Attachment 909318 Details for Bug 1084224 – patch providing strictCiphers implementation

[patch] patch providing strictCiphers implementation

tomcatjss-strict-ciphers.patch (text/plain), 3.02 KB, created by Christina Fu on 2014-06-17 00:09:38 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Christina Fu

Created: 2014-06-17 00:09:38 UTC

Size: 3.02 KB

patch

obsolete

>diff -up tomcatjss-2.1.0/src/org/apache/tomcat/util/net/jss/JSSSocketFactory.java.cfu tomcatjss-2.1.0/src/org/apache/tomcat/util/net/jss/JSSSocketFactory.java
>--- tomcatjss-2.1.0/src/org/apache/tomcat/util/net/jss/JSSSocketFactory.java.cfu	2014-06-13 17:37:04.000000000 -0700
>+++ tomcatjss-2.1.0/src/org/apache/tomcat/util/net/jss/JSSSocketFactory.java	2014-06-16 15:36:43.000000000 -0700
>@@ -174,6 +174,7 @@ public class JSSSocketFactory
>     FileWriter debugFile = null;
>     boolean debug = false;
>     private IPasswordStore mPasswordStore = null;
>+    private boolean mStrictCiphers = false;
> 
>     public JSSSocketFactory() {
>         super();
>@@ -229,6 +230,8 @@ public class JSSSocketFactory
>         }
>         if (cipherid != 0) {
>             try {
>+                debugWrite("JSSSocketFactory setSSLCiphers:  "+
>+                    cipherstr+": 0x"+Integer.toHexString(cipherid) +"\n");
>                 SSLSocket.setCipherPreferenceDefault(cipherid, state);
>             }
>             catch (Exception e) {
>@@ -271,10 +274,30 @@ public class JSSSocketFactory
>           }
>         }
>         if (name.equals("tls")) {
>-          // JSS does not have a way to enable TLS
>+          if (value.equals("true")) {
>+            SSLSocket.enableTLSDefault(true);
>+            setSSLCiphers("tls3Ciphers");
>+          } else {
>+            SSLSocket.enableTLSDefault(false);
>+          }
>         }
>       }
>     }
>+    // remove all to start with a clean slate
>+    public void unsetSSLCiphers() throws SocketException
>+    {
>+        int ciphers[] = SSLSocket.getImplementedCipherSuites();
>+        try {
>+          for (int i = 0; ciphers != null && i < ciphers.length; i++) {
>+
>+            debugWrite("JSSSocketFactory unsetSSLCiphers - turning off '0x"+
>+               Integer.toHexString(ciphers[i]) + "'\n");
>+            SSLSocket.setCipherPreferenceDefault(ciphers[i], false);
>+          }
>+        } catch (Exception e) {
>+        }
>+    }
>+
> 
>     void init() throws IOException {
>         try {
>@@ -502,7 +525,21 @@ public class JSSSocketFactory
>             // 12 hours = 43200 seconds
>             SSLServerSocket.configServerSessionIDCache(0, 43200, 43200, null);
> 
>+            String strictCiphersStr = (String)attributes.get("strictCiphers");
>+            if (strictCiphersStr.equalsIgnoreCase("true") ||
>+              strictCiphersStr.equalsIgnoreCase("yes")) {
>+                mStrictCiphers = true;
>+            }
>+            if (mStrictCiphers == true) {
>+                // what ciphers do we have to start with? turn them all off
>+                 debugWrite("SSSocketFactory init - before setSSLOptions, strictCiphers is true\n");
>+                 unsetSSLCiphers();
>+            } else {
>+                 debugWrite("SSSocketFactory init - before setSSLOptions, strictCiphers is false\n");
>+            }
>+
>             setSSLOptions();
>+            debugWrite("SSSocketFactory init - after setSSLOptions\n");
>         } catch (Exception ex) {
>             debugWrite("JSSSocketFactory init - exception thrown:"+
>                    ex.toString()+"\n");

Flags:

jmagne: review+

Actions: View | Diff

Attachments on bug 1084224: 909318 | 909320