[jdk21u-dev] Integrated: 8302111: Serialization considerations

[Goetz Lindenmaier]

On Mon, 10 Feb 2025 15:38:07 GMT, Goetz Lindenmaier <goetz at openjdk.org> wrote:

> I think this is a valuable fix we need in 21.  It secures deserialized data.
> 
> The code needed some resolves, but overall the change of
> head fits well on the code in 21.  In detail:
> 
> I resolved
>   src/java.base/share/classes/com/sun/crypto/provider/DHPrivateKey.java and
>   src/java.base/share/classes/com/sun/crypto/provider/DHPublicKey.java.
> It does not apply as these changes are missing in 21:
>   8311170: Simplify and modernize equals and hashCode in security area
>   8315974: Make fields final in 'com.sun.crypto.provider' package
> Both files have similar differences between head and 21:
> In both files I resolved one larger chunk. Some of the removed code is different:
>   * Initialization of this.l removed in original.  This initialization is not in 21.
>   * head has some coding initializing this.x/y.  This is handled by a call to
>     parseKeyBits() in 21, which executes similar code.
> The new code is the same as in head.
> 
> In src/java.security.jgss/share/classes/sun/security/krb5/internal/KRBError.java, changes
>   8327818: Implement Kerberos debug with sun.security.util.Debug and again
>   8311170: Simplify and modernize equals and hashCode in security area
> are missing in 21.
> This only requires trivial resolves due to context differences.
> 
> I based this backport on the commit to head.
> The commit to 22.0.2 is identical to that, except that it skips
> two unnecessary empty lines in KRBError.java. I rather go
> with the head version as this will make further backports
> fit better.
> 
> This passed our nightly testing which includes the tests for the security implementations. 
> We run headless tier 1-4 on 8 platform with fastdebug, jck and further internal tests.

This pull request has now been integrated.

Changeset: 17cb53a9
Author:    Goetz Lindenmaier <goetz at openjdk.org>
URL:       https://git.openjdk.org/jdk21u-dev/commit/17cb53a995e3afd8e8e3b612fdfd71880faaae80
Stats:     1046 lines in 21 files changed: 567 ins; 299 del; 180 mod

8302111: Serialization considerations

Reviewed-by: andrew
Backport-of: 369c573383a0120e0d85aeb89a211f38b5261013

-------------

PR: https://git.openjdk.org/jdk21u-dev/pull/1391