What is the intended relationship between
TlsCiphers.isH2Blacklisted(String) and isWeak(String)?
I was expecting this to pass but it doesn't because it IMO
"blacklisted" is stronger than "weak":
diff --git
a/httpcore5/src/main/java/org/apache/hc/core5/http/ssl/TlsCiphers.java
b/httpcore5/src/main/java/org/apache/hc/core5/http/ssl/TlsCiphers.java
index 140f925..803514f 100644
--- a/httpcore5/src/main/java/org/apache/hc/core5/http/ssl/TlsCiphers.java
+++ b/httpcore5/src/main/java/org/apache/hc/core5/http/ssl/TlsCiphers.java
@@ -371,4 +371,8 @@ public static boolean isWeak(final String cipherSuite) {
return !enabledCiphers.isEmpty() ? enabledCiphers.toArray(new
String[0]) : ciphers;
}
+ static Set<String> getH2Blacklisted() {
+ return H2_BLACKLISTED;
+ }
+
}
diff --git
a/httpcore5/src/test/java/org/apache/hc/core5/http/ssl/TestTlsCiphers.java
b/httpcore5/src/test/java/org/apache/hc/core5/http/ssl/TestTlsCiphers.java
index f2c1929..0a3bafa 100644
--- a/httpcore5/src/test/java/org/apache/hc/core5/http/ssl/TestTlsCiphers.java
+++ b/httpcore5/src/test/java/org/apache/hc/core5/http/ssl/TestTlsCiphers.java
@@ -95,6 +95,15 @@ void testExcludeWeakNull() {
}
@ParameterizedTest
+ @MethodSource("org.apache.hc.core5.http.ssl.TlsCiphers#getH2Blacklisted()")
+ void testH2BlacklistedIsWeak(final String h2BlacklistedCipherSuite) {
+ // Sanity assert
+
Assertions.assertTrue(TlsCiphers.isH2Blacklisted(h2BlacklistedCipherSuite),
h2BlacklistedCipherSuite);
+ // Test
+ Assertions.assertTrue(TlsCiphers.isWeak(h2BlacklistedCipherSuite),
h2BlacklistedCipherSuite);
+ }
+
+ @ParameterizedTest
@ValueSource(strings = {
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
"TLS_RSA_WITH_AES_256_CBC_SHA256",
@@ -129,4 +138,5 @@ void testWeakCiphersDisabledByDefault(final String
weakCiphersSuite) {
Assertions.assertTrue(TlsCiphers.isWeak(weakCiphersSuite));
}
+
}
--
TY,
Gary
On Sun, Aug 2, 2026 at 9:07 AM Gary Gregory <[email protected]> wrote:
>
> On Sun, Aug 2, 2026 at 4:54 AM Oleg Kalnichevski <[email protected]> wrote:
> >
> > On Sat, 2026-08-01 at 21:14 -0400, Gary Gregory wrote:
> > > Hi All,
> > >
> > > Is there anything that we can do in our code to facilitate RFC 10015
> > > and
> > > further secure users of HttpClient?
> > >
> > > https://www.rfc-editor.org/rfc/rfc10015.html
> > >
> > > Ty,
> > > Gary
> >
> > Hi Gary
> >
> > We already have weak cipher exclusion logic, for instance, used to
> > exclude cipher blacklisted by the HTTP/2 spec.
> >
> > https://github.com/apache/httpcomponents-core/blob/master/httpcore5/src/main/java/org/apache/hc/core5/http/ssl/TlsCiphers.java#L348
> >
> > One would have to review the existing implementation and make sure it
> > conforms to RFC 10015.
>
> I'll create a PR...
>
> Gary
>
> >
> > Oleg
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: [email protected]
> > For additional commands, e-mail: [email protected]
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
