archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-28 15:24:43 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8268427: Improve AlgorithmConstraints:checkAlgorithm performance

Browse source 
Co-authored-by: GaofengZhang <zhanggaofeng9@huawei.com>
Reviewed-by: xuelei, ascarpino
This commit is contained in:
Dongbo He 2021-06-26 09:54:47 +00:00 • committed by Hamlin Li
parent 68ef21db41
commit 3b83bc1bc3
4 changed files with 95 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

39
src/java.base/share/classes/sun/security/util/AbstractAlgorithmConstraints.java
View file

@ -32,6 +32,7 @@ import java.security.Security;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.TreeSet;
import java.util.List;
import java.util.Set;
@ -48,7 +49,7 @@ public abstract class AbstractAlgorithmConstraints
}
// Get algorithm constraints from the specified security property.
static List<String> getAlgorithms(String propertyName) {
static Set<String> getAlgorithms(String propertyName) {
@SuppressWarnings("removal")
String property = AccessController.doPrivileged(
new PrivilegedAction<String>() {
@ -73,39 +74,31 @@ public abstract class AbstractAlgorithmConstraints
// map the disabled algorithms
if (algorithmsInProperty == null) {
return Collections.emptyList();
return Collections.emptySet();
}
return new ArrayList<>(Arrays.asList(algorithmsInProperty));
Set<String> algorithmsInPropertySet = new TreeSet<>(String.CASE_INSENSITIVE_ORDER);
algorithmsInPropertySet.addAll(Arrays.asList(algorithmsInProperty));
return algorithmsInPropertySet;
}
static boolean checkAlgorithm(List<String> algorithms, String algorithm,
static boolean checkAlgorithm(Set<String> algorithms, String algorithm,
AlgorithmDecomposer decomposer) {
if (algorithm == null || algorithm.isEmpty()) {
throw new IllegalArgumentException("No algorithm name specified");
}
Set<String> elements = null;
for (String item : algorithms) {
if (item == null || item.isEmpty()) {
continue;
}
if (algorithms.contains(algorithm)) {
return false;
}
// check the full name
if (item.equalsIgnoreCase(algorithm)) {
// decompose the algorithm into sub-elements
Set<String> elements = decomposer.decompose(algorithm);
// check the element of the elements
for (String element : elements) {
if (algorithms.contains(element)) {
return false;
}
// decompose the algorithm into sub-elements
if (elements == null) {
elements = decomposer.decompose(algorithm);
}
// check the items of the algorithm
for (String element : elements) {
if (item.equalsIgnoreCase(element)) {
return false;
}
}
}
return true;

28
src/java.base/share/classes/sun/security/util/DisabledAlgorithmConstraints.java
View file

@ -85,6 +85,9 @@ public class DisabledAlgorithmConstraints extends AbstractAlgorithmConstraints {
private static final String PROPERTY_DISABLED_EC_CURVES =
"jdk.disabled.namedCurves";
private static final Pattern INCLUDE_PATTERN = Pattern.compile("include " +
PROPERTY_DISABLED_EC_CURVES, Pattern.CASE_INSENSITIVE);
private static class CertPathHolder {
static final DisabledAlgorithmConstraints CONSTRAINTS =
new DisabledAlgorithmConstraints(PROPERTY_CERTPATH_DISABLED_ALGS);
@ -95,7 +98,7 @@ public class DisabledAlgorithmConstraints extends AbstractAlgorithmConstraints {
new DisabledAlgorithmConstraints(PROPERTY_JAR_DISABLED_ALGS);
}
private final List<String> disabledAlgorithms;
private final Set<String> disabledAlgorithms;
private final Constraints algorithmConstraints;
public static DisabledAlgorithmConstraints certPathConstraints() {
@ -130,21 +133,14 @@ public class DisabledAlgorithmConstraints extends AbstractAlgorithmConstraints {
disabledAlgorithms = getAlgorithms(propertyName);
// Check for alias
int ecindex = -1, i = 0;
for (String s : disabledAlgorithms) {
if (s.regionMatches(true, 0,"include ", 0, 8)) {
if (s.regionMatches(true, 8, PROPERTY_DISABLED_EC_CURVES, 0,
PROPERTY_DISABLED_EC_CURVES.length())) {
ecindex = i;
break;
}
Matcher matcher = INCLUDE_PATTERN.matcher(s);
if (matcher.matches()) {
disabledAlgorithms.remove(matcher.group());
disabledAlgorithms.addAll(
getAlgorithms(PROPERTY_DISABLED_EC_CURVES));
break;
}
i++;
}
if (ecindex > -1) {
disabledAlgorithms.remove(ecindex);
disabledAlgorithms.addAll(ecindex,
getAlgorithms(PROPERTY_DISABLED_EC_CURVES));
}
algorithmConstraints = new Constraints(propertyName, disabledAlgorithms);
}
@ -332,8 +328,8 @@ public class DisabledAlgorithmConstraints extends AbstractAlgorithmConstraints {
"denyAfter\\s+(\\d{4})-(\\d{2})-(\\d{2})");
}
public Constraints(String propertyName, List<String> constraintArray) {
for (String constraintEntry : constraintArray) {
public Constraints(String propertyName, Set<String> constraintSet) {
for (String constraintEntry : constraintSet) {
if (constraintEntry == null || constraintEntry.isEmpty()) {
continue;
}

2
src/java.base/share/classes/sun/security/util/LegacyAlgorithmConstraints.java
View file

@ -40,7 +40,7 @@ public class LegacyAlgorithmConstraints extends AbstractAlgorithmConstraints {
public static final String PROPERTY_TLS_LEGACY_ALGS =
"jdk.tls.legacyAlgorithms";
private final List<String> legacyAlgorithms;
private final Set<String> legacyAlgorithms;
public LegacyAlgorithmConstraints(String propertyName,
AlgorithmDecomposer decomposer) {