JDK-8052406 : SSLv2Hello protocol may be filtered out unexpectedly
  • Type: Bug
  • Component: security-libs
  • Sub-Component: javax.net.ssl
  • Affected Version: 7u65
  • Priority: P3
  • Status: Closed
  • Resolution: Fixed
  • Submitted: 2014-07-29
  • Updated: 2016-03-14
  • Resolved: 2014-08-01
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 7 JDK 8 JDK 9
7u80Fixed 8u40Fixed 9 b26Fixed
Description

In server side,
 -Use SSLServerSocket class created in SSLServerSocketFactory
 -Cipher suite : TLS_RSA_WITH_AES_128_CBC_SHA256 is set to 
setEnabledCipherSuites()
 -Crypto protocol : Default value

In client side,
-Use SSLServerSocket class created in SSLServerSocketFactory
-Cipher suite : Set all the cipher suites by 
SSLSocket.getSupportedCipherSuites() to SSLSocket.setEnabledCipherSuites() 
-Crypto protocol :Set all the encrypto protocols by 
SSLSocket.getSupportedProtocols() to SSLSocket.setEnabledProtocols() 
-All the supported cipher suites and crypto protcols are enabled.

Then, The client and server try to communicate in SSL,
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure  
occurs.
Comments
The testcase could pass in nightly result: http://aurora.ru.oracle.com/functional/faces/RunDetails.xhtml?names=669066.CORELIBS-JDK-NIGHTLY-JTREG-16 Verified it.
26-12-2014
It's a bug of SunJSSE implementation.
30-07-2014
If only set "TLS_RSA_WITH_AES_128_CBC_SHA256" in server side, the SSLv2Hello is disabled improperly. However, in client side, as SSLv2Hello is enabled, the ClientHello request message would packaged in SSLv2Hello format. Server should not filter out SSLv2Hello if it is enabled. Workaround: did not enable SSLv2Hello in client side. In practice, it is not recommended to use SSLv2Hello any more.
30-07-2014