Author: markt
Date: Thu Mar 14 14:51:26 2013
New Revision: 1456457
URL: http://svn.apache.org/r1456457
Log:
Use server defaults not client defaults for SSL protocols and ciphers if none
are defined for the connector.
Modified:
tomcat/tc7.0.x/trunk/ (props changed)
tomcat/tc7.0.x/trunk/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java
tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml
Propchange: tomcat/tc7.0.x/trunk/
------------------------------------------------------------------------------
Merged /tomcat/trunk:r1456453
Modified:
tomcat/tc7.0.x/trunk/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java
URL:
http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java?rev=1456457&r1=1456456&r2=1456457&view=diff
==============================================================================
---
tomcat/tc7.0.x/trunk/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java
(original)
+++
tomcat/tc7.0.x/trunk/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java
Thu Mar 14 14:51:26 2013
@@ -89,6 +89,9 @@ public class JSSESocketFactory implement
private static final boolean RFC_5746_SUPPORTED;
+ private static final String[] DEFAULT_SERVER_PROTOCOLS;
+ private static final String[] DEAFULT_SERVER_CIPHER_SUITES;
+
// Defaults - made public where re-used
private static final String defaultProtocol = "TLS";
private static final String defaultKeystoreType = "JKS";
@@ -102,23 +105,40 @@ public class JSSESocketFactory implement
static {
boolean result = false;
SSLContext context;
+ String[] ciphers = null;
+ String[] protocols = null;
try {
context = SSLContext.getInstance("TLS");
context.init(null, null, null);
SSLServerSocketFactory ssf = context.getServerSocketFactory();
- String ciphers[] = ssf.getSupportedCipherSuites();
- for (String cipher : ciphers) {
+ String supportedCiphers[] = ssf.getSupportedCipherSuites();
+ for (String cipher : supportedCiphers) {
if ("TLS_EMPTY_RENEGOTIATION_INFO_SCSV".equals(cipher)) {
result = true;
break;
}
}
+
+ // There is no API to obtain the default server protocols and
cipher
+ // suites. Having inspected the OpenJDK code there the same results
+ // can be achieved via the standard API but there is no guarantee
+ // that every JVM implementation determines the defaults the same
+ // way. Therefore the defaults are determined by creating a server
+ // socket and requested the configured values.
+
+ SSLServerSocket socket = (SSLServerSocket)
ssf.createServerSocket();
+ ciphers = socket.getEnabledCipherSuites();
+ protocols = socket.getEnabledProtocols();
} catch (NoSuchAlgorithmException e) {
// Assume no RFC 5746 support
} catch (KeyManagementException e) {
// Assume no RFC 5746 support
+ } catch (IOException e) {
+ // Unable to determine default ciphers/protocols so use none
}
RFC_5746_SUPPORTED = result;
+ DEAFULT_SERVER_CIPHER_SUITES = ciphers;
+ DEFAULT_SERVER_PROTOCOLS = protocols;
}
@@ -211,7 +231,7 @@ public class JSSESocketFactory implement
}
if ((requestedCiphersStr == null)
|| (requestedCiphersStr.trim().length() == 0)) {
- return context.getDefaultSSLParameters().getCipherSuites();
+ return DEAFULT_SERVER_CIPHER_SUITES;
}
List<String> requestedCiphers = new ArrayList<String>();
@@ -222,7 +242,7 @@ public class JSSESocketFactory implement
}
}
if (requestedCiphers.isEmpty()) {
- return context.getDefaultSSLParameters().getCipherSuites();
+ return DEAFULT_SERVER_CIPHER_SUITES;
}
List<String> ciphers = new ArrayList<String>(requestedCiphers);
ciphers.retainAll(Arrays.asList(context.getSupportedSSLParameters()
@@ -677,7 +697,7 @@ public class JSSESocketFactory implement
public String[] getEnableableProtocols(SSLContext context) {
String[] requestedProtocols = endpoint.getSslEnabledProtocolsArray();
if ((requestedProtocols == null) || (requestedProtocols.length == 0)) {
- return context.getDefaultSSLParameters().getProtocols();
+ return DEFAULT_SERVER_PROTOCOLS;
}
List<String> protocols = new ArrayList<String>(
Modified: tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml
URL:
http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml?rev=1456457&r1=1456456&r2=1456457&view=diff
==============================================================================
--- tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml (original)
+++ tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml Thu Mar 14 14:51:26 2013
@@ -68,6 +68,16 @@
</fix>
</changelog>
</subsection>
+ <subsection name="Coyote">
+ <changelog>
+ <fix>
+ <bug>54690</bug>: Fix a regression caused by the previous fix for
+ <bug>54406</bug>. If no values are specified for sslEnabledProtocols or
+ ciphers use the default values for server sockets rather than the
+ default values for client sockets. (markt)
+ </fix>
+ </changelog>
+ </subsection>
<subsection name="jdbc-pool">
<changelog>
<fix>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
