Add SSL configuration tests

Added TestSSLConf with 15 tests for SSL_CONF context creation,
configuration command validation, protocol and cipher configuration,
and command sequence execution.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: csutherl

test/org/apache/tomcat/jni/TestSSLConf.java

@@ -0,0 +1,250 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.tomcat.jni;
+
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+
+/**
+ * Tests for SSL_CONF context and OpenSSL configuration commands.
+ */
+public class TestSSLConf extends BaseTest {
+
+    private long pool;
+    private long sslCtx;
+    private long confCtx;
+
+    @Before
+    public void setup() throws Exception {
+        requireLibrary();
+        pool = Pool.create(0);
+        sslCtx = SSLContext.make(pool, SSL.SSL_PROTOCOL_ALL, SSL.SSL_MODE_SERVER);
+    }
+
+    @After
+    public void tearDown() {
+        if (confCtx != 0) {
+            SSLConf.free(confCtx);
+        }
+        if (sslCtx != 0) {
+            SSLContext.free(sslCtx);
+        }
+        if (pool != 0) {
+            Pool.destroy(pool);
+        }
+    }
+
+    @Test
+    public void testCreateServerSSLConf() throws Exception {
+        confCtx = SSLConf.make(pool, SSL.SSL_CONF_FLAG_SERVER);
+        Assert.assertNotEquals("SSL_CONF context should be created", 0, confCtx);
+    }
+
+    @Test
+    public void testCreateClientSSLConf() throws Exception {
+        confCtx = SSLConf.make(pool, SSL.SSL_CONF_FLAG_CLIENT);
+        Assert.assertNotEquals("SSL_CONF context should be created", 0, confCtx);
+    }
+
+    @Test
+    public void testCreateSSLConfWithMultipleFlags() throws Exception {
+        int flags = SSL.SSL_CONF_FLAG_SERVER | SSL.SSL_CONF_FLAG_FILE;
+        confCtx = SSLConf.make(pool, flags);
+        Assert.assertNotEquals("SSL_CONF context with multiple flags should be created", 0, confCtx);
+    }
+
+    @Test
+    public void testAssignSSLContext() throws Exception {
+        confCtx = SSLConf.make(pool, SSL.SSL_CONF_FLAG_SERVER);
+
+        // Assign SSL context to CONF context - should not throw
+        SSLConf.assign(confCtx, sslCtx);
+        Assert.assertTrue("Assignment should succeed without exception", true);
+    }
+
+    @Test
+    public void testCheckMinProtocol() throws Exception {
+        confCtx = SSLConf.make(pool, SSL.SSL_CONF_FLAG_SERVER);
+        SSLConf.assign(confCtx, sslCtx);
+
+        // Check MinProtocol command
+        int result = SSLConf.check(confCtx, "MinProtocol", "TLSv1.2");
+        Assert.assertTrue("MinProtocol check should return valid result", result >= 0);
+    }
+
+    @Test
+    public void testCheckCipherString() throws Exception {
+        confCtx = SSLConf.make(pool, SSL.SSL_CONF_FLAG_SERVER);
+        SSLConf.assign(confCtx, sslCtx);
+
+        // Check CipherString command
+        int result = SSLConf.check(confCtx, "CipherString", "HIGH:!aNULL");
+        Assert.assertTrue("CipherString check should return valid result", result >= 0);
+    }
+
+    @Test
+    public void testApplyMinProtocol() throws Exception {
+        confCtx = SSLConf.make(pool, SSL.SSL_CONF_FLAG_SERVER);
+        SSLConf.assign(confCtx, sslCtx);
+
+        // Apply MinProtocol command
+        int result = SSLConf.apply(confCtx, "MinProtocol", "TLSv1.2");
+        Assert.assertTrue("MinProtocol apply should return success", result > 0);
+    }
+
+    @Test
+    public void testApplyMaxProtocol() throws Exception {
+        confCtx = SSLConf.make(pool, SSL.SSL_CONF_FLAG_SERVER);
+        SSLConf.assign(confCtx, sslCtx);
+
+        // Apply MaxProtocol command
+        int result = SSLConf.apply(confCtx, "MaxProtocol", "TLSv1.3");
+        Assert.assertTrue("MaxProtocol apply should return success", result > 0);
+    }
+
+    @Test
+    public void testApplyCipherString() throws Exception {
+        confCtx = SSLConf.make(pool, SSL.SSL_CONF_FLAG_SERVER);
+        SSLConf.assign(confCtx, sslCtx);
+
+        // Apply CipherString command
+        int result = SSLConf.apply(confCtx, "CipherString", "HIGH:!aNULL:!MD5");
+        Assert.assertTrue("CipherString apply should return success", result > 0);
+    }
+
+    @Test
+    public void testApplyOptions() throws Exception {
+        confCtx = SSLConf.make(pool, SSL.SSL_CONF_FLAG_SERVER);
+        SSLConf.assign(confCtx, sslCtx);
+
+        // Apply Options command
+        int result = SSLConf.apply(confCtx, "Options", "ServerPreference");
+        Assert.assertTrue("Options apply should return success", result > 0);
+    }
+
+    @Test
+    public void testFinish() throws Exception {
+        confCtx = SSLConf.make(pool, SSL.SSL_CONF_FLAG_SERVER);
+        SSLConf.assign(confCtx, sslCtx);
+
+        // Apply some commands
+        SSLConf.apply(confCtx, "MinProtocol", "TLSv1.2");
+        SSLConf.apply(confCtx, "CipherString", "HIGH");
+
+        // Finish should be called after all commands
+        int result = SSLConf.finish(confCtx);
+        Assert.assertTrue("Finish should return success", result > 0);
+    }
+
+    @Test
+    public void testMultipleCommandSequence() throws Exception {
+        confCtx = SSLConf.make(pool, SSL.SSL_CONF_FLAG_SERVER);
+        SSLConf.assign(confCtx, sslCtx);
+
+        // Apply multiple commands in sequence
+        int result1 = SSLConf.apply(confCtx, "MinProtocol", "TLSv1.2");
+        Assert.assertTrue("First command should succeed", result1 > 0);
+
+        int result2 = SSLConf.apply(confCtx, "MaxProtocol", "TLSv1.3");
+        Assert.assertTrue("Second command should succeed", result2 > 0);
+
+        int result3 = SSLConf.apply(confCtx, "CipherString", "HIGH:!aNULL");
+        Assert.assertTrue("Third command should succeed", result3 > 0);
+
+        int finishResult = SSLConf.finish(confCtx);
+        Assert.assertTrue("Finish should succeed", finishResult > 0);
+    }
+
+    @Test
+    public void testCheckBeforeApply() throws Exception {
+        confCtx = SSLConf.make(pool, SSL.SSL_CONF_FLAG_SERVER);
+        SSLConf.assign(confCtx, sslCtx);
+
+        // Check a command first
+        int checkResult = SSLConf.check(confCtx, "MinProtocol", "TLSv1.2");
+        Assert.assertTrue("Check should succeed", checkResult >= 0);
+
+        // Then apply the same command
+        int applyResult = SSLConf.apply(confCtx, "MinProtocol", "TLSv1.2");
+        Assert.assertTrue("Apply should succeed after check", applyResult > 0);
+    }
+
+    @Test
+    public void testInvalidCommandHandling() throws Exception {
+        confCtx = SSLConf.make(pool, SSL.SSL_CONF_FLAG_SERVER);
+        SSLConf.assign(confCtx, sslCtx);
+
+        // Try applying an invalid command - should handle gracefully
+        try {
+            int result = SSLConf.apply(confCtx, "InvalidCommand", "SomeValue");
+            // Result might be <= 0 for unrecognized commands
+            // This is acceptable behavior
+            Assert.assertTrue("Invalid command handled", true);
+        } catch (Exception e) {
+            // Exception is also acceptable for invalid commands
+            Assert.assertTrue("Exception on invalid command is acceptable", true);
+        }
+    }
+
+    @Test
+    public void testMultipleSSLConfContexts() throws Exception {
+        long confCtx1 = SSLConf.make(pool, SSL.SSL_CONF_FLAG_SERVER);
+        long confCtx2 = SSLConf.make(pool, SSL.SSL_CONF_FLAG_CLIENT);
+
+        Assert.assertNotEquals("First CONF context should be created", 0, confCtx1);
+        Assert.assertNotEquals("Second CONF context should be created", 0, confCtx2);
+        Assert.assertNotEquals("CONF contexts should differ", confCtx1, confCtx2);
+
+        // Assign same SSL context to both
+        SSLConf.assign(confCtx1, sslCtx);
+        SSLConf.assign(confCtx2, sslCtx);
+
+        // Apply different commands to each
+        SSLConf.apply(confCtx1, "MinProtocol", "TLSv1.2");
+        SSLConf.apply(confCtx2, "MinProtocol", "TLSv1.3");
+
+        SSLConf.free(confCtx2);
+        SSLConf.free(confCtx1);
+
+        // Set confCtx to 0 so tearDown doesn't try to free it again
+        confCtx = 0;
+    }
+
+    @Test
+    public void testProtocolConfiguration() throws Exception {
+        confCtx = SSLConf.make(pool, SSL.SSL_CONF_FLAG_SERVER);
+        SSLConf.assign(confCtx, sslCtx);
+
+        // Test different protocol combinations
+        String[] protocols = {"TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3"};
+
+        for (String protocol : protocols) {
+            // Just verify these don't throw - actual protocol support
+            // depends on OpenSSL version
+            try {
+                SSLConf.apply(confCtx, "MinProtocol", protocol);
+            } catch (Exception e) {
+                // Some protocols might not be supported
+                // That's acceptable
+            }
+        }
+
+        SSLConf.finish(confCtx);
+    }
+}