RFR: 8331682: Slow networks/Impatient clients can potentially send unencrypted TLSv1.3 alerts that won't parse on the server [v8]
Artur Barashev
abarashev at openjdk.org
Wed Sep 25 14:41:58 UTC 2024
> https://bugs.openjdk.org/browse/JDK-8331682
Artur Barashev has updated the pull request with a new target base due to a merge or a rebase. The incremental webrev excludes the unrelated changes brought in by the merge/rebase. The pull request contains nine additional commits since the last revision:
- Move inspectTlsFlight test helper method to proper location
- Merge branch 'master' into JDK-8331682
- Spell user_canceled instead of user_cancelled as per RFC
- Remove unused helper method
- Fix network message order
- - Switch server to use plaintext after getting the unexpected plaintext alert message during TLSv1.3 handshake
- Always send user_cancelled alert before close_notify alert during handshake. This is actually a different issue which was discovered during this fix.
- Update tests accordingly
- Add assertions. Add the final server wrap
- - Rather than proactively scanning every packet for this unlikely scenario, we reactively check for unencrypted alert after getting the BadPaddingException
- Add "!context.isNegotiated" check as "handshakeContext" can be non-null if server receives a Post-Handshake message
- Update test to send "close_notify" alert after "user_cancelled" alert
- 8331682: Slow networks/Impatient clients can potentially send unencrypted TLSv1.3 alerts that won't parse on the server
-------------
Changes:
- all: https://git.openjdk.org/jdk/pull/21043/files
- new: https://git.openjdk.org/jdk/pull/21043/files/e2eb0591..8ce7d623
Webrevs:
- full: https://webrevs.openjdk.org/?repo=jdk&pr=21043&range=07
- incr: https://webrevs.openjdk.org/?repo=jdk&pr=21043&range=06-07
Stats: 151579 lines in 712 files changed: 146976 ins; 1877 del; 2726 mod
Patch: https://git.openjdk.org/jdk/pull/21043.diff
Fetch: git fetch https://git.openjdk.org/jdk.git pull/21043/head:pull/21043
PR: https://git.openjdk.org/jdk/pull/21043
More information about the security-dev
mailing list