RFR: 8258833: Cancel multi-part cipher operations in SunPKCS11 after failures

Valerie Peng valeriep at openjdk.java.net
Tue Jan 5 19:43:55 UTC 2021


On Mon, 28 Dec 2020 16:24:43 GMT, Martin Balao <mbalao at openjdk.org> wrote:

> When a multi-part cipher operation fails in SunPKCS11 (i.e. because of an invalid block size), we now cancel the operation before returning the underlying Session to the Session Manager. This allows to use the returned Session for a different purpose. Otherwise, an CKR_OPERATION_ACTIVE error would be raised from the PKCS#11 library.
> 
> The jdk/sun/security/pkcs11/Cipher/CancelMultipart.java regression test is introduced as part of this PR.
> 
> No regressions found in jdk/sun/security/pkcs11.

test/jdk/sun/security/pkcs11/Cipher/CancelMultipart.java line 50:

> 48:     }
> 49: 
> 50:     private static class SessionLeaker {

The term "leak/leaker" is used extensively in the test, however, this is not really a leak conceptually, but rather sessions w/ active states/operations which are unusable and lead to unexpected PKCS#11 errors subsequently. Maybe replace it with other terms like "corrupt/corruptor" or other similar terms would be more suitable?

-------------

PR: https://git.openjdk.java.net/jdk/pull/1901



More information about the security-dev mailing list