8179503: Java should support GET OCSP calls #847

apavlyutkin · 2022-03-02T11:47:30Z

Hello! I'd like to backport

8179503: Java should support GET OCSP calls (dependency)

to jdk11u-dev. This one is required as a dependency for

8274471: Add support for RSASSA-PSS in OCSP Response

The following changes were done to apply original patch:

src/java.base/share/classes/sun/security/provider/certpath/OCSP.java

resolved baseline conflict taking place due to absent revocation checking code

The rest of the code applied without changes

Verification/regression (20.04/amd64): jdk_security

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issue

JDK-8179503: Java should support GET OCSP calls

Reviewers

Martin Doerr (@TheRealMDoerr - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk11u-dev.git pull/847/head:pull/847
$ git checkout pull/847

Update a local copy of the PR:
$ git checkout pull/847
$ git pull https://git.openjdk.org/jdk11u-dev.git pull/847/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 847

View PR using the GUI difftool:
$ git pr show -t 847

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk11u-dev/pull/847.diff

Webrev

Link to Webrev Comment

bridgekeeper · 2022-03-02T11:48:40Z

👋 Welcome back apavlyutkin! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2022-03-02T11:49:42Z

This backport pull request has now been updated with issue from the original commit.

mlbridge · 2022-03-02T12:02:28Z

Webrevs

apavlyutkin · 2022-03-02T12:03:05Z

@TheRealMDoerr @alexeybakhtin I splitted #788, this is the 1st part for 8179503

TheRealMDoerr

Looks good.

TheRealMDoerr · 2022-03-02T13:11:24Z

src/java.base/share/classes/sun/security/provider/certpath/OCSP.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2009, 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2009, 2022, Oracle and/or its affiliates. All rights reserved.


Copyright year update not needed for pure backports when the original change doesn't touch it. May cause merge conflicts. Feel free to revert.

openjdk · 2022-03-02T13:12:48Z

@apavlyutkin This change now passes all automated pre-integration checks.

After integration, the commit message for the final commit will be:

8179503: Java should support GET OCSP calls

Reviewed-by: mdoerr

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 1 new commit pushed to the master branch:

6b4feb5: 8305975: Add TWCA Global Root CA

Please see this link for an up-to-date comparison between the source branch of this pull request and the master branch.
As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

As you do not have Committer status in this project an existing Committer must agree to sponsor your change. Possible candidates are the reviewers of this PR (@TheRealMDoerr) but any other Committer may sponsor as well.

➡️ To flag this PR as ready for integration with the above commit message, type /integrate in a new comment. (Afterwards, your sponsor types /sponsor in a new comment to perform the integration).

TheRealMDoerr

Thumbs up from my side!

alexeybakhtin · 2022-03-02T14:26:30Z

Looks good.

GoeLin · 2022-03-07T10:39:01Z

Please configure Pre-submit tests.

apavlyutkin · 2022-03-08T11:25:47Z

@GoeLin I've configured pre-submit tests, but they constantly fail on cross-compilation for different target architectures due to absense of required packages. Is that my fault, should I do something else?

TheRealMDoerr · 2022-03-08T19:23:07Z

A lot of pre-submit tests have failed for other PRs, too. I don't think it's your fault. This change is not platform dependent, so I think your tests are fine.

GoeLin · 2022-03-10T11:13:40Z

Thanks for the tests, the failures are unrelated.

apavlyutkin · 2022-04-06T07:20:15Z

jdk11u-fix-no

…osx-aarch64 Reviewed-by: phh Backport-of: ab22407

…icationException Change implementation to use iterator instead of plain LinkedList Reviewed-by: phh Backport-of: d948bfd

…ption message Reviewed-by: mchung, phh Backport-of: 9f9d678591e02ecaeae7b81eeefb0ba41c7b4dae

… 8218431 Reviewed-by: dlong, mdoerr

Backport-of: e82dc6935b5f575a53fcba9c96767cee1b535cb8

…ust be at least loaded Set InstanceKlass::loaded before adding classes to the subklass list, which can be read concurrently by the compiler. Reviewed-by: rrich Backport-of: cab9667

Backport-of: 3330f9c2ad508fdb9100a2400abdd3366342dde1

Co-authored-by: Justin Lu <jlu@openjdk.org> Reviewed-by: lancea, iris, rriggs Backport-of: 0a700c6c3d150ed375c113b31b8e6185cbe57ae6

…or GB 18030-2022 Implementation Level 2 Reviewed-by: lancea, iris, rriggs Backport-of: 926910977080dda181ae3772293d2bc9bd458f2a

…call in early potential CHECK_NULL return Backport-of: b51ea4204eaa18687e7712e87cdc92efbddfcb5b

…ll in early potential CHECK_NULL return Backport-of: a7e308ab6e5dba7df790840d29fc7edbf3af2e24

Reviewed-by: mdoerr Backport-of: 2903d59

…rsion Reviewed-by: lancea, rriggs, naoto, iris Backport-of: e5ac7a1b7e8df1e56a7e78bba6a2b9ed7fc297f1

Remove old version specific code in reflection.cpp Reviewed-by: clanger Backport-of: 145582d

… backport of JDK-8303861 Reviewed-by: clanger

Backport-of: 5296357fe27ac9f68c635cd1ba324c4985934354

Reviewed-by: phh

Reviewed-by: mdoerr Backport-of: 5b43804b7988ea4abd6458fba0a042b7bd6d9cb8

Backport-of: 686ca5a

phax · 2023-05-16T20:23:28Z

This issue causes a regression, if the OCSP server is not returning the Content-Length header which at least happens now and then on a DigiCert server. In that case the contentLength is set to Integer.MAX_VALUE and IOUtils.readExactlyNBytes fails with an EOFException because it can't read Integer.MAX_VALUE bytes

See also phax/phase4#124 for my original analysis on the Java 17 problem

apavlyutkin · 2023-05-17T06:06:04Z

This issue causes a regression, if the OCSP server is not returning the Content-Length header which at least happens now and then on a DigiCert server. In that case the contentLength is set to Integer.MAX_VALUE and IOUtils.readExactlyNBytes fails with an EOFException because it can't read Integer.MAX_VALUE bytes

See also phax/phase4#124 for my original analysis on the Java 17 problem

Thanks a lot, Philip! I will keep it on mind.

apavlyutkin · 2023-05-17T06:14:41Z

@RealCLanger

Hi, Chris! As I see you've marked dependent JDK-8274471 with jdk11u-todo. Does it mean I should keep working on this and create depended PR(s)? Previously this one was rejected with jdk11u-fix-request-no as inappropriate for jdk11

RealCLanger · 2023-05-17T06:48:31Z

This issue causes a regression, if the OCSP server is not returning the Content-Length header which at least happens now and then on a DigiCert server. In that case the contentLength is set to Integer.MAX_VALUE and IOUtils.readExactlyNBytes fails with an EOFException because it can't read Integer.MAX_VALUE bytes

See also phax/phase4#124 for my original analysis on the Java 17 problem

This is recorded in JBS now as JDK-8308255.

RealCLanger · 2023-05-17T06:57:48Z

@RealCLanger

Hi, Chris! As I see you've marked dependent JDK-8274471 with jdk11u-todo. Does it mean I should keep working on this and create depended PR(s)? Previously this one was rejected with jdk11u-fix-request-no as inappropriate for jdk11

Hi @apavlyutkin,
I have removed jdk11u-fix-no from JDK-8179503 now, as I think it was backported for Oracle as well (although the backport is not public) and there is justification for backporting this change as well as JDK-8274471.
You need not care about the jdk11u-todo label. It is just some flagging that helps us keep the JBS filters for open backports lean. You could remove the label once a backport to 11u was merged. But you can also keep the label around for us to clean up.

So, please go ahead with your efforts to backport these two items. As for this PR, I think a merge with master would clean it up and also trigger GHA, hoping for all green results.

…11u-dev into backport-8179503

openjdk · 2023-05-19T12:07:29Z

⚠️ @apavlyutkin This pull request contains merges that bring in commits not present in the target repository. Since this is not a "merge style" pull request, these changes will be squashed when this pull request in integrated. If this is your intention, then please ignore this message. If you want to preserve the commit structure, you must change the title of this pull request to Merge <project>:<branch> where <project> is the name of another project in the OpenJDK organization (for example Merge jdk:master).

phohensee

@apavlyutkin, there are 494 changed files in the PR vs 3 in the original commit. Looks like a merge issue.

phohensee

Somehow the last merge changed 494 files, please fix.

apavlyutkin · 2023-05-30T15:51:28Z

Somehow the last merge changed 494 files, please fix.

The request was initiated Mar 2, 2022. It's Ok

TheRealMDoerr · 2023-05-30T16:48:10Z

It may be correct. We can see the actual patch here: https://patch-diff.githubusercontent.com/raw/openjdk/jdk11u-dev/pull/847.patch
The GitHub PR view is broken. We can't see what is being changed. Maybe it's possible to fix it by changing what exactly is supposed to get diffed.

apavlyutkin · 2023-05-31T09:14:11Z

Ok, I'm raising new #1917 instead of this one

Backport f5ee356

072741f

openjdk bot changed the title ~~Backport f5ee356540d7aa4a7663c0d5d74f5fdb0726b426~~ 8179503: Java should support GET OCSP calls Mar 2, 2022

openjdk bot added the backport label Mar 2, 2022

removes trailing whitespaces

07b077c

openjdk bot added the rfr Pull request is ready for review label Mar 2, 2022

TheRealMDoerr approved these changes Mar 2, 2022

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Mar 2, 2022

reverts copyright year

ae3d2ba

TheRealMDoerr approved these changes Mar 2, 2022

View reviewed changes

apavlyutkin closed this Apr 6, 2022

apavlyutkin reopened this Mar 17, 2023

RealCLanger and others added 8 commits March 17, 2023 11:36

8265486: ProblemList javax/sound/midi/Sequencer/Recording.java on mac…

be64682

…osx-aarch64 Reviewed-by: phh Backport-of: ab22407

8232853: AuthenticationFilter.Cache::remove may throw ConcurrentModif…

1ab8693

…icationException Change implementation to use iterator instead of plain LinkedList Reviewed-by: phh Backport-of: d948bfd

8302791: Add specific ClassLoader object to Proxy IllegalArgumentExce…

f4776fe

…ption message Reviewed-by: mchung, phh Backport-of: 9f9d678591e02ecaeae7b81eeefb0ba41c7b4dae

8304389: [11u] Crash on Windows in C2 compiled code after 8248238 and…

f1c92b4

… 8218431 Reviewed-by: dlong, mdoerr

Merge

ab51b15

8300205: Swing test bug8078268 make latch timeout configurable

1516012

Backport-of: e82dc6935b5f575a53fcba9c96767cee1b535cb8

8215575: C2 crash: assert(get_instanceKlass()->is_loaded()) failed: m…

386addf

…ust be at least loaded Set InstanceKlass::loaded before adding classes to the subklass list, which can be read concurrently by the compiler. Reviewed-by: rrich Backport-of: cab9667

8301170: perfMemory_windows.cpp add free_security_attr to early returns

75fb8a9

Backport-of: 3330f9c2ad508fdb9100a2400abdd3366342dde1

naotoj and others added 12 commits May 10, 2023 17:03

8301401: Allow additional characters for GB18030-2022 support

75c5063

Co-authored-by: Justin Lu <jlu@openjdk.org> Reviewed-by: lancea, iris, rriggs Backport-of: 0a700c6c3d150ed375c113b31b8e6185cbe57ae6

8305682: Update the javadoc in the Character class to state support f…

804ed83

…or GB 18030-2022 Implementation Level 2 Reviewed-by: lancea, iris, rriggs Backport-of: 926910977080dda181ae3772293d2bc9bd458f2a

8303354: addCertificatesToKeystore in KeystoreImpl.m needs CFRelease …

f5da5da

…call in early potential CHECK_NULL return Backport-of: b51ea4204eaa18687e7712e87cdc92efbddfcb5b

8303576: addIdentitiesToKeystore in KeystoreImpl.m needs CFRelease ca…

12093c0

…ll in early potential CHECK_NULL return Backport-of: a7e308ab6e5dba7df790840d29fc7edbf3af2e24

8282467: add extra diagnostics for JDK-8268184

9317eec

Reviewed-by: mdoerr Backport-of: 2903d59

8285497: Add system property for Java SE specification maintenance ve…

b46e240

…rsion Reviewed-by: lancea, rriggs, naoto, iris Backport-of: e5ac7a1b7e8df1e56a7e78bba6a2b9ed7fc297f1

8214807: Improve handling of very old class files

ca62ba5

Remove old version specific code in reflection.cpp Reviewed-by: clanger Backport-of: 145582d

8307811: [TEST] compilation of TimeoutInErrorHandlingTest fails after…

0ef2e11

… backport of JDK-8303861 Reviewed-by: clanger

8303822: gtestMain should give more helpful output

2f6a287

Backport-of: 5296357fe27ac9f68c635cd1ba324c4985934354

8308006: Missing NMT memory tagging in CMS

be0de41

Reviewed-by: phh

8282201: Consider removal of expiry check in VerifyCACerts.java test

507a392

Reviewed-by: mdoerr Backport-of: 5b43804b7988ea4abd6458fba0a042b7bd6d9cb8

8243936: NonWriteable system properties are actually writeable

3139666

Backport-of: 686ca5a

Alexey Pavlyutkin added 4 commits May 19, 2023 15:04

Backport f5ee356

3ca3e4c

removes trailing whitespaces

1918efd

reverts copyright year

c4219c4

Merge branch 'backport-8179503' of https://github.com/apavlyutkin/jdk…

623572f

…11u-dev into backport-8179503

openjdk bot mentioned this pull request May 23, 2023

8274471: Add support for RSASSA-PSS in OCSP Response #1891

Closed

3 tasks

phohensee suggested changes May 26, 2023

View reviewed changes

phohensee suggested changes May 30, 2023

View reviewed changes

apavlyutkin mentioned this pull request May 31, 2023

8179503: Java should support GET OCSP calls #1917

Closed

4 tasks

apavlyutkin closed this May 31, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

8179503: Java should support GET OCSP calls #847

8179503: Java should support GET OCSP calls #847

apavlyutkin commented Mar 2, 2022 •

edited by openjdk bot

Loading

bridgekeeper bot commented Mar 2, 2022

openjdk bot commented Mar 2, 2022

mlbridge bot commented Mar 2, 2022 •

edited

Loading

apavlyutkin commented Mar 2, 2022

TheRealMDoerr left a comment

TheRealMDoerr Mar 2, 2022

openjdk bot commented Mar 2, 2022 •

edited

Loading

TheRealMDoerr left a comment

alexeybakhtin commented Mar 2, 2022

GoeLin commented Mar 7, 2022

apavlyutkin commented Mar 8, 2022

TheRealMDoerr commented Mar 8, 2022

GoeLin commented Mar 10, 2022

apavlyutkin commented Apr 6, 2022

phax commented May 16, 2023 •

edited

Loading

apavlyutkin commented May 17, 2023

apavlyutkin commented May 17, 2023

RealCLanger commented May 17, 2023 •

edited

Loading

RealCLanger commented May 17, 2023

openjdk bot commented May 19, 2023

phohensee left a comment

phohensee left a comment

apavlyutkin commented May 30, 2023 •

edited

Loading

TheRealMDoerr commented May 30, 2023

apavlyutkin commented May 31, 2023

8179503: Java should support GET OCSP calls #847

8179503: Java should support GET OCSP calls #847

Conversation

apavlyutkin commented Mar 2, 2022 • edited by openjdk bot Loading

Progress

Issue

Reviewers

Reviewing

Webrev

bridgekeeper bot commented Mar 2, 2022

openjdk bot commented Mar 2, 2022

mlbridge bot commented Mar 2, 2022 • edited Loading

Webrevs

apavlyutkin commented Mar 2, 2022

TheRealMDoerr left a comment

Choose a reason for hiding this comment

TheRealMDoerr Mar 2, 2022

Choose a reason for hiding this comment

openjdk bot commented Mar 2, 2022 • edited Loading

TheRealMDoerr left a comment

Choose a reason for hiding this comment

alexeybakhtin commented Mar 2, 2022

GoeLin commented Mar 7, 2022

apavlyutkin commented Mar 8, 2022

TheRealMDoerr commented Mar 8, 2022

GoeLin commented Mar 10, 2022

apavlyutkin commented Apr 6, 2022

phax commented May 16, 2023 • edited Loading

apavlyutkin commented May 17, 2023

apavlyutkin commented May 17, 2023

RealCLanger commented May 17, 2023 • edited Loading

RealCLanger commented May 17, 2023

openjdk bot commented May 19, 2023

phohensee left a comment

Choose a reason for hiding this comment

phohensee left a comment

Choose a reason for hiding this comment

apavlyutkin commented May 30, 2023 • edited Loading

TheRealMDoerr commented May 30, 2023

apavlyutkin commented May 31, 2023

apavlyutkin commented Mar 2, 2022 •

edited by openjdk bot

Loading

mlbridge bot commented Mar 2, 2022 •

edited

Loading

openjdk bot commented Mar 2, 2022 •

edited

Loading

phax commented May 16, 2023 •

edited

Loading

RealCLanger commented May 17, 2023 •

edited

Loading

apavlyutkin commented May 30, 2023 •

edited

Loading