8335288: SunPKCS11 initialization will call C_GetMechanismInfo on unsupported mechanisms #20207

valeriepeng · 2024-07-17T00:48:20Z

Can someone help review this fix? Changed the required-mechanism check by checking if the particular mechanism is inside the list of enabled supported mechanisms. This should be more reliable than calling C_GetMechanismInfo(..) on the required mechanism given vendors may return various sorts of error codes.

Thanks,
Valerie

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issue

JDK-8335288: SunPKCS11 initialization will call C_GetMechanismInfo on unsupported mechanisms (Bug - P3)

Reviewers

Hai-May Chao (@haimaychao - Committer) Review applies to a37ab014
Martin Balao (@martinuy - Committer)
Weijun Wang (@wangweij - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/20207/head:pull/20207
$ git checkout pull/20207

Update a local copy of the PR:
$ git checkout pull/20207
$ git pull https://git.openjdk.org/jdk.git pull/20207/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 20207

View PR using the GUI difftool:
$ git pr show -t 20207

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/20207.diff

Webrev

Link to Webrev Comment

…pported mechanisms

bridgekeeper · 2024-07-17T00:48:43Z

👋 Welcome back valeriep! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2024-07-17T00:50:11Z

@valeriepeng This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8335288: SunPKCS11 initialization will call C_GetMechanismInfo on unsupported mechanisms

Reviewed-by: mbalao, weijun, hchao

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 480 new commits pushed to the master branch:

777ed2b: 8339132: Make DirectCodeBuilder write through without allocating instruction objects
e57b593: 8335062: NMT: Make StackIndex non-opaque
8c8b580: 8338281: jshell does not run shutdown hooks
d35ffa4: 8339017: Make a couple of fields in DoubleByte static
723588a: 8338569: HTTP/1.1 CleanupTrigger may be triggerred after the next exchange started
362f9ce: 8339120: Use more fine-granular gcc unused warnings
f080b4b: 8333098: ubsan: bytecodeInfo.cpp:318:59: runtime error: division by zero
ff59532: 8338678: Erroneous parameterized type represented as
0b4a7d5: 8324859: Improve error recovery
1383fec: 8327381: Refactor type-improving transformations in BoolNode::Ideal to BoolNode::Value
... and 470 more: https://git.openjdk.org/jdk/compare/c8a95a763c169b94c5ba07d2c6fbdf99ba3b9e3b...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

openjdk · 2024-07-17T00:50:49Z

@valeriepeng The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2024-07-17T00:54:15Z

Webrevs

01: Full - Incremental (8f3bdbbc)
00: Full (a37ab014)

haimaychao · 2024-07-19T00:23:27Z

LGTM.

valeriepeng · 2024-07-19T16:27:14Z

LGTM.

Thanks Haimay for the review~

driverkt · 2024-07-19T19:24:08Z

I understand that the sample config is for a test, but are there any mechanisms we would want to disable by default? It occurred to me as I was reading through the test and noticed that SHA1 was not in the disabled list for the test.

valeriepeng · 2024-07-22T22:40:34Z

I understand that the sample config is for a test, but are there any mechanisms we would want to disable by default? It occurred to me as I was reading through the test and noticed that SHA1 was not in the disabled list for the test.

Are you asking about general PKCS11 provider configuration setting? For PKCS11 providers, users provide their provider configuration file and they decide what to disable. As for SHA-1, it's not disabled by default for SUN provider either.

valeriepeng · 2024-08-05T21:28:14Z

@martinuy Can you also review this? IIRC, this is introduced by the PBE PKCS12 changes earlier.

martinuy

Overall, I like the change because in addition to fixing the bug we will save some getMechanismInfo calls for mechanisms that are supported by the token but disabled in the configuration. I made a couple of minor comments, though.

martinuy · 2024-08-06T22:25:30Z

src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java

+                Arrays.stream(supportedMechanisms).boxed().collect
+                (Collectors.toCollection(HashSet::new));
+        if (config.getDisabledMechanisms() != null) {
+            enabledMechSet.removeAll(config.getDisabledMechanisms());


Should enabledMechSet be further restricted to Config::enabledMechanisms (if set)? Config::disabledMechanisms looks like a fallback for when Config::enabledMechanisms is not set, according to Config::isEnabled. I'd keep the logic that makes Config::enabledMechanisms work in pair with Config::disabledMechanisms in a single place, as duplicating it into two different places may lead to misalignment.

Yes, you have a good point. Let me think about it and see how to better handle this.

martinuy · 2024-08-06T22:27:36Z

src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java


-        for (int i = 0; i < supportedMechanisms.length; i++) {
-            long longMech = supportedMechanisms[i];
+        for (long longMech : supportedMechanisms) {


Is the code under if (!config.isEnabled(longMech)) { still needed? Looks to me that we will be iterating over enabled mechanisms now.

Just for the record, I want to note that we will not longer be showing information about supported but disabled mechanisms here.

Right, I agree that it's better to show info about supported but disabled mechanisms.

…ailable mechanisms.

martinuy

Looks good to me.

valeriepeng · 2024-08-21T16:58:04Z

Looks good to me.

Thanks Martin for the review~

wangweij

Change looks fine.

haimaychao · 2024-08-29T17:49:14Z

Updated webrev looks good.

valeriepeng · 2024-09-13T21:12:00Z

/integrate

openjdk · 2024-09-13T21:13:54Z

Going to push as commit fdfe503.
Since your change was applied there have been 658 commits pushed to the master branch:

3aa8338: 8340075: Autoconf bundle cannot run on read-only filesystem
37bf589: 8339847: Broken link to the dieharder distribution website in SplittableRandom
89c172a: 8340082: Use inline return tag in java.base
1a0a538: 8340120: Remove redundant code in SegmentBulkOperations::mismatch
89ca89c: 8338626: ClassLoaderExt::process_jar_manifest() should allow / separator on Windows
3e0da58: 8333843: Provide guidelines on MemorySegment to read strings with known lengths
3c4d15b: 8334301: Errors in jpackage man page
4d01178: 8339927: Man page update for deprecating jhsdb debugd for removal
bd44cf8: 8330302: strace004 can still fail
8a4ea09: 8336492: Regression in lambda serialization
... and 648 more: https://git.openjdk.org/jdk/compare/c8a95a763c169b94c5ba07d2c6fbdf99ba3b9e3b...master

Your commit was automatically rebased without conflicts.

openjdk · 2024-09-13T21:14:01Z

@valeriepeng Pushed as commit fdfe503.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

kaarefc · 2024-10-07T06:31:13Z

Hi. I'm the original reporter of this issue.
Thanks for the work done on this bug.
I see the the fix has been targeted at only Java 24.
Are there any plans to back port this to Java 21, which is the current LTS version, and where the regression was introduced?

valeriepeng · 2024-10-08T22:33:40Z

Hi. I'm the original reporter of this issue. Thanks for the work done on this bug. I see the the fix has been targeted at only Java 24. Are there any plans to back port this to Java 21, which is the current LTS version, and where the regression was introduced?

I have just opened a request to backport this to JDK 21 update. Someone from the sustaining team should handle the backport request. Thank~

valeriepeng · 2024-10-08T23:12:19Z

Hi. I'm the original reporter of this issue. Thanks for the work done on this bug. I see the the fix has been targeted at only Java 24. Are there any plans to back port this to Java 21, which is the current LTS version, and where the regression was introduced?

I have just opened a request to backport this to JDK 21 update. Someone from the sustaining team should handle the backport request. Thank~

Correction: It'll be the OpenJDK21 maintainers to handle the backport request (not the sustaining team).

valeriepeng · 2024-10-31T23:45:40Z

Hi. I'm the original reporter of this issue. Thanks for the work done on this bug. I see the the fix has been targeted at only Java 24. Are there any plans to back port this to Java 21, which is the current LTS version, and where the regression was introduced?

I have just opened a request to backport this to JDK 21 update. Someone from the sustaining team should handle the backport request. Thank~

Correction: It'll be the OpenJDK21 maintainers to handle the backport request (not the sustaining team).

@GoeLin I fixed this in jdk24 and the submitter hopes that can be backported to jdk21. Is this something that you can help with? Thanks!

8335288: SunPKCS11 initialization will call C_GetMechanismInfo on usu…

a37ab01

…pported mechanisms

openjdk bot added the rfr Pull request is ready for review label Jul 17, 2024

openjdk bot added the security security-dev@openjdk.org label Jul 17, 2024

haimaychao approved these changes Jul 19, 2024

View reviewed changes

martinuy suggested changes Aug 6, 2024

View reviewed changes

Address review comments and reverted back to iterating through all av…

8f3bdbb

…ailable mechanisms.

martinuy approved these changes Aug 21, 2024

View reviewed changes

wangweij approved these changes Aug 29, 2024

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Aug 29, 2024

openjdk bot added the integrated Pull request has been integrated label Sep 13, 2024

openjdk bot closed this Sep 13, 2024

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels Sep 13, 2024

valeriepeng deleted the JDK-8335288 branch September 13, 2024 21:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

8335288: SunPKCS11 initialization will call C_GetMechanismInfo on unsupported mechanisms #20207

8335288: SunPKCS11 initialization will call C_GetMechanismInfo on unsupported mechanisms #20207

valeriepeng commented Jul 17, 2024 •

edited by openjdk bot

Loading

bridgekeeper bot commented Jul 17, 2024

openjdk bot commented Jul 17, 2024 •

edited

Loading

openjdk bot commented Jul 17, 2024

mlbridge bot commented Jul 17, 2024 •

edited

Loading

haimaychao commented Jul 19, 2024

valeriepeng commented Jul 19, 2024

driverkt commented Jul 19, 2024 •

edited

Loading

valeriepeng commented Jul 22, 2024

valeriepeng commented Aug 5, 2024

martinuy left a comment

martinuy Aug 6, 2024

valeriepeng Aug 19, 2024

martinuy Aug 6, 2024

martinuy Aug 6, 2024

valeriepeng Aug 19, 2024

martinuy left a comment

valeriepeng commented Aug 21, 2024

wangweij left a comment

haimaychao commented Aug 29, 2024

valeriepeng commented Sep 13, 2024

openjdk bot commented Sep 13, 2024

openjdk bot commented Sep 13, 2024

kaarefc commented Oct 7, 2024 •

edited by bridgekeeper bot

Loading

valeriepeng commented Oct 8, 2024

valeriepeng commented Oct 8, 2024

valeriepeng commented Oct 31, 2024

8335288: SunPKCS11 initialization will call C_GetMechanismInfo on unsupported mechanisms #20207

8335288: SunPKCS11 initialization will call C_GetMechanismInfo on unsupported mechanisms #20207

Conversation

valeriepeng commented Jul 17, 2024 • edited by openjdk bot Loading

Progress

Issue

Reviewers

Reviewing

Webrev

bridgekeeper bot commented Jul 17, 2024

openjdk bot commented Jul 17, 2024 • edited Loading

openjdk bot commented Jul 17, 2024

mlbridge bot commented Jul 17, 2024 • edited Loading

Webrevs

haimaychao commented Jul 19, 2024

valeriepeng commented Jul 19, 2024

driverkt commented Jul 19, 2024 • edited Loading

valeriepeng commented Jul 22, 2024

valeriepeng commented Aug 5, 2024

martinuy left a comment

Choose a reason for hiding this comment

martinuy Aug 6, 2024

Choose a reason for hiding this comment

valeriepeng Aug 19, 2024

Choose a reason for hiding this comment

martinuy Aug 6, 2024

Choose a reason for hiding this comment

martinuy Aug 6, 2024

Choose a reason for hiding this comment

valeriepeng Aug 19, 2024

Choose a reason for hiding this comment

martinuy left a comment

Choose a reason for hiding this comment

valeriepeng commented Aug 21, 2024

wangweij left a comment

Choose a reason for hiding this comment

haimaychao commented Aug 29, 2024

valeriepeng commented Sep 13, 2024

openjdk bot commented Sep 13, 2024

openjdk bot commented Sep 13, 2024

kaarefc commented Oct 7, 2024 • edited by bridgekeeper bot Loading

valeriepeng commented Oct 8, 2024

valeriepeng commented Oct 8, 2024

valeriepeng commented Oct 31, 2024

valeriepeng commented Jul 17, 2024 •

edited by openjdk bot

Loading

openjdk bot commented Jul 17, 2024 •

edited

Loading

mlbridge bot commented Jul 17, 2024 •

edited

Loading

driverkt commented Jul 19, 2024 •

edited

Loading

kaarefc commented Oct 7, 2024 •

edited by bridgekeeper bot

Loading