8245527: LDAP Channel Binding support for Java GSS/Kerberos #278

alexeybakhtin · 2020-09-21T08:19:28Z

Hi,

Plaese review JDK-8245527 fix which implements LDAP Channel Binding support for Java GSS/Kerberos.
Initial review is available at core-devs: https://mail.openjdk.java.net/pipermail/core-libs-dev/2020-August/068197.html
This version removes "tls-unique" CB type from the list of possible channel binding types. The only supported type is "tls-server-end-point"

CSR is also updated : https://bugs.openjdk.java.net/browse/JDK-8247311

Thank you
Alexey

Progress

Change must not contain extraneous whitespace
Commit message must refer to an issue
Change must be properly reviewed

Issue

JDK-8245527: LDAP Channel Binding support for Java GSS/Kerberos

Reviewers

Daniel Fuchs (@dfuch - Reviewer)
Aleksei Efimov (@AlekseiEfimov - Committer)
mullan - Reviewer ⚠️ Added manually

Download

$ git fetch https://git.openjdk.java.net/jdk pull/278/head:pull/278
$ git checkout pull/278

bridgekeeper · 2020-09-21T08:21:32Z

👋 Welcome back abakhtin! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2020-09-21T08:22:16Z

@alexeybakhtin The following labels will be automatically applied to this pull request: core-libs security.

When this pull request is ready to be reviewed, an RFR email will be sent to the corresponding mailing lists. If you would like to change these labels, use the /label (add|remove) "label" command.

mlbridge · 2020-09-21T08:26:03Z

Webrevs

01: Full - Incremental (8b135f4)
00: Full (3f4ae08)

dfuch · 2020-09-22T14:26:26Z

Thanks for the PR Alexey! Let me run a last round of testing - and if that comes back clean I'll approve. Please don't integrate until you get a reviewer from security-libs too.

best regards,
-- daniel

dfuch · 2020-09-22T14:41:57Z

src/java.naming/share/classes/com/sun/jndi/ldap/Connection.java

@@ -972,4 +990,46 @@ public void run() {
        }
        return buf;
    }
+
+    private CompletableFuture<X509Certificate> tlsHandshakeCompleted =


Should be final?

Thank you. Agree. It should be final.

dfuch · 2020-09-22T14:47:35Z

src/java.naming/share/classes/com/sun/jndi/ldap/sasl/TlsChannelBinding.java

+        /**
+         * Channel binding on the basis of TLS Finished message
+         */
+        TLS_UNIQUE("tls-unique"),


Is that still used? If not maybe it should be removed?

No, It is not used.
However, I'd like to leave it as is (it is mentioned in the documentation as unsupported value).
Otherwise, TlsChannelBindingType enum will have one element only and should be simplified/removed in all places. In this case, it would be double work to add TlsChannelBindingType enum back in the future if "tls-unique" required.
If required I can remove TLS_UNIQUE item, but not remove TlsChannelBindingType enum

I was suggesting to keep TlsChannelBindingType but remove TLS_UNIQUE; However, I'm OK to keep things as is: this is an internal API. I wonder if it would deserve a comment:

/** * Channel binding on the basis of TLS Finished message */ // TLS_UNIQUE is defined by RFC 5929 but is not supported by the current LDAP stack. TLS_UNIQUE("tls-unique"),

Thank you. Added suggested comment.

wangweij

I'm mostly OK with the SASL/JGSS part, except for the small nits in this comment. I'm not an expert on HandshakeCompletedListener.

wangweij · 2020-09-22T15:11:57Z

src/jdk.security.jgss/share/classes/com/sun/security/sasl/gsskerb/GssKrb5Client.java

@@ -150,6 +151,14 @@
            }
            secCtx.requestMutualAuth(mutual);

+            if (props != null) {
+                // TLS Channel Binding
+                byte[] tlsCB = (byte[])props.get("jdk.internal.sasl.tlschannelbinding");


You can say the name is defined in another class in another module. If we really want to rename it one day we will know where it's from.

Thank you. Comment is added

wangweij · 2020-09-22T15:12:51Z

src/java.security.jgss/share/classes/sun/security/jgss/krb5/InitialToken.java

+                        CHANNEL_BINDING_AF_UNSPEC:CHANNEL_BINDING_AF_NULL_ADDR);
+        int acceptorAddressType = getAddrType(acceptorAddress,
+                (channelBinding instanceof TlsChannelBindingImpl)?
+                        CHANNEL_BINDING_AF_UNSPEC:CHANNEL_BINDING_AF_NULL_ADDR);


Normally we put a white space around "?" and ":".

Thank you. Fixed.

wangweij · 2020-09-22T15:16:10Z

src/java.naming/share/classes/com/sun/jndi/ldap/sasl/TlsChannelBinding.java

+
+    /**
+     * Parse value of "com.sun.jndi.ldap.tls.cbtype" property
+     * @param cbType


Please add a @return here, esp, about null.

Added @return with comments

wangweij · 2020-09-22T15:16:41Z

src/java.naming/share/classes/com/sun/jndi/ldap/sasl/TlsChannelBinding.java

+
+    public TlsChannelBindingType getType() {
+        return cbType;
+    }


Add a new line here.

openjdk · 2020-09-23T11:50:54Z

@alexeybakhtin This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for more details.

After integration, the commit message for the final commit will be:

8245527: LDAP Channel Binding support for Java GSS/Kerberos

Reviewed-by: dfuchs, aefimov, mullan

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 79 new commits pushed to the master branch:

37b7028: 8240556: Abort concurrent mark after effective eager reclamation of humongous objects
dcde95b: 8253586: C2: Clean up unused PhaseIterGVN::init_worklist()
0b83fc0: 8235710: Remove the legacy elliptic curves
8239b67: 8253322: Update the specification in the newly added constructors
24a4248: 8253615: Change to Visual Studio 2019 16.7.2 for building on Windows at Oracle
8b85c3a: 8251261: CDS dumping should not clear states in live classes
9ac162e: 8251999: remove usage of PropertyResolvingWrapper in vmTestbase/nsk/aod
527a309: 8252722: More Swing plaf APIs that rely on default constructors
3495c19: 8250855: Address reliance on default constructors in the Java 2D APIs
a9d0440: 8250859: Address reliance on default constructors in the Accessibility APIs
... and 69 more: https://git.openjdk.java.net/jdk/compare/52c28b869293c8639228ff32ec8f8615955fe39d...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

As you do not have Committer status in this project an existing Committer must agree to sponsor your change. Possible candidates are the reviewers of this PR (@wangweij, @dfuch, @AlekseiEfimov) but any other Committer may sponsor as well.

➡️ To flag this PR as ready for integration with the above commit message, type /integrate in a new comment. (Afterwards, your sponsor types /sponsor in a new comment to perform the integration).

AlekseiEfimov

Hi Alexey, The latest changes looks good to me.

dfuch · 2020-09-23T12:48:00Z

/csr

openjdk · 2020-09-23T12:49:04Z

@dfuch the issue for this pull request, JDK-8245527, already has an approved CSR request: JDK-8247311

alexeybakhtin · 2020-09-24T14:59:04Z

/reviewer credit mullan
/reviewer credit weijun
/integrate

openjdk · 2020-09-24T14:59:56Z

@alexeybakhtin
Reviewer mullan successfully credited.

openjdk · 2020-09-24T15:00:34Z

@alexeybakhtin Reviewer weijun has already made an authenticated review of this PR, and does not need to be credited manually.

openjdk · 2020-09-24T15:01:04Z

@alexeybakhtin
Your change (at version 8b135f4) is now ready to be sponsored by a Committer.

yan-too · 2020-09-25T07:25:00Z

/sponsor

openjdk · 2020-09-25T07:27:03Z

@yan-too @alexeybakhtin Since your change was applied there have been 79 commits pushed to the master branch:

37b7028: 8240556: Abort concurrent mark after effective eager reclamation of humongous objects
dcde95b: 8253586: C2: Clean up unused PhaseIterGVN::init_worklist()
0b83fc0: 8235710: Remove the legacy elliptic curves
8239b67: 8253322: Update the specification in the newly added constructors
24a4248: 8253615: Change to Visual Studio 2019 16.7.2 for building on Windows at Oracle
8b85c3a: 8251261: CDS dumping should not clear states in live classes
9ac162e: 8251999: remove usage of PropertyResolvingWrapper in vmTestbase/nsk/aod
527a309: 8252722: More Swing plaf APIs that rely on default constructors
3495c19: 8250855: Address reliance on default constructors in the Java 2D APIs
a9d0440: 8250859: Address reliance on default constructors in the Accessibility APIs
... and 69 more: https://git.openjdk.java.net/jdk/compare/52c28b869293c8639228ff32ec8f8615955fe39d...master

Your commit was automatically rebased without conflicts.

Pushed as commit cfa3f74.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

Neustradamus · 2022-08-01T16:25:03Z

@alexeybakhtin: It is official for TLS 1.3 Binding!

RFC 9266: Channel Bindings for TLS 1.3: https://tools.ietf.org/html/rfc9266

Details:

tls-unique for TLS =< 1.2
tls-exporter for TLS = 1.3

Can you look to add it?

Thanks in advance.

8245527: LDAP Channel Binding support for Java GSS/Kerberos

3f4ae08

openjdk bot added the rfr Pull request is ready for review label Sep 21, 2020

openjdk bot added security security-dev@openjdk.org core-libs core-libs-dev@openjdk.org labels Sep 21, 2020

dfuch reviewed Sep 22, 2020

View reviewed changes

wangweij reviewed Sep 22, 2020

View reviewed changes

8245527: version.01

8b135f4

dfuch approved these changes Sep 23, 2020

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Sep 23, 2020

AlekseiEfimov approved these changes Sep 23, 2020

View reviewed changes

openjdk bot added the sponsor Pull request is ready to be sponsored label Sep 24, 2020

openjdk bot closed this Sep 25, 2020

openjdk bot added integrated Pull request has been integrated and removed sponsor Pull request is ready to be sponsored ready Pull request is ready to be integrated rfr Pull request is ready for review labels Sep 25, 2020

8245527: LDAP Channel Binding support for Java GSS/Kerberos #278

8245527: LDAP Channel Binding support for Java GSS/Kerberos #278

alexeybakhtin commented Sep 21, 2020 •

edited by openjdk bot

bridgekeeper bot commented Sep 21, 2020

openjdk bot commented Sep 21, 2020

mlbridge bot commented Sep 21, 2020 •

edited

dfuch commented Sep 22, 2020

dfuch Sep 22, 2020

alexeybakhtin Sep 22, 2020

dfuch Sep 22, 2020

alexeybakhtin Sep 22, 2020

dfuch Sep 22, 2020 •

edited

alexeybakhtin Sep 22, 2020

wangweij left a comment

wangweij Sep 22, 2020

alexeybakhtin Sep 22, 2020

wangweij Sep 22, 2020

alexeybakhtin Sep 22, 2020

wangweij Sep 22, 2020

alexeybakhtin Sep 22, 2020

wangweij Sep 22, 2020

alexeybakhtin Sep 22, 2020

openjdk bot commented Sep 23, 2020 •

edited

AlekseiEfimov left a comment

dfuch commented Sep 23, 2020

openjdk bot commented Sep 23, 2020

alexeybakhtin commented Sep 24, 2020

openjdk bot commented Sep 24, 2020

openjdk bot commented Sep 24, 2020

openjdk bot commented Sep 24, 2020

yan-too commented Sep 25, 2020

openjdk bot commented Sep 25, 2020

Neustradamus commented Aug 1, 2022 •

edited by bridgekeeper bot

8245527: LDAP Channel Binding support for Java GSS/Kerberos #278

8245527: LDAP Channel Binding support for Java GSS/Kerberos #278

Conversation

alexeybakhtin commented Sep 21, 2020 • edited by openjdk bot

Progress

Issue

Reviewers

Download

bridgekeeper bot commented Sep 21, 2020

openjdk bot commented Sep 21, 2020

mlbridge bot commented Sep 21, 2020 • edited

Webrevs

dfuch commented Sep 22, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dfuch Sep 22, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wangweij left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

openjdk bot commented Sep 23, 2020 • edited

AlekseiEfimov left a comment

Choose a reason for hiding this comment

dfuch commented Sep 23, 2020

openjdk bot commented Sep 23, 2020

alexeybakhtin commented Sep 24, 2020

openjdk bot commented Sep 24, 2020

openjdk bot commented Sep 24, 2020

openjdk bot commented Sep 24, 2020

yan-too commented Sep 25, 2020

openjdk bot commented Sep 25, 2020

Neustradamus commented Aug 1, 2022 • edited by bridgekeeper bot

alexeybakhtin commented Sep 21, 2020 •

edited by openjdk bot

mlbridge bot commented Sep 21, 2020 •

edited

dfuch Sep 22, 2020 •

edited

openjdk bot commented Sep 23, 2020 •

edited

Neustradamus commented Aug 1, 2022 •

edited by bridgekeeper bot