Skip to content

Fixes for callbacks, CRL dates, DN parsing, PSK getters #407

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cconlon wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Fixes for callbacks, CRL dates, DN parsing, PSK getters #407

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
294ae2a
F-11870: handle unrecognized RDN types in WolfSSLX509 DN reformatting
cconlon Aug 24, 2026
0581c1a
F-11875: honor revocation date in CRL add_revoked and reject it in ad…
cconlon Aug 24, 2026
dc4cd2f
F-11876: guard against NULL PSK identity strings before NewStringUTF
cconlon Aug 24, 2026
f4b4ea7
F-11882 / F-11883: fail closed on verify callback errors in NativeVer…
cconlon Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 57 additions & 6 deletions native/com_wolfssl_WolfSSLCRL.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,13 @@
#define WOLFSSL_JNI_CRL_GEN_ENABLED
#endif

/* WOLFSSL_X509_REVOKED.revocationDate was added in 5.9.0 */
#if defined(WOLFSSL_JNI_CRL_GEN_ENABLED) && \
((LIBWOLFSSL_VERSION_HEX > 0x05008004) || \
defined(WOLFSSL_PR9839_PATCH_APPLIED))
#define WOLFSSL_JNI_CRL_REVDATE_ENABLED
#endif

JNIEXPORT jlong JNICALL Java_com_wolfssl_WolfSSLCRL_X509_1CRL_1new
(JNIEnv* jenv, jclass jcl)
{
Expand Down Expand Up @@ -260,15 +267,16 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLCRL_X509_1CRL_1add_1revoked
WOLFSSL_X509_CRL* crl = (WOLFSSL_X509_CRL*)(uintptr_t)crlPtr;
WOLFSSL_X509_REVOKED revoked;
WOLFSSL_ASN1_INTEGER* serialInt = NULL;
#ifdef WOLFSSL_JNI_CRL_REVDATE_ENABLED
WOLFSSL_ASN1_TIME revTime;
byte* revDateBuf = NULL;
int revDateSz = 0;
#endif
byte* serialBuf = NULL;
int serialSz = 0;
int ret = WOLFSSL_SUCCESS;
(void)jcl;

/* Note: date is not currently used until WOLFSSL_X509_REVOKED adds it. */
(void)revDate;
(void)dateFmt;

if (jenv == NULL || crl == NULL || serial == NULL) {
return WOLFSSL_FAILURE;
}
Expand All @@ -291,10 +299,46 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLCRL_X509_1CRL_1add_1revoked
serialInt->isDynamic = 0;
serialInt->type = 0;
revoked.serialNumber = serialInt;
ret = wolfSSL_X509_CRL_add_revoked(crl, &revoked);

#ifdef WOLFSSL_JNI_CRL_REVDATE_ENABLED
/* Set caller-supplied revocation date if present, otherwise
* wolfSSL fills in the current time. revDate holds the ASN.1
* time value bytes, dateFmt is ASN_UTC_TIME or
* ASN_GENERALIZED_TIME tag. */
if (revDate != NULL) {
revDateBuf = (byte*)(*jenv)->GetByteArrayElements(jenv,
revDate, NULL);
revDateSz = (*jenv)->GetArrayLength(jenv, revDate);
if (revDateBuf == NULL || revDateSz <= 0 ||
(size_t)revDateSz > sizeof(revTime.data)) {
ret = WOLFSSL_FAILURE;
}
else {
XMEMSET(&revTime, 0, sizeof(revTime));
XMEMCPY(revTime.data, revDateBuf, (size_t)revDateSz);
revTime.length = revDateSz;
revTime.type = (int)dateFmt;
revoked.revocationDate = &revTime;
}
}
#else
/* No revocationDate support, wolfSSL records the current time. */
(void)revDate;
(void)dateFmt;
#endif

if (ret == WOLFSSL_SUCCESS) {
ret = wolfSSL_X509_CRL_add_revoked(crl, &revoked);
}
}
}

#ifdef WOLFSSL_JNI_CRL_REVDATE_ENABLED
if (revDateBuf != NULL) {
(*jenv)->ReleaseByteArrayElements(jenv, revDate,
(jbyte*)revDateBuf, JNI_ABORT);
}
#endif
if (serialBuf != NULL) {
(*jenv)->ReleaseByteArrayElements(jenv, serial,
(jbyte*)serialBuf, JNI_ABORT);
Expand Down Expand Up @@ -325,13 +369,20 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLCRL_X509_1CRL_1add_1revoked_1cert
int certSz = 0;
int ret = WOLFSSL_SUCCESS;
(void)jcl;
(void)revDate;
(void)dateFmt;

if (jenv == NULL || crl == NULL || certDer == NULL) {
return WOLFSSL_FAILURE;
}

/* Reject non-null date rather than ignoring it, since
* wolfSSL_X509_CRL_add_revoked_cert() always records the current time.
* Caller should use addRevoked() with an explicit serial number to set a
* specific revocation date. */
if (revDate != NULL) {
return BAD_FUNC_ARG;
}

certBuf = (byte*)(*jenv)->GetByteArrayElements(jenv, certDer, NULL);
certSz = (*jenv)->GetArrayLength(jenv, certDer);
if (certBuf == NULL || certSz == 0) {
Expand Down
23 changes: 14 additions & 9 deletions native/com_wolfssl_WolfSSLContext.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -765,7 +765,7 @@ int NativeVerifyCallback(int preverify_ok, WOLFSSL_X509_STORE_CTX* store)
{
JNIEnv* jenv;
jint vmret = 0;
jint retval = -1;
jint retval = 0;
int needsDetach = 0;
jclass excClass = NULL;
jclass verifyClass = NULL;
Expand All @@ -789,11 +789,11 @@ int NativeVerifyCallback(int preverify_ok, WOLFSSL_X509_STORE_CTX* store)
vmret = (*g_vm)->AttachCurrentThread(g_vm, (void**) &jenv, NULL);
#endif
if (vmret) {
return -101; /* failed to attach JNIEnv to thread */
return 0; /* failed to attach JNIEnv to thread */
}
needsDetach = 1;
} else if (vmret != JNI_OK) {
return -102; /* unable to get JNIEnv from JavaVM */
return 0; /* unable to get JNIEnv from JavaVM */
}

/* find exception class */
Expand All @@ -803,7 +803,7 @@ int NativeVerifyCallback(int preverify_ok, WOLFSSL_X509_STORE_CTX* store)
(*jenv)->ExceptionClear(jenv);
if (needsDetach)
(*g_vm)->DetachCurrentThread(g_vm);
return -103;
return 0;
}

/* Locate the per-context verify callback jobject via
Expand Down Expand Up @@ -853,7 +853,7 @@ int NativeVerifyCallback(int preverify_ok, WOLFSSL_X509_STORE_CTX* store)
"Can't get native WolfSSLVerifyCallback class reference");
if (needsDetach)
(*g_vm)->DetachCurrentThread(g_vm);
return -104;
return 0;
}

verifyMethod = (*jenv)->GetMethodID(jenv, verifyClass,
Expand All @@ -868,7 +868,7 @@ int NativeVerifyCallback(int preverify_ok, WOLFSSL_X509_STORE_CTX* store)
"Error getting verifyCallback method from JNI");
if (needsDetach)
(*g_vm)->DetachCurrentThread(g_vm);
return -105;
return 0;
}

retval = (*jenv)->CallIntMethod(jenv, verifyCbObj,
Expand All @@ -880,7 +880,7 @@ int NativeVerifyCallback(int preverify_ok, WOLFSSL_X509_STORE_CTX* store)
(*jenv)->ExceptionClear(jenv);
if (needsDetach)
(*g_vm)->DetachCurrentThread(g_vm);
return -106;
return 0;
}

} else {
Expand All @@ -893,13 +893,18 @@ int NativeVerifyCallback(int preverify_ok, WOLFSSL_X509_STORE_CTX* store)
"Object reference invalid in NativeVerifyCallback");
if (needsDetach)
(*g_vm)->DetachCurrentThread(g_vm);
return -1;
return 0;
}

if (needsDetach)
(*g_vm)->DetachCurrentThread(g_vm);

return retval;
/* Accept only on an explicit callback success (1), reject otherwise. */
if (retval == 1) {
return 1;
}

return 0;
}

JNIEXPORT jlong JNICALL Java_com_wolfssl_WolfSSLContext_setOptions
Expand Down
39 changes: 28 additions & 11 deletions native/com_wolfssl_WolfSSLSession.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,7 @@ int NativeSSLVerifyCallback(int preverify_ok, WOLFSSL_X509_STORE_CTX* store)
{
JNIEnv* jenv;
jint vmret = 0;
jint retval = -1;
jint retval = 0;
int needsDetach = 0;
jobjectRefType refcheck;
SSLAppData* appData; /* WOLFSSL app data, stored verify cb obj */
Expand All @@ -128,11 +128,11 @@ int NativeSSLVerifyCallback(int preverify_ok, WOLFSSL_X509_STORE_CTX* store)
vmret = (*g_vm)->AttachCurrentThread(g_vm, (void**) &jenv, NULL);
#endif
if (vmret) {
return -101; /* failed to attach JNIEnv to thread */
return 0; /* failed to attach JNIEnv to thread */
}
needsDetach = 1;
} else if (vmret != JNI_OK) {
return -102; /* unable to get JNIEnv from JavaVM */
return 0; /* unable to get JNIEnv from JavaVM */
}

/* get app data to retrieve stored Java jobject callback object */
Expand All @@ -143,7 +143,7 @@ int NativeSSLVerifyCallback(int preverify_ok, WOLFSSL_X509_STORE_CTX* store)
if (needsDetach) {
(*g_vm)->DetachCurrentThread(g_vm);
}
return -105;
return 0;
}

/* Promote stored global callback ref to a local ref under g_verifyCbMutex
Expand All @@ -161,7 +161,7 @@ int NativeSSLVerifyCallback(int preverify_ok, WOLFSSL_X509_STORE_CTX* store)
if (needsDetach) {
(*g_vm)->DetachCurrentThread(g_vm);
}
return -106;
return 0;
}

/* valid ref check: non-zero type covers local/global/weak, and verifyCbObj
Expand All @@ -180,7 +180,7 @@ int NativeSSLVerifyCallback(int preverify_ok, WOLFSSL_X509_STORE_CTX* store)
if (needsDetach) {
(*g_vm)->DetachCurrentThread(g_vm);
}
return -107;
return 0;
}

retval = (*jenv)->CallIntMethod(jenv, verifyCbObj,
Expand All @@ -194,7 +194,7 @@ int NativeSSLVerifyCallback(int preverify_ok, WOLFSSL_X509_STORE_CTX* store)
(*jenv)->DeleteLocalRef(jenv, verifyCbObj);
if (needsDetach)
(*g_vm)->DetachCurrentThread(g_vm);
return -109;
return 0;
}

} else {
Expand All @@ -208,15 +208,20 @@ int NativeSSLVerifyCallback(int preverify_ok, WOLFSSL_X509_STORE_CTX* store)
(*jenv)->DeleteLocalRef(jenv, verifyCbObj);
if (needsDetach)
(*g_vm)->DetachCurrentThread(g_vm);
return -1;
return 0;
}

(*jenv)->DeleteLocalRef(jenv, verifyCbObj);

if (needsDetach)
(*g_vm)->DetachCurrentThread(g_vm);

return retval;
/* Accept only on an explicit callback success (1), reject otherwise. */
if (retval == 1) {
return 1;
}

return 0;
}

#ifndef USE_WINDOWS_API
Expand Down Expand Up @@ -4877,13 +4882,19 @@ JNIEXPORT jstring JNICALL Java_com_wolfssl_WolfSSLSession_getPskIdentityHint
{
#ifndef NO_PSK
WOLFSSL* ssl = (WOLFSSL*)(uintptr_t)sslPtr;
const char* hint = NULL;
(void)obj;

if (jenv == NULL || ssl == NULL) {
return NULL;
}

return (*jenv)->NewStringUTF(jenv, wolfSSL_get_psk_identity_hint(ssl));
hint = wolfSSL_get_psk_identity_hint(ssl);
if (hint == NULL) {
return NULL;
}

return (*jenv)->NewStringUTF(jenv, hint);
#else
(void)jenv;
(void)obj;
Expand All @@ -4897,13 +4908,19 @@ JNIEXPORT jstring JNICALL Java_com_wolfssl_WolfSSLSession_getPskIdentity
{
#ifndef NO_PSK
WOLFSSL* ssl = (WOLFSSL*)(uintptr_t)sslPtr;
const char* identity = NULL;
(void)obj;

if (jenv == NULL || ssl == NULL) {
return NULL;
}

return (*jenv)->NewStringUTF(jenv, wolfSSL_get_psk_identity(ssl));
identity = wolfSSL_get_psk_identity(ssl);
if (identity == NULL) {
return NULL;
}

return (*jenv)->NewStringUTF(jenv, identity);
#else
(void)jenv;
(void)obj;
Expand Down
Loading
Loading