From ab2fbfcecaf6d08ec28fca40a01273684e6b8d3b Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Wed, 28 Oct 2026 16:43:16 -0600 Subject: [PATCH 1/3] JNI: Stop printing verify/ALPN callback exceptions and cipher/RSA-PSS errors --- native/com_wolfssl_WolfCryptRSA.c | 3 ++- native/com_wolfssl_WolfSSL.c | 4 ++-- native/com_wolfssl_WolfSSLContext.c | 1 - native/com_wolfssl_WolfSSLSession.c | 9 ++------- 4 files changed, 6 insertions(+), 11 deletions(-) diff --git a/native/com_wolfssl_WolfCryptRSA.c b/native/com_wolfssl_WolfCryptRSA.c index 2844aec9..9735bec4 100644 --- a/native/com_wolfssl_WolfCryptRSA.c +++ b/native/com_wolfssl_WolfCryptRSA.c @@ -28,6 +28,7 @@ #include #include #include +#include #include "com_wolfssl_WolfCryptRSA.h" @@ -473,7 +474,7 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfCryptRSA_doPssVerify printf("wc_RsaPSS_Verify failed, ret = %d\n", ret); } } else { - printf("RSA key decode failed, ret = %d\n", ret); + WOLFSSL_MSG("RSA key decode failed"); } wc_FreeRsaKey(&myKey); diff --git a/native/com_wolfssl_WolfSSL.c b/native/com_wolfssl_WolfSSL.c index 92210901..856fc5db 100644 --- a/native/com_wolfssl_WolfSSL.c +++ b/native/com_wolfssl_WolfSSL.c @@ -2556,7 +2556,7 @@ JNIEXPORT jstring JNICALL Java_com_wolfssl_WolfSSL_getAvailableCipherSuitesIana } if (protocolVersion < 0 || protocolVersion > 8) { - printf("Input protocol version invalid: %d\n", protocolVersion); + WOLFSSL_MSG("Input protocol version invalid"); return NULL; } @@ -2609,7 +2609,7 @@ JNIEXPORT jstring JNICALL Java_com_wolfssl_WolfSSL_getAvailableCipherSuitesIana #endif #endif default: - printf("Input protocol version invalid: %d\n", protocolVersion); + WOLFSSL_MSG("Input protocol version invalid"); return NULL; } diff --git a/native/com_wolfssl_WolfSSLContext.c b/native/com_wolfssl_WolfSSLContext.c index b1894c64..dfcaa69f 100644 --- a/native/com_wolfssl_WolfSSLContext.c +++ b/native/com_wolfssl_WolfSSLContext.c @@ -926,7 +926,6 @@ int NativeVerifyCallback(int preverify_ok, WOLFSSL_X509_STORE_CTX* store) if ((*jenv)->ExceptionOccurred(jenv)) { /* exception occurred on the Java side during method call */ - (*jenv)->ExceptionDescribe(jenv); (*jenv)->ExceptionClear(jenv); freeNativeVerifyCbLocalRefs(jenv, excClass, verifyClass, verifyCbObj); diff --git a/native/com_wolfssl_WolfSSLSession.c b/native/com_wolfssl_WolfSSLSession.c index 17d5ebe2..39b87590 100644 --- a/native/com_wolfssl_WolfSSLSession.c +++ b/native/com_wolfssl_WolfSSLSession.c @@ -195,7 +195,6 @@ int NativeSSLVerifyCallback(int preverify_ok, WOLFSSL_X509_STORE_CTX* store) if ((*jenv)->ExceptionOccurred(jenv)) { /* exception occurred on the Java side during method call */ - (*jenv)->ExceptionDescribe(jenv); (*jenv)->ExceptionClear(jenv); (*jenv)->DeleteLocalRef(jenv, verifyCbObj); if (needsDetach) @@ -6276,10 +6275,8 @@ int NativeALPNSelectCb(WOLFSSL *ssl, const unsigned char **out, alpnSelectMethodId, (jobject)(*g_cachedSSLObj), outProtoArr, peerProtosArr); if ((*jenv)->ExceptionCheck(jenv)) { - (*jenv)->ExceptionDescribe(jenv); (*jenv)->ExceptionClear(jenv); - throwWolfSSLJNIException(jenv, - "Exception while calling internalAlpnSelectCallback()"); + WOLFSSL_MSG("Exception while calling internalAlpnSelectCallback()"); ret = SSL_TLSEXT_ERR_ALERT_FATAL; } } @@ -6304,11 +6301,9 @@ int NativeALPNSelectCb(WOLFSSL *ssl, const unsigned char **out, jenv, outProtoArr, 0); if (selectedProto == NULL) { if ((*jenv)->ExceptionCheck(jenv)) { - (*jenv)->ExceptionDescribe(jenv); (*jenv)->ExceptionClear(jenv); } - throwWolfSSLJNIException(jenv, - "Selected ALPN protocol in String[] is NULL"); + WOLFSSL_MSG("Selected ALPN protocol in String[] is NULL"); ret = SSL_TLSEXT_ERR_ALERT_FATAL; } } From e892571eb86514b8a716e0e4663ec653a2c20891 Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Wed, 28 Oct 2026 15:09:01 -0600 Subject: [PATCH 2/3] JNI/JSSE: bump version to 1.19 --- README.md | 2 +- build.xml | 2 +- pom.xml | 2 +- src/java/com/wolfssl/provider/jsse/WolfSSLProvider.java | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 37033a94..c1e25e2b 100644 --- a/README.md +++ b/README.md @@ -246,7 +246,7 @@ an application can include this as a dependency in the application's com.wolfssl wolfssl-jsse - 1.18.0-SNAPSHOT + 1.19.0-SNAPSHOT ... diff --git a/build.xml b/build.xml index 535fc90e..7745202a 100644 --- a/build.xml +++ b/build.xml @@ -14,7 +14,7 @@ - + diff --git a/pom.xml b/pom.xml index aad136f7..fc49baff 100644 --- a/pom.xml +++ b/pom.xml @@ -4,7 +4,7 @@ 4.0.0 com.wolfssl wolfssl-jsse - 1.18.0-SNAPSHOT + 1.19.0-SNAPSHOT jar wolfssl-jsse https://www.wolfssl.com diff --git a/src/java/com/wolfssl/provider/jsse/WolfSSLProvider.java b/src/java/com/wolfssl/provider/jsse/WolfSSLProvider.java index 811a34f9..f6e71bdb 100644 --- a/src/java/com/wolfssl/provider/jsse/WolfSSLProvider.java +++ b/src/java/com/wolfssl/provider/jsse/WolfSSLProvider.java @@ -77,8 +77,8 @@ public void errorCallback(int ok, int err, String hash) { */ @SuppressWarnings("deprecation") public WolfSSLProvider() { - super("wolfJSSE", 1.18, "wolfSSL JSSE Provider"); - /* super("wolfJSSE", "1.18", "wolfSSL JSSE Provider"); */ + super("wolfJSSE", 1.19, "wolfSSL JSSE Provider"); + /* super("wolfJSSE", "1.19", "wolfSSL JSSE Provider"); */ /* load native wolfSSLJNI library */ WolfSSL.loadLibrary(); From 70798c5253ee0f8c9ad4235aa98daaf14432d245 Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Wed, 28 Oct 2026 15:09:12 -0600 Subject: [PATCH 3/3] Update ChangeLog.md for 1.19 release --- ChangeLog.md | 97 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 97 insertions(+) diff --git a/ChangeLog.md b/ChangeLog.md index ea06e56e..4205c3b1 100644 --- a/ChangeLog.md +++ b/ChangeLog.md @@ -1,3 +1,100 @@ +### wolfSSL JNI Release 1.19.0 (10/29/2026) + +Release 1.19.0 of wolfSSL JNI and JSSE has bug fixes and new features including +fixes for socket read and handshake timeouts on Windows, SSLEngine fixes for +TLS 1.3 connections, and new JNI APIs for canceling a handshake and managing +native session timeouts. Other fixes validate JNI arguments and buffer sizes, +zero sensitive data, and release JNI resources on error paths. Other changes +improve session caching and resumption, closing connections before the handshake +finishes, and FIPS self-test behavior under concurrent use. + +**New JNI Functionality:** +* Add `WolfSSLSession.sendUserCanceled()` for canceling a handshake before it completes (PR 424) +* Add static `WolfSSLSession.sessionSetTimeout()` and related native session timeout methods (PR 435) +* Add `WolfSSLSession.getDhKeySize()` to get the negotiated DH group size in bits (PR 401) +* Add `WolfSSL.wolfssl_chacha` and `wolfssl_camellia` bulk cipher constants for `getBulkCipher()` (PR 421) + +**JNI and JSSE Changes:** +* Fix `SSLSocket.setSoTimeout()` read and handshake timeouts on Windows (PR 444) +* Fix `IllegalArgumentException` retrying `SSLEngine.unwrap()` after `BUFFER_OVERFLOW` on TLS 1.3 (PR 436) +* Fix `SSLEngine.unwrap()` truncating JDK `HttpClient` responses when TLS 1.3 servers send no ticket (PR 436) +* Fix Apache HttpClient 5 handshake failures from lowercase `"https"` endpoint identification (PR 434) +* Send `close_notify` when closing mid-handshake (PR 424) +* Fix `shutdownSSL()` looping on a `WANT_READ`/`WANT_WRITE` left from an unfinished handshake (PR 424) +* Fix `SSLEngine.isOutboundDone()` getting stuck after a failed init (PR 424) +* Return original native errors from `getError()` instead of `SSL_ERROR_SYSCALL` (PR 442) +* Fix `SSLSocket` `read()` returning 0 instead of -1 when the peer closes without `close_notify` (PR 442) +* Run FIPS CASTs once per process, fixing failures in concurrent threads when creating `WolfSSL` (PR 440) +* Fix LDAPS hostname checks allowing non-left-most wildcards with a basic `X509TrustManager` (PR 426) +* Fix minimum key sizes reset to 0 when `jdk.tls.disabledAlgorithms` has no `keySize` limit (PR 396) +* Enforce `jdk.tls.disabledAlgorithms` DH key size limits on the negotiated DH group (PR 401) +* Fix `CertManagerCheckOCSPResponse()` not returning an error when OCSP could not be enabled (PR 426) +* Omit subject alternative names containing NUL bytes instead of returning them truncated (PR 404) +* Fail on a corrupt system trust store and skip a missing `jssecacerts` (PR 416) +* Fix sessions invalidated with `SSLSession.invalidate()` still being resumed or cached (PR 406) +* Fix `SSLSession` IDs and SNI names lost after close or in sessions from the cache (PR 413, 435) +* Fix `SSLSession.getLocalPrincipal()` freeing certificates owned by the `X509KeyManager` (PR 416) +* Return null from `SSLSession` local identity getters when no `X509KeyManager` is set (PR 421) +* Fix `SSLEngine.getHandshakeSession()` returning a session when no handshake is in progress (PR 421) +* Fix `getPeerCertificateChainDER()` rejecting chains with empty slots from newer wolfSSL (PR 435) +* Fix `SSLSocket.close()` not cleanly ending blocked reads on Windows and `select()` builds (PR 397, 444) +* Fix `SSLSocket.close()` not treating `SO_LINGER` as seconds and waiting when it is 0 (PR 444) +* Fix native resource leaks when `SSLSocket.close()` overlaps I/O or follows transport close (PR 414, 415, 418) +* Fix `SSLServerSocket.accept()` leaking the accepted socket when wrapping it fails (PR 420) +* Fix `SSLEngine` send buffer growth ignoring queued data, which could fail large `wrap()` calls (PR 400) +* Throw `IllegalArgumentException` from `setUseClientMode()` once the handshake has begun (PR 419) +* Reject negative session timeouts and packet sizes and empty ALPN protocol names (PR 420) +* Fix `jdk.tls.*.SignatureSchemes` properties skipping schemes after a comma and space (PR 419) +* Fix ALPN protocol names with commas, NUL or non-ASCII bytes being altered in select callbacks (PR 431) +* Fix `setHandshakeApplicationProtocolSelector(null)` not clearing the ALPN selector (PR 418) +* Fix `KeyManagerFactory` key loading failing after the caller clears its `init()` password (PR 429) +* Fix `X509KeyManager` alias lookups failing on KeyStore entries without a certificate (PR 412) +* Fix Android system CA loading stopping at a CA file whose DER conversion fails (PR 417) +* Fix `WolfSSLX509.getExtensionValue()` returning the extension OID instead of its DER value (PR 437) +* Fix `getExtendedKeyUsage()` null entries and missing `anyExtendedKeyUsage` or unknown OIDs (PR 396, 411, 437) +* Fix `getKeyUsage()` truncating Key Usage bits past `decipherOnly` (PR 438) +* Fix `WolfSSLX509.getPublicKey()` returning null for EdDSA and RSASSA-PSS keys (PR 416) +* Fix `WolfSSLX509` subject and issuer DNs mangling RDN types such as `DC` (PR 407) +* Fix `WolfSSLX509` extension OID getters returning null or empty sets contrary to `X509Certificate` (PR 409) +* Report a freed `WolfSSLX509` as not a CA from `getBasicConstraints()` (PR 430) +* Return the distinguished name from `WolfSSLX509Name.toString()` (PR 420) +* Fix `WolfSSLAltName.equals()` giving different results depending on argument order (PR 411) +* Throw from `WolfSSLCertificate.getX509Certificate()` on errors instead of returning null (PR 422) +* Return null from `WolfSSLX509StoreCtx.getCerts()` when a chain certificate cannot be read (PR 396) +* Fix certificate, CSR and CRL signing methods not reporting native signing failures (PR 394) +* Fix certificate and CRL date setters truncating dates or using uninitialized time data (PR 402) +* Fix certificate and CRL validity date parsing failing under non-English default locales (PR 416) +* Fix `WolfSSLCRL.addRevoked()` and `addRevokedCert()` ignoring the given revocation date (PR 407) +* Fix `WolfSSLSession.write()` resending data when falling back from its direct `ByteBuffer` path (PR 427) +* Reject invalid `read()` and `write()` offsets and lengths before any data is read or sent (PR 400, 427, 429) +* Fix PSK handshakes failing with no identity hint or a maximum-length client identity (PR 410, 439) +* Fix `WolfSSLSession.dtlsSetPeer()` and `dtlsGetPeer()` with IPv6 peer addresses (PR 421) +* Fix `WolfSSL.getErrno()` returning `errno` instead of `WSAGetLastError()` on Windows (PR 444) + +**Debugging Changes:** +* Fix `refreshDebugFlags()` ignoring `wolfjsse.debugFormat` changes while debug logging is on (PR 422) + +**Example Changes:** +* Use client certificates in the RMI, threaded socket and dual-provider FIPS example servers (PR 405) +* Enable HTTPS hostname verification in the RMI TLS client example (PR 405) +* Link Android example native libraries with 16 KB page alignment for Android 15+ devices (PR 432) +* Update Android example FIPS Ready core hash defaults to the FIPS v7 HMAC-SHA-512 length (PR 432) + +**Testing Changes:** +* Add socket read and handshake timeout tests, and run close interrupt tests on Windows (PR 444) +* Cap busy-spin threads in concurrent `SSLSocket` close tests to avoid timeouts on many-core hosts (PR 395) +* Fix flaky session resumption and `SSLEngine` memory leak tests (PR 435) +* Add test certificates for EKU, Key Usage, and EdDSA and RSA-PSS public key handling (PR 396, 416, 437, 438) +* Add a test checking that revoked serial numbers in generated CRLs decode unchanged (PR 413) + +**Misc Changes:** +* Auto-detect `JAVA_HOME` in the `Makefile` and quote JNI include paths for directories with spaces (PR 402) +* Update Android example Gradle wrapper to 8.4 and remove an unused `libs/*.jar` dependency (PR 425) + +The wolfSSL JNI/JSSE Manual is available at: +https://www.wolfssl.com/documentation/manuals/wolfssljni/. For build +instructions and more details, please check the manual. + ### wolfSSL JNI Release 1.18.0 (08/10/2026) Release 1.18.0 of wolfSSL JNI and JSSE changes the open source license from