stan/jdk-24
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

8319670: Improve comments describing system properties for TLS server and client for max chain length

Browse Source 
Reviewed-by: mullan
This commit is contained in:
Hai-May Chao 2023-11-09 20:21:15 +00:00
parent 38745ecacd
commit a95062b39a
1 changed files with 24 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
src/java.base/share/classes/sun/security/ssl/SSLConfiguration.java
View File

@ -138,7 +138,10 @@ final class SSLConfiguration implements Cloneable {
static { static {
boolean globalPropSet = false; boolean globalPropSet = false;
// jdk.tls.maxCertificateChainLength property has no default /*
* jdk.tls.maxCertificateChainLength system property works for both
* server and client modes.
*/
Integer maxCertificateChainLength = GetIntegerAction.privilegedGetProperty( Integer maxCertificateChainLength = GetIntegerAction.privilegedGetProperty(
"jdk.tls.maxCertificateChainLength"); "jdk.tls.maxCertificateChainLength");
if (maxCertificateChainLength != null && maxCertificateChainLength >= 0) { if (maxCertificateChainLength != null && maxCertificateChainLength >= 0) {
@ -146,20 +149,15 @@ final class SSLConfiguration implements Cloneable {
} }
/* /*
* If either jdk.tls.server.maxInboundCertificateChainLength or * jdk.tls.server.maxInboundCertificateChainLength system property
* jdk.tls.client.maxInboundCertificateChainLength is set, it will * works in server mode.
* override jdk.tls.maxCertificateChainLength, regardless of whether * maxInboundClientCertChainLen is the maximum length of a client
* jdk.tls.maxCertificateChainLength is set or not. * certificate chain accepted by a server. It is determined as follows:
* If neither jdk.tls.server.maxInboundCertificateChainLength nor * - If the jdk.tls.server.maxInboundCertificateChainLength system
* jdk.tls.client.maxInboundCertificateChainLength is set, the behavior * property is set and its value >= 0, it uses that value.
* depends on the setting of jdk.tls.maxCertificateChainLength. If * - Otherwise, if the jdk.tls.maxCertificateChainLength system
* jdk.tls.maxCertificateChainLength is set, it falls back to that * property is set and its value >= 0, it uses that value.
* value; otherwise, it defaults to 8 for * - Otherwise it is set to a default value of 8.
* jdk.tls.server.maxInboundCertificateChainLength
* and 10 for jdk.tls.client.maxInboundCertificateChainLength.
* Users can independently set either
* jdk.tls.server.maxInboundCertificateChainLength or
* jdk.tls.client.maxInboundCertificateChainLength.
*/ */
Integer inboundClientLen = GetIntegerAction.privilegedGetProperty( Integer inboundClientLen = GetIntegerAction.privilegedGetProperty(
"jdk.tls.server.maxInboundCertificateChainLength"); "jdk.tls.server.maxInboundCertificateChainLength");
@ -172,6 +170,17 @@ final class SSLConfiguration implements Cloneable {
maxInboundClientCertChainLen = inboundClientLen; maxInboundClientCertChainLen = inboundClientLen;
} }
/*
* jdk.tls.client.maxInboundCertificateChainLength system property
* works in client mode.
* maxInboundServerCertChainLen is the maximum length of a server
* certificate chain accepted by a client. It is determined as follows:
* - If the jdk.tls.client.maxInboundCertificateChainLength system
* property is set and its value >= 0, it uses that value.
* - Otherwise, if the jdk.tls.maxCertificateChainLength system
* property is set and its value >= 0, it uses that value.
* - Otherwise it is set to a default value of 10.
*/
Integer inboundServerLen = GetIntegerAction.privilegedGetProperty( Integer inboundServerLen = GetIntegerAction.privilegedGetProperty(
"jdk.tls.client.maxInboundCertificateChainLength"); "jdk.tls.client.maxInboundCertificateChainLength");