8255409: Support the new C_GetInterfaceList, C_GetInterface, and C_SessionCancel APIs in PKCS#11 v3.0 #6655

valeriepeng · 2021-12-01T21:42:51Z

PKCS#11 v3.0 adds the support for several new APIs. For this particular RFE, it enhances SunPKCS11 provider to load PKCS#11 provider by first trying the C_GetInterface (new in 3.0) before the C_GetFunctionList assuming not explicitly specified in config. In addition, PKCS#11 v3.0 defines a new API for cancelling session operations, so I've also updated various classes to call this new API if the PKCS#11 library version is 3.0. Otherwise, these classes will try to cancel by finishing off current operations as before. The support for the new C_LoginUser() has not been tested, so I commented it out for now. Given the current release schedule, support for other new PKCS#11 APIs (such as message-based ones and parameters structure) and options for C_GetInterface (if needed) will be handled later.

I validated the current changes against different NSS releases (supports PKCS#11 v2.40 and v3..0 respectively) with existing regression tests.

Thanks,
Valerie

Progress

Change must not contain extraneous whitespace
Commit message must refer to an issue
Change must be properly reviewed

Issue

JDK-8255409: Support the new C_GetInterfaceList, C_GetInterface, and C_SessionCancel APIs in PKCS#11 v3.0

Reviewers

Anthony Scarpino (@ascarpino - Reviewer) ⚠️ Review applies to 6d8d207
Weijun Wang (@wangweij - Reviewer) ⚠️ Review applies to 6d8d207

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.java.net/jdk pull/6655/head:pull/6655
$ git checkout pull/6655

Update a local copy of the PR:
$ git checkout pull/6655
$ git pull https://git.openjdk.java.net/jdk pull/6655/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 6655

View PR using the GUI difftool:
$ git pr show -t 6655

Using diff file

Download this PR as a diff file:
https://git.openjdk.java.net/jdk/pull/6655.diff

bridgekeeper · 2021-12-01T21:43:37Z

👋 Welcome back valeriep! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2021-12-01T21:46:10Z

@valeriepeng The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2021-12-01T21:49:39Z

Webrevs

wangweij · 2021-12-05T05:12:35Z

src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Config.java

@@ -409,65 +415,89 @@ private void parse() throws IOException {
                throw excToken("Unexpected token:");
            }
            String word = st.sval;
-            if (word.equals("name")) {
+            switch (word) {


Since every case has a break it's probably better to use the enhanced switch (case "x" -> ...;). It's safer and also saves quite some lines. An IDE can help you with the conversion.

Sure, I can do that. I tend to use the "->" for switch with less items.

According to JEP 361, the preferred style is to write the statement (if there is only a single line) on the same line as the case label, so you save another one line.

wangweij · 2021-12-05T05:12:35Z

src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11AEADCipher.java

@@ -401,8 +401,27 @@ private void implInit(int opmode, Key key, byte[] iv, int tagLen,
    }

    private void cancelOperation() {
-        // cancel operation by finishing it; avoid killSession as some
-        // hardware vendors may require re-login


The new cancelOperation() methods seems identical everywhere. Is it possible to consolidate it to a helper method like trySessionCancel(token, session, flags)? It can return true if canceled successfully, false if needs a fallback, and can still throw a ProviderException.

I assume you mean the if-() block of code? I can move the code into a helper method inside the P11Util class.

Yes, just keep duplicated lines as few as possible.

ascarpino

Should the NSS supporting 3.0 get added to the changeset for testing?

ascarpino · 2021-12-06T18:50:08Z

src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11PSSSignature.java

-        // cancel operation by finishing it; avoid killSession as some
-        // hardware vendors may require re-login
+        if (token.p11.getVersion().major == 3) {
+            long flags = (mode == M_SIGN? CKF_SIGN : CKF_VERIFY);


I think this is a syntax nit with no space between M_SIGN and '?'

Ok, will add the space.

ascarpino · 2021-12-06T18:50:08Z

src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11KeyWrapCipher.java

+        token.ensureValid();
+
+        if (token.p11.getVersion().major == 3) {
+            long flags = (opmode == Cipher.ENCRYPT_MODE? CKF_ENCRYPT :


I think this is a syntax nit with no space between MODE and '?'

ascarpino · 2021-12-06T18:50:08Z

src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Cipher.java

-        // cancel operation by finishing it; avoid killSession as some
-        // hardware vendors may require re-login
+        if (token.p11.getVersion().major == 3) {
+            long flags = (encrypt? CKF_ENCRYPT : CKF_DECRYPT);


I think this is a syntax nit with no space between "encrypt" and '?'

ascarpino · 2021-12-06T18:50:08Z

src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11AEADCipher.java

-        // hardware vendors may require re-login
+        token.ensureValid();
+        if (token.p11.getVersion().major == 3) {
+            long flags = (encrypt? CKF_ENCRYPT : CKF_DECRYPT);


I think this is a syntax nit with no space between "encrypt" and '?'

ascarpino · 2021-12-06T18:50:08Z

src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Signature.java

-        // hardware vendors may require re-login
+
+        if (token.p11.getVersion().major == 3) {
+            long flags = (mode == M_SIGN? CKF_SIGN : CKF_VERIFY);


M_SIGN ? ...

Ok. BTW, is there a central place for these syntax? I usually just pick up the convention used in the same file.

ascarpino · 2021-12-06T19:00:30Z

I updated my comments because I neglected to read your initial message and went straight to the code review

valeriepeng · 2021-12-07T04:10:53Z

Should the NSS supporting 3.0 get added to the changeset for testing?

Recall there was a bug filed for updating the artifactory NSS version. There was some window build issue, will follow up with the SQE RE again.

wangweij · 2021-12-07T19:13:36Z

src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Util.java

+        if (token.p11.getVersion().major == 3) {
+            try {
+                token.p11.C_SessionCancel(session.id(), flags);
+                status = true;


Or you can just return true here and return false at the end.

Sure, I like this better.

wangweij · 2021-12-08T00:42:10Z

src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11AEADCipher.java

+    }
+
+    // only used by cancelOperation(); cancel by finishing operations
+    // avoid killSession as some hardware vendors may require re-login


Since this method is only called once, maybe we can inline it back inside cancelOperation()?

wangweij · 2021-12-08T15:47:29Z

src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java

@@ -186,11 +203,14 @@ public static synchronized PKCS11 getInstance(String pkcs11ModulePath,
     * native part.
     *
     * @param pkcs11ModulePath The PKCS#11 library path.
+     * @param functionList the method name for retrieving the PKCS#11
+     *         function list; maybe null if not set in config file


s/maybe/may be/.

Sure. Will fix both of the "maybe" s in this file.

wangweij · 2021-12-08T18:44:08Z

src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_sessmgmt.c

@@ -351,7 +378,7 @@ JNIEXPORT void JNICALL Java_sun_security_pkcs11_wrapper_PKCS11_C_1SetOperationSt

    free(ckpState);

-    if (ckAssertReturnValueOK(env, rv) != CK_ASSERT_OK) { return; }
+    ckAssertReturnValueOK(env, rv);


Are you going to apply this change to other places? I see 2 new functions still using the old style.

Sure, I can change the other 2 places.

ascarpino

After my most recent comments are addressed, I'm fine with the change

ascarpino · 2021-12-08T18:45:12Z

src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_sessmgmt.c

+            ckPinLength);
+    free(ckpPinArray);
+
+    if (ckAssertReturnValueOK(env, rv) != CK_ASSERT_OK) { return; }


Given you changed line 381 to not be in a condition, I would assume this could be the same.

Yes, will change.

ascarpino · 2021-12-08T18:45:12Z

src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_sessmgmt.c


    free(ckpPinArray);
+    free(ckpUsername);

    if (ckAssertReturnValueOK(env, rv) != CK_ASSERT_OK) { return; }


Conditional again?

Yes, will change.

openjdk · 2021-12-08T18:45:58Z

@valeriepeng This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8255409: Support the new C_GetInterfaceList, C_GetInterface, and C_SessionCancel APIs in PKCS#11 v3.0

Reviewed-by: ascarpino, weijun

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 170 new commits pushed to the master branch:

03bf55f: 8277980: ObjectMethods::bootstrap throws NPE when lookup is null
3893f4f: 8278330: dump stack trace if the jvmti test nsk/jvmti/GetThreadState/thrstat002 is failed with wrong thread state
b3faecf: 8276116: C2: optimize long range checks in int counted loops
fe2ae8e: 8276904: Optional.toString() is unnecessarily expensive
6e7b7f3: 8278251: Enable "missing-explicit-ctor" check in the jdk.unsupported.desktop module
c83b781: 8278459: ProblemList javax/swing/JTree/4908142/bug4908142.java on macosx-aarch64
8e8fadf: 8278428: ObjectInputStream.readFully range check incorrect
5a80abf: 8272944: Use snippets in jdk.javadoc documentation
fb11d8f: 8272945: Use snippets in java.compiler documentation
42d9b1b: 8277106: Cannot compile certain sources with --release
... and 160 more: https://git.openjdk.java.net/jdk/compare/e30e67670981ee905724787c109b7b7fd2b70b42...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

valeriepeng · 2021-12-08T23:02:54Z

/integrate

openjdk · 2021-12-08T23:04:24Z

Going to push as commit 83e6a4c.
Since your change was applied there have been 171 commits pushed to the master branch:

3cec700: 8278463: [test] Serialization WritePrimitive test revised for readFully test fails
03bf55f: 8277980: ObjectMethods::bootstrap throws NPE when lookup is null
3893f4f: 8278330: dump stack trace if the jvmti test nsk/jvmti/GetThreadState/thrstat002 is failed with wrong thread state
b3faecf: 8276116: C2: optimize long range checks in int counted loops
fe2ae8e: 8276904: Optional.toString() is unnecessarily expensive
6e7b7f3: 8278251: Enable "missing-explicit-ctor" check in the jdk.unsupported.desktop module
c83b781: 8278459: ProblemList javax/swing/JTree/4908142/bug4908142.java on macosx-aarch64
8e8fadf: 8278428: ObjectInputStream.readFully range check incorrect
5a80abf: 8272944: Use snippets in jdk.javadoc documentation
fb11d8f: 8272945: Use snippets in java.compiler documentation
... and 161 more: https://git.openjdk.java.net/jdk/compare/e30e67670981ee905724787c109b7b7fd2b70b42...master

Your commit was automatically rebased without conflicts.

openjdk · 2021-12-08T23:04:42Z

@valeriepeng Pushed as commit 83e6a4c.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

8255409: Support the new APIs in PKCS#11 v3.0

571f022

openjdk bot added the rfr Pull request is ready for review label Dec 1, 2021

openjdk bot added the security security-dev@openjdk.org label Dec 1, 2021

wangweij reviewed Dec 5, 2021

View changes

ascarpino reviewed Dec 6, 2021

View changes

Update to address review feedbacks.

952ee33

wangweij reviewed Dec 7, 2021

View changes

Update to address review comments

061b6b9

wangweij reviewed Dec 8, 2021

View changes

Updated to address review comments.

6d8d207

wangweij reviewed Dec 8, 2021

View changes

valeriepeng changed the title ~~8255409: Support the new APIs in PKCS#11 v3.0~~ 8255409: Support the new C_GetInterfaceList, C_GetInterface, and C_SessionCancel APIs in PKCS#11 v3.0 Dec 8, 2021

wangweij approved these changes Dec 8, 2021

View changes

ascarpino approved these changes Dec 8, 2021

View changes

openjdk bot added the ready Pull request is ready to be integrated label Dec 8, 2021

Update to address review comments.

9492c7b

openjdk bot closed this Dec 8, 2021

openjdk bot added integrated Pull request has been integrated and removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels Dec 8, 2021

8255409: Support the new C_GetInterfaceList, C_GetInterface, and C_SessionCancel APIs in PKCS#11 v3.0 #6655

8255409: Support the new C_GetInterfaceList, C_GetInterface, and C_SessionCancel APIs in PKCS#11 v3.0 #6655

Conversation

valeriepeng commented Dec 1, 2021 • edited by openjdk bot

Progress

Issue

Reviewers

Reviewing

bridgekeeper bot commented Dec 1, 2021

openjdk bot commented Dec 1, 2021

mlbridge bot commented Dec 1, 2021 • edited

Webrevs

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ascarpino left a comment • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ascarpino commented Dec 6, 2021

valeriepeng commented Dec 7, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

valeriepeng Dec 8, 2021 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ascarpino left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

openjdk bot commented Dec 8, 2021 • edited

valeriepeng commented Dec 8, 2021

openjdk bot commented Dec 8, 2021

openjdk bot commented Dec 8, 2021

valeriepeng commented Dec 1, 2021 •

edited by openjdk bot

mlbridge bot commented Dec 1, 2021 •

edited

ascarpino left a comment •

edited

valeriepeng Dec 8, 2021 •

edited

openjdk bot commented Dec 8, 2021 •

edited