Code review request, 7093640, Enable TLS 1.2 for client-side default contexts

[Sean Mullan]

I reviewed the source code changes (not the tests) and it looks good to me.

--Sean

On 12/17/2013 05:08 AM, Xuelei Fan wrote:
> Hi,
>
> This is a request to enabled TLS 1.2 for client-side default contexts.
> Please review this update.
>
> webrev: http://cr.openjdk.java.net/~xuelei/7093640/webrev.00/
>
> We are still concern about the version intolerance issue with some older
> SSL/TLS server implementation.  As a workaround, a new system property,
> "jdk.tls.client.protocols", is defined to configure the protocols in
> default contexts.
>
> By default, TLS 1.1 and TLS 1.2 (plus other supported and safe
> protocols) are enabled unless the system property is explicit configured
> and does not contain "TLSv1.1" or "TLSv1.2".
>
> The property string is a list of comma separated standard SSL protocol
> names. The syntax of the property string can be described as this Java
> BNF-style:
>       ClientProtocols:
>              ('"' SSLProtocolNames '"') | SSLProtocolNames
>       SSLProtocolNames:
>              SSLProtocolName { , SSLProtocolName }
>       SSLProtocolName:
>          (see below)
>
> The "SSLProtocolName" is the standard SSL protocol name as described in
> the "Java Cryptography Architecture Standard Algorithm Name
> Documentation". If the property value does not comply to the above
> syntax, or the specified value of SSLProtocolName is not a supported SSL
> protocol name, the instantiation of the SSLContext provider service (via
> SSLContext.getInstance() methods) may generate a
> java.security.NoSuchAlgorithmException. Please note that the protocol
> name is case-sensitive.
>
> If the system property is not set or is empty, the default enabled
> protocol setting in both client and server looks like:
>
> Protocol         Enabled           Enabled
>                   for Client        for Server
> --------         ----------        ----------
> SSLv3            Yes               Yes
> TLSv1            Yes               Yes
> TLSv1.1          Yes               Yes
> TLSv1.2          Yes               Yes
> SSLv2Hello       No                Yes
>
>
> If the system property is set to "TLSv1,TLSv1.1", the default enabled
> protocol setting in both client and server looks like:
>
> Protocol         Enabled           Enabled
>                   for Client        for Server
> --------         ----------        ----------
> SSLv3            No                Yes
> TLSv1            Yes               Yes
> TLSv1.1          Yes               Yes
> TLSv1.2          No                Yes
> SSLv2Hello       No                Yes
>
> This update does not impact the API specification of JSSE, JSSE server
> side and third party's provider.
>
> Thanks,
> Xuelei
>