<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hello,<br>
<br>
please review this fix for 8:<br>
<br>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<a href="http://cr.openjdk.java.net/%7Ekshefov/8025123/webrev.00/">http://cr.openjdk.java.net/~kshefov/8025123/webrev.00/</a><br>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<a href="https://bugs.openjdk.java.net/browse/JDK-8025123">https://bugs.openjdk.java.net/browse/JDK-8025123</a><br>
<br>
SNI APIs were introduced in JDK 8, but TLS Kerberos client
implementation does not take into account SNI host name when it
requests TGS.<br>
<br>
For example, there are two HTTPS sites at the same machine:<br>
<br>
https_service_1.test.machine<br>
https_service_2.test.machine<br>
<br>
KDC contains records for both HTTPS services:<br>
<br>
<a class="moz-txt-link-abbreviated" href="mailto:host/https_service_1.test.machine@TEST.REALM">host/https_service_1.test.machine@TEST.REALM</a><br>
<a class="moz-txt-link-abbreviated" href="mailto:host/https_service_2.test.machine@TEST.REALM">host/https_service_2.test.machine@TEST.REALM</a><br>
<br>
Client wants to request 'https_service_1.test.machine' service, and
it sets SNI host name 'https_service_1.test.machine' during
handshaking. Currently TLS Kerberos client implementation requests
TGS for '<a class="moz-txt-link-abbreviated" href="mailto:host/test.machine@TEST.REALM">host/test.machine@TEST.REALM</a>' instead of
'<a class="moz-txt-link-abbreviated" href="mailto:host/https_service_1.test.machine@TEST.REALM">host/https_service_1.test.machine@TEST.REALM</a>'<br>
<br>
Changes:<br>
- ClientHandshaker uses SNI host name if it is specified.<br>
- If client gets server name extension in server hello then it is
considered as SNI confirmation, so SNI hostname must be used to
build Kerberos service principal name. If there is no SNI
confirmation, client uses SNI first and then fallback to
getHostSE(). <br>
- KerberosClientKeyExchangeImpl.getServiceTicket() method used to
change a hostname for service principal if loopback address was
used. But since we introduced SNI, using IP address to make the
decision does not work any more. For compatibility reasons, the
method checks that "localhost" or "localhost.localdomain" are passed
(they are two known loopback hostname). If so, it still tries to get
the local hostname.<br>
- Added a test case for test/sun/security/krb5/auto/SSL.java<br>
<br>
I have tested this with available reg/jck/sqe tests, no issues
found.<br>
<br>
Artem<br>
</body>
</html>