This is an automated email from the ASF dual-hosted git repository. markt-asf pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 915d713e83e9166c5df5c470e7fb49cff78e6ac1 Author: Mark Thomas <[email protected]> AuthorDate: Tue Nov 3 20:21:41 2026 +0000 Review "Fix TLS 1.3 cipher suite configuration" Make null reset the ciphers to the defaults. --- java/org/apache/tomcat/util/net/SSLHostConfig.java | 25 ++++++++++++++++------ .../apache/tomcat/util/net/TestSSLHostConfig.java | 21 ++++++++++++++++-- 2 files changed, 37 insertions(+), 9 deletions(-) diff --git a/java/org/apache/tomcat/util/net/SSLHostConfig.java b/java/org/apache/tomcat/util/net/SSLHostConfig.java index 4cc5be8b01..e4f7b83494 100644 --- a/java/org/apache/tomcat/util/net/SSLHostConfig.java +++ b/java/org/apache/tomcat/util/net/SSLHostConfig.java @@ -178,11 +178,11 @@ public class SSLHostConfig implements Serializable { /** * The cipher configuration for TLS 1.2 and below (OpenSSL format). */ - private String ciphers = DEFAULT_TLS_CIPHERS_12; + private String ciphers = null; /** * The cipher suite configuration for TLS 1.3. */ - private String cipherSuites = DEFAULT_TLS_CIPHERS_13; + private String cipherSuites = null; /** * The parsed cipher list for TLS 1.2 and below. */ @@ -728,7 +728,8 @@ public class SSLHostConfig implements Serializable { * Set the new cipher (TLSv1.2 and below) configuration. Note: Regardless of the format used to set the * configuration, it is always stored in OpenSSL format. * - * @param ciphersList The new cipher configuration in OpenSSL or JSSE format + * @param ciphersList The new cipher configuration in OpenSSL or JSSE format. A value of {@code null} restores the + * default, {@link #DEFAULT_TLS_CIPHERS_12}. */ public void setCiphers(String ciphersList) { // Ciphers is stored in OpenSSL format. Convert the provided value if @@ -787,9 +788,13 @@ public class SSLHostConfig implements Serializable { /** * Returns the cipher (TLSv1.2 and below) configuration. * - * @return An OpenSSL cipher string for the current configuration. + * @return An OpenSSL cipher string for the current configuration. If no configuration has been set, or it was set + * to {@code null}, this is {@link #DEFAULT_TLS_CIPHERS_12}. */ public String getCiphers() { + if (ciphers == null) { + return DEFAULT_TLS_CIPHERS_12; + } return ciphers; } @@ -828,11 +833,13 @@ public class SSLHostConfig implements Serializable { * Set the cipher suite (TLSv1.3) configuration. Note: Regardless of the format used to set the configuration, it is * always stored in OpenSSL format. * - * @param cipherSuites The cipher suites to use in a colon-separated, preference order list + * @param cipherSuites The cipher suites to use in a preference order list. The list may be colon-separated + * (OpenSSL format) or comma-separated (JSSE format). A value of {@code null} restores the + * default, {@link #DEFAULT_TLS_CIPHERS_13}. */ public void setCipherSuites(String cipherSuites) { if (cipherSuites == null) { - // As for setCiphers(), a null value is stored as provided. + // As for setCiphers(), a null value restores the default. this.cipherSuites = null; this.cipherSuiteList = null; this.jsseCipherNames = null; @@ -881,9 +888,13 @@ public class SSLHostConfig implements Serializable { /** * Obtain the current cipher suite (TLSv1.3) configuration. * - * @return An OpenSSL cipher suite string for the current configuration. + * @return An OpenSSL cipher suite string for the current configuration. If no configuration has been set, or it + * was set to {@code null}, this is {@link #DEFAULT_TLS_CIPHERS_13}. */ public String getCipherSuites() { + if (cipherSuites == null) { + return DEFAULT_TLS_CIPHERS_13; + } return cipherSuites; } diff --git a/test/org/apache/tomcat/util/net/TestSSLHostConfig.java b/test/org/apache/tomcat/util/net/TestSSLHostConfig.java index b866a66c65..c7d040a61d 100644 --- a/test/org/apache/tomcat/util/net/TestSSLHostConfig.java +++ b/test/org/apache/tomcat/util/net/TestSSLHostConfig.java @@ -165,9 +165,26 @@ public class TestSSLHostConfig { public void testCiphersuite05() { SSLHostConfig hc = new SSLHostConfig(); - // Null should be handled without an error, as it is for setCiphers() + // Null restores the default, as it does for setCiphers() + hc.setCipherSuites(Cipher.TLS_AES_128_CCM_SHA256.getOpenSSLAlias()); hc.setCipherSuites(null); - Assert.assertNull(hc.getCipherSuites()); + Assert.assertEquals(SSLHostConfig.DEFAULT_TLS_CIPHERS_13, hc.getCipherSuites()); + // and the derived values must be usable + Assert.assertFalse(hc.getJsseCipherNames().isEmpty()); + } + + + @Test + public void testCiphersNull() { + SSLHostConfig hc = new SSLHostConfig(); + + // Null restores the default + hc.setCiphers(Cipher.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.getOpenSSLAlias()); + hc.setCiphers(null); + Assert.assertEquals(SSLHostConfig.DEFAULT_TLS_CIPHERS_12, hc.getCiphers()); + // and the derived values must be usable + Assert.assertFalse(hc.getCipherList().isEmpty()); + Assert.assertFalse(hc.getJsseCipherNames().isEmpty()); } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
