8282600: SSLSocketImpl should not use user_canceled workaround when not necessary #7664

zzambers · 2022-03-02T19:04:26Z

When testing compatibility of jdk TLS implementation with gnutls, I have found a problem. The problem is, that gnutls does not like use of user_canceled alert when closing TLS-1.3 connection from duplexCloseOutput() (used by socket.close() unless shutdownOutput was called explicitly) and considers it error. (For more details see: [1])

As I understand it, usage of user_canceled alert before close is workaround for an issue of not being able to cleanly initialize full (duplex) close of TLS-1.3 connection (other side is not required to immediately close the after receiving close_notify, unlike in earlier TLS versions). Some legacy programs could probably hang or something, expecting socket.close to perform immediate duplex close. Problem is this is not what user_canceled alert is intended for [2] and it is therefore undefined how the other side handles this. (JDK itself replies to close_notify preceded by user_canceled alert by immediately closing its output [3].)

This fix disables this workaround when it is not necessary (connection is already half-closed by the other side). This way it fixes my case (gnutls client connected to jdk server initiates close) and it should be safe. (As removing workaround altogether could probably reintroduce issues for legacy apps... )

I also ran jdk_security tests locally, which passed for me.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1918473
[2] https://datatracker.ietf.org/doc/html/rfc8446#section-6.1
[3]

jdk/src/java.base/share/classes/sun/security/ssl/Alert.java

Line 243 in b6c35ae

if (alert == Alert.CLOSE_NOTIFY) {

Progress

Change must not contain extraneous whitespace
Commit message must refer to an issue
Change must be properly reviewed (1 reviews required, with at least 1 reviewer)

Issue

JDK-8282600: SSLSocketImpl should not use user_canceled workaround when not necessary

Reviewers

Xue-Lei Andrew Fan (@XueleiFan - Reviewer)
Bradford Wetmore (@bradfordwetmore - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.java.net/jdk pull/7664/head:pull/7664
$ git checkout pull/7664

Update a local copy of the PR:
$ git checkout pull/7664
$ git pull https://git.openjdk.java.net/jdk pull/7664/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 7664

View PR using the GUI difftool:
$ git pr show -t 7664

Using diff file

Download this PR as a diff file:
https://git.openjdk.java.net/jdk/pull/7664.diff

…has already half-closed the connection.

bridgekeeper · 2022-03-02T19:09:38Z

👋 Welcome back zzambers! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2022-03-02T19:12:19Z

@zzambers The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

jerboaa · 2022-03-03T10:45:02Z

@zzambers I've create https://bugs.openjdk.java.net/browse/JDK-8282600 for this issue. Please reference it in the PR title.

mlbridge · 2022-03-03T11:21:16Z

Webrevs

00: Full (f16499bc)

zzambers · 2022-03-03T11:23:06Z

@jerboaa thank you

XueleiFan

It looks like a nice change to me. Thank you!

openjdk · 2022-03-03T15:38:32Z

@zzambers This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8282600: SSLSocketImpl should not use user_canceled workaround when not necessary

Reviewed-by: xuelei, wetmore

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 760 new commits pushed to the master branch:

81d7475: 7132796: [macosx] closed/javax/swing/JComboBox/4517214/bug4517214.java fails on MacOS
4a5e7a1: 8282555: Missing memory edge when spilling MoveF2I, MoveD2L etc
1bb4de2: 8285956: (fs) Excessive default poll interval in PollingWatchService
3092b56: 8284813: x86 Code cleanup related to move instructions.
d43ae72: 8286105: SourceRevision.gmk should respect GIT variable
7d54508: 8283606: Tests may fail with zh locale on MacOS
158d871: 8285693: Create an automated test for JDK-4702199
bb022b2: 8285470: Improve handling of @inheritdoc
09e6ee9: 8255552: Add DES/3DES/MD5 to jdk.security.legacyAlgorithms
4d30a1e: 8284220: TypeMirror#toString omits enclosing class names after JDK-8281238
... and 750 more: https://git.openjdk.java.net/jdk/compare/fc52a2182a9debc04b2ac302801b3d61989f54ec...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

As you do not have Committer status in this project an existing Committer must agree to sponsor your change. Possible candidates are the reviewers of this PR (@XueleiFan, @bradfordwetmore) but any other Committer may sponsor as well.

➡️ To flag this PR as ready for integration with the above commit message, type /integrate in a new comment. (Afterwards, your sponsor types /sponsor in a new comment to perform the integration).

XueleiFan · 2022-03-03T15:40:31Z

Did you want to add a test? Otherwise, please add a noreg- label in the bug JDK-8282600.

zzambers · 2022-03-03T16:49:59Z

@XueleiFan thank you for review. I have added noreg-external tag and some explanation to Openjdk bug.

bradfordwetmore · 2022-03-09T21:12:06Z

I am looking at a few things in this PR. Please ping me before integrating.

I believe this code is correct, but checking on the overall USER_CANCELED strategy.

zzambers · 2022-03-14T13:25:44Z

@bradfordwetmore, it is ready from my side, but please take your time to do any checks, which you find necessary to make sure there is no problem here.

bradfordwetmore · 2022-03-14T14:21:38Z

Thanks, been working on another close issue. I should be finishing that shortly,

bridgekeeper · 2022-04-11T14:45:46Z

@zzambers This pull request has been inactive for more than 4 weeks and will be automatically closed if another 4 weeks passes without any activity. To avoid this, simply add a new comment to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration!

bradfordwetmore · 2022-04-11T19:50:07Z

Resettting the clock. Sorry for the delay.

bradfordwetmore

Thanks for the extra time to review this change.

I'm still wondering if there is better pattern that doesn't use user_canceled, but that doesn't need to delay this fix from going in.

bradfordwetmore · 2022-05-04T16:17:25Z

tier1/tier2 tests pass. Did not try infra or JCK yet.

bradfordwetmore · 2022-05-04T19:22:05Z

Infra + JCK passed. Looks good.

zzambers · 2022-05-05T09:57:18Z

@bradfordwetmore Thank you

zzambers · 2022-05-05T09:58:14Z

/integrate

openjdk · 2022-05-05T09:59:41Z

@zzambers
Your change (at version f16499b) is now ready to be sponsored by a Committer.

jerboaa · 2022-05-05T12:12:19Z

/sponsor

openjdk · 2022-05-05T12:13:29Z

Going to push as commit 7e88ff8.
Since your change was applied there have been 760 commits pushed to the master branch:

81d7475: 7132796: [macosx] closed/javax/swing/JComboBox/4517214/bug4517214.java fails on MacOS
4a5e7a1: 8282555: Missing memory edge when spilling MoveF2I, MoveD2L etc
1bb4de2: 8285956: (fs) Excessive default poll interval in PollingWatchService
3092b56: 8284813: x86 Code cleanup related to move instructions.
d43ae72: 8286105: SourceRevision.gmk should respect GIT variable
7d54508: 8283606: Tests may fail with zh locale on MacOS
158d871: 8285693: Create an automated test for JDK-4702199
bb022b2: 8285470: Improve handling of @inheritdoc
09e6ee9: 8255552: Add DES/3DES/MD5 to jdk.security.legacyAlgorithms
4d30a1e: 8284220: TypeMirror#toString omits enclosing class names after JDK-8281238
... and 750 more: https://git.openjdk.java.net/jdk/compare/fc52a2182a9debc04b2ac302801b3d61989f54ec...master

Your commit was automatically rebased without conflicts.

openjdk · 2022-05-05T12:13:43Z

@jerboaa @zzambers Pushed as commit 7e88ff8.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

SSLSocketImpl: Do not use user_canceled workaround if the other side …

f16499b

…has already half-closed the connection.

openjdk bot added the security security-dev@openjdk.org label Mar 2, 2022

zzambers changed the title ~~SSLSocketImpl should not use user_canceled workaround when not necessary~~ 8282600: SSLSocketImpl should not use user_canceled workaround when not necessary Mar 3, 2022

openjdk bot added the rfr Pull request is ready for review label Mar 3, 2022

XueleiFan approved these changes Mar 3, 2022

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Mar 3, 2022

bradfordwetmore approved these changes May 4, 2022

View reviewed changes

openjdk bot added the sponsor Pull request is ready to be sponsored label May 5, 2022

openjdk bot added the integrated Pull request has been integrated label May 5, 2022

openjdk bot closed this May 5, 2022

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review sponsor Pull request is ready to be sponsored labels May 5, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

8282600: SSLSocketImpl should not use user_canceled workaround when not necessary #7664

8282600: SSLSocketImpl should not use user_canceled workaround when not necessary #7664

zzambers commented Mar 2, 2022 •

edited by openjdk bot

Loading

bridgekeeper bot commented Mar 2, 2022

openjdk bot commented Mar 2, 2022

jerboaa commented Mar 3, 2022

mlbridge bot commented Mar 3, 2022

zzambers commented Mar 3, 2022

XueleiFan left a comment

openjdk bot commented Mar 3, 2022 •

edited

Loading

XueleiFan commented Mar 3, 2022

zzambers commented Mar 3, 2022

bradfordwetmore commented Mar 9, 2022 •

edited

Loading

zzambers commented Mar 14, 2022

bradfordwetmore commented Mar 14, 2022

bridgekeeper bot commented Apr 11, 2022

bradfordwetmore commented Apr 11, 2022

bradfordwetmore left a comment

bradfordwetmore commented May 4, 2022

bradfordwetmore commented May 4, 2022

zzambers commented May 5, 2022

zzambers commented May 5, 2022

openjdk bot commented May 5, 2022

jerboaa commented May 5, 2022

openjdk bot commented May 5, 2022

openjdk bot commented May 5, 2022

8282600: SSLSocketImpl should not use user_canceled workaround when not necessary #7664

8282600: SSLSocketImpl should not use user_canceled workaround when not necessary #7664

Conversation

zzambers commented Mar 2, 2022 • edited by openjdk bot Loading

Progress

Issue

Reviewers

Reviewing

bridgekeeper bot commented Mar 2, 2022

openjdk bot commented Mar 2, 2022

jerboaa commented Mar 3, 2022

mlbridge bot commented Mar 3, 2022

Webrevs

zzambers commented Mar 3, 2022

XueleiFan left a comment

Choose a reason for hiding this comment

openjdk bot commented Mar 3, 2022 • edited Loading

XueleiFan commented Mar 3, 2022

zzambers commented Mar 3, 2022

bradfordwetmore commented Mar 9, 2022 • edited Loading

zzambers commented Mar 14, 2022

bradfordwetmore commented Mar 14, 2022

bridgekeeper bot commented Apr 11, 2022

bradfordwetmore commented Apr 11, 2022

bradfordwetmore left a comment

Choose a reason for hiding this comment

bradfordwetmore commented May 4, 2022

bradfordwetmore commented May 4, 2022

zzambers commented May 5, 2022

zzambers commented May 5, 2022

openjdk bot commented May 5, 2022

jerboaa commented May 5, 2022

openjdk bot commented May 5, 2022

openjdk bot commented May 5, 2022

zzambers commented Mar 2, 2022 •

edited by openjdk bot

Loading

openjdk bot commented Mar 3, 2022 •

edited

Loading

bradfordwetmore commented Mar 9, 2022 •

edited

Loading