Summary

Backport the JDK-8217633 enhancement to Oracle JDK 8u/11u releases. Propose to support TLS configurable extensions via introduction of implementation specific JDK system properties.

Problem

The TLS protocols are designed to tolerate unknown TLS extensions. However, although it is not common, there are a few TLS implementations that cannot handle unknown extensions properly. As a result, unexpected interoperability issues can arise when new extensions are introduced in JDK. The interoperability impact could be mitigated If applications can customize the extensions if needed.

Applications may not be able to update the source code. It is more convenient if applications can customize the default extensions with system properties.

Solution

Add two system properties to configure the default extensions in either client or server side of TLS connections. This is an identical port of the JDK 17 enhancement to JDK 8u/11u Oracle releases.

Specification

Two new implementation specific System Properties will be added. The System Property, "jdk.tls.client.disableExtensions", is used to disable extensions used in client side. The System Property, "jdk.tls.server.disableExtensions", is used to disable extensions used in server side. If an extension is disabled, it will be neither produced nor processed in the handshake messages.

The property string is a list of comma separated standard TLS extension names. The syntax of the property string can be described as this Java BNF-style:

DisableExtensions:
        ('"' TLSExtensionNames '"') | TLSExtensionNames 
TLSExtensionNames:
        TLSExtensionName { , TLSExtensionName }
TLSExtensionName:
        (see below)

The extension name, TLSExtensionName, is registered in the IANA documentation (for example, server_name, status_request and signature_algorithms_cert). Note that the extension names are case sensitive. Unknown/unsupported/misspelled/duplicated TLSExtensionName tokens will be ignored.

Note that previously we had introduced a few extension System Properties, for example "jsse.enableMFLNExtension" and "jsse.enableSNIExtension", to switch on/off TLS extensions. An extension will not be enabled if it is disabled, even it could be enabled by setting the corresponding extension System Property.

Documentation

The new System Properties will be described in the JSSE Reference Guide, and release noted.