Skip to content

Commit de6d2c9

Browse files
GoeLinGoeLin
committed
8190492: Remove SSLv2Hello and SSLv3 from default enabled TLS protocols
Reviewed-by: phh, mbaesken Backport-of: 5fc46f3
1 parent 2405ca6 commit de6d2c9

File tree

13 files changed

+210
-166
lines changed

13 files changed

+210
-166
lines changed

‎src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java

+8-16
Original file line numberDiff line numberDiff line change
@@ -571,9 +571,7 @@ private abstract static class AbstractTLSContext extends SSLContextImpl {
571571
ProtocolVersion.TLS13,
572572
ProtocolVersion.TLS12,
573573
ProtocolVersion.TLS11,
574-
ProtocolVersion.TLS10,
575-
ProtocolVersion.SSL30,
576-
ProtocolVersion.SSL20Hello
574+
ProtocolVersion.TLS10
577575
});
578576
}
579577

@@ -637,8 +635,7 @@ public static final class TLS10Context extends AbstractTLSContext {
637635
} else {
638636
clientDefaultProtocols = getAvailableProtocols(
639637
new ProtocolVersion[] {
640-
ProtocolVersion.TLS10,
641-
ProtocolVersion.SSL30
638+
ProtocolVersion.TLS10
642639
});
643640
}
644641

@@ -677,8 +674,7 @@ public static final class TLS11Context extends AbstractTLSContext {
677674
clientDefaultProtocols = getAvailableProtocols(
678675
new ProtocolVersion[] {
679676
ProtocolVersion.TLS11,
680-
ProtocolVersion.TLS10,
681-
ProtocolVersion.SSL30
677+
ProtocolVersion.TLS10
682678
});
683679
}
684680

@@ -720,8 +716,7 @@ public static final class TLS12Context extends AbstractTLSContext {
720716
new ProtocolVersion[] {
721717
ProtocolVersion.TLS12,
722718
ProtocolVersion.TLS11,
723-
ProtocolVersion.TLS10,
724-
ProtocolVersion.SSL30
719+
ProtocolVersion.TLS10
725720
});
726721
}
727722

@@ -764,8 +759,7 @@ public static final class TLS13Context extends AbstractTLSContext {
764759
ProtocolVersion.TLS13,
765760
ProtocolVersion.TLS12,
766761
ProtocolVersion.TLS11,
767-
ProtocolVersion.TLS10,
768-
ProtocolVersion.SSL30
762+
ProtocolVersion.TLS10
769763
});
770764
}
771765

@@ -927,11 +921,11 @@ private static List<ProtocolVersion> customizedProtocols(
927921
ProtocolVersion.TLS13,
928922
ProtocolVersion.TLS12,
929923
ProtocolVersion.TLS11,
930-
ProtocolVersion.TLS10,
931-
ProtocolVersion.SSL30
924+
ProtocolVersion.TLS10
932925
};
933926
}
934927
} else {
928+
// default server protocols
935929
if (SunJSSE.isFIPS()) {
936930
candidates = new ProtocolVersion[] {
937931
ProtocolVersion.TLS13,
@@ -944,9 +938,7 @@ private static List<ProtocolVersion> customizedProtocols(
944938
ProtocolVersion.TLS13,
945939
ProtocolVersion.TLS12,
946940
ProtocolVersion.TLS11,
947-
ProtocolVersion.TLS10,
948-
ProtocolVersion.SSL30,
949-
ProtocolVersion.SSL20Hello
941+
ProtocolVersion.TLS10
950942
};
951943
}
952944
}

‎test/jdk/javax/net/ssl/SSLEngine/NoAuthClientAuth.java

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2003, 2019, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -28,7 +28,7 @@
2828

2929
/*
3030
* @test
31-
* @bug 4495742
31+
* @bug 4495742 8190492
3232
* @summary Demonstrate SSLEngine switch from no client auth to client auth.
3333
* @run main/othervm NoAuthClientAuth SSLv3
3434
* @run main/othervm NoAuthClientAuth TLSv1
@@ -304,6 +304,11 @@ private void createSSLEngines() throws Exception {
304304
serverEngine.setUseClientMode(false);
305305
serverEngine.setNeedClientAuth(false);
306306

307+
// Enable all supported protocols on server side to test SSLv3
308+
if ("SSLv3".equals(tlsProtocol)) {
309+
serverEngine.setEnabledProtocols(serverEngine.getSupportedProtocols());
310+
}
311+
307312
/*
308313
* Similar to above, but using client mode instead.
309314
*/

‎test/jdk/javax/net/ssl/ServerName/SSLEngineExplorer.java

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2012, 2014, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2012, 2019, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -28,7 +28,7 @@
2828

2929
/*
3030
* @test
31-
* @bug 7068321
31+
* @bug 7068321 8190492
3232
* @summary Support TLS Server Name Indication (SNI) Extension in JSSE Server
3333
* @library ../SSLEngine ../templates
3434
* @build SSLEngineService SSLCapabilities SSLExplorer
@@ -80,6 +80,9 @@ void doServerSide() throws Exception {
8080
// create SSLEngine.
8181
SSLEngine ssle = createSSLEngine(false);
8282

83+
// Enable all supported protocols on server side to test SSLv3
84+
ssle.setEnabledProtocols(ssle.getSupportedProtocols());
85+
8386
// Create a server socket channel.
8487
InetSocketAddress isa =
8588
new InetSocketAddress(InetAddress.getLocalHost(), serverPort);

‎test/jdk/javax/net/ssl/ServerName/SSLSocketExplorer.java

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2012, 2014, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2012, 2019, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -28,7 +28,7 @@
2828

2929
/**
3030
* @test
31-
* @bug 7068321
31+
* @bug 7068321 8190492
3232
* @summary Support TLS Server Name Indication (SNI) Extension in JSSE Server
3333
* @library ../templates
3434
* @build SSLCapabilities SSLExplorer
@@ -148,6 +148,9 @@ void doServerSide() throws Exception {
148148
new ByteArrayInputStream(buffer, 0, position);
149149
SSLSocket sslSocket = (SSLSocket)sslsf.createSocket(socket, bais, true);
150150

151+
// Enable all supported protocols on server side to test SSLv3
152+
sslSocket.setEnabledProtocols(sslSocket.getSupportedProtocols());
153+
151154
InputStream sslIS = sslSocket.getInputStream();
152155
OutputStream sslOS = sslSocket.getOutputStream();
153156

‎test/jdk/javax/net/ssl/sanity/interop/JSSEServer.java

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2002, 2018, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2002, 2019, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -51,6 +51,10 @@ class JSSEServer extends CipherTest.Server {
5151
serverSocket
5252
= (SSLServerSocket) factory.createServerSocket(CipherTest.serverPort);
5353
CipherTest.serverPort = serverSocket.getLocalPort();
54+
55+
// JDK-8190492: Enable all supported protocols on server side to test SSLv3
56+
serverSocket.setEnabledProtocols(serverSocket.getSupportedProtocols());
57+
5458
serverSocket.setEnabledCipherSuites(factory.getSupportedCipherSuites());
5559
serverSocket.setWantClientAuth(true);
5660
}

‎test/jdk/sun/security/pkcs11/sslecc/JSSEServer.java

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2002, 2017, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2002, 2019, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -52,6 +52,10 @@ class JSSEServer extends CipherTest.Server {
5252
serverSocket = (SSLServerSocket)factory.createServerSocket(0);
5353
serverSocket.setSoTimeout(CipherTest.TIMEOUT);
5454
CipherTest.serverPort = serverSocket.getLocalPort();
55+
56+
// JDK-8190492: Enable all supported protocols on server side to test SSLv3
57+
serverSocket.setEnabledProtocols(serverSocket.getSupportedProtocols());
58+
5559
serverSocket.setEnabledCipherSuites(factory.getSupportedCipherSuites());
5660
serverSocket.setWantClientAuth(true);
5761
}

‎test/jdk/sun/security/ssl/ProtocolVersion/HttpsProtocols.java

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2002, 2014, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2002, 2019, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -23,7 +23,7 @@
2323

2424
/*
2525
* @test
26-
* @bug 4671289
26+
* @bug 4671289 8190492
2727
* @summary passing https.protocols from command line doesn't work.
2828
* @run main/othervm -Dhttps.protocols=SSLv3 HttpsProtocols
2929
* @author Brad Wetmore
@@ -88,6 +88,9 @@ void doServerSide() throws Exception {
8888
SSLServerSocket sslServerSocket =
8989
(SSLServerSocket) sslssf.createServerSocket(serverPort);
9090

91+
// Enable all supported protocols on server side to test SSLv3
92+
sslServerSocket.setEnabledProtocols(sslServerSocket.getSupportedProtocols());
93+
9194
serverPort = sslServerSocket.getLocalPort();
9295

9396
/*

0 commit comments

Comments
 (0)