8264864: Multiple byte tag not supported by ASN.1 encoding #3391

wangweij · 2021-04-08T01:06:47Z

This code change does not intend to support multiple byte tags. Instead, it aims to fail more gracefully when such a tag is encountered. For DerValue constructors from an encoding (type I), an IOException will be thrown since it's already in the throws clause. For constructors from tag and value (type II), an IllegalArgumentException will be thrown. All existing type II callers inside JDK use tag numbers smaller than 31.

Progress

Change must not contain extraneous whitespace
Commit message must refer to an issue
Change must be properly reviewed

Issue

JDK-8264864: Multiple byte tag not supported by ASN.1 encoding

Reviewers

Xue-Lei Andrew Fan (@XueleiFan - Reviewer) ⚠️ Review applies to 9b0f9db

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.java.net/jdk pull/3391/head:pull/3391
$ git checkout pull/3391

Update a local copy of the PR:
$ git checkout pull/3391
$ git pull https://git.openjdk.java.net/jdk pull/3391/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 3391

View PR using the GUI difftool:
$ git pr show -t 3391

Using diff file

Download this PR as a diff file:
https://git.openjdk.java.net/jdk/pull/3391.diff

8264864: Multiple byte tag not supported by ASN.1 encoding

bridgekeeper · 2021-04-08T01:07:20Z

👋 Welcome back weijun! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2021-04-08T01:14:59Z

@wangweij The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2021-04-08T01:24:24Z

Webrevs

src/java.base/share/classes/sun/security/util/DerValue.java

XueleiFan

Looks good to me, except a minor comment.

XueleiFan · 2021-04-08T15:53:10Z

src/java.base/share/classes/sun/security/util/DerValue.java

@@ -221,6 +221,9 @@ public boolean isConstructed(byte constructedTag) {
     * Creates a new DerValue by specifying all its fields.
     */
    DerValue(byte tag, byte[] buffer, int start, int end, boolean allowBER) {
+        if ((tag & 0x1f) == 0x1f) {
+            throw new IllegalArgumentException("Tag number 31 is not supported");


As number 31 just means the tag is bigger than 31, Is it more accuracy by using "Tag number over 30 is not supported"?

Well, it's a little delicate here. Even if we support multi-byte tag one day, this constructor will still only be used to create a single-byte tag DerValue, and it's illegal for a single byte tag to end with 0x1f. So the words above is to remind people that they cannot create a tag number 31 DerValue just because it seems it still fits into the 5 bits. Precisely, the words should be "this constructor only supports tag number between 0 and 30", but... I'll choose your words.

It makes sense. Your words is good to me.

openjdk · 2021-04-08T15:54:32Z

@wangweij This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8264864: Multiple byte tag not supported by ASN.1 encoding

Reviewed-by: xuelei

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 58 new commits pushed to the master branch:

5bd6c74: 8236127: Use value of --icon CLI option to set icon for exe installers
81d35e4: 8264063: Outer Safepoint poll load should not reference the head of inner strip mined loop.
04fa1ed: 8264848: [macos] libjvm.dylib linker warning due to macOS version mismatch
214d6e2: 8263506: Make sun.net.httpserver.UnmodifiableHeaders unmodifiable
af13c64: 8264711: More runtime TRAPS cleanups
3aec2d9: 8264718: Shenandoah: enable string deduplication during root scanning
255afbe: 8264672: runtime/ParallelLoad/ParallelSuperTest.java timed out
ec599da: 8264633: Add missing logging to PlatformRecording#stop
e89542f: 8264352: AArch64: Optimize vector "not/andNot" for NEON and SVE
016db40: 8263907: Specification of CellRendererPane::paintComponent(..Rectangle) should clearly mention which method it delegates the call to
... and 48 more: https://git.openjdk.java.net/jdk/compare/9c283da1752db3b8c89cc21016277e43eadd6cf4...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

jnimeh · 2021-04-08T16:58:24Z

src/java.base/share/classes/sun/security/util/DerValue.java

@@ -315,6 +318,9 @@ public DerValue(byte[] encoding) throws IOException {
        }
        int pos = offset;
        tag = buf[pos++];
+        if ((tag & 0x1f) == 0x1f) {
+            throw new IOException("Tag number over 30 is not supported");


Would it be useful for these types of exception messages to either display the offending tag value or perhaps the tag offset? Just thinking it might be a nice thing for the recipient to know where in the DER encoding the issue is.

I don't want to go on reading the following bytes to find out what the intended tag number is, because that somehow shows I do understand the encoding a lot but still don't want to support it (well, actually I only understand a little). There are only 2 kinds of tags: one <= 30 and one >= 31. IMHO, the message has already expressed the meaning that we only support the 1st one.

An alternative message I can think of is "Unsupported tag byte: 0xBF", but it looks too cryptic.

I think that is fair. If you don't want to read ahead like that, what about using the "offset" or "pos" field to give a message like "Tag number over 30 at offset NN is not supported" (something like that, at least) Maybe don't worry about the tag value itself, but at least the position in the data stream. Just a suggestion only, no strong feelings about this either way.

There is an offset value here but I have really no idea if the user knows where to count from. If we say "offset" then we probably need to tell what data block we are talking about. What if the DerValue is just a portion of a bigger data block?

That said, if you really like it, I can add an offset like "tag byte at offset nnnn". I just hope the user can find it.

wangweij · 2021-04-08T20:06:48Z

/integrate

wangweij · 2021-04-08T20:08:20Z

/integrate

wangweij · 2021-04-08T21:17:56Z

/integrate

openjdk · 2021-04-08T21:26:19Z

@wangweij Since your change was applied there have been 61 commits pushed to the master branch:

ccefa5e: 8261625: Add Elements.isAutomaticModule(ModuleElement)
8a23580: 8264428: Cleanup usages of StringBuffer in java.desktop
308f679: 8264454: Jaxp unit test from open jdk needs to be improved
5bd6c74: 8236127: Use value of --icon CLI option to set icon for exe installers
81d35e4: 8264063: Outer Safepoint poll load should not reference the head of inner strip mined loop.
04fa1ed: 8264848: [macos] libjvm.dylib linker warning due to macOS version mismatch
214d6e2: 8263506: Make sun.net.httpserver.UnmodifiableHeaders unmodifiable
af13c64: 8264711: More runtime TRAPS cleanups
3aec2d9: 8264718: Shenandoah: enable string deduplication during root scanning
255afbe: 8264672: runtime/ParallelLoad/ParallelSuperTest.java timed out
... and 51 more: https://git.openjdk.java.net/jdk/compare/9c283da1752db3b8c89cc21016277e43eadd6cf4...master

Your commit was automatically rebased without conflicts.

Pushed as commit 3d2b4cc.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

openjdk · 2021-04-08T21:32:43Z

@wangweij The command integrate can only be used in open pull requests.

openjdk · 2021-04-08T21:41:05Z

@wangweij The command integrate can only be used in open pull requests.

8264864: Multiple byte tag not supported by ASN.1 encoding

d25d3fb

8264864: Multiple byte tag not supported by ASN.1 encoding

openjdk bot added the rfr Pull request is ready for review label Apr 8, 2021

openjdk bot added the security security-dev@openjdk.org label Apr 8, 2021

make sure test fails before code change

46b3700

XueleiFan reviewed Apr 8, 2021

View reviewed changes

src/java.base/share/classes/sun/security/util/DerValue.java Outdated Show resolved Hide resolved

update exception wordings

9b0f9db

XueleiFan approved these changes Apr 8, 2021

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Apr 8, 2021

jnimeh reviewed Apr 8, 2021

View reviewed changes

wangweij added 2 commits April 8, 2021 13:02

change exception message

004b35e

add offset info in exception message

9cb908b

wangweij closed this Apr 8, 2021

wangweij deleted the 8264864 branch April 8, 2021 20:07

wangweij restored the 8264864 branch April 8, 2021 20:08

wangweij reopened this Apr 8, 2021

openjdk bot closed this Apr 8, 2021

openjdk bot added integrated Pull request has been integrated and removed ready Pull request is ready to be integrated labels Apr 8, 2021

openjdk bot removed the rfr Pull request is ready for review label Apr 8, 2021

wangweij deleted the 8264864 branch November 30, 2021 16:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

8264864: Multiple byte tag not supported by ASN.1 encoding #3391

8264864: Multiple byte tag not supported by ASN.1 encoding #3391

wangweij commented Apr 8, 2021 •

edited by openjdk bot

Loading

bridgekeeper bot commented Apr 8, 2021

openjdk bot commented Apr 8, 2021

mlbridge bot commented Apr 8, 2021 •

edited

Loading

XueleiFan left a comment

XueleiFan Apr 8, 2021

wangweij Apr 8, 2021 •

edited

Loading

XueleiFan Apr 8, 2021

openjdk bot commented Apr 8, 2021 •

edited

Loading

jnimeh Apr 8, 2021

wangweij Apr 8, 2021

jnimeh Apr 8, 2021 •

edited

Loading

wangweij Apr 8, 2021 •

edited

Loading

wangweij commented Apr 8, 2021

wangweij commented Apr 8, 2021

wangweij commented Apr 8, 2021

openjdk bot commented Apr 8, 2021

openjdk bot commented Apr 8, 2021

openjdk bot commented Apr 8, 2021

8264864: Multiple byte tag not supported by ASN.1 encoding #3391

8264864: Multiple byte tag not supported by ASN.1 encoding #3391

Conversation

wangweij commented Apr 8, 2021 • edited by openjdk bot Loading

Progress

Issue

Reviewers

Reviewing

bridgekeeper bot commented Apr 8, 2021

openjdk bot commented Apr 8, 2021

mlbridge bot commented Apr 8, 2021 • edited Loading

Webrevs

XueleiFan left a comment

Choose a reason for hiding this comment

XueleiFan Apr 8, 2021

Choose a reason for hiding this comment

wangweij Apr 8, 2021 • edited Loading

Choose a reason for hiding this comment

XueleiFan Apr 8, 2021

Choose a reason for hiding this comment

openjdk bot commented Apr 8, 2021 • edited Loading

jnimeh Apr 8, 2021

Choose a reason for hiding this comment

wangweij Apr 8, 2021

Choose a reason for hiding this comment

jnimeh Apr 8, 2021 • edited Loading

Choose a reason for hiding this comment

wangweij Apr 8, 2021 • edited Loading

Choose a reason for hiding this comment

wangweij commented Apr 8, 2021

wangweij commented Apr 8, 2021

wangweij commented Apr 8, 2021

openjdk bot commented Apr 8, 2021

openjdk bot commented Apr 8, 2021

openjdk bot commented Apr 8, 2021

wangweij commented Apr 8, 2021 •

edited by openjdk bot

Loading

mlbridge bot commented Apr 8, 2021 •

edited

Loading

wangweij Apr 8, 2021 •

edited

Loading

openjdk bot commented Apr 8, 2021 •

edited

Loading

jnimeh Apr 8, 2021 •

edited

Loading

wangweij Apr 8, 2021 •

edited

Loading