Re: RFR: 8293176: SSLEngine handshaker does not send an alert after a bad parameters [v2]

2023-09-27 Thread Daniel Jeliński
On Fri, 11 Aug 2023 21:38:04 GMT, Daniel Jeliński wrote: >> Please review this patch that ensures that all exceptions thrown by >> SSLEngine delegated tasks are translated to alerts. >> >> All exceptions should already be translated to SSLExceptions and alerts by >> the time we exit from conte

Integrated: 8293176: SSLEngine handshaker does not send an alert after a bad parameters

2023-09-27 Thread Daniel Jeliński
On Fri, 4 Aug 2023 08:17:39 GMT, Daniel Jeliński wrote: > Please review this patch that ensures that all exceptions thrown by SSLEngine > delegated tasks are translated to alerts. > > All exceptions should already be translated to SSLExceptions and alerts by > the time we exit from context.dis

Re: RFR: 8308144: HttpClient - uncontrolled memory consumption in SSLFlowDelegate.Reader

2023-09-27 Thread Bart Smits
On Mon, 24 Jul 2023 06:28:23 GMT, Jaikiran Pai wrote: >> Thank you, I will look at these options. > > Hello @zhurs, would you mind if one of us took over this PR and moved this > forward? Daniel noted that the fix looks reasonable and it's the test which > will need some work. We will add you a

Re: RFR: 8308144: HttpClient - uncontrolled memory consumption in SSLFlowDelegate.Reader

2023-09-27 Thread Daniel Fuchs
On Wed, 27 Sep 2023 13:07:00 GMT, Bart Smits wrote: >> Hello @zhurs, would you mind if one of us took over this PR and moved this >> forward? Daniel noted that the fix looks reasonable and it's the test which >> will need some work. We will add you as the co-author. > > Hi @jaikiran I see the P

Re: RFR: 8295919: java.security.MessageDigest.isEqual does not adhere to @implNote

2023-09-27 Thread Sean Mullan
On Tue, 26 Sep 2023 19:37:23 GMT, Kevin Driver wrote: > Fix JDK-8295919 by updating the javadoc to explain that a null or zero-length > `digestb` will also result in a short-circuit response src/java.base/share/classes/java/security/MessageDigest.java line 464: > 462: * It does not depend

Re: RFR: 8295919: java.security.MessageDigest.isEqual does not adhere to @implNote

2023-09-27 Thread Kevin Driver
On Wed, 27 Sep 2023 19:31:53 GMT, Sean Mullan wrote: >> Fix JDK-8295919 by updating the javadoc to explain that a null or >> zero-length `digestb` will also result in a short-circuit response > > src/java.base/share/classes/java/security/MessageDigest.java line 464: > >> 462: * It does not

Re: RFR: 8295919: java.security.MessageDigest.isEqual does not adhere to @implNote [v2]

2023-09-27 Thread Kevin Driver
> Fix JDK-8295919 by updating the javadoc to explain that a null or zero-length > `digestb` will also result in a short-circuit response Kevin Driver has updated the pull request incrementally with one additional commit since the last revision: rephrased per code review - Change

RFR: 8316964: Security tools should not call System.exit

2023-09-27 Thread Weijun Wang
Remove most `System.exit()` calls in various security tools and only leave one in the `main` method. This paves the way to convert them to JSR 199 tools. - Commit messages: - the fix Changes: https://git.openjdk.org/jdk/pull/15951/files Webrev: https://webrevs.openjdk.org/?repo=jd

Re: RFR: 8308144: HttpClient - uncontrolled memory consumption in SSLFlowDelegate.Reader

2023-09-27 Thread Jaikiran Pai
On Thu, 25 May 2023 20:17:39 GMT, zhurs wrote: > When using HttpClient to make requests to HTTPS resources, there is an issue > where the entire file is being downloaded into memory without the ability to > limit the buffer size. > If the SSLEngine cannot decode the entire buffer due to the alg

Re: RFR: 8301686: TLS 1.3 handshake fails if server_name doesn't match resuming session [v2]

2023-09-27 Thread Bradford Wetmore
On Wed, 26 Apr 2023 11:51:23 GMT, Jaikiran Pai wrote: >> Can I please get a review of this change which proposes to fix the issue >> reported in https://bugs.openjdk.org/browse/JDK-8301686? >> >> The internal implementation of SSLContext caches SSLSession(s). These >> sessions are for a partic

Re: RFR: 8293176: SSLEngine handshaker does not send an alert after a bad parameters [v2]

2023-09-27 Thread Bradford Wetmore
On Fri, 11 Aug 2023 21:38:04 GMT, Daniel Jeliński wrote: >> Please review this patch that ensures that all exceptions thrown by >> SSLEngine delegated tasks are translated to alerts. >> >> All exceptions should already be translated to SSLExceptions and alerts by >> the time we exit from conte

Re: RFR: 8293176: SSLEngine handshaker does not send an alert after a bad parameters [v2]

2023-09-27 Thread Bradford Wetmore
On Fri, 11 Aug 2023 21:22:02 GMT, Daniel Jeliński wrote: >> test/jdk/sun/security/ssl/SSLEngineImpl/SSLEngineDecodeBadPoint.java line 40: >> >>> 38: public class SSLEngineDecodeBadPoint { >>> 39: static final byte[] clientHello = HexFormat.of().parseHex( >>> 40: "160303013a010001

Re: RFR: 8301686: TLS 1.3 handshake fails if server_name doesn't match resuming session [v2]

2023-09-27 Thread Jaikiran Pai
On Wed, 26 Apr 2023 11:51:23 GMT, Jaikiran Pai wrote: >> Can I please get a review of this change which proposes to fix the issue >> reported in https://bugs.openjdk.org/browse/JDK-8301686? >> >> The internal implementation of SSLContext caches SSLSession(s). These >> sessions are for a partic

Re: RFR: 8301686: TLS 1.3 handshake fails if server_name doesn't match resuming session [v3]

2023-09-27 Thread Jaikiran Pai
> Can I please get a review of this change which proposes to fix the issue > reported in https://bugs.openjdk.org/browse/JDK-8301686? > > The internal implementation of SSLContext caches SSLSession(s). These > sessions are for a particular combination or peer host and port. When a TLS > handsha

Re: RFR: 8307160: [REDO] Enable the permissive- flag on the Microsoft Visual C compiler [v6]

2023-09-27 Thread Julian Waters
> We should set the -permissive- flag for the Microsoft Visual C compiler, as > was requested by the now backed out > [JDK-8241499](https://bugs.openjdk.org/browse/JDK-8241499). Doing so makes > the Visual C compiler much less accepting of ill formed code, which will > improve code quality on W

Re: RFR: 8307160: [REDO] Enable the permissive- flag on the Microsoft Visual C compiler [v6]

2023-09-27 Thread Julian Waters
On Thu, 28 Sep 2023 03:12:03 GMT, Julian Waters wrote: >> We should set the -permissive- flag for the Microsoft Visual C compiler, as >> was requested by the now backed out >> [JDK-8241499](https://bugs.openjdk.org/browse/JDK-8241499). Doing so makes >> the Visual C compiler much less acceptin

Withdrawn: 8307160: [REDO] Enable the permissive- flag on the Microsoft Visual C compiler

2023-09-27 Thread Julian Waters
On Tue, 1 Aug 2023 01:52:24 GMT, Julian Waters wrote: > We should set the -permissive- flag for the Microsoft Visual C compiler, as > was requested by the now backed out > [JDK-8241499](https://bugs.openjdk.org/browse/JDK-8241499). Doing so makes > the Visual C compiler much less accepting of

Re: RFR: JDK-8296631 NSS tests failing on OL9 linux-aarch64 hosts [v2]

2023-09-27 Thread Mark Powers
On Thu, 21 Sep 2023 15:40:22 GMT, Mark Powers wrote: >> https://bugs.openjdk.org/browse/JDK-8296631 > > Mark Powers has updated the pull request with a new target base due to a > merge or a rebase. The incremental webrev excludes the unrelated changes > brought in by the merge/rebase. The pull

Re: RFR: 8301686: TLS 1.3 handshake fails if server_name doesn't match resuming session [v3]

2023-09-27 Thread Jaikiran Pai
On Thu, 28 Sep 2023 01:38:15 GMT, Jaikiran Pai wrote: >> Can I please get a review of this change which proposes to fix the issue >> reported in https://bugs.openjdk.org/browse/JDK-8301686? >> >> The internal implementation of SSLContext caches SSLSession(s). These >> sessions are for a partic

Re: RFR: 8293176: SSLEngine handshaker does not send an alert after a bad parameters [v2]

2023-09-27 Thread Daniel Jeliński
On Thu, 28 Sep 2023 00:54:32 GMT, Bradford Wetmore wrote: >> Daniel Jeliński has updated the pull request incrementally with two >> additional commits since the last revision: >> >> - Fix exception handling >> - Fix indentation > > src/java.base/share/classes/sun/security/ssl/SSLEngineImpl.ja