This functionality will allow session engines to handle their own delayed tasks (e.g. engine controlled retransmissions)

No need to create all frames now. PADDING, PING, ACK, CRYPTO frames should be enough at this time.

Hello,

I have made a very quick test using the DLTS example classes provided in the project. Unfortunately I for some reason run into problems when I try to connect to a DTLSServer which is started on Java 15? If I switch the server to run on Java 13 it works as expected. I'm using the Liberica JDKs from Bellsoft (https://bell-sw.com/pages/downloads) .

Test 1:
Client (Java 15) -> Server (Java 15) : unsuccessful

Client log info:
[root@tool dtls]# jdk-15.0.2-full/bin/java -cp my.jar -Dorg.snf4j.Host=192.168.0.2 org.snf4j.example.dtls.DTLSClient
[INF] open
[ERR] javax.net.ssl.SSLHandshakeException: The Finished message cannot be verified.
[INF] closed

Test 2:
Client (Java 15) -> Server (Java 13) : SUCCESS - seems to work perfectly!

Find attached a capture file which includes both attempts (Test 1 in frame 1-23, Test 2 start in frame 24):
snf4j-test-java15-java13.zip

openjdk version "15.0.2" 2021-01-19
OpenJDK Runtime Environment (build 15.0.2+10)
OpenJDK 64-Bit Server VM (build 15.0.2+10, mixed mode, sharing)

openjdk version "13.0.2" 2020-01-15
OpenJDK Runtime Environment (build 13.0.2+9)
OpenJDK 64-Bit Server VM (build 13.0.2+9, mixed mode, sharing)

I appreciate all hints about how to resolve this issue.

Thanks, Gunnar

This functionality may be required by session engines that do not use the default retransmission functionality

Hello,

This is not really an issue, but a general question about which TLS extensions are supported by SNF4J (and Java), in particular the "heartbeat extension" (https://tools.ietf.org/html/rfc6520) .

I assume that the hearbeat extension is not necessarily available in the Java SSLEngine I'm using. Is there anyway I can see which extensions are supported in my environment? Can I somehow control which extensions should be enabled?

In the provided Wireshark trace the client includes the extension "heartbeat", but I don't really understand how I can enable this support also in the server (which is built on SNF4J).
dtls-heartbeat.zip

Any hint is much appreciated! :-)

Thanks, Gunnar

Hi,
I am wondering if DTLS is supported over SCTP in snf4j and if yes do you maybe have some example?

Thanks

This functionality can be required by other protocols that use TLS 1.3 handshake engine but prohibit the usage of the EndOfEarlyData handshake message (e.g. QUIC).

There will be a need to keep seperate AEAD encryptors/decryptors and header protectors for each of the encryption levels.

Both StreamSession and SSLSession are affected.

This functionality will help in extending the default TLS.1.3 specification by other specifications like QUIC.

For example:
Extending TLS1.3 AEAD by QUIC specific key limits and header protection algorithms

In some scenarios the default close operation (i.e. quickClose) is not good. For example when it is needed to send back a frame (e.g. close frame with an error code) to peer host on session's failure.

The methods returning minimum and maximum buffer sizes are now fully controlled by the SNF4J framework. Remove the note.

It needs to be forced as the SSLEngine (for TLS1.3) may still be in the NOT_HANDSHAKING state after closing the inbound.