RFR: 8331682: Slow networks/Impatient clients can potentially send unencrypted TLSv1.3 alerts that won't parse on the server [v24]

Artur Barashev abarashev at openjdk.org
Fri Oct 25 13:30:43 UTC 2024


> Check for unexpected plaintext alert message during TLSv1.3 handshake. This can happen if client doesn't receive ServerHello due to network timeout and tries to close the connection by sending an alert message.

Artur Barashev has updated the pull request with a new target base due to a merge or a rebase. The incremental webrev excludes the unrelated changes brought in by the merge/rebase. The pull request contains 28 additional commits since the last revision:

 - Merge branch 'master' into JDK-8331682
 - Use more appropriate exception with the alert description
 - Update Copyright
 - Update @library directive
 - Merge branch 'master' into JDK-8331682
 - Produce appropriate exception message. Update tests.
 - Adjust line length
 - Additional error checking
 - Write and read to/from server in a single pass. Use SocketChannel.
 - Return null if there is no record we attempted to decode
 - ... and 18 more: https://git.openjdk.org/jdk/compare/12b9a32f...aef08dd0

-------------

Changes:
  - all: https://git.openjdk.org/jdk/pull/21043/files
  - new: https://git.openjdk.org/jdk/pull/21043/files/91fc0fd8..aef08dd0

Webrevs:
 - full: https://webrevs.openjdk.org/?repo=jdk&pr=21043&range=23
 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=21043&range=22-23

  Stats: 110018 lines in 264 files changed: 5690 ins; 102781 del; 1547 mod
  Patch: https://git.openjdk.org/jdk/pull/21043.diff
  Fetch: git fetch https://git.openjdk.org/jdk.git pull/21043/head:pull/21043

PR: https://git.openjdk.org/jdk/pull/21043


More information about the security-dev mailing list