This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/11.0.x by this push:
new 12c1387c92 Review "Exclude unimplemented SSLv2 ciphers when converting
OpenSSL..."
12c1387c92 is described below
commit 12c1387c920293b3cc841671efd4055243e80168
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Nov 4 10:23:11 2026 +0000
Review "Exclude unimplemented SSLv2 ciphers when converting OpenSSL..."
Make enabled cipher list and supported cipher list consistent
---
java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java | 13 ++++++++-----
.../tomcat/util/net/openssl/panama/OpenSSLEngine.java | 13 ++++++++-----
2 files changed, 16 insertions(+), 10 deletions(-)
diff --git a/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java
b/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java
index 33bf8c15eb..a62dbb1f8d 100644
--- a/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java
+++ b/java/org/apache/tomcat/util/net/openssl/OpenSSLEngine.java
@@ -755,13 +755,16 @@ public final class OpenSSLEngine extends SSLEngine
implements SSLUtil.ProtocolIn
if (enabled == null) {
return new String[0];
} else {
- for (int i = 0; i < enabled.length; i++) {
- String mapped =
OpenSSLCipherConfigurationParser.openSSLToJsse(enabled[i]);
- if (mapped != null) {
- enabled[i] = mapped;
+ // Only report ciphers with a JSSE equivalent so the enabled
ciphers are always a subset of the supported
+ // ciphers
+ List<String> mapped = new ArrayList<>(enabled.length);
+ for (String cipher : enabled) {
+ String jsseName =
OpenSSLCipherConfigurationParser.openSSLToJsse(cipher);
+ if (jsseName != null) {
+ mapped.add(jsseName);
}
}
- return enabled;
+ return mapped.toArray(new String[0]);
}
}
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
index a42144bdcd..df7c3cb303 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
@@ -675,13 +675,16 @@ public final class OpenSSLEngine extends SSLEngine
implements SSLUtil.ProtocolIn
return new String[0];
}
String[] enabled = OpenSSLLibrary.getCiphers(state.ssl);
- for (int i = 0; i < enabled.length; i++) {
- String mapped =
OpenSSLCipherConfigurationParser.openSSLToJsse(enabled[i]);
- if (mapped != null) {
- enabled[i] = mapped;
+ // Only report ciphers with a JSSE equivalent so the enabled ciphers
are always a subset of the supported
+ // ciphers
+ List<String> mapped = new ArrayList<>(enabled.length);
+ for (String cipher : enabled) {
+ String jsseName =
OpenSSLCipherConfigurationParser.openSSLToJsse(cipher);
+ if (jsseName != null) {
+ mapped.add(jsseName);
}
}
- return enabled;
+ return mapped.toArray(new String[0]);
}
@Override
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
