jdk-sandbox: comparison jdk/src/java.base/share/classes/sun/security/pkcs/SignerInfo.java

equal deleted inserted replaced

-:c0fe2e6364d9
+:cc479488428c
 /*
-* Copyright (c) 1996, 2015, Oracle and/or its affiliates. All rights reserved.
+* Copyright (c) 1996, 2016, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.  Oracle designates this
 package sun.security.pkcs;
 import java.io.OutputStream;
 import java.io.IOException;
 import java.math.BigInteger;
+import java.security.CryptoPrimitive;
+import java.security.InvalidKeyException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.Principal;
+import java.security.PublicKey;
+import java.security.Signature;
+import java.security.SignatureException;
+import java.security.Timestamp;
 import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;
 import java.security.cert.CertPath;
 import java.security.cert.X509Certificate;
-import java.security.*;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
+import java.util.EnumSet;
+import java.util.Set;
 import sun.security.timestamp.TimestampToken;
-import sun.security.util.*;
+import sun.security.util.Debug;
+import sun.security.util.DerEncoder;
+import sun.security.util.DerInputStream;
+import sun.security.util.DerOutputStream;
+import sun.security.util.DerValue;
+import sun.security.util.DisabledAlgorithmConstraints;
+import sun.security.util.HexDumpEncoder;
+import sun.security.util.ObjectIdentifier;
 import sun.security.x509.AlgorithmId;
 import sun.security.x509.X500Name;
 import sun.security.x509.KeyUsageExtension;
-import sun.security.util.HexDumpEncoder;
 /**
 * A SignerInfo, as defined in PKCS#7's signedData type.
 *
 * @author Benjamin Renaud
 */
 public class SignerInfo implements DerEncoder {
+// Digest and Signature restrictions
+private static final Set<CryptoPrimitive> DIGEST_PRIMITIVE_SET =
+Collections.unmodifiableSet(EnumSet.of(CryptoPrimitive.MESSAGE_DIGEST));
+private static final Set<CryptoPrimitive> SIG_PRIMITIVE_SET =
+Collections.unmodifiableSet(EnumSet.of(CryptoPrimitive.SIGNATURE));
+private static final DisabledAlgorithmConstraints JAR_DISABLED_CHECK =
+new DisabledAlgorithmConstraints(
+DisabledAlgorithmConstraints.PROPERTY_JAR_DISABLED_ALGS);
 BigInteger version;
 X500Name issuerName;
 BigInteger certificateSerialNumber;
 AlgorithmId digestAlgorithmId;
 PKCS9Attribute.MESSAGE_DIGEST_OID);
 if (messageDigest == null) // fail if there is no message digest
 return null;
+// check that algorithm is not restricted
+if (!JAR_DISABLED_CHECK.permits(DIGEST_PRIMITIVE_SET,
+digestAlgname, null)) {
+throw new SignatureException("Digest check failed. " +
+"Disabled algorithm used: " + digestAlgname);
+}
 MessageDigest md = MessageDigest.getInstance(digestAlgname);
 byte[] computedMessageDigest = md.digest(data);
 if (messageDigest.length != computedMessageDigest.length)
 return null;
 String tmp = AlgorithmId.getEncAlgFromSigAlg(encryptionAlgname);
 if (tmp != null) encryptionAlgname = tmp;
 String algname = AlgorithmId.makeSigAlg(
 digestAlgname, encryptionAlgname);
-Signature sig = Signature.getInstance(algname);
+// check that algorithm is not restricted
+if (!JAR_DISABLED_CHECK.permits(SIG_PRIMITIVE_SET, algname, null)) {
+throw new SignatureException("Signature check failed. " +
+"Disabled algorithm used: " + algname);
+}
 X509Certificate cert = getCertificate(block);
+PublicKey key = cert.getPublicKey();
 if (cert == null) {
 return null;
 }
+// check if the public key is restricted
+if (!JAR_DISABLED_CHECK.permits(SIG_PRIMITIVE_SET, key)) {
+throw new SignatureException("Public key check failed. " +
+"Disabled algorithm used: " + key.getAlgorithm());
+}
 if (cert.hasUnsupportedCriticalExtension()) {
 throw new SignatureException("Certificate has unsupported "
 + "critical extension(s)");
 }
 + "cannot be used for "
 + "digital signatures");
 }
 }
-PublicKey key = cert.getPublicKey();
+Signature sig = Signature.getInstance(algname);
 sig.initVerify(key);
 sig.update(dataSigned);
 if (sig.verify(encryptedDigest)) {
 return this;
 }
 } catch (IOException e) {
 * Match the hash present in the signature timestamp token against the hash
 * of this signature.
 */
 private void verifyTimestamp(TimestampToken token)
 throws NoSuchAlgorithmException, SignatureException {
+String digestAlgname = token.getHashAlgorithm().getName();
+// check that algorithm is not restricted
+if (!JAR_DISABLED_CHECK.permits(DIGEST_PRIMITIVE_SET, digestAlgname,
+null)) {
+throw new SignatureException("Timestamp token digest check failed. " +
+"Disabled algorithm used: " + digestAlgname);
+}
 MessageDigest md =
-MessageDigest.getInstance(token.getHashAlgorithm().getName());
+MessageDigest.getInstance(digestAlgname);
 if (!Arrays.equals(token.getHashedMessage(),
 md.digest(encryptedDigest))) {
 throw new SignatureException("Signature timestamp (#" +

changeset 41580	cc479488428c
parent 34687	d302ed125dc9
child 41582	246512d81eba