archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-27 14:54:52 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8275887: jarsigner prints invalid digest/signature algorithm warnings if keysize is weak/disabled

Browse source 
Reviewed-by: weijun
This commit is contained in:
Sean Mullan 2021-11-19 14:36:07 +00:00
parent 936f7ff49e
commit 03f8c0fb93
9 changed files with 90 additions and 89 deletions
Download patch file Download diff file Expand all files Collapse all files

28
src/java.base/share/classes/sun/security/pkcs/SignerInfo.java
View file

@ -76,10 +76,12 @@ public class SignerInfo implements DerEncoder {
/** /**
* A map containing the algorithms in this SignerInfo. This is used to * A map containing the algorithms in this SignerInfo. This is used to
* avoid checking algorithms to see if they are disabled more than once. * avoid checking algorithms to see if they are disabled more than once.
* The key is the AlgorithmId of the algorithm, and the value is the name of * The key is the AlgorithmId of the algorithm, and the value is a record
* the field or attribute. * containing the name of the field or attribute and whether the key
* should also be checked (ex: if it is a signature algorithm).
*/ */
private Map<AlgorithmId, String> algorithms = new HashMap<>(); private record AlgorithmInfo(String field, boolean checkKey) {}
private Map<AlgorithmId, AlgorithmInfo> algorithms = new HashMap<>();
public SignerInfo(X500Name issuerName, public SignerInfo(X500Name issuerName,
BigInteger serial, BigInteger serial,
@ -350,7 +352,8 @@ public class SignerInfo implements DerEncoder {
} }
String digestAlgName = digestAlgorithmId.getName(); String digestAlgName = digestAlgorithmId.getName();
algorithms.put(digestAlgorithmId, "SignerInfo digestAlgorithm field"); algorithms.put(digestAlgorithmId,
new AlgorithmInfo("SignerInfo digestAlgorithm field", false));
byte[] dataSigned; byte[] dataSigned;
@ -421,7 +424,8 @@ public class SignerInfo implements DerEncoder {
new AlgorithmId(ObjectIdentifier.of(oid), new AlgorithmId(ObjectIdentifier.of(oid),
digestEncryptionAlgorithmId.getParameters()); digestEncryptionAlgorithmId.getParameters());
algorithms.put(sigAlgId, algorithms.put(sigAlgId,
"SignerInfo digestEncryptionAlgorithm field"); new AlgorithmInfo(
"SignerInfo digestEncryptionAlgorithm field", true));
} }
X509Certificate cert = getCertificate(block); X509Certificate cert = getCertificate(block);
@ -677,7 +681,8 @@ public class SignerInfo implements DerEncoder {
throws NoSuchAlgorithmException, SignatureException { throws NoSuchAlgorithmException, SignatureException {
AlgorithmId digestAlgId = token.getHashAlgorithm(); AlgorithmId digestAlgId = token.getHashAlgorithm();
algorithms.put(digestAlgId, "TimestampToken digestAlgorithm field"); algorithms.put(digestAlgId,
new AlgorithmInfo("TimestampToken digestAlgorithm field", false));
MessageDigest md = MessageDigest.getInstance(digestAlgId.getName()); MessageDigest md = MessageDigest.getInstance(digestAlgId.getName());
@ -734,18 +739,19 @@ public class SignerInfo implements DerEncoder {
*/ */
public static Set<String> verifyAlgorithms(SignerInfo[] infos, public static Set<String> verifyAlgorithms(SignerInfo[] infos,
JarConstraintsParameters params, String name) throws SignatureException { JarConstraintsParameters params, String name) throws SignatureException {
Map<AlgorithmId, String> algorithms = new HashMap<>(); Map<AlgorithmId, AlgorithmInfo> algorithms = new HashMap<>();
for (SignerInfo info : infos) { for (SignerInfo info : infos) {
algorithms.putAll(info.algorithms); algorithms.putAll(info.algorithms);
} }
Set<String> enabledAlgorithms = new HashSet<>(); Set<String> enabledAlgorithms = new HashSet<>();
try { try {
for (Map.Entry<AlgorithmId, String> algorithm : algorithms.entrySet()) { for (var algEntry : algorithms.entrySet()) {
params.setExtendedExceptionMsg(name, algorithm.getValue()); AlgorithmInfo info = algEntry.getValue();
AlgorithmId algId = algorithm.getKey(); params.setExtendedExceptionMsg(name, info.field());
AlgorithmId algId = algEntry.getKey();
JAR_DISABLED_CHECK.permits(algId.getName(), JAR_DISABLED_CHECK.permits(algId.getName(),
algId.getParameters(), params); algId.getParameters(), params, info.checkKey());
enabledAlgorithms.add(algId.getName()); enabledAlgorithms.add(algId.getName());
} }
} catch (CertPathValidatorException e) { } catch (CertPathValidatorException e) {

31
src/java.base/share/classes/sun/security/provider/certpath/AlgorithmChecker.java
View file

@ -38,7 +38,6 @@ import java.security.KeyFactory;
import java.security.AlgorithmParameters; import java.security.AlgorithmParameters;
import java.security.GeneralSecurityException; import java.security.GeneralSecurityException;
import java.security.cert.Certificate; import java.security.cert.Certificate;
import java.security.cert.X509CRL;
import java.security.cert.X509Certificate; import java.security.cert.X509Certificate;
import java.security.cert.PKIXCertPathChecker; import java.security.cert.PKIXCertPathChecker;
import java.security.cert.TrustAnchor; import java.security.cert.TrustAnchor;
@ -57,7 +56,6 @@ import sun.security.util.DisabledAlgorithmConstraints;
import sun.security.validator.Validator; import sun.security.validator.Validator;
import sun.security.x509.AlgorithmId; import sun.security.x509.AlgorithmId;
import sun.security.x509.X509CertImpl; import sun.security.x509.X509CertImpl;
import sun.security.x509.X509CRLImpl;
/** /**
* A {@code PKIXCertPathChecker} implementation to check whether a * A {@code PKIXCertPathChecker} implementation to check whether a
@ -226,13 +224,13 @@ public final class AlgorithmChecker extends PKIXCertPathChecker {
CertPathConstraintsParameters cp = CertPathConstraintsParameters cp =
new CertPathConstraintsParameters(trustedPubKey, variant, new CertPathConstraintsParameters(trustedPubKey, variant,
anchor, date); anchor, date);
dac.permits(trustedPubKey.getAlgorithm(), cp); dac.permits(trustedPubKey.getAlgorithm(), cp, true);
} }
// Check the signature algorithm and parameters against constraints // Check the signature algorithm and parameters against constraints
CertPathConstraintsParameters cp = CertPathConstraintsParameters cp =
new CertPathConstraintsParameters(x509Cert, variant, new CertPathConstraintsParameters(x509Cert, variant,
anchor, date); anchor, date);
dac.permits(currSigAlg, currSigAlgParams, cp); dac.permits(currSigAlg, currSigAlgParams, cp, true);
} else { } else {
if (prevPubKey != null) { if (prevPubKey != null) {
if (!constraints.permits(SIGNATURE_PRIMITIVE_SET, if (!constraints.permits(SIGNATURE_PRIMITIVE_SET,
@ -362,29 +360,6 @@ public final class AlgorithmChecker extends PKIXCertPathChecker {
} }
} }
/**
* Check the signature algorithm with the specified public key.
*
* @param key the public key to verify the CRL signature
* @param crl the target CRL
* @param variant the Validator variant of the operation. A null value
* passed will set it to Validator.GENERIC.
* @param anchor the trust anchor selected to validate the CRL issuer
*/
static void check(PublicKey key, X509CRL crl, String variant,
TrustAnchor anchor) throws CertPathValidatorException {
X509CRLImpl x509CRLImpl = null;
try {
x509CRLImpl = X509CRLImpl.toImpl(crl);
} catch (CRLException ce) {
throw new CertPathValidatorException(ce);
}
AlgorithmId algorithmId = x509CRLImpl.getSigAlgId();
check(key, algorithmId, variant, anchor);
}
/** /**
* Check the signature algorithm with the specified public key. * Check the signature algorithm with the specified public key.
* *
@ -399,7 +374,7 @@ public final class AlgorithmChecker extends PKIXCertPathChecker {
DisabledAlgorithmConstraints.certPathConstraints().permits( DisabledAlgorithmConstraints.certPathConstraints().permits(
algorithmId.getName(), algorithmId.getParameters(), algorithmId.getName(), algorithmId.getParameters(),
new CertPathConstraintsParameters(key, variant, anchor, null)); new CertPathConstraintsParameters(key, variant, anchor, null), true);
} }
} }

3
src/java.base/share/classes/sun/security/provider/certpath/DistributionPointFetcher.java
View file

@ -653,7 +653,8 @@ public class DistributionPointFetcher {
// check the crl signature algorithm // check the crl signature algorithm
try { try {
AlgorithmChecker.check(prevKey, crl, variant, anchor); AlgorithmChecker.check(prevKey, crlImpl.getSigAlgId(),
variant, anchor);
} catch (CertPathValidatorException cpve) { } catch (CertPathValidatorException cpve) {
if (debug != null) { if (debug != null) {
debug.println("CRL signature algorithm check failed: " + cpve); debug.println("CRL signature algorithm check failed: " + cpve);

43
src/java.base/share/classes/sun/security/util/DisabledAlgorithmConstraints.java
View file

@ -192,9 +192,9 @@ public class DisabledAlgorithmConstraints extends AbstractAlgorithmConstraints {
} }
public final void permits(String algorithm, AlgorithmParameters ap, public final void permits(String algorithm, AlgorithmParameters ap,
ConstraintsParameters cp) throws CertPathValidatorException { ConstraintsParameters cp, boolean checkKey)
throws CertPathValidatorException {
permits(algorithm, cp); permits(algorithm, cp, checkKey);
if (ap != null) { if (ap != null) {
permits(ap, cp); permits(ap, cp);
} }
@ -219,13 +219,13 @@ public class DisabledAlgorithmConstraints extends AbstractAlgorithmConstraints {
PSSParameterSpec pssParams = PSSParameterSpec pssParams =
ap.getParameterSpec(PSSParameterSpec.class); ap.getParameterSpec(PSSParameterSpec.class);
String digestAlg = pssParams.getDigestAlgorithm(); String digestAlg = pssParams.getDigestAlgorithm();
permits(digestAlg, cp); permits(digestAlg, cp, false);
AlgorithmParameterSpec mgfParams = pssParams.getMGFParameters(); AlgorithmParameterSpec mgfParams = pssParams.getMGFParameters();
if (mgfParams instanceof MGF1ParameterSpec) { if (mgfParams instanceof MGF1ParameterSpec) {
String mgfDigestAlg = String mgfDigestAlg =
((MGF1ParameterSpec)mgfParams).getDigestAlgorithm(); ((MGF1ParameterSpec)mgfParams).getDigestAlgorithm();
if (!mgfDigestAlg.equalsIgnoreCase(digestAlg)) { if (!mgfDigestAlg.equalsIgnoreCase(digestAlg)) {
permits(mgfDigestAlg, cp); permits(mgfDigestAlg, cp, false);
} }
} }
} catch (InvalidParameterSpecException ipse) { } catch (InvalidParameterSpecException ipse) {
@ -233,22 +233,22 @@ public class DisabledAlgorithmConstraints extends AbstractAlgorithmConstraints {
} }
} }
public final void permits(String algorithm, ConstraintsParameters cp) public final void permits(String algorithm, ConstraintsParameters cp,
throws CertPathValidatorException { boolean checkKey) throws CertPathValidatorException {
if (checkKey) {
// Check if named curves in the key are disabled. // Check if named curves in the key are disabled.
for (Key key : cp.getKeys()) { for (Key key : cp.getKeys()) {
for (String curve : getNamedCurveFromKey(key)) { for (String curve : getNamedCurveFromKey(key)) {
if (!checkAlgorithm(disabledAlgorithms, curve, decomposer)) { if (!checkAlgorithm(disabledAlgorithms, curve, decomposer)) {
throw new CertPathValidatorException( throw new CertPathValidatorException(
"Algorithm constraints check failed on disabled " + "Algorithm constraints check failed on disabled " +
"algorithm: " + curve, "algorithm: " + curve,
null, null, -1, BasicReason.ALGORITHM_CONSTRAINED); null, null, -1, BasicReason.ALGORITHM_CONSTRAINED);
}
} }
} }
} }
algorithmConstraints.permits(algorithm, cp, checkKey);
algorithmConstraints.permits(algorithm, cp);
} }
private static List<String> getNamedCurveFromKey(Key key) { private static List<String> getNamedCurveFromKey(Key key) {
@ -481,8 +481,8 @@ public class DisabledAlgorithmConstraints extends AbstractAlgorithmConstraints {
return true; return true;
} }
public void permits(String algorithm, ConstraintsParameters cp) public void permits(String algorithm, ConstraintsParameters cp,
throws CertPathValidatorException { boolean checkKey) throws CertPathValidatorException {
if (debug != null) { if (debug != null) {
debug.println("Constraints.permits(): " + algorithm + ", " debug.println("Constraints.permits(): " + algorithm + ", "
@ -496,8 +496,10 @@ public class DisabledAlgorithmConstraints extends AbstractAlgorithmConstraints {
algorithms.add(algorithm); algorithms.add(algorithm);
} }
for (Key key : cp.getKeys()) { if (checkKey) {
algorithms.add(key.getAlgorithm()); for (Key key : cp.getKeys()) {
algorithms.add(key.getAlgorithm());
}
} }
// Check all applicable constraints // Check all applicable constraints
@ -507,6 +509,9 @@ public class DisabledAlgorithmConstraints extends AbstractAlgorithmConstraints {
continue; continue;
} }
for (Constraint constraint : list) { for (Constraint constraint : list) {
if (!checkKey && constraint instanceof KeySizeConstraint) {
continue;
}
constraint.permits(cp); constraint.permits(cp);
} }
} }

11
src/java.base/share/classes/sun/security/util/JarConstraintsParameters.java
View file

@ -98,16 +98,11 @@ public class JarConstraintsParameters implements ConstraintsParameters {
this.timestamp = latestTimestamp; this.timestamp = latestTimestamp;
} }
public JarConstraintsParameters(List<X509Certificate> chain, Timestamp timestamp) { public JarConstraintsParameters(List<X509Certificate> chain, Date timestamp) {
this.keys = new HashSet<>(); this.keys = new HashSet<>();
this.certsIssuedByAnchor = new HashSet<>(); this.certsIssuedByAnchor = new HashSet<>();
addToCertsAndKeys(chain); addToCertsAndKeys(chain);
if (timestamp != null) { this.timestamp = timestamp;
addToCertsAndKeys(timestamp.getSignerCertPath());
this.timestamp = timestamp.getTimestamp();
} else {
this.timestamp = null;
}
} }
// extract last certificate and signer's public key from chain // extract last certificate and signer's public key from chain
@ -178,7 +173,7 @@ public class JarConstraintsParameters implements ConstraintsParameters {
@Override @Override
public String extendedExceptionMsg() { public String extendedExceptionMsg() {
return message; return message == null ? "." : message;
} }
@Override @Override

4
src/java.base/share/classes/sun/security/util/ManifestEntryVerifier.java
View file

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 1997, 2020, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 1997, 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
* *
* This code is free software; you can redistribute it and/or modify it * This code is free software; you can redistribute it and/or modify it
@ -217,7 +217,7 @@ public class ManifestEntryVerifier {
params.setExtendedExceptionMsg(JarFile.MANIFEST_NAME, params.setExtendedExceptionMsg(JarFile.MANIFEST_NAME,
name + " entry"); name + " entry");
DisabledAlgorithmConstraints.jarConstraints() DisabledAlgorithmConstraints.jarConstraints()
.permits(digest.getAlgorithm(), params); .permits(digest.getAlgorithm(), params, false);
} catch (GeneralSecurityException e) { } catch (GeneralSecurityException e) {
if (debug != null) { if (debug != null) {
debug.println("Digest algorithm is restricted: " + e); debug.println("Digest algorithm is restricted: " + e);

2
src/java.base/share/classes/sun/security/util/SignatureFileVerifier.java
View file

@ -383,7 +383,7 @@ public class SignatureFileVerifier {
try { try {
params.setExtendedExceptionMsg(name + ".SF", key + " attribute"); params.setExtendedExceptionMsg(name + ".SF", key + " attribute");
DisabledAlgorithmConstraints DisabledAlgorithmConstraints
.jarConstraints().permits(algorithm, params); .jarConstraints().permits(algorithm, params, false);
} catch (GeneralSecurityException e) { } catch (GeneralSecurityException e) {
permittedAlgs.put(algorithm, Boolean.FALSE); permittedAlgs.put(algorithm, Boolean.FALSE);
permittedAlgs.put(key.toUpperCase(), Boolean.FALSE); permittedAlgs.put(key.toUpperCase(), Boolean.FALSE);

39
src/jdk.jartool/share/classes/sun/security/tools/jarsigner/Main.java
View file

@ -1018,9 +1018,14 @@ public class Main {
Calendar c = Calendar.getInstance( Calendar c = Calendar.getInstance(
TimeZone.getTimeZone("UTC"), TimeZone.getTimeZone("UTC"),
Locale.getDefault(Locale.Category.FORMAT)); Locale.getDefault(Locale.Category.FORMAT));
c.setTime(tsTokenInfo.getDate()); Date tsDate = tsTokenInfo.getDate();
c.setTime(tsDate);
JarConstraintsParameters jcp = JarConstraintsParameters jcp =
new JarConstraintsParameters(chain, si.getTimestamp()); new JarConstraintsParameters(chain, tsDate);
JarConstraintsParameters jcpts =
new JarConstraintsParameters(
tsSi.getCertificateChain(tsToken),
tsDate);
history = String.format( history = String.format(
rb.getString("history.with.ts"), rb.getString("history.with.ts"),
signer.getSubjectX500Principal(), signer.getSubjectX500Principal(),
@ -1029,9 +1034,9 @@ public class Main {
verifyWithWeak(key, jcp), verifyWithWeak(key, jcp),
c, c,
tsSigner.getSubjectX500Principal(), tsSigner.getSubjectX500Principal(),
verifyWithWeak(tsDigestAlg, DIGEST_PRIMITIVE_SET, true, jcp), verifyWithWeak(tsDigestAlg, DIGEST_PRIMITIVE_SET, true, jcpts),
verifyWithWeak(tsSigAlg, SIG_PRIMITIVE_SET, true, jcp), verifyWithWeak(tsSigAlg, SIG_PRIMITIVE_SET, true, jcpts),
verifyWithWeak(tsKey, jcp)); verifyWithWeak(tsKey, jcpts));
} else { } else {
JarConstraintsParameters jcp = JarConstraintsParameters jcp =
new JarConstraintsParameters(chain, null); new JarConstraintsParameters(chain, null);
@ -1371,13 +1376,13 @@ public class Main {
boolean tsa, JarConstraintsParameters jcp) { boolean tsa, JarConstraintsParameters jcp) {
try { try {
JAR_DISABLED_CHECK.permits(alg, jcp); JAR_DISABLED_CHECK.permits(alg, jcp, false);
} catch (CertPathValidatorException e) { } catch (CertPathValidatorException e) {
disabledAlgFound = true; disabledAlgFound = true;
return String.format(rb.getString("with.disabled"), alg); return String.format(rb.getString("with.disabled"), alg);
} }
try { try {
LEGACY_CHECK.permits(alg, jcp); LEGACY_CHECK.permits(alg, jcp, false);
return alg; return alg;
} catch (CertPathValidatorException e) { } catch (CertPathValidatorException e) {
if (primitiveSet == SIG_PRIMITIVE_SET) { if (primitiveSet == SIG_PRIMITIVE_SET) {
@ -1399,13 +1404,13 @@ public class Main {
private String verifyWithWeak(PublicKey key, JarConstraintsParameters jcp) { private String verifyWithWeak(PublicKey key, JarConstraintsParameters jcp) {
int kLen = KeyUtil.getKeySize(key); int kLen = KeyUtil.getKeySize(key);
try { try {
JAR_DISABLED_CHECK.permits(key.getAlgorithm(), jcp); JAR_DISABLED_CHECK.permits(key.getAlgorithm(), jcp, true);
} catch (CertPathValidatorException e) { } catch (CertPathValidatorException e) {
disabledAlgFound = true; disabledAlgFound = true;
return String.format(rb.getString("key.bit.disabled"), kLen); return String.format(rb.getString("key.bit.disabled"), kLen);
} }
try { try {
LEGACY_CHECK.permits(key.getAlgorithm(), jcp); LEGACY_CHECK.permits(key.getAlgorithm(), jcp, true);
if (kLen >= 0) { if (kLen >= 0) {
return String.format(rb.getString("key.bit"), kLen); return String.format(rb.getString("key.bit"), kLen);
} else { } else {
@ -1422,9 +1427,9 @@ public class Main {
boolean tsa, JarConstraintsParameters jcp) { boolean tsa, JarConstraintsParameters jcp) {
try { try {
JAR_DISABLED_CHECK.permits(alg, jcp); JAR_DISABLED_CHECK.permits(alg, jcp, false);
try { try {
LEGACY_CHECK.permits(alg, jcp); LEGACY_CHECK.permits(alg, jcp, false);
} catch (CertPathValidatorException e) { } catch (CertPathValidatorException e) {
if (primitiveSet == SIG_PRIMITIVE_SET) { if (primitiveSet == SIG_PRIMITIVE_SET) {
legacyAlg |= 2; legacyAlg |= 2;
@ -1451,9 +1456,9 @@ public class Main {
private void checkWeakSign(PrivateKey key, JarConstraintsParameters jcp) { private void checkWeakSign(PrivateKey key, JarConstraintsParameters jcp) {
try { try {
JAR_DISABLED_CHECK.permits(key.getAlgorithm(), jcp); JAR_DISABLED_CHECK.permits(key.getAlgorithm(), jcp, true);
try { try {
LEGACY_CHECK.permits(key.getAlgorithm(), jcp); LEGACY_CHECK.permits(key.getAlgorithm(), jcp, true);
} catch (CertPathValidatorException e) { } catch (CertPathValidatorException e) {
legacyAlg |= 8; legacyAlg |= 8;
} }
@ -1465,12 +1470,12 @@ public class Main {
private static String checkWeakKey(PublicKey key, CertPathConstraintsParameters cpcp) { private static String checkWeakKey(PublicKey key, CertPathConstraintsParameters cpcp) {
int kLen = KeyUtil.getKeySize(key); int kLen = KeyUtil.getKeySize(key);
try { try {
CERTPATH_DISABLED_CHECK.permits(key.getAlgorithm(), cpcp); CERTPATH_DISABLED_CHECK.permits(key.getAlgorithm(), cpcp, true);
} catch (CertPathValidatorException e) { } catch (CertPathValidatorException e) {
return String.format(rb.getString("key.bit.disabled"), kLen); return String.format(rb.getString("key.bit.disabled"), kLen);
} }
try { try {
LEGACY_CHECK.permits(key.getAlgorithm(), cpcp); LEGACY_CHECK.permits(key.getAlgorithm(), cpcp, true);
if (kLen >= 0) { if (kLen >= 0) {
return String.format(rb.getString("key.bit"), kLen); return String.format(rb.getString("key.bit"), kLen);
} else { } else {
@ -1483,12 +1488,12 @@ public class Main {
private static String checkWeakAlg(String alg, CertPathConstraintsParameters cpcp) { private static String checkWeakAlg(String alg, CertPathConstraintsParameters cpcp) {
try { try {
CERTPATH_DISABLED_CHECK.permits(alg, cpcp); CERTPATH_DISABLED_CHECK.permits(alg, cpcp, false);
} catch (CertPathValidatorException e) { } catch (CertPathValidatorException e) {
return String.format(rb.getString("with.disabled"), alg); return String.format(rb.getString("with.disabled"), alg);
} }
try { try {
LEGACY_CHECK.permits(alg, cpcp); LEGACY_CHECK.permits(alg, cpcp, false);
return alg; return alg;
} catch (CertPathValidatorException e) { } catch (CertPathValidatorException e) {
return String.format(rb.getString("with.weak"), alg); return String.format(rb.getString("with.weak"), alg);

18
test/jdk/sun/security/tools/jarsigner/TimestampCheck.java
View file

@ -55,7 +55,7 @@ import sun.security.timestamp.TimestampToken;
/* /*
* @test * @test
* @bug 6543842 6543440 6939248 8009636 8024302 8163304 8169911 8180289 8172404 * @bug 6543842 6543440 6939248 8009636 8024302 8163304 8169911 8180289 8172404
* 8247960 8242068 8269039 * 8247960 8242068 8269039 8275887
* @summary checking response of timestamp * @summary checking response of timestamp
* @modules java.base/sun.security.pkcs * @modules java.base/sun.security.pkcs
* java.base/sun.security.timestamp * java.base/sun.security.timestamp
@ -340,6 +340,7 @@ public class TimestampCheck {
verify("tsdisabled2.jar", "-verbose") verify("tsdisabled2.jar", "-verbose")
.shouldHaveExitValue(16) .shouldHaveExitValue(16)
.shouldContain("treated as unsigned") .shouldContain("treated as unsigned")
.shouldNotMatch("Signature.*(disabled)")
.shouldMatch("Timestamp.*512.*(disabled)"); .shouldMatch("Timestamp.*512.*(disabled)");
// Algorithm used in signing is disabled // Algorithm used in signing is disabled
@ -356,6 +357,8 @@ public class TimestampCheck {
// sign with RSAkeysize < 1024 // sign with RSAkeysize < 1024
signVerbose("normal", "sign1.jar", "sign2.jar", "disabledkeysize") signVerbose("normal", "sign1.jar", "sign2.jar", "disabledkeysize")
.shouldContain("Algorithm constraints check failed on keysize") .shouldContain("Algorithm constraints check failed on keysize")
.shouldNotContain("option is considered a security " +
"risk and is disabled")
.shouldHaveExitValue(4); .shouldHaveExitValue(4);
checkMultiple("sign2.jar"); checkMultiple("sign2.jar");
@ -419,6 +422,17 @@ public class TimestampCheck {
// sign with RSAkeysize < 2048 // sign with RSAkeysize < 2048
signVerbose("normal", "sign1.jar", "sign2.jar", "weakkeysize") signVerbose("normal", "sign1.jar", "sign2.jar", "weakkeysize")
.shouldNotContain("Algorithm constraints check failed on keysize") .shouldNotContain("Algorithm constraints check failed on keysize")
.shouldNotContain("The SHA-256 algorithm specified " +
"for the -digestalg option is considered a " +
"security risk")
.shouldNotContain("The SHA256withRSA algorithm " +
"specified for the -sigalg option is considered " +
"a security risk")
.shouldNotContain("The SHA-256 algorithm specified " +
"for the -tsadigestalg option is considered a " +
"security risk")
.shouldContain("The RSA signing key has a keysize " +
"of 1024 which is considered a security risk")
.shouldHaveExitValue(0); .shouldHaveExitValue(0);
checkMultipleWeak("sign2.jar"); checkMultipleWeak("sign2.jar");
@ -673,7 +687,7 @@ public class TimestampCheck {
.shouldMatch("Timestamp signature algorithm: .*key.*(disabled)"); .shouldMatch("Timestamp signature algorithm: .*key.*(disabled)");
verify(file, "-J-Djava.security.debug=jar") verify(file, "-J-Djava.security.debug=jar")
.shouldHaveExitValue(16) .shouldHaveExitValue(16)
.shouldMatch("SignatureException:.*keysize"); .shouldMatch("SignatureException:.*MD5");
// For 8171319: keytool should print out warnings when reading or // For 8171319: keytool should print out warnings when reading or
// generating cert/cert req using disabled algorithms. // generating cert/cert req using disabled algorithms.