8331975: Enable case-insensitive check in ccache and keytab entry lookup #19216

wangweij · 2024-05-13T14:34:41Z

Add a new system property to control the name comparison in keytab and ccache entry lookup.

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue
Change requires CSR request JDK-8331976 to be approved

Issues

JDK-8331975: Enable case-insensitive check in ccache and keytab entry lookup (Enhancement - P4)
JDK-8331976: Enable case-insensitive check in ccache and keytab entry lookup (CSR)

Reviewers

@michael-o (no known openjdk.org user name / role) ⚠️ Review applies to f6ad0a8c
Mark Powers (@mcpowers - Committer) ⚠️ Review applies to f6ad0a8c
Valerie Peng (@valeriepeng - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/19216/head:pull/19216
$ git checkout pull/19216

Update a local copy of the PR:
$ git checkout pull/19216
$ git pull https://git.openjdk.org/jdk.git pull/19216/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 19216

View PR using the GUI difftool:
$ git pr show -t 19216

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/19216.diff

Webrev

Link to Webrev Comment

bridgekeeper · 2024-05-13T14:35:28Z

👋 Welcome back weijun! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2024-05-13T14:36:30Z

@wangweij This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8331975: Enable case-insensitive check in ccache and keytab entry lookup

Reviewed-by: mpowers, valeriep

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 142 new commits pushed to the master branch:

424eb60: 8331683: Clean up GetCarrierThread
9b1d6d6: 8316328: Test jdk/jfr/event/oldobject/TestSanityDefault.java times out for some heap sizes
f8a3e4e: 8328998: Encoding support for Intel APX extended general-purpose registers
ddd73b4: 8332082: Shenandoah: Use consistent tests to determine when pre-write barrier is active
0a9d1f8: 8332749: Broken link in MemorySegment.Scope.html
c9a7b97: 8332829: [BACKOUT] C2: crash in compiled code because of dependency on removed range check CastIIs
7fd9d6c: 8332340: Add JavacBench as a test case for CDS
417d174: 8331348: Some incremental builds deposit files in the make directory
303ac9f: 8332671: Logging for pretouching thread stacks shows wrong memory range
90758f6: 8332808: Always set java.io.tmpdir to a suitable value in the build
... and 132 more: https://git.openjdk.org/jdk/compare/1dac34fa757f1d603f0bc9b9c1994c114c276add...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

openjdk · 2024-05-13T14:37:04Z

@wangweij The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2024-05-13T14:40:38Z

Webrevs

mcpowers · 2024-05-20T15:44:37Z

src/java.security.jgss/share/classes/sun/security/krb5/PrincipalName.java

        //name type is just a hint, no two names can be the same ignoring name type.
        // if (this.nameType != pname.nameType) {
        //      matched = false;
        // }


Can this dead code be removed?

Maybe not. At least this will remind future maintainers not to add it back.

mcpowers

LGTM
Only have one comment about existing code.

mcpowers · 2024-05-20T16:11:35Z

Are there any existing interoperability tests?

wangweij · 2024-05-20T16:15:25Z

Are there any existing interoperability tests?

Not with real KDCs, but I can probably enhance the test to cover the case when this prop is not set.

michael-o · 2024-05-20T17:16:54Z

Are there any existing interoperability tests?

Not with real KDCs, but I can probably enhance the test to cover the case when this prop is not set.

I can only confirm that the default behavior works with Active Directory KDC.

valeriepeng · 2024-05-20T22:36:54Z

src/java.security.jgss/share/classes/sun/security/krb5/PrincipalName.java

     *
     * @param pname the other <code>PrincipalName</code> object.
     * @return true if two have identical values, otherwise, return false.
     */
-    // It is used in <code>sun.security.krb5.internal.ccache</code> package.
    public boolean match(PrincipalName pname) {
        boolean matched = true;
        //name type is just a hint, no two names can be the same ignoring name type.
        // if (this.nameType != pname.nameType) {
        //      matched = false;
        // }
        if ((this.nameRealm != null) && (pname.nameRealm != null)) {


isn't 'nameRealm' non-null? Is this check necessary? Having this check seems to imply their value may be null and it seems incomplete that there is no code handling the cases when one or both of them are null.

You're right. The realm field used to be nullable but it cannot be now. I'll fix it. Thanks.

valeriepeng

Changes look good to me. Thanks~

wangweij · 2024-05-21T18:04:36Z

Changes look good to me. Thanks~

Thanks a lot! Can you please also review the CSR?

wangweij · 2024-05-24T01:16:27Z

/integrate

openjdk · 2024-05-24T01:16:46Z

Going to push as commit da3001d.
Since your change was applied there have been 142 commits pushed to the master branch:

424eb60: 8331683: Clean up GetCarrierThread
9b1d6d6: 8316328: Test jdk/jfr/event/oldobject/TestSanityDefault.java times out for some heap sizes
f8a3e4e: 8328998: Encoding support for Intel APX extended general-purpose registers
ddd73b4: 8332082: Shenandoah: Use consistent tests to determine when pre-write barrier is active
0a9d1f8: 8332749: Broken link in MemorySegment.Scope.html
c9a7b97: 8332829: [BACKOUT] C2: crash in compiled code because of dependency on removed range check CastIIs
7fd9d6c: 8332340: Add JavacBench as a test case for CDS
417d174: 8331348: Some incremental builds deposit files in the make directory
303ac9f: 8332671: Logging for pretouching thread stacks shows wrong memory range
90758f6: 8332808: Always set java.io.tmpdir to a suitable value in the build
... and 132 more: https://git.openjdk.org/jdk/compare/1dac34fa757f1d603f0bc9b9c1994c114c276add...master

Your commit was automatically rebased without conflicts.

openjdk · 2024-05-24T01:16:53Z

@wangweij Pushed as commit da3001d.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

wangweij added 2 commits May 13, 2024 10:33

the commit

d795fcb

year

f6ad0a8

openjdk bot added csr Pull request needs approved CSR before integration rfr Pull request is ready for review labels May 13, 2024

openjdk bot added the security security-dev@openjdk.org label May 13, 2024

michael-o approved these changes May 20, 2024

View reviewed changes

mcpowers reviewed May 20, 2024

View reviewed changes

mcpowers approved these changes May 20, 2024

View reviewed changes

enhance test

1263ae1

valeriepeng reviewed May 20, 2024

View reviewed changes

wangweij added 2 commits May 20, 2024 19:17

fast fail and no need to check null

f0fdfd9

remove commented out code but leave comment

c74e645

valeriepeng approved these changes May 21, 2024

View reviewed changes

openjdk bot added ready Pull request is ready to be integrated and removed csr Pull request needs approved CSR before integration labels May 24, 2024

openjdk bot added the integrated Pull request has been integrated label May 24, 2024

openjdk bot closed this May 24, 2024

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels May 24, 2024

wangweij deleted the 8331975 branch May 24, 2024 01:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

8331975: Enable case-insensitive check in ccache and keytab entry lookup #19216

8331975: Enable case-insensitive check in ccache and keytab entry lookup #19216

wangweij commented May 13, 2024 •

edited by openjdk bot

bridgekeeper bot commented May 13, 2024

openjdk bot commented May 13, 2024 •

edited

openjdk bot commented May 13, 2024

mlbridge bot commented May 13, 2024 •

edited

mcpowers May 20, 2024

wangweij May 20, 2024

mcpowers left a comment

mcpowers commented May 20, 2024

wangweij commented May 20, 2024

michael-o commented May 20, 2024

valeriepeng May 20, 2024

wangweij May 20, 2024

valeriepeng left a comment

wangweij commented May 21, 2024

wangweij commented May 24, 2024

openjdk bot commented May 24, 2024

openjdk bot commented May 24, 2024

8331975: Enable case-insensitive check in ccache and keytab entry lookup #19216

8331975: Enable case-insensitive check in ccache and keytab entry lookup #19216

Conversation

wangweij commented May 13, 2024 • edited by openjdk bot

Progress

Issues

Reviewers

Reviewing

Webrev

bridgekeeper bot commented May 13, 2024

openjdk bot commented May 13, 2024 • edited

openjdk bot commented May 13, 2024

mlbridge bot commented May 13, 2024 • edited

Webrevs

mcpowers May 20, 2024

Choose a reason for hiding this comment

wangweij May 20, 2024

Choose a reason for hiding this comment

mcpowers left a comment

Choose a reason for hiding this comment

mcpowers commented May 20, 2024

wangweij commented May 20, 2024

michael-o commented May 20, 2024

valeriepeng May 20, 2024

Choose a reason for hiding this comment

wangweij May 20, 2024

Choose a reason for hiding this comment

valeriepeng left a comment

Choose a reason for hiding this comment

wangweij commented May 21, 2024

wangweij commented May 24, 2024

openjdk bot commented May 24, 2024

openjdk bot commented May 24, 2024

wangweij commented May 13, 2024 •

edited by openjdk bot

openjdk bot commented May 13, 2024 •

edited

mlbridge bot commented May 13, 2024 •

edited