[cpp-sp] branch main updated: CPPSP-18 Investigate tlsCipherList for WinHttp

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository cpp-sp.

View the commit online:
https://codeberg.org/Shibboleth/cpp-sp/commit/13429742218e4518e0c5e66fc78dbee6f5d0f6a7

The following commit(s) were added to refs/heads/main by this push:
     new 13429742 CPPSP-18 Investigate tlsCipherList for WinHttp
13429742 is described below

commit 13429742218e4518e0c5e66fc78dbee6f5d0f6a7
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Thu Aug 20 20:07:59 2026 +0100

    CPPSP-18 Investigate tlsCipherList for WinHttp
    
    https://shibboleth.atlassian.net/browse/CPPSP-18
    
    Fix 'non specified' case for tlsCipherList and tls13CipherList
---
 shibsp/remoting/impl/WinHTTPRemotingService.cpp | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/shibsp/remoting/impl/WinHTTPRemotingService.cpp b/shibsp/remoting/impl/WinHTTPRemotingService.cpp
index f4eb2603..5d9a0019 100644
--- a/shibsp/remoting/impl/WinHTTPRemotingService.cpp
+++ b/shibsp/remoting/impl/WinHTTPRemotingService.cpp
@@ -627,9 +627,6 @@ void WinHTTPRemotingService::logSecureFailure(DWORD Status) const
 //
 void WinHTTPRemotingService::handleCipher(HINTERNET handle) const
 {
-    if (m_tls13CipherSet.empty() && m_cipherSet.empty())
-        return;
-
     WINHTTP_SECURITY_INFO secinfo;
     DWORD len = sizeof(secinfo);
     if (!WinHttpQueryOption(handle, WINHTTP_OPTION_SECURITY_INFO, &secinfo, &len)) {
@@ -643,7 +640,8 @@ void WinHTTPRemotingService::handleCipher(HINTERNET handle) const
     m_log.debug("cipher presented : {} ", cipher);
 
     if (secinfo.ConnectionInfo.dwProtocol == SP_PROT_TLS1_2_CLIENT) {
-        if (m_cipherSet.count(cipher)) {
+
+        if (getCiphers().empty() || m_cipherSet.count(cipher)) {
             // match, nothing to do
             return;
         }
@@ -652,7 +650,7 @@ void WinHTTPRemotingService::handleCipher(HINTERNET handle) const
     }
 
     if (secinfo.ConnectionInfo.dwProtocol == SP_PROT_TLS1_3_CLIENT) {
-        if (m_tls13CipherSet.count(cipher)) {
+        if (getTls13Ciphers().empty() || m_tls13CipherSet.count(cipher)) {
             // match, nothing to do
             return;
         }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.