Implement JDK PQC availability detection (5.1 backport of #6244) - #6347
Open
jnbdz wants to merge 1 commit into
Open
Implement JDK PQC availability detection (5.1 backport of #6244)#6347jnbdz wants to merge 1 commit into
jnbdz wants to merge 1 commit into
Conversation
Backport of eclipse-vertx#6244. The 5.1 branch received the JDK 21 implementation of JdkDependent.isPqcAvailable() with eclipse-vertx#6337, but JdkSSLEngineOptions .isPqcAvailable() still returns false unconditionally, so the STRICT and CLIENT_NEGOTIATED enforcement policies refuse to start on the JDK engine even when the JDK supports a PQ-compliant named group. Delegate to JdkDependent as master does, and add the base implementation for JDKs before 21.
Member
|
@anavarr ping |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #6244 to
5.1.5.1received the JDK 21 implementation ofJdkDependent.isPqcAvailable()with #6337, butJdkSSLEngineOptions.isPqcAvailable()on that branch still returnsfalseunconditionally (// Todo: implement it when JDK add supports), soSTRICTandCLIENT_NEGOTIATEDrefuse to start on the JDK engine even when the JDK supports a PQ-compliant named group.master(#6244) and4.x(#6245) have the delegation;5.1does not.This is the same two-file change as #6244:
JdkSSLEngineOptions.isPqcAvailable()delegates toJdkDependent.isPqcAvailable(), and the base (pre-21)JdkDependentgets thefalseimplementation. The JDK 21 detection and theHybridKeyExchangeTestchanges are already on5.1.Verified with a Quarkus application using the packaged
vertx-core5.1.8-SNAPSHOT from this branch, on a JDK 25.0.5 EA build whereX25519MLKEM768is a default named group (openssl s_client -tls1_3 -groups ...as the client):STRICTNegotiated TLS1.3 group: X25519MLKEM768CLIENT_NEGOTIATEDX25519MLKEM768STRICTX25519MLKEM768STRICTHybridKeyExchangeTestpasses on JDK 21 and on the 25.0.5 EA (in-tree it runs againsttarget/classes, where the baseJdkDependentapplies, so its JDK cases are skipped there; the table above is what exercises the multi-release path).