1fb6c7e115
Motivation: This AE was seen in the wild at a non-negligible rate among AeroFS clients (JDK 8, TLS 1.2, mutual auth with RSA certs). Upon examination of SslHandler's code a few things became apparent: - the AE is unnecessary given the contract of decode() - the AE was introduced between 3.8 and 3.9 - the AE is no longer present in in 4.x and master - branches that do not have the AE skip all the bytes being fed to unwrap() It is not entirely clear what sequence of SSL records can trip the assert but it seems to happen before the handshake is completed. The little detailed data we've been able to gather shows the assert being triggered when - SSLEngine.unwrap returns NEED_WRAP - the remaining buffer is a TLS heartbeat record Likewise, it is not entirely clear if skipping the remaining bytes is the right thing to do or if they should be fed back to unwrap. Modifications: Mirror behavior in newer versions by removing the assert and skipping bytes fed to unwrap() Add logging in an effort to get a better understanding of this corner case. Result: Avoid crashes |
||
|---|---|---|
| .. | ||
| assembly | ||
| javadoc | ||
| main | ||
| site | ||
| test | ||