Re: [13] RFR: 8020637: Permissions.readObject doesn't enforce proper Class to PermissionCollection mappings

2019-04-08 Thread Sean Mullan
On 4/6/19 10:33 AM, Weijun Wang wrote: 603 // check that the Class of the Permission key and value are the same 604 for (Map.Entry e : perms.entrySet()) { 605 Permission k = e.getKey(); 606 Permission v = e.getValue(); 607 if (!(k.get

RFR [13]: 8222089: [TESTBUG] sun/security/lib/cacerts/VerifyCACerts.java fails due to cert within 90-day expiry window

2019-04-08 Thread Sean Mullan
Two DocuSign root CA certificates will expire in 90 days. This is causing failures in mach5 tier 2 and tier 4. For now, I have modified the test to exclude these certificates until we can contact the CA vendor to determine if we should remove or replace them, and filed a follow-on issue to tra

Re: JDK-8219568 extended master secret performance problems

2019-04-08 Thread Xuelei Fan
Hi Daniel, Was extended master secret extension used when legacy resumption is expected? I did not get the point from JDK-8219568 and this description. It would be helpful if there is a test code to reproduce the behavior. Thanks, Xuelei On 4/6/2019 11:36 AM, Daniel Jeliński wrote: Hi al

Re: RFR [13]: 8222089: [TESTBUG] sun/security/lib/cacerts/VerifyCACerts.java fails due to cert within 90-day expiry window

2019-04-08 Thread Xuelei Fan
Looks good to me. Xuelei On 4/8/2019 7:24 AM, Sean Mullan wrote: Two DocuSign root CA certificates will expire in 90 days. This is causing failures in mach5 tier 2 and tier 4. For now, I have modified the test to exclude these certificates until we can contact the CA vendor to determine if w

Re: JDK-8219568 extended master secret performance problems

2019-04-08 Thread Daniel Jeliński
Hi Xuelei, Thanks for your response! My understanding is that legacy resumption = resumption of a session that was established without extended master secret extension. Our Java application is a web server that is communicating with a large number of clients, majority of which are built on top of

RFR[13]: 8222133: Add temporary exceptions for root certs that are due to expire soon

2019-04-08 Thread Sean Mullan
Please review this fix to add temporary test exceptions for 4 more root CA certificates that are due to expire soon and will start causing test failures in the next couple of days. bug: https://bugs.openjdk.java.net/browse/JDK-8222133 diffs: $ hg diff diff -r 0608ef3a7740 test/jdk/sun/securit

Re: RFR[13]: 8222133: Add temporary exceptions for root certs that are due to expire soon

2019-04-08 Thread Xuelei Fan
Looks fine to me. Xuelei On 4/8/2019 10:02 AM, Sean Mullan wrote: Please review this fix to add temporary test exceptions for 4 more root CA certificates that are due to expire soon and will start causing test failures in the next couple of days. bug: https://bugs.openjdk.java.net/browse/JDK

Re: [13] RFR JDK-8216039 "TLS with BC and RSASSA-PSS breaks ECDHServerKeyExchange"

2019-04-08 Thread Xuelei Fan
The update is clear and straightforward to me. Signature.java:542: - 542 if (cert instanceof java.security.cert.X509Certificate) { + 542 if (cert instanceof X509Certificate) { 546 X509Certificate c = (X509Certificate)cert; To keep the two lines consistent, I would prefer to remove the packa

Re: JDK-8219568 extended master secret performance problems

2019-04-08 Thread Xuelei Fan
Hi Daniel, Thanks for the quick feedback. It helps me a lot. On 4/8/2019 9:59 AM, Daniel Jeliński wrote: Hi Xuelei, Thanks for your response! My understanding is that legacy resumption = resumption of a session that was established without extended master secret extension. Our Java applicat

Re: [13] RFR JDK-8216039 "TLS with BC and RSASSA-PSS breaks ECDHServerKeyExchange"

2019-04-08 Thread Valerie Peng
Hi Xuelei, Thanks for your review~ I will incorporate your feedback and re-test before integrating it. As for making the new init methods public, I can see both pros and cons. On one hand, I think it'd be nice have the new init methods being public as PKCS11 API passes both key and parameter

Re: [13] RFR: 8020637: Permissions.readObject doesn't enforce proper Class to PermissionCollection mappings

2019-04-08 Thread Weijun Wang
> On Apr 8, 2019, at 9:38 PM, Sean Mullan wrote: > > On 4/6/19 10:33 AM, Weijun Wang wrote: >> 603 // check that the Class of the Permission key and value are the >> same >> 604 for (Map.Entry e : perms.entrySet()) { >> 605 Permission k = e.getKey(); >> 606

Re: RFR 8180573: Refactor sun/security/tools shell tests to plain java tests

2019-04-08 Thread Rajan Halade
Review took longer than I planned. Your fix looks good. In addition to conversion to java, fix has good enhancements needed to tests. For instance - changing non-default digest algorithm to SHA-1 from SHA-256 for AlgOptions.sh. Thanks for these changes. Thanks, Rajan On 3/25/19 8:20 PM, Weij