(storm) branch master updated: Add to instead of replace Jetty's default TLS exclusions on HTTPS connectors

[rzo1]

This is an automated email from the ASF dual-hosted git repository.

rzo1 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/storm.git


The following commit(s) were added to refs/heads/master by this push:
     new ea78c5bea Add to instead of replace Jetty's default TLS exclusions on 
HTTPS connectors
ea78c5bea is described below

commit ea78c5bead8c0d85300cae7f955dd9f20301c3e6
Author: Richard Zowalla <r...@apache.org>
AuthorDate: Wed Aug 19 08:36:13 2026 +0200

    Add to instead of replace Jetty's default TLS exclusions on HTTPS connectors
---
 .../java/org/apache/storm/daemon/ui/UIHelpers.java |  5 ++--
 .../org/apache/storm/daemon/ui/UIHelpersTest.java  | 34 +++++++++++++++++++++-
 2 files changed, 36 insertions(+), 3 deletions(-)

diff --git 
a/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java 
b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java
index 3f50e9f04..77f43a398 100644
--- a/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java
+++ b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java
@@ -234,8 +234,9 @@ public class UIHelpers {
                                                   Boolean needClientAuth, 
Boolean wantClientAuth,
                                                   Integer headerBufferSize, 
boolean enableSslReload) {
         SslContextFactory.Server factory = new 
ReloadableSslContextFactory(enableSslReload);
-        factory.setExcludeCipherSuites("SSL_RSA_WITH_RC4_128_MD5", 
"SSL_RSA_WITH_RC4_128_SHA");
-        factory.setExcludeProtocols("SSLv3");
+        // add to, rather than replace, the exclusions Jetty's 
SslContextFactory ships with
+        factory.addExcludeCipherSuites("SSL_RSA_WITH_RC4_128_MD5", 
"SSL_RSA_WITH_RC4_128_SHA");
+        factory.addExcludeProtocols("SSLv3");
         factory.setRenegotiationAllowed(false);
         factory.setKeyStorePath(ksPath);
         factory.setKeyStoreType(ksType);
diff --git 
a/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java 
b/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java
index d2fef3aa6..1ef066b8e 100644
--- a/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java
+++ b/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java
@@ -30,13 +30,23 @@ import org.apache.storm.generated.TopologyPageInfo;
 import org.apache.storm.generated.TopologyStats;
 import org.apache.storm.utils.Time;
 import net.minidev.json.JSONValue;
+import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.server.ServerConnector;
+import org.eclipse.jetty.server.SslConnectionFactory;
+import org.eclipse.jetty.util.ssl.SslContextFactory;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Arrays;
 import java.util.HashMap;
+import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
@@ -692,4 +702,26 @@ class UIHelpersTest {
         assertEquals("application/json;charset=utf-8", 
headers.get("Content-Type"));
         assertEquals("nosniff", headers.get("X-Content-Type-Options"));
     }
-}
\ No newline at end of file
+
+    @Test
+    public void testConfigSslKeepsJettyDefaultTlsExclusions(@TempDir Path 
tempDir) throws Exception {
+        SslContextFactory.Server defaults = new SslContextFactory.Server();
+        Set<String> expectedProtocols = new 
LinkedHashSet<>(Arrays.asList(defaults.getExcludeProtocols()));
+        Set<String> expectedCiphers = new 
LinkedHashSet<>(Arrays.asList(defaults.getExcludeCipherSuites()));
+        assertFalse(expectedProtocols.isEmpty());
+        assertFalse(expectedCiphers.isEmpty());
+        expectedProtocols.add("SSLv3");
+        expectedCiphers.add("SSL_RSA_WITH_RC4_128_MD5");
+        expectedCiphers.add("SSL_RSA_WITH_RC4_128_SHA");
+
+        Path keyStore = Files.createFile(tempDir.resolve("keystore.jks"));
+        Server server = new Server();
+        UIHelpers.configSsl(server, 8443, keyStore.toString(), "password", 
"JKS", "password",
+                null, null, null, false, false, false);
+
+        ServerConnector connector = (ServerConnector) 
server.getConnectors()[0];
+        SslContextFactory factory = 
connector.getConnectionFactory(SslConnectionFactory.class).getSslContextFactory();
+        assertEquals(expectedProtocols, new 
LinkedHashSet<>(Arrays.asList(factory.getExcludeProtocols())));
+        assertEquals(expectedCiphers, new 
LinkedHashSet<>(Arrays.asList(factory.getExcludeCipherSuites())));
+    }
+}