Author: markt
Date: Mon Sep 7 19:19:58 2015
New Revision: 1701673
URL: http://svn.apache.org/r1701673
Log:
Fix https://bz.apache.org/bugzilla/show_bug.cgi?id=58275
Add a special case for IBM since it accepts cipher names in two forms (TLS_XXX
and SSL_XXX) but only lists one form (SSL_XXX) when asked which ciphers it
supports.
Modified:
tomcat/trunk/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java
Modified:
tomcat/trunk/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java
URL:
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java?rev=1701673&r1=1701672&r2=1701673&view=diff
==============================================================================
--- tomcat/trunk/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java
(original)
+++ tomcat/trunk/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java
Mon Sep 7 19:19:58 2015
@@ -54,6 +54,7 @@ import javax.net.ssl.X509KeyManager;
import org.apache.juli.logging.Log;
import org.apache.juli.logging.LogFactory;
+import org.apache.tomcat.util.compat.JreVendor;
import org.apache.tomcat.util.net.SSLContext;
import org.apache.tomcat.util.net.SSLHostConfig;
import org.apache.tomcat.util.net.SSLHostConfigCertificate;
@@ -144,7 +145,24 @@ public class JSSESocketFactory implement
List<String> requestedCiphers = sslHostConfig.getJsseCipherNames();
List<String> ciphers = new ArrayList<>(requestedCiphers);
-
ciphers.retainAll(Arrays.asList(context.getSupportedSSLParameters().getCipherSuites()));
+ String[] supportedCipherSuiteArray =
context.getSupportedSSLParameters().getCipherSuites();
+ // The IBM JRE will accept cipher suites names SSL_xxx or TLS_xxx but
+ // only returns the SSL_xxx form for supported cipher suites. Therefore
+ // need to filter the requested cipher suites using both forms with an
+ // IBM JRE.
+ List<String> supportedCipherSuiteList;
+ if (JreVendor.IS_IBM_JVM) {
+ supportedCipherSuiteList = new
ArrayList<>(supportedCipherSuiteArray.length * 2);
+ for (String name : supportedCipherSuiteArray) {
+ supportedCipherSuiteList.add(name);
+ if (name.startsWith("SSL")) {
+ supportedCipherSuiteList.add("TLS" + name.substring(3));
+ }
+ }
+ } else {
+ supportedCipherSuiteList =
Arrays.asList(supportedCipherSuiteArray);
+ }
+ ciphers.retainAll(supportedCipherSuiteList);
if (ciphers.isEmpty()) {
log.warn(sm.getString("jsse.requested_ciphers_not_supported",
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
