8179502: Enhance OCSP, CRL and Certificate Fetch Timeouts by jnimeh · Pull Request #13762 · openjdk/jdk

jnimeh · 2023-05-02T21:12:31Z

This set of enhancements extends the allowed syntax for the com.sun.security.ocsp.timeout, com.sun.security.crl.timeout and com.sun.security.crl.readtimeout System properties. These properties retain their current behavior where a purely numeric value is interpreted in seconds, but now the numeric value may also be appended with "ms" (case-insensitive) to be interpreted as milliseconds.

This enhancement also adds two new System properties: com.sun.security.cert.timeout and com.sun.security.cert.readtimeout which follow the same new allowed syntax. These timeouts only come into play when an AIA extension on a certificate is followed for pulling the issuing authority certificate and only when the com.sun.security.enableAIAcaIssuers property is true (default false).

JBS: https://bugs.openjdk.org/browse/JDK-8179502
CSR: https://bugs.openjdk.org/browse/JDK-8300722

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue
Change requires CSR request JDK-8300722 to be approved

Issues

JDK-8179502: Enhance OCSP, CRL and Certificate Fetch Timeouts
JDK-8300722: Enhance OCSP, CRL and Certificate Fetch Timeouts (CSR)

Reviewers

Sean Mullan (@seanjmullan - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/13762/head:pull/13762
$ git checkout pull/13762

Update a local copy of the PR:
$ git checkout pull/13762
$ git pull https://git.openjdk.org/jdk.git pull/13762/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 13762

View PR using the GUI difftool:
$ git pr show -t 13762

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/13762.diff

Webrev

Link to Webrev Comment

jnimeh · 2023-05-02T21:13:28Z

/issue 8179502

jnimeh · 2023-05-02T21:13:40Z

/csr needed

bridgekeeper · 2023-05-02T21:14:07Z

👋 Welcome back jnimeh! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2023-05-02T21:16:40Z

@jnimeh This issue is referenced in the PR title - it will now be updated.

openjdk · 2023-05-02T21:17:02Z

@jnimeh an approved CSR request is already required for this pull request.

openjdk · 2023-05-02T21:19:01Z

@jnimeh The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2023-05-02T21:55:18Z

Webrevs

wangweij · 2023-05-02T22:33:47Z

src/java.base/share/classes/sun/security/action/GetPropertyAction.java

+        }
+
+        // Determine if "ms" is on the end of the string
+        boolean isMillis = propVal.toLowerCase().endsWith("ms");


Shall we allow the s suffix as well? This makes it clear that a value is in seconds.

Well, all the existing documentation already states that they are in seconds. That was why I didn't add any additional suffixes. The goal was to make it so folks don't need to make any changes if the existing seconds-level granularity is sufficient for them.

I don't mean not to support bare numbers. It's just a little unfair that millisecond has a suffix but second does not. We can support all of "1", "1s", and "1000ms".

Okay, we can make that change.

seanjmullan · 2023-05-09T14:59:36Z

I think you should also apply the cert and CRL timeouts to the LDAPCertStore implementation, using the JNDI properties: com.sun.jndi.ldap.connect.timeout and com.sun.jndi.ldap.read.timeout.

seanjmullan · 2023-05-09T15:01:29Z

src/java.base/share/classes/sun/security/provider/certpath/OCSP.java

I see there is no way to individually control the OCSP read and connect timeouts like there is for certs and CRLs. Perhaps this isn't as big an issue, but when you set the OCSP timeout, it really means 2x what you set.

Yes, I noticed that too. I wasn't sure if we needed to make a change there. I opted to leave well-enough alone since nobody was asking for it and it's one less property to keep track of. All of these property sets end up with a max latency of connect-timeout + read-timeout, and by default they are set to the same values. So in practice much of the time they are all 2x.

It's easy enough I think to make a separate property for com.sun.security.ocsp.readtimeout and then the existing .timeout property would be for connect timeouts (keeping in line with the other props). I don't think it will introduce significant risk but I will highlight that in the CSR.

I think you should also apply the cert and CRL timeouts to the LDAPCertStore implementation, using the JNDI properties: com.sun.jndi.ldap.connect.timeout and com.sun.jndi.ldap.read.timeout.

I will look into this.

I've added the OCSP readtimeout property, seems to be working well. As discussed offline we'll hold off on the LDAP changes for now.

seanjmullan · 2023-05-22T15:58:14Z

src/java.base/share/classes/sun/security/action/GetPropertyAction.java

+            def = 0;
+        }
+
+        String propVal = System.getProperty(prop, "").trim();


You should call privilegedGetProperty here instead of System.getProperty so the call is wrapped in doPrivileged when an SM is active.

Good catch. Will fix.

seanjmullan · 2023-05-22T15:59:07Z

src/java.base/share/classes/sun/security/action/GetPropertyAction.java

+
+        // Next check to make sure the string is built only from digits
+        if (propVal.matches("^\\d+$")) {
+            int timeout = Integer.parseInt(propVal);


Is this guaranteed never to throw NumberFormatException? It might be safer to catch it just in case.

I'll change this to catch NFE, but I'm pretty sure the pattern will only ever return true if the string is comprised solely of digits from start to end - I could never get a string that would pass when it shouldn't. But point taken, better safe than sorry.

jnimeh · 2023-05-22T17:27:45Z

@seanjmullan if you have a chance would you mind taking a quick look at the release note for this change? (https://bugs.openjdk.org/browse/JDK-8308582)
It is pretty close to the CSR solution text, but I tried to trim it down a little. It's still pretty long, but there's a lot to convey.

seanjmullan · 2023-05-22T17:17:26Z

src/java.base/share/classes/sun/security/action/GetPropertyAction.java

+                if (dbg != null) {
+                    dbg.println("Warning: Unexpected " + nfe +
+                            " for timeout value " + propVal +
+                            ". Using default value of " + def + " msec.");
+                }


This would also be useful debug for the else case on line 214-216 if the value is not an integer.

Sounds good, I can add that.

seanjmullan · 2023-05-22T17:24:10Z

src/java.base/share/classes/sun/security/provider/certpath/URICertStore.java

    // allowed when downloading CRLs
    private static final int DEFAULT_CRL_READ_TIMEOUT = 15000;

+    // Default connect and read timeouts for CA certificate fetching (15 sec)


Does 15 seconds make sense as the default timeout, especially for certs? CRLs are generally larger than certs, so a longer read timeout makes sense.

I'm ok with keeping these default values the same for consistency, but I think we should re-evaluate each of these default timeouts and compare them to other products/technologies to see if some adjustments may be needed - can you file a follow-on RFE for that?

Yes, I can make a follow on for that.

Filed https://bugs.openjdk.org/browse/JDK-8308601

seanjmullan

Looks good. I think there may be value in moving some of the test code into the testlibrary, like the AIA and CRL https servers so other tests can use it, but we can explore that more later if the opportunity arises.

openjdk · 2023-05-23T13:39:15Z

@jnimeh This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8179502: Enhance OCSP, CRL and Certificate Fetch Timeouts

Reviewed-by: mullan

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 18 new commits pushed to the master branch:

9e196b3: 8308565: HttpClient: Sanitize logging while stopping
582ddeb: 8308545: java/net/httpclient/ShutdownNow.java fails with "stream 1 cancelled"
1cfb265: 8307814: In the case of two methods with Record Patterns, the second one contains a line number from the first method
eb11508: 8308281: Java snippets in the FFM API need to be updated
26227a6: 8305073: Fix VerifyLoopOptimizations - step 2 - verify idom
80d7de7: 8305582: Compiler crash when compiling record patterns with var
e559613: 8308500: ZStatSubPhase::register_start should not call register_gc_phase_start if ZAbort::should_abort()
bdd2402: 8260943: C2 SuperWord: Remove dead vectorization optimization added by 8076284
4f0f776: 8308403: [s390x] separate remaining_cargs from z_abi_160
06b0a5e: 8302652: [SuperWord] Reduction should happen after loop, when possible
... and 8 more: https://git.openjdk.org/jdk/compare/8474e693b4404ba62927fe0e43e68b904d66fbde...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

jnimeh · 2023-05-23T21:31:29Z

/integrate

openjdk · 2023-05-23T21:32:37Z

Going to push as commit 2836c34.
Since your change was applied there have been 28 commits pushed to the master branch:

8ffa264: 8306698: Add overloads to MethodTypeDesc::of
6b27dad: 8301154: SunPKCS11 KeyStore deleteEntry results in dangling PrivateKey entries
ed0e956: 8308716: ProblemList java/util/concurrent/ScheduledThreadPoolExecutor/BasicCancelTest.java with genzgc on windows-x64
bddf483: 8303942: os::write should write completely
ab241b3: 8306706: Support out-of-line code generation for MachNodes
710453c: 8308016: Use snippets in java.io package
e9320f3: 8308116: jdk.test.lib.compiler.InMemoryJavaCompiler.compile does not close files
97d3b27: 8307523: [vectorapi] Optimize MaskFromLongBenchmark.java
bb0ff48: 8305091: Change ChaCha20 cipher init behavior to match AES-GCM
c0c4d77: 8308544: Fix compilation regression from JDK-8306983 on musl libc
... and 18 more: https://git.openjdk.org/jdk/compare/8474e693b4404ba62927fe0e43e68b904d66fbde...master

Your commit was automatically rebased without conflicts.

openjdk · 2023-05-23T21:32:51Z

@jnimeh Pushed as commit 2836c34.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

8179502: Enhance OCSP, CRL and Certificate Fetch Timeouts

3ab3b07

jnimeh marked this pull request as ready for review May 2, 2023 21:14

openjdk bot added the csr Pull request needs approved CSR before integration label May 2, 2023

openjdk bot added the security security-dev@openjdk.org label May 2, 2023

jnimeh added 2 commits May 2, 2023 14:47

Fix whitespace errors

e05292f

Fix more whitespace errors

3e0f582

openjdk bot added the rfr Pull request is ready for review label May 2, 2023

wangweij reviewed May 2, 2023

View reviewed changes

Add 's' suffix to allowed syntax

3c524e1

seanjmullan reviewed May 9, 2023

View reviewed changes

Add OCSP readtimeout property

81c7cb3

seanjmullan reviewed May 22, 2023

View reviewed changes

jnimeh added 2 commits May 22, 2023 09:54

Use privilegedGetProperty, catch NFE following string match

e73818e

Merge with main

ee24fdf

seanjmullan reviewed May 22, 2023

View reviewed changes

Add additional debug message in timeout property parser

659da85

openjdk bot removed the csr Pull request needs approved CSR before integration label May 23, 2023

seanjmullan approved these changes May 23, 2023

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label May 23, 2023

openjdk bot added the integrated Pull request has been integrated label May 23, 2023

openjdk bot closed this May 23, 2023

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels May 23, 2023

jnimeh deleted the JDK-8179502 branch December 12, 2023 19:27

Conversation

jnimeh commented May 2, 2023 • edited by openjdk bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Progress

Issues

Reviewers

Reviewing

Webrev

Uh oh!

jnimeh commented May 2, 2023

Uh oh!

jnimeh commented May 2, 2023

Uh oh!

bridgekeeper bot commented May 2, 2023

Uh oh!

openjdk bot commented May 2, 2023

Uh oh!

openjdk bot commented May 2, 2023

Uh oh!

openjdk bot commented May 2, 2023

Uh oh!

mlbridge bot commented May 2, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

seanjmullan commented May 9, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jnimeh May 22, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jnimeh commented May 22, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

seanjmullan left a comment

Choose a reason for hiding this comment

Uh oh!

openjdk bot commented May 23, 2023

Uh oh!

jnimeh commented May 23, 2023

Uh oh!

openjdk bot commented May 23, 2023

Uh oh!

openjdk bot commented May 23, 2023

Uh oh!

Reviewers

Assignees

Labels

Milestone

jnimeh commented May 2, 2023 •

edited by openjdk bot

Loading

mlbridge bot commented May 2, 2023 •

edited

Loading

jnimeh May 22, 2023 •

edited

Loading