<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div dir="ltr">
<div></div>
<div>
<div>Hello,</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">I wanted to mention again, that all those System property configurations are good, especially to resolve the update pains, but not really useful if you want to make configurations on a per-connection base. If you have to support multiple partners
it can be a real pain to setup a common feature set or multiple instances. For this a generic feature setter for the context would be really useful. Most prominent recent example is the ca-extension, which only really makes sense if you also did programmatically
configure a small list of trusted CAs.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">I also think it would overall clean up the code and give a good place for Javadoc all those options.</div>
<div dir="ltr">Not to mention the default could be tied to a few new context names.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">Gruss</div>
<div dir="ltr">Bernd</div>
<div id="ms-outlook-mobile-signature">
<div style="direction: ltr">-- </div>
<div style="direction: ltr">http://bernd.eckenfels.net</div>
</div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>Von:</b> security-dev <security-dev-retn@openjdk.java.net> im Auftrag von Xue-Lei Andrew Fan <xuelei@openjdk.java.net><br>
<b>Gesendet:</b> Monday, January 25, 2021 11:17:56 PM<br>
<b>An:</b> security-dev@openjdk.java.net <security-dev@openjdk.java.net><br>
<b>Betreff:</b> Re: RFR: 8217633: Configurable extensions with system properties [v2]</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">> The TLS protocols are designed to tolerant unknown TLS extensions. However, although it is not common, there are a few TLS implementations that cannot handle unknown extensions properly. As results in unexpected interoperability issue
when new extensions are introduced in JDK. The interoperability impact could be mitigated If applications can customize the extensions if needed.<br>
> <br>
> With this update, two system properties are added to configure the default extensions in either client or server side of TLS connections. Please note that the impact of blocking TLS extensions is complicated. For example, a TLS connection may not be able
to established if a mandatory extension is blocked. Please don't use this feature unless you clearly understand the impact.<br>
> <br>
> Bug: <a href="https://bugs.openjdk.java.net/browse/JDK-8217633">https://bugs.openjdk.java.net/browse/JDK-8217633</a>
<br>
> CSR: <a href="https://bugs.openjdk.java.net/browse/JDK-8217993">https://bugs.openjdk.java.net/browse/JDK-8217993</a><br>
<br>
Xue-Lei Andrew Fan has updated the pull request incrementally with one additional commit since the last revision:<br>
<br>
Update copyright years to 2021<br>
<br>
-------------<br>
<br>
Changes:<br>
- all: <a href="https://git.openjdk.java.net/jdk/pull/1752/files">https://git.openjdk.java.net/jdk/pull/1752/files</a><br>
- new: <a href="https://git.openjdk.java.net/jdk/pull/1752/files/ad5f3330..5bd6e865">
https://git.openjdk.java.net/jdk/pull/1752/files/ad5f3330..5bd6e865</a><br>
<br>
Webrevs:<br>
- full: <a href="https://webrevs.openjdk.java.net/?repo=jdk&pr=1752&range=01">https://webrevs.openjdk.java.net/?repo=jdk&pr=1752&range=01</a><br>
- incr: <a href="https://webrevs.openjdk.java.net/?repo=jdk&pr=1752&range=00-01">
https://webrevs.openjdk.java.net/?repo=jdk&pr=1752&range=00-01</a><br>
<br>
Stats: 4 lines in 2 files changed: 0 ins; 0 del; 4 mod<br>
Patch: <a href="https://git.openjdk.java.net/jdk/pull/1752.diff">https://git.openjdk.java.net/jdk/pull/1752.diff</a><br>
Fetch: git fetch <a href="https://git.openjdk.java.net/jdk">https://git.openjdk.java.net/jdk</a> pull/1752/head:pull/1752<br>
<br>
PR: <a href="https://git.openjdk.java.net/jdk/pull/1752">https://git.openjdk.java.net/jdk/pull/1752</a><br>
</div>
</span></font></div>
</body>
</html>