setEnabledCipherSuites() — netty Function Reference

Source Code

handler/src/main/java/io/netty/handler/ssl/ReferenceCountedOpenSslEngine.java lines 1707–1761

    @Override
    public final void setEnabledCipherSuites(String[] cipherSuites) {
        checkNotNull(cipherSuites, "cipherSuites");

        final StringBuilder buf = new StringBuilder();
        final StringBuilder bufTLSv13 = new StringBuilder();

        CipherSuiteConverter.convertToCipherStrings(Arrays.asList(cipherSuites), buf, bufTLSv13,
                OpenSsl.isBoringSSL());
        final String cipherSuiteSpec = buf.toString();
        final String cipherSuiteSpecTLSv13 = bufTLSv13.toString();

        if (!OpenSsl.isTlsv13Supported() && !cipherSuiteSpecTLSv13.isEmpty()) {
            throw new IllegalArgumentException("TLSv1.3 is not supported by this java version.");
        }
        synchronized (this) {
            hasTLSv13Cipher = !cipherSuiteSpecTLSv13.isEmpty();
            if (!destroyed) {
                try {
                    // Set non TLSv1.3 ciphers.
                    SSL.setCipherSuites(ssl, cipherSuiteSpec, false);
                    if (OpenSsl.isTlsv13Supported()) {
                        // Set TLSv1.3 ciphers.
                        SSL.setCipherSuites(ssl, OpenSsl.checkTls13Ciphers(logger, cipherSuiteSpecTLSv13), true);
                    }

                    // We also need to update the enabled protocols to ensure we disable the protocol if there are
                    // no compatible ciphers left.
                    Set<String> protocols = new HashSet<String>(enabledProtocols);

                    // We have no ciphers that are compatible with none-TLSv1.3, let us explicit disable all other
                    // protocols.
                    if (cipherSuiteSpec.isEmpty()) {
                        protocols.remove(SslProtocols.TLS_v1);
                        protocols.remove(SslProtocols.TLS_v1_1);
                        protocols.remove(SslProtocols.TLS_v1_2);
                        protocols.remove(SslProtocols.SSL_v3);
                        protocols.remove(SslProtocols.SSL_v2);
                        protocols.remove(SslProtocols.SSL_v2_HELLO);
                    }
                    // We have no ciphers that are compatible with TLSv1.3, let us explicit disable it.
                    if (cipherSuiteSpecTLSv13.isEmpty()) {
                        protocols.remove(SslProtocols.TLS_v1_3);
                    }
                    // Update the protocols but not cache the value. We only cache when we call it from the user
                    // code or when we construct the engine.
                    setEnabledProtocols0(protocols.toArray(EMPTY_STRINGS), !hasTLSv13Cipher);
                } catch (Exception e) {
                    throw new IllegalStateException("failed to enable cipher suites: " + cipherSuiteSpec, e);
                }
            } else {
                throw new IllegalStateException("failed to enable cipher suites: " + cipherSuiteSpec);
            }
        }
    }