{
* @since 1.5
*/
public static boolean isDigit(int codePoint) {
- return getType(codePoint) == Character.DECIMAL_DIGIT_NUMBER;
+ return CharacterData.of(codePoint).isDigit(codePoint);
}
/**
diff --git a/src/java.base/share/classes/java/lang/CharacterData.java b/src/java.base/share/classes/java/lang/CharacterData.java
index d6b05f4f847..1cc296fa82a 100644
--- a/src/java.base/share/classes/java/lang/CharacterData.java
+++ b/src/java.base/share/classes/java/lang/CharacterData.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2006, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2006, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -28,6 +28,9 @@ package java.lang;
abstract class CharacterData {
abstract int getProperties(int ch);
abstract int getType(int ch);
+ abstract boolean isDigit(int ch);
+ abstract boolean isLowerCase(int ch);
+ abstract boolean isUpperCase(int ch);
abstract boolean isWhitespace(int ch);
abstract boolean isMirrored(int ch);
abstract boolean isJavaIdentifierStart(int ch);
diff --git a/src/java.base/share/classes/java/lang/Object.java b/src/java.base/share/classes/java/lang/Object.java
index 421fcc27f93..8f751e7e4c0 100644
--- a/src/java.base/share/classes/java/lang/Object.java
+++ b/src/java.base/share/classes/java/lang/Object.java
@@ -94,12 +94,10 @@ public class Object {
* programmer should be aware that producing distinct integer results
* for unequal objects may improve the performance of hash tables.
*
- *
- * As much as is reasonably practical, the hashCode method defined
- * by class {@code Object} does return distinct integers for
- * distinct objects. (The hashCode may or may not be implemented
- * as some function of an object's memory address at some point
- * in time.)
+ *
+ * @implSpec
+ * As far as is reasonably practical, the {@code hashCode} method defined
+ * by class {@code Object} returns distinct integers for distinct objects.
*
* @return a hash code value for this object.
* @see java.lang.Object#equals(java.lang.Object)
diff --git a/src/java.base/share/classes/java/lang/System.java b/src/java.base/share/classes/java/lang/System.java
index fb0ac21675b..42b97d670fe 100644
--- a/src/java.base/share/classes/java/lang/System.java
+++ b/src/java.base/share/classes/java/lang/System.java
@@ -801,8 +801,9 @@ public final class System {
}
if (props == null) {
- props = SystemProps.initProperties();
- VersionProps.init(props);
+ Map tempProps = SystemProps.initProperties();
+ VersionProps.init(tempProps);
+ props = createProperties(tempProps);
}
System.props = props;
}
@@ -1959,18 +1960,42 @@ public final class System {
}
}
+ /**
+ * Create the Properties object from a map - masking out system properties
+ * that are not intended for public access.
+ */
+ private static Properties createProperties(Map initialProps) {
+ Properties properties = new Properties(initialProps.size());
+ for (var entry : initialProps.entrySet()) {
+ String prop = entry.getKey();
+ switch (prop) {
+ // Do not add private system properties to the Properties
+ case "sun.nio.MaxDirectMemorySize":
+ case "sun.nio.PageAlignDirectMemory":
+ // used by java.lang.Integer.IntegerCache
+ case "java.lang.Integer.IntegerCache.high":
+ // used by sun.launcher.LauncherHelper
+ case "sun.java.launcher.diag":
+ // used by jdk.internal.loader.ClassLoaders
+ case "jdk.boot.class.path.append":
+ break;
+ default:
+ properties.put(prop, entry.getValue());
+ }
+ }
+ return properties;
+ }
+
/**
* Initialize the system class. Called after thread initialization.
*/
private static void initPhase1() {
-
// VM might invoke JNU_NewStringPlatform() to set those encoding
// sensitive properties (user.home, user.name, boot.class.path, etc.)
// during "props" initialization.
// The charset is initialized in System.c and does not depend on the Properties.
- props = SystemProps.initProperties();
- VersionProps.init(props);
- StaticProperty.javaHome(); // Load StaticProperty to cache the property values
+ Map tempProps = SystemProps.initProperties();
+ VersionProps.init(tempProps);
// There are certain system configurations that may be controlled by
// VM options such as the maximum amount of direct memory and
@@ -1978,15 +2003,14 @@ public final class System {
// of autoboxing. Typically, the library will obtain these values
// from the properties set by the VM. If the properties are for
// internal implementation use only, these properties should be
- // removed from the system properties.
- //
- // See java.lang.Integer.IntegerCache and the
- // VM.saveAndRemoveProperties method for example.
+ // masked from the system properties.
//
// Save a private copy of the system properties object that
- // can only be accessed by the internal implementation. Remove
- // certain system properties that are not intended for public access.
- VM.saveAndRemoveProperties(props);
+ // can only be accessed by the internal implementation.
+ VM.saveProperties(tempProps);
+ props = createProperties(tempProps);
+
+ StaticProperty.javaHome(); // Load StaticProperty to cache the property values
lineSeparator = props.getProperty("line.separator");
diff --git a/src/java.base/share/classes/java/lang/VersionProps.java.template b/src/java.base/share/classes/java/lang/VersionProps.java.template
index 9ed15112ed1..66035a130ae 100644
--- a/src/java.base/share/classes/java/lang/VersionProps.java.template
+++ b/src/java.base/share/classes/java/lang/VersionProps.java.template
@@ -28,8 +28,8 @@ package java.lang;
import java.io.PrintStream;
import java.util.Arrays;
import java.util.List;
+import java.util.Map;
import java.util.Optional;
-import java.util.Properties;
class VersionProps {
@@ -88,25 +88,25 @@ class VersionProps {
/**
* Initialize system properties using build provided values.
*
- * @param props Properties instance in which to insert the properties
+ * @param props Map instance in which to insert the properties
*/
- public static void init(Properties props) {
- props.setProperty("java.version", java_version);
- props.setProperty("java.version.date", java_version_date);
- props.setProperty("java.runtime.version", java_runtime_version);
- props.setProperty("java.runtime.name", java_runtime_name);
+ public static void init(Map props) {
+ props.put("java.version", java_version);
+ props.put("java.version.date", java_version_date);
+ props.put("java.runtime.version", java_runtime_version);
+ props.put("java.runtime.name", java_runtime_name);
if (VENDOR_VERSION_STRING.length() > 0)
- props.setProperty("java.vendor.version", VENDOR_VERSION_STRING);
+ props.put("java.vendor.version", VENDOR_VERSION_STRING);
- props.setProperty("java.class.version", CLASSFILE_MAJOR_MINOR);
+ props.put("java.class.version", CLASSFILE_MAJOR_MINOR);
- props.setProperty("java.specification.version", VERSION_SPECIFICATION);
- props.setProperty("java.specification.name", "Java Platform API Specification");
- props.setProperty("java.specification.vendor", "Oracle Corporation");
+ props.put("java.specification.version", VERSION_SPECIFICATION);
+ props.put("java.specification.name", "Java Platform API Specification");
+ props.put("java.specification.vendor", "Oracle Corporation");
- props.setProperty("java.vendor", VENDOR);
- props.setProperty("java.vendor.url", VENDOR_URL);
- props.setProperty("java.vendor.url.bug", VENDOR_URL_BUG);
+ props.put("java.vendor", VENDOR);
+ props.put("java.vendor.url", VENDOR_URL);
+ props.put("java.vendor.url.bug", VENDOR_URL_BUG);
}
private static int parseVersionNumber(String version, int prevIndex, int index) {
diff --git a/src/java.base/share/classes/java/net/URI.java b/src/java.base/share/classes/java/net/URI.java
index 2f5ac158d6e..0f784961825 100644
--- a/src/java.base/share/classes/java/net/URI.java
+++ b/src/java.base/share/classes/java/net/URI.java
@@ -25,6 +25,7 @@
package java.net;
+import java.io.File;
import java.io.IOException;
import java.io.InvalidObjectException;
import java.io.ObjectInputStream;
@@ -36,6 +37,7 @@ import java.nio.charset.CharsetDecoder;
import java.nio.charset.CoderResult;
import java.nio.charset.CodingErrorAction;
import java.nio.charset.CharacterCodingException;
+import java.nio.file.Path;
import java.text.Normalizer;
import jdk.internal.access.JavaNetUriAccess;
import jdk.internal.access.SharedSecrets;
@@ -458,6 +460,27 @@ import java.lang.NullPointerException; // for javadoc
* resolution as well as the network I/O operations of looking up the host and
* opening a connection to the specified resource.
*
+ * @apiNote
+ *
+ * Applications working with file paths and file URIs should take great
+ * care to use the appropriate methods to convert between the two.
+ * The {@link Path#of(URI)} factory method and the {@link File#File(URI)}
+ * constructor can be used to create {@link Path} or {@link File}
+ * objects from a file URI. {@link Path#toUri()} and {@link File#toURI()}
+ * can be used to create a {@link URI} from a file path.
+ * Applications should never try to {@linkplain
+ * #URI(String, String, String, int, String, String, String)
+ * construct}, {@linkplain #URI(String) parse}, or
+ * {@linkplain #resolve(String) resolve} a {@code URI}
+ * from the direct string representation of a {@code File} or {@code Path}
+ * instance.
+ *
+ * Some components of a URL or URI, such as userinfo, may
+ * be abused to construct misleading URLs or URIs. Applications
+ * that deal with URLs or URIs should take into account
+ * the recommendations advised in RFC3986,
+ * Section 7, Security Considerations.
*
* @author Mark Reinhold
* @since 1.4
diff --git a/src/java.base/share/classes/java/net/URL.java b/src/java.base/share/classes/java/net/URL.java
index 93de5622ed8..81279425b4c 100644
--- a/src/java.base/share/classes/java/net/URL.java
+++ b/src/java.base/share/classes/java/net/URL.java
@@ -25,9 +25,11 @@
package java.net;
+import java.io.File;
import java.io.IOException;
import java.io.InputStream;
import java.net.spi.URLStreamHandlerProvider;
+import java.nio.file.Path;
import java.security.AccessController;
import java.security.PrivilegedAction;
import java.util.Hashtable;
@@ -145,6 +147,27 @@ import sun.security.action.GetPropertyAction;
* used, but only for HTML form encoding, which is not the same
* as the encoding scheme defined in RFC2396.
*
+ * @apiNote
+ *
+ * Applications working with file paths and file URIs should take great
+ * care to use the appropriate methods to convert between the two.
+ * The {@link Path#of(URI)} factory method and the {@link File#File(URI)}
+ * constructor can be used to create {@link Path} or {@link File}
+ * objects from a file URI. {@link Path#toUri()} and {@link File#toURI()}
+ * can be used to create a {@link URI} from a file path, which can be
+ * converted to URL using {@link URI#toURL()}.
+ * Applications should never try to {@linkplain #URL(String, String, String)
+ * construct} or {@linkplain #URL(String) parse} a {@code URL}
+ * from the direct string representation of a {@code File} or {@code Path}
+ * instance.
+ *
+ * Some components of a URL or URI, such as userinfo, may
+ * be abused to construct misleading URLs or URIs. Applications
+ * that deal with URLs or URIs should take into account
+ * the recommendations advised in RFC3986,
+ * Section 7, Security Considerations.
+ *
* @author James Gosling
* @since 1.0
*/
diff --git a/src/java.base/share/classes/java/security/KeyStore.java b/src/java.base/share/classes/java/security/KeyStore.java
index acb34db2383..fb7e90fed8f 100644
--- a/src/java.base/share/classes/java/security/KeyStore.java
+++ b/src/java.base/share/classes/java/security/KeyStore.java
@@ -314,14 +314,7 @@ public class KeyStore {
/**
* Gets the name of the protection algorithm.
* If none was set then the keystore provider will use its default
- * protection algorithm. The name of the default protection algorithm
- * for a given keystore type is set using the
- * {@code 'keystore..keyProtectionAlgorithm'} security property.
- * For example, the
- * {@code keystore.PKCS12.keyProtectionAlgorithm} property stores the
- * name of the default key protection algorithm used for PKCS12
- * keystores. If the security property is not set, an
- * implementation-specific algorithm will be used.
+ * protection algorithm.
*
* @return the algorithm name, or {@code null} if none was set
*
@@ -1813,8 +1806,8 @@ public class KeyStore {
}
}
- throw new KeyStoreException("This keystore does not support probing "
- + "and must be loaded with a specified type");
+ throw new KeyStoreException("Unrecognized keystore format. "
+ + "Please load it with a specified type");
}
/**
diff --git a/src/java.base/share/classes/java/security/Provider.java b/src/java.base/share/classes/java/security/Provider.java
index 324de1bf9a4..3ebd72104ee 100644
--- a/src/java.base/share/classes/java/security/Provider.java
+++ b/src/java.base/share/classes/java/security/Provider.java
@@ -33,6 +33,7 @@ import java.lang.reflect.*;
import java.util.function.BiConsumer;
import java.util.function.BiFunction;
import java.util.function.Function;
+import java.util.concurrent.ConcurrentHashMap;
/**
* This class represents a "provider" for the
@@ -225,6 +226,7 @@ public abstract class Provider extends Properties {
this.version = version;
this.versionStr = Double.toString(version);
this.info = info;
+ this.serviceMap = new ConcurrentHashMap<>();
putId();
initialized = true;
}
@@ -262,6 +264,7 @@ public abstract class Provider extends Properties {
this.versionStr = versionStr;
this.version = parseVersionStr(versionStr);
this.info = info;
+ this.serviceMap = new ConcurrentHashMap<>();
putId();
initialized = true;
}
@@ -852,10 +855,7 @@ public abstract class Provider extends Properties {
// legacy properties changed since last call to any services method?
private transient boolean legacyChanged;
// serviceMap changed since last call to getServices()
- private transient boolean servicesChanged;
-
- // Map
- private transient Map legacyStrings;
+ private volatile transient boolean servicesChanged;
// Map
// used for services added via putService(), initialized on demand
@@ -905,22 +905,18 @@ public abstract class Provider extends Properties {
// otherwise, set version based on versionStr
this.version = parseVersionStr(this.versionStr);
}
+ this.serviceMap = new ConcurrentHashMap<>();
implClear();
initialized = true;
putAll(copy);
}
- private boolean checkLegacy(Object key) {
+ private static boolean isProviderInfo(Object key) {
String keyString = (String)key;
if (keyString.startsWith("Provider.")) {
- return false;
+ return true;
}
-
- legacyChanged = true;
- if (legacyStrings == null) {
- legacyStrings = new LinkedHashMap<>();
- }
- return true;
+ return false;
}
/**
@@ -936,20 +932,20 @@ public abstract class Provider extends Properties {
private Object implRemove(Object key) {
if (key instanceof String) {
- if (!checkLegacy(key)) {
+ if (isProviderInfo(key)) {
return null;
}
- legacyStrings.remove((String)key);
+ legacyChanged = true;
}
return super.remove(key);
}
private boolean implRemove(Object key, Object value) {
if (key instanceof String && value instanceof String) {
- if (!checkLegacy(key)) {
+ if (isProviderInfo(key)) {
return false;
}
- legacyStrings.remove((String)key, value);
+ legacyChanged = true;
}
return super.remove(key, value);
}
@@ -957,21 +953,20 @@ public abstract class Provider extends Properties {
private boolean implReplace(Object key, Object oldValue, Object newValue) {
if ((key instanceof String) && (oldValue instanceof String) &&
(newValue instanceof String)) {
- if (!checkLegacy(key)) {
+ if (isProviderInfo(key)) {
return false;
}
- legacyStrings.replace((String)key, (String)oldValue,
- (String)newValue);
+ legacyChanged = true;
}
return super.replace(key, oldValue, newValue);
}
private Object implReplace(Object key, Object value) {
if ((key instanceof String) && (value instanceof String)) {
- if (!checkLegacy(key)) {
+ if (isProviderInfo(key)) {
return null;
}
- legacyStrings.replace((String)key, (String)value);
+ legacyChanged = true;
}
return super.replace(key, value);
}
@@ -980,12 +975,6 @@ public abstract class Provider extends Properties {
private void implReplaceAll(BiFunction function) {
legacyChanged = true;
- if (legacyStrings == null) {
- legacyStrings = new LinkedHashMap<>();
- } else {
- legacyStrings.replaceAll((BiFunction) function);
- }
super.replaceAll(function);
}
@@ -993,11 +982,10 @@ public abstract class Provider extends Properties {
private Object implMerge(Object key, Object value, BiFunction remappingFunction) {
if ((key instanceof String) && (value instanceof String)) {
- if (!checkLegacy(key)) {
+ if (isProviderInfo(key)) {
return null;
}
- legacyStrings.merge((String)key, (String)value,
- (BiFunction) remappingFunction);
+ legacyChanged = true;
}
return super.merge(key, value, remappingFunction);
}
@@ -1006,11 +994,10 @@ public abstract class Provider extends Properties {
private Object implCompute(Object key, BiFunction remappingFunction) {
if (key instanceof String) {
- if (!checkLegacy(key)) {
+ if (isProviderInfo(key)) {
return null;
}
- legacyStrings.compute((String) key,
- (BiFunction) remappingFunction);
+ legacyChanged = true;
}
return super.compute(key, remappingFunction);
}
@@ -1019,11 +1006,10 @@ public abstract class Provider extends Properties {
private Object implComputeIfAbsent(Object key, Function mappingFunction) {
if (key instanceof String) {
- if (!checkLegacy(key)) {
+ if (isProviderInfo(key)) {
return null;
}
- legacyStrings.computeIfAbsent((String) key,
- (Function) mappingFunction);
+ legacyChanged = true;
}
return super.computeIfAbsent(key, mappingFunction);
}
@@ -1032,45 +1018,39 @@ public abstract class Provider extends Properties {
private Object implComputeIfPresent(Object key, BiFunction remappingFunction) {
if (key instanceof String) {
- if (!checkLegacy(key)) {
+ if (isProviderInfo(key)) {
return null;
}
- legacyStrings.computeIfPresent((String) key,
- (BiFunction) remappingFunction);
+ legacyChanged = true;
}
return super.computeIfPresent(key, remappingFunction);
}
private Object implPut(Object key, Object value) {
if ((key instanceof String) && (value instanceof String)) {
- if (!checkLegacy(key)) {
+ if (isProviderInfo(key)) {
return null;
}
- legacyStrings.put((String)key, (String)value);
+ legacyChanged = true;
}
return super.put(key, value);
}
private Object implPutIfAbsent(Object key, Object value) {
if ((key instanceof String) && (value instanceof String)) {
- if (!checkLegacy(key)) {
+ if (isProviderInfo(key)) {
return null;
}
- legacyStrings.putIfAbsent((String)key, (String)value);
+ legacyChanged = true;
}
return super.putIfAbsent(key, value);
}
private void implClear() {
- if (legacyStrings != null) {
- legacyStrings.clear();
- }
if (legacyMap != null) {
legacyMap.clear();
}
- if (serviceMap != null) {
- serviceMap.clear();
- }
+ serviceMap.clear();
legacyChanged = false;
servicesChanged = false;
serviceSet = null;
@@ -1090,13 +1070,13 @@ public abstract class Provider extends Properties {
this.algorithm = intern ? algorithm.intern() : algorithm;
}
public int hashCode() {
- return type.hashCode() + algorithm.hashCode();
+ return Objects.hash(type, algorithm);
}
public boolean equals(Object obj) {
if (this == obj) {
return true;
}
- if (obj instanceof ServiceKey == false) {
+ if (!(obj instanceof ServiceKey)) {
return false;
}
ServiceKey other = (ServiceKey)obj;
@@ -1113,16 +1093,16 @@ public abstract class Provider extends Properties {
* service objects.
*/
private void ensureLegacyParsed() {
- if ((legacyChanged == false) || (legacyStrings == null)) {
+ if (legacyChanged == false) {
return;
}
serviceSet = null;
if (legacyMap == null) {
- legacyMap = new LinkedHashMap<>();
+ legacyMap = new ConcurrentHashMap<>();
} else {
legacyMap.clear();
}
- for (Map.Entry entry : legacyStrings.entrySet()) {
+ for (Map.Entry entry : super.entrySet()) {
parseLegacyPut(entry.getKey(), entry.getValue());
}
removeInvalidServices(legacyMap);
@@ -1161,7 +1141,15 @@ public abstract class Provider extends Properties {
private static final String ALIAS_PREFIX_LOWER = "alg.alias.";
private static final int ALIAS_LENGTH = ALIAS_PREFIX.length();
- private void parseLegacyPut(String name, String value) {
+ private void parseLegacyPut(Object k, Object v) {
+ if (!(k instanceof String) || !(v instanceof String)) {
+ return;
+ }
+ String name = (String) k;
+ String value = (String) v;
+ if (isProviderInfo(name)) {
+ return;
+ }
if (name.toLowerCase(ENGLISH).startsWith(ALIAS_PREFIX_LOWER)) {
// e.g. put("Alg.Alias.MessageDigest.SHA", "SHA-1");
// aliasKey ~ MessageDigest.SHA
@@ -1248,22 +1236,28 @@ public abstract class Provider extends Properties {
*
* @since 1.5
*/
- public synchronized Service getService(String type, String algorithm) {
+ public Service getService(String type, String algorithm) {
checkInitialized();
- // avoid allocating a new key object if possible
+
+ // avoid allocating a new ServiceKey object if possible
ServiceKey key = previousKey;
if (key.matches(type, algorithm) == false) {
key = new ServiceKey(type, algorithm, false);
previousKey = key;
}
- if (serviceMap != null) {
- Service service = serviceMap.get(key);
- if (service != null) {
- return service;
+ if (!serviceMap.isEmpty()) {
+ Service s = serviceMap.get(key);
+ if (s != null) {
+ return s;
}
}
- ensureLegacyParsed();
- return (legacyMap != null) ? legacyMap.get(key) : null;
+ synchronized (this) {
+ ensureLegacyParsed();
+ }
+ if (legacyMap != null && !legacyMap.isEmpty()) {
+ return legacyMap.get(key);
+ }
+ return null;
}
// ServiceKey from previous getService() call
@@ -1292,10 +1286,10 @@ public abstract class Provider extends Properties {
if (serviceSet == null) {
ensureLegacyParsed();
Set set = new LinkedHashSet<>();
- if (serviceMap != null) {
+ if (!serviceMap.isEmpty()) {
set.addAll(serviceMap.values());
}
- if (legacyMap != null) {
+ if (legacyMap != null && !legacyMap.isEmpty()) {
set.addAll(legacyMap.values());
}
serviceSet = Collections.unmodifiableSet(set);
@@ -1333,7 +1327,7 @@ public abstract class Provider extends Properties {
*
* @since 1.5
*/
- protected synchronized void putService(Service s) {
+ protected void putService(Service s) {
check("putProviderProperty." + name);
if (debug != null) {
debug.println(name + ".putService(): " + s);
@@ -1345,20 +1339,18 @@ public abstract class Provider extends Properties {
throw new IllegalArgumentException
("service.getProvider() must match this Provider object");
}
- if (serviceMap == null) {
- serviceMap = new LinkedHashMap<>();
- }
- servicesChanged = true;
String type = s.getType();
String algorithm = s.getAlgorithm();
ServiceKey key = new ServiceKey(type, algorithm, true);
- // remove existing service
implRemoveService(serviceMap.get(key));
serviceMap.put(key, s);
for (String alias : s.getAliases()) {
serviceMap.put(new ServiceKey(type, alias, true), s);
}
- putPropertyStrings(s);
+ servicesChanged = true;
+ synchronized (this) {
+ putPropertyStrings(s);
+ }
}
/**
@@ -1425,7 +1417,7 @@ public abstract class Provider extends Properties {
*
* @since 1.5
*/
- protected synchronized void removeService(Service s) {
+ protected void removeService(Service s) {
check("removeProviderProperty." + name);
if (debug != null) {
debug.println(name + ".removeService(): " + s);
@@ -1437,7 +1429,7 @@ public abstract class Provider extends Properties {
}
private void implRemoveService(Service s) {
- if ((s == null) || (serviceMap == null)) {
+ if ((s == null) || serviceMap.isEmpty()) {
return;
}
String type = s.getType();
@@ -1452,7 +1444,9 @@ public abstract class Provider extends Properties {
for (String alias : s.getAliases()) {
serviceMap.remove(new ServiceKey(type, alias, false));
}
- removePropertyStrings(s);
+ synchronized (this) {
+ removePropertyStrings(s);
+ }
}
// Wrapped String that behaves in a case insensitive way for equals/hashCode
diff --git a/src/java.base/share/classes/java/util/SplittableRandom.java b/src/java.base/share/classes/java/util/SplittableRandom.java
index b85572f59bf..ff33624a00c 100644
--- a/src/java.base/share/classes/java/util/SplittableRandom.java
+++ b/src/java.base/share/classes/java/util/SplittableRandom.java
@@ -80,7 +80,7 @@ import java.util.stream.StreamSupport;
* in security-sensitive applications. Additionally,
* default-constructed instances do not use a cryptographically random
* seed unless the {@linkplain System#getProperty system property}
- * {@code java.util.secureRandomSeed} is set to {@code true}.
+ * {@systemProperty java.util.secureRandomSeed} is set to {@code true}.
*
* @author Guy Steele
* @author Doug Lea
diff --git a/src/java.base/share/classes/java/util/concurrent/ConcurrentHashMap.java b/src/java.base/share/classes/java/util/concurrent/ConcurrentHashMap.java
index de2dcbdb29d..3652b51f087 100644
--- a/src/java.base/share/classes/java/util/concurrent/ConcurrentHashMap.java
+++ b/src/java.base/share/classes/java/util/concurrent/ConcurrentHashMap.java
@@ -2334,17 +2334,15 @@ public class ConcurrentHashMap extends AbstractMap
Node[] tab, nt; int n, sc;
while (s >= (long)(sc = sizeCtl) && (tab = table) != null &&
(n = tab.length) < MAXIMUM_CAPACITY) {
- int rs = resizeStamp(n);
+ int rs = resizeStamp(n) << RESIZE_STAMP_SHIFT;
if (sc < 0) {
- if ((sc >>> RESIZE_STAMP_SHIFT) != rs || sc == rs + 1 ||
- sc == rs + MAX_RESIZERS || (nt = nextTable) == null ||
- transferIndex <= 0)
+ if (sc == rs + MAX_RESIZERS || sc == rs + 1 ||
+ (nt = nextTable) == null || transferIndex <= 0)
break;
if (U.compareAndSetInt(this, SIZECTL, sc, sc + 1))
transfer(tab, nt);
}
- else if (U.compareAndSetInt(this, SIZECTL, sc,
- (rs << RESIZE_STAMP_SHIFT) + 2))
+ else if (U.compareAndSetInt(this, SIZECTL, sc, rs + 2))
transfer(tab, null);
s = sumCount();
}
@@ -2358,11 +2356,11 @@ public class ConcurrentHashMap extends AbstractMap
Node[] nextTab; int sc;
if (tab != null && (f instanceof ForwardingNode) &&
(nextTab = ((ForwardingNode)f).nextTable) != null) {
- int rs = resizeStamp(tab.length);
+ int rs = resizeStamp(tab.length) << RESIZE_STAMP_SHIFT;
while (nextTab == nextTable && table == tab &&
(sc = sizeCtl) < 0) {
- if ((sc >>> RESIZE_STAMP_SHIFT) != rs || sc == rs + 1 ||
- sc == rs + MAX_RESIZERS || transferIndex <= 0)
+ if (sc == rs + MAX_RESIZERS || sc == rs + 1 ||
+ transferIndex <= 0)
break;
if (U.compareAndSetInt(this, SIZECTL, sc, sc + 1)) {
transfer(tab, nextTab);
diff --git a/src/java.base/share/classes/java/util/concurrent/ForkJoinPool.java b/src/java.base/share/classes/java/util/concurrent/ForkJoinPool.java
index d1f5e567190..5ff7f26b6aa 100644
--- a/src/java.base/share/classes/java/util/concurrent/ForkJoinPool.java
+++ b/src/java.base/share/classes/java/util/concurrent/ForkJoinPool.java
@@ -136,17 +136,17 @@ import java.util.concurrent.locks.LockSupport;
* The parameters used to construct the common pool may be controlled by
* setting the following {@linkplain System#getProperty system properties}:
*
- * - {@code java.util.concurrent.ForkJoinPool.common.parallelism}
+ *
- {@systemProperty java.util.concurrent.ForkJoinPool.common.parallelism}
* - the parallelism level, a non-negative integer
- *
- {@code java.util.concurrent.ForkJoinPool.common.threadFactory}
+ *
- {@systemProperty java.util.concurrent.ForkJoinPool.common.threadFactory}
* - the class name of a {@link ForkJoinWorkerThreadFactory}.
* The {@linkplain ClassLoader#getSystemClassLoader() system class loader}
* is used to load this class.
- *
- {@code java.util.concurrent.ForkJoinPool.common.exceptionHandler}
+ *
- {@systemProperty java.util.concurrent.ForkJoinPool.common.exceptionHandler}
* - the class name of a {@link UncaughtExceptionHandler}.
* The {@linkplain ClassLoader#getSystemClassLoader() system class loader}
* is used to load this class.
- *
- {@code java.util.concurrent.ForkJoinPool.common.maximumSpares}
+ *
- {@systemProperty java.util.concurrent.ForkJoinPool.common.maximumSpares}
* - the maximum number of allowed extra threads to maintain target
* parallelism (default 256).
*
diff --git a/src/java.base/share/classes/java/util/concurrent/locks/Lock.java b/src/java.base/share/classes/java/util/concurrent/locks/Lock.java
index 33ac44b8493..2bc880ddaeb 100644
--- a/src/java.base/share/classes/java/util/concurrent/locks/Lock.java
+++ b/src/java.base/share/classes/java/util/concurrent/locks/Lock.java
@@ -122,7 +122,7 @@ import java.util.concurrent.TimeUnit;
* All {@code Lock} implementations must enforce the same
* memory synchronization semantics as provided by the built-in monitor
* lock, as described in
- *
+ *
* Chapter 17 of
* The Java™ Language Specification:
*
diff --git a/src/java.base/share/classes/java/util/concurrent/locks/StampedLock.java b/src/java.base/share/classes/java/util/concurrent/locks/StampedLock.java
index d1f29be2d93..6d6557c41f6 100644
--- a/src/java.base/share/classes/java/util/concurrent/locks/StampedLock.java
+++ b/src/java.base/share/classes/java/util/concurrent/locks/StampedLock.java
@@ -133,7 +133,7 @@ import jdk.internal.vm.annotation.ReservedStackAccess;
* Memory Synchronization. Methods with the effect of
* successfully locking in any mode have the same memory
* synchronization effects as a Lock action described in
- *
+ *
* Chapter 17 of The Java™ Language Specification.
* Methods successfully unlocking in write mode have the same memory
* synchronization effects as an Unlock action. In optimistic
diff --git a/src/java.base/share/classes/java/util/concurrent/package-info.java b/src/java.base/share/classes/java/util/concurrent/package-info.java
index 0e992a2af08..8b2fd39ad2c 100644
--- a/src/java.base/share/classes/java/util/concurrent/package-info.java
+++ b/src/java.base/share/classes/java/util/concurrent/package-info.java
@@ -226,7 +226,7 @@
*
*
Memory Consistency Properties
*
- *
+ *
* Chapter 17 of
* The Java™ Language Specification defines the
* happens-before relation on memory operations such as reads and
diff --git a/src/java.base/share/classes/jdk/internal/event/EventHelper.java b/src/java.base/share/classes/jdk/internal/event/EventHelper.java
index 2832945ee81..5eacb9392d5 100644
--- a/src/java.base/share/classes/jdk/internal/event/EventHelper.java
+++ b/src/java.base/share/classes/jdk/internal/event/EventHelper.java
@@ -101,6 +101,9 @@ public final class EventHelper {
*/
private static String getDurationString(Instant start) {
if (start != null) {
+ if (start.equals(Instant.MIN)) {
+ return "N/A";
+ }
Duration duration = Duration.between(start, Instant.now());
long micros = duration.toNanos() / 1_000;
if (micros < 1_000_000) {
diff --git a/src/java.base/share/classes/jdk/internal/misc/VM.java b/src/java.base/share/classes/jdk/internal/misc/VM.java
index 561b3aaa253..872c3abdd83 100644
--- a/src/java.base/share/classes/jdk/internal/misc/VM.java
+++ b/src/java.base/share/classes/jdk/internal/misc/VM.java
@@ -26,6 +26,8 @@
package jdk.internal.misc;
import static java.lang.Thread.State.*;
+
+import java.util.Collections;
import java.util.Map;
import java.util.Properties;
@@ -175,7 +177,7 @@ public class VM {
if (savedProps == null)
throw new IllegalStateException("Not yet initialized");
- return savedProps;
+ return Collections.unmodifiableMap(savedProps);
}
private static Map savedProps;
@@ -184,16 +186,15 @@ public class VM {
// the system properties that are not intended for public access.
//
// This method can only be invoked during system initialization.
- public static void saveAndRemoveProperties(Properties props) {
+ public static void saveProperties(Map props) {
if (initLevel() != 0)
throw new IllegalStateException("Wrong init level");
- @SuppressWarnings({"rawtypes", "unchecked"})
- Map sp =
- Map.ofEntries(props.entrySet().toArray(new Map.Entry[0]));
// only main thread is running at this time, so savedProps and
// its content will be correctly published to threads started later
- savedProps = sp;
+ if (savedProps == null) {
+ savedProps = props;
+ }
// Set the maximum amount of direct memory. This value is controlled
// by the vm option -XX:MaxDirectMemorySize=.
@@ -201,7 +202,7 @@ public class VM {
// from the system property sun.nio.MaxDirectMemorySize set by the VM.
// If not set or set to -1, the max memory will be used
// The system property will be removed.
- String s = (String)props.remove("sun.nio.MaxDirectMemorySize");
+ String s = props.get("sun.nio.MaxDirectMemorySize");
if (s == null || s.isEmpty() || s.equals("-1")) {
// -XX:MaxDirectMemorySize not given, take default
directMemory = Runtime.getRuntime().maxMemory();
@@ -212,19 +213,9 @@ public class VM {
}
// Check if direct buffers should be page aligned
- s = (String)props.remove("sun.nio.PageAlignDirectMemory");
+ s = props.get("sun.nio.PageAlignDirectMemory");
if ("true".equals(s))
pageAlignDirectMemory = true;
-
- // Remove other private system properties
- // used by java.lang.Integer.IntegerCache
- props.remove("java.lang.Integer.IntegerCache.high");
-
- // used by sun.launcher.LauncherHelper
- props.remove("sun.java.launcher.diag");
-
- // used by jdk.internal.loader.ClassLoaders
- props.remove("jdk.boot.class.path.append");
}
// Initialize any miscellaneous operating system settings that need to be
diff --git a/src/java.base/share/classes/jdk/internal/reflect/Reflection.java b/src/java.base/share/classes/jdk/internal/reflect/Reflection.java
index 7fd94e54e5a..492103209aa 100644
--- a/src/java.base/share/classes/jdk/internal/reflect/Reflection.java
+++ b/src/java.base/share/classes/jdk/internal/reflect/Reflection.java
@@ -56,6 +56,7 @@ public class Reflection {
Constructor.class, ALL_MEMBERS,
Field.class, ALL_MEMBERS,
Method.class, ALL_MEMBERS,
+ Module.class, ALL_MEMBERS,
System.class, Set.of("security")
);
methodFilterMap = Map.of();
diff --git a/src/java.base/share/classes/jdk/internal/util/SystemProps.java b/src/java.base/share/classes/jdk/internal/util/SystemProps.java
index 5c300597f3a..6bda754a04d 100644
--- a/src/java.base/share/classes/jdk/internal/util/SystemProps.java
+++ b/src/java.base/share/classes/jdk/internal/util/SystemProps.java
@@ -26,7 +26,8 @@ package jdk.internal.util;
import java.lang.annotation.Native;
-import java.util.Properties;
+import java.util.HashMap;
+import java.util.Map;
/**
* System Property initialization for internal use only
@@ -47,12 +48,13 @@ public final class SystemProps {
*
* @return a Properties instance initialized with all of the properties
*/
- public static Properties initProperties() {
+ public static Map initProperties() {
+
// Initially, cmdProperties only includes -D and props from the VM
Raw raw = new Raw();
- Properties props = raw.cmdProperties();
+ HashMap props = raw.cmdProperties();
- String javaHome = props.getProperty("java.home");
+ String javaHome = props.get("java.home");
assert javaHome != null : "java.home not set";
putIfAbsent(props, "user.home", raw.propDefault(Raw._user_home_NDX));
@@ -92,7 +94,6 @@ public final class SystemProps {
putIfAbsent(props, "java.awt.headless", raw.propDefault(Raw._java_awt_headless_NDX));
putIfAbsent(props, "java.awt.graphicsenv", raw.propDefault(Raw._java_awt_graphicsenv_NDX));
putIfAbsent(props, "sun.desktop", raw.propDefault(Raw._sun_desktop_NDX));
- putIfAbsent(props, "sun.java2d.fontpath", raw.propDefault(Raw._sun_java2d_fontpath_NDX));
putIfAbsent(props, "sun.arch.abi", raw.propDefault(Raw._sun_arch_abi_NDX));
putIfAbsent(props, "sun.arch.data.model", raw.propDefault(Raw._sun_arch_data_model_NDX));
putIfAbsent(props, "sun.os.patch.level", raw.propDefault(Raw._sun_os_patch_level_NDX));
@@ -121,7 +122,7 @@ public final class SystemProps {
* @param key the key
* @param value the value
*/
- private static void put(Properties props, String key, String value) {
+ private static void put(HashMap props, String key, String value) {
if (value != null) {
props.put(key, value);
}
@@ -133,7 +134,7 @@ public final class SystemProps {
* @param key the key
* @param value the value
*/
- private static void putIfAbsent(Properties props, String key, String value) {
+ private static void putIfAbsent(HashMap props, String key, String value) {
if (value != null) {
props.putIfAbsent(key, value);
}
@@ -148,10 +149,12 @@ public final class SystemProps {
* @param display the display value for the base
* @param format the format value for the base
*/
- private static void fillI18nProps(Properties cmdProps, String base, String display,
+ private static void fillI18nProps(HashMap cmdProps,
+ String base,
+ String display,
String format) {
// Do not override command line setting
- String baseValue = cmdProps.getProperty(base);
+ String baseValue = cmdProps.get(base);
if (baseValue != null) {
return; // Do not override value from the command line
}
@@ -164,7 +167,7 @@ public final class SystemProps {
/* user.xxx.display property */
String disp = base.concat(".display");
- String dispValue = cmdProps.getProperty(disp);
+ String dispValue = cmdProps.get(disp);
if (dispValue == null && display != null && !display.equals(baseValue)) {
// Create the property only if different from the base property
cmdProps.put(disp, display);
@@ -172,7 +175,7 @@ public final class SystemProps {
/* user.xxx.format property */
String fmt = base.concat(".format");
- String fmtValue = cmdProps.getProperty(fmt);
+ String fmtValue = cmdProps.get(fmt);
if (fmtValue == null && format != null && !format.equals(baseValue)) {
// Create the property only if different than the base property
cmdProps.put(fmt, format);
@@ -221,8 +224,7 @@ public final class SystemProps {
@Native private static final int _sun_cpu_isalist_NDX = 1 + _sun_cpu_endian_NDX;
@Native private static final int _sun_desktop_NDX = 1 + _sun_cpu_isalist_NDX;
@Native private static final int _sun_io_unicode_encoding_NDX = 1 + _sun_desktop_NDX;
- @Native private static final int _sun_java2d_fontpath_NDX = 1 + _sun_io_unicode_encoding_NDX;
- @Native private static final int _sun_jnu_encoding_NDX = 1 + _sun_java2d_fontpath_NDX;
+ @Native private static final int _sun_jnu_encoding_NDX = 1 + _sun_io_unicode_encoding_NDX;
@Native private static final int _sun_os_patch_level_NDX = 1 + _sun_jnu_encoding_NDX;
@Native private static final int _sun_stderr_encoding_NDX = 1 + _sun_os_patch_level_NDX;
@Native private static final int _sun_stdout_encoding_NDX = 1 + _sun_stderr_encoding_NDX;
@@ -255,15 +257,17 @@ public final class SystemProps {
*
* @return return a Properties instance of the command line and VM options
*/
- private Properties cmdProperties() {
+ private HashMap cmdProperties() {
String[] vmProps = vmProperties();
- int nProps = vmProps.length / 2;
- var cmdProps = new Properties(nProps + Raw.FIXED_LENGTH);
- for (int i = 0; i < nProps; i++) {
- String k = vmProps[i * 2];
+ // While optimal initialCapacity here would be the exact number of properties
+ // divided by LOAD_FACTOR, a large portion of the properties in Raw are
+ // usually not set, so for typical cases the chosen capacity avoids resizing
+ var cmdProps = new HashMap((vmProps.length / 2) + Raw.FIXED_LENGTH);
+ for (int i = 0; i < vmProps.length;) {
+ String k = vmProps[i++];
if (k != null) {
- String v = vmProps[i * 2 + 1];
- cmdProps.setProperty(k, v != null ? v : "");
+ String v = vmProps[i++];
+ cmdProps.put(k, v != null ? v : "");
} else {
// no more key/value pairs
break;
diff --git a/src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java b/src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java
index 59d081bb56f..b696ee8d7bd 100644
--- a/src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java
+++ b/src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java
@@ -53,7 +53,6 @@ import java.util.*;
import java.security.AlgorithmParameters;
import java.security.InvalidAlgorithmParameterException;
-import java.security.InvalidKeyException;
import javax.crypto.spec.PBEParameterSpec;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.SecretKeySpec;
@@ -70,6 +69,7 @@ import sun.security.util.DerOutputStream;
import sun.security.util.DerValue;
import sun.security.util.ObjectIdentifier;
import sun.security.pkcs.ContentInfo;
+import sun.security.util.SecurityProperties;
import sun.security.x509.AlgorithmId;
import sun.security.pkcs.EncryptedPrivateKeyInfo;
import sun.security.provider.JavaKeyStore.JKS;
@@ -81,9 +81,11 @@ import sun.security.util.KeyStoreDelegator;
* Implements the PKCS#12 PFX protected using the Password privacy mode.
* The contents are protected using Password integrity mode.
*
- * Currently we support following PBE algorithms:
- * - pbeWithSHAAnd3KeyTripleDESCBC to encrypt private keys
- * - pbeWithSHAAnd40BitRC2CBC to encrypt certificates
+ * Currently these PBE algorithms are used by default:
+ * - PBEWithSHA1AndDESede to encrypt private keys, iteration count 50000.
+ * - PBEWithSHA1AndRC2_40 to encrypt certificates, iteration count 50000.
+ *
+ * The default Mac algorithm is HmacPBESHA1, iteration count 100000.
*
* Supported encryption of various implementations :
*
@@ -126,11 +128,7 @@ import sun.security.util.KeyStoreDelegator;
* @author Jeff Nisewanger
* @author Jan Luehe
*
- * @see KeyProtector
* @see java.security.KeyStoreSpi
- * @see KeyTool
- *
- *
*/
public final class PKCS12KeyStore extends KeyStoreSpi {
@@ -143,14 +141,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
public static final int VERSION_3 = 3;
- private static final String[] KEY_PROTECTION_ALGORITHM = {
- "keystore.pkcs12.keyProtectionAlgorithm",
- "keystore.PKCS12.keyProtectionAlgorithm"
- };
-
private static final int MAX_ITERATION_COUNT = 5000000;
- private static final int PBE_ITERATION_COUNT = 50000; // default
- private static final int MAC_ITERATION_COUNT = 100000; // default
private static final int SALT_LEN = 20;
// friendlyName, localKeyId, trustedKeyUsage
@@ -171,10 +162,6 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
private static final int[] pkcs9certType = {1, 2, 840, 113549, 1, 9, 22, 1};
- private static final int[] pbeWithSHAAnd40BitRC2CBC =
- {1, 2, 840, 113549, 1, 12, 1, 6};
- private static final int[] pbeWithSHAAnd3KeyTripleDESCBC =
- {1, 2, 840, 113549, 1, 12, 1, 3};
private static final int[] pbes2 = {1, 2, 840, 113549, 1, 5, 13};
// TODO: temporary Oracle OID
/*
@@ -185,17 +172,15 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
{2, 16, 840, 1, 113894, 746875, 1, 1};
private static final int[] AnyExtendedKeyUsage = {2, 5, 29, 37, 0};
- private static ObjectIdentifier PKCS8ShroudedKeyBag_OID;
- private static ObjectIdentifier CertBag_OID;
- private static ObjectIdentifier SecretBag_OID;
- private static ObjectIdentifier PKCS9FriendlyName_OID;
- private static ObjectIdentifier PKCS9LocalKeyId_OID;
- private static ObjectIdentifier PKCS9CertType_OID;
- private static ObjectIdentifier pbeWithSHAAnd40BitRC2CBC_OID;
- private static ObjectIdentifier pbeWithSHAAnd3KeyTripleDESCBC_OID;
- private static ObjectIdentifier pbes2_OID;
- private static ObjectIdentifier TrustedKeyUsage_OID;
- private static ObjectIdentifier[] AnyUsage;
+ private static final ObjectIdentifier PKCS8ShroudedKeyBag_OID;
+ private static final ObjectIdentifier CertBag_OID;
+ private static final ObjectIdentifier SecretBag_OID;
+ private static final ObjectIdentifier PKCS9FriendlyName_OID;
+ private static final ObjectIdentifier PKCS9LocalKeyId_OID;
+ private static final ObjectIdentifier PKCS9CertType_OID;
+ private static final ObjectIdentifier pbes2_OID;
+ private static final ObjectIdentifier TrustedKeyUsage_OID;
+ private static final ObjectIdentifier[] AnyUsage;
private int counter = 0;
@@ -210,6 +195,17 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
// certificate count
private int certificateCount = 0;
+ // Alg/params used for *this* keystore. Initialized as -1 for ic and
+ // null for algorithm names. When an existing file is read, they will be
+ // assigned inside engineLoad() so storing an existing keystore uses the
+ // old alg/params. This makes sure if a keystore is created password-less
+ // it will be password-less forever. Otherwise, engineStore() will read
+ // the default values. These fields are always reset when load() is called.
+ private String certProtectionAlgorithm = null;
+ private int certPbeIterationCount = -1;
+ private String macAlgorithm = null;
+ private int macIterationCount = -1;
+
// the source of randomness
private SecureRandom random;
@@ -221,16 +217,12 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
PKCS9FriendlyName_OID = new ObjectIdentifier(pkcs9Name);
PKCS9LocalKeyId_OID = new ObjectIdentifier(pkcs9KeyId);
PKCS9CertType_OID = new ObjectIdentifier(pkcs9certType);
- pbeWithSHAAnd40BitRC2CBC_OID =
- new ObjectIdentifier(pbeWithSHAAnd40BitRC2CBC);
- pbeWithSHAAnd3KeyTripleDESCBC_OID =
- new ObjectIdentifier(pbeWithSHAAnd3KeyTripleDESCBC);
pbes2_OID = new ObjectIdentifier(pbes2);
TrustedKeyUsage_OID = new ObjectIdentifier(TrustedKeyUsage);
AnyUsage = new ObjectIdentifier[]{
new ObjectIdentifier(AnyExtendedKeyUsage)};
} catch (IOException ioe) {
- // should not happen
+ throw new AssertionError("OID not initialized", ioe);
}
}
@@ -391,7 +383,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
ic = pbeSpec.getIterationCount();
if (ic > MAX_ITERATION_COUNT) {
- throw new IOException("PBE iteration count too large");
+ throw new IOException("key PBE iteration count too large");
}
} else {
ic = 0;
@@ -424,7 +416,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
if (debug != null) {
debug.println("Retrieved a protected private key at alias" +
" '" + alias + "' (" +
- new AlgorithmId(algOid).getName() +
+ mapPBEParamsToAlgorithm(algOid, algParams) +
" iterations: " + ic + ")");
}
return tmp;
@@ -449,7 +441,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
if (debug != null) {
debug.println("Retrieved a protected secret key at alias " +
"'" + alias + "' (" +
- new AlgorithmId(algOid).getName() +
+ mapPBEParamsToAlgorithm(algOid, algParams) +
" iterations: " + ic + ")");
}
return tmp;
@@ -701,7 +693,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
entries.put(alias.toLowerCase(Locale.ENGLISH), entry);
} catch (Exception nsae) {
- throw new KeyStoreException("Key protection " +
+ throw new KeyStoreException("Key protection" +
" algorithm not found: " + nsae, nsae);
}
}
@@ -801,14 +793,13 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
/*
* Generate PBE Algorithm Parameters
*/
- private AlgorithmParameters getPBEAlgorithmParameters(String algorithm)
- throws IOException
- {
+ private AlgorithmParameters getPBEAlgorithmParameters(
+ String algorithm, int iterationCount) throws IOException {
AlgorithmParameters algParams = null;
// create PBE parameters from salt and iteration count
PBEParameterSpec paramSpec =
- new PBEParameterSpec(getSalt(), PBE_ITERATION_COUNT);
+ new PBEParameterSpec(getSalt(), iterationCount);
try {
algParams = AlgorithmParameters.getInstance(algorithm);
algParams.init(paramSpec);
@@ -871,13 +862,14 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
}
/*
- * Encrypt private key using Password-based encryption (PBE)
+ * Encrypt private key or secret key using Password-based encryption (PBE)
* as defined in PKCS#5.
*
* NOTE: By default, pbeWithSHAAnd3-KeyTripleDES-CBC algorithmID is
* used to derive the key and IV.
*
- * @return encrypted private key encoded as EncryptedPrivateKeyInfo
+ * @return encrypted private key or secret key encoded as
+ * EncryptedPrivateKeyInfo
*/
private byte[] encryptPrivateKey(byte[] data,
KeyStore.PasswordProtection passwordProtection)
@@ -899,27 +891,14 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
algParams = AlgorithmParameters.getInstance(algorithm);
algParams.init(algParamSpec);
} else {
- algParams = getPBEAlgorithmParameters(algorithm);
+ algParams = getPBEAlgorithmParameters(algorithm,
+ defaultKeyPbeIterationCount());
}
} else {
// Check default key protection algorithm for PKCS12 keystores
- algorithm = AccessController.doPrivileged(
- new PrivilegedAction() {
- public String run() {
- String prop =
- Security.getProperty(
- KEY_PROTECTION_ALGORITHM[0]);
- if (prop == null) {
- prop = Security.getProperty(
- KEY_PROTECTION_ALGORITHM[1]);
- }
- return prop;
- }
- });
- if (algorithm == null || algorithm.isEmpty()) {
- algorithm = "PBEWithSHA1AndDESede";
- }
- algParams = getPBEAlgorithmParameters(algorithm);
+ algorithm = defaultKeyProtectionAlgorithm();
+ algParams = getPBEAlgorithmParameters(algorithm,
+ defaultKeyPbeIterationCount());
}
ObjectIdentifier pbeOID = mapPBEAlgorithmToOID(algorithm);
@@ -977,7 +956,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
if (algorithm.equals(pbes2_OID) && algParams != null) {
return algParams.toString();
}
- return algorithm.toString();
+ return new AlgorithmId(algorithm).getName();
}
/**
@@ -1209,10 +1188,6 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
public synchronized void engineStore(OutputStream stream, char[] password)
throws IOException, NoSuchAlgorithmException, CertificateException
{
- // password is mandatory when storing
- if (password == null) {
- throw new IllegalArgumentException("password can't be null");
- }
// -- Create PFX
DerOutputStream pfx = new DerOutputStream();
@@ -1245,16 +1220,28 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
// -- create EncryptedContentInfo
if (certificateCount > 0) {
+ if (certProtectionAlgorithm == null) {
+ certProtectionAlgorithm = defaultCertProtectionAlgorithm();
+ }
+ if (certPbeIterationCount < 0) {
+ certPbeIterationCount = defaultCertPbeIterationCount();
+ }
+
if (debug != null) {
debug.println("Storing " + certificateCount +
" certificate(s) in a PKCS#7 encryptedData");
}
byte[] encrData = createEncryptedData(password);
- ContentInfo encrContentInfo =
- new ContentInfo(ContentInfo.ENCRYPTED_DATA_OID,
+ if (!certProtectionAlgorithm.equalsIgnoreCase("NONE")) {
+ ContentInfo encrContentInfo =
+ new ContentInfo(ContentInfo.ENCRYPTED_DATA_OID,
new DerValue(encrData));
- encrContentInfo.encode(authSafeContentInfo);
+ encrContentInfo.encode(authSafeContentInfo);
+ } else {
+ ContentInfo dataContentInfo = new ContentInfo(encrData);
+ dataContentInfo.encode(authSafeContentInfo);
+ }
}
// wrap as SequenceOf ContentInfos
@@ -1269,9 +1256,16 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
pfx.write(authSafeData);
// -- MAC
- byte[] macData = calculateMac(password, authenticatedSafe);
- pfx.write(macData);
-
+ if (macAlgorithm == null) {
+ macAlgorithm = defaultMacAlgorithm();
+ }
+ if (macIterationCount < 0) {
+ macIterationCount = defaultMacIterationCount();
+ }
+ if (!macAlgorithm.equalsIgnoreCase("NONE")) {
+ byte[] macData = calculateMac(password, authenticatedSafe);
+ pfx.write(macData);
+ }
// write PFX to output stream
DerOutputStream pfxout = new DerOutputStream();
pfxout.write(DerValue.tag_Sequence, pfx);
@@ -1481,24 +1475,6 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
return entry.attributes;
}
- /*
- * Generate Hash.
- */
- private byte[] generateHash(byte[] data) throws IOException
- {
- byte[] digest = null;
-
- try {
- MessageDigest md = MessageDigest.getInstance("SHA1");
- md.update(data);
- digest = md.digest();
- } catch (Exception e) {
- throw new IOException("generateHash failed: " + e, e);
- }
- return digest;
- }
-
-
/*
* Calculate MAC using HMAC algorithm (required for password integrity)
*
@@ -1509,16 +1485,16 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
throws IOException
{
byte[] mData = null;
- String algName = "SHA1";
+ String algName = macAlgorithm.substring(7);
try {
// Generate a random salt.
byte[] salt = getSalt();
// generate MAC (MAC key is generated within JCE)
- Mac m = Mac.getInstance("HmacPBESHA1");
+ Mac m = Mac.getInstance(macAlgorithm);
PBEParameterSpec params =
- new PBEParameterSpec(salt, MAC_ITERATION_COUNT);
+ new PBEParameterSpec(salt, macIterationCount);
SecretKey key = getPBEKey(passwd);
m.init(key, params);
m.update(data);
@@ -1526,7 +1502,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
// encode as MacData
MacData macData = new MacData(algName, macResult, salt,
- MAC_ITERATION_COUNT);
+ macIterationCount);
DerOutputStream bytes = new DerOutputStream();
bytes.write(macData.getEncoded());
mData = bytes.toByteArray();
@@ -1799,15 +1775,19 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
byte[] safeBagData = safeBagValue.toByteArray();
// encrypt the content (EncryptedContentInfo)
- byte[] encrContentInfo = encryptContent(safeBagData, password);
+ if (!certProtectionAlgorithm.equalsIgnoreCase("NONE")) {
+ byte[] encrContentInfo = encryptContent(safeBagData, password);
- // -- SEQUENCE of EncryptedData
- DerOutputStream encrData = new DerOutputStream();
- DerOutputStream encrDataContent = new DerOutputStream();
- encrData.putInteger(0);
- encrData.write(encrContentInfo);
- encrDataContent.write(DerValue.tag_Sequence, encrData);
- return encrDataContent.toByteArray();
+ // -- SEQUENCE of EncryptedData
+ DerOutputStream encrData = new DerOutputStream();
+ DerOutputStream encrDataContent = new DerOutputStream();
+ encrData.putInteger(0);
+ encrData.write(encrContentInfo);
+ encrDataContent.write(DerValue.tag_Sequence, encrData);
+ return encrDataContent.toByteArray();
+ } else {
+ return safeBagData;
+ }
}
/*
@@ -1916,47 +1896,52 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
byte[] encryptedData = null;
- // create AlgorithmParameters
- AlgorithmParameters algParams =
- getPBEAlgorithmParameters("PBEWithSHA1AndRC2_40");
- DerOutputStream bytes = new DerOutputStream();
- AlgorithmId algId =
- new AlgorithmId(pbeWithSHAAnd40BitRC2CBC_OID, algParams);
- algId.encode(bytes);
- byte[] encodedAlgId = bytes.toByteArray();
try {
+ // create AlgorithmParameters
+ AlgorithmParameters algParams = getPBEAlgorithmParameters(
+ certProtectionAlgorithm, certPbeIterationCount);
+ DerOutputStream bytes = new DerOutputStream();
+
// Use JCE
SecretKey skey = getPBEKey(password);
- Cipher cipher = Cipher.getInstance("PBEWithSHA1AndRC2_40");
+ Cipher cipher = Cipher.getInstance(certProtectionAlgorithm);
cipher.init(Cipher.ENCRYPT_MODE, skey, algParams);
encryptedData = cipher.doFinal(data);
+ AlgorithmId algId = new AlgorithmId(
+ mapPBEAlgorithmToOID(certProtectionAlgorithm),
+ cipher.getParameters());
+ // cipher.getParameters() now has IV
+ algId.encode(bytes);
+ byte[] encodedAlgId = bytes.toByteArray();
+
if (debug != null) {
debug.println(" (Cipher algorithm: " + cipher.getAlgorithm() +
- ")");
+ ")");
}
+ // create EncryptedContentInfo
+ DerOutputStream bytes2 = new DerOutputStream();
+ bytes2.putOID(ContentInfo.DATA_OID);
+ bytes2.write(encodedAlgId);
+
+ // Wrap encrypted data in a context-specific tag.
+ DerOutputStream tmpout2 = new DerOutputStream();
+ tmpout2.putOctetString(encryptedData);
+ bytes2.writeImplicit(DerValue.createTag(DerValue.TAG_CONTEXT,
+ false, (byte) 0), tmpout2);
+
+ // wrap EncryptedContentInfo in a Sequence
+ DerOutputStream out = new DerOutputStream();
+ out.write(DerValue.tag_Sequence, bytes2);
+ return out.toByteArray();
+ } catch (IOException ioe) {
+ throw ioe;
} catch (Exception e) {
throw new IOException("Failed to encrypt" +
" safe contents entry: " + e, e);
}
-
- // create EncryptedContentInfo
- DerOutputStream bytes2 = new DerOutputStream();
- bytes2.putOID(ContentInfo.DATA_OID);
- bytes2.write(encodedAlgId);
-
- // Wrap encrypted data in a context-specific tag.
- DerOutputStream tmpout2 = new DerOutputStream();
- tmpout2.putOctetString(encryptedData);
- bytes2.writeImplicit(DerValue.createTag(DerValue.TAG_CONTEXT,
- false, (byte)0), tmpout2);
-
- // wrap EncryptedContentInfo in a Sequence
- DerOutputStream out = new DerOutputStream();
- out.write(DerValue.tag_Sequence, bytes2);
- return out.toByteArray();
}
/**
@@ -1979,10 +1964,12 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
public synchronized void engineLoad(InputStream stream, char[] password)
throws IOException, NoSuchAlgorithmException, CertificateException
{
- DataInputStream dis;
- CertificateFactory cf = null;
- ByteArrayInputStream bais = null;
- byte[] encoded = null;
+
+ // Reset config when loading a different keystore.
+ certProtectionAlgorithm = null;
+ certPbeIterationCount = -1;
+ macAlgorithm = null;
+ macIterationCount = -1;
if (stream == null)
return;
@@ -2022,6 +2009,8 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
secretKeyCount = 0;
certificateCount = 0;
+ boolean seeEncBag = false;
+
/*
* Spin over the ContentInfos.
*/
@@ -2047,6 +2036,21 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
debug.println("Warning: skipping PKCS#7 encryptedData" +
" - no password was supplied");
}
+ // No password to decrypt ENCRYPTED_DATA_OID. *Skip it*.
+ // This means user will see a PrivateKeyEntry without
+ // certificates and a whole TrustedCertificateEntry will
+ // be lost. This is not a perfect solution but alternative
+ // solutions are more disruptive:
+ //
+ // We cannot just fail, since KeyStore.load(is, null)
+ // has been known to never fail because of a null password.
+ //
+ // We cannot just throw away the whole PrivateKeyEntry,
+ // this is too silent and no one will notice anything.
+ //
+ // We also cannot fail when getCertificate() on such a
+ // PrivateKeyEntry is called, since the method has not
+ // specified this behavior.
continue;
}
@@ -2084,13 +2088,18 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
ic = pbeSpec.getIterationCount();
if (ic > MAX_ITERATION_COUNT) {
- throw new IOException("PBE iteration count too large");
+ throw new IOException("cert PBE iteration count too large");
}
+
+ certProtectionAlgorithm
+ = mapPBEParamsToAlgorithm(algOid, algParams);
+ certPbeIterationCount = ic;
+ seeEncBag = true;
}
if (debug != null) {
debug.println("Loading PKCS#7 encryptedData " +
- "(" + new AlgorithmId(algOid).getName() +
+ "(" + mapPBEParamsToAlgorithm(algOid, algParams) +
" iterations: " + ic + ")");
}
@@ -2115,48 +2124,62 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
}
}
+ // No ENCRYPTED_DATA_OID but see certificate. Must be passwordless.
+ if (!seeEncBag && certificateCount > 0) {
+ certProtectionAlgorithm = "NONE";
+ }
+
// The MacData is optional.
- if (password != null && s.available() > 0) {
- MacData macData = new MacData(s);
- int ic = macData.getIterations();
+ if (s.available() > 0) {
+ // If there is no password, we cannot fail. KeyStore.load(is, null)
+ // has been known to never fail because of a null password.
+ if (password != null) {
+ MacData macData = new MacData(s);
+ int ic = macData.getIterations();
- try {
- if (ic > MAX_ITERATION_COUNT) {
- throw new InvalidAlgorithmParameterException(
- "MAC iteration count too large: " + ic);
+ try {
+ if (ic > MAX_ITERATION_COUNT) {
+ throw new InvalidAlgorithmParameterException(
+ "MAC iteration count too large: " + ic);
+ }
+
+ String algName =
+ macData.getDigestAlgName().toUpperCase(Locale.ENGLISH);
+
+ // Change SHA-1 to SHA1
+ algName = algName.replace("-", "");
+
+ macAlgorithm = "HmacPBE" + algName;
+ macIterationCount = ic;
+
+ // generate MAC (MAC key is created within JCE)
+ Mac m = Mac.getInstance(macAlgorithm);
+ PBEParameterSpec params =
+ new PBEParameterSpec(macData.getSalt(), ic);
+
+ RetryWithZero.run(pass -> {
+ SecretKey key = getPBEKey(pass);
+ m.init(key, params);
+ m.update(authSafeData);
+ byte[] macResult = m.doFinal();
+
+ if (debug != null) {
+ debug.println("Checking keystore integrity " +
+ "(" + m.getAlgorithm() + " iterations: " + ic + ")");
+ }
+
+ if (!MessageDigest.isEqual(macData.getDigest(), macResult)) {
+ throw new UnrecoverableKeyException("Failed PKCS12" +
+ " integrity checking");
+ }
+ return (Void) null;
+ }, password);
+ } catch (Exception e) {
+ throw new IOException("Integrity check failed: " + e, e);
}
-
- String algName =
- macData.getDigestAlgName().toUpperCase(Locale.ENGLISH);
-
- // Change SHA-1 to SHA1
- algName = algName.replace("-", "");
-
- // generate MAC (MAC key is created within JCE)
- Mac m = Mac.getInstance("HmacPBE" + algName);
- PBEParameterSpec params =
- new PBEParameterSpec(macData.getSalt(), ic);
-
- RetryWithZero.run(pass -> {
- SecretKey key = getPBEKey(pass);
- m.init(key, params);
- m.update(authSafeData);
- byte[] macResult = m.doFinal();
-
- if (debug != null) {
- debug.println("Checking keystore integrity " +
- "(" + m.getAlgorithm() + " iterations: " + ic + ")");
- }
-
- if (!MessageDigest.isEqual(macData.getDigest(), macResult)) {
- throw new UnrecoverableKeyException("Failed PKCS12" +
- " integrity checking");
- }
- return (Void)null;
- }, password);
- } catch (Exception e) {
- throw new IOException("Integrity check failed: " + e, e);
}
+ } else {
+ macAlgorithm = "NONE";
}
/*
@@ -2196,8 +2219,14 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
cert = certsMap.get(issuerDN);
}
/* Update existing KeyEntry in entries table */
- if (chain.size() > 0)
+ if (chain.size() > 0) {
entry.chain = chain.toArray(new Certificate[chain.size()]);
+ } else {
+ // Remove private key entries where there is no associated
+ // certs. Most likely the keystore is loaded with a null
+ // password.
+ entries.remove(entry);
+ }
}
}
@@ -2221,6 +2250,46 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
keyList.clear();
}
+ /**
+ * Returns if a pkcs12 file is password-less. This means no cert is
+ * encrypted and there is no Mac. Please note that the private key
+ * can be encrypted.
+ *
+ * This is a simplified version of {@link #engineLoad} that only looks
+ * at the ContentInfo types.
+ *
+ * @param f the pkcs12 file
+ * @return if it's password-less
+ * @throws IOException
+ */
+ public static boolean isPasswordless(File f) throws IOException {
+
+ try (FileInputStream stream = new FileInputStream(f)) {
+ DerValue val = new DerValue(stream);
+ DerInputStream s = val.toDerInputStream();
+
+ s.getInteger(); // skip version
+
+ ContentInfo authSafe = new ContentInfo(s);
+ DerInputStream as = new DerInputStream(authSafe.getData());
+ for (DerValue seq : as.getSequence(2)) {
+ DerInputStream sci = new DerInputStream(seq.toByteArray());
+ ContentInfo safeContents = new ContentInfo(sci);
+ if (safeContents.getContentType()
+ .equals(ContentInfo.ENCRYPTED_DATA_OID)) {
+ // Certificate encrypted
+ return false;
+ }
+ }
+
+ if (s.available() > 0) {
+ // The MacData exists.
+ return false;
+ }
+ }
+ return true;
+ }
+
/**
* Locates a matched CertEntry from certEntries, and returns its cert.
* @param entry the KeyEntry to match
@@ -2368,8 +2437,8 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
if (bagItem instanceof KeyEntry) {
KeyEntry entry = (KeyEntry)bagItem;
- if (bagItem instanceof PrivateKeyEntry) {
- if (keyId == null) {
+ if (keyId == null) {
+ if (bagItem instanceof PrivateKeyEntry) {
// Insert a localKeyID for the privateKey
// Note: This is a workaround to allow null localKeyID
// attribute in pkcs12 with one private key entry and
@@ -2379,6 +2448,9 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
} else {
continue;
}
+ } else {
+ // keyId in a SecretKeyEntry is not significant
+ keyId = "00".getBytes("UTF8");
}
}
entry.keyId = keyId;
@@ -2518,4 +2590,83 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
return result;
}
+
+ // 8076190: Customizing the generation of a PKCS12 keystore
+
+ private static String defaultCertProtectionAlgorithm() {
+ String result = SecurityProperties.privilegedGetOverridable(
+ "keystore.pkcs12.certProtectionAlgorithm");
+ return (result != null && !result.isEmpty())
+ ? result : "PBEWithSHA1AndRC2_40";
+ }
+
+ private static int defaultCertPbeIterationCount() {
+ String result = SecurityProperties.privilegedGetOverridable(
+ "keystore.pkcs12.certPbeIterationCount");
+ return (result != null && !result.isEmpty())
+ ? string2IC("certPbeIterationCount", result) : 50000;
+ }
+
+ // Read both "keystore.pkcs12.keyProtectionAlgorithm" and
+ // "keystore.PKCS12.keyProtectionAlgorithm" for compatibility.
+ private static String defaultKeyProtectionAlgorithm() {
+ String result = AccessController.doPrivileged(new PrivilegedAction() {
+ public String run() {
+ String result;
+ String name1 = "keystore.pkcs12.keyProtectionAlgorithm";
+ String name2 = "keystore.PKCS12.keyProtectionAlgorithm";
+ result = System.getProperty(name1);
+ if (result != null) {
+ return result;
+ }
+ result = System.getProperty(name2);
+ if (result != null) {
+ return result;
+ }
+ result = Security.getProperty(name1);
+ if (result != null) {
+ return result;
+ }
+ return Security.getProperty(name2);
+ }
+ });
+ return (result != null && !result.isEmpty())
+ ? result : "PBEWithSHA1AndDESede";
+ }
+
+ private static int defaultKeyPbeIterationCount() {
+ String result = SecurityProperties.privilegedGetOverridable(
+ "keystore.pkcs12.keyPbeIterationCount");
+ return (result != null && !result.isEmpty())
+ ? string2IC("keyPbeIterationCount", result) : 50000;
+ }
+
+ private static String defaultMacAlgorithm() {
+ String result = SecurityProperties.privilegedGetOverridable(
+ "keystore.pkcs12.macAlgorithm");
+ return (result != null && !result.isEmpty())
+ ? result : "HmacPBESHA1";
+ }
+
+ private static int defaultMacIterationCount() {
+ String result = SecurityProperties.privilegedGetOverridable(
+ "keystore.pkcs12.macIterationCount");
+ return (result != null && !result.isEmpty())
+ ? string2IC("macIterationCount", result) : 100000;
+ }
+
+ private static int string2IC(String type, String value) {
+ int number;
+ try {
+ number = Integer.parseInt(value);
+ } catch (NumberFormatException e) {
+ throw new IllegalArgumentException("keystore.pkcs12." + type
+ + " is not a number: " + value);
+ }
+ if (number <= 0 || number > MAX_ITERATION_COUNT) {
+ throw new IllegalArgumentException("Invalid keystore.pkcs12."
+ + type + ": " + value);
+ }
+ return number;
+ }
}
diff --git a/src/java.base/share/classes/sun/security/provider/Sun.java b/src/java.base/share/classes/sun/security/provider/Sun.java
index 4de677d4b87..3d7fcc75912 100644
--- a/src/java.base/share/classes/sun/security/provider/Sun.java
+++ b/src/java.base/share/classes/sun/security/provider/Sun.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1996, 2016, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -28,7 +28,6 @@ package sun.security.provider;
import java.util.*;
import java.security.*;
-import sun.security.action.PutAllAction;
import static sun.security.util.SecurityConstants.PROVIDER_VER;
@@ -51,17 +50,27 @@ public final class Sun extends Provider {
/* We are the SUN provider */
super("SUN", PROVIDER_VER, INFO);
+ Provider p = this;
+ Iterator serviceIter = new SunEntries(p).iterator();
+
// if there is no security manager installed, put directly into
- // the provider. Otherwise, create a temporary map and use a
- // doPrivileged() call at the end to transfer the contents
+ // the provider
if (System.getSecurityManager() == null) {
- SunEntries.putEntries(this);
+ putEntries(serviceIter);
} else {
- // use LinkedHashMap to preserve the order of the PRNGs
- Map map = new LinkedHashMap<>();
- SunEntries.putEntries(map);
- AccessController.doPrivileged(new PutAllAction(this, map));
+ AccessController.doPrivileged(new PrivilegedAction() {
+ @Override
+ public Void run() {
+ putEntries(serviceIter);
+ return null;
+ }
+ });
}
}
+ void putEntries(Iterator i) {
+ while (i.hasNext()) {
+ putService(i.next());
+ }
+ }
}
diff --git a/src/java.base/share/classes/sun/security/provider/SunEntries.java b/src/java.base/share/classes/sun/security/provider/SunEntries.java
index 872c14b7b55..905fa03ea40 100644
--- a/src/java.base/share/classes/sun/security/provider/SunEntries.java
+++ b/src/java.base/share/classes/sun/security/provider/SunEntries.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1996, 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -27,7 +27,7 @@ package sun.security.provider;
import java.io.*;
import java.net.*;
-import java.util.Map;
+import java.util.*;
import java.security.*;
import jdk.internal.util.StaticProperty;
@@ -75,17 +75,28 @@ import sun.security.action.GetPropertyAction;
* - JavaLoginConfig is the default file-based LoginModule Configuration type.
*/
-final class SunEntries {
+public final class SunEntries {
- private static final boolean useLegacyDSA =
- Boolean.parseBoolean(GetPropertyAction.privilegedGetProperty
- ("jdk.security.legacyDSAKeyPairGenerator"));
-
- private SunEntries() {
- // empty
+ // create an aliases List from the specified aliases
+ public static List createAliases(String ... aliases) {
+ return Arrays.asList(aliases);
}
- static void putEntries(Map map) {
+ // create an aliases List from the specified oid followed by other aliases
+ public static List createAliasesWithOid(String ... oids) {
+ String[] result = Arrays.copyOf(oids, oids.length + 1);
+ result[result.length - 1] = "OID." + oids[0];
+ return Arrays.asList(result);
+ }
+
+ // extend LinkedHashSet to preserve the ordering (needed by SecureRandom?)
+ SunEntries(Provider p) {
+ services = new LinkedHashSet<>(50, 0.9f);
+
+ // start populating content using the specified provider
+
+ // common attribute map
+ HashMap attrs = new HashMap<>(3);
/*
* SecureRandom
@@ -100,266 +111,217 @@ final class SunEntries {
boolean useNativePRNG = seedSource.equals(URL_DEV_URANDOM) ||
seedSource.equals(URL_DEV_RANDOM);
+ attrs.put("ThreadSafe", "true");
if (nativeAvailable && useNativePRNG) {
- map.put("SecureRandom.NativePRNG",
- "sun.security.provider.NativePRNG");
- map.put("SecureRandom.NativePRNG ThreadSafe", "true");
+ add(p, "SecureRandom", "NativePRNG",
+ "sun.security.provider.NativePRNG", null, attrs);
}
-
- map.put("SecureRandom.DRBG", "sun.security.provider.DRBG");
- map.put("SecureRandom.DRBG ThreadSafe", "true");
-
- map.put("SecureRandom.SHA1PRNG",
- "sun.security.provider.SecureRandom");
-
- map.put("SecureRandom.SHA1PRNG ThreadSafe", "true");
+ attrs.put("ImplementedIn", "Software");
+ add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", null, attrs);
+ add(p, "SecureRandom", "SHA1PRNG",
+ "sun.security.provider.SecureRandom", null, attrs);
+ attrs.remove("ImplementedIn");
if (nativeAvailable && !useNativePRNG) {
- map.put("SecureRandom.NativePRNG",
- "sun.security.provider.NativePRNG");
- map.put("SecureRandom.NativePRNG ThreadSafe", "true");
+ add(p, "SecureRandom", "NativePRNG", "sun.security.provider.NativePRNG",
+ null, attrs);
}
if (NativePRNG.Blocking.isAvailable()) {
- map.put("SecureRandom.NativePRNGBlocking",
- "sun.security.provider.NativePRNG$Blocking");
- map.put("SecureRandom.NativePRNGBlocking ThreadSafe", "true");
+ add(p, "SecureRandom", "NativePRNGBlocking",
+ "sun.security.provider.NativePRNG$Blocking", null, attrs);
}
-
if (NativePRNG.NonBlocking.isAvailable()) {
- map.put("SecureRandom.NativePRNGNonBlocking",
- "sun.security.provider.NativePRNG$NonBlocking");
- map.put("SecureRandom.NativePRNGNonBlocking ThreadSafe", "true");
+ add(p, "SecureRandom", "NativePRNGNonBlocking",
+ "sun.security.provider.NativePRNG$NonBlocking", null, attrs);
}
/*
* Signature engines
*/
- map.put("Signature.SHA1withDSA",
- "sun.security.provider.DSA$SHA1withDSA");
- map.put("Signature.NONEwithDSA", "sun.security.provider.DSA$RawDSA");
- map.put("Alg.Alias.Signature.RawDSA", "NONEwithDSA");
- map.put("Signature.SHA224withDSA",
- "sun.security.provider.DSA$SHA224withDSA");
- map.put("Signature.SHA256withDSA",
- "sun.security.provider.DSA$SHA256withDSA");
-
- map.put("Signature.SHA1withDSAinP1363Format",
- "sun.security.provider.DSA$SHA1withDSAinP1363Format");
- map.put("Signature.NONEwithDSAinP1363Format",
- "sun.security.provider.DSA$RawDSAinP1363Format");
- map.put("Signature.SHA224withDSAinP1363Format",
- "sun.security.provider.DSA$SHA224withDSAinP1363Format");
- map.put("Signature.SHA256withDSAinP1363Format",
- "sun.security.provider.DSA$SHA256withDSAinP1363Format");
-
+ attrs.clear();
String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" +
"|java.security.interfaces.DSAPrivateKey";
- map.put("Signature.SHA1withDSA SupportedKeyClasses", dsaKeyClasses);
- map.put("Signature.NONEwithDSA SupportedKeyClasses", dsaKeyClasses);
- map.put("Signature.SHA224withDSA SupportedKeyClasses", dsaKeyClasses);
- map.put("Signature.SHA256withDSA SupportedKeyClasses", dsaKeyClasses);
+ attrs.put("SupportedKeyClasses", dsaKeyClasses);
+ attrs.put("ImplementedIn", "Software");
- map.put("Alg.Alias.Signature.DSA", "SHA1withDSA");
- map.put("Alg.Alias.Signature.DSS", "SHA1withDSA");
- map.put("Alg.Alias.Signature.SHA/DSA", "SHA1withDSA");
- map.put("Alg.Alias.Signature.SHA-1/DSA", "SHA1withDSA");
- map.put("Alg.Alias.Signature.SHA1/DSA", "SHA1withDSA");
- map.put("Alg.Alias.Signature.SHAwithDSA", "SHA1withDSA");
- map.put("Alg.Alias.Signature.DSAWithSHA1", "SHA1withDSA");
- map.put("Alg.Alias.Signature.OID.1.2.840.10040.4.3",
- "SHA1withDSA");
- map.put("Alg.Alias.Signature.1.2.840.10040.4.3", "SHA1withDSA");
- map.put("Alg.Alias.Signature.1.3.14.3.2.13", "SHA1withDSA");
- map.put("Alg.Alias.Signature.1.3.14.3.2.27", "SHA1withDSA");
- map.put("Alg.Alias.Signature.OID.2.16.840.1.101.3.4.3.1",
- "SHA224withDSA");
- map.put("Alg.Alias.Signature.2.16.840.1.101.3.4.3.1", "SHA224withDSA");
- map.put("Alg.Alias.Signature.OID.2.16.840.1.101.3.4.3.2",
- "SHA256withDSA");
- map.put("Alg.Alias.Signature.2.16.840.1.101.3.4.3.2", "SHA256withDSA");
+ attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures
+
+ add(p, "Signature", "SHA1withDSA",
+ "sun.security.provider.DSA$SHA1withDSA",
+ createAliasesWithOid("1.2.840.10040.4.3", "DSA", "DSS", "SHA/DSA",
+ "SHA-1/DSA", "SHA1/DSA", "SHAwithDSA", "DSAWithSHA1",
+ "1.3.14.3.2.13", "1.3.14.3.2.27"), attrs);
+ add(p, "Signature", "NONEwithDSA", "sun.security.provider.DSA$RawDSA",
+ createAliases("RawDSA"), attrs);
+
+ attrs.put("KeySize", "2048"); // for SHA224 and SHA256 DSA signatures
+
+ add(p, "Signature", "SHA224withDSA",
+ "sun.security.provider.DSA$SHA224withDSA",
+ createAliasesWithOid("2.16.840.1.101.3.4.3.1"), attrs);
+ add(p, "Signature", "SHA256withDSA",
+ "sun.security.provider.DSA$SHA256withDSA",
+ createAliasesWithOid("2.16.840.1.101.3.4.3.2"), attrs);
+
+ attrs.remove("KeySize");
+
+ add(p, "Signature", "SHA1withDSAinP1363Format",
+ "sun.security.provider.DSA$SHA1withDSAinP1363Format",
+ null, null);
+ add(p, "Signature", "NONEwithDSAinP1363Format",
+ "sun.security.provider.DSA$RawDSAinP1363Format",
+ null, null);
+ add(p, "Signature", "SHA224withDSAinP1363Format",
+ "sun.security.provider.DSA$SHA224withDSAinP1363Format",
+ null, null);
+ add(p, "Signature", "SHA256withDSAinP1363Format",
+ "sun.security.provider.DSA$SHA256withDSAinP1363Format",
+ null, null);
/*
* Key Pair Generator engines
*/
+ attrs.clear();
+ attrs.put("ImplementedIn", "Software");
+ attrs.put("KeySize", "2048"); // for DSA KPG and APG only
+
+ String dsaOid = "1.2.840.10040.4.1";
+ List dsaAliases = createAliasesWithOid(dsaOid, "1.3.14.3.2.12");
String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$";
dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current");
- map.put("KeyPairGenerator.DSA", dsaKPGImplClass);
- map.put("Alg.Alias.KeyPairGenerator.OID.1.2.840.10040.4.1", "DSA");
- map.put("Alg.Alias.KeyPairGenerator.1.2.840.10040.4.1", "DSA");
- map.put("Alg.Alias.KeyPairGenerator.1.3.14.3.2.12", "DSA");
-
- /*
- * Digest engines
- */
- map.put("MessageDigest.MD2", "sun.security.provider.MD2");
- map.put("MessageDigest.MD5", "sun.security.provider.MD5");
- map.put("MessageDigest.SHA", "sun.security.provider.SHA");
-
- map.put("Alg.Alias.MessageDigest.SHA-1", "SHA");
- map.put("Alg.Alias.MessageDigest.SHA1", "SHA");
- map.put("Alg.Alias.MessageDigest.1.3.14.3.2.26", "SHA");
- map.put("Alg.Alias.MessageDigest.OID.1.3.14.3.2.26", "SHA");
-
- map.put("MessageDigest.SHA-224", "sun.security.provider.SHA2$SHA224");
- map.put("Alg.Alias.MessageDigest.2.16.840.1.101.3.4.2.4", "SHA-224");
- map.put("Alg.Alias.MessageDigest.OID.2.16.840.1.101.3.4.2.4",
- "SHA-224");
-
- map.put("MessageDigest.SHA-256", "sun.security.provider.SHA2$SHA256");
- map.put("Alg.Alias.MessageDigest.2.16.840.1.101.3.4.2.1", "SHA-256");
- map.put("Alg.Alias.MessageDigest.OID.2.16.840.1.101.3.4.2.1",
- "SHA-256");
- map.put("MessageDigest.SHA-384", "sun.security.provider.SHA5$SHA384");
- map.put("Alg.Alias.MessageDigest.2.16.840.1.101.3.4.2.2", "SHA-384");
- map.put("Alg.Alias.MessageDigest.OID.2.16.840.1.101.3.4.2.2",
- "SHA-384");
- map.put("MessageDigest.SHA-512", "sun.security.provider.SHA5$SHA512");
- map.put("Alg.Alias.MessageDigest.2.16.840.1.101.3.4.2.3", "SHA-512");
- map.put("Alg.Alias.MessageDigest.OID.2.16.840.1.101.3.4.2.3",
- "SHA-512");
- map.put("MessageDigest.SHA-512/224", "sun.security.provider.SHA5$SHA512_224");
- map.put("Alg.Alias.MessageDigest.2.16.840.1.101.3.4.2.5", "SHA-512/224");
- map.put("Alg.Alias.MessageDigest.OID.2.16.840.1.101.3.4.2.5",
- "SHA-512/224");
- map.put("MessageDigest.SHA-512/256", "sun.security.provider.SHA5$SHA512_256");
- map.put("Alg.Alias.MessageDigest.2.16.840.1.101.3.4.2.6", "SHA-512/256");
- map.put("Alg.Alias.MessageDigest.OID.2.16.840.1.101.3.4.2.6",
- "SHA-512/256");
-
- map.put("MessageDigest.SHA3-224", "sun.security.provider.SHA3$SHA224");
- map.put("Alg.Alias.MessageDigest.2.16.840.1.101.3.4.2.7", "SHA3-224");
- map.put("Alg.Alias.MessageDigest.OID.2.16.840.1.101.3.4.2.7",
- "SHA3-224");
-
- map.put("MessageDigest.SHA3-256", "sun.security.provider.SHA3$SHA256");
- map.put("Alg.Alias.MessageDigest.2.16.840.1.101.3.4.2.8", "SHA3-256");
- map.put("Alg.Alias.MessageDigest.OID.2.16.840.1.101.3.4.2.8",
- "SHA3-256");
- map.put("MessageDigest.SHA3-384", "sun.security.provider.SHA3$SHA384");
- map.put("Alg.Alias.MessageDigest.2.16.840.1.101.3.4.2.9", "SHA3-384");
- map.put("Alg.Alias.MessageDigest.OID.2.16.840.1.101.3.4.2.9",
- "SHA3-384");
- map.put("MessageDigest.SHA3-512", "sun.security.provider.SHA3$SHA512");
- map.put("Alg.Alias.MessageDigest.2.16.840.1.101.3.4.2.10", "SHA3-512");
- map.put("Alg.Alias.MessageDigest.OID.2.16.840.1.101.3.4.2.10",
- "SHA3-512");
-
+ add(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, dsaAliases, attrs);
/*
* Algorithm Parameter Generator engines
*/
- map.put("AlgorithmParameterGenerator.DSA",
- "sun.security.provider.DSAParameterGenerator");
+ add(p, "AlgorithmParameterGenerator", "DSA",
+ "sun.security.provider.DSAParameterGenerator", dsaAliases, attrs);
+ attrs.remove("KeySize");
/*
* Algorithm Parameter engines
*/
- map.put("AlgorithmParameters.DSA",
- "sun.security.provider.DSAParameters");
- map.put("Alg.Alias.AlgorithmParameters.OID.1.2.840.10040.4.1", "DSA");
- map.put("Alg.Alias.AlgorithmParameters.1.2.840.10040.4.1", "DSA");
- map.put("Alg.Alias.AlgorithmParameters.1.3.14.3.2.12", "DSA");
+ add(p, "AlgorithmParameters", "DSA",
+ "sun.security.provider.DSAParameters", dsaAliases, attrs);
/*
* Key factories
*/
- map.put("KeyFactory.DSA", "sun.security.provider.DSAKeyFactory");
- map.put("Alg.Alias.KeyFactory.OID.1.2.840.10040.4.1", "DSA");
- map.put("Alg.Alias.KeyFactory.1.2.840.10040.4.1", "DSA");
- map.put("Alg.Alias.KeyFactory.1.3.14.3.2.12", "DSA");
+ add(p, "KeyFactory", "DSA", "sun.security.provider.DSAKeyFactory",
+ dsaAliases, attrs);
+
+ /*
+ * Digest engines
+ */
+ add(p, "MessageDigest", "MD2", "sun.security.provider.MD2", null, attrs);
+ add(p, "MessageDigest", "MD5", "sun.security.provider.MD5", null, attrs);
+ add(p, "MessageDigest", "SHA", "sun.security.provider.SHA",
+ createAliasesWithOid("1.3.14.3.2.26", "SHA-1", "SHA1"), attrs);
+
+ String sha2BaseOid = "2.16.840.1.101.3.4.2";
+ add(p, "MessageDigest", "SHA-224", "sun.security.provider.SHA2$SHA224",
+ createAliasesWithOid(sha2BaseOid + ".4"), attrs);
+ add(p, "MessageDigest", "SHA-256", "sun.security.provider.SHA2$SHA256",
+ createAliasesWithOid(sha2BaseOid + ".1"), attrs);
+ add(p, "MessageDigest", "SHA-384", "sun.security.provider.SHA5$SHA384",
+ createAliasesWithOid(sha2BaseOid + ".2"), attrs);
+ add(p, "MessageDigest", "SHA-512", "sun.security.provider.SHA5$SHA512",
+ createAliasesWithOid(sha2BaseOid + ".3"), attrs);
+ add(p, "MessageDigest", "SHA-512/224",
+ "sun.security.provider.SHA5$SHA512_224",
+ createAliasesWithOid(sha2BaseOid + ".5"), attrs);
+ add(p, "MessageDigest", "SHA-512/256",
+ "sun.security.provider.SHA5$SHA512_256",
+ createAliasesWithOid(sha2BaseOid + ".6"), attrs);
+ add(p, "MessageDigest", "SHA3-224", "sun.security.provider.SHA3$SHA224",
+ createAliasesWithOid(sha2BaseOid + ".7"), attrs);
+ add(p, "MessageDigest", "SHA3-256", "sun.security.provider.SHA3$SHA256",
+ createAliasesWithOid(sha2BaseOid + ".8"), attrs);
+ add(p, "MessageDigest", "SHA3-384", "sun.security.provider.SHA3$SHA384",
+ createAliasesWithOid(sha2BaseOid + ".9"), attrs);
+ add(p, "MessageDigest", "SHA3-512", "sun.security.provider.SHA3$SHA512",
+ createAliasesWithOid(sha2BaseOid + ".10"), attrs);
/*
* Certificates
*/
- map.put("CertificateFactory.X.509",
- "sun.security.provider.X509Factory");
- map.put("Alg.Alias.CertificateFactory.X509", "X.509");
+ add(p, "CertificateFactory", "X.509",
+ "sun.security.provider.X509Factory",
+ createAliases("X509"), attrs);
/*
* KeyStore
*/
- map.put("KeyStore.PKCS12",
- "sun.security.pkcs12.PKCS12KeyStore$DualFormatPKCS12");
- map.put("KeyStore.JKS",
- "sun.security.provider.JavaKeyStore$DualFormatJKS");
- map.put("KeyStore.CaseExactJKS",
- "sun.security.provider.JavaKeyStore$CaseExactJKS");
- map.put("KeyStore.DKS", "sun.security.provider.DomainKeyStore$DKS");
+ add(p, "KeyStore", "PKCS12",
+ "sun.security.pkcs12.PKCS12KeyStore$DualFormatPKCS12",
+ null, null);
+ add(p, "KeyStore", "JKS",
+ "sun.security.provider.JavaKeyStore$DualFormatJKS",
+ null, attrs);
+ add(p, "KeyStore", "CaseExactJKS",
+ "sun.security.provider.JavaKeyStore$CaseExactJKS",
+ null, attrs);
+ add(p, "KeyStore", "DKS", "sun.security.provider.DomainKeyStore$DKS",
+ null, attrs);
- /*
- * Policy
- */
- map.put("Policy.JavaPolicy", "sun.security.provider.PolicySpiFile");
-
- /*
- * Configuration
- */
- map.put("Configuration.JavaLoginConfig",
- "sun.security.provider.ConfigFile$Spi");
-
- /*
- * CertPathBuilder
- */
- map.put("CertPathBuilder.PKIX",
- "sun.security.provider.certpath.SunCertPathBuilder");
- map.put("CertPathBuilder.PKIX ValidationAlgorithm",
- "RFC5280");
-
- /*
- * CertPathValidator
- */
- map.put("CertPathValidator.PKIX",
- "sun.security.provider.certpath.PKIXCertPathValidator");
- map.put("CertPathValidator.PKIX ValidationAlgorithm",
- "RFC5280");
/*
* CertStores
*/
- map.put("CertStore.Collection",
- "sun.security.provider.certpath.CollectionCertStore");
- map.put("CertStore.com.sun.security.IndexedCollection",
- "sun.security.provider.certpath.IndexedCollectionCertStore");
+ add(p, "CertStore", "Collection",
+ "sun.security.provider.certpath.CollectionCertStore",
+ null, attrs);
+ add(p, "CertStore", "com.sun.security.IndexedCollection",
+ "sun.security.provider.certpath.IndexedCollectionCertStore",
+ null, attrs);
/*
- * KeySize
+ * Policy
*/
- map.put("Signature.NONEwithDSA KeySize", "1024");
- map.put("Signature.SHA1withDSA KeySize", "1024");
- map.put("Signature.SHA224withDSA KeySize", "2048");
- map.put("Signature.SHA256withDSA KeySize", "2048");
-
- map.put("KeyPairGenerator.DSA KeySize", "2048");
- map.put("AlgorithmParameterGenerator.DSA KeySize", "2048");
+ add(p, "Policy", "JavaPolicy", "sun.security.provider.PolicySpiFile",
+ null, null);
/*
- * Implementation type: software or hardware
+ * Configuration
*/
- map.put("Signature.SHA1withDSA ImplementedIn", "Software");
- map.put("KeyPairGenerator.DSA ImplementedIn", "Software");
- map.put("MessageDigest.MD5 ImplementedIn", "Software");
- map.put("MessageDigest.SHA ImplementedIn", "Software");
- map.put("AlgorithmParameterGenerator.DSA ImplementedIn",
- "Software");
- map.put("AlgorithmParameters.DSA ImplementedIn", "Software");
- map.put("KeyFactory.DSA ImplementedIn", "Software");
- map.put("SecureRandom.SHA1PRNG ImplementedIn", "Software");
- map.put("SecureRandom.DRBG ImplementedIn", "Software");
- map.put("CertificateFactory.X.509 ImplementedIn", "Software");
- map.put("KeyStore.JKS ImplementedIn", "Software");
- map.put("CertPathValidator.PKIX ImplementedIn", "Software");
- map.put("CertPathBuilder.PKIX ImplementedIn", "Software");
- map.put("CertStore.Collection ImplementedIn", "Software");
- map.put("CertStore.com.sun.security.IndexedCollection ImplementedIn",
- "Software");
+ add(p, "Configuration", "JavaLoginConfig",
+ "sun.security.provider.ConfigFile$Spi", null, null);
+ /*
+ * CertPathBuilder and CertPathValidator
+ */
+ attrs.clear();
+ attrs.put("ValidationAlgorithm", "RFC5280");
+ attrs.put("ImplementedIn", "Software");
+
+ add(p, "CertPathBuilder", "PKIX",
+ "sun.security.provider.certpath.SunCertPathBuilder",
+ null, attrs);
+ add(p, "CertPathValidator", "PKIX",
+ "sun.security.provider.certpath.PKIXCertPathValidator",
+ null, attrs);
}
+ Iterator iterator() {
+ return services.iterator();
+ }
+
+ private void add(Provider p, String type, String algo, String cn,
+ List aliases, HashMap attrs) {
+ services.add(new Provider.Service(p, type, algo, cn, aliases, attrs));
+ }
+
+ private LinkedHashSet services;
+
// name of the *System* property, takes precedence over PROP_RNDSOURCE
private static final String PROP_EGD = "java.security.egd";
// name of the *Security* property
private static final String PROP_RNDSOURCE = "securerandom.source";
+ private static final boolean useLegacyDSA =
+ Boolean.parseBoolean(GetPropertyAction.privilegedGetProperty
+ ("jdk.security.legacyDSAKeyPairGenerator"));
+
static final String URL_DEV_RANDOM = "file:/dev/random";
static final String URL_DEV_URANDOM = "file:/dev/urandom";
diff --git a/src/java.base/share/classes/sun/security/provider/VerificationProvider.java b/src/java.base/share/classes/sun/security/provider/VerificationProvider.java
index f4016a867f7..485e08605f1 100644
--- a/src/java.base/share/classes/sun/security/provider/VerificationProvider.java
+++ b/src/java.base/share/classes/sun/security/provider/VerificationProvider.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1996, 2016, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -28,8 +28,6 @@ package sun.security.provider;
import java.util.*;
import java.security.*;
-import sun.security.action.PutAllAction;
-
import sun.security.rsa.SunRsaSignEntries;
import static sun.security.util.SecurityConstants.PROVIDER_VER;
@@ -70,18 +68,30 @@ public final class VerificationProvider extends Provider {
return;
}
+ Provider p = this;
+ Iterator sunIter = new SunEntries(p).iterator();
+ Iterator rsaIter =
+ new SunRsaSignEntries(p).iterator();
+
// if there is no security manager installed, put directly into
- // the provider. Otherwise, create a temporary map and use a
- // doPrivileged() call at the end to transfer the contents
+ // the provider
if (System.getSecurityManager() == null) {
- SunEntries.putEntries(this);
- SunRsaSignEntries.putEntries(this);
+ putEntries(sunIter);
+ putEntries(rsaIter);
} else {
- // use LinkedHashMap to preserve the order of the PRNGs
- Map map = new LinkedHashMap<>();
- SunEntries.putEntries(map);
- SunRsaSignEntries.putEntries(map);
- AccessController.doPrivileged(new PutAllAction(this, map));
+ AccessController.doPrivileged(new PrivilegedAction