archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-28 07:14:30 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge

Browse source
This commit is contained in:
Jesper Wilhelmsson 2020-01-16 04:09:50 +01:00
commit 51d5164ca2
102 changed files with 2027 additions and 937 deletions
Download patch file Download diff file Expand all files Collapse all files

61
src/java.base/share/classes/com/sun/crypto/provider/JceKeyStore.java
View file

@ -26,6 +26,7 @@
package com.sun.crypto.provider;
import sun.security.util.Debug;
import sun.security.util.IOUtils;
import java.io.*;
import java.util.*;
@ -73,7 +74,7 @@ public final class JceKeyStore extends KeyStoreSpi {
private static final class PrivateKeyEntry {
Date date; // the creation date of this entry
byte[] protectedKey;
Certificate chain[];
Certificate[] chain;
};
// Secret key
@ -742,23 +743,11 @@ public final class JceKeyStore extends KeyStoreSpi {
entry.date = new Date(dis.readLong());
// read the private key
try {
entry.protectedKey = new byte[dis.readInt()];
} catch (OutOfMemoryError e) {
throw new IOException("Keysize too big");
}
dis.readFully(entry.protectedKey);
entry.protectedKey = IOUtils.readExactlyNBytes(dis, dis.readInt());
// read the certificate chain
int numOfCerts = dis.readInt();
try {
if (numOfCerts > 0) {
entry.chain = new Certificate[numOfCerts];
}
} catch (OutOfMemoryError e) {
throw new IOException("Too many certificates in "
+ "chain");
}
List<Certificate> tmpCerts = new ArrayList<>();
for (int j = 0; j < numOfCerts; j++) {
if (xVersion == 2) {
// read the certificate type, and instantiate a
@ -766,27 +755,24 @@ public final class JceKeyStore extends KeyStoreSpi {
// existing factory if possible)
String certType = dis.readUTF();
if (cfs.containsKey(certType)) {
// reuse certificate factory
// reuse certificate factory
cf = cfs.get(certType);
} else {
// create new certificate factory
// create new certificate factory
cf = CertificateFactory.getInstance(
certType);
// store the certificate factory so we can
// reuse it later
// store the certificate factory so we can
// reuse it later
cfs.put(certType, cf);
}
}
// instantiate the certificate
try {
encoded = new byte[dis.readInt()];
} catch (OutOfMemoryError e) {
throw new IOException("Certificate too big");
}
dis.readFully(encoded);
encoded = IOUtils.readExactlyNBytes(dis, dis.readInt());
bais = new ByteArrayInputStream(encoded);
entry.chain[j] = cf.generateCertificate(bais);
tmpCerts.add(cf.generateCertificate(bais));
}
entry.chain = tmpCerts.toArray(
new Certificate[numOfCerts]);
// Add the entry to the list
entries.put(alias, entry);
@ -818,12 +804,7 @@ public final class JceKeyStore extends KeyStoreSpi {
cfs.put(certType, cf);
}
}
try {
encoded = new byte[dis.readInt()];
} catch (OutOfMemoryError e) {
throw new IOException("Certificate too big");
}
dis.readFully(encoded);
encoded = IOUtils.readExactlyNBytes(dis, dis.readInt());
bais = new ByteArrayInputStream(encoded);
entry.cert = cf.generateCertificate(bais);
@ -882,18 +863,14 @@ public final class JceKeyStore extends KeyStoreSpi {
* with
*/
if (password != null) {
byte computed[], actual[];
computed = md.digest();
actual = new byte[computed.length];
dis.readFully(actual);
for (int i = 0; i < computed.length; i++) {
if (computed[i] != actual[i]) {
throw new IOException(
byte[] computed = md.digest();
byte[] actual = IOUtils.readExactlyNBytes(dis, computed.length);
if (!MessageDigest.isEqual(computed, actual)) {
throw new IOException(
"Keystore was tampered with, or "
+ "password was incorrect",
new UnrecoverableKeyException(
"Password verification failed"));
}
new UnrecoverableKeyException(
"Password verification failed"));
}
}
} finally {

19
src/java.base/share/classes/java/io/ObjectInputFilter.java
View file

@ -35,6 +35,7 @@ import java.util.Optional;
import java.util.function.Function;
import jdk.internal.access.SharedSecrets;
import jdk.internal.util.StaticProperty;
/**
* Filter classes, array lengths, and graph metrics during deserialization.
@ -205,15 +206,17 @@ public interface ObjectInputFilter {
* <p>
* The filter is configured during the initialization of the {@code ObjectInputFilter.Config}
* class. For example, by calling {@link #getSerialFilter() Config.getSerialFilter}.
* If the system property {@systemProperty jdk.serialFilter} is defined, it is used
* to configure the filter.
* If the system property is not defined, and the {@link java.security.Security}
* property {@code jdk.serialFilter} is defined then it is used to configure the filter.
* Otherwise, the filter is not configured during initialization.
* If the system property {@systemProperty jdk.serialFilter} is defined on the command line,
* it is used to configure the filter.
* If the system property is not defined on the command line, and the
* {@link java.security.Security} property {@code jdk.serialFilter} is defined
* then it is used to configure the filter.
* Otherwise, the filter is not configured during initialization and
* can be set with {@link #setSerialFilter(ObjectInputFilter) Config.setSerialFilter}.
* Setting the {@code jdk.serialFilter} with {@link System#setProperty(String, String)
* System.setProperty} <em>does not set the filter</em>.
* The syntax for each property is the same as for the
* {@link #createFilter(String) createFilter} method.
* If a filter is not configured, it can be set with
* {@link #setSerialFilter(ObjectInputFilter) Config.setSerialFilter}.
*
* @since 9
*/
@ -256,7 +259,7 @@ public interface ObjectInputFilter {
static {
configuredFilter = AccessController
.doPrivileged((PrivilegedAction<ObjectInputFilter>) () -> {
String props = System.getProperty(SERIAL_FILTER_PROPNAME);
String props = StaticProperty.jdkSerialFilter();
if (props == null) {
props = Security.getProperty(SERIAL_FILTER_PROPNAME);
}

76
src/java.base/share/classes/java/io/ObjectInputStream.java
View file

@ -453,16 +453,50 @@ public class ObjectInputStream
* @throws IOException Any of the usual Input/Output related exceptions.
*/
public final Object readObject()
throws IOException, ClassNotFoundException {
return readObject(Object.class);
}
/**
* Reads a String and only a string.
*
* @return the String read
* @throws EOFException If end of file is reached.
* @throws IOException If other I/O error has occurred.
*/
private String readString() throws IOException {
try {
return (String) readObject(String.class);
} catch (ClassNotFoundException cnf) {
throw new IllegalStateException(cnf);
}
}
/**
* Internal method to read an object from the ObjectInputStream of the expected type.
* Called only from {@code readObject()} and {@code readString()}.
* Only {@code Object.class} and {@code String.class} are supported.
*
* @param type the type expected; either Object.class or String.class
* @return an object of the type
* @throws IOException Any of the usual Input/Output related exceptions.
* @throws ClassNotFoundException Class of a serialized object cannot be
* found.
*/
private final Object readObject(Class<?> type)
throws IOException, ClassNotFoundException
{
if (enableOverride) {
return readObjectOverride();
}
if (! (type == Object.class || type == String.class))
throw new AssertionError("internal error");
// if nested read, passHandle contains handle of enclosing object
int outerHandle = passHandle;
try {
Object obj = readObject0(false);
Object obj = readObject0(type, false);
handles.markDependency(outerHandle, passHandle);
ClassNotFoundException ex = handles.lookupException(passHandle);
if (ex != null) {
@ -557,7 +591,7 @@ public class ObjectInputStream
// if nested read, passHandle contains handle of enclosing object
int outerHandle = passHandle;
try {
Object obj = readObject0(true);
Object obj = readObject0(Object.class, true);
handles.markDependency(outerHandle, passHandle);
ClassNotFoundException ex = handles.lookupException(passHandle);
if (ex != null) {
@ -1577,8 +1611,10 @@ public class ObjectInputStream
/**
* Underlying readObject implementation.
* @param type a type expected to be deserialized; non-null
* @param unshared true if the object can not be a reference to a shared object, otherwise false
*/
private Object readObject0(boolean unshared) throws IOException {
private Object readObject0(Class<?> type, boolean unshared) throws IOException {
boolean oldMode = bin.getBlockDataMode();
if (oldMode) {
int remain = bin.currentBlockRemaining();
@ -1610,13 +1646,20 @@ public class ObjectInputStream
return readNull();
case TC_REFERENCE:
return readHandle(unshared);
// check the type of the existing object
return type.cast(readHandle(unshared));
case TC_CLASS:
if (type == String.class) {
throw new ClassCastException("Cannot cast a class to java.lang.String");
}
return readClass(unshared);
case TC_CLASSDESC:
case TC_PROXYCLASSDESC:
if (type == String.class) {
throw new ClassCastException("Cannot cast a class to java.lang.String");
}
return readClassDesc(unshared);
case TC_STRING:
@ -1624,15 +1667,27 @@ public class ObjectInputStream
return checkResolve(readString(unshared));
case TC_ARRAY:
if (type == String.class) {
throw new ClassCastException("Cannot cast an array to java.lang.String");
}
return checkResolve(readArray(unshared));
case TC_ENUM:
if (type == String.class) {
throw new ClassCastException("Cannot cast an enum to java.lang.String");
}
return checkResolve(readEnum(unshared));
case TC_OBJECT:
if (type == String.class) {
throw new ClassCastException("Cannot cast an object to java.lang.String");
}
return checkResolve(readOrdinaryObject(unshared));
case TC_EXCEPTION:
if (type == String.class) {
throw new ClassCastException("Cannot cast an exception to java.lang.String");
}
IOException ex = readFatalException();
throw new WriteAbortedException("writing aborted", ex);
@ -2004,7 +2059,7 @@ public class ObjectInputStream
if (ccl == null) {
for (int i = 0; i < len; i++) {
readObject0(false);
readObject0(Object.class, false);
}
} else if (ccl.isPrimitive()) {
if (ccl == Integer.TYPE) {
@ -2029,7 +2084,7 @@ public class ObjectInputStream
} else {
Object[] oa = (Object[]) array;
for (int i = 0; i < len; i++) {
oa[i] = readObject0(false);
oa[i] = readObject0(Object.class, false);
handles.markDependency(arrayHandle, passHandle);
}
}
@ -2393,7 +2448,7 @@ public class ObjectInputStream
return;
default:
readObject0(false);
readObject0(Object.class, false);
break;
}
}
@ -2438,7 +2493,7 @@ public class ObjectInputStream
int numPrimFields = fields.length - objVals.length;
for (int i = 0; i < objVals.length; i++) {
ObjectStreamField f = fields[numPrimFields + i];
objVals[i] = readObject0(f.isUnshared());
objVals[i] = readObject0(Object.class, f.isUnshared());
if (f.getField() != null) {
handles.markDependency(objHandle, passHandle);
}
@ -2479,7 +2534,7 @@ public class ObjectInputStream
throw new InternalError();
}
clear();
return (IOException) readObject0(false);
return (IOException) readObject0(Object.class, false);
}
/**
@ -2601,7 +2656,7 @@ public class ObjectInputStream
int numPrimFields = fields.length - objVals.length;
for (int i = 0; i < objVals.length; i++) {
objVals[i] =
readObject0(fields[numPrimFields + i].isUnshared());
readObject0(Object.class, fields[numPrimFields + i].isUnshared());
objHandles[i] = passHandle;
}
passHandle = oldHandle;
@ -4090,6 +4145,7 @@ public class ObjectInputStream
static {
SharedSecrets.setJavaObjectInputStreamAccess(ObjectInputStream::checkArray);
SharedSecrets.setJavaObjectInputStreamReadString(ObjectInputStream::readString);
}
}

156
src/java.base/share/classes/java/math/BigDecimal.java
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 1996, 2019, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 1996, 2020, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -2119,7 +2119,7 @@ public class BigDecimal extends Number implements Comparable<BigDecimal> {
// approximately a 15 digit approximation to the square
// root, it is helpful to instead normalize this so that
// the significand portion is to right of the decimal
// point by roughly (scale() - precision() +1).
// point by roughly (scale() - precision() + 1).
// Now the precision / scale adjustment
int scaleAdjust = 0;
@ -2147,7 +2147,7 @@ public class BigDecimal extends Number implements Comparable<BigDecimal> {
// than 15 digits were needed, it might be faster to do
// the loop entirely in BigDecimal arithmetic.
//
// (A double value might have as much many as 17 decimal
// (A double value might have as many as 17 decimal
// digits of precision; it depends on the relative density
// of binary and decimal numbers at different regions of
// the number line.)
@ -2171,7 +2171,25 @@ public class BigDecimal extends Number implements Comparable<BigDecimal> {
if (originalPrecision == 0) {
targetPrecision = stripped.precision()/2 + 1;
} else {
targetPrecision = originalPrecision;
/*
* To avoid the need for post-Newton fix-up logic, in
* the case of half-way rounding modes, double the
* target precision so that the "2p + 2" property can
* be relied on to accomplish the final rounding.
*/
switch (mc.getRoundingMode()) {
case HALF_UP:
case HALF_DOWN:
case HALF_EVEN:
targetPrecision = 2 * originalPrecision;
if (targetPrecision < 0) // Overflow
targetPrecision = Integer.MAX_VALUE - 2;
break;
default:
targetPrecision = originalPrecision;
break;
}
}
// When setting the precision to use inside the Newton
@ -2199,33 +2217,81 @@ public class BigDecimal extends Number implements Comparable<BigDecimal> {
// If result*result != this numerically, the square
// root isn't exact
if (this.subtract(result.multiply(result)).compareTo(ZERO) != 0) {
if (this.subtract(result.square()).compareTo(ZERO) != 0) {
throw new ArithmeticException("Computed square root not exact.");
}
} else {
result = approx.scaleByPowerOfTen(-scaleAdjust/2).round(mc);
switch (targetRm) {
case DOWN:
case FLOOR:
// Check if too big
if (result.square().compareTo(this) > 0) {
BigDecimal ulp = result.ulp();
// Adjust increment down in case of 1.0 = 10^0
// since the next smaller number is only 1/10
// as far way as the next larger at exponent
// boundaries. Test approx and *not* result to
// avoid having to detect an arbitrary power
// of ten.
if (approx.compareTo(ONE) == 0) {
ulp = ulp.multiply(ONE_TENTH);
}
result = result.subtract(ulp);
}
break;
case UP:
case CEILING:
// Check if too small
if (result.square().compareTo(this) < 0) {
result = result.add(result.ulp());
}
break;
default:
// No additional work, rely on "2p + 2" property
// for correct rounding. Alternatively, could
// instead run the Newton iteration to around p
// digits and then do tests and fix-ups on the
// rounded value. One possible set of tests and
// fix-ups is given in the Hull and Abrham paper;
// however, additional half-way cases can occur
// for BigDecimal given the more varied
// combinations of input and output precisions
// supported.
break;
}
}
// Test numerical properties at full precision before any
// scale adjustments.
assert squareRootResultAssertions(result, mc);
if (result.scale() != preferredScale) {
// The preferred scale of an add is
// max(addend.scale(), augend.scale()). Therefore, if
// the scale of the result is first minimized using
// stripTrailingZeros(), adding a zero of the
// preferred scale rounding the correct precision will
// perform the proper scale vs precision tradeoffs.
// preferred scale rounding to the correct precision
// will perform the proper scale vs precision
// tradeoffs.
result = result.stripTrailingZeros().
add(zeroWithFinalPreferredScale,
new MathContext(originalPrecision, RoundingMode.UNNECESSARY));
}
assert squareRootResultAssertions(result, mc);
return result;
} else {
BigDecimal result = null;
switch (signum) {
case -1:
throw new ArithmeticException("Attempted square root " +
"of negative BigDecimal");
case 0:
return valueOf(0L, scale()/2);
result = valueOf(0L, scale()/2);
assert squareRootResultAssertions(result, mc);
return result;
default:
throw new AssertionError("Bad value from signum");
@ -2233,6 +2299,10 @@ public class BigDecimal extends Number implements Comparable<BigDecimal> {
}
}
private BigDecimal square() {
return this.multiply(this);
}
private boolean isPowerOfTen() {
return BigInteger.ONE.equals(this.unscaledValue());
}
@ -2241,10 +2311,16 @@ public class BigDecimal extends Number implements Comparable<BigDecimal> {
* For nonzero values, check numerical correctness properties of
* the computed result for the chosen rounding mode.
*
* For the directed roundings, for DOWN and FLOOR, result^2 must
* be {@code <=} the input and (result+ulp)^2 must be {@code >} the
* input. Conversely, for UP and CEIL, result^2 must be {@code >=} the
* input and (result-ulp)^2 must be {@code <} the input.
* For the directed rounding modes:
*
* <ul>
*
* <li> For DOWN and FLOOR, result^2 must be {@code <=} the input
* and (result+ulp)^2 must be {@code >} the input.
*
* <li>Conversely, for UP and CEIL, result^2 must be {@code >=}
* the input and (result-ulp)^2 must be {@code <} the input.
* </ul>
*/
private boolean squareRootResultAssertions(BigDecimal result, MathContext mc) {
if (result.signum() == 0) {
@ -2254,52 +2330,68 @@ public class BigDecimal extends Number implements Comparable<BigDecimal> {
BigDecimal ulp = result.ulp();
BigDecimal neighborUp = result.add(ulp);
// Make neighbor down accurate even for powers of ten
if (this.isPowerOfTen()) {
if (result.isPowerOfTen()) {
ulp = ulp.divide(TEN);
}
BigDecimal neighborDown = result.subtract(ulp);
// Both the starting value and result should be nonzero and positive.
if (result.signum() != 1 ||
this.signum() != 1) {
return false;
}
assert (result.signum() == 1 &&
this.signum() == 1) :
"Bad signum of this and/or its sqrt.";
switch (rm) {
case DOWN:
case FLOOR:
return
result.multiply(result).compareTo(this) <= 0 &&
neighborUp.multiply(neighborUp).compareTo(this) > 0;
assert
result.square().compareTo(this) <= 0 &&
neighborUp.square().compareTo(this) > 0:
"Square of result out for bounds rounding " + rm;
return true;
case UP:
case CEILING:
return
result.multiply(result).compareTo(this) >= 0 &&
neighborDown.multiply(neighborDown).compareTo(this) < 0;
assert
result.square().compareTo(this) >= 0 &&
neighborDown.square().compareTo(this) < 0:
"Square of result out for bounds rounding " + rm;
return true;
case HALF_DOWN:
case HALF_EVEN:
case HALF_UP:
BigDecimal err = result.multiply(result).subtract(this).abs();
BigDecimal errUp = neighborUp.multiply(neighborUp).subtract(this);
BigDecimal errDown = this.subtract(neighborDown.multiply(neighborDown));
BigDecimal err = result.square().subtract(this).abs();
BigDecimal errUp = neighborUp.square().subtract(this);
BigDecimal errDown = this.subtract(neighborDown.square());
// All error values should be positive so don't need to
// compare absolute values.
int err_comp_errUp = err.compareTo(errUp);
int err_comp_errDown = err.compareTo(errDown);
return
assert
errUp.signum() == 1 &&
errDown.signum() == 1 &&
errDown.signum() == 1 :
"Errors of neighbors squared don't have correct signs";
err_comp_errUp <= 0 &&
err_comp_errDown <= 0 &&
// For breaking a half-way tie, the return value may
// have a larger error than one of the neighbors. For
// example, the square root of 2.25 to a precision of
// 1 digit is either 1 or 2 depending on how the exact
// value of 1.5 is rounded. If 2 is returned, it will
// have a larger rounding error than its neighbor 1.
assert
err_comp_errUp <= 0 ||
err_comp_errDown <= 0 :
"Computed square root has larger error than neighbors for " + rm;
assert
((err_comp_errUp == 0 ) ? err_comp_errDown < 0 : true) &&
((err_comp_errDown == 0 ) ? err_comp_errUp < 0 : true);
((err_comp_errDown == 0 ) ? err_comp_errUp < 0 : true) :
"Incorrect error relationships";
// && could check for digit conditions for ties too
return true;
default: // Definition of UNNECESSARY already verified.
return true;

2
src/java.base/share/classes/java/net/AbstractPlainDatagramSocketImpl.java
View file

@ -97,7 +97,7 @@ abstract class AbstractPlainDatagramSocketImpl extends DatagramSocketImpl
fd = new FileDescriptor();
try {
datagramSocketCreate();
SocketCleanable.register(fd);
SocketCleanable.register(fd, false);
} catch (SocketException ioe) {
ResourceManager.afterUdpClose();
fd = null;

17
src/java.base/share/classes/java/net/AbstractPlainSocketImpl.java
View file

@ -127,7 +127,7 @@ abstract class AbstractPlainSocketImpl extends SocketImpl implements PlatformSoc
fd = new FileDescriptor();
try {
socketCreate(false);
SocketCleanable.register(fd);
SocketCleanable.register(fd, false);
} catch (IOException ioe) {
ResourceManager.afterUdpClose();
fd = null;
@ -136,7 +136,7 @@ abstract class AbstractPlainSocketImpl extends SocketImpl implements PlatformSoc
} else {
fd = new FileDescriptor();
socketCreate(true);
SocketCleanable.register(fd);
SocketCleanable.register(fd, true);
}
}
@ -580,7 +580,7 @@ abstract class AbstractPlainSocketImpl extends SocketImpl implements PlatformSoc
} finally {
releaseFD();
}
SocketCleanable.register(si.fd);
SocketCleanable.register(si.fd, true);
}
/**
@ -683,9 +683,6 @@ abstract class AbstractPlainSocketImpl extends SocketImpl implements PlatformSoc
protected void close() throws IOException {
synchronized(fdLock) {
if (fd != null) {
if (!stream) {
ResourceManager.afterUdpClose();
}
if (fdUseCount == 0) {
if (closePending) {
return;
@ -840,7 +837,13 @@ abstract class AbstractPlainSocketImpl extends SocketImpl implements PlatformSoc
*/
protected void socketClose() throws IOException {
SocketCleanable.unregister(fd);
socketClose0(false);
try {
socketClose0(false);
} finally {
if (!stream) {
ResourceManager.afterUdpClose();
}
}
}
abstract void socketCreate(boolean stream) throws IOException;

23
src/java.base/share/classes/java/net/SocketCleanable.java
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2018, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -34,6 +34,7 @@ import java.io.IOException;
import java.io.UncheckedIOException;
import java.lang.ref.Cleaner;
import sun.net.ResourceManager;
/**
* Cleanable for a socket/datagramsocket FileDescriptor when it becomes phantom reachable.
@ -56,17 +57,22 @@ final class SocketCleanable extends PhantomCleanable<FileDescriptor> {
// The raw fd to close
private final int fd;
// true for socket, false for datagram socket
private final boolean stream;
/**
* Register a socket specific Cleanable with the FileDescriptor
* if the FileDescriptor is non-null and the raw fd is != -1.
*
* @param fdo the FileDescriptor; may be null
* @param fdo the FileDescriptor; may be null
* @param stream false for datagram socket
*/
static void register(FileDescriptor fdo) {
static void register(FileDescriptor fdo, boolean stream) {
if (fdo != null && fdo.valid()) {
int fd = fdAccess.get(fdo);
fdAccess.registerCleanup(fdo,
new SocketCleanable(fdo, CleanerFactory.cleaner(), fd));
new SocketCleanable(fdo, CleanerFactory.cleaner(),
fd, stream));
}
}
@ -86,10 +92,13 @@ final class SocketCleanable extends PhantomCleanable<FileDescriptor> {
* @param obj the object to monitor
* @param cleaner the cleaner
* @param fd file descriptor to close
* @param stream false for datagram socket
*/
private SocketCleanable(FileDescriptor obj, Cleaner cleaner, int fd) {
private SocketCleanable(FileDescriptor obj, Cleaner cleaner,
int fd, boolean stream) {
super(obj, cleaner);
this.fd = fd;
this.stream = stream;
}
/**
@ -101,6 +110,10 @@ final class SocketCleanable extends PhantomCleanable<FileDescriptor> {
cleanupClose0(fd);
} catch (IOException ioe) {
throw new UncheckedIOException("close", ioe);
} finally {
if (!stream) {
ResourceManager.afterUdpClose();
}
}
}
}

7
src/java.base/share/classes/java/net/URL.java
View file

@ -45,6 +45,7 @@ import java.util.ServiceLoader;
import jdk.internal.access.JavaNetURLAccess;
import jdk.internal.access.SharedSecrets;
import jdk.internal.misc.VM;
import sun.net.util.IPAddressUtil;
import sun.security.util.SecurityConstants;
import sun.security.action.GetPropertyAction;
@ -1431,7 +1432,7 @@ public final class URL implements java.io.Serializable {
boolean checkedWithFactory = false;
boolean overrideableProtocol = isOverrideable(protocol);
if (overrideableProtocol && jdk.internal.misc.VM.isBooted()) {
if (overrideableProtocol && VM.isBooted()) {
// Use the factory (if any). Volatile read makes
// URLStreamHandlerFactory appear fully initialized to current thread.
fac = factory;
@ -1665,7 +1666,9 @@ public final class URL implements java.io.Serializable {
}
boolean isBuiltinStreamHandler(URLStreamHandler handler) {
return isBuiltinStreamHandler(handler.getClass().getName());
Class<?> handlerClass = handler.getClass();
return isBuiltinStreamHandler(handlerClass.getName())
|| VM.isSystemDomainLoader(handlerClass.getClassLoader());
}
private boolean isBuiltinStreamHandler(String handlerClassName) {

2
src/java.base/share/classes/java/nio/file/Files.java
View file

@ -3348,6 +3348,8 @@ public final class Files {
Objects.requireNonNull(cs);
byte[] ba = readAllBytes(path);
if (path.getClass().getModule() != Object.class.getModule())
ba = ba.clone();
return JLA.newStringNoRepl(ba, cs);
}

2
src/java.base/share/classes/java/security/CodeSource.java
View file

@ -598,7 +598,7 @@ public class CodeSource implements java.io.Serializable {
cfs.put(certType, cf);
}
// parse the certificate
byte[] encoded = IOUtils.readNBytes(ois, ois.readInt());
byte[] encoded = IOUtils.readExactlyNBytes(ois, ois.readInt());
ByteArrayInputStream bais = new ByteArrayInputStream(encoded);
try {
certList.add(cf.generateCertificate(bais));

2
src/java.base/share/classes/java/security/UnresolvedPermission.java
View file

@ -594,7 +594,7 @@ implements java.io.Serializable
cfs.put(certType, cf);
}
// parse the certificate
byte[] encoded = IOUtils.readNBytes(ois, ois.readInt());
byte[] encoded = IOUtils.readExactlyNBytes(ois, ois.readInt());
ByteArrayInputStream bais = new ByteArrayInputStream(encoded);
try {
certList.add(cf.generateCertificate(bais));

2
src/java.base/share/classes/java/security/cert/CertificateRevokedException.java
View file

@ -244,7 +244,7 @@ public class CertificateRevokedException extends CertificateException {
for (int i = 0; i < size; i++) {
String oid = (String) ois.readObject();
boolean critical = ois.readBoolean();
byte[] extVal = IOUtils.readNBytes(ois, ois.readInt());
byte[] extVal = IOUtils.readExactlyNBytes(ois, ois.readInt());
Extension ext = sun.security.x509.Extension.newExtension
(new ObjectIdentifier(oid), critical, extVal);
extensions.put(oid, ext);

38
src/java.base/share/classes/jdk/internal/access/JavaObjectInputStreamReadString.java Normal file
View file

@ -0,0 +1,38 @@
/*
* Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package jdk.internal.access;
import java.io.IOException;
import java.io.ObjectInputStream;
/**
* Interface to specify methods for accessing {@code ObjectInputStream}.
*/
@FunctionalInterface
public interface JavaObjectInputStreamReadString {
String readString(ObjectInputStream ois) throws IOException;
}

12
src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
View file

@ -62,6 +62,7 @@ public class SharedSecrets {
private static JavaIOFileDescriptorAccess javaIOFileDescriptorAccess;
private static JavaIOFilePermissionAccess javaIOFilePermissionAccess;
private static JavaIORandomAccessFileAccess javaIORandomAccessFileAccess;
private static JavaObjectInputStreamReadString javaObjectInputStreamReadString;
private static JavaObjectInputStreamAccess javaObjectInputStreamAccess;
private static JavaObjectInputFilterAccess javaObjectInputFilterAccess;
private static JavaNetInetAddressAccess javaNetInetAddressAccess;
@ -283,6 +284,17 @@ public class SharedSecrets {
javaUtilResourceBundleAccess = access;
}
public static JavaObjectInputStreamReadString getJavaObjectInputStreamReadString() {
if (javaObjectInputStreamReadString == null) {
unsafe.ensureClassInitialized(ObjectInputStream.class);
}
return javaObjectInputStreamReadString;
}
public static void setJavaObjectInputStreamReadString(JavaObjectInputStreamReadString access) {
javaObjectInputStreamReadString = access;
}
public static JavaObjectInputStreamAccess getJavaObjectInputStreamAccess() {
if (javaObjectInputStreamAccess == null) {
unsafe.ensureClassInitialized(ObjectInputStream.class);

16
src/java.base/share/classes/jdk/internal/util/StaticProperty.java
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2018, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -42,6 +42,7 @@ public final class StaticProperty {
private static final String USER_HOME = initProperty("user.home");
private static final String USER_DIR = initProperty("user.dir");
private static final String USER_NAME = initProperty("user.name");
private static final String JDK_SERIAL_FILTER = System.getProperty("jdk.serialFilter");
private StaticProperty() {}
@ -104,4 +105,17 @@ public final class StaticProperty {
public static String userName() {
return USER_NAME;
}
/**
* Return the {@code jdk.serialFilter} system property.
*
* <strong>{@link SecurityManager#checkPropertyAccess} is NOT checked
* in this method. The caller of this method should take care to ensure
* that the returned property is not made accessible to untrusted code.</strong>
*
* @return the {@code user.name} system property
*/
public static String jdkSerialFilter() {
return JDK_SERIAL_FILTER;
}
}

19
src/java.base/share/classes/sun/security/provider/JavaKeyStore.java
View file

@ -697,7 +697,7 @@ public abstract class JavaKeyStore extends KeyStoreSpi {
// Read the private key
entry.protectedPrivKey =
IOUtils.readFully(dis, dis.readInt(), true);
IOUtils.readExactlyNBytes(dis, dis.readInt());
// Read the certificate chain
int numOfCerts = dis.readInt();
@ -722,7 +722,7 @@ public abstract class JavaKeyStore extends KeyStoreSpi {
}
}
// instantiate the certificate
encoded = IOUtils.readFully(dis, dis.readInt(), true);
encoded = IOUtils.readExactlyNBytes(dis, dis.readInt());
bais = new ByteArrayInputStream(encoded);
certs.add(cf.generateCertificate(bais));
bais.close();
@ -761,7 +761,7 @@ public abstract class JavaKeyStore extends KeyStoreSpi {
cfs.put(certType, cf);
}
}
encoded = IOUtils.readFully(dis, dis.readInt(), true);
encoded = IOUtils.readExactlyNBytes(dis, dis.readInt());
bais = new ByteArrayInputStream(encoded);
entry.cert = cf.generateCertificate(bais);
bais.close();
@ -787,16 +787,13 @@ public abstract class JavaKeyStore extends KeyStoreSpi {
*/
if (password != null) {
byte[] computed = md.digest();
byte[] actual = new byte[computed.length];
dis.readFully(actual);
for (int i = 0; i < computed.length; i++) {
if (computed[i] != actual[i]) {
Throwable t = new UnrecoverableKeyException
byte[] actual = IOUtils.readExactlyNBytes(dis, computed.length);
if (!MessageDigest.isEqual(computed, actual)) {
Throwable t = new UnrecoverableKeyException
("Password verification failed");
throw (IOException)new IOException
throw (IOException) new IOException
("Keystore was tampered with, or "
+ "password was incorrect").initCause(t);
}
+ "password was incorrect").initCause(t);
}
}
}

10
src/java.base/share/classes/sun/security/ssl/Alert.java
View file

@ -271,8 +271,14 @@ enum Alert {
ClientAuthType.CLIENT_AUTH_REQUESTED)) {
throw tc.fatal(Alert.HANDSHAKE_FAILURE,
"received handshake warning: " + alert.description);
} // Otherwise, ignore the warning
} // Otherwise, ignore the warning.
} else {
// Otherwise ignore the warning but remove the
// CertificateVerify handshake consumer so the state
// machine doesn't expect it.
tc.handshakeContext.handshakeConsumers.remove(
SSLHandshake.CERTIFICATE_VERIFY.id);
}
} // Otherwise, ignore the warning
} else { // fatal or unknown
String diagnostic;
if (alert == null) {

8
src/java.base/share/classes/sun/security/ssl/CertificateMessage.java
View file

@ -371,6 +371,10 @@ final class CertificateMessage {
T12CertificateMessage certificateMessage )throws IOException {
List<byte[]> encodedCerts = certificateMessage.encodedCertChain;
if (encodedCerts == null || encodedCerts.isEmpty()) {
// For empty Certificate messages, we should not expect
// a CertificateVerify message to follow
shc.handshakeConsumers.remove(
SSLHandshake.CERTIFICATE_VERIFY.id);
if (shc.sslConfig.clientAuthType !=
ClientAuthType.CLIENT_AUTH_REQUESTED) {
// unexpected or require client authentication
@ -1165,6 +1169,10 @@ final class CertificateMessage {
T13CertificateMessage certificateMessage )throws IOException {
if (certificateMessage.certEntries == null ||
certificateMessage.certEntries.isEmpty()) {
// For empty Certificate messages, we should not expect
// a CertificateVerify message to follow
shc.handshakeConsumers.remove(
SSLHandshake.CERTIFICATE_VERIFY.id);
if (shc.sslConfig.clientAuthType == CLIENT_AUTH_REQUIRED) {
throw shc.conContext.fatal(Alert.BAD_CERTIFICATE,
"Empty client certificate chain");

37
src/java.base/share/classes/sun/security/ssl/CertificateVerify.java
View file

@ -287,6 +287,17 @@ final class CertificateVerify {
ByteBuffer message) throws IOException {
// The consuming happens in server side only.
ServerHandshakeContext shc = (ServerHandshakeContext)context;
// Clean up this consumer
shc.handshakeConsumers.remove(SSLHandshake.CERTIFICATE_VERIFY.id);
// Ensure that the CV message follows the CKE
if (shc.handshakeConsumers.containsKey(
SSLHandshake.CLIENT_KEY_EXCHANGE.id)) {
throw shc.conContext.fatal(Alert.UNEXPECTED_MESSAGE,
"Unexpected CertificateVerify handshake message");
}
S30CertificateVerifyMessage cvm =
new S30CertificateVerifyMessage(shc, message);
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
@ -529,6 +540,17 @@ final class CertificateVerify {
ByteBuffer message) throws IOException {
// The consuming happens in server side only.
ServerHandshakeContext shc = (ServerHandshakeContext)context;
// Clean up this consumer
shc.handshakeConsumers.remove(SSLHandshake.CERTIFICATE_VERIFY.id);
// Ensure that the CV message follows the CKE
if (shc.handshakeConsumers.containsKey(
SSLHandshake.CLIENT_KEY_EXCHANGE.id)) {
throw shc.conContext.fatal(Alert.UNEXPECTED_MESSAGE,
"Unexpected CertificateVerify handshake message");
}
T10CertificateVerifyMessage cvm =
new T10CertificateVerifyMessage(shc, message);
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
@ -767,6 +789,17 @@ final class CertificateVerify {
ByteBuffer message) throws IOException {
// The consuming happens in server side only.
ServerHandshakeContext shc = (ServerHandshakeContext)context;
// Clean up this consumer
shc.handshakeConsumers.remove(SSLHandshake.CERTIFICATE_VERIFY.id);
// Ensure that the CV message follows the CKE
if (shc.handshakeConsumers.containsKey(
SSLHandshake.CLIENT_KEY_EXCHANGE.id)) {
throw shc.conContext.fatal(Alert.UNEXPECTED_MESSAGE,
"Unexpected CertificateVerify handshake message");
}
T12CertificateVerifyMessage cvm =
new T12CertificateVerifyMessage(shc, message);
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
@ -1120,6 +1153,10 @@ final class CertificateVerify {
ByteBuffer message) throws IOException {
// The producing happens in handshake context only.
HandshakeContext hc = (HandshakeContext)context;
// Clean up this consumer
hc.handshakeConsumers.remove(SSLHandshake.CERTIFICATE_VERIFY.id);
T13CertificateVerifyMessage cvm =
new T13CertificateVerifyMessage(hc, message);
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

9
src/java.base/share/classes/sun/security/ssl/ClientHello.java
View file

@ -1140,6 +1140,15 @@ final class ClientHello {
ServerHandshakeContext shc = (ServerHandshakeContext)context;
ClientHelloMessage clientHello = (ClientHelloMessage)message;
// [RFC 8446] TLS 1.3 forbids renegotiation. If a server has
// negotiated TLS 1.3 and receives a ClientHello at any other
// time, it MUST terminate the connection with an
// "unexpected_message" alert.
if (shc.conContext.isNegotiated) {
throw shc.conContext.fatal(Alert.UNEXPECTED_MESSAGE,
"Received unexpected renegotiation handshake message");
}
// The client may send a dummy change_cipher_spec record
// immediately after the first ClientHello.
shc.conContext.consumers.putIfAbsent(

30
src/java.base/share/classes/sun/security/ssl/Finished.java
View file

@ -589,6 +589,16 @@ final class Finished {
private void onConsumeFinished(ServerHandshakeContext shc,
ByteBuffer message) throws IOException {
// Make sure that any expected CertificateVerify message
// has been received and processed.
if (!shc.isResumption) {
if (shc.handshakeConsumers.containsKey(
SSLHandshake.CERTIFICATE_VERIFY.id)) {
throw shc.conContext.fatal(Alert.UNEXPECTED_MESSAGE,
"Unexpected Finished handshake message");
}
}
FinishedMessage fm = new FinishedMessage(shc, message);
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
SSLLogger.fine(
@ -883,6 +893,16 @@ final class Finished {
private void onConsumeFinished(ClientHandshakeContext chc,
ByteBuffer message) throws IOException {
// Make sure that any expected CertificateVerify message
// has been received and processed.
if (!chc.isResumption) {
if (chc.handshakeConsumers.containsKey(
SSLHandshake.CERTIFICATE_VERIFY.id)) {
throw chc.conContext.fatal(Alert.UNEXPECTED_MESSAGE,
"Unexpected Finished handshake message");
}
}
FinishedMessage fm = new FinishedMessage(chc, message);
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
SSLLogger.fine(
@ -1005,6 +1025,16 @@ final class Finished {
private void onConsumeFinished(ServerHandshakeContext shc,
ByteBuffer message) throws IOException {
// Make sure that any expected CertificateVerify message
// has been received and processed.
if (!shc.isResumption) {
if (shc.handshakeConsumers.containsKey(
SSLHandshake.CERTIFICATE_VERIFY.id)) {
throw shc.conContext.fatal(Alert.UNEXPECTED_MESSAGE,
"Unexpected Finished handshake message");
}
}
FinishedMessage fm = new FinishedMessage(shc, message);
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
SSLLogger.fine(

2
src/java.base/share/classes/sun/security/util/DerValue.java
View file

@ -395,7 +395,7 @@ public class DerValue {
if (fullyBuffered && in.available() != length)
throw new IOException("extra data given to DerValue constructor");
byte[] bytes = IOUtils.readFully(in, length, true);
byte[] bytes = IOUtils.readExactlyNBytes(in, length);
buffer = new DerInputBuffer(bytes, allowBER);
return new DerInputStream(buffer);

72
src/java.base/share/classes/sun/security/util/IOUtils.java
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2009, 2017, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2009, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -32,68 +32,34 @@ package sun.security.util;
import java.io.EOFException;
import java.io.IOException;
import java.io.InputStream;
import java.util.Arrays;
public class IOUtils {
/**
* Read up to {@code length} of bytes from {@code in}
* until EOF is detected.
* @param is input stream, must not be null
* @param length number of bytes to read
* @param readAll if true, an EOFException will be thrown if not enough
* bytes are read.
* @return bytes read
* @throws IOException Any IO error or a premature EOF is detected
*/
public static byte[] readFully(InputStream is, int length, boolean readAll)
throws IOException {
if (length < 0) {
throw new IOException("Invalid length");
}
byte[] output = {};
int pos = 0;
while (pos < length) {
int bytesToRead;
if (pos >= output.length) { // Only expand when there's no room
bytesToRead = Math.min(length - pos, output.length + 1024);
if (output.length < pos + bytesToRead) {
output = Arrays.copyOf(output, pos + bytesToRead);
}
} else {
bytesToRead = output.length - pos;
}
int cc = is.read(output, pos, bytesToRead);
if (cc < 0) {
if (readAll) {
throw new EOFException("Detect premature EOF");
} else {
if (output.length != pos) {
output = Arrays.copyOf(output, pos);
}
break;
}
}
pos += cc;
}
return output;
}
/**
* Read {@code length} of bytes from {@code in}. An exception is
* thrown if there are not enough bytes in the stream.
* Read exactly {@code length} of bytes from {@code in}.
*
* <p> Note that this method is safe to be called with unknown large
* {@code length} argument. The memory used is proportional to the
* actual bytes available. An exception is thrown if there are not
* enough bytes in the stream.
*
* @param is input stream, must not be null
* @param length number of bytes to read, must not be negative
* @param length number of bytes to read
* @return bytes read
* @throws IOException if any IO error or a premature EOF is detected, or
* if {@code length} is negative since this length is usually also
* read from {@code is}.
* @throws EOFException if there are not enough bytes in the stream
* @throws IOException if an I/O error occurs or {@code length} is negative
* @throws OutOfMemoryError if an array of the required size cannot be
* allocated.
*/
public static byte[] readNBytes(InputStream is, int length) throws IOException {
public static byte[] readExactlyNBytes(InputStream is, int length)
throws IOException {
if (length < 0) {
throw new IOException("length cannot be negative: " + length);
}
return readFully(is, length, true);
byte[] data = is.readNBytes(length);
if (data.length < length) {
throw new EOFException();
}
return data;
}
}

100
src/java.base/share/classes/sun/security/validator/PKIXValidator.java
View file

@ -32,6 +32,7 @@ import java.security.cert.*;
import javax.security.auth.x500.X500Principal;
import sun.security.action.GetBooleanAction;
import sun.security.action.GetPropertyAction;
import sun.security.provider.certpath.AlgorithmChecker;
import sun.security.provider.certpath.PKIXExtendedParameters;
@ -60,6 +61,18 @@ public final class PKIXValidator extends Validator {
private static final boolean checkTLSRevocation = GetBooleanAction
.privilegedGetProperty("com.sun.net.ssl.checkRevocation");
/**
* System property that if set (or set to "true"), allows trust anchor
* certificates to be used if they do not have the proper CA extensions.
* Set to false if prop is not set, or set to any other value.
*/
private static final boolean ALLOW_NON_CA_ANCHOR = allowNonCaAnchor();
private static boolean allowNonCaAnchor() {
String prop = GetPropertyAction
.privilegedGetProperty("jdk.security.allowNonCaAnchor");
return prop != null && (prop.isEmpty() || prop.equalsIgnoreCase("true"));
}
private final Set<X509Certificate> trustedCerts;
private final PKIXBuilderParameters parameterTemplate;
private int certPathLength = -1;
@ -195,6 +208,7 @@ public final class PKIXValidator extends Validator {
("null or zero-length certificate chain");
}
// Use PKIXExtendedParameters for timestamp and variant additions
PKIXBuilderParameters pkixParameters = null;
try {
@ -224,28 +238,30 @@ public final class PKIXValidator extends Validator {
for (int i = 0; i < chain.length; i++) {
X509Certificate cert = chain[i];
X500Principal dn = cert.getSubjectX500Principal();
if (i != 0 && !dn.equals(prevIssuer)) {
// chain is not ordered correctly, call builder instead
return doBuild(chain, otherCerts, pkixParameters);
}
// Check if chain[i] is already trusted. It may be inside
// trustedCerts, or has the same dn and public key as a cert
// inside trustedCerts. The latter happens when a CA has
// updated its cert with a stronger signature algorithm in JRE
// but the weak one is still in circulation.
if (trustedCerts.contains(cert) || // trusted cert
(trustedSubjects.containsKey(dn) && // replacing ...
trustedSubjects.get(dn).contains( // ... weak cert
cert.getPublicKey()))) {
if (i == 0) {
if (i == 0) {
if (trustedCerts.contains(cert)) {
return new X509Certificate[] {chain[0]};
}
// Remove and call validator on partial chain [0 .. i-1]
X509Certificate[] newChain = new X509Certificate[i];
System.arraycopy(chain, 0, newChain, 0, i);
return doValidate(newChain, pkixParameters);
} else {
if (!dn.equals(prevIssuer)) {
// chain is not ordered correctly, call builder instead
return doBuild(chain, otherCerts, pkixParameters);
}
// Check if chain[i] is already trusted. It may be inside
// trustedCerts, or has the same dn and public key as a cert
// inside trustedCerts. The latter happens when a CA has
// updated its cert with a stronger signature algorithm in JRE
// but the weak one is still in circulation.
if (trustedCerts.contains(cert) || // trusted cert
(trustedSubjects.containsKey(dn) && // replacing ...
trustedSubjects.get(dn).contains( // ... weak cert
cert.getPublicKey()))) {
// Remove and call validator on partial chain [0 .. i-1]
X509Certificate[] newChain = new X509Certificate[i];
System.arraycopy(chain, 0, newChain, 0, i);
return doValidate(newChain, pkixParameters);
}
}
prevIssuer = cert.getIssuerX500Principal();
}
@ -308,15 +324,18 @@ public final class PKIXValidator extends Validator {
private static X509Certificate[] toArray(CertPath path, TrustAnchor anchor)
throws CertificateException {
List<? extends java.security.cert.Certificate> list =
path.getCertificates();
X509Certificate[] chain = new X509Certificate[list.size() + 1];
list.toArray(chain);
X509Certificate trustedCert = anchor.getTrustedCert();
if (trustedCert == null) {
throw new ValidatorException
("TrustAnchor must be specified as certificate");
}
verifyTrustAnchor(trustedCert);
List<? extends java.security.cert.Certificate> list =
path.getCertificates();
X509Certificate[] chain = new X509Certificate[list.size() + 1];
list.toArray(chain);
chain[chain.length - 1] = trustedCert;
return chain;
}
@ -351,6 +370,41 @@ public final class PKIXValidator extends Validator {
}
}
/**
* Verify that a trust anchor certificate is a CA certificate.
*/
private static void verifyTrustAnchor(X509Certificate trustedCert)
throws ValidatorException {
// skip check if jdk.security.allowNonCAAnchor system property is set
if (ALLOW_NON_CA_ANCHOR) {
return;
}
// allow v1 trust anchor certificates
if (trustedCert.getVersion() < 3) {
return;
}
// check that the BasicConstraints cA field is not set to false
if (trustedCert.getBasicConstraints() == -1) {
throw new ValidatorException
("TrustAnchor with subject \"" +
trustedCert.getSubjectX500Principal() +
"\" is not a CA certificate");
}
// check that the KeyUsage extension, if included, asserts the
// keyCertSign bit
boolean[] keyUsageBits = trustedCert.getKeyUsage();
if (keyUsageBits != null && !keyUsageBits[5]) {
throw new ValidatorException
("TrustAnchor with subject \"" +
trustedCert.getSubjectX500Principal() +
"\" does not have keyCertSign bit set in KeyUsage extension");
}
}
private X509Certificate[] doBuild(X509Certificate[] chain,
Collection<X509Certificate> otherCerts,
PKIXBuilderParameters params) throws CertificateException {

2
src/java.base/share/classes/sun/security/x509/AVA.java
View file

@ -599,7 +599,7 @@ public class AVA implements DerEncoder {
if (derval.tag != DerValue.tag_Sequence) {
throw new IOException("AVA not a sequence");
}
oid = X500Name.intern(derval.data.getOID());
oid = derval.data.getOID();
value = derval.data.getDerValue();
if (derval.data.available() != 0) {

144
src/java.base/share/classes/sun/security/x509/X500Name.java
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 1996, 2014, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 1996, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -1097,18 +1097,6 @@ public class X500Name implements GeneralNameInterface, Principal {
/****************************************************************/
/*
* Maybe return a preallocated OID, to reduce storage costs
* and speed recognition of common X.500 attributes.
*/
static ObjectIdentifier intern(ObjectIdentifier oid) {
ObjectIdentifier interned = internedOIDs.putIfAbsent(oid, oid);
return (interned == null) ? oid : interned;
}
private static final Map<ObjectIdentifier,ObjectIdentifier> internedOIDs
= new HashMap<ObjectIdentifier,ObjectIdentifier>();
/*
* Selected OIDs from X.520
* Includes all those specified in RFC 5280 as MUST or SHOULD
@ -1136,92 +1124,82 @@ public class X500Name implements GeneralNameInterface, Principal {
{ 0, 9, 2342, 19200300, 100, 1, 1 };
public static final ObjectIdentifier commonName_oid;
public static final ObjectIdentifier countryName_oid;
public static final ObjectIdentifier localityName_oid;
public static final ObjectIdentifier orgName_oid;
public static final ObjectIdentifier orgUnitName_oid;
public static final ObjectIdentifier stateName_oid;
public static final ObjectIdentifier streetAddress_oid;
public static final ObjectIdentifier title_oid;
public static final ObjectIdentifier DNQUALIFIER_OID;
public static final ObjectIdentifier SURNAME_OID;
public static final ObjectIdentifier GIVENNAME_OID;
public static final ObjectIdentifier INITIALS_OID;
public static final ObjectIdentifier GENERATIONQUALIFIER_OID;
public static final ObjectIdentifier ipAddress_oid;
public static final ObjectIdentifier DOMAIN_COMPONENT_OID;
public static final ObjectIdentifier userid_oid;
public static final ObjectIdentifier SERIALNUMBER_OID;
// OID for the "CN=" attribute, denoting a person's common name.
public static final ObjectIdentifier commonName_oid =
ObjectIdentifier.newInternal(commonName_data);
static {
/** OID for the "CN=" attribute, denoting a person's common name. */
commonName_oid = intern(ObjectIdentifier.newInternal(commonName_data));
// OID for the "SERIALNUMBER=" attribute, denoting a serial number for.
// a name. Do not confuse with PKCS#9 issuerAndSerialNumber or the
// certificate serial number.
public static final ObjectIdentifier SERIALNUMBER_OID =
ObjectIdentifier.newInternal(SERIALNUMBER_DATA);
/** OID for the "SERIALNUMBER=" attribute, denoting a serial number for.
a name. Do not confuse with PKCS#9 issuerAndSerialNumber or the
certificate serial number. */
SERIALNUMBER_OID = intern(ObjectIdentifier.newInternal(SERIALNUMBER_DATA));
// OID for the "C=" attribute, denoting a country.
public static final ObjectIdentifier countryName_oid =
ObjectIdentifier.newInternal(countryName_data);
/** OID for the "C=" attribute, denoting a country. */
countryName_oid = intern(ObjectIdentifier.newInternal(countryName_data));
// OID for the "L=" attribute, denoting a locality (such as a city).
public static final ObjectIdentifier localityName_oid =
ObjectIdentifier.newInternal(localityName_data);
/** OID for the "L=" attribute, denoting a locality (such as a city) */
localityName_oid = intern(ObjectIdentifier.newInternal(localityName_data));
// OID for the "O=" attribute, denoting an organization name.
public static final ObjectIdentifier orgName_oid =
ObjectIdentifier.newInternal(orgName_data);
/** OID for the "O=" attribute, denoting an organization name */
orgName_oid = intern(ObjectIdentifier.newInternal(orgName_data));
// OID for the "OU=" attribute, denoting an organizational unit name.
public static final ObjectIdentifier orgUnitName_oid =
ObjectIdentifier.newInternal(orgUnitName_data);
/** OID for the "OU=" attribute, denoting an organizational unit name */
orgUnitName_oid = intern(ObjectIdentifier.newInternal(orgUnitName_data));
// OID for the "S=" attribute, denoting a state (such as Delaware).
public static final ObjectIdentifier stateName_oid =
ObjectIdentifier.newInternal(stateName_data);
/** OID for the "S=" attribute, denoting a state (such as Delaware) */
stateName_oid = intern(ObjectIdentifier.newInternal(stateName_data));
// OID for the "STREET=" attribute, denoting a street address.
public static final ObjectIdentifier streetAddress_oid =
ObjectIdentifier.newInternal(streetAddress_data);
/** OID for the "STREET=" attribute, denoting a street address. */
streetAddress_oid = intern(ObjectIdentifier.newInternal(streetAddress_data));
// OID for the "T=" attribute, denoting a person's title.
public static final ObjectIdentifier title_oid =
ObjectIdentifier.newInternal(title_data);
/** OID for the "T=" attribute, denoting a person's title. */
title_oid = intern(ObjectIdentifier.newInternal(title_data));
// OID for the "DNQUALIFIER=" or "DNQ=" attribute, denoting DN
// disambiguating information.
public static final ObjectIdentifier DNQUALIFIER_OID =
ObjectIdentifier.newInternal(DNQUALIFIER_DATA);
/** OID for the "DNQUALIFIER=" or "DNQ=" attribute, denoting DN
disambiguating information.*/
DNQUALIFIER_OID = intern(ObjectIdentifier.newInternal(DNQUALIFIER_DATA));
// OID for the "SURNAME=" attribute, denoting a person's surname.
public static final ObjectIdentifier SURNAME_OID =
ObjectIdentifier.newInternal(SURNAME_DATA);
/** OID for the "SURNAME=" attribute, denoting a person's surname.*/
SURNAME_OID = intern(ObjectIdentifier.newInternal(SURNAME_DATA));
// OID for the "GIVENNAME=" attribute, denoting a person's given name.
public static final ObjectIdentifier GIVENNAME_OID =
ObjectIdentifier.newInternal(GIVENNAME_DATA);
/** OID for the "GIVENNAME=" attribute, denoting a person's given name.*/
GIVENNAME_OID = intern(ObjectIdentifier.newInternal(GIVENNAME_DATA));
// OID for the "INITIALS=" attribute, denoting a person's initials.
public static final ObjectIdentifier INITIALS_OID =
ObjectIdentifier.newInternal(INITIALS_DATA);
/** OID for the "INITIALS=" attribute, denoting a person's initials.*/
INITIALS_OID = intern(ObjectIdentifier.newInternal(INITIALS_DATA));
// OID for the "GENERATION=" attribute, denoting Jr., II, etc.
public static final ObjectIdentifier GENERATIONQUALIFIER_OID =
ObjectIdentifier.newInternal(GENERATIONQUALIFIER_DATA);
/** OID for the "GENERATION=" attribute, denoting Jr., II, etc.*/
GENERATIONQUALIFIER_OID =
intern(ObjectIdentifier.newInternal(GENERATIONQUALIFIER_DATA));
// OIDs from other sources which show up in X.500 names we
// expect to deal with often.
//
// OID for "IP=" IP address attributes, used with SKIP.
public static final ObjectIdentifier ipAddress_oid =
ObjectIdentifier.newInternal(ipAddress_data);
/*
* OIDs from other sources which show up in X.500 names we
* expect to deal with often
*/
/** OID for "IP=" IP address attributes, used with SKIP. */
ipAddress_oid = intern(ObjectIdentifier.newInternal(ipAddress_data));
// Domain component OID from RFC 1274, RFC 2247, RFC 5280.
//
// OID for "DC=" domain component attributes, used with DNSNames in DN
// format.
public static final ObjectIdentifier DOMAIN_COMPONENT_OID =
ObjectIdentifier.newInternal(DOMAIN_COMPONENT_DATA);
/*
* Domain component OID from RFC 1274, RFC 2247, RFC 5280
*/
/*
* OID for "DC=" domain component attributes, used with DNSNames in DN
* format
*/
DOMAIN_COMPONENT_OID =
intern(ObjectIdentifier.newInternal(DOMAIN_COMPONENT_DATA));
/** OID for "UID=" denoting a user id, defined in RFCs 1274 & 2798. */
userid_oid = intern(ObjectIdentifier.newInternal(userid_data));
}
// OID for "UID=" denoting a user id, defined in RFCs 1274 & 2798.
public static final ObjectIdentifier userid_oid =
ObjectIdentifier.newInternal(userid_data);
/**
* Return constraint type:<ul>