Replace invalid default excludedProtocols in HttpsConnectorFactory #3533
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The default list of excluded protocols used in `HttpsConnectorFactory` wasn't working as expected. Jetty currently doesn't support using regular expressions for supporte or excluded protocols. This only works for supported and excluded cipher suites as of Jetty 9.4.33.v20201020. The default list of excluded protocols now only contains valid and complete entries: SSLv3, TLSv1, and TLSv1.1 Refs jetty/jetty.project#5531 Fixes #3532
pkwarren
approved these changes
Oct 28, 2020
pkwarren
reviewed
Oct 28, 2020
| try { | ||
| assertThat(sslContextFactory.newSSLEngine().getEnabledProtocols()) | ||
| .doesNotContainAnyElementsOf(factory.getExcludedProtocols()) | ||
| .allSatisfy(protocol -> assertThat(protocol).doesNotStartWith("SSL")); |
There was a problem hiding this comment.
Do we also want to ensure that enabled protocols only includes TLS v1.2/v1.3 and nothing else? Feels like a good test to fail if any older protocols are enabled.
There was a problem hiding this comment.
I also thought about adding this, but then the test will start failing when run on JVMs which support other (newer) protocols in the future.
Or maybe some JVM only supports up to TLSv2. 🤔
|
Kudos, SonarCloud Quality Gate passed!
|
arteam
approved these changes
Oct 29, 2020
joschi
added a commit
that referenced
this pull request
Oct 29, 2020
…3533) The default list of excluded protocols used in `HttpsConnectorFactory` wasn't working as expected. Jetty currently doesn't support using regular expressions for supported or excluded protocols. This only works for supported and excluded cipher suites as of Jetty 9.4.33.v20201020. The default list of excluded protocols now only contains valid and complete entries: SSLv3, TLSv1, and TLSv1.1 Refs jetty/jetty.project#5531 Fixes #3532 (cherry picked from commit 206e858)
joschi
added a commit
that referenced
this pull request
Nov 26, 2020
…ctory" (#3579) Jetty 9.4.34.v20201102 added support for regular expressions in included/excluded protocols. https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.34.v20201102 Refs #3533 Refs jetty/jetty.project#5535 This partially reverts commit 206e858.
joschi
added a commit
that referenced
this pull request
Nov 26, 2020
…ctory" (#3579) Jetty 9.4.34.v20201102 added support for regular expressions in included/excluded protocols. https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.34.v20201102 Refs #3533 Refs jetty/jetty.project#5535 This partially reverts commit 206e858. (cherry picked from commit cf2230d)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The default list of excluded protocols used in
HttpsConnectorFactorywasn't working as expected.Jetty currently doesn't support using regular expressions for supported or excluded protocols.
This is only working for supported and excluded cipher suites as of Jetty 9.4.33.v20201020.
The default list of excluded protocols now only contains valid and complete entries:
SSLv3, TLSv1, and TLSv1.1
Refs jetty/jetty.project#5531
Fixes #3532