8139348: Deprecate 3DES and RC4 in Kerberos

[kvergizova]

I'd like to backport JDK-8139348 to 8u for parity with Oracle 8u351.
CSR JDK-8262273 is approved for 8-pool.

11u patch doesn't apply cleanly, some tests need to be adjusted:

• jdk/test/sun/security/krb5/auto/NewSalt.java
  • copyright years adjusted
  • "default_tgs_enctypes=aes128-sha1" changed to "default_tgs_enctypes=aes128-cts" since aes128-sha1 alias is not supported in 8u (JDK-8014628 is not backported to 8u)
• jdk/test/sun/security/krb5/auto/W83.java
  • copyright years adjusted
  • compile tag hunk applied manually due to context difference
• jdk/test/sun/security/krb5/etype/WeakCrypto.java
  • bug tag hunk applied manually due to context difference
  • List.of replaced with Arrays.asList
• test/jdk/sun/security/krb5/tools/KtabCheck.java changes applied to jdk/test/sun/security/krb5/tools/ktcheck.sh (JDK-8180569 is not backported to 8u)
  • additionally, aes128-sha2 (19) values are removed since it is not supported in 8u (JDK-8014628 is not in 8u)
• jdk/test/sun/security/krb5/tools/onlythree.conf
  • aes128-sha2 removed from default_tkt_enctypes since it is not supported in 8u (JDK-8014628 is not in 8u)

Tested with jdk_security and tier1, no regressions.

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• Change must not contain extraneous whitespace
• Commit message must refer to an issue

Issue

• JDK-8139348: Deprecate 3DES and RC4 in Kerberos

Reviewers

• Andrew John Hughes (@gnu-andrew - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk8u-dev.git pull/312/head:pull/312
$ git checkout pull/312

Update a local copy of the PR:
$ git checkout pull/312
$ git pull https://git.openjdk.org/jdk8u-dev.git pull/312/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 312

View PR using the GUI difftool:
$ git pr show -t 312

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk8u-dev/pull/312.diff

Webrev

Link to Webrev Comment

[bridgekeeper]

👋 Welcome back evergizova! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

This backport pull request has now been updated with issue from the original commit.

[mlbridge]

Webrevs

• 00: Full (46abda62)

[jerboaa]

FYI @gnu-andrew I think you've looked into that as well...

[kvergizova]

Could anyone review this backport please?

[gnu-andrew]

Yes, I'll take a look. As Severin says, I was planning to do this one too, so thanks for taking it on.

[gnu-andrew]

Changes look good to me. I'll add my usual proviso that Arrays.asList is modifiable while the original List.of method isn't, but this doesn't matter for a test that only calls three read only methods on the result.

JDK-8180569 might be worth looking at for backport, but isn't a pre-requisite for this.

Please flag with jdk8u-fix-request for approval.

[openjdk]

@kvergizova This change now passes all automated pre-integration checks.

After integration, the commit message for the final commit will be:

8139348: Deprecate 3DES and RC4 in Kerberos

Reviewed-by: andrew

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 14 new commits pushed to the master branch:

• 1c802b2: 8253269: The CheckCommonColors test should provide more info on failure
• 4923d46: 8309122: Bump update version of OpenJDK: 8u392
• 8efa32e: 8307134: Add GTS root CAs
• f5c2c39: 8304760: Add 2 Microsoft TLS roots
• 29ba98e: 8298108: Add a regression test for JDK-8297684
• 54208fc: 8305975: Add TWCA Global Root CA
• 20b4c70: 8072678: Wrong exception messages in java.awt.color.ICC_ColorSpace
• 764dbd5: 8307310: Backport the tests for JDK-8058969 and JDK-8039271 to the OpenJDK8
• 8562298: 8268558: [TESTBUG] Case 2 in TestP11KeyFactoryGetRSAKeySpec is skipped
• c7c080a: 8285515: (dc) DatagramChannel.disconnect fails with "Invalid argument" on macOS 12.4
• ... and 4 more: https://git.openjdk.org/jdk8u-dev/compare/3147b1bafe12326a97269655de46f066931f3ee4...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

As you do not have Committer status in this project an existing Committer must agree to sponsor your change. Possible candidates are the reviewers of this PR (@gnu-andrew) but any other Committer may sponsor as well.

➡️ To flag this PR as ready for integration with the above commit message, type /integrate in a new comment. (Afterwards, your sponsor types /sponsor in a new comment to perform the integration).

[kvergizova]

Thanks for the review, @gnu-andrew!

[gnu-andrew]

No problem, sorry for the delay. I only just saw this today.

I've approved the bug. If you integrate, I can sponsor the commit and we can get this one in. Thanks for the backport :)

[kvergizova]

/integrate

[openjdk]

@kvergizova
Your change (at version 46abda6) is now ready to be sponsored by a Committer.

[gnu-andrew]

/sponsor

[openjdk]

Going to push as commit 6244292.
Since your change was applied there have been 14 commits pushed to the master branch:

• 1c802b2: 8253269: The CheckCommonColors test should provide more info on failure
• 4923d46: 8309122: Bump update version of OpenJDK: 8u392
• 8efa32e: 8307134: Add GTS root CAs
• f5c2c39: 8304760: Add 2 Microsoft TLS roots
• 29ba98e: 8298108: Add a regression test for JDK-8297684
• 54208fc: 8305975: Add TWCA Global Root CA
• 20b4c70: 8072678: Wrong exception messages in java.awt.color.ICC_ColorSpace
• 764dbd5: 8307310: Backport the tests for JDK-8058969 and JDK-8039271 to the OpenJDK8
• 8562298: 8268558: [TESTBUG] Case 2 in TestP11KeyFactoryGetRSAKeySpec is skipped
• c7c080a: 8285515: (dc) DatagramChannel.disconnect fails with "Invalid argument" on macOS 12.4
• ... and 4 more: https://git.openjdk.org/jdk8u-dev/compare/3147b1bafe12326a97269655de46f066931f3ee4...master

Your commit was automatically rebased without conflicts.

[openjdk]

@gnu-andrew @kvergizova Pushed as commit 6244292.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.