This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 24769f7936d0e5c56c503d8c2ddb9def623cb607 Author: opencode <[email protected]> AuthorDate: Thu Oct 15 14:35:06 2026 +0200 Fix TLS 1.3 cipher suite configuration SSLHostConfig.setCipherSuites() converted each configured name from JSSE format to OpenSSL format and then discarded the result, appending the original value instead. Since the value is always stored, and later passed to OpenSSL, in OpenSSL format, append the converted name. This matches setCiphers(), which already appended the converted name. There is no change in behaviour for current configurations because the JSSE and OpenSSL names for TLS 1.3 cipher suites are currently the same. Also avoid a NullPointerException when a null value is provided. That method dereferenced the argument without checking it, unlike setCiphers(), which stores a null value and resets the values derived from the previous configuration. Do the same here. Tests: testCiphersuite04 covers the JSSE format (comma separated) list and the conversion to the OpenSSL format list. testCiphersuite05 covers the null value, which previously failed with a NullPointerException. --- java/org/apache/tomcat/util/net/SSLHostConfig.java | 15 ++++++++++++-- .../apache/tomcat/util/net/TestSSLHostConfig.java | 24 ++++++++++++++++++++++ 2 files changed, 37 insertions(+), 2 deletions(-) diff --git a/java/org/apache/tomcat/util/net/SSLHostConfig.java b/java/org/apache/tomcat/util/net/SSLHostConfig.java index 9a67129730..78fbca3ad0 100644 --- a/java/org/apache/tomcat/util/net/SSLHostConfig.java +++ b/java/org/apache/tomcat/util/net/SSLHostConfig.java @@ -800,11 +800,22 @@ public class SSLHostConfig implements Serializable { /** - * Set the cipher suite (TLSv1.3) configuration. + * Set the cipher suite (TLSv1.3) configuration. Note: Regardless of the format used to set the configuration, it is + * always stored in OpenSSL format. * * @param cipherSuites The cipher suites to use in a colon-separated, preference order list */ public void setCipherSuites(String cipherSuites) { + if (cipherSuites == null) { + // As for setCiphers(), a null value is stored as provided. + this.cipherSuites = null; + this.cipherSuiteList = null; + this.jsseCipherNames = null; + return; + } + + // Cipher suites are stored in OpenSSL format. Convert the provided + // value if necessary. StringBuilder sb = new StringBuilder(); String[] values; if (cipherSuites.contains(":")) { @@ -833,7 +844,7 @@ public class SSLHostConfig implements Serializable { if (sb.length() > 0) { sb.append(':'); } - sb.append(trimmed); + sb.append(openSSLName); } } this.cipherSuites = sb.toString(); diff --git a/test/org/apache/tomcat/util/net/TestSSLHostConfig.java b/test/org/apache/tomcat/util/net/TestSSLHostConfig.java index 82d4d38012..a258fbc4d4 100644 --- a/test/org/apache/tomcat/util/net/TestSSLHostConfig.java +++ b/test/org/apache/tomcat/util/net/TestSSLHostConfig.java @@ -167,6 +167,30 @@ public class TestSSLHostConfig { } + @Test + public void testCiphersuite04() { + SSLHostConfig hc = new SSLHostConfig(); + Cipher c1 = Cipher.TLS_AES_128_CCM_SHA256; + Cipher c2 = Cipher.TLS_AES_256_GCM_SHA384; + + // JSSE format (comma separated) list of JSSE names. The result should be + // an OpenSSL format (colon separated) list of OpenSSL names. + hc.setCipherSuites(c1.getJsseNames().iterator().next() + "," + + c2.getJsseNames().iterator().next()); + Assert.assertEquals(c1.getOpenSSLAlias() + ":" + c2.getOpenSSLAlias(), hc.getCipherSuites()); + } + + + @Test + public void testCiphersuite05() { + SSLHostConfig hc = new SSLHostConfig(); + + // Null should be handled without an error, as it is for setCiphers() + hc.setCipherSuites(null); + Assert.assertNull(hc.getCipherSuites()); + } + + @Test public void testSerialization() throws IOException, ClassNotFoundException { // Dummy OpenSSL command name/value pair --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
