This is an automated email from the ASF dual-hosted git repository. markt-asf pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 7983e72e5d4556f6c9b471cb378e79524e85b6fe Author: Mark Thomas <[email protected]> AuthorDate: Wed Nov 4 10:23:11 2026 +0000 Review "Exclude unimplemented SSLv2 ciphers when converting OpenSSL..." Make enabled cipher list and supported cipher list consistent --- java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java | 13 ++++++++----- .../tomcat/util/net/openssl/panama/OpenSSLEngine.java | 13 ++++++++----- 2 files changed, 16 insertions(+), 10 deletions(-) diff --git a/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java index 4d8d71f0b4..a785eef1d0 100644 --- a/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java +++ b/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java @@ -755,13 +755,16 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn if (enabled == null) { return new String[0]; } else { - for (int i = 0; i < enabled.length; i++) { - String mapped = OpenSSLCipherConfigurationParser.openSSLToJsse(enabled[i]); - if (mapped != null) { - enabled[i] = mapped; + // Only report ciphers with a JSSE equivalent so the enabled ciphers are always a subset of the supported + // ciphers + List<String> mapped = new ArrayList<>(enabled.length); + for (String cipher : enabled) { + String jsseName = OpenSSLCipherConfigurationParser.openSSLToJsse(cipher); + if (jsseName != null) { + mapped.add(jsseName); } } - return enabled; + return mapped.toArray(new String[0]); } } diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java index 6f09163d2f..ca55e4fc62 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java @@ -675,13 +675,16 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn return new String[0]; } String[] enabled = OpenSSLLibrary.getCiphers(state.ssl); - for (int i = 0; i < enabled.length; i++) { - String mapped = OpenSSLCipherConfigurationParser.openSSLToJsse(enabled[i]); - if (mapped != null) { - enabled[i] = mapped; + // Only report ciphers with a JSSE equivalent so the enabled ciphers are always a subset of the supported + // ciphers + List<String> mapped = new ArrayList<>(enabled.length); + for (String cipher : enabled) { + String jsseName = OpenSSLCipherConfigurationParser.openSSLToJsse(cipher); + if (jsseName != null) { + mapped.add(jsseName); } } - return enabled; + return mapped.toArray(new String[0]); } @Override --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
