<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="SV" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Thanks Chris,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">I like that approach very much.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Thanks again<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Markus<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Chris Hegarty <chris.hegarty@oracle.com>
<br>
<b>Sent:</b> den 28 april 2021 12:51<br>
<b>To:</b> Markus Gronlund <markus.gronlund@oracle.com><br>
<b>Cc:</b> Lim <lim.chainz11+mailing@gmail.com>; Ron Pressler <ron.pressler@oracle.com>; security-dev@openjdk.java.net<br>
<b>Subject:</b> Re: JEP411: Missing use-case: Monitoring / restricting libraries<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On 28 Apr 2021, at 11:38, Markus Gronlund <<a href="mailto:markus.gronlund@oracle.com">markus.gronlund@oracle.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Hi Lim,<br>
<br>
JFR specific feedback can be posted to: <a href="mailto:hotspot-jfr-dev@openjdk.java.net">
hotspot-jfr-dev@openjdk.java.net</a><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks Markus. That is the appropriate list to send JFR feedback. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Just to add, I filed an Enhancement Request in JIRA, 8265962: "Evaluate adding Networking JFR events” [1], to track the possibility of adding JFR events to the JDK libraries that perform low-level networking activity (which is mostly in
the purview of the networking and libraries area). If we had such, then it would be possible to monitor *all* low-level network activity performed by the platform, regardless of which higher-level library is performing the activity. Clearly such would not
capture URLs, but rather the network activity that would be triggered by, say, an HTTP Client library. This seems like a more fruitful and uniform approach, rather than trying to add JFR events to, say, every HTTP library.<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">-Chris.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">[1] <a href="https://bugs.openjdk.java.net/browse/JDK-8265962">
https://bugs.openjdk.java.net/browse/JDK-8265962</a><o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal"><br>
Thanks<br>
Markus<br>
<br>
-----Original Message-----<br>
From: Lim <<a href="mailto:lim.chainz11+mailing@gmail.com">lim.chainz11+mailing@gmail.com</a>>
<br>
Sent: den 28 april 2021 12:18<br>
To: Markus Gronlund <<a href="mailto:markus.gronlund@oracle.com">markus.gronlund@oracle.com</a>><br>
Cc: Ron Pressler <<a href="mailto:ron.pressler@oracle.com">ron.pressler@oracle.com</a>>;
<a href="mailto:security-dev@openjdk.java.net">security-dev@openjdk.java.net</a><br>
Subject: Re: JEP411: Missing use-case: Monitoring / restricting libraries<br>
<br>
Hi Markus, thank you for giving me the guidance for performing the JFR programmatically.<br>
I am able to test if my use case is suitable. Where do I provide my feedback/issue of using the streamed JFR?<br>
<br>
On Wed, Apr 21, 2021 at 10:32 PM Markus Gronlund <<a href="mailto:markus.gronlund@oracle.com">markus.gronlund@oracle.com</a>> wrote:<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">If the existing event probes in the JDK does not give you the information you need, like the name of URL's, it can be a reached by building your own "custom events" via the Events API [3]. It can be harder to add events to unknown code
dynamically, but it can be done and you can use java.lang.Instrument to build an agent to inject the custom event.<o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><br>
I understand that new events can be added in code that I have control of using the Events API but in this case, which is the name of URLs is not feasible.<br>
<br>
Firstly, using a Java agent to instrument bytecode cannot be scaled because there are a lot of HTTP libraries, including the built in Java APIs and 3rd parties such as Apache HTTP, OkHttp. They can also roll their own "HTTP wrapper" if the author doesn't want
dependency. In addition, these 3rd party libraries can be shaded and relocated, making it harder to target via instrumentation.<br>
<br>
Obfuscation can also have an impact on reliability of instrumentation, since obfuscation can be changed in every version and what if the obfuscation has "anti-tamper/anti-debug" features? This is not scalable if we need to monitor for each library that might
call URLs.<br>
<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">If there is a general problem area and provides a good scaling factor, and the URL information might just be such a case, it can make sense to investigate if this information can be provided directly by the JDK, by extending existing or
new JFR events.<o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><br>
I believe that the majority of the HTTP libraries, and code that roll their own are using the built in Java APIs, thus monitoring the built in API that is used for making URLs calls make sense. Then, it can be scaled to most of the libraries compared to instrumenting
each one which has its own problem stated above.<o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>