Re: [PATCH] JDK-8190917 : SSL session resumption, through handshake, in SSLEngine is broken for any protocols lesser than TLSv1.2

2018-05-02 Thread Jaikiran Pai
Hi Xuelei, I just noticed the comment on JDK-8190917[1], stating that the issue has been fixed. So I just built the latest JDK upstream and ran my test and it went fine :) Glad that this now works. Would you be willing to include (just) the testcase to verify that this behaviour works and doe

Re: [PATCH] JDK-8190917 : SSL session resumption, through handshake, in SSLEngine is broken for any protocols lesser than TLSv1.2

2018-02-28 Thread Xuelei Fan
Hi Jaikiran, As you noticed, we updated to use the ClientHello.client_version and session version for version negotiation during resumption. It's not the best option for performance, but it is a safer option for compatibility before I'm able to make further evaluation. I need more time to t

Re: [PATCH] JDK-8190917 : SSL session resumption, through handshake, in SSLEngine is broken for any protocols lesser than TLSv1.2

2018-02-23 Thread Jaikiran Pai
Sounds fine, thank you Xuelei. Would this later be backported to Java 9 too? -Jaikiran On 24/02/18 12:21 AM, Xuelei Fan wrote: Hi Jaikiran, Thanks a lot for the update.  Your code looks fine to me. As we are working on the re-org of the implementation[1] now, I may integrate your contributi

Re: [PATCH] JDK-8190917 : SSL session resumption, through handshake, in SSLEngine is broken for any protocols lesser than TLSv1.2

2018-02-23 Thread Xuelei Fan
Hi Jaikiran, Thanks a lot for the update. Your code looks fine to me. As we are working on the re-org of the implementation[1] now, I may integrate your contribution shortly after the re-org changes. Thanks, Xuelei [1]: http://mail.openjdk.java.net/pipermail/security-dev/2018-February/0168

Re: [PATCH] JDK-8190917 : SSL session resumption, through handshake, in SSLEngine is broken for any protocols lesser than TLSv1.2

2018-02-22 Thread Jaikiran Pai
Given some recent changes to the class involved in this patch, in the jdk repo (http://hg.openjdk.java.net/jdk/jdk), I noticed some merge conflicts to this patch today. So I've now attached an updated patch which resolves those merge issues. This has been tested with latest jtreg (tip). -Jaik

Re: [PATCH] JDK-8190917 : SSL session resumption, through handshake, in SSLEngine is broken for any protocols lesser than TLSv1.2

2017-12-06 Thread Jaikiran Pai
Thank you Xuelei. Please take your time. -Jaikiran On Wednesday, December 6, 2017, Xuelei Fan wrote: > Hi Jaikiran, > > I will sponsor this contribution. I need more time for the review and > testing. > > Thanks, > Xuelei > > On 11/23/2017 9:22 PM, Jaikiran Pai wrote: > >> As noted in [1], t

Re: [PATCH] JDK-8190917 : SSL session resumption, through handshake, in SSLEngine is broken for any protocols lesser than TLSv1.2

2017-12-06 Thread Xuelei Fan
Hi Jaikiran, I will sponsor this contribution. I need more time for the review and testing. Thanks, Xuelei On 11/23/2017 9:22 PM, Jaikiran Pai wrote: As noted in [1], there's a regression in Java 9, where SSL session resumption no longer works for SSL protocols other than TLSv1.2. The code

Re: [PATCH] JDK-8190917 : SSL session resumption, through handshake, in SSLEngine is broken for any protocols lesser than TLSv1.2

2017-12-05 Thread Jaikiran Pai
Last attempt - if there's no interest in this patch I'll stop pestering. -Jaikiran On 30/11/17 7:34 AM, Jaikiran Pai wrote: Anyone willing to sponsor/review the patch please? -Jaikiran On 24/11/17 10:52 AM, Jaikiran Pai wrote: As noted in [1], there's a regression in Java 9, where SSL sessi

Re: [PATCH] JDK-8190917 : SSL session resumption, through handshake, in SSLEngine is broken for any protocols lesser than TLSv1.2

2017-11-29 Thread Jaikiran Pai
Anyone willing to sponsor/review the patch please? -Jaikiran On 24/11/17 10:52 AM, Jaikiran Pai wrote: As noted in [1], there's a regression in Java 9, where SSL session resumption no longer works for SSL protocols other than TLSv1.2. The code which is responsible for session resumption resid

[PATCH] JDK-8190917 : SSL session resumption, through handshake, in SSLEngine is broken for any protocols lesser than TLSv1.2

2017-11-23 Thread Jaikiran Pai
As noted in [1], there's a regression in Java 9, where SSL session resumption no longer works for SSL protocols other than TLSv1.2. The code which is responsible for session resumption resides in the ServerHandshaker[2], in the clientHello method. This method, in its logic to decide whether or