8297955: LDAP CertStore should use LdapName and not String for DNs

[seanjmullan]

The LDAPCertStore implementation passes Distinguished Names in CRL and Certificate URLs as Strings to JNDI APIs such as LdapContext.getAttributes(String), which then treats them as CompositeNames. This causes issues with URLs that have DNs with forward slashes. These are rare but compliant with the LDAP URL format for DNs referenced by section 4.2.1.13 of RFC 5280. Instead, the implementation should be passing the DN to JNDI APIs as an LdapName, which parses the forward slash character as part of the DN. Unfortunately, LDAP referral URLs can not be converted to LdapNames, so we keep the current DN syntax checks (and disallow forward slashes) if there are referrals involved.

The current test/jdk/security/infra/java/security/cert/CertPathValidator/certification/ActalisCA.java can be used to test this fix as it contains a test certificate with an LDAP URL in the CRL Distribution Points with a forward slash in the Distinguished Name. Prior to the fix it was failing because of this bug, now it is passing. We also take this opportunity to update the test and replace expired test certificates with new ones.

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• Change must not contain extraneous whitespace
• Commit message must refer to an issue

Issue

• JDK-8297955: LDAP CertStore should use LdapName and not String for DNs

Reviewers

• Weijun Wang (@wangweij - Reviewer)
• Rajan Halade (@rhalade - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk pull/12730/head:pull/12730
$ git checkout pull/12730

Update a local copy of the PR:
$ git checkout pull/12730
$ git pull https://git.openjdk.org/jdk pull/12730/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 12730

View PR using the GUI difftool:
$ git pr show -t 12730

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/12730.diff

[bridgekeeper]

👋 Welcome back mullan! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

@seanjmullan The following labels will be automatically applied to this pull request:

• core-libs
• security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing lists. If you would like to change these labels, use the /label pull request command.

[mlbridge]

Webrevs

• 00: Full (da84c20a)

[openjdk]

@seanjmullan This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8297955: LDAP CertStore should use LdapName and not String for DNs

Reviewed-by: weijun, rhalade

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 130 new commits pushed to the master branch:

• f3abc40: 8302783: Improve CRC32C intrinsic with crypto pmull on AArch64
• 45d8a17: 8303405: fix @returnss typo in ReflectionFactory
• e7113dc: 8302495: update for deprecated sprintf for java.desktop
• 843d632: 8303442: Clean up w2k_lsa_auth linker parameters
• d4dcba0: 8303267: Prefer ArrayList to LinkedList in ConcurrentLocksPrinter
• 2c7d2c0: 8303411: JFR problem list entry for JDK-8247776 should be removed
• 0b63557: 8303039: Utilize coverageLevels.txt
• 32247c3: 8303476: Add the runtime version in the release file of a JDK image
• 0926d0c: 8302516: Do some cleanup of nsk/share/jdi/EventHandler.java
• b51ea42: 8303354: addCertificatesToKeystore in KeystoreImpl.m needs CFRelease call in early potential CHECK_NULL return
• ... and 120 more: https://git.openjdk.org/jdk/compare/db483a38a815f85bd9668749674b5f0f6e4b27b4...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

[seanjmullan]

/integrate

[openjdk]

Going to push as commit df9aad0.
Since your change was applied there have been 135 commits pushed to the master branch:

• d23a8bf: 8297753: AArch64: Add optimized rules for vector compare with zero on NEON
• 339ca88: 8303539: javadoc typos in Attr
• e1745bc: 8303473: Add implied {@code} in java.lang.invoke.MethodHandles
• c961a91: 8143900: OptimizeStringConcat has an opaque dependency on Integer.sizeTable field
• 35003b5: 8302830: AArch64: Fix the mismatch between cas.m4 and aarch64.ad
• f3abc40: 8302783: Improve CRC32C intrinsic with crypto pmull on AArch64
• 45d8a17: 8303405: fix @returnss typo in ReflectionFactory
• e7113dc: 8302495: update for deprecated sprintf for java.desktop
• 843d632: 8303442: Clean up w2k_lsa_auth linker parameters
• d4dcba0: 8303267: Prefer ArrayList to LinkedList in ConcurrentLocksPrinter
• ... and 125 more: https://git.openjdk.org/jdk/compare/db483a38a815f85bd9668749674b5f0f6e4b27b4...master

Your commit was automatically rebased without conflicts.

[openjdk]

@seanjmullan Pushed as commit df9aad0.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.