This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new da20b82c07 Review "Exclude unimplemented SSLv2 ciphers when converting
OpenSSL..."
da20b82c07 is described below
commit da20b82c0717af82f4798ab2f3326f7d69bebf04
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Nov 4 10:23:11 2026 +0000
Review "Exclude unimplemented SSLv2 ciphers when converting OpenSSL..."
Make enabled cipher list and supported cipher list consistent
---
java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java | 13 ++++++++-----
.../tomcat/util/net/openssl/panama/OpenSSLEngine.java | 13 ++++++++-----
2 files changed, 16 insertions(+), 10 deletions(-)
diff --git a/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java
b/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java
index 33b6fd1036..40a16fa6ef 100644
--- a/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java
+++ b/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java
@@ -763,13 +763,16 @@ public final class OpenSSLEngine extends SSLEngine
implements SSLUtil.ProtocolIn
if (enabled == null) {
return new String[0];
} else {
- for (int i = 0; i < enabled.length; i++) {
- String mapped =
OpenSSLCipherConfigurationParser.openSSLToJsse(enabled[i]);
- if (mapped != null) {
- enabled[i] = mapped;
+ // Only report ciphers with a JSSE equivalent so the enabled
ciphers are always a subset of the supported
+ // ciphers
+ List<String> mapped = new ArrayList<>(enabled.length);
+ for (String cipher : enabled) {
+ String jsseName =
OpenSSLCipherConfigurationParser.openSSLToJsse(cipher);
+ if (jsseName != null) {
+ mapped.add(jsseName);
}
}
- return enabled;
+ return mapped.toArray(new String[0]);
}
}
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
index 420ca4d554..0a866163cc 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
@@ -675,13 +675,16 @@ public final class OpenSSLEngine extends SSLEngine
implements SSLUtil.ProtocolIn
return new String[0];
}
String[] enabled = OpenSSLLibrary.getCiphers(state.ssl);
- for (int i = 0; i < enabled.length; i++) {
- String mapped =
OpenSSLCipherConfigurationParser.openSSLToJsse(enabled[i]);
- if (mapped != null) {
- enabled[i] = mapped;
+ // Only report ciphers with a JSSE equivalent so the enabled ciphers
are always a subset of the supported
+ // ciphers
+ List<String> mapped = new ArrayList<>(enabled.length);
+ for (String cipher : enabled) {
+ String jsseName =
OpenSSLCipherConfigurationParser.openSSLToJsse(cipher);
+ if (jsseName != null) {
+ mapped.add(jsseName);
}
}
- return enabled;
+ return mapped.toArray(new String[0]);
}
@Override
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
