Skip to content

Commit d463fd8

Browse files
authored
Correctly map GENERIC to UNKNOWN when using BoringSSL (#937)
Motivation: BoringSSL returns GENERIC when using TLS1.3 but the JDK TrustManager implementation expect UNKNOWN. We need to map it the expected value as otherwise we will see failures. Modifications: Adjust #if to also include BoringSSL Result: No more testfailures when running netty CI with netty-tcnative-boringssl-static SNAPSHOT
1 parent e46d949 commit d463fd8

File tree

1 file changed

+3
-5
lines changed

1 file changed

+3
-5
lines changed

openssl-dynamic/src/main/c/sslutils.c

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -78,17 +78,15 @@ const char* TCN_UNKNOWN_AUTH_METHOD = "UNKNOWN";
7878
* https://android.googlesource.com/platform/external/openssl/+/master/patches/0003-jsse.patch
7979
*/
8080
const char* tcn_SSL_cipher_authentication_method(const SSL_CIPHER* cipher){
81-
#if defined(OPENSSL_IS_BORINGSSL)
82-
return SSL_CIPHER_get_kx_name(cipher);
83-
#elif defined(OPENSSL_IS_AWSLC)
81+
#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
8482
const char* name = SSL_CIPHER_get_kx_name(cipher);
85-
if(strcmp(name, "GENERIC") == 0) {
83+
if (strcmp(name, "GENERIC") == 0) {
8684
// Only TLS 1.3 will report the kx name as generic.
8785
// Map this UNKNOWN, which will signal to Java to validate that
8886
// the certificate's keyUsage has at least the digitalSignature bit set.
8987
// (Per the SunJCE implementation).
9088
// This is done in the OpenSSL implementation a bit further down.
91-
return "UNKNOWN";
89+
return TCN_UNKNOWN_AUTH_METHOD;
9290
}
9391
return name;
9492
#elif OPENSSL_VERSION_NUMBER >= 0x10100000L && (!defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER >= 0x2070000fL)

0 commit comments

Comments
 (0)