You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@hc.apache.org by Oleg Kalnichevski <ol...@apache.org> on 2018/10/22 17:00:52 UTC
TLS v1.3 breaks hostname verification in HttpClient; Re: Client
beta is next?
On Mon, 2018-10-22 at 09:43 -0600, Gary Gregory wrote:
> HI All:
>
> Now that we are out of the woods with HttpCore beta5, are we ready
> for the
> next HttpClient beta? If not, what's left to do?
>
> Gary
HttpClient 5.0-beta2 is pretty much ready but the trouble is that TLS
v1.3 breaks hostname verification code in all HttpClient versions.
I described the problem in my message [1] to OneJDK security-dev list.
I am sorry I should have forwareded it to our dev list as well.
So far no response fron OpenJDK developers, which is very
disheartening.
We have three options going forward:
1. Ignore the problem and just state that HttpClient hostname
verification is currently not compatible with TLS v1.3 and Java 11
(unless one expcitly downgrades to TLS v1.2)
2. Take time to fix the problem properly. That might mean waiting
indefinitely on OpenJDK developers
3. Commit my ugly workaround [2] for now, proceed with the release and
fix the problem properly once we know how to do it.
Oleg
[1] http://mail.openjdk.java.net/pipermail/security-dev/2018-October/018540.html
[2] https://github.com/ok2c/httpclient/commit/6ca28be047a7a461c7814ee7e0f3e083158ee349
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: TLS v1.3 breaks hostname verification in HttpClient; Re: Client
beta is next?
Posted by Gary Gregory <ga...@gmail.com>.
On Wed, Oct 24, 2018 at 7:32 AM Oleg Kalnichevski <ol...@apache.org> wrote:
> On Wed, 2018-10-24 at 07:15 -0600, Gary Gregory wrote:
> > On Wed, Oct 24, 2018 at 2:15 AM Oleg Kalnichevski <ol...@apache.org>
> > wrote:
> >
>
> ...
>
> > >
> > > The current behavior of Java 11 TLS code has been deemed a defect
> > > and
> > > an issue has been raised to track its resolution
> > >
> > > https://bugs.openjdk.java.net/browse/JDK-8212885
> >
> >
> > Wow, good to know. We'll have to keep the workaround in until this
> > this
> > fixed and maybe for a long time it the fix only makes it in Java 12.
> >
>
> Is not Java 11 supposed to be a LTS version? I suspect this defect
> breaks every application out there that performs server certificate
> chain validation or analysis. We are likely to be among first to have
> been hit by it. I hope that should add some urgency to the resolution
> of the issue in Java 11.
>
Well, that's good I suppose. What I am hinting at is that our workaound
will need to live in the code as long as Java 11 is supported if not
longer... and if it fixed in Java 11.0.x, then do we keep the workaround
code or document that Java 11.0.x is required? I suppose we do not need to
worry about this until the fix is in.
Gary
> Oleg
>
> > Gary
> >
> > >
> > >
> > > Oleg
> > >
> > >
> > >
> > > -----------------------------------------------------------------
> > > ----
> > > To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
> > > For additional commands, e-mail: dev-help@hc.apache.org
> > >
> > >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
> For additional commands, e-mail: dev-help@hc.apache.org
>
>
Re: TLS v1.3 breaks hostname verification in HttpClient; Re: Client
beta is next?
Posted by Oleg Kalnichevski <ol...@apache.org>.
On Wed, 2018-10-24 at 07:15 -0600, Gary Gregory wrote:
> On Wed, Oct 24, 2018 at 2:15 AM Oleg Kalnichevski <ol...@apache.org>
> wrote:
>
...
> >
> > The current behavior of Java 11 TLS code has been deemed a defect
> > and
> > an issue has been raised to track its resolution
> >
> > https://bugs.openjdk.java.net/browse/JDK-8212885
>
>
> Wow, good to know. We'll have to keep the workaround in until this
> this
> fixed and maybe for a long time it the fix only makes it in Java 12.
>
Is not Java 11 supposed to be a LTS version? I suspect this defect
breaks every application out there that performs server certificate
chain validation or analysis. We are likely to be among first to have
been hit by it. I hope that should add some urgency to the resolution
of the issue in Java 11.
Oleg
> Gary
>
> >
> >
> > Oleg
> >
> >
> >
> > -----------------------------------------------------------------
> > ----
> > To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
> > For additional commands, e-mail: dev-help@hc.apache.org
> >
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: TLS v1.3 breaks hostname verification in HttpClient; Re: Client
beta is next?
Posted by Gary Gregory <ga...@gmail.com>.
On Wed, Oct 24, 2018 at 2:15 AM Oleg Kalnichevski <ol...@apache.org> wrote:
> On Mon, 2018-10-22 at 11:14 -0600, Gary Gregory wrote:
> > >
>
> ...
>
>
> > On Mon, Oct 22, 2018 at 11:00 AM Oleg Kalnichevski <ol...@apache.org>
> > wrote:
> >
> > I am OK with a workaround that is documented and includes your links.
> > It's
> > only been one day since you posted your message, so there is hope.
> > I say. release the next client beta and keep moving forward.
> >
> > Gary
> >
> >
>
> The current behavior of Java 11 TLS code has been deemed a defect and
> an issue has been raised to track its resolution
>
> https://bugs.openjdk.java.net/browse/JDK-8212885
Wow, good to know. We'll have to keep the workaround in until this this
fixed and maybe for a long time it the fix only makes it in Java 12.
Gary
>
>
> Oleg
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
> For additional commands, e-mail: dev-help@hc.apache.org
>
>
Re: TLS v1.3 breaks hostname verification in HttpClient; Re: Client
beta is next?
Posted by Oleg Kalnichevski <ol...@apache.org>.
On Mon, 2018-10-22 at 11:14 -0600, Gary Gregory wrote:
> >
...
> On Mon, Oct 22, 2018 at 11:00 AM Oleg Kalnichevski <ol...@apache.org>
> wrote:
>
> I am OK with a workaround that is documented and includes your links.
> It's
> only been one day since you posted your message, so there is hope.
> I say. release the next client beta and keep moving forward.
>
> Gary
>
>
The current behavior of Java 11 TLS code has been deemed a defect and
an issue has been raised to track its resolution
https://bugs.openjdk.java.net/browse/JDK-8212885
Oleg
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: TLS v1.3 breaks hostname verification in HttpClient; Re: Client
beta is next?
Posted by Gary Gregory <ga...@gmail.com>.
On Mon, Oct 22, 2018 at 11:00 AM Oleg Kalnichevski <ol...@apache.org> wrote:
> On Mon, 2018-10-22 at 09:43 -0600, Gary Gregory wrote:
> > HI All:
> >
> > Now that we are out of the woods with HttpCore beta5, are we ready
> > for the
> > next HttpClient beta? If not, what's left to do?
> >
> > Gary
>
> HttpClient 5.0-beta2 is pretty much ready but the trouble is that TLS
> v1.3 breaks hostname verification code in all HttpClient versions.
>
> I described the problem in my message [1] to OneJDK security-dev list.
>
> I am sorry I should have forwareded it to our dev list as well.
>
> So far no response fron OpenJDK developers, which is very
> disheartening.
>
> We have three options going forward:
>
> 1. Ignore the problem and just state that HttpClient hostname
> verification is currently not compatible with TLS v1.3 and Java 11
> (unless one expcitly downgrades to TLS v1.2)
>
> 2. Take time to fix the problem properly. That might mean waiting
> indefinitely on OpenJDK developers
>
> 3. Commit my ugly workaround [2] for now, proceed with the release and
> fix the problem properly once we know how to do it.
>
I am OK with a workaround that is documented and includes your links. It's
only been one day since you posted your message, so there is hope.
I say. release the next client beta and keep moving forward.
Gary
>
> Oleg
>
> [1]
> http://mail.openjdk.java.net/pipermail/security-dev/2018-October/018540.html
> [2]
> https://github.com/ok2c/httpclient/commit/6ca28be047a7a461c7814ee7e0f3e083158ee349
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
> For additional commands, e-mail: dev-help@hc.apache.org
>
>