search

google / openjdk-kerberos

GNU General Public License v2.0
9 stars 9 forks source link

new restrictions on non-SDK interfaces break the library starting from API 29 #1

Open mhadidg opened 4 years ago

mhadidg commented 4 years ago

With the release of Android API 29, every application utilizing this library will crash with NoSuchMethodError (see an example of a stack trace below) due to new restrictions on non-SDK interfaces introduced in API 28.

Is there any immediate workaround for production devices? Are you planning a migration to SDK interfaces or other alternatives?

2020-03-01 09:58:13.733 ? W/.enterprise.dp: Accessing hidden method Lsun/misc/HexDumpEncoder;-><init>()V (greylist, linking, allowed)
2020-03-01 09:58:13.733 ? W/.enterprise.dp: Accessing hidden method Lsun/misc/CharacterEncoder;->encodeBuffer([B)Ljava/lang/String; (greylist, linking, allowed)
2020-03-01 09:58:13.737 ? W/.enterprise.dp: Accessing hidden method Lsun/security/action/GetPropertyAction;-><init>(Ljava/lang/String;)V (greylist, linking, allowed)
2020-03-01 09:58:13.738 ? W/.enterprise.dp: Accessing hidden method Lsun/security/action/GetBooleanAction;-><init>(Ljava/lang/String;)V (greylist, linking, allowed)
2020-03-01 09:58:13.741 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/DerValue;->getTag()B (blacklist, linking, denied)
2020-03-01 09:58:13.741 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/DerInputStream;->peekByte()I (greylist, linking, allowed)
2020-03-01 09:58:13.741 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/DerInputStream;->getDerValue()Lsun/security/util/DerValue; (greylist, linking, allowed)
2020-03-01 09:58:13.741 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/DerValue;->getTag()B (blacklist, linking, denied)
2020-03-01 09:58:13.741 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/DerOutputStream;-><init>()V (greylist, linking, allowed)
2020-03-01 09:58:13.741 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/DerOutputStream;->putInteger(Ljava/math/BigInteger;)V (greylist, linking, allowed)
2020-03-01 09:58:13.741 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/DerValue;->createTag(BZB)B (greylist, linking, allowed)
2020-03-01 09:58:13.741 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/DerOutputStream;->write(BLsun/security/util/DerOutputStream;)V (greylist, linking, allowed)
2020-03-01 09:58:13.741 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/DerOutputStream;->putOctetString([B)V (greylist, linking, allowed)
2020-03-01 09:58:13.742 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/DerValue;->getTag()B (blacklist, linking, denied)
2020-03-01 09:58:13.742 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/DerValue;->getTag()B (blacklist, linking, denied)
2020-03-01 09:58:13.743 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/DerOutputStream;->putSequence([Lsun/security/util/DerValue;)V (greylist, linking, allowed)
2020-03-01 09:58:13.744 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/DerValue;->getTag()B (blacklist, linking, denied)
2020-03-01 09:58:13.745 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/DerOutputStream;->putDerValue(Lsun/security/util/DerValue;)V (greylist, linking, allowed)
2020-03-01 09:58:13.747 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/BitArray;-><init>(I)V (blacklist, linking, denied)
2020-03-01 09:58:13.747 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/BitArray;-><init>(I[B)V (greylist, linking, allowed)
2020-03-01 09:58:13.747 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/BitArray;->toBooleanArray()[Z (blacklist, linking, denied)
2020-03-01 09:58:13.747 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/BitArray;-><init>([Z)V (blacklist, linking, denied)
2020-03-01 09:58:13.747 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/DerOutputStream;->putUnalignedBitString(Lsun/security/util/BitArray;)V (blacklist, linking, denied)
2020-03-01 09:58:13.747 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/BitArray;->get(I)Z (blacklist, linking, denied)
2020-03-01 09:58:13.747 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/BitArray;->set(IZ)V (blacklist, linking, denied)
2020-03-01 09:58:13.747 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/BitArray;->toBooleanArray()[Z (blacklist, linking, denied)
2020-03-01 09:58:13.747 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/DerValue;->getUnalignedBitString(Z)Lsun/security/util/BitArray; (blacklist, linking, denied)
2020-03-01 09:58:13.747 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/DerValue;->getTag()B (blacklist, linking, denied)
2020-03-01 09:58:13.748 ? W/.enterprise.dp: Accessing hidden method Lsun/security/util/BitArray;-><init>(I)V (blacklist, linking, denied)
2020-03-01 09:58:13.748 ? E/JavaBinder: *** Uncaught remote exception!  (Exceptions are not yet supported across processes.)
    java.lang.NoSuchMethodError: No direct method <init>(I)V in class Lsun/security/util/BitArray; or its super classes (declaration of 'sun.security.util.BitArray' appears in /apex/com.android.runtime/javalib/core-oj.jar)
        at sun.security.krb5.internal.util.KerberosFlags.<init>(KerberosFlags.java:64)
        at sun.security.krb5.internal.KDCOptions.<init>(KDCOptions.java:182)
        at sun.security.krb5.KrbAsReq.<init>(KrbAsReq.java:65)
        at sun.security.krb5.KrbAsReqBuilder.build(KrbAsReqBuilder.java:265)
        at sun.security.krb5.KrbAsReqBuilder.send(KrbAsReqBuilder.java:315)
        at sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:361)
        at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:755)
        at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:585)
        at iq.earthlink.enterprise.dpc.KerberosAuthenticator.getAuthToken(KerberosAuthenticator.kt:89)
        at android.accounts.AbstractAccountAuthenticator$Transport.getAuthToken(AbstractAccountAuthenticator.java:246)
        at android.accounts.IAccountAuthenticator$Stub.onTransact(IAccountAuthenticator.java:282)
        at android.os.Binder.execTransactInternal(Binder.java:1021)
        at android.os.Binder.execTransact(Binder.java:994)
2020-03-01 09:58:13.749 ? E/AndroidRuntime: FATAL EXCEPTION: Binder:8573_3
    Process: iq.earthlink.enterprise.dpc, PID: 8573
    java.lang.NoSuchMethodError: No direct method <init>(I)V in class Lsun/security/util/BitArray; or its super classes (declaration of 'sun.security.util.BitArray' appears in /apex/com.android.runtime/javalib/core-oj.jar)
        at sun.security.krb5.internal.util.KerberosFlags.<init>(KerberosFlags.java:64)
        at sun.security.krb5.internal.KDCOptions.<init>(KDCOptions.java:182)
        at sun.security.krb5.KrbAsReq.<init>(KrbAsReq.java:65)
        at sun.security.krb5.KrbAsReqBuilder.build(KrbAsReqBuilder.java:265)
        at sun.security.krb5.KrbAsReqBuilder.send(KrbAsReqBuilder.java:315)
        at sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:361)
        at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:755)
        at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:585)
        at iq.earthlink.enterprise.dpc.KerberosAuthenticator.getAuthToken(KerberosAuthenticator.kt:89)
        at android.accounts.AbstractAccountAuthenticator$Transport.getAuthToken(AbstractAccountAuthenticator.java:246)
        at android.accounts.IAccountAuthenticator$Stub.onTransact(IAccountAuthenticator.java:282)
        at android.os.Binder.execTransactInternal(Binder.java:1021)
        at android.os.Binder.execTransact(Binder.java:994)
eranmes commented 4 years ago

I'm happy to see you using this library - can you elaborate on the context you use it for? Regarding work-arounds:

As you can probably tell, this library contains a subset of the Kerberos implementation from OpenJDK, with some namespaces changed to not conflict with existing code in the JDK provided with Android.

I would suggest importing classes which are no longer public, e.g. sun.misc.HexDumpEncoder into this library - I'm happy to take patches.

mhadidg commented 4 years ago

I'm thankful for your prompt reply.

Can you elaborate on the context you use it for?

I'm using it in a simple Android Kerberos client for our company SSO solution. It's much like your Kerberos Authenticator sample adapted for our specific needs and requirements.

You can build the app such that it targets SDK level 28.

Unfortunately, that doesn't help. Part of the classes referenced in the library is listed in the "blacklist" of the API 29, which are "non-SDK interfaces that you cannot use regardless of your app's target API level."—I'm quoting from the official guide.

You can migrate the classes from Sun's OpenJDK into the project.

It should be possible this way. Yet, surprisingly, the NoSuchMethodError exception thrown in the stack trace provided earlier is about a class you already provided in your package: sun/security/util/BitArray. It seems like we had a class conflict here with another version from the SDK, and the resolving strategy is favoring the SDK version.

I'm thinking of relocating the provided subset to a different namespaces to avoid the conflict, and migrate (then relocate) from Sun's OpenJDK those classes that are listed in the blacklist and the greylist and not provided in your subset; what do you think?

eranmes commented 4 years ago

I'm thankful for your prompt reply.

Can you elaborate on the context you use it for?

I'm using it in a simple Android Kerberos client for our company SSO solution. It's much like your Kerberos Authenticator sample adapted for our specific needs and requirements. Great! I'd like to hear more if you can share. I can contact you privately as I'm keen to learn more about environments where it's used, so I can justify spending more work on this. It should be possible this way. Yet, surprisingly, the NoSuchMethodError exception thrown in the stack trace provided earlier is about a class you already provided in your package: sun/security/util/BitArray. It seems like we had a class conflict here with another version from the SDK, and the resolving strategy is favoring the SDK version.

I'm thinking of relocating the provided subset to a different namespaces to avoid the conflict, and migrate (then relocate) from Sun's OpenJDK those classes that are listed in the blacklist and the greylist and not provided in your subset; what do you think?

Yes, I think that's the only viable course of action. I agree it's not the prettiest solution and a bit of dredge work, copying class by class and renaming all references in the code (a good IDE will make it much simpler). But that is the approach I had to take, after consulting with the Android Runtime team, where they made it clear these classes will not be included in Android due to the low use.