<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "Menlo"), DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: 0.875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px;
}
body {
font-family: var(--default-regular-font, -apple-system),BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px; font-family: var(--default-regular-font, -apple-system),BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">
<p style="color: #777777;">
<a href="https://gitlab.com/codesquid">Tim Kosse</a>
<a href="https://gitlab.com/gnutls/gnutls/-/issues/1451#note_1265730817">commented</a>:
</p>
<div class="md" style="color: #333238; word-wrap: break-word;">
<p dir="auto" style="color: #333238; margin: 0 0 16px;" align="initial">TLS 1.3 has changed how close_notify works, now allowing half-closed connections that are only closed in one direction, whereas previously the recipient of close_notify had to immediately reply with a close_notify on its own resulting in a duplex close.</p>
<p dir="auto" style="color: #333238; margin: 0 0 16px;" align="initial">As existing applications might rely on the previous behavior, the OpenJDK developers try to emulate the previous behavior in TLS 1.3 through use of the user_canceled alert, intending to force a duplex close in TLS 1.3</p>
<p dir="auto" style="color: #333238; margin: 0 0 16px;" align="initial">This non-standard use of user_canceled by OpenJDK as part of the normal connection shutdown obviously causes compatibility issues, depending on how other TLS libraries and the applications using them process and react to alerts. In particular, RFC 8446 explicitly states that post-handshake, user_canceled can be used "If a user cancels an operation", which is clearly at odds with OpenJDK's use of the alert.</p>
<p dir="auto" style="color: #333238; margin: 0;" align="initial">I only see one viable solution: OpenJDK needs to get rid of the user_canceled workaround entirely. If TLS 1.3 breaking existing applications expecting TLS 1.2 behavior wrt. close_notify is a major concern, they could for example make TLS 1.3 an opt-in feature instead.</p>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #737278;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/issues/1451#note_1265730817">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.com">gitlab.com</a>. <a href="https://gitlab.com/-/sent_notifications/d3eb29dfd95a077165344ccfe02d8533/unsubscribe" target="_blank" rel="noopener noreferrer">Unsubscribe</a> from this thread · <a href="https://gitlab.com/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.com/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/-/issues/1451#note_1265730817"}}</script>
</p>
</div>
</body>
</html>