8280703: CipherCore.doFinal(...) causes potentially massive byte[] allocations during decryption #1780

asgibbons · 2023-02-27T17:58:21Z

Backporting because this change results in ~3x performance improvement in AES-CTR.

Risk is low. Tested with tier1 and benchmark.

The PR does not backport cleanly. The buffer name was changed, but functionally remains the same.

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issue

JDK-8280703: CipherCore.doFinal(...) causes potentially massive byte[] allocations during decryption

Reviewers

Christoph Langer (@RealCLanger - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk11u-dev pull/1780/head:pull/1780
$ git checkout pull/1780

Update a local copy of the PR:
$ git checkout pull/1780
$ git pull https://git.openjdk.org/jdk11u-dev pull/1780/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 1780

View PR using the GUI difftool:
$ git pr show -t 1780

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk11u-dev/pull/1780.diff

bridgekeeper · 2023-02-27T17:59:23Z

👋 Welcome back sgibbons! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2023-02-27T18:01:48Z

This backport pull request has now been updated with issue from the original commit.

mlbridge · 2023-02-27T18:06:51Z

Webrevs

RealCLanger

LGTM

RealCLanger · 2023-02-27T21:41:36Z

can you please run GHA

openjdk · 2023-02-27T21:43:52Z

@asgibbons This change now passes all automated pre-integration checks.

After integration, the commit message for the final commit will be:

8280703: CipherCore.doFinal(...) causes potentially massive byte[] allocations during decryption

Reviewed-by: clanger

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 16 new commits pushed to the master branch:

0748e2a: 8303432: Bump update version for OpenJDK: jdk-11.0.20
8a726af: 8264299: Create implementation of native accessibility peer for ScrollPane and ScrollBar Java Accessibility roles
915ac57: 8302000: [11u] A subtle race condition during jdk11u build
125cf5a: 8295530: Update Zlib Data Compression Library to Version 1.2.13
de6d2c9: 8190492: Remove SSLv2Hello and SSLv3 from default enabled TLS protocols
2405ca6: 8299520: TestPrintXML.java output error messages in case compare fails
bd9c2fb: 8290197: test/jdk/java/nio/file/Files/probeContentType/Basic.java fails on some systems for the ".rar" extension
15bdc4d: 8235448: code cleanup in SSLContextImpl.java
5802a9a: 8245654: Add Certigna Root CA
86b8ea8: 8295777: java/net/httpclient/ConnectExceptionTest.java should not rely on system resolver
... and 6 more: https://git.openjdk.org/jdk11u-dev/compare/cfb05cb26d1b16fc12c2ba2486d00b8ebacc04da...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

As you do not have Committer status in this project an existing Committer must agree to sponsor your change. Possible candidates are the reviewers of this PR (@RealCLanger) but any other Committer may sponsor as well.

➡️ To flag this PR as ready for integration with the above commit message, type /integrate in a new comment. (Afterwards, your sponsor types /sponsor in a new comment to perform the integration).

asgibbons · 2023-02-27T21:46:59Z

Noob here - what is GHA?

RealCLanger · 2023-02-28T15:22:26Z

Noob here - what is GHA?

GHA= GitHub Actions. You have to enable it in your repository fork. Then you will also be able to trigger the run for your PR branch.

asgibbons · 2023-02-28T15:56:29Z

Thanks @RealCLanger. I triggered a run and will integrate when complete.

RealCLanger

Hm after your merges the resulting change looks incorrect.

asgibbons · 2023-03-01T22:17:06Z

@RealCLanger - Sorry for the churn. I had a slight mixup in the myriad of JDK trees I'm concurrently maintaining. I fixed the issue and manual testing along with tier1 testing have successfully completed.

Please review and approve if this is acceptable.

sviswa7 · 2023-03-02T22:08:08Z

@ascarpino Could you please help review this backport CR?

RealCLanger

I had a closer look now. Overall it seems ok. Could you maybe rename outWithPadding to internalOutput? That would bring the code closer to head and seems the more logical name for the buffer. Thanks.

RealCLanger · 2023-03-05T21:17:16Z

src/java.base/share/classes/com/sun/crypto/provider/CipherCore.java

-            System.arraycopy(outWithPadding, 0, output, outputOffset, outLen);
-            // decrypt mode. Zero out output data that's not required
-            Arrays.fill(outWithPadding, (byte) 0x00);
+            if(outWithPadding != null) {


Please add a space after if

RealCLanger · 2023-03-06T15:51:20Z

src/java.base/share/classes/com/sun/crypto/provider/CipherCore.java

@@ -968,9 +974,9 @@ private void endDoFinal() {
        }
    }

-    private int unpad(int outLen, byte[] outWithPadding)


Here the variable should remain outWithPadding.

RealCLanger · 2023-03-06T15:51:31Z

src/java.base/share/classes/com/sun/crypto/provider/CipherCore.java

            throws BadPaddingException {
-        int padStart = padding.unpad(outWithPadding, 0, outLen);


RealCLanger · 2023-03-06T17:04:03Z

Thanks. This looks good. I'll run it through SAP'S nightlies and will hopefully approve tomorrow when no regressions spotted.

asgibbons · 2023-03-06T17:30:27Z

Thank you very much @RealCLanger !

ascarpino · 2023-03-06T19:05:45Z

The backport looks consistent with what was put in recent releases.

ascarpino · 2023-03-06T19:33:27Z

Something that should be verified is that this doesn't expose failed auth tag decrypted GCM data or other GCM decryption. There maybe some unexpected differences as this change was after GCM separated from CipherCore in 17. I believe GCM still uses CipherCore in 11.

asgibbons · 2023-03-06T21:27:20Z

Thanks, @ascarpino. Are there any tests I can run to verify that no GCM data have been exposed? It appears to me that there's one place where decrypted data could be leaked (ShortBufferException), but this is the same in newer versions.

RealCLanger

Looks good from my perspective now. SAP tests passed. Can't say anything to the GCM topic brought up by @ascarpino, though.

asgibbons · 2023-03-07T19:20:06Z

@ascarpino I have been looking to see whether any data could be potentially leaked as a result of my change and cannot envision such a scenario. It appears to me that my change is functionally identical to what it would be without the change. Can you please provide more details? Thanks.

asgibbons · 2023-03-09T15:46:13Z

I believe there is no additional risk to data leakage as the result of this change, so I'm proposing integration. Thanks.

/integrate

openjdk · 2023-03-09T15:47:59Z

@asgibbons
Your change (at version 9b7ef4a) is now ready to be sponsored by a Committer.

RealCLanger · 2023-03-10T09:17:04Z

I believe there is no additional risk to data leakage as the result of this change, so I'm proposing integration. Thanks.

/integrate

ok

/sponsor

openjdk · 2023-03-10T09:19:36Z

Going to push as commit 479ddb6.
Since your change was applied there have been 18 commits pushed to the master branch:

7d89919: 8289301: P11Cipher should not throw out of bounds exception during padding
80615a6: 8293815: P11PSSSignature.engineUpdate should not print debug messages during normal operation
0748e2a: 8303432: Bump update version for OpenJDK: jdk-11.0.20
8a726af: 8264299: Create implementation of native accessibility peer for ScrollPane and ScrollBar Java Accessibility roles
915ac57: 8302000: [11u] A subtle race condition during jdk11u build
125cf5a: 8295530: Update Zlib Data Compression Library to Version 1.2.13
de6d2c9: 8190492: Remove SSLv2Hello and SSLv3 from default enabled TLS protocols
2405ca6: 8299520: TestPrintXML.java output error messages in case compare fails
bd9c2fb: 8290197: test/jdk/java/nio/file/Files/probeContentType/Basic.java fails on some systems for the ".rar" extension
15bdc4d: 8235448: code cleanup in SSLContextImpl.java
... and 8 more: https://git.openjdk.org/jdk11u-dev/compare/cfb05cb26d1b16fc12c2ba2486d00b8ebacc04da...master

Your commit was automatically rebased without conflicts.

openjdk · 2023-03-10T09:20:12Z

@RealCLanger @asgibbons Pushed as commit 479ddb6.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

Backport 409382ba4b43bf48ed0086020dd20641effd35b6

e893476

openjdk bot changed the title ~~Backport 409382ba4b43bf48ed0086020dd20641effd35b6~~ 8280703: CipherCore.doFinal(...) causes potentially massive byte[] allocations during decryption Feb 27, 2023

openjdk bot added backport rfr Pull request is ready for review labels Feb 27, 2023

RealCLanger approved these changes Feb 27, 2023

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Feb 27, 2023

asgibbons added 3 commits February 28, 2023 09:17

Fixed bad merge

e09abff

Fixed bad merge

2196026

Fixed bad merge

6d37596

RealCLanger suggested changes Mar 1, 2023

View reviewed changes

openjdk bot removed the ready Pull request is ready to be integrated label Mar 1, 2023

Fix initialization of offset

a4a93c5

RealCLanger suggested changes Mar 5, 2023

View reviewed changes

Address review comment

9b07d2b

RealCLanger suggested changes Mar 6, 2023

View reviewed changes

Address review comment

9b7ef4a

RealCLanger approved these changes Mar 7, 2023

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Mar 7, 2023

openjdk bot added the sponsor Pull request is ready to be sponsored label Mar 9, 2023

openjdk bot added the integrated Pull request has been integrated label Mar 10, 2023

openjdk bot closed this Mar 10, 2023

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review sponsor Pull request is ready to be sponsored labels Mar 10, 2023

8280703: CipherCore.doFinal(...) causes potentially massive byte[] allocations during decryption #1780

8280703: CipherCore.doFinal(...) causes potentially massive byte[] allocations during decryption #1780

asgibbons commented Feb 27, 2023 •

edited by openjdk bot

bridgekeeper bot commented Feb 27, 2023

openjdk bot commented Feb 27, 2023

mlbridge bot commented Feb 27, 2023 •

edited

RealCLanger left a comment

RealCLanger commented Feb 27, 2023

openjdk bot commented Feb 27, 2023 •

edited

asgibbons commented Feb 27, 2023

RealCLanger commented Feb 28, 2023

asgibbons commented Feb 28, 2023

RealCLanger left a comment

asgibbons commented Mar 1, 2023

sviswa7 commented Mar 2, 2023

RealCLanger left a comment

RealCLanger Mar 5, 2023

RealCLanger Mar 6, 2023

RealCLanger Mar 6, 2023

RealCLanger commented Mar 6, 2023

asgibbons commented Mar 6, 2023

ascarpino commented Mar 6, 2023

ascarpino commented Mar 6, 2023

asgibbons commented Mar 6, 2023

RealCLanger left a comment •

edited

asgibbons commented Mar 7, 2023

asgibbons commented Mar 9, 2023

openjdk bot commented Mar 9, 2023

RealCLanger commented Mar 10, 2023

openjdk bot commented Mar 10, 2023

openjdk bot commented Mar 10, 2023

		throws BadPaddingException {
		int padStart = padding.unpad(outWithPadding, 0, outLen);

8280703: CipherCore.doFinal(...) causes potentially massive byte[] allocations during decryption #1780

8280703: CipherCore.doFinal(...) causes potentially massive byte[] allocations during decryption #1780

Conversation

asgibbons commented Feb 27, 2023 • edited by openjdk bot

Progress

Issue

Reviewers

Reviewing

bridgekeeper bot commented Feb 27, 2023

openjdk bot commented Feb 27, 2023

mlbridge bot commented Feb 27, 2023 • edited

Webrevs

RealCLanger left a comment

Choose a reason for hiding this comment

RealCLanger commented Feb 27, 2023

openjdk bot commented Feb 27, 2023 • edited

asgibbons commented Feb 27, 2023

RealCLanger commented Feb 28, 2023

asgibbons commented Feb 28, 2023

RealCLanger left a comment

Choose a reason for hiding this comment

asgibbons commented Mar 1, 2023

sviswa7 commented Mar 2, 2023

RealCLanger left a comment

Choose a reason for hiding this comment

RealCLanger Mar 5, 2023

Choose a reason for hiding this comment

RealCLanger Mar 6, 2023

Choose a reason for hiding this comment

RealCLanger Mar 6, 2023

Choose a reason for hiding this comment

RealCLanger commented Mar 6, 2023

asgibbons commented Mar 6, 2023

ascarpino commented Mar 6, 2023

ascarpino commented Mar 6, 2023

asgibbons commented Mar 6, 2023

RealCLanger left a comment • edited

Choose a reason for hiding this comment

asgibbons commented Mar 7, 2023

asgibbons commented Mar 9, 2023

openjdk bot commented Mar 9, 2023

RealCLanger commented Mar 10, 2023

openjdk bot commented Mar 10, 2023

openjdk bot commented Mar 10, 2023

asgibbons commented Feb 27, 2023 •

edited by openjdk bot

mlbridge bot commented Feb 27, 2023 •

edited

openjdk bot commented Feb 27, 2023 •

edited

RealCLanger left a comment •

edited