From fa81cc65dd39c990bb68cc1fbb44329dd05d96e2 Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Wed, 16 Jan 2019 18:11:46 -0600 Subject: [PATCH] Update comments around JDK11 workaround. 11.0.2 has since been released, but we are now aware of several more bugs, so the workaround is unlikely to be removable for the foreseeable future. Change-Id: I8e7edcba2f002d0558a21e607306ddf9a205bfb3 Reviewed-on: https://boringssl-review.googlesource.com/c/34484 Commit-Queue: David Benjamin Commit-Queue: Adam Langley Reviewed-by: Adam Langley --- include/openssl/ssl.h | 10 +++++----- ssl/handshake_server.cc | 3 +-- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index c107cbd54..5cfaae9de 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h @@ -3794,12 +3794,12 @@ OPENSSL_EXPORT void SSL_set_ignore_tls13_downgrade(SSL *ssl, int ignore); // mechanism would have aborted |ssl|'s handshake and zero otherwise. OPENSSL_EXPORT int SSL_is_tls13_downgrade(const SSL *ssl); -// SSL_set_jdk11_workaround configures whether to workaround a bug in JDK 11's -// TLS 1.3 implementation. Prior to 11.0.2, JDK 11 fails to send SNI in -// connections which offer a TLS 1.3 session. Enabling this workaround will -// disable TLS 1.3 on such clients. +// SSL_set_jdk11_workaround configures whether to workaround various bugs in +// JDK 11's TLS 1.3 implementation by disabling TLS 1.3 for such clients. // -// See also https://bugs.openjdk.java.net/browse/JDK-8211806. +// https://bugs.openjdk.java.net/browse/JDK-8211806 +// https://bugs.openjdk.java.net/browse/JDK-8212885 +// https://bugs.openjdk.java.net/browse/JDK-8213202 OPENSSL_EXPORT void SSL_set_jdk11_workaround(SSL *ssl, int enable); diff --git a/ssl/handshake_server.cc b/ssl/handshake_server.cc index 15ba2b083..cb4e9d1f7 100644 --- a/ssl/handshake_server.cc +++ b/ssl/handshake_server.cc @@ -402,8 +402,7 @@ static enum ssl_hs_wait_t do_start_accept(SSL_HANDSHAKE *hs) { } // is_probably_jdk11_with_tls13 returns whether |client_hello| was probably sent -// from a JDK 11 client (11.0.1 or earlier) with both TLS 1.3 and a prior -// version enabled. +// from a JDK 11 client with both TLS 1.3 and a prior version enabled. static bool is_probably_jdk11_with_tls13(const SSL_CLIENT_HELLO *client_hello) { // JDK 11 ClientHellos contain a number of unusual properties which should // limit false positives.