netty · normanmaurer · Aug 23, 2018 · Aug 20, 2018
diff --git a/boringssl-static/pom.xml b/boringssl-static/pom.xml
@@ -239,7 +239,8 @@
                   <configureArgs>
                     <configureArg>--with-ssl=no</configureArg>
                     <configureArg>--with-apr=${aprHome}</configureArg>
-                    <configureArg>CFLAGS=-O3 -Werror -fno-omit-frame-pointer -Wunused-variable</configureArg>
+                    <configureArg>--with-static-libs</configureArg>
+                    <configureArg>CFLAGS=-O3 -Werror -fno-omit-frame-pointer -fvisibility=hidden -Wunused-variable</configureArg>
                     <configureArg>CPPFLAGS=-DHAVE_OPENSSL -I${boringsslCheckoutDir}/include</configureArg>
                     <configureArg>LDFLAGS=-L${boringsslBuildDir}/ssl -L${boringsslBuildDir}/crypto -L${boringsslBuildDir}/decrepit -ldecrepit -lssl -lcrypto</configureArg>
                   </configureArgs>

diff --git a/libressl-static/pom.xml b/libressl-static/pom.xml
@@ -63,6 +63,7 @@
               <configureArgs>
                 <configureArg>--with-ssl=${sslHome}</configureArg>
                 <configureArg>--with-apr=${aprHome}</configureArg>
+                <configureArg>--with-static-libs</configureArg>
               </configureArgs>
             </configuration>
           </execution>
@@ -149,8 +150,9 @@
         </plugins>
       </build>
     </profile>
+
     <profile>
-      <id>build-libressl-linux-mac</id>
+      <id>build-libressl-non-windows</id>
       <activation>
         <os>
           <family>!windows</family>
@@ -163,7 +165,7 @@
             <executions>
               <!-- Download and build LibreSSL -->
               <execution>
-                <id>build-libressl-linux-mac</id>
+                <id>build-libressl-non-windows</id>
                 <phase>generate-sources</phase>
                 <goals>
                   <goal>run</goal>

diff --git a/openssl-dynamic/src/main/c/jnilib.c b/openssl-dynamic/src/main/c/jnilib.c
@@ -290,7 +290,7 @@ static const JNINativeMethod method_table[] = {
 static const jint method_table_size = sizeof(method_table) / sizeof(method_table[0]);
 // JNI Method Registration Table End
 
-jint netty_internal_tcnative_Library_JNI_OnLoad(JNIEnv* env, const char* packagePrefix) {
+static jint netty_internal_tcnative_Library_JNI_OnLoad(JNIEnv* env, const char* packagePrefix) {
     if (netty_internal_tcnative_util_register_natives(env, packagePrefix, "io/netty/internal/tcnative/Library", method_table, method_table_size) != 0) {
         return JNI_ERR;
     }
@@ -341,7 +341,7 @@ jint netty_internal_tcnative_Library_JNI_OnLoad(JNIEnv* env, const char* package
     return TCN_JNI_VERSION;
 }
 
-void netty_internal_tcnative_Library_JNI_OnUnLoad(JNIEnv* env) {
+static void netty_internal_tcnative_Library_JNI_OnUnLoad(JNIEnv* env) {
     if (tcn_global_pool != NULL) {
         TCN_UNLOAD_CLASS(env, jString_class);
         apr_terminate();
@@ -356,8 +356,7 @@ void netty_internal_tcnative_Library_JNI_OnUnLoad(JNIEnv* env) {
     netty_internal_tcnative_SSLContext_JNI_OnUnLoad(env);
 }
 
-// JNI Wrapper for statically built Java 8 deps
-jint JNI_OnLoad_netty_tcnative(JavaVM* vm, void* reserved) {
+static jint JNI_OnLoad_netty_tcnative0(JavaVM* vm, void* reserved) {
     JNIEnv* env;
     if ((*vm)->GetEnv(vm, (void**) &env, TCN_JNI_VERSION) != JNI_OK) {
         return JNI_ERR;
@@ -417,13 +416,7 @@ jint JNI_OnLoad_netty_tcnative(JavaVM* vm, void* reserved) {
     return ret;
 }
 
-#ifndef TCN_BUILD_STATIC
-JNIEXPORT jint JNI_OnLoad(JavaVM* vm, void* reserved) {
-    return JNI_OnLoad_netty_tcnative(vm, reserved);
-}
-#endif /* TCN_BUILD_STATIC */
-
-void JNI_OnUnload_netty_tcnative(JavaVM* vm, void* reserved) {
+static void JNI_OnUnload_netty_tcnative0(JavaVM* vm, void* reserved) {
     JNIEnv* env;
     if ((*vm)->GetEnv(vm, (void**) &env, TCN_JNI_VERSION) != JNI_OK) {
         // Something is wrong but nothing we can do about this :(
@@ -432,8 +425,28 @@ void JNI_OnUnload_netty_tcnative(JavaVM* vm, void* reserved) {
     netty_internal_tcnative_Library_JNI_OnUnLoad(env);
 }
 
+// As we build with -fvisibility=hidden we need to ensure we mark the entry load and unload functions used by the
+// JVM as visible.
+//
+// It's important to note that we will only export functions that are prefixed with JNI_ so if we ever need to export
+// more we need to ensure we add the prefix. This is enforced by the TCN_CHECK_STATIC function in tcnative.m4.
+
+// Invoked by the JVM when statically linked
+JNIEXPORT jint JNI_OnLoad_netty_tcnative(JavaVM* vm, void* reserved) {
+    return JNI_OnLoad_netty_tcnative0(vm, reserved);
+}
+
+// Invoked by the JVM when statically linked
+JNIEXPORT void JNI_OnUnload_netty_tcnative(JavaVM* vm, void* reserved) {
+    JNI_OnUnload_netty_tcnative0(vm, reserved);
+}
+
 #ifndef TCN_BUILD_STATIC
+JNIEXPORT jint JNI_OnLoad(JavaVM* vm, void* reserved) {
+    return JNI_OnLoad_netty_tcnative0(vm, reserved);
+}
+
 JNIEXPORT void JNI_OnUnload(JavaVM* vm, void* reserved) {
-  JNI_OnUnload_netty_tcnative(vm, reserved);
+    JNI_OnUnload_netty_tcnative0(vm, reserved);
 }
 #endif /* TCN_BUILD_STATIC */
diff --git a/openssl-dynamic/src/main/native-package/configure.ac b/openssl-dynamic/src/main/native-package/configure.ac
@@ -28,8 +28,8 @@ AC_CONFIG_HEADERS([src/config.h])
 AC_CANONICAL_HOST
 AC_CANONICAL_SYSTEM
 
-${CFLAGS="-O3 -Werror -fno-omit-frame-pointer -Wunused-variable"}
-${CXXFLAGS="-O3 -Werror -fno-omit-frame-pointer -Wunused-variable"}
+${CFLAGS="-O3 -Werror -fno-omit-frame-pointer -fvisibility=hidden -Wunused-variable"}
+${CXXFLAGS="-O3 -Werror -fno-omit-frame-pointer -fvisibility=hidden -Wunused-variable"}
 
 ## -----------------------------------------------
 ## Application Checks

diff --git a/openssl-dynamic/src/main/native-package/m4/custom.m4 b/openssl-dynamic/src/main/native-package/m4/custom.m4
@@ -41,7 +41,10 @@ AC_DEFUN([CUSTOM_M4_SETUP],
     esac
   ])
 
-  dnl Make sure OpenSSL is available in the system.
+  dnl Check if the libs we link against are static
+  TCN_CHECK_STATIC
+
+  dnl Make sure OpenSSL is available in the system and set extra flags if we compile against a static version.
   if $use_openssl ; then
     TCN_CHECK_SSL_TOOLKIT
   fi

diff --git a/openssl-dynamic/src/main/native-package/m4/tcnative.m4 b/openssl-dynamic/src/main/native-package/m4/tcnative.m4
@@ -275,6 +275,32 @@ dnl Note: this define must be on one line so that it can be properly returned
 dnl as the help string.
 AC_DEFUN([TCN_HELP_STRING],[ifelse(regexp(AC_ACVERSION, 2\.1), -1, AC_HELP_STRING($1,$2),[  ]$1 substr([                       ],len($1))$2)])dnl
 
+dnl
+dnl TCN_CHECK_STATIC
+dnl Will prepare more LDFLAGS that should be set to ensure we do not export any functions from the static compiled APR / OpenSSL libs.
+dnl
+AC_DEFUN([TCN_CHECK_STATIC],[
+    LD_FLAGS_STATIC=""
+
+    AC_ARG_WITH(static-libs,
+      [  --with-static-libs     The libraries we link against are static.],
+      [
+
+      case $host in
+      *-darwin*)
+          LD_FLAGS_STATIC="-Wl,-exported_symbol,_JNI_*"
+          ;;
+      *linux*)
+          LD_FLAGS_STATIC="-Wl,--exclude-libs,ALL"
+          ;;
+      *)
+          LD_FLAGS_STATIC=""
+          ;;
+      esac
+
+    ])
+])
+
 dnl
 dnl TCN_CHECK_SSL_TOOLKIT
 dnl
@@ -410,4 +436,6 @@ then
     APR_ADDTO(TCNATIVE_LDFLAGS, [$TCN_OPENSSL_LIBS])
     APR_ADDTO(CFLAGS, [-DHAVE_OPENSSL])
 fi
+
+APR_ADDTO(LDFLAGS, [$LD_FLAGS_STATIC])
 ])
diff --git a/openssl-static/pom.xml b/openssl-static/pom.xml
@@ -73,6 +73,7 @@
               <configureArgs>
                 <configureArg>--with-ssl=${sslHome}</configureArg>
                 <configureArg>--with-apr=${aprHome}</configureArg>
+                <configureArg>--with-static-libs</configureArg>
               </configureArgs>
             </configuration>
           </execution>
@@ -186,7 +187,7 @@
       <id>build-openssl-linux</id>
       <activation>
         <os>
-          <family>unix</family>
+          <family>linux</family>
         </os>
       </activation>
       <build>