore = WolfSSLUtil.LoadKeyStoreFileByType(
sysStore = WolfSSLUtil.loadKeyStoreFileByType(
file, this.pswd, "BKS");
}
@ -133,7 +133,7 @@ public class WolfSSLKeyManager extends KeyManagerFactorySpi {
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "javax.net.ssl.keyStoreType system property " +
"not set, trying type: JKS");
sysStore = WolfSSLUtil.LoadKeyStoreFileByType(
sysStore = WolfSSLUtil.loadKeyStoreFileByType(
file, this.pswd, "JKS");
}
}

2
src/java/com/wolfssl/provider/jsse/WolfSSLProvider.java
View File

@ -168,7 +168,7 @@ public final class WolfSSLProvider extends Provider {
* @throws WolfSSLException if error registering native crypto callback
* function
*/
public void setDevId(int devId) throws WolfSSLException {
public static void setDevId(int devId) throws WolfSSLException {
/* Store devId into static WolfSSL variable, used by
* WolfSSLContext (SSLContext) */

4
src/java/com/wolfssl/provider/jsse/WolfSSLSocket.java
View File

@ -543,9 +543,9 @@ public class WolfSSLSocket extends SSLSocket {
() -> "loading private key and cert chain");
if (this.socket != null) {
EngineHelper.LoadKeyAndCertChain(this.socket, null);
EngineHelper.loadKeyAndCertChain(this.socket, null);
} else {
EngineHelper.LoadKeyAndCertChain(this, null);
EngineHelper.loadKeyAndCertChain(this, null);
}
} else {
throw new WolfSSLException(

10
src/java/com/wolfssl/provider/jsse/WolfSSLTrustManager.java
View File

@ -126,7 +126,7 @@ public class WolfSSLTrustManager extends TrustManagerFactorySpi {
"wolfjsse.keystore.type.required");
}
sysStore = WolfSSLUtil.LoadKeyStoreFileByType(
sysStore = WolfSSLUtil.loadKeyStoreFileByType(
tsFile, passArr, tsType);
}
else {
@ -134,7 +134,7 @@ public class WolfSSLTrustManager extends TrustManagerFactorySpi {
* FIPS is being used */
if (wksAvailable &&
(requiredType == null || requiredType.equals("WKS"))) {
sysStore = WolfSSLUtil.LoadKeyStoreFileByType(
sysStore = WolfSSLUtil.loadKeyStoreFileByType(
tsFile, passArr, "WKS");
}
@ -143,7 +143,7 @@ public class WolfSSLTrustManager extends TrustManagerFactorySpi {
(requiredType == null || requiredType.equals("BKS"))) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "Detected Android VM, trying BKS KeyStore type");
sysStore = WolfSSLUtil.LoadKeyStoreFileByType(
sysStore = WolfSSLUtil.loadKeyStoreFileByType(
tsFile, passArr, "BKS");
}
@ -153,7 +153,7 @@ public class WolfSSLTrustManager extends TrustManagerFactorySpi {
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "javax.net.ssl.trustStoreType system property " +
"not set, trying type: JKS");
sysStore = WolfSSLUtil.LoadKeyStoreFileByType(
sysStore = WolfSSLUtil.loadKeyStoreFileByType(
tsFile, passArr, "JKS");
}
}
@ -699,7 +699,7 @@ public class WolfSSLTrustManager extends TrustManagerFactorySpi {
/* Get JAVA_HOME for trying to load system certs next */
if (certs == null) {
javaHome = WolfSSLUtil.GetJavaHome();
javaHome = WolfSSLUtil.getJavaHome();
if (javaHome == null) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "$JAVA_HOME not set, unable to load system " +

4
src/java/com/wolfssl/provider/jsse/WolfSSLUtil.java
View File

@ -605,7 +605,7 @@ public class WolfSSLUtil {
*
* @return String path to Java home directory, otherwise null if not set
*/
protected static String GetJavaHome() {
protected static String getJavaHome() {
String javaHome = System.getenv("JAVA_HOME");
@ -672,7 +672,7 @@ public class WolfSSLUtil {
* @return new KeyStore object loaded with KeyStore file, or null
* if unable to load KeyStore
*/
protected static KeyStore LoadKeyStoreFileByType(String file, char[] pass,
protected static KeyStore loadKeyStoreFileByType(String file, char[] pass,
String type) {
KeyStore ks = null;