[2.5 backport] Fix TLS 1.3 issues on JDKs which support it #29121 #29148
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Session renegotiation tests are disabled because TLS 1.3 does not support renegotiation any more. (cherry picked from commit e524a0d) I mostly copied over the newest version of TlsSpec from master without doing a proper conflict resolution that does mimimal things. Hopefully, we have only picked up some more recent fixes and not some unwanted stuff.
Refs akka#29110 TLSActor could get caught in a spin-loop on connection termination because there was an implicit assumption that when inbound is closed (peer has sent `close_notify`), this SSLEngine would also automatically send a `close_notify` and close the connection. Therefore, it would stay in `flushOutbound` pumping in a loop. This is not true anymore with TLS 1.3, more accurately it can be configured using `-Djdk.tls.acknowledgeCloseNotify` which is `false` by default leading to half-open connections. The solution is to not support half-open TLS connections for now and consider a connection closed as soon as `isInboundClosed` and there's no outstanding data. (To support half-open connections, this fix would have to be reverted and `flushOutbound` fixed accordingly.) (cherry picked from commit 9beb88f)
…tanding data Refs akka#29111 This seems only to happen with TLS 1.3. In that case, remaining data in `transportInBuffer` was left there instead of putting it back onto the chopping block. Then `doWrap` was run but `doUnwrap` was never called again because only the chopping block was checked for outstanding data but not the buffer. (cherry picked from commit 87c5844)
jrudolph
added
backport
and removed
validating
This was referenced May 28, 2020
|
Test PASSed. |
raboof
approved these changes
May 29, 2020
This was referenced Jun 24, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
For simplicity, I backported all of the latest version of TlsSpec and not just the changes from #29121.