Code Review Request, JDK-8207009 SSLEngine#closeInbound mentions SSLException when no close_notify is received

[Xuelei Fan]

Hi,

Please review the update for the TLS 1.3 half-close and synchronization 
implementation:
    http://cr.openjdk.java.net/~xuelei/8207009/webrev.00/

Unlike TLS 1.2 and prior versions, for TLS 1.3, the close_notify is use 
to close the local write side and peer read side only.  After the 
close_notify get handles, the local read side and peer write side may 
still be open.

In this update, if an application calls 
SSLEngine.closeInbound/Outbound() or SSLSocket.shutdownInput/Output(), 
half-close will be used.  For compatibility, if SSLSocket.close() get 
called, a duplex close will be tried.  In order to support duplex close, 
JDK will use the user_canceled warning alert even the handshake complete.

In practice, an application may only close outbound even it is intended 
to close the inbound as well, or close the connection completely.  It 
works for TLS 1.2 and prior versions.  But no more for TLS 1.3 because 
of the close_notify behavior change in the TLS 1.3 specification.  The 
application may be hung and dead-waiting for read/close.  It could be 
solved by closing the inbound explicitly.  In order to mitigate the 
impact, a new System Property is introduced, 
"jdk.tls.acknowledgeCloseNotify" if source code update is not available. 
  If the System Property is set to "true", if receiving the 
close_notify, a close_notify alert will be responded.  It is a 
countermeasure of the TLS 1.3 half-close issues.

Thanks,
Xuelei