8200400: Restrict Sasl mechanisms

[Weijun Wang]

Please take a review at

   https://cr.openjdk.java.net/~weijun/8200400/webrev.01/

There is a CSR at

   https://bugs.openjdk.java.net/browse/JDK-8214331

Thanks,
Max

RFR 8219013: Update Apache Santuario (XML Signature) to version 2.1.3

[Weijun Wang]

Hi Sean,

Please take a review at

  https://cr.openjdk.java.net/~weijun/8219013/webrev.00/

Most of the changes are around 1) ECKeyValue 2) new BASE64 methods 3) 
XMLUtils.getFullTextChildrenFromNode. There are also quite a bunch of changes 
only including year and an apache-style $Id (Ex: DOMHMACSignatureMethod.java) 
because the previous JDK-8217878 fix had not updated the year.

What kind of noreg label I should choose? I am thinking of noreg-other with an 
explanation that this is a sync with upstream repo.

Thanks,
Max

Re: RFR 8223063: Support CNG RSA keys

[Weijun Wang]

OK, the command is now

  certutil -v -p changeit -csp "Microsoft Software Key Storage Provider" -user 
-importpfx MY ks NoRoot,NoExport

Test still passes.

Thanks,
Max

> On May 2, 2019, at 4:09 AM, Bernd Eckenfels  wrote:
> 
> Max, would it make sense to specify ` -csp "Microsoft Software Key Storage 
> Provider"` to make sure it stores the key in a CNG KSP? (I am not sure what 
> the default provider is). Also maybe make the key non-exportable to make sure 
> key-handles are actually used for the operations?
> 
> Gruss
> Bernd
> 
> 
> --
> http://bernd.eckenfels.net
>  
> Von: security-dev  im Auftrag von 
> Weijun Wang 
> Gesendet: Mittwoch, Mai 1, 2019 7:21 PM
> An: security-dev@openjdk.java.net
> Betreff: Re: RFR 8223063: Support CNG RSA keys
>  
> It looks the Mach5 machines are Windows Server 2012 but mine is 2019. I 
> removed the "-f" option and everything looks fine now. 
> 
> --Max 
> 
> > On May 1, 2019, at 7:18 AM, Weijun Wang  wrote: 
> > 
> > Please take a look at 
> > 
> > https://cr.openjdk.java.net/~weijun/8223063/webrev.00/ 
> > 
> > Unfortunately, although the new test I added succeeds on my own machine, 
> > the "certutil -importPFX" command inside always fail on Mach5 with 
> > 
> > Command line: [certutil -f -v -p changeit -user -importpfx MY ks NoRoot] 
> > A -- A-7626e24d-46df-4ba0-8880-9866bb1-01966 
> > A -- A-7626e24d-46df-4ba0-8880-9866bb178ab6 
> > CertUtil: -importPFX command FAILED: 0x80090029 (-2146893783 
> > NTE_NOT_SUPPORTED) 
> > CertUtil: The requested operation is not supported. 
> > 
> > Maybe there is a permission issue. 
> > 
> > I'll study it for more, but If anyone of you can fix it I'll be very happy. 
> > 
> > Thanks, 
> > Max 
> > 
>