<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I’ve raised the PR as discussed at
<a href="https://github.com/openjdk/jdk/pull/28075">https://github.com/openjdk/jdk/pull/28075</a>. Sorry this took a little longer than expected due to other projects getting in the way!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I’ve added autoconf and build system changes that deal with whether the target system has krb5 or not, plus a suitable jtreg test using OneKDC. The changes and testing work on both Linux and MacOS and the
CI runs successfully on my fork, although only the MacOS builds enable krb5 – but the other builds get through autoconf and successfully disable the feature.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">After familiarizing myself with the build system a bit, I found a slightly neater way of implementing the conditionally compiled code approach I mentioned below which avoids changing the library name on MacOS
– although if it was preferable to have a consistent library name on both platforms, it would be easy to go back to the approach below. Given the library name on Windows is different anyway, it didn’t seem that bad to have separate library names for each
platform.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Nick<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Wei-Jun Wang <weijun.wang@oracle.com>
<br>
<b>Sent:</b> Thursday, February 6, 2025 2:12 PM<br>
<b>To:</b> Hall, Nick <Nick.Hall@deshaw.com><br>
<b>Cc:</b> Sean Mullan <sean.mullan@oracle.com>; security-dev@openjdk.org<br>
<b>Subject:</b> Re: Linux support for java.security.jgss "nativeccache" functionality<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p><span style="font-size:9.0pt;font-family:"Verdana",sans-serif;color:#CC0000">This message was sent by an external party.<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi Nick, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I’ve filed <a href="https://bugs.openjdk.org/browse/JDK-8349546">https://bugs.openjdk.org/browse/JDK-8349546</a>. It will be great if the same code could support nativeccache on both Mac and Linux.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If the test cannot be automated, feel free to add some instructions for manual testing.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Looking forward to your first OpenJDK contribution!<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Weijun<o:p></o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Feb 3, 2025, at 19:04, Hall, Nick <<a href="mailto:Nick.Hall@deshaw.com">Nick.Hall@deshaw.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Hi Sean,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks for your response - I confirm that my company is D. E. Shaw & Co.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Let me know if I can provide any further information!<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Nick<o:p></o:p></p>
</div>
<div id="mail-editor-reference-message-container">
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="font-family:"Calibri",sans-serif">From:</span></b><span style="font-family:"Calibri",sans-serif"> Sean Mullan <</span><a href="mailto:sean.mullan@oracle.com"><span style="font-family:"Calibri",sans-serif">sean.mullan@oracle.com</span></a><span style="font-family:"Calibri",sans-serif">><br>
<b>Sent:</b> Monday, February 3, 2025 11:03 pm<br>
<b>To:</b> Hall, Nick <</span><a href="mailto:Nick.Hall@deshaw.com"><span style="font-family:"Calibri",sans-serif">Nick.Hall@deshaw.com</span></a><span style="font-family:"Calibri",sans-serif">>;
</span><a href="mailto:security-dev@openjdk.org"><span style="font-family:"Calibri",sans-serif">security-dev@openjdk.org</span></a><span style="font-family:"Calibri",sans-serif"> <</span><a href="mailto:security-dev@openjdk.org"><span style="font-family:"Calibri",sans-serif">security-dev@openjdk.org</span></a><span style="font-family:"Calibri",sans-serif">><br>
<b>Subject:</b> Re: Linux support for java.security.jgss "nativeccache" functionality
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt">This message was sent by an external party.<br>
<br>
<br>
Hi Nick,<br>
<br>
This proposal does sound like it would be useful, so I think we can<br>
start some more discussions about it. Once we go a bit further in the<br>
discussions and we decide it is worthwhile, we can open a JBS issue for<br>
tracking purposes. For starters, can you confirm that your company is<br>
"D. E. Shaw & Co., LP"?<br>
<br>
--Sean<br>
<br>
On 1/31/25 12:04 PM, Hall, Nick wrote:<br>
> Hi,<br>
><br>
> The current OpenJDK code has “native” ccache support for both Windows/<br>
> Mac, allowing native Kerberos credential acquisition on those platforms<br>
> via the usual system library calls rather than the pure Java code. It<br>
> does not support Linux, meaning that only file based ccaches are<br>
> supported on that platform. I couldn’t find any other similar bug<br>
> reports/fixes/submissions, so have developed a patch that I’d like to<br>
> contribute to improve this support (for full disclosure, this is a<br>
> corporate submission approved by my employer, and the OCA has been<br>
> appropriately signed; this is my first time contributing to the OpenJDK).<br>
><br>
> The motivation for doing this is that the Linux Kerberos / GSS-API<br>
> system libraries support more than just file-based Kerberos credential<br>
> caches – in particular, we’re interested in supporting KCM, which is a<br>
> standard protocol for acquiring credentials via a service based cache –<br>
> there are two existing implementations in Heimdal Kerberos and the<br>
> RedHat SSSD. As it stands now, supporting KCM for Java processes means<br>
> running them inside a “kstart” shell which copies a KCM cache to a file<br>
> ccache for the process to use initially. This is an unergonomic<br>
> approach that we would like to avoid, as it’s a source of errors in our<br>
> environment.<br>
><br>
> The patch generalizes the Mac support to include Linux – the C code (ref<br>
> src/java.security.jgss/macosx/native/libosxkrb5/nativeccache.c) required<br>
> here is identical to the Mac version other than the header files (and<br>
> includes a bug fix to avoid a segfault caused by a null pointer deref,<br>
> which I suspect is a dormant bug on MacOSX too). The only other<br>
> required changes are in the Java code which loads the relevant libraries<br>
> and calls them, in both cases these are just changes to an existing<br>
> conditional.<br>
><br>
> I’d be interested in feedback, and had some questions about how to<br>
> approach the shared nature of the code between MacOSX and Linux based on<br>
> the options I’ve tried here:<br>
><br>
> * Option 1: duplicate the code, fix the headers and build a separate<br>
> Linux shared object. This has the disadvantage of a lot of<br>
> duplicated code, but keeps each platform’s libraries separate/distinct.<br>
> * Option 2: build a common shared object on both MacOSX and Linux for<br>
> the nativeccache functionality, using pre-processor directives to<br>
> select the correct set of header files for each platform. This has<br>
> the advantage of a smaller patch (lines of code), but introduces a<br>
> (no-op) change on MacOSX as a result. MacOSX has one additional<br>
> source file (SCDynamicStoreConfig) compiled into the library that<br>
> Linux does not have.<br>
><br>
> The draft code for option 2 can be found at </span><a href="https://github.com/nrhall/"><span style="font-size:11.0pt">https://github.com/nrhall/</span></a><span style="font-size:11.0pt"><br>
> jdk/commit/7b57a48afff77ef80dbb6cd947bd0d0581c439c1 <</span><a href="https://github.com/%0b"><span style="font-size:11.0pt">https://github.com/<br>
</span></a><span style="font-size:11.0pt">> nrhall/jdk/commit/7b57a48afff77ef80dbb6cd947bd0d0581c439c1> (note that<br>
> the GH Actions jobs currently fail on Linux because the runner needs to<br>
> have at least libkrb5-dev installed, and that changes to autoconf/<br>
> dependencies will be needed to ensure these libs/headers are installed<br>
> at compile time at least – with some careful handling at library load<br>
> time to handle the error if not).<br>
><br>
> If there’s interest in pursuing this, I’d be happy to raise a PR -<br>
> please let me know if there are any questions!<br>
><br>
> Thanks,<br>
><br>
> Nick<br>
><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<br>
<hr size="1">
D. E. Shaw & Co. (London), LLP, which is authorised and regulated by the Financial Conduct Authority (firm reference number 590179), may record telephone calls made to or from our members and employees and otherwise gather personal information that you may
share in the course of our dealings with you. This information will be used for the purposes of providing services, keeping records, processing applications for employment, and regulatory compliance and, accordingly, may be transferred outside of the European
Economic Area to other D. E. Shaw group companies. D. E. Shaw & Co. (London), LLP is a limited liability partnership registered in England and Wales with company number OC377872.
</body>
</html>