Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

8265462: Handle multiple slots in the NSS Internal Module from SunPKCS11's Secmod #3661

Closed
wants to merge 2 commits into from

Conversation

martinuy
Copy link
Contributor

@martinuy martinuy commented Apr 23, 2021

Hi,

Please find in this PR a proposal to fix JDK-8265462 [1].

With this fix, OpenJDK will only use the known slot IDs for the NSS Internal Module. If the NSS Internal Module has more slots (for example, as a result of an initialization sequence such as the one triggered from the libnsssysinit.so library), they will be ignored. The goal is to handle multiple-slots scenarios while keeping OpenJDK's previous behavior.

No regressions observed in the jdk/sun/security/pkcs11 tests category.

A new regression test was not added as part of this changeset because of its complexity. It would depend on a specific NSS configuration, or the NSS library would need to be mocked. I've done manual testing in my environment and JDK-8265462 [1] has further information about it.

Thanks,
Martin.-

--
[1] - https://bugs.openjdk.java.net/browse/JDK-8265462


Progress

  • Change must not contain extraneous whitespace
  • Commit message must refer to an issue
  • Change must be properly reviewed

Issue

  • JDK-8265462: Handle multiple slots in the NSS Internal Module from SunPKCS11's Secmod

Reviewers

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.java.net/jdk pull/3661/head:pull/3661
$ git checkout pull/3661

Update a local copy of the PR:
$ git checkout pull/3661
$ git pull https://git.openjdk.java.net/jdk pull/3661/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 3661

View PR using the GUI difftool:
$ git pr show -t 3661

Using diff file

Download this PR as a diff file:
https://git.openjdk.java.net/jdk/pull/3661.diff

@bridgekeeper
Copy link

bridgekeeper bot commented Apr 23, 2021

👋 Welcome back mbalao! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

@openjdk openjdk bot added the rfr Pull request is ready for review label Apr 23, 2021
@openjdk
Copy link

openjdk bot commented Apr 23, 2021

@martinuy The following label will be automatically applied to this pull request:

  • security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

@openjdk openjdk bot added the security security-dev@openjdk.org label Apr 23, 2021
@mlbridge
Copy link

mlbridge bot commented Apr 23, 2021

Webrevs

Copy link
Contributor

@valeriepeng valeriepeng left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here are some comments. Rest looks fine. Thanks. Valerie

@martinuy
Copy link
Contributor Author

@valeriepeng can you please take one more look at the changes?

No regressions found in jdk/sun/security/pkcs11 tests category.

Copy link
Contributor

@valeriepeng valeriepeng left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The updates look good. Thanks! Valerie

@openjdk
Copy link

openjdk bot commented May 18, 2021

@martinuy This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8265462: Handle multiple slots in the NSS Internal Module from SunPKCS11's Secmod

Reviewed-by: valeriep

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 386 new commits pushed to the master branch:

  • fadf580: 8262952: [macos_aarch64] os::commit_memory failure
  • f8f40ab: 8230486: G1BarrierSetAssembler::g1_write_barrier_post unnecessarily pushes/pops new_val
  • 9d168e2: 8266973: Migrate to ClassHierarchyIterator when enumerating subclasses
  • 02507bc: 8267166: Remove test file vmTestbase/vm/mlvm/tools/LoadClass.java
  • ce88b33: 8266615: C2 incorrectly folds subtype checks involving an interface array
  • 894547d: 8266897: com/sun/net/httpserver/FilterTest.java fails intermittently with AssertionError
  • da7c846: 8264408: test_oopStorage no longer needs to disable some tests on WIN32
  • f6c2891: 8267229: Split runtime/Metaspace/elastic test configurations for better scalability
  • b60975d: 8267237: ARM32: bad AD file in matcher.cpp after 8266810
  • 905b41a: 8265711: C1: Intrinsify Class.getModifier method
  • ... and 376 more: https://git.openjdk.java.net/jdk/compare/5aab1609b97284ccff8b7ae20a3ddcf1e29c47d7...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

@openjdk openjdk bot added the ready Pull request is ready to be integrated label May 18, 2021
@martinuy
Copy link
Contributor Author

/integrate

@martinuy martinuy closed this May 18, 2021
@openjdk openjdk bot added integrated Pull request has been integrated and removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels May 18, 2021
@openjdk
Copy link

openjdk bot commented May 18, 2021

@martinuy Since your change was applied there have been 389 commits pushed to the master branch:

  • 10236e7: 8263242: serviceability/sa/ClhsdbFindPC.java cannot find MaxJNILocalCapacity with ASLR
  • e6705c0: 8266949: Check possibility to disable OperationTimedOut on Unix
  • b92c5a4: 8265292: [macos_aarch64] java/foreign/TestDowncall.java crashes with SIGBUS
  • fadf580: 8262952: [macos_aarch64] os::commit_memory failure
  • f8f40ab: 8230486: G1BarrierSetAssembler::g1_write_barrier_post unnecessarily pushes/pops new_val
  • 9d168e2: 8266973: Migrate to ClassHierarchyIterator when enumerating subclasses
  • 02507bc: 8267166: Remove test file vmTestbase/vm/mlvm/tools/LoadClass.java
  • ce88b33: 8266615: C2 incorrectly folds subtype checks involving an interface array
  • 894547d: 8266897: com/sun/net/httpserver/FilterTest.java fails intermittently with AssertionError
  • da7c846: 8264408: test_oopStorage no longer needs to disable some tests on WIN32
  • ... and 379 more: https://git.openjdk.java.net/jdk/compare/5aab1609b97284ccff8b7ae20a3ddcf1e29c47d7...master

Your commit was automatically rebased without conflicts.

Pushed as commit bdbe23b.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

@martinuy martinuy deleted the JDK-8265462 branch May 18, 2021 23:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
integrated Pull request has been integrated security security-dev@openjdk.org
Development

Successfully merging this pull request may close these issues.

2 participants