8311546: Certificate name constraints improperly validated with leading period #16295
Conversation
|
👋 Welcome back blperez01! A progress list of the required criteria for merging this PR into |
|
@blperez01 The following label will be automatically applied to this pull request:
When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command. |
Webrevs
|
There was a problem hiding this comment.
On line 203, can you modify the comment to:
-
RFC 5280: For DNS names, restrictions MUST use the dNSName syntax in
Section 4.2.1.6.This matches the new text in the errata (https://www.rfc-editor.org/errata/eid5997).
Also, you can remove the comments on lines 208-213 as they are duplicates.
| * questions. | ||
| */ | ||
|
|
||
| /* @test |
| TrustAnchor anchor; | ||
| anchor = new TrustAnchor((X509Certificate) selfSignedCert, null); |
There was a problem hiding this comment.
You can combine these two lines.
| // disable OCSP checker | ||
| Security.setProperty("ocsp.enable", "false"); |
There was a problem hiding this comment.
You should not need to set this property if revocation is disabled.
| System.setProperty("com.sun.security.enableCRLDP", "false"); | ||
|
|
There was a problem hiding this comment.
You should not need to set this property if revocation is disabled.
There was a problem hiding this comment.
You may have missed this comment, you can also remove lines 77-78.
| targetFromCAWithoutPeriod); | ||
| try { | ||
| validator.validate(pathWithoutLeadingPeriod, paramsForCAWithoutLeadingPeriod); | ||
| } catch (CertPathValidatorException uoe) { |
There was a problem hiding this comment.
You don't need try/catch here since main throws Exception this will just get propagated upwards. Same comment on line 122.
| Certificate ca = cf.generateCertificate(is); | ||
|
|
||
| // generate certification path | ||
| List<Certificate> list = Arrays.asList(targetCert, ca); |
There was a problem hiding this comment.
Probably simpler to use List.of(targetCert, ca) here.
|
@blperez01 This change now passes all automated pre-integration checks. ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details. After integration, the commit message for the final commit will be: You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed. At the time when this comment was updated there had been 140 new commits pushed to the
As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details. As you do not have Committer status in this project an existing Committer must agree to sponsor your change. Possible candidates are the reviewers of this PR (@seanjmullan) but any other Committer may sponsor as well. ➡️ To flag this PR as ready for integration with the above commit message, type |
|
/integrate |
|
@blperez01 |
|
/sponsor |
|
Going to push as commit bfaf570.
Your commit was automatically rebased without conflicts. |
openjdk
bot
removed
ready
|
@seanjmullan @blperez01 Pushed as commit bfaf570. 💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored. |
2 participants
Updated the
constrainsmethod inDNSName.javato accept certificates with a leading period.Progress
Issue
Reviewers
Reviewing
Using
gitCheckout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/16295/head:pull/16295$ git checkout pull/16295Update a local copy of the PR:
$ git checkout pull/16295$ git pull https://git.openjdk.org/jdk.git pull/16295/headUsing Skara CLI tools
Checkout this PR locally:
$ git pr checkout 16295View PR using the GUI difftool:
$ git pr show -t 16295Using diff file
Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/16295.diff
Webrev
Link to Webrev Comment