RFR: 8331682: Slow networks/Impatient clients can potentially send unencrypted TLSv1.3 alerts that won't parse on the server [v8]

Artur Barashev abarashev at openjdk.org
Wed Sep 25 14:41:58 UTC 2024


> https://bugs.openjdk.org/browse/JDK-8331682

Artur Barashev has updated the pull request with a new target base due to a merge or a rebase. The incremental webrev excludes the unrelated changes brought in by the merge/rebase. The pull request contains nine additional commits since the last revision:

 - Move inspectTlsFlight test helper method to proper location
 - Merge branch 'master' into JDK-8331682
 - Spell user_canceled instead of user_cancelled as per RFC
 - Remove unused helper method
 - Fix network message order
 - - Switch server to use plaintext after getting the unexpected plaintext alert message during TLSv1.3 handshake
   - Always send user_cancelled alert before close_notify alert during handshake. This is actually a different issue which was discovered during this fix.
   - Update tests accordingly
 - Add assertions. Add the final server wrap
 - - Rather than proactively scanning every packet for this unlikely scenario, we reactively check for unencrypted alert after getting the BadPaddingException
   - Add "!context.isNegotiated" check as "handshakeContext" can be non-null if server receives a Post-Handshake message
   - Update test to send "close_notify" alert after "user_cancelled" alert
 - 8331682: Slow networks/Impatient clients can potentially send unencrypted TLSv1.3 alerts that won't parse on the server

-------------

Changes:
  - all: https://git.openjdk.org/jdk/pull/21043/files
  - new: https://git.openjdk.org/jdk/pull/21043/files/e2eb0591..8ce7d623

Webrevs:
 - full: https://webrevs.openjdk.org/?repo=jdk&pr=21043&range=07
 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=21043&range=06-07

  Stats: 151579 lines in 712 files changed: 146976 ins; 1877 del; 2726 mod
  Patch: https://git.openjdk.org/jdk/pull/21043.diff
  Fetch: git fetch https://git.openjdk.org/jdk.git pull/21043/head:pull/21043

PR: https://git.openjdk.org/jdk/pull/21043


More information about the security-dev mailing list