8274205: Handle KDC_ERR_SVC_UNAVAILABLE error code from KDC #5658

alexeybakhtin · 2021-09-23T16:52:07Z

The code change handles KDC_ERR_SVC_UNAVAILABLE error code (29) received from KDC and resends the initial request to the next KDC in the list. It aligns error code handling with the MIT Kerberos implementation.
sun/security/krb5 tests passed

Progress

Change must not contain extraneous whitespace
Commit message must refer to an issue
Change must be properly reviewed

Issue

JDK-8274205: Handle KDC_ERR_SVC_UNAVAILABLE error code from KDC

Reviewers

Weijun Wang (@wangweij - Reviewer)

Contributors

Weijun Wang <weijun@openjdk.org>

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.java.net/jdk pull/5658/head:pull/5658
$ git checkout pull/5658

Update a local copy of the PR:
$ git checkout pull/5658
$ git pull https://git.openjdk.java.net/jdk pull/5658/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 5658

View PR using the GUI difftool:
$ git pr show -t 5658

Using diff file

Download this PR as a diff file:
https://git.openjdk.java.net/jdk/pull/5658.diff

bridgekeeper · 2021-09-23T16:53:12Z

👋 Welcome back abakhtin! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2021-09-23T16:56:57Z

@alexeybakhtin The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2021-09-23T17:02:09Z

Webrevs

01: Full - Incremental (96774140)
00: Full (6bf7dfc0)

wangweij · 2021-09-23T18:19:05Z

The code change looks fine to me. I'd like to contribute a regression test. Please wait while I am testing it.

wangweij · 2021-09-23T19:31:32Z

Here it is. Feel free to modify it.test/jdk/sun/security/krb5/auto/Unavailable.java:

/*
 * Copyright (c) 2021, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.
 *
 * This code is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * version 2 for more details (a copy is included in the LICENSE file that
 * accompanied this code).
 *
 * You should have received a copy of the GNU General Public License version
 * 2 along with this work; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 *
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 * or visit www.oracle.com if you need additional information or have any
 * questions.
 */

/*
 * @test
 * @bug 8274205
 * @summary Handle KDC_ERR_SVC_UNAVAILABLE error code from KDC
 * @library /test/lib
 * @compile -XDignore.symbol.file Unavailable.java
 * @run main jdk.test.lib.FileInstaller TestHosts TestHosts
 * @run main/othervm -Djdk.net.hosts.file=TestHosts Unavailable
 */

import sun.security.krb5.Config;
import sun.security.krb5.PrincipalName;
import sun.security.krb5.internal.KRBError;
import sun.security.krb5.internal.KerberosTime;

import java.nio.file.Files;
import java.nio.file.Path;
import java.util.Locale;

public class Unavailable {

    public static void main(String[] args) throws Exception {

        // Good KDC
        KDC kdc1 = KDC.create(OneKDC.REALM);
        kdc1.addPrincipal(OneKDC.USER, OneKDC.PASS);
        kdc1.addPrincipalRandKey("krbtgt/" + OneKDC.REALM);

        // The "not available" KDC
        KDC kdc2 = new KDC(OneKDC.REALM, "kdc." + OneKDC.REALM.toLowerCase(Locale.US), 0, true) {
            @Override
            protected byte[] processAsReq(byte[] in) throws Exception {
                KRBError err = new KRBError(null, null, null,
                        KerberosTime.now(), 0,
                        29, // KDC_ERR_SVC_UNAVAILABLE
                        null, new PrincipalName("krbtgt/" + OneKDC.REALM),
                        null, null);
                return err.asn1Encode();
            }
        };

        Files.write(Path.of(OneKDC.KRB5_CONF), String.format("""
                [libdefaults]
                default_realm = RABBIT.HOLE

                [realms]
                RABBIT.HOLE = {
                    kdc = kdc.rabbit.hole:%d
                    kdc = kdc.rabbit.hole:%d
                }
                """, kdc2.getPort(), kdc1.getPort()).getBytes());
        System.setProperty("java.security.krb5.conf", OneKDC.KRB5_CONF);
        Config.refresh();

        Context.fromUserPass(OneKDC.USER, OneKDC.PASS, false);
    }
}

alexeybakhtin · 2021-09-24T05:28:07Z

/contributor add @wangweij

openjdk · 2021-09-24T05:28:47Z

@alexeybakhtin
Contributor Weijun Wang <weijun@openjdk.org> successfully added.

alexeybakhtin · 2021-09-24T05:29:46Z

@wangweij Thank you a lot for the quick review and test

openjdk · 2021-09-24T11:26:06Z

@alexeybakhtin This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8274205: Handle KDC_ERR_SVC_UNAVAILABLE error code from KDC

Co-authored-by: Weijun Wang <weijun@openjdk.org>
Reviewed-by: weijun

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 35 new commits pushed to the master branch:

d91e227: 8238274: (sctp) JDK-7118373 is not fixed for SctpChannel
971aa35: 8274083: Update testing docs to mention tiered testing
1d44014: 8273034: Make javadoc navigation collapsible on small displays
bb74ae8: 8274171: java/nio/file/Files/probeContentType/Basic.java failed on "Content type" mismatches
56b8b35: 8273261: Replace 'while' cycles with iterator with enhanced-for in java.base
0aa63fe: 8274216: ProblemList 2 serviceability/dcmd/gc tests with ZGC on linux-all and windows-all
5ffbe75: 8274195: Doc cleanup in java.nio.file
1fdc656: 8274175: (fc) java/nio/channels/FileChannel/Transfer2GPlus.java still failed in timeout
3b1b8fc: 8269850: Most JDK releases report macOS version 12 as 10.16 instead of 12.0
1b7f4b7: 8274169: HotSpot Style Guide has stale link to chromium style guide
... and 25 more: https://git.openjdk.java.net/jdk/compare/aefd4ac4a336f00c067bcb91b95472ccc9a6bf83...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

As you do not have Committer status in this project an existing Committer must agree to sponsor your change. Possible candidates are the reviewers of this PR (@wangweij) but any other Committer may sponsor as well.

➡️ To flag this PR as ready for integration with the above commit message, type /integrate in a new comment. (Afterwards, your sponsor types /sponsor in a new comment to perform the integration).

alexeybakhtin · 2021-09-24T11:33:04Z

/integrate

openjdk · 2021-09-24T11:34:37Z

@alexeybakhtin
Your change (at version 9677414) is now ready to be sponsored by a Committer.

VladimirKempik · 2021-09-24T12:08:41Z

/sponsor

openjdk · 2021-09-24T12:09:59Z

Going to push as commit 5ba0d09.
Since your change was applied there have been 37 commits pushed to the master branch:

5a12af7: 8271880: Tighten condition for excluding regions from collecting cards with cross-references
db23ecd: 8274191: Improve g1 evacuation failure injector performance
d91e227: 8238274: (sctp) JDK-7118373 is not fixed for SctpChannel
971aa35: 8274083: Update testing docs to mention tiered testing
1d44014: 8273034: Make javadoc navigation collapsible on small displays
bb74ae8: 8274171: java/nio/file/Files/probeContentType/Basic.java failed on "Content type" mismatches
56b8b35: 8273261: Replace 'while' cycles with iterator with enhanced-for in java.base
0aa63fe: 8274216: ProblemList 2 serviceability/dcmd/gc tests with ZGC on linux-all and windows-all
5ffbe75: 8274195: Doc cleanup in java.nio.file
1fdc656: 8274175: (fc) java/nio/channels/FileChannel/Transfer2GPlus.java still failed in timeout
... and 27 more: https://git.openjdk.java.net/jdk/compare/aefd4ac4a336f00c067bcb91b95472ccc9a6bf83...master

Your commit was automatically rebased without conflicts.

openjdk · 2021-09-24T12:10:18Z

@VladimirKempik @alexeybakhtin Pushed as commit 5ba0d09.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

8274205: Handle KDC_ERR_SVC_UNAVAILABLE error code from KDC

6bf7dfc

openjdk bot added the rfr Pull request is ready for review label Sep 23, 2021

openjdk bot added the security security-dev@openjdk.org label Sep 23, 2021

Added Unavailable test

9677414

wangweij approved these changes Sep 24, 2021

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Sep 24, 2021

openjdk bot added the sponsor Pull request is ready to be sponsored label Sep 24, 2021

openjdk bot closed this Sep 24, 2021

openjdk bot added integrated Pull request has been integrated and removed ready Pull request is ready to be integrated rfr Pull request is ready for review sponsor Pull request is ready to be sponsored labels Sep 24, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

8274205: Handle KDC_ERR_SVC_UNAVAILABLE error code from KDC #5658

8274205: Handle KDC_ERR_SVC_UNAVAILABLE error code from KDC #5658

alexeybakhtin commented Sep 23, 2021 •

edited by openjdk bot

Loading

bridgekeeper bot commented Sep 23, 2021

openjdk bot commented Sep 23, 2021

mlbridge bot commented Sep 23, 2021 •

edited

Loading

wangweij commented Sep 23, 2021 •

edited

Loading

wangweij commented Sep 23, 2021

alexeybakhtin commented Sep 24, 2021

openjdk bot commented Sep 24, 2021

alexeybakhtin commented Sep 24, 2021

openjdk bot commented Sep 24, 2021 •

edited

Loading

alexeybakhtin commented Sep 24, 2021

openjdk bot commented Sep 24, 2021

VladimirKempik commented Sep 24, 2021

openjdk bot commented Sep 24, 2021

openjdk bot commented Sep 24, 2021

8274205: Handle KDC_ERR_SVC_UNAVAILABLE error code from KDC #5658

8274205: Handle KDC_ERR_SVC_UNAVAILABLE error code from KDC #5658

Conversation

alexeybakhtin commented Sep 23, 2021 • edited by openjdk bot Loading

Progress

Issue

Reviewers

Contributors

Reviewing

bridgekeeper bot commented Sep 23, 2021

openjdk bot commented Sep 23, 2021

mlbridge bot commented Sep 23, 2021 • edited Loading

Webrevs

wangweij commented Sep 23, 2021 • edited Loading

wangweij commented Sep 23, 2021

alexeybakhtin commented Sep 24, 2021

openjdk bot commented Sep 24, 2021

alexeybakhtin commented Sep 24, 2021

openjdk bot commented Sep 24, 2021 • edited Loading

alexeybakhtin commented Sep 24, 2021

openjdk bot commented Sep 24, 2021

VladimirKempik commented Sep 24, 2021

openjdk bot commented Sep 24, 2021

openjdk bot commented Sep 24, 2021

alexeybakhtin commented Sep 23, 2021 •

edited by openjdk bot

Loading

mlbridge bot commented Sep 23, 2021 •

edited

Loading

wangweij commented Sep 23, 2021 •

edited

Loading

openjdk bot commented Sep 24, 2021 •

edited

Loading