[java-shib-shared] branch main updated: OSJ-391: Default supported TLS protocols appears too broad

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-shib-shared.

View the commit online:
http://git.shibboleth.net/view/?p=java-shib-shared.git;a=commit;h=1bc411d6edb56add2e2920ae8ed5a6fe63c4a11e

The following commit(s) were added to refs/heads/main by this push:
     new 1bc411d6 OSJ-391: Default supported TLS protocols appears too broad
1bc411d6 is described below

commit 1bc411d6edb56add2e2920ae8ed5a6fe63c4a11e
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Dec 13 21:57:59 2023 -0500

    OSJ-391: Default supported TLS protocols appears too broad
---
 .../shibboleth/shared/httpclient/TLSSocketFactory.java    | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/TLSSocketFactory.java b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/TLSSocketFactory.java
index 3366d5d3..d95d3fca 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/TLSSocketFactory.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/TLSSocketFactory.java
@@ -18,6 +18,7 @@ import java.io.IOException;
 import java.net.InetSocketAddress;
 import java.net.Socket;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -91,6 +92,9 @@ public class TLSSocketFactory implements LayeredConnectionSocketFactory {
     /** Hostname verifier which implements a strict policy. */
     @Nonnull public static final HostnameVerifier STRICT_HOSTNAME_VERIFIER = new DefaultHostnameVerifier();
     
+    /** Default enabled protocols. */
+    @Nonnull public static final String[] DEFAULT_ENABLED_PROTOCOLS = new String[] { "TLSv1.3", "TLSv1.2"};
+    
     /** Logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(TLSSocketFactory.class);
 
@@ -300,15 +304,8 @@ public class TLSSocketFactory implements LayeredConnectionSocketFactory {
         } else if (getSupportedProtocols() != null) {
             sslsock.setEnabledProtocols(getSupportedProtocols());
         } else {
-            // If supported protocols are not explicitly set, remove all SSL protocol versions
-            final String[] allProtocols = sslsock.getSupportedProtocols();
-            final List<String> enabledProtocols = new ArrayList<>(allProtocols.length);
-            for (final String protocol: allProtocols) {
-                if (!protocol.startsWith("SSL")) {
-                    enabledProtocols.add(protocol);
-                }
-            }
-            sslsock.setEnabledProtocols(enabledProtocols.toArray(new String[enabledProtocols.size()]));
+            // If supported protocols are not otherwise explicitly set, enable only the default set
+            sslsock.setEnabledProtocols(DEFAULT_ENABLED_PROTOCOLS);
         }
         
         final String[] contextCipherSuites = getListAttribute(context, CONTEXT_KEY_TLS_CIPHER_SUITES);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.