James Roper jroper

There is a bug in the Oracle JDK TLS implementation.

A server might have an existing SSL session that has no client authentication associated with it. For example, it might be a web server, and a client has accessed the index page. Authentication is not required for the index page, so the server hasn't requested it.

At some point in future, the user might attempt to access a secured area of the site. A typical use case might be that they click an authenticate button. If the server wants to use SSL client certificates to authenticate the user, then at this point the server can send a renegotiation request, asking for a client certificate.

Java SSL negotiation and renogotiation has two modes when it comes to requesting a client certificate, one is "want auth", and the other is "need auth". Want auth means that if the client doesn't provide a certificate, the session will continue, without any client certificates. Need auth means that if the client doesn't provide a certificate, the session will be termi

RFC7159 introduced a change to the RFC4627, as mentioned in Appendix A:

Changed the definition of "JSON text" so that it can be any JSON
  value, removing the constraint that it be an object or array.

This meant that the heuristic in Section 3 of RFC4627 was no longer valid:

Since the first two characters of a JSON text will always be ASCII
characters [RFC0020], it is possible to determine whether an octet

stream is UTF-8, UTF-16 (BE or LE), or UTF-32 (BE or LE) by looking

	import org.jboss.netty.buffer.ChannelBuffer;
	import org.jboss.netty.channel.*;
	import org.jboss.netty.handler.codec.http.*;

	import java.net.SocketAddress;
	import java.util.LinkedList;
	import java.util.concurrent.Callable;

	public class HttpPipeliningHandler implements ChannelUpstreamHandler, ChannelDownstreamHandler {

	class MyManagedResource extends ResourceController[String] {
	def index = Action(Ok("index"))

	def newScreen = Action(Ok("new"))

	def create = Action {
	Redirect(MyInjectableResource.reverseRoutes.index())
	}

	def show(id: String) = Action(Ok("Show " + id))

	import play.api.libs.iteratee.{Done, Iteratee, Enumerator}
	import play.api.mvc._
	import play.api._
	import play.api.libs.concurrent.Execution.Implicits._

	object Global extends GlobalSettings {

	override def onRouteRequest(req: RequestHeader) = {
	// Lookup handler
	super.onRouteRequest(req) match {

	Initial clean compile of entire project:
	[info] [info] Compiling 29 Scala sources and 1 Java source to /tmp/inc-compile/target/scala-2.10/classes...
	[info] [success] Total time: 15 s, completed Aug 28, 2013 9:43:38 PM

	Now simulate adding a method to a controller:
	[info] [info] Compiling 1 Scala source to /tmp/inc-compile/target/scala-2.10/classes...
	[info] [success] Total time: 2 s, completed Aug 28, 2013 9:43:40 PM

	Now simulate adding a new route to the routes file:
	[info] [info] Compiling 2 Scala sources and 1 Java source to /tmp/inc-compile/target/scala-2.10/classes...

	// Reads for recursive path
	def recursiveSearchReads[T : Reads](path: JsPath) = Reads[Seq[T]] { json =>
	path.apply(json).map(_.validate[T]).foldLeft[JsResult[Seq[T]]](JsSuccess(Nil)) {
	case (JsError(a), JsError(b)) => JsError(a ++ b)
	case (err: JsError, _) => err
	case (_, err: JsError) => err
	case (JsSuccess(ts, _), JsSuccess(t, _)) => JsSuccess(ts :+ t)
	}.repath(path)
	}

	import java.util.regex.Pattern
	import play.core.Routes
	import play.api.mvc._

	object Router extends Routes {

	def routes = {
	// Static paths
	case Route("GET", p"") => controllers.Application.index
	case Route("GET", p"/items") => controllers.Items.list

	/**
	* Provides a global (cross classloader) static var.
	*
	* Where might you use this? Anywhere where you want to be evil ;)
	*
	* But, my use case was in a dynamic classloading environment where you want to load a library that
	* depends on a native library. Only one classloader can ever load and link the classes associated
	* with the native library, so if a second classloader (for example if a dynamic reload was done)
	* wanted to use it to, it couldn't. This provided a cross classloader mechanism for storing the
	* classloader that loaded the native library.

	import play.api._
	import play.api.mvc._

	object Global extends GlobalSettings {

	override def onRequestReceived(header: RequestHeader): (RequestHeader, Handler) = {
	val rewritten = if (header.uri.startsWith("//")) {
	val newPath = header.uri.substring(1).replaceAll("\\?.*$", "")
	header.copy(path = newPath)
	} else {