8044609: javax.net.debug options not working and documented as expected #18764

coffeys · 2024-04-12T15:56:24Z

The javax.net.debug TLS debug option is buggy since TLSv1.3 implementation was introduced many years ago.

Where "ssl" was previously a value to obtain all TLS debug traces (except network type dumps, verbose data), it now prints only a few lines for a standard client TLS connection.

The property parsing was also lax and allowed users to declare verbose logging options by themselves where the documentation stated that such verbose options were only meant to be used in conjunction with other TLS options :

        System.err.println("help           print the help messages");
        System.err.println("expand         expand debugging information");
        System.err.println();
        System.err.println("all            turn on all debugging");
        System.err.println("ssl            turn on ssl debugging");
        System.err.println();
        System.err.println("The following can be used with ssl:");
        System.err.println("\trecord       enable per-record tracing");
        System.err.println("\thandshake    print each handshake message");
        System.err.println("\tkeygen       print key generation data");
        System.err.println("\tsession      print session activity");
        System.err.println("\tdefaultctx   print default SSL initialization");
        System.err.println("\tsslctx       print SSLContext tracing");
        System.err.println("\tsessioncache print session cache tracing");
        System.err.println("\tkeymanager   print key manager tracing");
        System.err.println("\ttrustmanager print trust manager tracing");
        System.err.println("\tpluggability print pluggability tracing");
        System.err.println();
        System.err.println("\thandshake debugging can be widened with:");
        System.err.println("\tdata         hex dump of each handshake message");
        System.err.println("\tverbose      verbose handshake message printing");
        System.err.println();
        System.err.println("\trecord debugging can be widened with:");
        System.err.println("\tplaintext    hex dump of record plaintext");
        System.err.println("\tpacket       print raw SSL/TLS packets");

as part of this patch, I've also moved the log call to the more performant friendly System.Logger#log(java.lang.System.Logger.Level,java.util.function.Supplier) method.

the output has changed slightly with respect to that - less verbose

e.g. old style:

javax.net.ssl|DEBUG|10|main|2024-04-12 15:47:24.302 GMT|SSLSocketOutputRecord.java:261|WRITE: TLSv1.2 handshake, length = 70
javax.net.ssl|DEBUG|10|main|2024-04-12 15:47:24.302 GMT|SSLSocketOutputRecord.java:275|Raw write (
  0000: 16 03 03 00 46 10 00 00   42 41 04 90 84 B1 78 70  ....F...BA....xp
  0010: 08 E1 9B 40 AF 3C E7 81   2C 65 57 0C 81 C4 98 26  ...@.<..,eW....&
  0020: 98 5B 12 20 B8 9A C3 36   6B 7A 51 0E B7 AA 32 D0  .[. ...6kzQ...2.
  0030: 0D 82 36 56 3D 1C F0 EB   14 22 AF 2C 74 76 D7 86  ..6V=....".,tv..
  0040: 65 B6 21 31 72 BD 2A D7   A6 91 A4                 e.!1r.*....
)
javax.net.ssl|DEBUG|10|main|2024-04-12 15:47:24.310 GMT|ChangeCipherSpec.java:115|Produced ChangeCipherSpec message

e.g. new format:

javax.net.ssl|DEBUG|10|main|2024-04-12 15:47:46.440 GMT|SSLSocketOutputRecord.java:261|WRITE: TLSv1.2 handshake, length = 70
javax.net.ssl|DEBUG|10|main|2024-04-12 15:47:46.441 GMT|SSLSocketOutputRecord.java:275|Raw write:
  0000: 16 03 03 00 46 10 00 00   42 41 04 97 07 5E 48 78  ....F...BA...^Hx
  0010: EC AB 59 78 13 0B CD 79   B9 43 89 DF 36 07 38 54  ..Yx...y.C..6.8T
  0020: 2B E4 E7 D8 89 0B C0 D6   67 CB 4A 81 E9 E8 B7 50  +.......g.J....P
  0030: A1 F4 3C 71 3E 67 26 24   95 4E 59 4E B6 5A 94 32  ..<q>g&$.NYN.Z.2
  0040: AA AD C4 84 E2 28 71 B7   DB 43 E4                 .....(q..C.
javax.net.ssl|DEBUG|10|main|2024-04-12 15:47:46.447 GMT|ChangeCipherSpec.java:114|Produced ChangeCipherSpec message

note one line less per verbose entry and dropping of brackets around verbose output

new test case added to exercise javax.net.debug options including the use of the System.Logger option.

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Change requires CSR request JDK-8330987 to be approved
Commit message must refer to an issue

Issues

JDK-8044609: javax.net.debug options not working and documented as expected (Bug - P3)
JDK-8330987: javax.net.debug options not working and documented as expected (CSR)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/18764/head:pull/18764
$ git checkout pull/18764

Update a local copy of the PR:
$ git checkout pull/18764
$ git pull https://git.openjdk.org/jdk.git pull/18764/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 18764

View PR using the GUI difftool:
$ git pr show -t 18764

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/18764.diff

Using Webrev

Link to Webrev Comment

bridgekeeper · 2024-04-12T15:57:07Z

👋 Welcome back coffeys! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2024-04-12T17:09:50Z

❗ This change is not yet ready to be integrated.
See the Progress checklist in the description for automated requirements.

openjdk · 2024-04-12T17:11:32Z

@coffeys The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2024-04-12T17:13:54Z

Webrevs

…overage

coffeys · 2024-04-17T14:10:20Z

Tidied up the help menu output to capture current options
Changed logic to allow -Djavax.net.debug=ssl,handshake emit all ssl data (done today also)
Improved test case coverage

src/java.base/share/classes/sun/security/ssl/CertificateMessage.java

bridgekeeper · 2024-06-20T17:54:51Z

@coffeys This pull request has been inactive for more than 4 weeks and will be automatically closed if another 4 weeks passes without any activity. To avoid this, simply add a new comment to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration!

bridgekeeper · 2024-08-12T19:24:17Z

@coffeys This pull request has been inactive for more than 8 weeks and will now be automatically closed. If you would like to continue working on this pull request in the future, feel free to reopen it! This can be done using the /open pull request command.

src/java.base/share/classes/sun/security/ssl/SSLLogger.java

coffeys · 2024-09-04T09:40:25Z

/open

openjdk · 2024-09-04T09:41:30Z

@coffeys This pull request is now open

bridgekeeper · 2025-05-28T18:56:20Z

@coffeys This pull request has been inactive for more than 4 weeks and will be automatically closed if another 4 weeks passes without any activity. To avoid this, simply issue a /touch or /keepalive command to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration!

openjdk · 2025-06-05T16:41:15Z

@coffeys this pull request can not be integrated into master due to one or more merge conflicts. To resolve these merge conflicts and update this pull request you can run the following commands in the local repository for your personal fork:

git checkout 8044609-ssl
git fetch https://git.openjdk.org/jdk.git master
git merge FETCH_HEAD
# resolve conflicts and follow the instructions given by git merge
git commit -m "Merge master"
git push

bridgekeeper · 2025-06-25T20:14:08Z

@coffeys This pull request has been inactive for more than 8 weeks and will now be automatically closed. If you would like to continue working on this pull request in the future, feel free to reopen it! This can be done using the /open pull request command.

coffeys · 2025-06-26T07:04:57Z

/open

openjdk · 2025-06-26T07:05:38Z

@coffeys This pull request is now open

bridgekeeper · 2025-07-24T13:21:59Z

@coffeys This pull request has been inactive for more than 4 weeks and will be automatically closed if another 4 weeks passes without any activity. To avoid this, simply issue a /touch or /keepalive command to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration!

coffeys · 2025-07-24T14:49:33Z

Reminder on this one @bradfordwetmore

bradfordwetmore

Initial comments for current SSLLogger.

Continuing next week.

src/java.base/share/classes/sun/security/ssl/SSLLogger.java

coffeys

Thanks for initial comments Brad. I've taken them on board.

The sub-component parsing logic might have been needlessly complex. I've introduced a new isSubComponent field directly to the new Opt enum. That helps query components and simplify the code,

src/java.base/share/classes/sun/security/ssl/SSLLogger.java

bradfordwetmore

Next set of comments. Thanks for addressing the previous set!

src/java.base/share/classes/sun/security/ssl/SSLLogger.java

src/java.base/share/classes/sun/security/ssl/Alert.java

src/java.base/share/classes/sun/security/ssl/CertificateRequest.java

bradfordwetmore · 2025-09-02T00:23:34Z

src/java.base/share/classes/sun/security/ssl/ClientHello.java

-                    if (SSLLogger.isOn &&
-                            SSLLogger.isOn("ssl,handshake,verbose")) {
+                    if (SSLLogger.logging &&
+                            SSLLogger.isOn(SSLLogger.Opt.HANDSHAKE_VERBOSE)) {


Not your fault, but I'm not sure I like this as a verbose message.

In agreement. This sort of message strikes me as more in the HANDSHAKE category

Will I log a follow on JBS issue to have all call sites of Opt examined ?

coffeys

Thanks again for the review comments Brad. I've made comments and corrections where raised. New changes pushed.

src/java.base/share/classes/sun/security/ssl/SSLLogger.java

src/java.base/share/classes/sun/security/ssl/Alert.java

src/java.base/share/classes/sun/security/ssl/CertificateRequest.java

coffeys · 2025-09-02T14:30:20Z

src/java.base/share/classes/sun/security/ssl/ClientHello.java

-                    if (SSLLogger.isOn &&
-                            SSLLogger.isOn("ssl,handshake,verbose")) {
+                    if (SSLLogger.logging &&
+                            SSLLogger.isOn(SSLLogger.Opt.HANDSHAKE_VERBOSE)) {


In agreement. This sort of message strikes me as more in the HANDSHAKE category

Will I log a follow on JBS issue to have all call sites of Opt examined ?

bradfordwetmore

A couple more minor comments.

All copyrights look good. (Thanks.)

src/java.base/share/classes/sun/security/ssl/SSLLogger.java

coffeys

Thanks for comments Brad. All should be addressed.

src/java.base/share/classes/sun/security/ssl/SSLLogger.java

bridgekeeper · 2025-11-06T11:00:50Z

@coffeys This pull request has been inactive for more than 4 weeks and will be automatically closed if another 4 weeks passes without any activity. To avoid this, simply issue a /touch or /keepalive command to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration!

coffeys added 3 commits April 12, 2024 14:54

Initial commit

d87c974

remove file

c1a842f

Tighten up ssl parsing

bc0d610

openjdk bot changed the title ~~8044609~~ 8044609: javax.net.debug "ssl" options are not working and documented as expected. Apr 12, 2024

openjdk bot added the rfr Pull request is ready for review label Apr 12, 2024

openjdk bot added the security security-dev@openjdk.org label Apr 12, 2024

Allow ssl,<option> type syntax as currently done. Improve test case c…

277583c

…overage

openjdk bot added the csr Pull request needs approved CSR before integration label Apr 23, 2024

indentation

27178fb

mpdonova reviewed May 8, 2024

View reviewed changes

src/java.base/share/classes/sun/security/ssl/CertificateMessage.java Outdated Show resolved Hide resolved

coffeys changed the title ~~8044609: javax.net.debug "ssl" options are not working and documented as expected.~~ 8044609: javax.net.debug options not working and documented as expected May 8, 2024

coffeys added 3 commits May 21, 2024 09:34

Merge branch 'master' into 8044609-ssl

826ad29

all ssl mode only if ssl specified by itself

1c4250a

Merge branch 'master' into 8044609-ssl

a1003b9

Merge branch 'master' into 8044609-ssl

e7d42d4

bridgekeeper bot closed this Aug 12, 2024

bradfordwetmore reviewed Sep 4, 2024

View reviewed changes

src/java.base/share/classes/sun/security/ssl/SSLLogger.java Outdated Show resolved Hide resolved

coffeys added 2 commits September 4, 2024 08:15

Merge branch 'master' into 8044609-ssl

902453c

Remove pluggability help reference

4effe97

openjdk bot reopened this Sep 4, 2024

update test to comply with new debug output requirements

32ec47b

graalvmbot mentioned this pull request Apr 30, 2025

[JDK-8355981] Adapt JDK-8044609: javax.net.debug options not working and documented as expected oracle/graal#11108

Open

openjdk bot added the merge-conflict Pull request has merge conflict with target branch label Jun 5, 2025

bridgekeeper bot closed this Jun 25, 2025

openjdk bot reopened this Jun 26, 2025

Merge branch 'master' into 8044609-ssl

9d6bbfd

openjdk bot removed the merge-conflict Pull request has merge conflict with target branch label Jun 26, 2025

Merge branch 'master' into 8044609-ssl

5da3c6c

coffeys added 3 commits August 11, 2025 15:14

Merge branch 'master' into 8044609-ssl

3116f43

1 file omitted during merge

c8ebaf6

Merge branch 'master' into 8044609-ssl

71aa021

bradfordwetmore reviewed Aug 30, 2025

View reviewed changes

Initial review comments from Brad

9399ee2

coffeys commented Sep 1, 2025

View reviewed changes

src/java.base/share/classes/sun/security/ssl/SSLLogger.java Outdated Show resolved Hide resolved

src/java.base/share/classes/sun/security/ssl/SSLLogger.java Show resolved Hide resolved

bradfordwetmore reviewed Sep 2, 2025

View reviewed changes

Further review comments, copyright years also

ba4b1b2

coffeys commented Sep 2, 2025

View reviewed changes

bradfordwetmore reviewed Sep 12, 2025

View reviewed changes

coffeys added 2 commits September 16, 2025 10:53

Merge branch 'master' into 8044609-ssl

c21bca3

Incorporate review comments from Brad

f94c4e7

coffeys commented Sep 16, 2025

View reviewed changes

coffeys added 2 commits September 24, 2025 13:33

Merge branch 'master' into 8044609-ssl

4d4af43

Merge branch 'master' into 8044609-ssl

53f9d75

8044609: javax.net.debug options not working and documented as expected #18764

Are you sure you want to change the base?

8044609: javax.net.debug options not working and documented as expected #18764

Conversation

coffeys commented Apr 12, 2024 • edited by openjdk bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Progress

Issues

Reviewing

Uh oh!

bridgekeeper bot commented Apr 12, 2024

Uh oh!

openjdk bot commented Apr 12, 2024

Uh oh!

openjdk bot commented Apr 12, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mlbridge bot commented Apr 12, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

coffeys commented Apr 17, 2024 • edited by bridgekeeper bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

bridgekeeper bot commented Jun 20, 2024

Uh oh!

bridgekeeper bot commented Aug 12, 2024

Uh oh!

Uh oh!

coffeys commented Sep 4, 2024 • edited by bridgekeeper bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openjdk bot commented Sep 4, 2024

Uh oh!

bridgekeeper bot commented May 28, 2025

Uh oh!

openjdk bot commented Jun 5, 2025

Uh oh!

bridgekeeper bot commented Jun 25, 2025

Uh oh!

coffeys commented Jun 26, 2025

Uh oh!

openjdk bot commented Jun 26, 2025

Uh oh!

bridgekeeper bot commented Jul 24, 2025

Uh oh!

coffeys commented Jul 24, 2025

Uh oh!

bradfordwetmore left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coffeys left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

bradfordwetmore left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bradfordwetmore Sep 2, 2025

Choose a reason for hiding this comment

Uh oh!

coffeys commented Apr 12, 2024 •

edited by openjdk bot

Loading

openjdk bot commented Apr 12, 2024 •

edited

Loading

mlbridge bot commented Apr 12, 2024 •

edited

Loading

coffeys commented Apr 17, 2024 •

edited by bridgekeeper bot

Loading

coffeys commented Sep 4, 2024 •

edited by bridgekeeper bot

Loading