jdk-sandbox: comparison src/java.base/share/classes/sun/security/ssl/SignatureScheme.java

equal deleted inserted replaced

-:bfcdcd00e4fb
+:a93b7b28f644
 import java.util.Collections;
 import java.util.EnumSet;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Set;
-import sun.security.ssl.NamedGroup.NamedGroupType;
+import sun.security.ssl.NamedGroup.NamedGroupSpec;
 import sun.security.ssl.SupportedGroupsExtension.SupportedGroups;
 import sun.security.ssl.X509Authentication.X509Possession;
 import sun.security.util.KeyUtil;
 import sun.security.util.SignatureUtil;
 final int id;                       // hash + signature
 final String name;                  // literal name
 private final String algorithm;     // signature algorithm
 final String keyAlgorithm;          // signature key algorithm
-private final AlgorithmParameterSpec signAlgParameter;
+private final SigAlgParamSpec signAlgParams;    // signature parameters
 private final NamedGroup namedGroup;    // associated named group
 // The minimal required key size in bits.
 //
 // Only need to check RSA algorithm at present. RSA keys of 512 bits
 static enum SigAlgParamSpec {   // support RSASSA-PSS only now
 RSA_PSS_SHA256 ("SHA-256", 32),
 RSA_PSS_SHA384 ("SHA-384", 48),
 RSA_PSS_SHA512 ("SHA-512", 64);
-final private AlgorithmParameterSpec parameterSpec;
+private final AlgorithmParameterSpec parameterSpec;
-final boolean isAvailable;
+private final AlgorithmParameters parameters;
+private final boolean isAvailable;
 SigAlgParamSpec(String hash, int saltLength) {
 // See RFC 8017
 PSSParameterSpec pssParamSpec =
 new PSSParameterSpec(hash, "MGF1",
 new MGF1ParameterSpec(hash), saltLength, 1);
+AlgorithmParameters pssParams = null;
 boolean mediator = true;
 try {
 Signature signer = Signature.getInstance("RSASSA-PSS");
 signer.setParameter(pssParamSpec);
+pssParams = signer.getParameters();
 } catch (InvalidAlgorithmParameterException |
-NoSuchAlgorithmException exp) {
+NoSuchAlgorithmException | RuntimeException exp) {
+// Signature.getParameters() may throw RuntimeException.
 mediator = false;
 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
 SSLLogger.warning(
 "RSASSA-PSS signature with " + hash +
 " is not supported by the underlying providers", exp);
 }
 }
 this.isAvailable = mediator;
 this.parameterSpec = mediator ? pssParamSpec : null;
-}
+this.parameters = mediator ? pssParams : null;
-AlgorithmParameterSpec getParameterSpec() {
-return parameterSpec;
 }
 }
 // performance optimization
 private static final Set<CryptoPrimitive> SIGNATURE_PRIMITIVE_SET =
 supportedProtocols, supportedProtocols);
 }
 private SignatureScheme(int id, String name,
 String algorithm, String keyAlgorithm,
-SigAlgParamSpec signAlgParamSpec,
+SigAlgParamSpec signAlgParams,
 NamedGroup namedGroup, int minimalKeySize,
 ProtocolVersion[] supportedProtocols,
 ProtocolVersion[] handshakeSupportedProtocols) {
 this.id = id;
 this.name = name;
 this.algorithm = algorithm;
 this.keyAlgorithm = keyAlgorithm;
-this.signAlgParameter =
+this.signAlgParams = signAlgParams;
-signAlgParamSpec != null ? signAlgParamSpec.parameterSpec : null;
 this.namedGroup = namedGroup;
 this.minimalKeySize = minimalKeySize;
 this.supportedProtocols = Arrays.asList(supportedProtocols);
 this.handshakeSupportedProtocols =
 Arrays.asList(handshakeSupportedProtocols);
 boolean mediator = true;
-if (signAlgParamSpec != null) {
+if (signAlgParams != null) {
-mediator = signAlgParamSpec.isAvailable;
+mediator = signAlgParams.isAvailable;
 } else {
 try {
 Signature.getInstance(algorithm);
 } catch (Exception e) {
 mediator = false;
 // Return the size of a SignatureScheme structure in TLS record
 static int sizeInRecord() {
 return 2;
 }
+private boolean isPermitted(AlgorithmConstraints constraints) {
+return constraints.permits(SIGNATURE_PRIMITIVE_SET,
+this.name, null) &&
+constraints.permits(SIGNATURE_PRIMITIVE_SET,
+this.keyAlgorithm, null) &&
+constraints.permits(SIGNATURE_PRIMITIVE_SET,
+this.algorithm, (signAlgParams != null ?
+signAlgParams.parameters : null)) &&
+(namedGroup != null ?
+namedGroup.isPermitted(constraints) : true);
+}
 // Get local supported algorithm collection complying to algorithm
 // constraints.
 static List<SignatureScheme> getSupportedAlgorithms(
 AlgorithmConstraints constraints,
 List<ProtocolVersion> activeProtocols) {
 break;
 }
 }
 if (isMatch) {
-if (constraints.permits(
+if (ss.isPermitted(constraints)) {
-SIGNATURE_PRIMITIVE_SET, ss.algorithm, null)) {
 supported.add(ss);
 } else if (SSLLogger.isOn &&
 SSLLogger.isOn("ssl,handshake,verbose")) {
 SSLLogger.finest(
 "Ignore disabled signature scheme: " + ss.name);
 "Unsupported signature scheme: " +
 SignatureScheme.nameOf(ssid));
 }
 } else if (ss.isAvailable &&
 ss.supportedProtocols.contains(protocolVersion) &&
-constraints.permits(SIGNATURE_PRIMITIVE_SET,
+ss.isPermitted(constraints)) {
-ss.algorithm, null)) {
 supported.add(ss);
 } else {
 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
 SSLLogger.warning(
 "Unsupported signature scheme: " + ss.name);
 return supported;
 }
 static SignatureScheme getPreferableAlgorithm(
+AlgorithmConstraints constraints,
 List<SignatureScheme> schemes,
 SignatureScheme certScheme,
 ProtocolVersion version) {
 for (SignatureScheme ss : schemes) {
 if (ss.isAvailable &&
 ss.handshakeSupportedProtocols.contains(version) &&
-certScheme.keyAlgorithm.equalsIgnoreCase(ss.keyAlgorithm)) {
+certScheme.keyAlgorithm.equalsIgnoreCase(ss.keyAlgorithm) &&
+ss.isPermitted(constraints)) {
 return ss;
 }
 }
 return null;
 }
 static SignatureScheme getPreferableAlgorithm(
+AlgorithmConstraints constraints,
 List<SignatureScheme> schemes,
 X509Possession x509Possession,
 ProtocolVersion version) {
 PrivateKey signingKey = x509Possession.popPrivateKey;
 keySize = Integer.MAX_VALUE;
 }
 for (SignatureScheme ss : schemes) {
 if (ss.isAvailable && (keySize >= ss.minimalKeySize) &&
 ss.handshakeSupportedProtocols.contains(version) &&
-keyAlgorithm.equalsIgnoreCase(ss.keyAlgorithm)) {
+keyAlgorithm.equalsIgnoreCase(ss.keyAlgorithm) &&
-if ((ss.namedGroup != null) && (ss.namedGroup.type ==
+ss.isPermitted(constraints)) {
-NamedGroupType.NAMED_GROUP_ECDHE)) {
+if ((ss.namedGroup != null) && (ss.namedGroup.spec ==
+NamedGroupSpec.NAMED_GROUP_ECDHE)) {
 ECParameterSpec params =
 x509Possession.getECParameterSpec();
 if (params != null &&
 ss.namedGroup == NamedGroup.valueOf(params)) {
 return ss;
 }
 Signature signer = Signature.getInstance(algorithm);
 if (key instanceof PublicKey) {
 SignatureUtil.initVerifyWithParam(signer, (PublicKey)key,
-signAlgParameter);
+(signAlgParams != null ?
+signAlgParams.parameterSpec : null));
 } else {
 SignatureUtil.initSignWithParam(signer, (PrivateKey)key,
-signAlgParameter, null);
+(signAlgParams != null ?
+signAlgParams.parameterSpec : null),
+null);
 }
 return signer;
 }
 }

changeset 57718	a93b7b28f644
parent 55452	1170b6d92d1c
child 58679	9c3209ff7550
child 58951	d6e682e8fcc3