Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TLS handshaking issues with Postgres #1897

Merged
merged 2 commits into from
Jun 11, 2020
Merged

Conversation

mpilquist
Copy link
Member

@mpilquist mpilquist commented Jun 11, 2020

Followup to #1896.

  • Update test for completed handshake to not use isValid on SSLSession. On JDK 1.8.0_192, after the handshake completes with postgres, engine.getSession.isValid returns false and engine.getSession.getId returns an empty array. Same program works fine on JDK 11. This was tricking TLSEngine.read in to thinking it needed to handshake again, ad infinitum. Switched to comparing cipher suite to SSL_NULL_WITH_NULL_NULL, which is the documented cipher suite prior to handshake completion.
  • Respect maxBytes on TLSSocket.read. This is needed b/c the sample program makes the correct assumption that calling socket.read(n) will return a chunk with <= n bytes, but TLSEngine was violating that.

Most of the diff is just passing maxBytes through the various calls.

Tested this on both JDK 1.8 and 11 using Rob's sample Postgres client.

@mpilquist mpilquist changed the title Respect maxBytes on TLSSocket.read TLS handshaking issues with Postgres Jun 11, 2020
Copy link
Member

@tpolecat tpolecat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SSL_NULL_WITH_NULL_NULL 👍 👍

@mpilquist mpilquist merged commit 92991bf into master Jun 11, 2020
@mpilquist mpilquist deleted the topic/tls-session-validity branch June 15, 2020 23:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants