8281236: (D)TLS key exchange named groups

[XueleiFan]

This update is to support key exchange named groups customization for individual (D)TLS connection. Please review the CSR as well:
CSR: https://bugs.openjdk.org/browse/JDK-8291950
RFE: https://bugs.openjdk.org/browse/JDK-8281236
Release-note: https://bugs.openjdk.org/browse/JDK-8291975

This is an effort similar to JDK-8280494: "(D)TLS signature schemes"

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• Change must not contain extraneous whitespace
• Commit message must refer to an issue
• Change requires a CSR request to be approved

Issues

• JDK-8281236: (D)TLS key exchange named groups
• JDK-8291950: (D)TLS key exchange named groups (CSR)

Reviewers

• Sean Mullan (@seanjmullan - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk pull/9776/head:pull/9776
$ git checkout pull/9776

Update a local copy of the PR:
$ git checkout pull/9776
$ git pull https://git.openjdk.org/jdk pull/9776/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 9776

View PR using the GUI difftool:
$ git pr show -t 9776

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/9776.diff

[bridgekeeper]

👋 Welcome back xuelei! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

@XueleiFan The following labels will be automatically applied to this pull request:

• net
• security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing lists. If you would like to change these labels, use the /label pull request command.

[XueleiFan]

/csr

[openjdk]

@XueleiFan has indicated that a compatibility and specification (CSR) request is needed for this pull request.

@XueleiFan this pull request must refer to an issue in JBS to be able to link it to a CSR request. To refer this pull request to an issue in JBS, please use the /issue command in a comment in this pull request.

[XueleiFan]

/issue add JDK-8281236

[openjdk]

@XueleiFan This issue is referenced in the PR title - it will now be updated.

[mlbridge]

Webrevs

• 04: Full - Incremental (21bf18be)
• 03: Full (2039c113)
• 02: Full (37c080bd)
• 01: Full - Incremental (d2b9999c)
• 00: Full (30697d04)

[bridgekeeper]

@XueleiFan This pull request has been inactive for more than 4 weeks and will be automatically closed if another 4 weeks passes without any activity. To avoid this, simply add a new comment to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration!

[XueleiFan]

Ping ...

[bridgekeeper]

@XueleiFan This pull request has been inactive for more than 4 weeks and will be automatically closed if another 4 weeks passes without any activity. To avoid this, simply add a new comment to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration!

[bridgekeeper]

@XueleiFan This pull request has been inactive for more than 8 weeks and will now be automatically closed. If you would like to continue working on this pull request in the future, feel free to reopen it! This can be done using the /open pull request command.

[XueleiFan]

Anyone has cycle for the review?

[XueleiFan]

/open

[openjdk]

@XueleiFan This pull request is now open

[mcpowers]

Well crafted. LGTM.

[XueleiFan]

Thank you very much, @mcpowers!

May I have the CSR reviewed? https://bugs.openjdk.org/browse/JDK-8291950. The new feature deadline is approaching. I appreciate if the CSR could be reviewed in 2 weeks.

[mcpowers]

I'll look at your CSR this morning. Make sure your SSLParameters additions look correct with JavaDoc. I always forget that step.

[XueleiFan]

I'll look at your CSR this morning. Make sure your SSLParameters additions look correct with JavaDoc. I always forget that step.

Thank you for the suggestion. I double checked the JavaDoc. It looks good to me.

Please feel free to add your name as reviewer in the CSR and approve this PR when you are ready.

[mcpowers]

Unfortunately, I only have author status and can only comment.

[XueleiFan]

Unfortunately, I only have author status and can only comment.

I think OpenJDK Author can approve as well. I just need to get another Reviewer approval before integration.

[seanjmullan]

Unfortunately, I only have author status and can only comment.

I think OpenJDK Author can approve as well. I just need to get another Reviewer approval before integration.

For a CSR, I believe that is true. But you will need a Reviewer for the PR, and they may have comments on parts that are covered by the CSR.

I would suggest moving the CSR to Proposed (which doesn't require a Reviewer AFAIK). That will move it forward a bit.

[XueleiFan]

Unfortunately, I only have author status and can only comment.

I think OpenJDK Author can approve as well. I just need to get another Reviewer approval before integration.

For a CSR, I believe that is true. But you will need a Reviewer for the PR, and they may have comments on parts that are covered by the CSR.

+1. An Author can comment as reviewed as well, for the credit and indicating his/her review has completed. But the reviewing is not a Review approval, and the system will not allow the integration unless there is a Reviewer approval.

I would suggest moving the CSR to Proposed (which doesn't require a Reviewer AFAIK). That will move it forward a bit.

I changed the CSR to Proposed. Thanks for the suggestion.

[XueleiFan]

@seanjmullan Did you have cycle to review this PR and CSR? This CSR is similar to the one we did for signature algorithms. I was wondering if it is possible to have it in JDK 20 so that more specific TLS benchmarks could be introduced sooner. Thanks!

[seanjmullan]

@seanjmullan Did you have cycle to review this PR and CSR? This CSR is similar to the one we did for signature algorithms. I was wondering if it is possible to have it in JDK 20 so that more specific TLS benchmarks could be introduced sooner. Thanks!

I added my name as Reviewer to the CSR, so you can finalize that, as that will give you a better chance of it being approved and getting this into JDK 20. It will take me a little while longer to review the code changes, though I don't expect it will impact the API.

[seanjmullan]

I have fetched your branch and will run it thru the tier1 and tier2 tests before approving.

[seanjmullan]

Test results are good.

[openjdk]

@XueleiFan This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8281236: (D)TLS key exchange named groups

Reviewed-by: mullan

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 177 new commits pushed to the master branch:

• 10356e7: 8298303: (fs) temporarily remove Path.getExtension
• 3b8c7ef: 8157023: Integrate NMT with JFR
• e86f31b: 8298301: C2: assert(main_cmp->in(2)->Opcode() == Op_Opaque1) failed: main loop has no opaque node?
• 8edb98d: 8165943: LineBreakMeasurer does not measure correctly if TextAttribute.TRACKING is set.
• 3934484: 8298205: Prefer Member Initialization Lists for JFR classes in os_perf.hpp
• 389b8f4: 8297298: SequenceInputStream should override transferTo
• dd7385d: 8298202: [AIX] Dead code elimination removed jfr constructor used by AIX
• 29f1c3c: 8298274: Problem list TestSPISigned on Windows
• 3de7750: 8298177: Various java.lang.invoke cleanups
• 6ed3683: 8297209: Serial: Refactor GenCollectedHeap::full_process_roots
• ... and 167 more: https://git.openjdk.org/jdk/compare/b778cd52b3fae013ecb21d90bcf940a4d947bd68...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

[XueleiFan]

/integrate

[openjdk]

Going to push as commit 5d4c71c.
Since your change was applied there have been 177 commits pushed to the master branch:

• 10356e7: 8298303: (fs) temporarily remove Path.getExtension
• 3b8c7ef: 8157023: Integrate NMT with JFR
• e86f31b: 8298301: C2: assert(main_cmp->in(2)->Opcode() == Op_Opaque1) failed: main loop has no opaque node?
• 8edb98d: 8165943: LineBreakMeasurer does not measure correctly if TextAttribute.TRACKING is set.
• 3934484: 8298205: Prefer Member Initialization Lists for JFR classes in os_perf.hpp
• 389b8f4: 8297298: SequenceInputStream should override transferTo
• dd7385d: 8298202: [AIX] Dead code elimination removed jfr constructor used by AIX
• 29f1c3c: 8298274: Problem list TestSPISigned on Windows
• 3de7750: 8298177: Various java.lang.invoke cleanups
• 6ed3683: 8297209: Serial: Refactor GenCollectedHeap::full_process_roots
• ... and 167 more: https://git.openjdk.org/jdk/compare/b778cd52b3fae013ecb21d90bcf940a4d947bd68...master

Your commit was automatically rebased without conflicts.

[openjdk]

@XueleiFan Pushed as commit 5d4c71c.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.