archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-28 23:34:52 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8240871: SSLEngine handshake status immediately after the handshake can be NOT_HANDSHAKING rather than FINISHED with TLSv1.3

Browse source 
Reviewed-by: ascarpino
This commit is contained in:
Xue-Lei Andrew Fan 2020-05-29 13:48:13 -07:00
parent 1d4bd253e4
commit 7514ad9ad0
8 changed files with 165 additions and 69 deletions
Download patch file Download diff file Expand all files Collapse all files

20
src/java.base/share/classes/sun/security/ssl/TransportContext.java
View file

@ -64,6 +64,23 @@ final class TransportContext implements ConnectionContext {
Exception closeReason = null;
Exception delegatedThrown = null;
// For TLS 1.3 full handshake, the last handshake flight could be wrapped
// and encrypted in one record and delegated task would be used. There is
// no chance to return FINISHED handshake status with SSLEngine.(un)wrap().
// However, per the HandshakeStatus.FINISHED specification, this value is
// only generated by a call to SSLEngine.wrap()/unwrap() and it is never
// generated by SSLEngine.getHandshakeStatus().
//
// In order to workaround this case for TLS 1.3, the FINISHED status is
// present with SSLEngine.wrap() while delivering of the NewSessionTicket
// post-handshake message. If this post-handshake message is not needed,
// a follow-on SSLEngine.wrap() should be called to indicate the FINISHED
// handshake status. Although this special SSLEngine.wrap() should not
// consume or produce any application or network data.
boolean needHandshakeFinishedStatus = false;
boolean hasDelegatedFinished = false;
// negotiated security parameters
SSLSessionImpl conSession;
ProtocolVersion protocolVersion;
@ -589,6 +606,9 @@ final class TransportContext implements ConnectionContext {
// Special case that the inbound was closed, but outbound open.
return HandshakeStatus.NEED_WRAP;
} // Otherwise, both inbound and outbound are closed.
} else if (needHandshakeFinishedStatus) {
// Special case to get FINISHED status for TLS 1.3 full handshake.
return HandshakeStatus.NEED_WRAP;
}
return HandshakeStatus.NOT_HANDSHAKING;