On Sun, Aug 2, 2026 at 10:37 AM Gary Gregory <[email protected]> wrote: > > What is the intended relationship between > TlsCiphers.isH2Blacklisted(String) and isWeak(String)? > > I was expecting this to pass but it doesn't because it IMO > "blacklisted" is stronger than "weak":
What's below is in https://github.com/apache/httpcomponents-core/pull/686 as a disabled test. Gary > > diff --git > a/httpcore5/src/main/java/org/apache/hc/core5/http/ssl/TlsCiphers.java > b/httpcore5/src/main/java/org/apache/hc/core5/http/ssl/TlsCiphers.java > index 140f925..803514f 100644 > --- a/httpcore5/src/main/java/org/apache/hc/core5/http/ssl/TlsCiphers.java > +++ b/httpcore5/src/main/java/org/apache/hc/core5/http/ssl/TlsCiphers.java > @@ -371,4 +371,8 @@ public static boolean isWeak(final String cipherSuite) { > return !enabledCiphers.isEmpty() ? enabledCiphers.toArray(new > String[0]) : ciphers; > } > > + static Set<String> getH2Blacklisted() { > + return H2_BLACKLISTED; > + } > + > } > diff --git > a/httpcore5/src/test/java/org/apache/hc/core5/http/ssl/TestTlsCiphers.java > b/httpcore5/src/test/java/org/apache/hc/core5/http/ssl/TestTlsCiphers.java > index f2c1929..0a3bafa 100644 > --- a/httpcore5/src/test/java/org/apache/hc/core5/http/ssl/TestTlsCiphers.java > +++ b/httpcore5/src/test/java/org/apache/hc/core5/http/ssl/TestTlsCiphers.java > @@ -95,6 +95,15 @@ void testExcludeWeakNull() { > } > > @ParameterizedTest > + > @MethodSource("org.apache.hc.core5.http.ssl.TlsCiphers#getH2Blacklisted()") > + void testH2BlacklistedIsWeak(final String h2BlacklistedCipherSuite) { > + // Sanity assert > + > Assertions.assertTrue(TlsCiphers.isH2Blacklisted(h2BlacklistedCipherSuite), > h2BlacklistedCipherSuite); > + // Test > + Assertions.assertTrue(TlsCiphers.isWeak(h2BlacklistedCipherSuite), > h2BlacklistedCipherSuite); > + } > + > + @ParameterizedTest > @ValueSource(strings = { > "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", > "TLS_RSA_WITH_AES_256_CBC_SHA256", > @@ -129,4 +138,5 @@ void testWeakCiphersDisabledByDefault(final String > weakCiphersSuite) { > Assertions.assertTrue(TlsCiphers.isWeak(weakCiphersSuite)); > } > > + > } > > -- > TY, > Gary > > On Sun, Aug 2, 2026 at 9:07 AM Gary Gregory <[email protected]> wrote: > > > > On Sun, Aug 2, 2026 at 4:54 AM Oleg Kalnichevski <[email protected]> wrote: > > > > > > On Sat, 2026-08-01 at 21:14 -0400, Gary Gregory wrote: > > > > Hi All, > > > > > > > > Is there anything that we can do in our code to facilitate RFC 10015 > > > > and > > > > further secure users of HttpClient? > > > > > > > > https://www.rfc-editor.org/rfc/rfc10015.html > > > > > > > > Ty, > > > > Gary > > > > > > Hi Gary > > > > > > We already have weak cipher exclusion logic, for instance, used to > > > exclude cipher blacklisted by the HTTP/2 spec. > > > > > > https://github.com/apache/httpcomponents-core/blob/master/httpcore5/src/main/java/org/apache/hc/core5/http/ssl/TlsCiphers.java#L348 > > > > > > One would have to review the existing implementation and make sure it > > > conforms to RFC 10015. > > > > I'll create a PR... > > > > Gary > > > > > > > > Oleg > > > > > > --------------------------------------------------------------------- > > > To unsubscribe, e-mail: [email protected] > > > For additional commands, e-mail: [email protected] > > > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
