Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

8328638: Fallback option for POST-only OCSP requests #121

Closed
wants to merge 2 commits into from

Conversation

shipilev
Copy link
Member

@shipilev shipilev commented Apr 2, 2024

Improves JDK OCSP compatibility with some real world OCSP responders. Starts to be a problem since JDK 17 introduced GET OCSP requests. The default behavior is not changed.

Additional testing:

  • jdk_security pass, includes new test cases

Progress

  • Change must not contain extraneous whitespace
  • Commit message must refer to an issue
  • Change requires CSR request JDK-8328810 to be approved
  • JDK-8328638 needs maintainer approval
  • JDK-8329213 needs maintainer approval

Issues

  • JDK-8328638: Fallback option for POST-only OCSP requests (Enhancement - P4 - Approved)
  • JDK-8329213: Better validation for com.sun.security.ocsp.useget option (Enhancement - P4 - Approved)
  • JDK-8328810: Fallback option for POST-only OCSP requests (CSR)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk22u.git pull/121/head:pull/121
$ git checkout pull/121

Update a local copy of the PR:
$ git checkout pull/121
$ git pull https://git.openjdk.org/jdk22u.git pull/121/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 121

View PR using the GUI difftool:
$ git pr show -t 121

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk22u/pull/121.diff

Webrev

Link to Webrev Comment

@shipilev
Copy link
Member Author

shipilev commented Apr 2, 2024

/issue add JDK-8329213

@bridgekeeper
Copy link

bridgekeeper bot commented Apr 2, 2024

👋 Welcome back shade! A progress list of the required criteria for merging this PR into pr/120 will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

@openjdk
Copy link

openjdk bot commented Apr 2, 2024

@shipilev This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8328638: Fallback option for POST-only OCSP requests
8329213: Better validation for com.sun.security.ocsp.useget option

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 2 new commits pushed to the master branch:

  • 2374d1e: 8328988: [macos14] Problem list LightweightEventTest.java which fails due to macOS bug described in JDK-8322653
  • aead789: 8319548: Unexpected internal name for Filler array klass causes error in VisualVM

Please see this link for an up-to-date comparison between the source branch of this pull request and the master branch.
As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

@openjdk openjdk bot changed the title Backport 614db2ea9e10346475eef34629eab54878aa482d 8328638: Fallback option for POST-only OCSP requests Apr 2, 2024
@openjdk
Copy link

openjdk bot commented Apr 2, 2024

This backport pull request has now been updated with issue from the original commit.

@openjdk openjdk bot added backport rfr Pull request is ready for review labels Apr 2, 2024
@openjdk
Copy link

openjdk bot commented Apr 2, 2024

@shipilev
Adding additional issue to issue list: 8329213: Better validation for com.sun.security.ocsp.useget option.

@mlbridge
Copy link

mlbridge bot commented Apr 2, 2024

Webrevs

@shipilev
Copy link
Member Author

shipilev commented Apr 2, 2024

Both backports are clean.

/clean

@shipilev
Copy link
Member Author

shipilev commented Apr 2, 2024

/approval 8328638 request Improves JDK OCSP compatibility with some real world OCSP responders. Starts to be a problem since JDK 17 introduced GET OCSP requests. Risk is medium-low, as default behavior is not changed, and the code is simple. Passes full jdk_security tests.

/approval 8329213 request Option checking followup for JDK-8328638. Risk is low, simple refactoring. Passes full jdk_security tests.

@openjdk openjdk bot added the clean label Apr 2, 2024
@openjdk
Copy link

openjdk bot commented Apr 2, 2024

@shipilev This backport pull request is now marked as clean

@openjdk
Copy link

openjdk bot commented Apr 2, 2024

@shipilev
8328638: The approval request has been created successfully.

@openjdk
Copy link

openjdk bot commented Apr 2, 2024

@shipilev
8329213: The approval request has been created successfully.

@openjdk openjdk bot added the approval label Apr 2, 2024
@openjdk-notifier openjdk-notifier bot changed the base branch from pr/120 to master April 3, 2024 06:53
@openjdk-notifier
Copy link

The parent pull request that this pull request depends on has now been integrated and the target branch of this pull request has been updated. This means that changes from the dependent pull request can start to show up as belonging to this pull request, which may be confusing for reviewers. To remedy this situation, simply merge the latest changes from the new target branch into this pull request by running commands similar to these in the local repository for your personal fork:

git checkout JDK-8328638-ocsp-fallback
git fetch https://git.openjdk.org/jdk22u.git master
git merge FETCH_HEAD
# if there are conflicts, follow the instructions given by git merge
git commit -m "Merge master"
git push

@openjdk
Copy link

openjdk bot commented Apr 3, 2024

@shipilev Please do not rebase or force-push to an active PR as it invalidates existing review comments. Note for future reference, the bots always squash all changes into a single commit automatically as part of the integration. See OpenJDK Developers’ Guide for more information.

@openjdk openjdk bot added ready Pull request is ready to be integrated and removed approval labels Apr 4, 2024
@shipilev
Copy link
Member Author

shipilev commented Apr 4, 2024

/integrate

@openjdk
Copy link

openjdk bot commented Apr 4, 2024

Going to push as commit 8d7d8a4.
Since your change was applied there have been 2 commits pushed to the master branch:

  • 2374d1e: 8328988: [macos14] Problem list LightweightEventTest.java which fails due to macOS bug described in JDK-8322653
  • aead789: 8319548: Unexpected internal name for Filler array klass causes error in VisualVM

Your commit was automatically rebased without conflicts.

@openjdk openjdk bot added the integrated Pull request has been integrated label Apr 4, 2024
@openjdk openjdk bot closed this Apr 4, 2024
@openjdk openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels Apr 4, 2024
@openjdk
Copy link

openjdk bot commented Apr 4, 2024

@shipilev Pushed as commit 8d7d8a4.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport clean integrated Pull request has been integrated
1 participant