RFR: 8331682: Slow networks/Impatient clients can potentially send unencrypted TLSv1.3 alerts that won't parse on the server [v24]

[Artur Barashev]

On Tue, 29 Oct 2024 17:19:26 GMT, Xue-Lei Andrew Fan <xuelei at openjdk.org> wrote:

>> It may be sufficient to have it in exception only.  We normally don't log exception message alone in SunJSSE.  From my understand, it is hardly to see a lot benefits.
>
> I don't think we know the record is "plaintext", even it has just two bytes.  The input is not verified, it can be anything.  I don't want to confuse the developers further if it is not plaintext case.

We assume that it's a plain text because `ContentType` is not of `APPLICATION_DATA` type and data is less than `tagSize`. This is the same assumption that is made in RFC:

`The server then ignores early data by skipping all records with an external
 content type of "application_data" (indicating that they are encrypted)`

In any case, we will provide the integer values of those 2 bytes if they are not known alert level and alert type.

-------------

PR Review Comment: https://git.openjdk.org/jdk/pull/21043#discussion_r1821288921