8065422: Trailing dot in hostname causes TLS handshake to fail with SNI disabled

[wkia]

Almost clean backport.

JDK8 has the same issue with processing host names for SNI. It'd be good to keep JDK8 up to date with the upstream. No risks.

There were 2 changes with test files paths:

• Original test/jdk/javax/net/ssl/ServerName/EndingDotHostname.java added and moved to jdk/test/javax/net/ssl/ServerName/EndingDotHostname.java.
• Original test/jdk/javax/net/ssl/templates/SSLExampleCert.java added and moved to jdk/test/javax/net/ssl/templates/SSLExampleCert.java.

And the original changes use JDK17 strings in SSLExampleCert.java, so it was adapted for JDK8 withthe additional commit as it was done for JDK11 backport.

Please note that new test added by the change fails for now because of the certs are expired in March, 2022. To fix this, there are additional JDK fixes being backported as dependant PRs

• 8282398: EndingDotHostname.java test fails because SSL cert expired #206
• 8282511: Use fixed certificate validation date in SSLExampleCert template #207

---

Progress

• Change must not contain extraneous whitespace
• Commit message must refer to an issue

Issue

• JDK-8065422: Trailing dot in hostname causes TLS handshake to fail with SNI disabled

Reviewers

• Yuri Nesterenko (@yan-too - Reviewer) ⚠️ Review applies to 84cd2b55
• Andrew John Hughes (@gnu-andrew - Reviewer) ⚠️ Review applies to 84cd2b55

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk8u-dev pull/205/head:pull/205
$ git checkout pull/205

Update a local copy of the PR:
$ git checkout pull/205
$ git pull https://git.openjdk.org/jdk8u-dev pull/205/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 205

View PR using the GUI difftool:
$ git pr show -t 205

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk8u-dev/pull/205.diff

[bridgekeeper]

👋 Welcome back rmarchenko! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

This backport pull request has now been updated with issue from the original commit.

[mlbridge]

Webrevs

• 01: Full - Incremental (08f949b2)
• 00: Full (84cd2b55)

[openjdk]

@wkia This change now passes all automated pre-integration checks.

After integration, the commit message for the final commit will be:

8065422: Trailing dot in hostname causes TLS handshake to fail with SNI disabled

Reviewed-by: yan, andrew

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 63 new commits pushed to the master branch:

• a318e48: 8300014: Some backports placed the tests in the wrong location
• da57ed1: Merge
• 36321be: 8300178: JDK-8288516 causes build failure on Windows + VS2010
• dfd2fe8: 8300178: JDK-8286496 causes build failure on older GCC
• ddb9a5c: Merge
• 056d5a7: 8299439: java/text/Format/NumberFormat/CurrencyFormat.java fails for hr_HR
• 602d1d4: 8296239: ISO 4217 Amendment 174 Update
• 6389fde: 8294307: ISO 4217 Amendment 173 Update
• 7dd12ae: 8289549: ISO 4217 Amendment 172 Update
• 40ffc34: 8283277: ISO 4217 Amendment 171 Update
• ... and 53 more: https://git.openjdk.org/jdk8u-dev/compare/362cf7628b73f4112bee464cea52a8a29e6671ce...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

As you do not have Committer status in this project an existing Committer must agree to sponsor your change. Possible candidates are the reviewers of this PR (@yan-too, @gnu-andrew) but any other Committer may sponsor as well.

➡️ To flag this PR as ready for integration with the above commit message, type /integrate in a new comment. (Afterwards, your sponsor types /sponsor in a new comment to perform the integration).

[gnu-andrew]

Clean backport, simple bug fix.

[gnu-andrew]

This has a jdk8u-fix-yes approval already. Please run the integrate command and then one of us can sponsor this to get it in.

[gnu-andrew]

/clean

[openjdk]

@gnu-andrew This backport pull request is now marked as clean

[wkia]

The original changes use JDK17 strings in SSLExampleCert.java, so it was adapted for JDK8 withthe additional commit as it was done for JDK11 backport.

I will update the related PRs accordingly.

[phohensee]

Pre-submit test failures look like an infrastructure issue. @wkia, the backport has been approved, so if you add a "/integrate" comment, I or another committer can sponsor it.

[wkia]

/integrate

[openjdk]

@wkia
Your change (at version 08f949b) is now ready to be sponsored by a Committer.

[phohensee]

/sponsor

[openjdk]

Going to push as commit 5525464.
Since your change was applied there have been 63 commits pushed to the master branch:

• a318e48: 8300014: Some backports placed the tests in the wrong location
• da57ed1: Merge
• 36321be: 8300178: JDK-8288516 causes build failure on Windows + VS2010
• dfd2fe8: 8300178: JDK-8286496 causes build failure on older GCC
• ddb9a5c: Merge
• 056d5a7: 8299439: java/text/Format/NumberFormat/CurrencyFormat.java fails for hr_HR
• 602d1d4: 8296239: ISO 4217 Amendment 174 Update
• 6389fde: 8294307: ISO 4217 Amendment 173 Update
• 7dd12ae: 8289549: ISO 4217 Amendment 172 Update
• 40ffc34: 8283277: ISO 4217 Amendment 171 Update
• ... and 53 more: https://git.openjdk.org/jdk8u-dev/compare/362cf7628b73f4112bee464cea52a8a29e6671ce...master

Your commit was automatically rebased without conflicts.

[openjdk]

@phohensee @wkia Pushed as commit 5525464.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.