kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update comments around JDK11 workaround.

Browse Source 
11.0.2 has since been released, but we are now aware of several more
bugs, so the workaround is unlikely to be removable for the foreseeable
future.

Change-Id: I8e7edcba2f002d0558a21e607306ddf9a205bfb3
Reviewed-on: https://boringssl-review.googlesource.com/c/34484
Commit-Queue: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>
This commit is contained in:
David Benjamin 2019-01-16 18:11:46 -06:00 committed by CQ bot account: commit-bot@chromium.org
parent c47f7936d0
commit fa81cc65dd
2 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
include/openssl/ssl.h
View File

@ -3794,12 +3794,12 @@ OPENSSL_EXPORT void SSL_set_ignore_tls13_downgrade(SSL *ssl, int ignore);
// mechanism would have aborted |ssl|'s handshake and zero otherwise.
OPENSSL_EXPORT int SSL_is_tls13_downgrade(const SSL *ssl);
// SSL_set_jdk11_workaround configures whether to workaround a bug in JDK 11's
// TLS 1.3 implementation. Prior to 11.0.2, JDK 11 fails to send SNI in
// connections which offer a TLS 1.3 session. Enabling this workaround will
// disable TLS 1.3 on such clients.
// SSL_set_jdk11_workaround configures whether to workaround various bugs in
// JDK 11's TLS 1.3 implementation by disabling TLS 1.3 for such clients.
//
// See also https://bugs.openjdk.java.net/browse/JDK-8211806.
// https://bugs.openjdk.java.net/browse/JDK-8211806
// https://bugs.openjdk.java.net/browse/JDK-8212885
// https://bugs.openjdk.java.net/browse/JDK-8213202
OPENSSL_EXPORT void SSL_set_jdk11_workaround(SSL *ssl, int enable);

3
ssl/handshake_server.cc
View File

@ -402,8 +402,7 @@ static enum ssl_hs_wait_t do_start_accept(SSL_HANDSHAKE *hs) {
}
// is_probably_jdk11_with_tls13 returns whether |client_hello| was probably sent
// from a JDK 11 client (11.0.1 or earlier) with both TLS 1.3 and a prior
// version enabled.
// from a JDK 11 client with both TLS 1.3 and a prior version enabled.
static bool is_probably_jdk11_with_tls13(const SSL_CLIENT_HELLO *client_hello) {
// JDK 11 ClientHellos contain a number of unusual properties which should
// limit false positives.