This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 7fe1211e1f3921b57384cf573cbc7f5c67dd1a5f Author: opencode <[email protected]> AuthorDate: Thu Oct 15 14:35:06 2026 +0200 Fix TLS 1.3 cipher suite configuration SSLHostConfig.setCipherSuites() converted each configured name from JSSE format to OpenSSL format and then discarded the result, appending the original value instead. Since the value is always stored, and later passed to OpenSSL, in OpenSSL format, append the converted name. This matches setCiphers(), which already appended the converted name. There is no change in behaviour for current configurations because the JSSE and OpenSSL names for TLS 1.3 cipher suites are currently the same. Also avoid a NullPointerException when a null value is provided. That method dereferenced the argument without checking it, unlike setCiphers(), which stores a null value and resets the values derived from the previous configuration. Do the same here. Tests: testCiphersuite04 covers the JSSE format (comma separated) list and the conversion to the OpenSSL format list. testCiphersuite05 covers the null value, which previously failed with a NullPointerException. --- java/org/apache/tomcat/util/net/SSLHostConfig.java | 15 ++++++++++++-- .../apache/tomcat/util/net/TestSSLHostConfig.java | 24 ++++++++++++++++++++++ 2 files changed, 37 insertions(+), 2 deletions(-) diff --git a/java/org/apache/tomcat/util/net/SSLHostConfig.java b/java/org/apache/tomcat/util/net/SSLHostConfig.java index 79d3b35b89..94582622d0 100644 --- a/java/org/apache/tomcat/util/net/SSLHostConfig.java +++ b/java/org/apache/tomcat/util/net/SSLHostConfig.java @@ -825,11 +825,22 @@ public class SSLHostConfig implements Serializable { /** - * Set the cipher suite (TLSv1.3) configuration. + * Set the cipher suite (TLSv1.3) configuration. Note: Regardless of the format used to set the configuration, it is + * always stored in OpenSSL format. * * @param cipherSuites The cipher suites to use in a colon-separated, preference order list */ public void setCipherSuites(String cipherSuites) { + if (cipherSuites == null) { + // As for setCiphers(), a null value is stored as provided. + this.cipherSuites = null; + this.cipherSuiteList = null; + this.jsseCipherNames = null; + return; + } + + // Cipher suites are stored in OpenSSL format. Convert the provided + // value if necessary. StringBuilder sb = new StringBuilder(); String[] values; if (cipherSuites.contains(":")) { @@ -858,7 +869,7 @@ public class SSLHostConfig implements Serializable { if (!sb.isEmpty()) { sb.append(':'); } - sb.append(trimmed); + sb.append(openSSLName); } } this.cipherSuites = sb.toString(); diff --git a/test/org/apache/tomcat/util/net/TestSSLHostConfig.java b/test/org/apache/tomcat/util/net/TestSSLHostConfig.java index 40fe272231..b866a66c65 100644 --- a/test/org/apache/tomcat/util/net/TestSSLHostConfig.java +++ b/test/org/apache/tomcat/util/net/TestSSLHostConfig.java @@ -147,6 +147,30 @@ public class TestSSLHostConfig { } + @Test + public void testCiphersuite04() { + SSLHostConfig hc = new SSLHostConfig(); + Cipher c1 = Cipher.TLS_AES_128_CCM_SHA256; + Cipher c2 = Cipher.TLS_AES_256_GCM_SHA384; + + // JSSE format (comma separated) list of JSSE names. The result should be + // an OpenSSL format (colon separated) list of OpenSSL names. + hc.setCipherSuites(c1.getJsseNames().iterator().next() + "," + + c2.getJsseNames().iterator().next()); + Assert.assertEquals(c1.getOpenSSLAlias() + ":" + c2.getOpenSSLAlias(), hc.getCipherSuites()); + } + + + @Test + public void testCiphersuite05() { + SSLHostConfig hc = new SSLHostConfig(); + + // Null should be handled without an error, as it is for setCiphers() + hc.setCipherSuites(null); + Assert.assertNull(hc.getCipherSuites()); + } + + @Test public void testPreSharedKey() { SSLHostConfig sslHostConfig = new SSLHostConfig(); --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
