From 62661b3c2dfc15b6a8d42a1d65c7684f2a431625 Mon Sep 17 00:00:00 2001
From: Jeremy Schoemaker <jeremy@shoemoney.com>
Date: Thu, 27 Aug 2026 15:40:21 -0500
Subject: [PATCH] fix(pulsar): pass webServiceTlsCiphers to Jetty factory

Rebased onto branch-4.2 per maintainer request (PIP-478 covers
master). Same fix as the original commit, reapplied against
branch-4.2's WebService/ProxyConnection code: WebService passes
config.getTlsCiphers/getTlsProtocols to the Jetty SSL context
factory, ignoring webServiceTlsCiphers/webServiceTlsProtocols.
ProxyConnection.createClientConfiguration omits ciphers/protocols
for the broker lookup client.
---
 .../java/org/apache/pulsar/broker/web/WebService.java     | 8 +++++++-
 .../org/apache/pulsar/proxy/server/ProxyConnection.java   | 2 ++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/pulsar-broker/src/main/java/org/apache/pulsar/broker/web/WebService.java b/pulsar-broker/src/main/java/org/apache/pulsar/broker/web/WebService.java
index 21c99f8196fec..9ef193ff9f131 100644
--- a/pulsar-broker/src/main/java/org/apache/pulsar/broker/web/WebService.java
+++ b/pulsar-broker/src/main/java/org/apache/pulsar/broker/web/WebService.java
@@ -25,6 +25,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
+import java.util.Set;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.ScheduledFuture;
 import java.util.concurrent.TimeUnit;
@@ -171,7 +172,8 @@ public WebService(PulsarService pulsar) throws PulsarServerException {
                 SslContextFactory.Server sslCtxFactory =
                         JettySslContextFactory.createSslContextFactory(config.getWebServiceTlsProvider(),
                                 this.sslFactory, config.isTlsRequireTrustedClientCertOnConnect(),
-                                config.getTlsCiphers(), config.getTlsProtocols());
+                                firstNonEmpty(config.getWebServiceTlsCiphers(), config.getTlsCiphers()),
+                                firstNonEmpty(config.getWebServiceTlsProtocols(), config.getTlsProtocols()));
                 List<ConnectionFactory> connectionFactories = new ArrayList<>();
                 if (config.isWebServiceHaProxyProtocolEnabled()) {
                     connectionFactories.add(new ProxyConnectionFactory());
@@ -532,5 +534,9 @@ protected void refreshSslContext() {
         }
     }
 
+    private static Set<String> firstNonEmpty(Set<String> preferred, Set<String> fallback) {
+        return preferred != null && !preferred.isEmpty() ? preferred : fallback;
+    }
+
     private static final Logger log = LoggerFactory.getLogger(WebService.class);
 }
diff --git a/pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/ProxyConnection.java b/pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/ProxyConnection.java
index cfe788e522967..9271319fe136c 100644
--- a/pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/ProxyConnection.java
+++ b/pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/ProxyConnection.java
@@ -797,6 +797,8 @@ ClientConfigurationData createClientConfiguration() {
                 clientConf.setTlsCertificateFilePath(proxyConfig.getBrokerClientCertificateFilePath());
             }
             clientConf.setTlsAllowInsecureConnection(proxyConfig.isTlsAllowInsecureConnection());
+            clientConf.setTlsCiphers(proxyConfig.getBrokerClientTlsCiphers());
+            clientConf.setTlsProtocols(proxyConfig.getBrokerClientTlsProtocols());
         }
         return clientConf;
     }