RFR: 8331682: Slow networks/Impatient clients can potentially send unencrypted TLSv1.3 alerts that won't parse on the server [v20]

[Artur Barashev]

On Thu, 17 Oct 2024 18:51:57 GMT, Xue-Lei Andrew Fan <xuelei at openjdk.org> wrote:

>> Artur Barashev has updated the pull request incrementally with one additional commit since the last revision:
>> 
>>   Adjust line length
>
> src/java.base/share/classes/sun/security/ssl/SSLTransport.java line 150:
> 
>> 148:                 int contentLen = Record.getInt16(currentFlight);                     // pos: 3, 4
>> 149: 
>> 150:                 if (contentLen == 2 && ContentType.ALERT.equals(ContentType.valueOf(contentType))) {
> 
> The timeout case could happen during rekeying as well.  For rekeying, the content might be encrypted with previous keys and cannot decrypted with the current keys.  As may void the condition "contentLen == 2".

KEY UPDATE happens after handshake, so `!context.isNegotiated` check above won't pass.

-------------

PR Review Comment: https://git.openjdk.org/jdk/pull/21043#discussion_r1805341907