Skip to content

Fixes for TrustX509 issuer lookup, JNI callbacks, session cache save #428

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rlm2002 merged 5 commits into from
Oct 2, 2026
Merged

Fixes for TrustX509 issuer lookup, JNI callbacks, session cache save #428

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
13a5196
F-3917: bound memsaveSessionCache copy to the caller-supplied size
cconlon Sep 25, 2026
bef0cf9
F-9131: skip non-CA KeyStore entries in findIssuerBySignature unless …
cconlon Sep 25, 2026
bc36999
F-9134: free the hostname-check WolfSSLCertificate on every exit path
cconlon Sep 25, 2026
3724450
F-10766: build the MAC/encrypt callback encIn ByteBuffer from encIn
cconlon Sep 25, 2026
3959b72
F-10768: zero the Java PSK key array after the native callback copies it
cconlon Sep 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion native/com_wolfssl_WolfSSL.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2262,8 +2262,13 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSL_memsaveSessionCache
/* how much data do we need to write? */
cacheSz = wolfSSL_get_session_cache_memsize();

/* Make sure size is inside memBuf bounds */
if (ret == SSL_SUCCESS && (cacheSz < 0 || cacheSz > sz)) {
ret = SSL_FAILURE;
}

/* set jbyteArray for return */
if (cacheSz >= 0) {
if (ret == SSL_SUCCESS) {
(*jenv)->SetByteArrayRegion(jenv, mem, 0, cacheSz, (jbyte*)memBuf);
if ((*jenv)->ExceptionOccurred(jenv)) {
(*jenv)->ExceptionDescribe(jenv);
Expand Down
34 changes: 30 additions & 4 deletions native/com_wolfssl_WolfSSLContext.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2884,10 +2884,9 @@ int NativeMacEncryptCb(WOLFSSL* ssl, unsigned char* macOut,
return -1;
}

/* create ByteBuffer to wrap encIn - use encOut b/c it's not a const,
* but points to same memory. This will be important in Java-land in order
* to have an updated encIn array after doing the MAC operation. */
encInBB = (*jenv)->NewDirectByteBuffer(jenv, encOut, encSz);
/* create ByteBuffer to wrap encIn, direct so Java sees the MAC
* written to macOut, which lies within encIn */
encInBB = (*jenv)->NewDirectByteBuffer(jenv, (void*)encIn, encSz);
if (!encInBB) {
(*jenv)->ThrowNew(jenv, excClass, "failed to create encIn ByteBuffer");
freeMacEncryptCbLocalRefs(jenv, excClass, sessClass, ctxRef,
Expand Down Expand Up @@ -6637,6 +6636,24 @@ JNIEXPORT void JNICALL Java_com_wolfssl_WolfSSLContext_setPskClientCb

#ifndef NO_PSK

static void zeroPskKeyArray(JNIEnv* jenv, jbyteArray keyArray)
{
/* 64 matches wolfSSL MAX_PSK_KEY_LEN */
static const jbyte zeros[64] = { 0 };
jsize len = (*jenv)->GetArrayLength(jenv, keyArray);
jsize off = 0;
jsize chunk;

while (off < len) {
chunk = len - off;
if (chunk > (jsize)sizeof(zeros)) {
chunk = (jsize)sizeof(zeros);
}
(*jenv)->SetByteArrayRegion(jenv, keyArray, off, chunk, zeros);
off += chunk;
}
}

unsigned int NativePskClientCb(WOLFSSL* ssl, const char* hint, char* identity,
unsigned int id_max_len, unsigned char* key, unsigned int max_key_len)
{
Expand Down Expand Up @@ -6937,6 +6954,7 @@ unsigned int NativePskClientCb(WOLFSSL* ssl, const char* hint, char* identity,
(*jenv)->DeleteLocalRef(jenv, ctxRef);
(*jenv)->DeleteLocalRef(jenv, hintString);
(*jenv)->DeleteLocalRef(jenv, strBufObj);
zeroPskKeyArray(jenv, keyArray);
(*jenv)->DeleteLocalRef(jenv, keyArray);
if (needsDetach) {
(*g_vm)->DetachCurrentThread(g_vm);
Expand All @@ -6954,6 +6972,7 @@ unsigned int NativePskClientCb(WOLFSSL* ssl, const char* hint, char* identity,
(*jenv)->DeleteLocalRef(jenv, ctxRef);
(*jenv)->DeleteLocalRef(jenv, hintString);
(*jenv)->DeleteLocalRef(jenv, strBufObj);
zeroPskKeyArray(jenv, keyArray);
(*jenv)->DeleteLocalRef(jenv, keyArray);
if (needsDetach) {
(*g_vm)->DetachCurrentThread(g_vm);
Expand All @@ -6972,12 +6991,14 @@ unsigned int NativePskClientCb(WOLFSSL* ssl, const char* hint, char* identity,
(*jenv)->DeleteLocalRef(jenv, ctxRef);
(*jenv)->DeleteLocalRef(jenv, hintString);
(*jenv)->DeleteLocalRef(jenv, strBufObj);
zeroPskKeyArray(jenv, keyArray);
(*jenv)->DeleteLocalRef(jenv, keyArray);
if (needsDetach) {
(*g_vm)->DetachCurrentThread(g_vm);
}
return 0;
}
zeroPskKeyArray(jenv, keyArray);

/* get the String from the StringBuffer */
toStringId = (*jenv)->GetMethodID(jenv, strBufClass,
Expand Down Expand Up @@ -7049,6 +7070,7 @@ unsigned int NativePskClientCb(WOLFSSL* ssl, const char* hint, char* identity,
(*jenv)->DeleteLocalRef(jenv, bufString);
}
else {
zeroPskKeyArray(jenv, keyArray);
retval = 0;
}

Expand Down Expand Up @@ -7331,6 +7353,7 @@ unsigned int NativePskServerCb(WOLFSSL* ssl, const char* identity,
(*jenv)->ExceptionClear(jenv);
(*jenv)->DeleteLocalRef(jenv, ctxRef);
(*jenv)->DeleteLocalRef(jenv, identityString);
zeroPskKeyArray(jenv, keyArray);
(*jenv)->DeleteLocalRef(jenv, keyArray);
if (needsDetach) {
(*g_vm)->DetachCurrentThread(g_vm);
Expand All @@ -7346,6 +7369,7 @@ unsigned int NativePskServerCb(WOLFSSL* ssl, const char* identity,
(*jenv)->ExceptionClear(jenv);
(*jenv)->DeleteLocalRef(jenv, ctxRef);
(*jenv)->DeleteLocalRef(jenv, identityString);
zeroPskKeyArray(jenv, keyArray);
(*jenv)->DeleteLocalRef(jenv, keyArray);
if (needsDetach) {
(*g_vm)->DetachCurrentThread(g_vm);
Expand All @@ -7363,6 +7387,7 @@ unsigned int NativePskServerCb(WOLFSSL* ssl, const char* identity,
(*jenv)->ExceptionClear(jenv);
(*jenv)->DeleteLocalRef(jenv, ctxRef);
(*jenv)->DeleteLocalRef(jenv, identityString);
zeroPskKeyArray(jenv, keyArray);
(*jenv)->DeleteLocalRef(jenv, keyArray);
if (needsDetach) {
(*g_vm)->DetachCurrentThread(g_vm);
Expand All @@ -7375,6 +7400,7 @@ unsigned int NativePskServerCb(WOLFSSL* ssl, const char* identity,
}

/* delete local obj refs, detach JNIEnv from thread */
zeroPskKeyArray(jenv, keyArray);
(*jenv)->DeleteLocalRef(jenv, ctxRef);
(*jenv)->DeleteLocalRef(jenv, identityString);
(*jenv)->DeleteLocalRef(jenv, keyArray);
Expand Down
3 changes: 2 additions & 1 deletion src/java/com/wolfssl/WolfSSLPskClientCallback.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,8 @@ public interface WolfSSLPskClientCallback {
* @param hint client hint
* @param identity client identity
* @param idMaxLen maximum size in characters that identity can be
* @param key client key
* @param key array to write the client key into. It is zeroed
* after this method returns, so do not retain it.
* @param keyMaxLen maximum size in bytes that client key can be
*
* @return length of key in octets or 0 for error
Expand Down
3 changes: 2 additions & 1 deletion src/java/com/wolfssl/WolfSSLPskServerCallback.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,8 @@ public interface WolfSSLPskServerCallback {
* @param ssl the current SSL session object from which the
* callback was initiated.
* @param identity client identity
* @param key server key
* @param key array to write the server key into. It is zeroed
* after this method returns, so do not retain it.
* @param keyMaxLen maximum size in bytes that server key can be
*
* @return length of key in octets or 0 for error
Expand Down
122 changes: 68 additions & 54 deletions src/java/com/wolfssl/provider/jsse/WolfSSLTrustX509.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -353,6 +353,12 @@ private X509Certificate findIssuerBySignature(X509Certificate cert,
continue;
}

/* Only CAs may act as issuers, unless peer certs are trusted */
if (candidate.getBasicConstraints() < 0 &&
!WolfSSL.trustPeerCertEnabled()) {
continue;
}

/* Check subject DN matches cert's issuer DN */
if (!candidate.getSubjectX500Principal().equals(issuerDN)) {
continue;
Expand Down Expand Up @@ -717,74 +723,82 @@ else if (engine != null) {
throw new CertificateException(e);
}

/* Try verifying hostname against SNI name, if HTTPS type */
if (isClient && (type == HOSTNAME_TYPE_HTTPS)) {
if (sniHostName != null) {
final String tmpSniName = sniHostName;
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "trying hostname verification against SNI: " +
tmpSniName);

ret = WolfSSLUtil.verifyHostnameOrIp(peerCert, sniHostName, 0);
if (ret == WolfSSL.SSL_SUCCESS) {
/* Hostname successfully verified against SNI name */
try {
/* Try verifying hostname against SNI name, if HTTPS type */
if (isClient && (type == HOSTNAME_TYPE_HTTPS)) {
if (sniHostName != null) {
final String tmpSniName = sniHostName;
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "successfully verified X509 hostname using " +
"SNI name");
return;
() -> "trying hostname verification against SNI: " +
tmpSniName);

ret = WolfSSLUtil.verifyHostnameOrIp(peerCert,
sniHostName, 0);
if (ret == WolfSSL.SSL_SUCCESS) {
/* Hostname successfully verified against SNI name */
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "successfully verified X509 hostname using " +
"SNI name");
return;
}
else {
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "hostname match with SNI failed");
}
}
else {
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "hostname match with SNI failed");
() -> "no provided SNI name found");
}
}
else {
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "no provided SNI name found");
}
}

/* Try verifying hostname against peerHost from SSLSocket/SSLEngine */
if (peerHost != null) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "trying hostname verification against peer host: " +
peerHost);

/* LDAPS requires wildcard left-most matching only. IP literals
* are matched against iPAddress SANs only, handled inside
* verifyHostnameOrIp(). */
long flags = (type == HOSTNAME_TYPE_LDAPS) ?
WolfSSL.WOLFSSL_LEFT_MOST_WILDCARD_ONLY : 0;
ret = WolfSSLUtil.verifyHostnameOrIp(peerCert, peerHost, flags);
if (ret == WolfSSL.SSL_SUCCESS) {
/* Hostname successfully verified against peer host name */
/* Try verifying hostname against peerHost from
* SSLSocket/SSLEngine */
if (peerHost != null) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "successfully verified X509 hostname using " +
"SSLSession getPeerHost()");
return;
() -> "trying hostname verification against peer host: " +
peerHost);

/* LDAPS requires wildcard left-most matching only. IP literals
* are matched against iPAddress SANs only, handled inside
* verifyHostnameOrIp(). */
long flags = (type == HOSTNAME_TYPE_LDAPS) ?
WolfSSL.WOLFSSL_LEFT_MOST_WILDCARD_ONLY : 0;
ret = WolfSSLUtil.verifyHostnameOrIp(peerCert, peerHost, flags);
if (ret == WolfSSL.SSL_SUCCESS) {
/* Hostname successfully verified against peer host name */
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "successfully verified X509 hostname using " +
"SSLSession getPeerHost()");
return;
}
}
}

final String tmpSniName = sniHostName;
final String tmpPeerHost = peerHost;
if (isClient) {
if (type == HOSTNAME_TYPE_HTTPS) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "hostname verification failed for server peer " +
"cert, tried SNI (" + tmpSniName + "), peer host (" +
tmpPeerHost + ")\n" + peerCert);
final String tmpSniName = sniHostName;
final String tmpPeerHost = peerHost;
if (isClient) {
if (type == HOSTNAME_TYPE_HTTPS) {
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "hostname verification failed for server peer " +
"cert, tried SNI (" + tmpSniName + "), peer host (" +
tmpPeerHost + ")\n" + peerCert);
} else {
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "hostname verification failed for server peer " +
"cert, peer host (" + tmpPeerHost + ")\n" + peerCert);
}
} else {
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "hostname verification failed for server peer " +
"cert, peer host (" + tmpPeerHost + ")\n" + peerCert);
() -> "hostname verification failed for client peer " +
"cert, tried peer host (" + tmpPeerHost + ")\n" +
peerCert);
}
} else {
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
() -> "hostname verification failed for client peer cert, " +
"tried peer host (" + tmpPeerHost + ")\n" + peerCert);
}

throw new CertificateException("Hostname verification failed");
throw new CertificateException("Hostname verification failed");

} finally {
peerCert.free();
}
}

/**
Expand Down
Loading
Loading