Skip to content

Commit 6ea78a6

Browse files
committed
Fix cause of crashes with Native + NIO2 + OpenSSL
Prevent concurrent release of <code>OpenSSLEngine</code> resources and the termination of the Tomcat Native library as it can cause crashes during Tomcat shutdown.clear
1 parent 075f96c commit 6ea78a6

File tree

2 files changed

+20
-7
lines changed

2 files changed

+20
-7
lines changed

java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@
4141
import org.apache.juli.logging.Log;
4242
import org.apache.juli.logging.LogFactory;
4343
import org.apache.tomcat.jni.Buffer;
44+
import org.apache.tomcat.jni.Library;
4445
import org.apache.tomcat.jni.Pool;
4546
import org.apache.tomcat.jni.SSL;
4647
import org.apache.tomcat.jni.SSLContext;
@@ -134,6 +135,7 @@ enum ClientAuthMode {
134135
// OpenSSL state
135136
private final long ssl;
136137
private final long networkBIO;
138+
private final long aprGeneration;
137139

138140
private enum Accepted {
139141
NOT,
@@ -195,6 +197,7 @@ private enum Accepted {
195197
if (sslCtx == 0) {
196198
throw new IllegalArgumentException(sm.getString("engine.noSSLContext"));
197199
}
200+
aprGeneration = Library.getGeneration();
198201
session = new OpenSSLSession();
199202
ssl = SSL.newSSL(sslCtx, !clientMode);
200203
networkBIO = SSL.makeNetworkBIO(ssl);
@@ -218,14 +221,20 @@ public String getNegotiatedProtocol() {
218221
public synchronized void shutdown() {
219222
if (!destroyed) {
220223
destroyed = true;
221-
if (networkBIO != 0) {
222-
SSL.freeBIO(networkBIO);
223-
}
224-
if (ssl != 0) {
225-
SSL.freeSSL(ssl);
226-
}
227224
// internal errors can cause shutdown without marking the engine closed
228225
isInboundDone = isOutboundDone = engineClosed = true;
226+
if (Library.tryCleanUpLock(aprGeneration)) {
227+
try {
228+
if (networkBIO != 0) {
229+
SSL.freeBIO(networkBIO);
230+
}
231+
if (ssl != 0) {
232+
SSL.freeSSL(ssl);
233+
}
234+
} finally {
235+
Library.returnCleanUpLock();
236+
}
237+
}
229238
}
230239
}
231240

@@ -1442,5 +1451,4 @@ public int getApplicationBufferSize() {
14421451
}
14431452

14441453
}
1445-
14461454
}

webapps/docs/changelog.xml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,11 @@
206206
Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.
207207
(remm)
208208
</fix>
209+
<fix>
210+
Prevent concurrent release of <code>OpenSSLEngine</code> resources and
211+
the termination of the Tomcat Native library as it can cause crashes
212+
during Tomcat shutdown. (markt)
213+
</fix>
209214
</changelog>
210215
</subsection>
211216
<subsection name="Jasper">

0 commit comments

Comments
 (0)