[GitHub] [zookeeper] nkalmar commented on a change in pull request #1353: ZOOKEEPER-3832 ZKHostnameVerifier rejects valid certificates with subjectAltNames

2020-05-20 Thread GitBox 


nkalmar commented on a change in pull request #1353:
URL: https://github.com/apache/zookeeper/pull/1353#discussion_r428029871



##
File path: 
zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java
##
@@ -324,8 +324,14 @@ private static HostNameType determineHostFormat(final 
String host) {
 for (List entry : entries) {
 final Integer type = entry.size() >= 2 ? (Integer) 
entry.get(0) : null;
 if (type != null) {
-final String s = (String) entry.get(1);
-result.add(new SubjectName(s, type));
+if (type == SubjectName.DNS || type == SubjectName.IP) {
+final Object o = entry.get(1);
+if (o instanceof String) {
+result.add(new SubjectName((String) o, type));
+} else if (o instanceof byte[]) {
+// TODO ASN.1 DER encoded form

Review comment:
   Didn't see it's a static method. But I believe you can log by making the 
logger also static. Not sure it is worth it though, it's not a stopper from my 
side if we leave the TODO, just a nice-to-have.





This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org

[GitHub] [zookeeper] nkalmar commented on a change in pull request #1353: ZOOKEEPER-3832 ZKHostnameVerifier rejects valid certificates with subjectAltNames

2020-05-19 Thread GitBox 


nkalmar commented on a change in pull request #1353:
URL: https://github.com/apache/zookeeper/pull/1353#discussion_r427161374



##
File path: 
zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKHostnameVerifier.java
##
@@ -324,8 +324,14 @@ private static HostNameType determineHostFormat(final 
String host) {
 for (List entry : entries) {
 final Integer type = entry.size() >= 2 ? (Integer) 
entry.get(0) : null;
 if (type != null) {
-final String s = (String) entry.get(1);
-result.add(new SubjectName(s, type));
+if (type == SubjectName.DNS || type == SubjectName.IP) {
+final Object o = entry.get(1);
+if (o instanceof String) {
+result.add(new SubjectName((String) o, type));
+} else if (o instanceof byte[]) {
+// TODO ASN.1 DER encoded form

Review comment:
   I agree with Mate here, probably adding a warning until this TODO is not 
implemented would be nice.





This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org

[GitHub] [zookeeper] nkalmar commented on a change in pull request #1353: ZOOKEEPER-3832 ZKHostnameVerifier rejects valid certificates with subjectAltNames

2020-05-19 Thread GitBox 


nkalmar commented on a change in pull request #1353:
URL: https://github.com/apache/zookeeper/pull/1353#discussion_r427158878



##
File path: 
zookeeper-server/src/test/java/org/apache/zookeeper/common/CertificatesToPlayWith.java
##
@@ -0,0 +1,569 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+/**
+ * Some X509 certificates to test against.
+ * 
+ * Note:  some of these certificates have Japanese Kanji in the "subjectAlt"
+ * field (UTF8).  Not sure how realistic that is since international characters
+ * in DNS names usually get translated into ASCII using "xn--" style DNS
+ * entries.  "xn--i8s592g.co.jp" is what FireFox actually uses when trying to
+ * find .co.jp.  So would the CN in the certificate contain
+ * "xn--i8s592g.co.jp" in ASCII, or ".co.jp" in UTF8?  (Both?)
+ * 
+ *
+ * @since 11-Dec-2006

Review comment:
   Just checked JVMPauseMonitor out of curiosity. I got that class from 
hadoop, but modified it. I do have a comment indicating the original source. 
Maybe adding something similar?
   
https://github.com/apache/zookeeper/blob/fe940cdd8fb23ba09684cefb73233d570f4a20fa/zookeeper-server/src/main/java/org/apache/zookeeper/server/util/JvmPauseMonitor.java





This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org

[GitHub] [zookeeper] nkalmar commented on a change in pull request #1353: ZOOKEEPER-3832 ZKHostnameVerifier rejects valid certificates with subjectAltNames

2020-05-19 Thread GitBox 


nkalmar commented on a change in pull request #1353:
URL: https://github.com/apache/zookeeper/pull/1353#discussion_r427156834



##
File path: 
zookeeper-server/src/test/java/org/apache/zookeeper/common/CertificatesToPlayWith.java
##
@@ -0,0 +1,569 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.zookeeper.common;
+
+/**
+ * Some X509 certificates to test against.
+ * 
+ * Note:  some of these certificates have Japanese Kanji in the "subjectAlt"
+ * field (UTF8).  Not sure how realistic that is since international characters
+ * in DNS names usually get translated into ASCII using "xn--" style DNS
+ * entries.  "xn--i8s592g.co.jp" is what FireFox actually uses when trying to
+ * find .co.jp.  So would the CN in the certificate contain
+ * "xn--i8s592g.co.jp" in ASCII, or ".co.jp" in UTF8?  (Both?)
+ * 
+ *
+ * @since 11-Dec-2006

Review comment:
   AFAIK (and Enrico's question also applies this) if it's from another 
Apache project, the Apache license header is enough.





This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org