All compilers are expected to be able to compile to the C99 language standard,
-as some C99 features are used in the source code. Microsoft Visual Studio
-doesn't fully support C99 so in practice shared code is limited to using C99
-features that it does support.
+
All compilers are expected to be able to compile to the C99 language standard, as some C99 features are used in the source code. Microsoft Visual Studio doesn't fully support C99 so in practice shared code is limited to using C99 features that it does support.
gcc
The minimum accepted version of gcc is 4.8. Older versions will generate a warning by configure and are unlikely to work.
The JDK is currently known to be able to compile with at least version 7.4 of gcc.
Use additional problem lists file or files, in addition to the default ProblemList.txt located at the JTReg test roots.
If multiple file names are specified, they should be separated by space (or, to help avoid quoting issues, the special value %20).
The file names should be either absolute, or relative to the JTReg test root of the tests to be run.
+
RUN_PROBLEM_LISTS
+
Use the problem lists to select tests instead of excluding them.
+
Set to true or false. If true, JTReg will use -match: option, otherwise -exclude: will be used. Default is false.
OPTIONS
Additional options to the JTReg test framework.
Use JTREG="OPTIONS=--help all" to see all available JTReg options.
diff -r aaa83519e723 -r 0e2453f75881 doc/testing.md
--- a/doc/testing.md Fri Jul 19 11:09:41 2019 +0200
+++ b/doc/testing.md Tue Jul 23 11:17:59 2019 -0700
@@ -306,6 +306,14 @@
The file names should be either absolute, or relative to the JTReg test root of
the tests to be run.
+#### RUN_PROBLEM_LISTS
+
+Use the problem lists to select tests instead of excluding them.
+
+Set to `true` or `false`.
+If `true`, JTReg will use `-match:` option, otherwise `-exclude:` will be used.
+Default is `false`.
+
#### OPTIONS
Additional options to the JTReg test framework.
diff -r aaa83519e723 -r 0e2453f75881 make/RunTests.gmk
--- a/make/RunTests.gmk Fri Jul 19 11:09:41 2019 +0200
+++ b/make/RunTests.gmk Tue Jul 23 11:17:59 2019 -0700
@@ -278,7 +278,7 @@
$(eval $(call ParseKeywordVariable, JTREG, \
SINGLE_KEYWORDS := JOBS TIMEOUT_FACTOR TEST_MODE ASSERT VERBOSE RETAIN \
- MAX_MEM, \
+ MAX_MEM RUN_PROBLEM_LISTS, \
STRING_KEYWORDS := OPTIONS JAVA_OPTIONS VM_OPTIONS KEYWORDS \
EXTRA_PROBLEM_LISTS AOT_MODULES, \
))
@@ -828,6 +828,7 @@
endif
JTREG_VERBOSE ?= fail,error,summary
JTREG_RETAIN ?= fail,error
+ JTREG_RUN_PROBLEM_LISTS ?= false
ifneq ($$($1_JTREG_MAX_MEM), 0)
$1_JTREG_BASIC_OPTIONS += -vmoption:-Xmx$$($1_JTREG_MAX_MEM)
@@ -865,13 +866,19 @@
$1_JTREG_BASIC_OPTIONS += -nativepath:$$($1_JTREG_NATIVEPATH)
endif
+ ifeq ($$(JTREG_RUN_PROBLEM_LISTS), true)
+ JTREG_PROBLEM_LIST_PREFIX := -match:
+ else
+ JTREG_PROBLEM_LIST_PREFIX := -exclude:
+ endif
+
ifneq ($$($1_JTREG_PROBLEM_LIST), )
- $1_JTREG_BASIC_OPTIONS += $$(addprefix -exclude:, $$($1_JTREG_PROBLEM_LIST))
+ $1_JTREG_BASIC_OPTIONS += $$(addprefix $$(JTREG_PROBLEM_LIST_PREFIX), $$($1_JTREG_PROBLEM_LIST))
endif
ifneq ($$(JTREG_EXTRA_PROBLEM_LISTS), )
# Accept both absolute paths as well as relative to the current test root.
- $1_JTREG_BASIC_OPTIONS += $$(addprefix -exclude:, $$(wildcard \
+ $1_JTREG_BASIC_OPTIONS += $$(addprefix $$(JTREG_PROBLEM_LIST_PREFIX), $$(wildcard \
$$(JTREG_EXTRA_PROBLEM_LISTS) \
$$(addprefix $$($1_TEST_ROOT)/, $$(JTREG_EXTRA_PROBLEM_LISTS)) \
))
diff -r aaa83519e723 -r 0e2453f75881 src/hotspot/share/aot/aotCompiledMethod.hpp
--- a/src/hotspot/share/aot/aotCompiledMethod.hpp Fri Jul 19 11:09:41 2019 +0200
+++ b/src/hotspot/share/aot/aotCompiledMethod.hpp Tue Jul 23 11:17:59 2019 -0700
@@ -168,7 +168,7 @@
int state() const { return *_state_adr; }
// Non-virtual for speed
- bool _is_alive() const { return state() < zombie; }
+ bool _is_alive() const { return state() < unloaded; }
virtual bool is_zombie() const { return state() == zombie; }
virtual bool is_unloaded() const { return state() == unloaded; }
diff -r aaa83519e723 -r 0e2453f75881 src/hotspot/share/code/compiledMethod.hpp
--- a/src/hotspot/share/code/compiledMethod.hpp Fri Jul 19 11:09:41 2019 +0200
+++ b/src/hotspot/share/code/compiledMethod.hpp Tue Jul 23 11:17:59 2019 -0700
@@ -208,9 +208,9 @@
not_used = 1, // not entrant, but revivable
not_entrant = 2, // marked for deoptimization but activations may still exist,
// will be transformed to zombie when all activations are gone
- zombie = 3, // no activations exist, nmethod is ready for purge
- unloaded = 4 // there should be no activations, should not be called,
- // will be transformed to zombie immediately
+ unloaded = 3, // there should be no activations, should not be called, will be
+ // transformed to zombie by the sweeper, when not "locked in vm".
+ zombie = 4 // no activations exist, nmethod is ready for purge
};
virtual bool is_in_use() const = 0;
diff -r aaa83519e723 -r 0e2453f75881 src/hotspot/share/code/nmethod.cpp
--- a/src/hotspot/share/code/nmethod.cpp Fri Jul 19 11:09:41 2019 +0200
+++ b/src/hotspot/share/code/nmethod.cpp Tue Jul 23 11:17:59 2019 -0700
@@ -1136,6 +1136,20 @@
mdo->inc_decompile_count();
}
+bool nmethod::try_transition(int new_state_int) {
+ signed char new_state = new_state_int;
+ for (;;) {
+ signed char old_state = Atomic::load(&_state);
+ if (old_state >= new_state) {
+ // Ensure monotonicity of transitions.
+ return false;
+ }
+ if (Atomic::cmpxchg(new_state, &_state, old_state) == old_state) {
+ return true;
+ }
+ }
+}
+
void nmethod::make_unloaded() {
post_compiled_method_unload();
@@ -1159,7 +1173,9 @@
}
// Unlink the osr method, so we do not look this up again
if (is_osr_method()) {
- // Invalidate the osr nmethod only once
+ // Invalidate the osr nmethod only once. Note that with concurrent
+ // code cache unloading, OSR nmethods are invalidated before they
+ // are made unloaded. Therefore, this becomes a no-op then.
if (is_in_use()) {
invalidate_osr_method();
}
@@ -1213,12 +1229,14 @@
set_osr_link(NULL);
NMethodSweeper::report_state_change(this);
- // The release is only needed for compile-time ordering, as accesses
- // into the nmethod after the store are not safe due to the sweeper
- // being allowed to free it when the store is observed, during
- // concurrent nmethod unloading. Therefore, there is no need for
- // acquire on the loader side.
- OrderAccess::release_store(&_state, (signed char)unloaded);
+ bool transition_success = try_transition(unloaded);
+
+ // It is an important invariant that there exists no race between
+ // the sweeper and GC thread competing for making the same nmethod
+ // zombie and unloaded respectively. This is ensured by
+ // can_convert_to_zombie() returning false for any is_unloading()
+ // nmethod, informing the sweeper not to step on any GC toes.
+ assert(transition_success, "Invalid nmethod transition to unloaded");
#if INCLUDE_JVMCI
// Clear the link between this nmethod and a HotSpotNmethod mirror
@@ -1283,7 +1301,7 @@
assert(state == zombie || state == not_entrant, "must be zombie or not_entrant");
assert(!is_zombie(), "should not already be a zombie");
- if (_state == state) {
+ if (Atomic::load(&_state) >= state) {
// Avoid taking the lock if already in required state.
// This is safe from races because the state is an end-state,
// which the nmethod cannot back out of once entered.
@@ -1318,7 +1336,7 @@
// Enter critical section. Does not block for safepoint.
MutexLocker pl(Patching_lock, Mutex::_no_safepoint_check_flag);
- if (_state == state) {
+ if (Atomic::load(&_state) >= state) {
// another thread already performed this transition so nothing
// to do, but return false to indicate this.
return false;
@@ -1354,7 +1372,18 @@
}
// Change state
- _state = state;
+ if (!try_transition(state)) {
+ // If the transition fails, it is due to another thread making the nmethod more
+ // dead. In particular, one thread might be making the nmethod unloaded concurrently.
+ // If so, having patched in the jump in the verified entry unnecessarily is fine.
+ // The nmethod is no longer possible to call by Java threads.
+ // Incrementing the decompile count is also fine as the caller of make_not_entrant()
+ // had a valid reason to deoptimize the nmethod.
+ // Marking the nmethod as seen on stack also has no effect, as the nmethod is now
+ // !is_alive(), and the seen on stack value is only used to convert not_entrant
+ // nmethods to zombie in can_convert_to_zombie().
+ return false;
+ }
// Log the transition once
log_state_change();
diff -r aaa83519e723 -r 0e2453f75881 src/hotspot/share/code/nmethod.hpp
--- a/src/hotspot/share/code/nmethod.hpp Fri Jul 19 11:09:41 2019 +0200
+++ b/src/hotspot/share/code/nmethod.hpp Tue Jul 23 11:17:59 2019 -0700
@@ -212,6 +212,9 @@
void* operator new(size_t size, int nmethod_size, int comp_level) throw();
const char* reloc_string_for(u_char* begin, u_char* end);
+
+ bool try_transition(int new_state);
+
// Returns true if this thread changed the state of the nmethod or
// false if another thread performed the transition.
bool make_not_entrant_or_zombie(int state);
@@ -339,7 +342,7 @@
// flag accessing and manipulation
bool is_not_installed() const { return _state == not_installed; }
bool is_in_use() const { return _state <= in_use; }
- bool is_alive() const { return _state < zombie; }
+ bool is_alive() const { return _state < unloaded; }
bool is_not_entrant() const { return _state == not_entrant; }
bool is_zombie() const { return _state == zombie; }
bool is_unloaded() const { return _state == unloaded; }
diff -r aaa83519e723 -r 0e2453f75881 src/hotspot/share/gc/z/zNMethod.cpp
--- a/src/hotspot/share/gc/z/zNMethod.cpp Fri Jul 19 11:09:41 2019 +0200
+++ b/src/hotspot/share/gc/z/zNMethod.cpp Tue Jul 23 11:17:59 2019 -0700
@@ -261,6 +261,24 @@
Atomic::store(true, &_failed);
}
+ void unlink(nmethod* nm) {
+ // Unlinking of the dependencies must happen before the
+ // handshake separating unlink and purge.
+ nm->flush_dependencies(false /* delete_immediately */);
+
+ // We don't need to take the lock when unlinking nmethods from
+ // the Method, because it is only concurrently unlinked by
+ // the entry barrier, which acquires the per nmethod lock.
+ nm->unlink_from_method(false /* acquire_lock */);
+
+ if (nm->is_osr_method()) {
+ // Invalidate the osr nmethod before the handshake. The nmethod
+ // will be made unloaded after the handshake. Then invalidate_osr_method()
+ // will be called again, which will be a no-op.
+ nm->invalidate_osr_method();
+ }
+ }
+
public:
ZNMethodUnlinkClosure(bool unloading_occurred) :
_unloading_occurred(unloading_occurred),
@@ -278,14 +296,7 @@
ZLocker locker(ZNMethod::lock_for_nmethod(nm));
if (nm->is_unloading()) {
- // Unlinking of the dependencies must happen before the
- // handshake separating unlink and purge.
- nm->flush_dependencies(false /* delete_immediately */);
-
- // We don't need to take the lock when unlinking nmethods from
- // the Method, because it is only concurrently unlinked by
- // the entry barrier, which acquires the per nmethod lock.
- nm->unlink_from_method(false /* acquire_lock */);
+ unlink(nm);
return;
}
diff -r aaa83519e723 -r 0e2453f75881 src/hotspot/share/jvmci/jvmci.cpp
--- a/src/hotspot/share/jvmci/jvmci.cpp Fri Jul 19 11:09:41 2019 +0200
+++ b/src/hotspot/share/jvmci/jvmci.cpp Tue Jul 23 11:17:59 2019 -0700
@@ -91,6 +91,14 @@
return res;
}
+void JVMCI::destroy_global(jobject handle) {
+ // Assert before nulling out, for better debugging.
+ assert(is_global_handle(handle), "precondition");
+ oop* oop_ptr = reinterpret_cast(handle);
+ NativeAccess<>::oop_store(oop_ptr, (oop)NULL);
+ object_handles()->release(oop_ptr);
+}
+
bool JVMCI::is_global_handle(jobject handle) {
const oop* ptr = reinterpret_cast(handle);
return object_handles()->allocation_status(ptr) == OopStorage::ALLOCATED_ENTRY;
diff -r aaa83519e723 -r 0e2453f75881 src/hotspot/share/jvmci/jvmci.hpp
--- a/src/hotspot/share/jvmci/jvmci.hpp Fri Jul 19 11:09:41 2019 +0200
+++ b/src/hotspot/share/jvmci/jvmci.hpp Tue Jul 23 11:17:59 2019 -0700
@@ -90,6 +90,7 @@
static void initialize_compiler(TRAPS);
static jobject make_global(const Handle& obj);
+ static void destroy_global(jobject handle);
static bool is_global_handle(jobject handle);
static jmetadata allocate_handle(const methodHandle& handle);
diff -r aaa83519e723 -r 0e2453f75881 src/hotspot/share/jvmci/jvmciCompilerToVM.cpp
--- a/src/hotspot/share/jvmci/jvmciCompilerToVM.cpp Fri Jul 19 11:09:41 2019 +0200
+++ b/src/hotspot/share/jvmci/jvmciCompilerToVM.cpp Tue Jul 23 11:17:59 2019 -0700
@@ -2208,8 +2208,7 @@
C2V_VMENTRY(void, deleteGlobalHandle, (JNIEnv* env, jobject, jlong h))
jobject handle = (jobject)(address)h;
if (handle != NULL) {
- assert(JVMCI::is_global_handle(handle), "Invalid delete of global JNI handle");
- *((oop*)handle) = NULL; // Mark the handle as deleted, allocate will reuse it
+ JVMCI::destroy_global(handle);
}
}
diff -r aaa83519e723 -r 0e2453f75881 src/java.base/share/classes/javax/net/ssl/SSLSessionContext.java
--- a/src/java.base/share/classes/javax/net/ssl/SSLSessionContext.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.base/share/classes/javax/net/ssl/SSLSessionContext.java Tue Jul 23 11:17:59 2019 -0700
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -35,7 +35,11 @@
* it could be associated with a server or client who participates in many
* sessions concurrently.
*
- * Not all environments will contain session contexts.
+ * Not all environments will contain session contexts. For example, stateless
+ * session resumption.
+ *
+ * Session contexts may not contain all sessions. For example, stateless
+ * sessions are not stored in the session context.
*
* There are SSLSessionContext parameters that affect how
* sessions are stored:
@@ -68,8 +72,11 @@
public SSLSession getSession(byte[] sessionId);
/**
- * Returns an Enumeration of all session id's grouped under this
+ * Returns an Enumeration of all known session id's grouped under this
* SSLSessionContext.
+ *
Session contexts may not contain all sessions. For example,
+ * stateless sessions are not stored in the session context.
+ *
*
* @return an enumeration of all the Session id's
*/
diff -r aaa83519e723 -r 0e2453f75881 src/java.base/share/classes/sun/security/ssl/Finished.java
--- a/src/java.base/share/classes/sun/security/ssl/Finished.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.base/share/classes/sun/security/ssl/Finished.java Tue Jul 23 11:17:59 2019 -0700
@@ -482,7 +482,7 @@
shc.conContext.inputRecord.expectingFinishFlight();
} else {
if (shc.handshakeSession.isRejoinable() &&
- !shc.statelessResumption) {
+ !shc.handshakeSession.isStatelessable(shc)) {
((SSLSessionContextImpl)shc.sslContext.
engineGetServerSessionContext()).put(
shc.handshakeSession);
@@ -847,6 +847,8 @@
shc.conContext.serverVerifyData = fm.verifyData;
}
+ shc.conContext.conSession = shc.handshakeSession.finish();
+
// update the context
shc.handshakeConsumers.put(
SSLHandshake.FINISHED.id, SSLHandshake.FINISHED);
diff -r aaa83519e723 -r 0e2453f75881 src/java.base/share/classes/sun/security/ssl/NewSessionTicket.java
--- a/src/java.base/share/classes/sun/security/ssl/NewSessionTicket.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.base/share/classes/sun/security/ssl/NewSessionTicket.java Tue Jul 23 11:17:59 2019 -0700
@@ -45,7 +45,6 @@
*/
final class NewSessionTicket {
static final int MAX_TICKET_LIFETIME = 604800; // seconds, 7 days
-
static final SSLConsumer handshakeConsumer =
new T13NewSessionTicketConsumer();
static final SSLConsumer handshake12Consumer =
@@ -60,7 +59,7 @@
*/
abstract static class NewSessionTicketMessage extends HandshakeMessage {
int ticketLifetime;
- byte[] ticket;
+ byte[] ticket = new byte[0];
NewSessionTicketMessage(HandshakeContext context) {
super(context);
@@ -83,6 +82,9 @@
"TicketNonce not part of RFC 5077.");
}
+ boolean isValid() {
+ return (ticket.length > 0);
+ }
}
/**
* NewSessionTicket for TLS 1.2 and below (RFC 5077)
@@ -102,13 +104,13 @@
// RFC5077 struct {
// uint32 ticket_lifetime;
- // opaque ticket<1..2^16-1>;
+ // opaque ticket<0..2^16-1>;
// } NewSessionTicket;
super(context);
- if (m.remaining() < 14) {
+ if (m.remaining() < 6) {
throw context.conContext.fatal(Alert.ILLEGAL_PARAMETER,
- "Invalid NewSessionTicket message: no sufficient data");
+ "Invalid NewSessionTicket message: insufficient data");
}
this.ticketLifetime = Record.getInt32(m);
@@ -186,7 +188,7 @@
if (m.remaining() < 14) {
throw context.conContext.fatal(Alert.ILLEGAL_PARAMETER,
- "Invalid NewSessionTicket message: no sufficient data");
+ "Invalid NewSessionTicket message: insufficient data");
}
this.ticketLifetime = Record.getInt32(m);
@@ -195,18 +197,21 @@
if (m.remaining() < 5) {
throw context.conContext.fatal(Alert.ILLEGAL_PARAMETER,
- "Invalid NewSessionTicket message: no sufficient data");
+ "Invalid NewSessionTicket message: insufficient ticket" +
+ " data");
}
this.ticket = Record.getBytes16(m);
if (ticket.length == 0) {
- throw context.conContext.fatal(Alert.ILLEGAL_PARAMETER,
+ if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
+ SSLLogger.fine(
"No ticket in the NewSessionTicket handshake message");
+ }
}
if (m.remaining() < 2) {
throw context.conContext.fatal(Alert.ILLEGAL_PARAMETER,
- "Invalid NewSessionTicket message: no sufficient data");
+ "Invalid NewSessionTicket message: extra data");
}
SSLExtension[] supportedExtensions =
@@ -310,36 +315,45 @@
@Override
public byte[] produce(ConnectionContext context) throws IOException {
- // The producing happens in server side only.
- ServerHandshakeContext shc = (ServerHandshakeContext)context;
+ HandshakeContext hc = (HandshakeContext)context;
- // Is this session resumable?
- if (!shc.handshakeSession.isRejoinable()) {
- return null;
- }
+ // The producing happens in server side only.
+ if (hc instanceof ServerHandshakeContext) {
+ // Is this session resumable?
+ if (!hc.handshakeSession.isRejoinable()) {
+ return null;
+ }
- // What's the requested PSK key exchange modes?
- //
- // Note that currently, the NewSessionTicket post-handshake is
- // produced and delivered only in the current handshake context
- // if required.
- PskKeyExchangeModesSpec pkemSpec =
- (PskKeyExchangeModesSpec)shc.handshakeExtensions.get(
- SSLExtension.PSK_KEY_EXCHANGE_MODES);
- if (pkemSpec == null || !pkemSpec.contains(
- PskKeyExchangeModesExtension.PskKeyExchangeMode.PSK_DHE_KE)) {
- // Client doesn't support PSK with (EC)DHE key establishment.
- return null;
+ // What's the requested PSK key exchange modes?
+ //
+ // Note that currently, the NewSessionTicket post-handshake is
+ // produced and delivered only in the current handshake context
+ // if required.
+ PskKeyExchangeModesSpec pkemSpec =
+ (PskKeyExchangeModesSpec) hc.handshakeExtensions.get(
+ SSLExtension.PSK_KEY_EXCHANGE_MODES);
+ if (pkemSpec == null || !pkemSpec.contains(
+ PskKeyExchangeModesExtension.PskKeyExchangeMode.PSK_DHE_KE)) {
+ // Client doesn't support PSK with (EC)DHE key establishment.
+ return null;
+ }
+ } else { // PostHandshakeContext
+
+ // Check if we have sent a PSK already, then we know it is using a
+ // allowable PSK exchange key mode
+ if (!hc.handshakeSession.isPSKable()) {
+ return null;
+ }
}
// get a new session ID
SSLSessionContextImpl sessionCache = (SSLSessionContextImpl)
- shc.sslContext.engineGetServerSessionContext();
+ hc.sslContext.engineGetServerSessionContext();
SessionId newId = new SessionId(true,
- shc.sslContext.getSecureRandom());
+ hc.sslContext.getSecureRandom());
SecretKey resumptionMasterSecret =
- shc.handshakeSession.getResumptionMasterSecret();
+ hc.handshakeSession.getResumptionMasterSecret();
if (resumptionMasterSecret == null) {
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
SSLLogger.fine(
@@ -349,10 +363,10 @@
}
// construct the PSK and handshake message
- BigInteger nonce = shc.handshakeSession.incrTicketNonceCounter();
+ BigInteger nonce = hc.handshakeSession.incrTicketNonceCounter();
byte[] nonceArr = nonce.toByteArray();
SecretKey psk = derivePreSharedKey(
- shc.negotiatedCipherSuite.hashAlg,
+ hc.negotiatedCipherSuite.hashAlg,
resumptionMasterSecret, nonceArr);
int sessionTimeoutSeconds = sessionCache.getSessionTimeout();
@@ -364,31 +378,35 @@
return null;
}
- NewSessionTicketMessage nstm;
+ NewSessionTicketMessage nstm = null;
SSLSessionImpl sessionCopy =
- new SSLSessionImpl(shc.handshakeSession, newId);
+ new SSLSessionImpl(hc.handshakeSession, newId);
sessionCopy.setPreSharedKey(psk);
sessionCopy.setPskIdentity(newId.getId());
- if (shc.statelessResumption) {
- try {
- nstm = new T13NewSessionTicketMessage(shc,
- sessionTimeoutSeconds, shc.sslContext.getSecureRandom(),
- nonceArr, new SessionTicketSpec().encrypt(shc, sessionCopy));
+ // If a stateless ticket is allowed, attempt to make one
+ if (hc.handshakeSession.isStatelessable(hc)) {
+ nstm = new T13NewSessionTicketMessage(hc,
+ sessionTimeoutSeconds,
+ hc.sslContext.getSecureRandom(),
+ nonceArr,
+ new SessionTicketSpec().encrypt(hc, sessionCopy));
+ // If ticket construction failed, switch to session cache
+ if (!nstm.isValid()) {
+ hc.statelessResumption = false;
+ } else {
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
SSLLogger.fine(
"Produced NewSessionTicket stateless " +
"handshake message", nstm);
}
- } catch (Exception e) {
- // Error with NST ticket, abort NST
- shc.conContext.fatal(Alert.UNEXPECTED_MESSAGE, e);
- return null;
}
- } else {
- nstm = new T13NewSessionTicketMessage(shc, sessionTimeoutSeconds,
- shc.sslContext.getSecureRandom(), nonceArr,
+ }
+ // If a session cache ticket is being used, make one
+ if (!hc.handshakeSession.isStatelessable(hc)) {
+ nstm = new T13NewSessionTicketMessage(hc, sessionTimeoutSeconds,
+ hc.sslContext.getSecureRandom(), nonceArr,
newId.getId());
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
SSLLogger.fine(
@@ -399,13 +417,21 @@
// create and cache the new session
// The new session must be a child of the existing session so
// they will be invalidated together, etc.
- shc.handshakeSession.addChild(sessionCopy);
+ hc.handshakeSession.addChild(sessionCopy);
sessionCopy.setTicketAgeAdd(nstm.getTicketAgeAdd());
sessionCache.put(sessionCopy);
}
+
// Output the handshake message.
- nstm.write(shc.handshakeOutput);
- shc.handshakeOutput.flush();
+ if (nstm != null) {
+ // should never be null
+ nstm.write(hc.handshakeOutput);
+ hc.handshakeOutput.flush();
+ }
+
+ if (hc instanceof PostHandshakeContext) {
+ ((PostHandshakeContext) hc).finish();
+ }
// The message has been delivered.
return null;
@@ -448,23 +474,16 @@
return null;
}
- NewSessionTicketMessage nstm;
-
SSLSessionImpl sessionCopy =
new SSLSessionImpl(shc.handshakeSession, newId);
sessionCopy.setPskIdentity(newId.getId());
- try {
- nstm = new T12NewSessionTicketMessage(shc, sessionTimeoutSeconds,
- new SessionTicketSpec().encrypt(shc, sessionCopy));
- if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
- SSLLogger.fine(
- "Produced NewSessionTicket stateless handshake message", nstm);
- }
- } catch (Exception e) {
- // Abort on error with NST ticket
- shc.conContext.fatal(Alert.UNEXPECTED_MESSAGE, e);
- return null;
+ NewSessionTicketMessage nstm = new T12NewSessionTicketMessage(shc,
+ sessionTimeoutSeconds,
+ new SessionTicketSpec().encrypt(shc, sessionCopy));
+ if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
+ SSLLogger.fine(
+ "Produced NewSessionTicket stateless handshake message", nstm);
}
// Output the handshake message.
@@ -505,6 +524,9 @@
"Consuming NewSessionTicket message", nstm);
}
+ SSLSessionContextImpl sessionCache = (SSLSessionContextImpl)
+ hc.sslContext.engineGetClientSessionContext();
+
// discard tickets with timeout 0
if (nstm.ticketLifetime <= 0 ||
nstm.ticketLifetime > MAX_TICKET_LIFETIME) {
@@ -513,12 +535,10 @@
"Discarding NewSessionTicket with lifetime "
+ nstm.ticketLifetime, nstm);
}
+ sessionCache.remove(hc.handshakeSession.getSessionId());
return;
}
- SSLSessionContextImpl sessionCache = (SSLSessionContextImpl)
- hc.sslContext.engineGetClientSessionContext();
-
if (sessionCache.getSessionTimeout() > MAX_TICKET_LIFETIME) {
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
SSLLogger.fine(
diff -r aaa83519e723 -r 0e2453f75881 src/java.base/share/classes/sun/security/ssl/PostHandshakeContext.java
--- a/src/java.base/share/classes/sun/security/ssl/PostHandshakeContext.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.base/share/classes/sun/security/ssl/PostHandshakeContext.java Tue Jul 23 11:17:59 2019 -0700
@@ -54,6 +54,7 @@
handshakeConsumers = new LinkedHashMap<>(consumers);
handshakeFinished = true;
+ handshakeSession = context.conSession;
}
@Override
@@ -82,4 +83,9 @@
SSLHandshake.nameOf(handshakeType), be);
}
}
+
+ // Finish this PostHandshake event
+ void finish() {
+ handshakeSession = null;
+ }
}
diff -r aaa83519e723 -r 0e2453f75881 src/java.base/share/classes/sun/security/ssl/SSLEngineImpl.java
--- a/src/java.base/share/classes/sun/security/ssl/SSLEngineImpl.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.base/share/classes/sun/security/ssl/SSLEngineImpl.java Tue Jul 23 11:17:59 2019 -0700
@@ -344,6 +344,12 @@
hsStatus = tryKeyUpdate(hsStatus);
}
+ // Check if NewSessionTicket PostHandshake message needs to be sent
+ if (conContext.conSession.updateNST &&
+ !conContext.sslConfig.isClientMode) {
+ hsStatus = tryNewSessionTicket(hsStatus);
+ }
+
// update context status
ciphertext.handshakeStatus = hsStatus;
@@ -397,6 +403,29 @@
return currentHandshakeStatus;
}
+ // Try to generate a PostHandshake NewSessionTicket message. This is
+ // TLS 1.3 only.
+ private HandshakeStatus tryNewSessionTicket(
+ HandshakeStatus currentHandshakeStatus) throws IOException {
+ // Don't bother to kickstart if handshaking is in progress, or if the
+ // connection is not duplex-open.
+ if ((conContext.handshakeContext == null) &&
+ conContext.protocolVersion.useTLS13PlusSpec() &&
+ !conContext.isOutboundClosed() &&
+ !conContext.isInboundClosed() &&
+ !conContext.isBroken) {
+ if (SSLLogger.isOn && SSLLogger.isOn("ssl")) {
+ SSLLogger.finest("trigger NST");
+ }
+ conContext.conSession.updateNST = false;
+ NewSessionTicket.kickstartProducer.produce(
+ new PostHandshakeContext(conContext));
+ return conContext.getHandshakeStatus();
+ }
+
+ return currentHandshakeStatus;
+ }
+
private static void checkParams(
ByteBuffer[] srcs, int srcsOffset, int srcsLength,
ByteBuffer[] dsts, int dstsOffset, int dstsLength) {
diff -r aaa83519e723 -r 0e2453f75881 src/java.base/share/classes/sun/security/ssl/SSLSessionContextImpl.java
--- a/src/java.base/share/classes/sun/security/ssl/SSLSessionContextImpl.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.base/share/classes/sun/security/ssl/SSLSessionContextImpl.java Tue Jul 23 11:17:59 2019 -0700
@@ -69,8 +69,8 @@
private int cacheLimit; // the max cache size
private int timeout; // timeout in seconds
- // Does this context support stateless session (RFC 5077)
- private boolean statelessSession = true;
+ // Default setting for stateless session resumption support (RFC 5077)
+ private boolean statelessSession = false;
// package private
SSLSessionContextImpl(boolean server) {
@@ -234,14 +234,13 @@
// Property for Session Cache state
if (server) {
st = GetPropertyAction.privilegedGetProperty(
- "jdk.tls.server.enableSessionTicketExtension", "true");
+ "jdk.tls.server.enableSessionTicketExtension", "false");
} else {
st = GetPropertyAction.privilegedGetProperty(
- "jdk.tls.client.enableSessionTicketExtension", "true");
+ "jdk.tls.client.enableSessionTicketExtension", "false");
}
- if (st.compareToIgnoreCase("false") == 0) {
- statelessSession = false;
- }
+
+ statelessSession = Boolean.parseBoolean(st);
// Property for Session Ticket Timeout. The value can be changed
// by SSLSessionContext.setSessionTimeout(int)
diff -r aaa83519e723 -r 0e2453f75881 src/java.base/share/classes/sun/security/ssl/SSLSessionImpl.java
--- a/src/java.base/share/classes/sun/security/ssl/SSLSessionImpl.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.base/share/classes/sun/security/ssl/SSLSessionImpl.java Tue Jul 23 11:17:59 2019 -0700
@@ -27,6 +27,7 @@
import sun.security.x509.X509CertImpl;
import java.io.IOException;
+import java.lang.reflect.Array;
import java.math.BigInteger;
import java.net.InetAddress;
import java.nio.ByteBuffer;
@@ -35,6 +36,7 @@
import java.security.cert.CertificateEncodingException;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
+import java.util.Arrays;
import java.util.Queue;
import java.util.Collection;
import java.util.Collections;
@@ -104,7 +106,7 @@
private X509Certificate[] localCerts;
private PrivateKey localPrivateKey;
private final Collection localSupportedSignAlgs;
- private String[] peerSupportedSignAlgs; // for certificate
+ private Collection peerSupportedSignAlgs; //for certificate
private boolean useDefaultPeerSignAlgs = false;
private List statusResponses;
private SecretKey resumptionMasterSecret;
@@ -236,7 +238,8 @@
baseSession.localSupportedSignAlgs == null ?
Collections.emptySet() : baseSession.localSupportedSignAlgs;
this.peerSupportedSignAlgs =
- baseSession.getPeerSupportedSignatureAlgorithms();
+ baseSession.peerSupportedSignAlgs == null ?
+ Collections.emptySet() : baseSession.peerSupportedSignAlgs;
this.serverNameIndication = baseSession.serverNameIndication;
this.requestedServerNames = baseSession.getRequestedServerNames();
this.masterSecret = baseSession.getMasterSecret();
@@ -261,8 +264,10 @@
/**
* < 2 bytes > protocolVersion
* < 2 bytes > cipherSuite
- * < 2 bytes > localSupportedSignAlgs entries
+ * < 1 byte > localSupportedSignAlgs entries
* < 2 bytes per entries > localSupportedSignAlgs
+ * < 1 bytes > peerSupportedSignAlgs entries
+ * < 2 bytes per entries > peerSupportedSignAlgs
* < 2 bytes > preSharedKey length
* < length in bytes > preSharedKey
* < 1 byte > pskIdentity length
@@ -281,6 +286,9 @@
* < 1 byte > ServerName length
* < length in bytes > ServerName
* < 4 bytes > creationTime
+ * < 2 byte > status response length
+ * < 2 byte > status response entry length
+ * < length in byte > status response entry
* < 1 byte > Length of peer host
* < length in bytes > peer host
* < 2 bytes> peer port
@@ -302,17 +310,17 @@
* < length in bytes> PSK identity
* Anonymous
* < 1 byte >
+ * < 4 bytes > maximumPacketSize
+ * < 4 bytes > negotiatedMaxFragSize
*/
SSLSessionImpl(HandshakeContext hc, ByteBuffer buf) throws IOException {
int i = 0;
byte[] b;
- this.localSupportedSignAlgs = new ArrayList<>();
-
- boundValues = null;
-
- this.protocolVersion = ProtocolVersion.valueOf(Short.toUnsignedInt(buf.getShort()));
+ boundValues = new ConcurrentHashMap<>();
+ this.protocolVersion =
+ ProtocolVersion.valueOf(Short.toUnsignedInt(buf.getShort()));
if (protocolVersion.useTLS13PlusSpec()) {
this.sessionId = new SessionId(false, null);
@@ -322,14 +330,26 @@
hc.sslContext.getSecureRandom());
}
- this.cipherSuite = CipherSuite.valueOf(Short.toUnsignedInt(buf.getShort()));
+ this.cipherSuite =
+ CipherSuite.valueOf(Short.toUnsignedInt(buf.getShort()));
// Local Supported signature algorithms
- i = Short.toUnsignedInt(buf.getShort());
+ ArrayList list = new ArrayList<>();
+ i = Byte.toUnsignedInt(buf.get());
while (i-- > 0) {
- this.localSupportedSignAlgs.add(SignatureScheme.valueOf(
+ list.add(SignatureScheme.valueOf(
Short.toUnsignedInt(buf.getShort())));
}
+ this.localSupportedSignAlgs = Collections.unmodifiableCollection(list);
+
+ // Peer Supported signature algorithms
+ i = Byte.toUnsignedInt(buf.get());
+ list.clear();
+ while (i-- > 0) {
+ list.add(SignatureScheme.valueOf(
+ Short.toUnsignedInt(buf.getShort())));
+ }
+ this.peerSupportedSignAlgs = Collections.unmodifiableCollection(list);
// PSK
i = Short.toUnsignedInt(buf.getShort());
@@ -410,9 +430,27 @@
}
}
+ maximumPacketSize = buf.getInt();
+ negotiatedMaxFragLen = buf.getInt();
+
// Get creation time
this.creationTime = buf.getLong();
+ // Get Buffer sizes
+
+ // Status Response
+ len = Short.toUnsignedInt(buf.getShort());
+ if (len == 0) {
+ statusResponses = Collections.emptyList();
+ } else {
+ statusResponses = new ArrayList<>();
+ }
+ while (len-- > 0) {
+ b = new byte[Short.toUnsignedInt(buf.getShort())];
+ buf.get(b);
+ statusResponses.add(b);
+ }
+
// Get Peer host & port
i = Byte.toUnsignedInt(buf.get());
if (i == 0) {
@@ -484,6 +522,33 @@
context = (SSLSessionContextImpl)
hc.sslContext.engineGetServerSessionContext();
+ this.lastUsedTime = System.currentTimeMillis();
+ }
+
+ // Some situations we cannot provide a stateless ticket, but after it
+ // has been negotiated
+ boolean isStatelessable(HandshakeContext hc) {
+ if (!hc.statelessResumption) {
+ return false;
+ }
+
+ // If there is no getMasterSecret with TLS1.2 or under, do not resume.
+ if (!protocolVersion.useTLS13PlusSpec() &&
+ getMasterSecret().getEncoded() == null) {
+ if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
+ SSLLogger.finest("No MasterSecret, cannot make stateless" +
+ " ticket");
+ }
+ return false;
+ }
+ if (boundValues != null && boundValues.size() > 0) {
+ if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
+ SSLLogger.finest("There are boundValues, cannot make" +
+ " stateless ticket");
+ }
+ return false;
+ }
+ return true;
}
/**
@@ -497,11 +562,14 @@
hos.putInt16(cipherSuite.id);
// Local Supported signature algorithms
- int l = localSupportedSignAlgs.size();
- hos.putInt16(l);
- SignatureScheme[] sig = new SignatureScheme[l];
- localSupportedSignAlgs.toArray(sig);
- for (SignatureScheme s : sig) {
+ hos.putInt8(localSupportedSignAlgs.size());
+ for (SignatureScheme s : localSupportedSignAlgs) {
+ hos.putInt16(s.id);
+ }
+
+ // Peer Supported signature algorithms
+ hos.putInt8(peerSupportedSignAlgs.size());
+ for (SignatureScheme s : peerSupportedSignAlgs) {
hos.putInt16(s.id);
}
@@ -564,16 +632,30 @@
// List of SNIServerName
hos.putInt16(requestedServerNames.size());
if (requestedServerNames.size() > 0) {
- for (SNIServerName host: requestedServerNames) {
+ for (SNIServerName host : requestedServerNames) {
b = host.getEncoded();
hos.putInt8(b.length);
hos.write(b, 0, b.length);
}
}
+ // Buffer sizes
+ hos.putInt32(maximumPacketSize);
+ hos.putInt32(negotiatedMaxFragLen);
+
+ // creation time
ByteBuffer buffer = ByteBuffer.allocate(Long.BYTES);
hos.writeBytes(buffer.putLong(creationTime).array());
+ // Status Responses
+ List list = getStatusResponses();
+ int l = list.size();
+ hos.putInt16(l);
+ for (byte[] e : list) {
+ hos.putInt16(e.length);
+ hos.write(e);
+ }
+
// peer Host & Port
if (host == null || host.length() == 0) {
hos.putInt8(0);
@@ -649,10 +731,14 @@
BigInteger incrTicketNonceCounter() {
BigInteger result = ticketNonceCounter;
- ticketNonceCounter = ticketNonceCounter.add(BigInteger.valueOf(1));
+ ticketNonceCounter = ticketNonceCounter.add(BigInteger.ONE);
return result;
}
+ boolean isPSKable() {
+ return (ticketNonceCounter.compareTo(BigInteger.ZERO) > 0);
+ }
+
/**
* Returns the master secret ... treat with extreme caution!
*/
@@ -725,8 +811,7 @@
void setPeerSupportedSignatureAlgorithms(
Collection signatureSchemes) {
- peerSupportedSignAlgs =
- SignatureScheme.getAlgorithmNames(signatureSchemes);
+ peerSupportedSignAlgs = signatureSchemes;
}
// TLS 1.2 only
@@ -740,16 +825,20 @@
// certificates and server key exchange), it MUST send the
// signature_algorithms extension, listing the algorithms it
// is willing to accept.
+ private static final ArrayList defaultPeerSupportedSignAlgs =
+ new ArrayList<>(Arrays.asList(SignatureScheme.RSA_PKCS1_SHA1,
+ SignatureScheme.DSA_SHA1,
+ SignatureScheme.ECDSA_SHA1));
+
void setUseDefaultPeerSignAlgs() {
useDefaultPeerSignAlgs = true;
- peerSupportedSignAlgs = new String[] {
- "SHA1withRSA", "SHA1withDSA", "SHA1withECDSA"};
+ peerSupportedSignAlgs = defaultPeerSupportedSignAlgs;
}
// Returns the connection session.
SSLSessionImpl finish() {
if (useDefaultPeerSignAlgs) {
- this.peerSupportedSignAlgs = new String[0];
+ peerSupportedSignAlgs = Collections.emptySet();
}
return this;
@@ -1212,6 +1301,7 @@
* sessions can be shared across different protection domains.
*/
private final ConcurrentHashMap boundValues;
+ boolean updateNST;
/**
* Assigns a session value. Session change events are given if
@@ -1238,6 +1328,9 @@
e = new SSLSessionBindingEvent(this, key);
((SSLSessionBindingListener)value).valueBound(e);
}
+ if (protocolVersion.useTLS13PlusSpec()) {
+ updateNST = true;
+ }
}
/**
@@ -1273,6 +1366,9 @@
e = new SSLSessionBindingEvent(this, key);
((SSLSessionBindingListener)value).valueUnbound(e);
}
+ if (protocolVersion.useTLS13PlusSpec()) {
+ updateNST = true;
+ }
}
@@ -1474,11 +1570,7 @@
*/
@Override
public String[] getPeerSupportedSignatureAlgorithms() {
- if (peerSupportedSignAlgs != null) {
- return peerSupportedSignAlgs.clone();
- }
-
- return new String[0];
+ return SignatureScheme.getAlgorithmNames(peerSupportedSignAlgs);
}
/**
diff -r aaa83519e723 -r 0e2453f75881 src/java.base/share/classes/sun/security/ssl/SSLSocketImpl.java
--- a/src/java.base/share/classes/sun/security/ssl/SSLSocketImpl.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.base/share/classes/sun/security/ssl/SSLSocketImpl.java Tue Jul 23 11:17:59 2019 -0700
@@ -1264,6 +1264,11 @@
conContext.outputRecord.writeCipher.atKeyLimit()) {
tryKeyUpdate();
}
+ // Check if NewSessionTicket PostHandshake message needs to be sent
+ if (conContext.conSession.updateNST) {
+ conContext.conSession.updateNST = false;
+ tryNewSessionTicket();
+ }
}
@Override
@@ -1499,6 +1504,25 @@
}
}
+ // Try to generate a PostHandshake NewSessionTicket message. This is
+ // TLS 1.3 only.
+ private void tryNewSessionTicket() throws IOException {
+ // Don't bother to kickstart if handshaking is in progress, or if the
+ // connection is not duplex-open.
+ if (!conContext.sslConfig.isClientMode &&
+ conContext.protocolVersion.useTLS13PlusSpec() &&
+ conContext.handshakeContext == null &&
+ !conContext.isOutboundClosed() &&
+ !conContext.isInboundClosed() &&
+ !conContext.isBroken) {
+ if (SSLLogger.isOn && SSLLogger.isOn("ssl")) {
+ SSLLogger.finest("trigger new session ticket");
+ }
+ NewSessionTicket.kickstartProducer.produce(
+ new PostHandshakeContext(conContext));
+ }
+ }
+
/**
* Initialize the handshaker and socket streams.
*
diff -r aaa83519e723 -r 0e2453f75881 src/java.base/share/classes/sun/security/ssl/ServerHello.java
--- a/src/java.base/share/classes/sun/security/ssl/ServerHello.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.base/share/classes/sun/security/ssl/ServerHello.java Tue Jul 23 11:17:59 2019 -0700
@@ -1155,14 +1155,14 @@
chc, chc.resumingSession.getMasterSecret());
}
- chc.conContext.consumers.putIfAbsent(
- ContentType.CHANGE_CIPHER_SPEC.id,
- ChangeCipherSpec.t10Consumer);
if (chc.statelessResumption) {
chc.handshakeConsumers.putIfAbsent(
SSLHandshake.NEW_SESSION_TICKET.id,
SSLHandshake.NEW_SESSION_TICKET);
}
+ chc.conContext.consumers.putIfAbsent(
+ ContentType.CHANGE_CIPHER_SPEC.id,
+ ChangeCipherSpec.t10Consumer);
chc.handshakeConsumers.put(
SSLHandshake.FINISHED.id,
SSLHandshake.FINISHED);
diff -r aaa83519e723 -r 0e2453f75881 src/java.base/share/classes/sun/security/ssl/SessionTicketExtension.java
--- a/src/java.base/share/classes/sun/security/ssl/SessionTicketExtension.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.base/share/classes/sun/security/ssl/SessionTicketExtension.java Tue Jul 23 11:17:59 2019 -0700
@@ -46,7 +46,6 @@
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.text.MessageFormat;
-import java.util.Collection;
import java.util.Locale;
/**
@@ -255,13 +254,17 @@
data = buf;
}
- public byte[] encrypt(HandshakeContext hc, SSLSessionImpl session)
- throws IOException {
+ public byte[] encrypt(HandshakeContext hc, SSLSessionImpl session) {
byte[] encrypted;
- StatelessKey key = KeyState.getCurrentKey(hc);
- byte[] iv = new byte[16];
+
+ if (!hc.handshakeSession.isStatelessable(hc)) {
+ return new byte[0];
+ }
try {
+ StatelessKey key = KeyState.getCurrentKey(hc);
+ byte[] iv = new byte[16];
+
SecureRandom random = hc.sslContext.getSecureRandom();
random.nextBytes(iv);
Cipher c = Cipher.getInstance("AES/GCM/NoPadding");
@@ -273,8 +276,11 @@
(byte)(key.num >>> 8),
(byte)(key.num)}
);
- encrypted = c.doFinal(session.write());
-
+ byte[] data = session.write();
+ if (data.length == 0) {
+ return data;
+ }
+ encrypted = c.doFinal(data);
byte[] result = new byte[encrypted.length + Integer.BYTES +
iv.length];
result[0] = (byte)(key.num >>> 24);
@@ -286,7 +292,10 @@
Integer.BYTES + iv.length, encrypted.length);
return result;
} catch (Exception e) {
- throw hc.conContext.fatal(Alert.UNEXPECTED_MESSAGE, e);
+ if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
+ SSLLogger.fine("Encryption failed." + e);
+ }
+ return new byte[0];
}
}
@@ -311,11 +320,7 @@
(byte)(keyID >>> 8),
(byte)(keyID)}
);
- /*
- return ByteBuffer.wrap(c.doFinal(data,
- Integer.BYTES + iv.length,
- data.length - (Integer.BYTES + iv.length)));
- */
+
ByteBuffer out;
out = ByteBuffer.allocate(data.remaining() - GCM_TAG_LEN / 8);
c.doFinal(data, out);
diff -r aaa83519e723 -r 0e2453f75881 src/java.base/share/classes/sun/security/util/ManifestDigester.java
--- a/src/java.base/share/classes/sun/security/util/ManifestDigester.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.base/share/classes/sun/security/util/ManifestDigester.java Tue Jul 23 11:17:59 2019 -0700
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,10 +25,12 @@
package sun.security.util;
-import java.security.*;
+import java.security.MessageDigest;
import java.util.ArrayList;
import java.util.HashMap;
import java.io.ByteArrayOutputStream;
+import java.io.OutputStream;
+import java.io.IOException;
import java.util.List;
import static java.nio.charset.StandardCharsets.UTF_8;
@@ -40,13 +42,27 @@
*/
public class ManifestDigester {
+ /**
+ * The part "{@code Manifest-Main-Attributes}" of the main attributes
+ * digest header name in a signature file as described in the jar
+ * specification:
+ *
{@code x-Digest-Manifest-Main-Attributes}
+ * (where x is the standard name of a {@link MessageDigest} algorithm):
+ * The value of this attribute is the digest value of the main attributes
+ * of the manifest.
+ * @see
+ * JAR File Specification, section Signature File
+ * @see #getMainAttsEntry
+ */
public static final String MF_MAIN_ATTRS = "Manifest-Main-Attributes";
/** the raw bytes of the manifest */
- private byte[] rawBytes;
+ private final byte[] rawBytes;
- /** the entries grouped by names */
- private HashMap entries; // key is a UTF-8 string
+ private final Entry mainAttsEntry;
+
+ /** individual sections by their names */
+ private final HashMap entries = new HashMap<>();
/** state returned by findSection */
static class Position {
@@ -72,29 +88,31 @@
private boolean findSection(int offset, Position pos)
{
int i = offset, len = rawBytes.length;
- int last = offset;
+ int last = offset - 1;
int next;
boolean allBlank = true;
- pos.endOfFirstLine = -1;
+ /* denotes that a position is not yet assigned.
+ * As a primitive type int it cannot be null
+ * and -1 would be confused with (i - 1) when i == 0 */
+ final int UNASSIGNED = Integer.MIN_VALUE;
+
+ pos.endOfFirstLine = UNASSIGNED;
while (i < len) {
byte b = rawBytes[i];
switch(b) {
case '\r':
- if (pos.endOfFirstLine == -1)
+ if (pos.endOfFirstLine == UNASSIGNED)
pos.endOfFirstLine = i-1;
- if ((i < len) && (rawBytes[i+1] == '\n'))
+ if (i < len - 1 && rawBytes[i + 1] == '\n')
i++;
/* fall through */
case '\n':
- if (pos.endOfFirstLine == -1)
+ if (pos.endOfFirstLine == UNASSIGNED)
pos.endOfFirstLine = i-1;
if (allBlank || (i == len-1)) {
- if (i == len-1)
- pos.endOfSection = i;
- else
- pos.endOfSection = last;
+ pos.endOfSection = allBlank ? last : i;
pos.startOfNext = i+1;
return true;
}
@@ -116,16 +134,17 @@
public ManifestDigester(byte[] bytes)
{
rawBytes = bytes;
- entries = new HashMap<>();
Position pos = new Position();
- if (!findSection(0, pos))
+ if (!findSection(0, pos)) {
+ mainAttsEntry = null;
return; // XXX: exception?
+ }
// create an entry for main attributes
- entries.put(MF_MAIN_ATTRS, new Entry().addSection(
- new Section(0, pos.endOfSection + 1, pos.startOfNext, rawBytes)));
+ mainAttsEntry = new Entry().addSection(new Section(
+ 0, pos.endOfSection + 1, pos.startOfNext, rawBytes));
int start = pos.startOfNext;
while(findSection(start, pos)) {
@@ -133,14 +152,16 @@
int sectionLen = pos.endOfSection-start+1;
int sectionLenWithBlank = pos.startOfNext-start;
- if (len > 6) {
+ if (len >= 6) { // 6 == "Name: ".length()
if (isNameAttr(bytes, start)) {
ByteArrayOutputStream nameBuf = new ByteArrayOutputStream();
nameBuf.write(bytes, start+6, len-6);
int i = start + len;
if ((i-start) < sectionLen) {
- if (bytes[i] == '\r') {
+ if (bytes[i] == '\r'
+ && i + 1 - start < sectionLen
+ && bytes[i + 1] == '\n') {
i += 2;
} else {
i += 1;
@@ -152,14 +173,16 @@
// name is wrapped
int wrapStart = i;
while (((i-start) < sectionLen)
- && (bytes[i++] != '\n'));
- if (bytes[i-1] != '\n')
- return; // XXX: exception?
- int wrapLen;
- if (bytes[i-2] == '\r')
- wrapLen = i-wrapStart-2;
- else
- wrapLen = i-wrapStart-1;
+ && (bytes[i] != '\r')
+ && (bytes[i] != '\n')) i++;
+ int wrapLen = i - wrapStart;
+ if (i - start < sectionLen) {
+ i++;
+ if (bytes[i - 1] == '\r'
+ && i - start < sectionLen
+ && bytes[i] == '\n')
+ i++;
+ }
nameBuf.write(bytes, wrapStart, wrapLen);
} else {
@@ -167,7 +190,7 @@
}
}
- entries.computeIfAbsent(new String(nameBuf.toByteArray(), UTF_8),
+ entries.computeIfAbsent(nameBuf.toString(UTF_8),
dummy -> new Entry())
.addSection(new Section(start, sectionLen,
sectionLenWithBlank, rawBytes));
@@ -202,6 +225,26 @@
return this;
}
+ /**
+ * Check if the sections (particularly the last one of usually only one)
+ * are properly delimited with a trailing blank line so that another
+ * section can be correctly appended and return {@code true} or return
+ * {@code false} to indicate that reproduction is not advised and should
+ * be carried out with a clean "normalized" newly-written manifest.
+ *
+ * @see #reproduceRaw
+ */
+ public boolean isProperlyDelimited() {
+ return sections.stream().allMatch(
+ Section::isProperlySectionDelimited);
+ }
+
+ public void reproduceRaw(OutputStream out) throws IOException {
+ for (Section sec : sections) {
+ out.write(sec.rawBytes, sec.offset, sec.lengthWithBlankLine);
+ }
+ }
+
public byte[] digest(MessageDigest md)
{
md.reset();
@@ -242,6 +285,15 @@
this.rawBytes = rawBytes;
}
+ /**
+ * Returns {@code true} if the raw section is terminated with a blank
+ * line so that another section can possibly be appended resulting in a
+ * valid manifest and {@code false} otherwise.
+ */
+ private boolean isProperlySectionDelimited() {
+ return lengthWithBlankLine > length;
+ }
+
private static void doOldStyle(MessageDigest md,
byte[] bytes,
int offset,
@@ -268,10 +320,33 @@
}
}
+ /**
+ * @see #MF_MAIN_ATTRS
+ */
+ public Entry getMainAttsEntry() {
+ return mainAttsEntry;
+ }
+
+ /**
+ * @see #MF_MAIN_ATTRS
+ */
+ public Entry getMainAttsEntry(boolean oldStyle) {
+ mainAttsEntry.oldStyle = oldStyle;
+ return mainAttsEntry;
+ }
+
+ public Entry get(String name) {
+ return entries.get(name);
+ }
+
public Entry get(String name, boolean oldStyle) {
- Entry e = entries.get(name);
- if (e != null)
+ Entry e = get(name);
+ if (e == null && MF_MAIN_ATTRS.equals(name)) {
+ e = getMainAttsEntry();
+ }
+ if (e != null) {
e.oldStyle = oldStyle;
+ }
return e;
}
diff -r aaa83519e723 -r 0e2453f75881 src/java.base/share/classes/sun/security/util/SignatureFileVerifier.java
--- a/src/java.base/share/classes/sun/security/util/SignatureFileVerifier.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.base/share/classes/sun/security/util/SignatureFileVerifier.java Tue Jul 23 11:17:59 2019 -0700
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -72,8 +72,7 @@
private ArrayList signerCache;
private static final String ATTR_DIGEST =
- ("-DIGEST-" + ManifestDigester.MF_MAIN_ATTRS).toUpperCase
- (Locale.ENGLISH);
+ "-DIGEST-" + ManifestDigester.MF_MAIN_ATTRS.toUpperCase(Locale.ENGLISH);
/** the PKCS7 block for this .DSA/.RSA/.EC file */
private PKCS7 block;
@@ -537,8 +536,7 @@
MessageDigest digest = getDigest(algorithm);
if (digest != null) {
- ManifestDigester.Entry mde =
- md.get(ManifestDigester.MF_MAIN_ATTRS, false);
+ ManifestDigester.Entry mde = md.getMainAttsEntry(false);
byte[] computedHash = mde.digest(digest);
byte[] expectedHash =
Base64.getMimeDecoder().decode((String)se.getValue());
diff -r aaa83519e723 -r 0e2453f75881 src/java.base/share/legal/icu.md
--- a/src/java.base/share/legal/icu.md Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.base/share/legal/icu.md Tue Jul 23 11:17:59 2019 -0700
@@ -1,6 +1,7 @@
## International Components for Unicode (ICU4J) v64.2
### ICU4J License
+```
COPYRIGHT AND PERMISSION NOTICE (ICU 58 and later)
@@ -387,3 +388,6 @@
# by ICANN or the IETF Trust on the database or the code. Any person
# making a contribution to the database or code waives all rights to
# future claims in that contribution or in the TZ Database.
+
+```
+
diff -r aaa83519e723 -r 0e2453f75881 src/java.base/share/legal/unicode.md
--- a/src/java.base/share/legal/unicode.md Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.base/share/legal/unicode.md Tue Jul 23 11:17:59 2019 -0700
@@ -1,6 +1,7 @@
## The Unicode Standard, Unicode Character Database, Version 12.1.0
### Unicode Character Database
+```
UNICODE, INC. LICENSE AGREEMENT - DATA FILES AND SOFTWARE
@@ -48,3 +49,6 @@
shall not be used in advertising or otherwise to promote the sale,
use or other dealings in these Data Files or Software without prior
written authorization of the copyright holder.
+
+```
+
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/macosx/native/libosxkrb5/nativeccache.c
--- a/src/java.security.jgss/macosx/native/libosxkrb5/nativeccache.c Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/macosx/native/libosxkrb5/nativeccache.c Tue Jul 23 11:17:59 2019 -0700
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2011, 2015, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -345,7 +345,7 @@
if (krbcredsConstructor == 0) {
krbcredsConstructor = (*env)->GetMethodID(env, krbcredsClass, "",
- "(Lsun/security/krb5/internal/Ticket;Lsun/security/krb5/PrincipalName;Lsun/security/krb5/PrincipalName;Lsun/security/krb5/EncryptionKey;Lsun/security/krb5/internal/TicketFlags;Lsun/security/krb5/internal/KerberosTime;Lsun/security/krb5/internal/KerberosTime;Lsun/security/krb5/internal/KerberosTime;Lsun/security/krb5/internal/KerberosTime;Lsun/security/krb5/internal/HostAddresses;)V");
+ "(Lsun/security/krb5/internal/Ticket;Lsun/security/krb5/PrincipalName;Lsun/security/krb5/PrincipalName;Lsun/security/krb5/PrincipalName;Lsun/security/krb5/PrincipalName;Lsun/security/krb5/EncryptionKey;Lsun/security/krb5/internal/TicketFlags;Lsun/security/krb5/internal/KerberosTime;Lsun/security/krb5/internal/KerberosTime;Lsun/security/krb5/internal/KerberosTime;Lsun/security/krb5/internal/KerberosTime;Lsun/security/krb5/internal/HostAddresses;)V");
if (krbcredsConstructor == 0) {
printf("Couldn't find sun.security.krb5.internal.Ticket constructor\n");
break;
@@ -359,7 +359,9 @@
krbcredsConstructor,
ticket,
clientPrincipal,
+ NULL,
targetPrincipal,
+ NULL,
encryptionKey,
ticketFlags,
authTime,
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/javax/security/auth/kerberos/JavaxSecurityAuthKerberosAccessImpl.java
--- a/src/java.security.jgss/share/classes/javax/security/auth/kerberos/JavaxSecurityAuthKerberosAccessImpl.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/javax/security/auth/kerberos/JavaxSecurityAuthKerberosAccessImpl.java Tue Jul 23 11:17:59 2019 -0700
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2011, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -26,8 +26,6 @@
package javax.security.auth.kerberos;
import sun.security.krb5.JavaxSecurityAuthKerberosAccess;
-import sun.security.krb5.EncryptionKey;
-import sun.security.krb5.PrincipalName;
class JavaxSecurityAuthKerberosAccessImpl
implements JavaxSecurityAuthKerberosAccess {
@@ -35,4 +33,20 @@
KeyTab ktab) {
return ktab.takeSnapshot();
}
+
+ public KerberosPrincipal kerberosTicketGetClientAlias(KerberosTicket t) {
+ return t.clientAlias;
+ }
+
+ public void kerberosTicketSetClientAlias(KerberosTicket t, KerberosPrincipal a) {
+ t.clientAlias = a;
+ }
+
+ public KerberosPrincipal kerberosTicketGetServerAlias(KerberosTicket t) {
+ return t.serverAlias;
+ }
+
+ public void kerberosTicketSetServerAlias(KerberosTicket t, KerberosPrincipal a) {
+ t.serverAlias = a;
+ }
}
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/javax/security/auth/kerberos/KerberosTicket.java
--- a/src/java.security.jgss/share/classes/javax/security/auth/kerberos/KerberosTicket.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/javax/security/auth/kerberos/KerberosTicket.java Tue Jul 23 11:17:59 2019 -0700
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -195,6 +195,10 @@
private transient boolean destroyed = false;
+ transient KerberosPrincipal clientAlias = null;
+
+ transient KerberosPrincipal serverAlias = null;
+
/**
* Constructs a {@code KerberosTicket} using credentials information that a
* client either receives from a KDC or reads from a cache.
@@ -591,7 +595,11 @@
try {
krb5Creds = new sun.security.krb5.Credentials(asn1Encoding,
client.getName(),
+ (clientAlias != null ?
+ clientAlias.getName() : null),
server.getName(),
+ (serverAlias != null ?
+ serverAlias.getName() : null),
sessionKey.getEncoded(),
sessionKey.getKeyType(),
flags,
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/sun/security/jgss/krb5/Krb5Context.java
--- a/src/java.security.jgss/share/classes/sun/security/jgss/krb5/Krb5Context.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/sun/security/jgss/krb5/Krb5Context.java Tue Jul 23 11:17:59 2019 -0700
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -713,14 +713,14 @@
if (subject != null &&
!subject.isReadOnly()) {
/*
- * Store the service credentials as
- * javax.security.auth.kerberos.KerberosTicket in
- * the Subject. We could wait till the context is
- * succesfully established; however it is easier
- * to do here and there is no harm indoing it here.
- */
+ * Store the service credentials as
+ * javax.security.auth.kerberos.KerberosTicket in
+ * the Subject. We could wait until the context is
+ * successfully established; however it is easier
+ * to do it here and there is no harm.
+ */
final KerberosTicket kt =
- Krb5Util.credsToTicket(serviceCreds);
+ Krb5Util.credsToTicket(serviceCreds);
AccessController.doPrivileged (
new java.security.PrivilegedAction() {
public Void run() {
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/sun/security/jgss/krb5/Krb5InitCredential.java
--- a/src/java.security.jgss/share/classes/sun/security/jgss/krb5/Krb5InitCredential.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/sun/security/jgss/krb5/Krb5InitCredential.java Tue Jul 23 11:17:59 2019 -0700
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -59,7 +59,9 @@
private Krb5InitCredential(Krb5NameElement name,
byte[] asn1Encoding,
KerberosPrincipal client,
+ KerberosPrincipal clientAlias,
KerberosPrincipal server,
+ KerberosPrincipal serverAlias,
byte[] sessionKey,
int keyType,
boolean[] flags,
@@ -80,14 +82,21 @@
endTime,
renewTill,
clientAddresses);
-
+ KerberosSecrets.getJavaxSecurityAuthKerberosAccess()
+ .kerberosTicketSetClientAlias(this, clientAlias);
+ KerberosSecrets.getJavaxSecurityAuthKerberosAccess()
+ .kerberosTicketSetServerAlias(this, serverAlias);
this.name = name;
try {
// Cache this for later use by the sun.security.krb5 package.
krb5Credentials = new Credentials(asn1Encoding,
client.getName(),
+ (clientAlias != null ?
+ clientAlias.getName() : null),
server.getName(),
+ (serverAlias != null ?
+ serverAlias.getName() : null),
sessionKey,
keyType,
flags,
@@ -110,7 +119,9 @@
Credentials delegatedCred,
byte[] asn1Encoding,
KerberosPrincipal client,
+ KerberosPrincipal clientAlias,
KerberosPrincipal server,
+ KerberosPrincipal serverAlias,
byte[] sessionKey,
int keyType,
boolean[] flags,
@@ -131,7 +142,10 @@
endTime,
renewTill,
clientAddresses);
-
+ KerberosSecrets.getJavaxSecurityAuthKerberosAccess()
+ .kerberosTicketSetClientAlias(this, clientAlias);
+ KerberosSecrets.getJavaxSecurityAuthKerberosAccess()
+ .kerberosTicketSetServerAlias(this, serverAlias);
this.name = name;
// A delegated cred does not have all fields set. So do not try to
// creat new Credentials out of the delegatedCred.
@@ -153,10 +167,18 @@
Krb5MechFactory.NT_GSS_KRB5_PRINCIPAL);
}
+ KerberosPrincipal clientAlias = KerberosSecrets
+ .getJavaxSecurityAuthKerberosAccess()
+ .kerberosTicketGetClientAlias(tgt);
+ KerberosPrincipal serverAlias = KerberosSecrets
+ .getJavaxSecurityAuthKerberosAccess()
+ .kerberosTicketGetServerAlias(tgt);
return new Krb5InitCredential(name,
tgt.getEncoded(),
tgt.getClient(),
+ clientAlias,
tgt.getServer(),
+ serverAlias,
tgt.getSessionKey().getEncoded(),
tgt.getSessionKeyType(),
tgt.getFlags(),
@@ -179,10 +201,14 @@
*/
PrincipalName cPrinc = delegatedCred.getClient();
+ PrincipalName cAPrinc = delegatedCred.getClientAlias();
PrincipalName sPrinc = delegatedCred.getServer();
+ PrincipalName sAPrinc = delegatedCred.getServerAlias();
KerberosPrincipal client = null;
+ KerberosPrincipal clientAlias = null;
KerberosPrincipal server = null;
+ KerberosPrincipal serverAlias = null;
Krb5NameElement credName = null;
@@ -193,6 +219,10 @@
client = new KerberosPrincipal(fullName);
}
+ if (cAPrinc != null) {
+ clientAlias = new KerberosPrincipal(cAPrinc.getName());
+ }
+
// XXX Compare name to credName
if (sPrinc != null) {
@@ -201,11 +231,17 @@
KerberosPrincipal.KRB_NT_SRV_INST);
}
+ if (sAPrinc != null) {
+ serverAlias = new KerberosPrincipal(sAPrinc.getName());
+ }
+
return new Krb5InitCredential(credName,
delegatedCred,
delegatedCred.getEncoded(),
client,
+ clientAlias,
server,
+ serverAlias,
sessionKey.getBytes(),
sessionKey.getEType(),
delegatedCred.getFlags(),
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/sun/security/jgss/krb5/Krb5Util.java
--- a/src/java.security.jgss/share/classes/sun/security/jgss/krb5/Krb5Util.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/sun/security/jgss/krb5/Krb5Util.java Tue Jul 23 11:17:59 2019 -0700
@@ -132,7 +132,7 @@
public static KerberosTicket credsToTicket(Credentials serviceCreds) {
EncryptionKey sessionKey = serviceCreds.getSessionKey();
- return new KerberosTicket(
+ KerberosTicket kt = new KerberosTicket(
serviceCreds.getEncoded(),
new KerberosPrincipal(serviceCreds.getClient().getName()),
new KerberosPrincipal(serviceCreds.getServer().getName(),
@@ -145,14 +145,35 @@
serviceCreds.getEndTime(),
serviceCreds.getRenewTill(),
serviceCreds.getClientAddresses());
+ PrincipalName clientAlias = serviceCreds.getClientAlias();
+ PrincipalName serverAlias = serviceCreds.getServerAlias();
+ if (clientAlias != null) {
+ KerberosSecrets.getJavaxSecurityAuthKerberosAccess()
+ .kerberosTicketSetClientAlias(kt, new KerberosPrincipal(
+ clientAlias.getName(), clientAlias.getNameType()));
+ }
+ if (serverAlias != null) {
+ KerberosSecrets.getJavaxSecurityAuthKerberosAccess()
+ .kerberosTicketSetServerAlias(kt, new KerberosPrincipal(
+ serverAlias.getName(), serverAlias.getNameType()));
+ }
+ return kt;
};
public static Credentials ticketToCreds(KerberosTicket kerbTicket)
throws KrbException, IOException {
+ KerberosPrincipal clientAlias = KerberosSecrets
+ .getJavaxSecurityAuthKerberosAccess()
+ .kerberosTicketGetClientAlias(kerbTicket);
+ KerberosPrincipal serverAlias = KerberosSecrets
+ .getJavaxSecurityAuthKerberosAccess()
+ .kerberosTicketGetServerAlias(kerbTicket);
return new Credentials(
kerbTicket.getEncoded(),
kerbTicket.getClient().getName(),
+ (clientAlias != null ? clientAlias.getName() : null),
kerbTicket.getServer().getName(),
+ (serverAlias != null ? serverAlias.getName() : null),
kerbTicket.getSessionKey().getEncoded(),
kerbTicket.getSessionKeyType(),
kerbTicket.getFlags(),
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/sun/security/jgss/krb5/SubjectComber.java
--- a/src/java.security.jgss/share/classes/sun/security/jgss/krb5/SubjectComber.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/sun/security/jgss/krb5/SubjectComber.java Tue Jul 23 11:17:59 2019 -0700
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2002, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2002, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,8 @@
package sun.security.jgss.krb5;
+import sun.security.krb5.KerberosSecrets;
+
import javax.security.auth.kerberos.KerberosTicket;
import javax.security.auth.kerberos.KerberosKey;
import javax.security.auth.Subject;
@@ -182,24 +184,45 @@
}
} else {
+ KerberosPrincipal serverAlias = KerberosSecrets
+ .getJavaxSecurityAuthKerberosAccess()
+ .kerberosTicketGetServerAlias(ticket);
if (serverPrincipal == null ||
- ticket.getServer().getName().equals(serverPrincipal)) {
-
+ ticket.getServer().getName().equals(serverPrincipal) ||
+ (serverAlias != null &&
+ serverPrincipal.equals(
+ serverAlias.getName()))) {
+ KerberosPrincipal clientAlias = KerberosSecrets
+ .getJavaxSecurityAuthKerberosAccess()
+ .kerberosTicketGetClientAlias(ticket);
if (clientPrincipal == null ||
clientPrincipal.equals(
- ticket.getClient().getName())) {
+ ticket.getClient().getName()) ||
+ (clientAlias != null &&
+ clientPrincipal.equals(
+ clientAlias.getName()))) {
if (oneOnly) {
return ticket;
} else {
// Record names so that tickets will
// all belong to same principals
if (clientPrincipal == null) {
- clientPrincipal =
- ticket.getClient().getName();
+ if (clientAlias == null) {
+ clientPrincipal =
+ ticket.getClient().getName();
+ } else {
+ clientPrincipal =
+ clientAlias.getName();
+ }
}
if (serverPrincipal == null) {
- serverPrincipal =
- ticket.getServer().getName();
+ if (serverAlias == null) {
+ serverPrincipal =
+ ticket.getServer().getName();
+ } else {
+ serverPrincipal =
+ serverAlias.getName();
+ }
}
answer.add(credClass.cast(ticket));
}
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/sun/security/krb5/Credentials.java
--- a/src/java.security.jgss/share/classes/sun/security/krb5/Credentials.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/sun/security/krb5/Credentials.java Tue Jul 23 11:17:59 2019 -0700
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -49,7 +49,9 @@
Ticket ticket;
PrincipalName client;
+ PrincipalName clientAlias;
PrincipalName server;
+ PrincipalName serverAlias;
EncryptionKey key;
TicketFlags flags;
KerberosTime authTime;
@@ -69,7 +71,9 @@
public Credentials(Ticket new_ticket,
PrincipalName new_client,
+ PrincipalName new_client_alias,
PrincipalName new_server,
+ PrincipalName new_server_alias,
EncryptionKey new_key,
TicketFlags new_flags,
KerberosTime authTime,
@@ -78,14 +82,17 @@
KerberosTime renewTill,
HostAddresses cAddr,
AuthorizationData authzData) {
- this(new_ticket, new_client, new_server, new_key, new_flags,
- authTime, new_startTime, new_endTime, renewTill, cAddr);
+ this(new_ticket, new_client, new_client_alias, new_server,
+ new_server_alias, new_key, new_flags, authTime,
+ new_startTime, new_endTime, renewTill, cAddr);
this.authzData = authzData;
}
public Credentials(Ticket new_ticket,
PrincipalName new_client,
+ PrincipalName new_client_alias,
PrincipalName new_server,
+ PrincipalName new_server_alias,
EncryptionKey new_key,
TicketFlags new_flags,
KerberosTime authTime,
@@ -95,7 +102,9 @@
HostAddresses cAddr) {
ticket = new_ticket;
client = new_client;
+ clientAlias = new_client_alias;
server = new_server;
+ serverAlias = new_server_alias;
key = new_key;
flags = new_flags;
this.authTime = authTime;
@@ -107,7 +116,9 @@
public Credentials(byte[] encoding,
String client,
+ String clientAlias,
String server,
+ String serverAlias,
byte[] keyBytes,
int keyType,
boolean[] flags,
@@ -118,7 +129,11 @@
InetAddress[] cAddrs) throws KrbException, IOException {
this(new Ticket(encoding),
new PrincipalName(client, PrincipalName.KRB_NT_PRINCIPAL),
+ (clientAlias == null? null : new PrincipalName(clientAlias,
+ PrincipalName.KRB_NT_PRINCIPAL)),
new PrincipalName(server, PrincipalName.KRB_NT_SRV_INST),
+ (serverAlias == null? null : new PrincipalName(serverAlias,
+ PrincipalName.KRB_NT_SRV_INST)),
new EncryptionKey(keyType, keyBytes),
(flags == null? null: new TicketFlags(flags)),
(authTime == null? null: new KerberosTime(authTime)),
@@ -143,10 +158,18 @@
return client;
}
+ public final PrincipalName getClientAlias() {
+ return clientAlias;
+ }
+
public final PrincipalName getServer() {
return server;
}
+ public final PrincipalName getServerAlias() {
+ return serverAlias;
+ }
+
public final EncryptionKey getSessionKey() {
return key;
}
@@ -262,6 +285,7 @@
return new KrbTgsReq(options,
this,
server,
+ serverAlias,
null, // from
null, // till
null, // rtime
@@ -484,7 +508,11 @@
public static void printDebug(Credentials c) {
System.out.println(">>> DEBUG: ----Credentials----");
System.out.println("\tclient: " + c.client.toString());
+ if (c.clientAlias != null)
+ System.out.println("\tclient alias: " + c.clientAlias.toString());
System.out.println("\tserver: " + c.server.toString());
+ if (c.serverAlias != null)
+ System.out.println("\tserver alias: " + c.serverAlias.toString());
System.out.println("\tticket: sname: " + c.ticket.sname.toString());
if (c.startTime != null) {
System.out.println("\tstartTime: " + c.startTime.getTime());
@@ -512,7 +540,11 @@
public String toString() {
StringBuilder sb = new StringBuilder("Credentials:");
sb.append( "\n client=").append(client);
+ if (clientAlias != null)
+ sb.append( "\n clientAlias=").append(clientAlias);
sb.append( "\n server=").append(server);
+ if (serverAlias != null)
+ sb.append( "\n serverAlias=").append(serverAlias);
if (authTime != null) {
sb.append("\n authTime=").append(authTime);
}
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/sun/security/krb5/JavaxSecurityAuthKerberosAccess.java
--- a/src/java.security.jgss/share/classes/sun/security/krb5/JavaxSecurityAuthKerberosAccess.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/sun/security/krb5/JavaxSecurityAuthKerberosAccess.java Tue Jul 23 11:17:59 2019 -0700
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2011, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,8 @@
package sun.security.krb5;
+import javax.security.auth.kerberos.KerberosPrincipal;
+import javax.security.auth.kerberos.KerberosTicket;
import javax.security.auth.kerberos.KeyTab;
import sun.security.krb5.EncryptionKey;
import sun.security.krb5.PrincipalName;
@@ -39,4 +41,12 @@
*/
public sun.security.krb5.internal.ktab.KeyTab keyTabTakeSnapshot(
KeyTab ktab);
+
+ public KerberosPrincipal kerberosTicketGetClientAlias(KerberosTicket t);
+
+ public void kerberosTicketSetClientAlias(KerberosTicket t, KerberosPrincipal a);
+
+ public KerberosPrincipal kerberosTicketGetServerAlias(KerberosTicket t);
+
+ public void kerberosTicketSetServerAlias(KerberosTicket t, KerberosPrincipal a);
}
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/sun/security/krb5/KrbApReq.java
--- a/src/java.security.jgss/share/classes/sun/security/krb5/KrbApReq.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/sun/security/krb5/KrbApReq.java Tue Jul 23 11:17:59 2019 -0700
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -363,7 +363,9 @@
creds = new Credentials(
apReqMessg.ticket,
authenticator.cname,
+ null,
apReqMessg.ticket.sname,
+ null,
enc_ticketPart.key,
enc_ticketPart.flags,
enc_ticketPart.authtime,
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/sun/security/krb5/KrbAsRep.java
--- a/src/java.security.jgss/share/classes/sun/security/krb5/KrbAsRep.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/sun/security/krb5/KrbAsRep.java Tue Jul 23 11:17:59 2019 -0700
@@ -118,7 +118,7 @@
"Cannot find key for type/kvno to decrypt AS REP - " +
EType.toString(encPartKeyType) + "/" + encPartKvno);
}
- decrypt(dkey, asReq);
+ decrypt(dkey, asReq, cname);
}
/**
@@ -136,7 +136,7 @@
password,
encPartKeyType,
PAData.getSaltAndParams(encPartKeyType, rep.pAData));
- decrypt(dkey, asReq);
+ decrypt(dkey, asReq, cname);
}
/**
@@ -144,7 +144,8 @@
* @param dkey the decryption key to use
* @param asReq the original AS-REQ sent, used to validate AS-REP
*/
- private void decrypt(EncryptionKey dkey, KrbAsReq asReq)
+ private void decrypt(EncryptionKey dkey, KrbAsReq asReq,
+ PrincipalName cname)
throws KrbException, Asn1Exception, IOException {
byte[] enc_as_rep_bytes = rep.encPart.decrypt(dkey,
KeyUsage.KU_ENC_AS_REP_PART);
@@ -157,10 +158,16 @@
ASReq req = asReq.getMessage();
check(true, req, rep, dkey);
+ PrincipalName clientAlias = cname;
+ if (clientAlias.equals(rep.cname))
+ clientAlias = null;
+
creds = new Credentials(
rep.ticket,
rep.cname,
+ clientAlias,
enc_part.sname,
+ null, // No server alias expected in a TGT
enc_part.key,
enc_part.flags,
enc_part.authtime,
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/sun/security/krb5/KrbAsReqBuilder.java
--- a/src/java.security.jgss/share/classes/sun/security/krb5/KrbAsReqBuilder.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/sun/security/krb5/KrbAsReqBuilder.java Tue Jul 23 11:17:59 2019 -0700
@@ -68,6 +68,7 @@
// Common data for AS-REQ fields
private KDCOptions options;
private PrincipalName cname;
+ private PrincipalName refCname; // May be changed by referrals
private PrincipalName sname;
private KerberosTime from;
private KerberosTime till;
@@ -100,6 +101,7 @@
private void init(PrincipalName cname)
throws KrbException {
this.cname = cname;
+ this.refCname = cname;
state = State.INIT;
}
@@ -284,7 +286,7 @@
}
return new KrbAsReq(key,
options,
- cname,
+ refCname,
sname,
from,
till,
@@ -334,7 +336,7 @@
ReferralsState referralsState = new ReferralsState();
while (true) {
if (referralsState.refreshComm()) {
- comm = new KdcComm(cname.getRealmAsString());
+ comm = new KdcComm(refCname.getRealmAsString());
}
try {
req = build(pakey, referralsState);
@@ -384,7 +386,7 @@
ReferralsState() throws KrbException {
if (Config.DISABLE_REFERRALS) {
- if (cname.getNameType() == PrincipalName.KRB_NT_ENTERPRISE) {
+ if (refCname.getNameType() == PrincipalName.KRB_NT_ENTERPRISE) {
throw new KrbException("NT-ENTERPRISE principals only allowed" +
" when referrals are enabled.");
}
@@ -402,15 +404,15 @@
if (req.getMessage().reqBody.kdcOptions.get(KDCOptions.CANONICALIZE) &&
referredRealm != null && referredRealm.toString().length() > 0 &&
count < Config.MAX_REFERRALS) {
- cname = new PrincipalName(cname.getNameType(),
- cname.getNameStrings(), referredRealm);
+ refCname = new PrincipalName(refCname.getNameType(),
+ refCname.getNameStrings(), referredRealm);
refreshComm = true;
count++;
return true;
}
}
if (count < Config.MAX_REFERRALS &&
- cname.getNameType() != PrincipalName.KRB_NT_ENTERPRISE) {
+ refCname.getNameType() != PrincipalName.KRB_NT_ENTERPRISE) {
// Server may raise an error if CANONICALIZE is true.
// Try CANONICALIZE false.
enabled = false;
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/sun/security/krb5/KrbCred.java
--- a/src/java.security.jgss/share/classes/sun/security/krb5/KrbCred.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/sun/security/krb5/KrbCred.java Tue Jul 23 11:17:59 2019 -0700
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -76,7 +76,7 @@
options.set(KDCOptions.FORWARDABLE, true);
KrbTgsReq tgsReq = new KrbTgsReq(options, tgt, tgService,
- null, null, null, null,
+ null, null, null, null, null,
null, // No easy way to get addresses right
null, null, null);
credMessg = createMessage(tgsReq.sendAndGetCreds(), key);
@@ -152,7 +152,7 @@
+ " endtime=" + endtime
+ "renewTill=" + renewTill);
}
- creds = new Credentials(ticket, pname, sname, credInfoKey,
+ creds = new Credentials(ticket, pname, null, sname, null, credInfoKey,
flags, authtime, starttime, endtime, renewTill, caddr);
}
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/sun/security/krb5/KrbTgsRep.java
--- a/src/java.security.jgss/share/classes/sun/security/krb5/KrbTgsRep.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/sun/security/krb5/KrbTgsRep.java Tue Jul 23 11:17:59 2019 -0700
@@ -86,9 +86,20 @@
check(false, req, rep, tgsReq.tgsReqKey);
+ PrincipalName serverAlias = tgsReq.getServerAlias();
+ if (serverAlias != null) {
+ PrincipalName repSname = enc_part.sname;
+ if (serverAlias.equals(repSname) ||
+ isReferralSname(repSname)) {
+ serverAlias = null;
+ }
+ }
+
this.creds = new Credentials(rep.ticket,
rep.cname,
+ tgsReq.getClientAlias(),
enc_part.sname,
+ serverAlias,
enc_part.key,
enc_part.flags,
enc_part.authtime,
@@ -111,4 +122,16 @@
sun.security.krb5.internal.ccache.Credentials setCredentials() {
return new sun.security.krb5.internal.ccache.Credentials(rep, secondTicket);
}
+
+ private static boolean isReferralSname(PrincipalName sname) {
+ if (sname != null) {
+ String[] snameStrings = sname.getNameStrings();
+ if (snameStrings.length == 2 &&
+ snameStrings[0].equals(
+ PrincipalName.TGS_DEFAULT_SRV_NAME)) {
+ return true;
+ }
+ }
+ return false;
+ }
}
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/sun/security/krb5/KrbTgsReq.java
--- a/src/java.security.jgss/share/classes/sun/security/krb5/KrbTgsReq.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/sun/security/krb5/KrbTgsReq.java Tue Jul 23 11:17:59 2019 -0700
@@ -45,7 +45,9 @@
public class KrbTgsReq {
private PrincipalName princName;
+ private PrincipalName clientAlias;
private PrincipalName servName;
+ private PrincipalName serverAlias;
private TGSReq tgsReqMessg;
private KerberosTime ctime;
private Ticket secondTicket = null;
@@ -59,13 +61,16 @@
// Used in CredentialsUtil
public KrbTgsReq(KDCOptions options, Credentials asCreds,
- PrincipalName cname, PrincipalName sname,
+ PrincipalName cname, PrincipalName clientAlias,
+ PrincipalName sname, PrincipalName serverAlias,
Ticket[] additionalTickets, PAData[] extraPAs)
throws KrbException, IOException {
this(options,
asCreds,
cname,
+ clientAlias,
sname,
+ serverAlias,
null, // KerberosTime from
null, // KerberosTime till
null, // KerberosTime rtime
@@ -82,6 +87,7 @@
KDCOptions options,
Credentials asCreds,
PrincipalName sname,
+ PrincipalName serverAlias,
KerberosTime from,
KerberosTime till,
KerberosTime rtime,
@@ -90,16 +96,18 @@
AuthorizationData authorizationData,
Ticket[] additionalTickets,
EncryptionKey subKey) throws KrbException, IOException {
- this(options, asCreds, asCreds.getClient(), sname,
- from, till, rtime, eTypes, addresses,
- authorizationData, additionalTickets, subKey, null);
+ this(options, asCreds, asCreds.getClient(), asCreds.getClientAlias(),
+ sname, serverAlias, from, till, rtime, eTypes,
+ addresses, authorizationData, additionalTickets, subKey, null);
}
private KrbTgsReq(
KDCOptions options,
Credentials asCreds,
PrincipalName cname,
+ PrincipalName clientAlias,
PrincipalName sname,
+ PrincipalName serverAlias,
KerberosTime from,
KerberosTime till,
KerberosTime rtime,
@@ -111,7 +119,9 @@
PAData[] extraPAs) throws KrbException, IOException {
princName = cname;
+ this.clientAlias = clientAlias;
servName = sname;
+ this.serverAlias = serverAlias;
ctime = KerberosTime.now();
// check if they are valid arguments. The optional fields
@@ -365,6 +375,14 @@
return secondTicket;
}
+ PrincipalName getClientAlias() {
+ return clientAlias;
+ }
+
+ PrincipalName getServerAlias() {
+ return serverAlias;
+ }
+
private static void debug(String message) {
// System.err.println(">>> KrbTgsReq: " + message);
}
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/sun/security/krb5/PrincipalName.java
--- a/src/java.security.jgss/share/classes/sun/security/krb5/PrincipalName.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/sun/security/krb5/PrincipalName.java Tue Jul 23 11:17:59 2019 -0700
@@ -564,7 +564,9 @@
for (int i = 0; i < nameStrings.length; i++) {
if (i > 0)
str.append("/");
- str.append(nameStrings[i]);
+ String n = nameStrings[i];
+ n = n.replace("@", "\\@");
+ str.append(n);
}
str.append("@");
str.append(nameRealm.toString());
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/sun/security/krb5/internal/CredentialsUtil.java
--- a/src/java.security.jgss/share/classes/sun/security/krb5/internal/CredentialsUtil.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/sun/security/krb5/internal/CredentialsUtil.java Tue Jul 23 11:17:59 2019 -0700
@@ -284,8 +284,9 @@
// Try CANONICALIZE false.
}
}
- return serviceCredsSingle(options, asCreds,
- cname, sname, additionalTickets, extraPAs);
+ return serviceCredsSingle(options, asCreds, cname,
+ asCreds.getClientAlias(), sname, sname, additionalTickets,
+ extraPAs);
}
/*
@@ -300,26 +301,29 @@
options = new KDCOptions(options.toBooleanArray());
options.set(KDCOptions.CANONICALIZE, true);
PrincipalName cSname = sname;
+ PrincipalName refSname = sname; // May change with referrals
Credentials creds = null;
boolean isReferral = false;
List referrals = new LinkedList<>();
+ PrincipalName clientAlias = asCreds.getClientAlias();
while (referrals.size() <= Config.MAX_REFERRALS) {
ReferralsCache.ReferralCacheEntry ref =
- ReferralsCache.get(sname, cSname.getRealmString());
+ ReferralsCache.get(cname, sname, refSname.getRealmString());
String toRealm = null;
if (ref == null) {
- creds = serviceCredsSingle(options, asCreds,
- cname, cSname, additionalTickets, extraPAs);
+ creds = serviceCredsSingle(options, asCreds, cname,
+ clientAlias, refSname, cSname, additionalTickets,
+ extraPAs);
PrincipalName server = creds.getServer();
- if (!cSname.equals(server)) {
+ if (!refSname.equals(server)) {
String[] serverNameStrings = server.getNameStrings();
if (serverNameStrings.length == 2 &&
serverNameStrings[0].equals(
PrincipalName.TGS_DEFAULT_SRV_NAME) &&
- !cSname.getRealmAsString().equals(serverNameStrings[1])) {
+ !refSname.getRealmAsString().equals(serverNameStrings[1])) {
// Server Name (sname) has the following format:
// krbtgt/TO-REALM.COM@FROM-REALM.COM
- ReferralsCache.put(sname, server.getRealmString(),
+ ReferralsCache.put(cname, sname, server.getRealmString(),
serverNameStrings[1], creds);
toRealm = serverNameStrings[1];
isReferral = true;
@@ -336,8 +340,8 @@
// Referrals loop detected
return null;
}
- cSname = new PrincipalName(cSname.getNameString(),
- cSname.getNameType(), toRealm);
+ refSname = new PrincipalName(refSname.getNameString(),
+ refSname.getNameType(), toRealm);
referrals.add(toRealm);
isReferral = false;
continue;
@@ -356,14 +360,15 @@
*/
private static Credentials serviceCredsSingle(
KDCOptions options, Credentials asCreds,
- PrincipalName cname, PrincipalName sname,
+ PrincipalName cname, PrincipalName clientAlias,
+ PrincipalName refSname, PrincipalName sname,
Ticket[] additionalTickets, PAData[] extraPAs)
throws KrbException, IOException {
Credentials theCreds = null;
boolean[] okAsDelegate = new boolean[]{true};
String[] serverAsCredsNames = asCreds.getServer().getNameStrings();
String tgtRealm = serverAsCredsNames[1];
- String serviceRealm = sname.getRealmString();
+ String serviceRealm = refSname.getRealmString();
if (!serviceRealm.equals(tgtRealm)) {
// This is a cross-realm service request
if (DEBUG) {
@@ -390,8 +395,8 @@
System.out.println(">>> Credentials serviceCredsSingle:" +
" same realm");
}
- KrbTgsReq req = new KrbTgsReq(options, asCreds,
- cname, sname, additionalTickets, extraPAs);
+ KrbTgsReq req = new KrbTgsReq(options, asCreds, cname, clientAlias,
+ refSname, sname, additionalTickets, extraPAs);
theCreds = req.sendAndGetCreds();
if (theCreds != null) {
if (DEBUG) {
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/sun/security/krb5/internal/KRBError.java
--- a/src/java.security.jgss/share/classes/sun/security/krb5/internal/KRBError.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/sun/security/krb5/internal/KRBError.java Tue Jul 23 11:17:59 2019 -0700
@@ -139,7 +139,7 @@
sTime = new_sTime;
suSec = new_suSec;
errorCode = new_errorCode;
- crealm = new_cname.getRealm();
+ crealm = new_cname != null ? new_cname.getRealm() : null;
cname = new_cname;
sname = new_sname;
eText = new_eText;
@@ -168,7 +168,7 @@
sTime = new_sTime;
suSec = new_suSec;
errorCode = new_errorCode;
- crealm = new_cname.getRealm();
+ crealm = new_cname != null ? new_cname.getRealm() : null;
cname = new_cname;
sname = new_sname;
eText = new_eText;
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/sun/security/krb5/internal/ReferralsCache.java
--- a/src/java.security.jgss/share/classes/sun/security/krb5/internal/ReferralsCache.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/sun/security/krb5/internal/ReferralsCache.java Tue Jul 23 11:17:59 2019 -0700
@@ -45,8 +45,27 @@
*/
final class ReferralsCache {
- private static Map> referralsMap =
- new HashMap<>();
+ private static Map>
+ referralsMap = new HashMap<>();
+
+ static private final class ReferralCacheKey {
+ private PrincipalName cname;
+ private PrincipalName sname;
+ ReferralCacheKey (PrincipalName cname, PrincipalName sname) {
+ this.cname = cname;
+ this.sname = sname;
+ }
+ public boolean equals(Object other) {
+ if (!(other instanceof ReferralCacheKey))
+ return false;
+ ReferralCacheKey that = (ReferralCacheKey)other;
+ return cname.equals(that.cname) &&
+ sname.equals(that.sname);
+ }
+ public int hashCode() {
+ return cname.hashCode() + sname.hashCode();
+ }
+ }
static final class ReferralCacheEntry {
private final Credentials creds;
@@ -64,8 +83,9 @@
}
/*
- * Add a new referral entry to the cache, including: service principal,
- * source KDC realm, destination KDC realm and referral TGT.
+ * Add a new referral entry to the cache, including: client principal,
+ * service principal, source KDC realm, destination KDC realm and
+ * referral TGT.
*
* If a loop is generated when adding the new referral, the first hop is
* automatically removed. For example, let's assume that adding a
@@ -73,16 +93,17 @@
* REALM-1.COM -> REALM-2.COM -> REALM-3.COM -> REALM-1.COM. Then,
* REALM-1.COM -> REALM-2.COM referral entry is removed from the cache.
*/
- static synchronized void put(PrincipalName service,
+ static synchronized void put(PrincipalName cname, PrincipalName service,
String fromRealm, String toRealm, Credentials creds) {
- pruneExpired(service);
+ ReferralCacheKey k = new ReferralCacheKey(cname, service);
+ pruneExpired(k);
if (creds.getEndTime().before(new Date())) {
return;
}
- Map entries = referralsMap.get(service);
+ Map entries = referralsMap.get(k);
if (entries == null) {
entries = new HashMap();
- referralsMap.put(service, entries);
+ referralsMap.put(k, entries);
}
entries.remove(fromRealm);
ReferralCacheEntry newEntry = new ReferralCacheEntry(creds, toRealm);
@@ -103,13 +124,14 @@
}
/*
- * Obtain a referral entry from the cache given a service principal and a
- * source KDC realm.
+ * Obtain a referral entry from the cache given a client principal,
+ * service principal and a source KDC realm.
*/
- static synchronized ReferralCacheEntry get(PrincipalName service,
- String fromRealm) {
- pruneExpired(service);
- Map entries = referralsMap.get(service);
+ static synchronized ReferralCacheEntry get(PrincipalName cname,
+ PrincipalName service, String fromRealm) {
+ ReferralCacheKey k = new ReferralCacheKey(cname, service);
+ pruneExpired(k);
+ Map entries = referralsMap.get(k);
if (entries != null) {
ReferralCacheEntry toRef = entries.get(fromRealm);
if (toRef != null) {
@@ -122,9 +144,9 @@
/*
* Remove referral entries from the cache when referral TGTs expire.
*/
- private static void pruneExpired(PrincipalName service) {
+ private static void pruneExpired(ReferralCacheKey k) {
Date now = new Date();
- Map entries = referralsMap.get(service);
+ Map entries = referralsMap.get(k);
if (entries != null) {
for (Entry mapEntry :
entries.entrySet()) {
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/share/classes/sun/security/krb5/internal/ccache/Credentials.java
--- a/src/java.security.jgss/share/classes/sun/security/krb5/internal/ccache/Credentials.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/share/classes/sun/security/krb5/internal/ccache/Credentials.java Tue Jul 23 11:17:59 2019 -0700
@@ -180,8 +180,9 @@
// is most likely to be the one in Authenticator in PA-TGS-REQ encoded
// in TGS-REQ, therefore only stored with a service ticket. Currently
// in Java, we only reads TGTs.
- return new sun.security.krb5.Credentials(ticket,
- cname, sname, key, flags, authtime, starttime, endtime, renewTill, caddr);
+ return new sun.security.krb5.Credentials(ticket, cname, null, sname,
+ null, key, flags, authtime, starttime, endtime, renewTill,
+ caddr);
}
public KerberosTime getStartTime() {
diff -r aaa83519e723 -r 0e2453f75881 src/java.security.jgss/windows/native/libw2k_lsa_auth/NativeCreds.c
--- a/src/java.security.jgss/windows/native/libw2k_lsa_auth/NativeCreds.c Fri Jul 19 11:09:41 2019 +0200
+++ b/src/java.security.jgss/windows/native/libw2k_lsa_auth/NativeCreds.c Tue Jul 23 11:17:59 2019 -0700
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -406,6 +406,8 @@
"(Lsun/security/krb5/internal/Ticket;"
"Lsun/security/krb5/PrincipalName;"
"Lsun/security/krb5/PrincipalName;"
+ "Lsun/security/krb5/PrincipalName;"
+ "Lsun/security/krb5/PrincipalName;"
"Lsun/security/krb5/EncryptionKey;"
"Lsun/security/krb5/internal/TicketFlags;"
"Lsun/security/krb5/internal/KerberosTime;"
@@ -667,7 +669,9 @@
krbcredsConstructor,
ticket,
clientPrincipal,
+ NULL,
targetPrincipal,
+ NULL,
encryptionKey,
ticketFlags,
authTime, // mdu
diff -r aaa83519e723 -r 0e2453f75881 src/jdk.jartool/share/classes/jdk/security/jarsigner/JarSigner.java
--- a/src/jdk.jartool/share/classes/jdk/security/jarsigner/JarSigner.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/jdk.jartool/share/classes/jdk/security/jarsigner/JarSigner.java Tue Jul 23 11:17:59 2019 -0700
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2015, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2015, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -671,26 +671,18 @@
throw new AssertionError(asae);
}
- PrintStream ps = new PrintStream(os);
- ZipOutputStream zos = new ZipOutputStream(ps);
+ ZipOutputStream zos = new ZipOutputStream(os);
Manifest manifest = new Manifest();
- Map mfEntries = manifest.getEntries();
-
- // The Attributes of manifest before updating
- Attributes oldAttr = null;
-
- boolean mfModified = false;
- boolean mfCreated = false;
byte[] mfRawBytes = null;
// Check if manifest exists
- ZipEntry mfFile;
- if ((mfFile = getManifestFile(zipFile)) != null) {
+ ZipEntry mfFile = getManifestFile(zipFile);
+ boolean mfCreated = mfFile == null;
+ if (!mfCreated) {
// Manifest exists. Read its raw bytes.
mfRawBytes = zipFile.getInputStream(mfFile).readAllBytes();
manifest.read(new ByteArrayInputStream(mfRawBytes));
- oldAttr = (Attributes) (manifest.getMainAttributes().clone());
} else {
// Create new manifest
Attributes mattr = manifest.getMainAttributes();
@@ -701,7 +693,6 @@
mattr.putValue("Created-By", jdkVersion + " (" + javaVendor
+ ")");
mfFile = new ZipEntry(JarFile.MANIFEST_NAME);
- mfCreated = true;
}
/*
@@ -728,8 +719,12 @@
// out first
mfFiles.addElement(ze);
- if (SignatureFileVerifier.isBlockOrSF(
- ze.getName().toUpperCase(Locale.ENGLISH))) {
+ String zeNameUp = ze.getName().toUpperCase(Locale.ENGLISH);
+ if (SignatureFileVerifier.isBlockOrSF(zeNameUp)
+ // no need to preserve binary manifest portions
+ // if the only existing signature will be replaced
+ && !zeNameUp.startsWith(SignatureFile
+ .getBaseSignatureFilesName(signerName))) {
wasSigned = true;
}
@@ -742,55 +737,69 @@
if (manifest.getAttributes(ze.getName()) != null) {
// jar entry is contained in manifest, check and
// possibly update its digest attributes
- if (updateDigests(ze, zipFile, digests,
- manifest)) {
- mfModified = true;
- }
+ updateDigests(ze, zipFile, digests, manifest);
} else if (!ze.isDirectory()) {
// Add entry to manifest
Attributes attrs = getDigestAttributes(ze, zipFile, digests);
- mfEntries.put(ze.getName(), attrs);
- mfModified = true;
+ manifest.getEntries().put(ze.getName(), attrs);
}
}
- // Recalculate the manifest raw bytes if necessary
- if (mfModified) {
- ByteArrayOutputStream baos = new ByteArrayOutputStream();
+ /*
+ * Note:
+ *
+ * The Attributes object is based on HashMap and can handle
+ * continuation lines. Therefore, even if the contents are not changed
+ * (in a Map view), the bytes that it write() may be different from
+ * the original bytes that it read() from. Since the signature is
+ * based on raw bytes, we must retain the exact bytes.
+ */
+ boolean mfModified;
+ ByteArrayOutputStream baos = new ByteArrayOutputStream();
+ if (mfCreated || !wasSigned) {
+ mfModified = true;
manifest.write(baos);
- if (wasSigned) {
- byte[] newBytes = baos.toByteArray();
- if (mfRawBytes != null
- && oldAttr.equals(manifest.getMainAttributes())) {
+ mfRawBytes = baos.toByteArray();
+ } else {
- /*
- * Note:
- *
- * The Attributes object is based on HashMap and can handle
- * continuation columns. Therefore, even if the contents are
- * not changed (in a Map view), the bytes that it write()
- * may be different from the original bytes that it read()
- * from. Since the signature on the main attributes is based
- * on raw bytes, we must retain the exact bytes.
- */
+ // the manifest before updating
+ Manifest oldManifest = new Manifest(
+ new ByteArrayInputStream(mfRawBytes));
+ mfModified = !oldManifest.equals(manifest);
+ if (!mfModified) {
+ // leave whole manifest (mfRawBytes) unmodified
+ } else {
+ // reproduce the manifest raw bytes for unmodified sections
+ manifest.write(baos);
+ byte[] mfNewRawBytes = baos.toByteArray();
+ baos.reset();
+
+ ManifestDigester oldMd = new ManifestDigester(mfRawBytes);
+ ManifestDigester newMd = new ManifestDigester(mfNewRawBytes);
- int newPos = findHeaderEnd(newBytes);
- int oldPos = findHeaderEnd(mfRawBytes);
+ // main attributes
+ if (manifest.getMainAttributes().equals(
+ oldManifest.getMainAttributes())
+ && (manifest.getEntries().isEmpty() ||
+ oldMd.getMainAttsEntry().isProperlyDelimited())) {
+ oldMd.getMainAttsEntry().reproduceRaw(baos);
+ } else {
+ newMd.getMainAttsEntry().reproduceRaw(baos);
+ }
- if (newPos == oldPos) {
- System.arraycopy(mfRawBytes, 0, newBytes, 0, oldPos);
+ // individual sections
+ for (Map.Entry entry :
+ manifest.getEntries().entrySet()) {
+ String sectionName = entry.getKey();
+ Attributes entryAtts = entry.getValue();
+ if (entryAtts.equals(oldManifest.getAttributes(sectionName))
+ && oldMd.get(sectionName).isProperlyDelimited()) {
+ oldMd.get(sectionName).reproduceRaw(baos);
} else {
- // cat oldHead newTail > newBytes
- byte[] lastBytes = new byte[oldPos +
- newBytes.length - newPos];
- System.arraycopy(mfRawBytes, 0, lastBytes, 0, oldPos);
- System.arraycopy(newBytes, newPos, lastBytes, oldPos,
- newBytes.length - newPos);
- newBytes = lastBytes;
+ newMd.get(sectionName).reproduceRaw(baos);
}
}
- mfRawBytes = newBytes;
- } else {
+
mfRawBytes = baos.toByteArray();
}
}
@@ -801,13 +810,12 @@
mfFile = new ZipEntry(JarFile.MANIFEST_NAME);
}
if (handler != null) {
- if (mfCreated) {
+ if (mfCreated || !mfModified) {
handler.accept("adding", mfFile.getName());
- } else if (mfModified) {
+ } else {
handler.accept("updating", mfFile.getName());
}
}
-
zos.putNextEntry(mfFile);
zos.write(mfRawBytes);
@@ -826,9 +834,8 @@
}
signer.initSign(privateKey);
- ByteArrayOutputStream baos = new ByteArrayOutputStream();
+ baos.reset();
sf.write(baos);
-
byte[] content = baos.toByteArray();
signer.update(content);
@@ -889,6 +896,14 @@
if (!ze.getName().equalsIgnoreCase(JarFile.MANIFEST_NAME)
&& !ze.getName().equalsIgnoreCase(sfFilename)
&& !ze.getName().equalsIgnoreCase(bkFilename)) {
+ if (ze.getName().startsWith(SignatureFile
+ .getBaseSignatureFilesName(signerName))
+ && SignatureFileVerifier.isBlockOrSF(ze.getName())) {
+ if (handler != null) {
+ handler.accept("updating", ze.getName());
+ }
+ continue;
+ }
if (handler != null) {
if (manifest.getAttributes(ze.getName()) != null) {
handler.accept("signing", ze.getName());
@@ -942,11 +957,9 @@
}
}
- private boolean updateDigests(ZipEntry ze, ZipFile zf,
+ private void updateDigests(ZipEntry ze, ZipFile zf,
MessageDigest[] digests,
Manifest mf) throws IOException {
- boolean update = false;
-
Attributes attrs = mf.getAttributes(ze.getName());
String[] base64Digests = getDigests(ze, zf, digests);
@@ -976,19 +989,9 @@
if (name == null) {
name = digests[i].getAlgorithm() + "-Digest";
- attrs.putValue(name, base64Digests[i]);
- update = true;
- } else {
- // compare digests, and replace the one in the manifest
- // if they are different
- String mfDigest = attrs.getValue(name);
- if (!mfDigest.equalsIgnoreCase(base64Digests[i])) {
- attrs.putValue(name, base64Digests[i]);
- update = true;
- }
}
+ attrs.putValue(name, base64Digests[i]);
}
- return update;
}
private Attributes getDigestAttributes(
@@ -1051,30 +1054,6 @@
return base64Digests;
}
- @SuppressWarnings("fallthrough")
- private int findHeaderEnd(byte[] bs) {
- // Initial state true to deal with empty header
- boolean newline = true; // just met a newline
- int len = bs.length;
- for (int i = 0; i < len; i++) {
- switch (bs[i]) {
- case '\r':
- if (i < len - 1 && bs[i + 1] == '\n') i++;
- // fallthrough
- case '\n':
- if (newline) return i + 1; //+1 to get length
- newline = true;
- break;
- default:
- newline = false;
- }
- }
- // If header end is not found, it means the MANIFEST.MF has only
- // the main attributes section and it does not end with 2 newlines.
- // Returns the whole length so that it can be completely replaced.
- return len;
- }
-
/*
* Try to load the specified signing mechanism.
* The URL class loader is used.
@@ -1145,14 +1124,12 @@
}
// create digest of the manifest main attributes
- ManifestDigester.Entry mde =
- md.get(ManifestDigester.MF_MAIN_ATTRS, false);
+ ManifestDigester.Entry mde = md.getMainAttsEntry(false);
if (mde != null) {
- for (MessageDigest digest: digests) {
- mattr.putValue(digest.getAlgorithm() +
- "-Digest-" + ManifestDigester.MF_MAIN_ATTRS,
- Base64.getEncoder().encodeToString(
- mde.digest(digest)));
+ for (MessageDigest digest : digests) {
+ mattr.putValue(digest.getAlgorithm() + "-Digest-" +
+ ManifestDigester.MF_MAIN_ATTRS,
+ Base64.getEncoder().encodeToString(mde.digest(digest)));
}
} else {
throw new IllegalStateException
@@ -1181,15 +1158,19 @@
sf.write(out);
}
+ private static String getBaseSignatureFilesName(String baseName) {
+ return "META-INF/" + baseName + ".";
+ }
+
// get .SF file name
public String getMetaName() {
- return "META-INF/" + baseName + ".SF";
+ return getBaseSignatureFilesName(baseName) + "SF";
}
// get .DSA (or .DSA, .EC) file name
public String getBlockName(PrivateKey privateKey) {
String keyAlgorithm = privateKey.getAlgorithm();
- return "META-INF/" + baseName + "." + keyAlgorithm;
+ return getBaseSignatureFilesName(baseName) + keyAlgorithm;
}
// Generates the PKCS#7 content of block file
diff -r aaa83519e723 -r 0e2453f75881 src/jdk.jartool/share/classes/sun/tools/jar/Main.java
--- a/src/jdk.jartool/share/classes/sun/tools/jar/Main.java Fri Jul 19 11:09:41 2019 +0200
+++ b/src/jdk.jartool/share/classes/sun/tools/jar/Main.java Tue Jul 23 11:17:59 2019 -0700
@@ -944,11 +944,10 @@
// Don't read from the newManifest InputStream, as we
// might need it below, and we can't re-read the same data
// twice.
- FileInputStream fis = new FileInputStream(mname);
- boolean ambiguous = isAmbiguousMainClass(new Manifest(fis));
- fis.close();
- if (ambiguous) {
- return false;
+ try (FileInputStream fis = new FileInputStream(mname)) {
+ if (isAmbiguousMainClass(new Manifest(fis))) {
+ return false;
+ }
}
}
// Update the manifest.
diff -r aaa83519e723 -r 0e2453f75881 src/jdk.javadoc/share/legal/pako.md
--- a/src/jdk.javadoc/share/legal/pako.md Fri Jul 19 11:09:41 2019 +0200
+++ /dev/null Thu Jan 01 00:00:00 1970 +0000
@@ -1,45 +0,0 @@
-## Pako v1.0
-
-### Pako License
-
-Copyright (C) 2014-2017 by Vitaly Puzrin and Andrei Tuputcyn
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-(C) 1995-2013 Jean-loup Gailly and Mark Adler
-(C) 2014-2017 Vitaly Puzrin and Andrey Tupitsin
-
-This software is provided 'as-is', without any express or implied
-warranty. In no event will the authors be held liable for any damages
-arising from the use of this software.
-
-Permission is granted to anyone to use this software for any purpose,
-including commercial applications, and to alter it and redistribute it
-freely, subject to the following restrictions:
-
-1. The origin of this software must not be misrepresented; you must not
-claim that you wrote the original software. If you use this software
-in a product, an acknowledgment in the product documentation would be
-appreciated but is not required.
-2. Altered source versions must be plainly marked as such, and must not be
- misrepresented as being the original software.
-3. This notice may not be removed or altered from any source distribution.
-
-
-
-
diff -r aaa83519e723 -r 0e2453f75881 test/hotspot/jtreg/runtime/appcds/SharedArchiveConsistency.java
--- a/test/hotspot/jtreg/runtime/appcds/SharedArchiveConsistency.java Fri Jul 19 11:09:41 2019 +0200
+++ b/test/hotspot/jtreg/runtime/appcds/SharedArchiveConsistency.java Tue Jul 23 11:17:59 2019 -0700
@@ -163,7 +163,6 @@
public static void writeData(FileChannel fc, long offset, ByteBuffer bb) throws Exception {
fc.position(offset);
fc.write(bb);
- fc.force(true);
}
public static FileChannel getFileChannel(File jsaFile) throws Exception {
@@ -247,7 +246,6 @@
bbuf.clear();
bytes_written += 4096;
}
- fc.force(true);
if (fc.isOpen()) {
fc.close();
}
diff -r aaa83519e723 -r 0e2453f75881 test/jdk/ProblemList.txt
--- a/test/jdk/ProblemList.txt Fri Jul 19 11:09:41 2019 +0200
+++ b/test/jdk/ProblemList.txt Tue Jul 23 11:17:59 2019 -0700
@@ -655,13 +655,13 @@
sun/security/pkcs11/ec/TestKeyFactory.java 8026976 generic-all
sun/security/pkcs11/Secmod/AddTrustedCert.java 8180837 generic-all
sun/security/pkcs11/tls/TestKeyMaterial.java 8180837 generic-all
-sun/security/pkcs11/tls/tls12/FipsModeTLS12.java 8224954,8225678 windows-all,linux-all
sun/security/pkcs11/sslecc/ClientJSSEServerJSSE.java 8161536 generic-all
sun/security/tools/keytool/ListKeychainStore.sh 8156889 macosx-all
sun/security/tools/keytool/KeyToolTest.java 8224644 solaris-all
sun/security/tools/keytool/WeakAlg.java 8224644 solaris-all
+sun/security/tools/jarsigner/compatibility/SignTwice.java 8228341 windows-all
sun/security/tools/jarsigner/warnings/BadKeyUsageTest.java 8026393 generic-all
javax/net/ssl/ServerName/SSLEngineExplorerMatchedSNI.java 8212096 generic-all
@@ -676,6 +676,28 @@
security/infra/java/security/cert/CertPathValidator/certification/ActalisCA.java 8224768 generic-all
+sun/security/smartcardio/TestChannel.java 8039280 generic-all
+sun/security/smartcardio/TestConnect.java 8039280 generic-all
+sun/security/smartcardio/TestConnectAgain.java 8039280 generic-all
+sun/security/smartcardio/TestControl.java 8039280 generic-all
+sun/security/smartcardio/TestDefault.java 8039280 generic-all
+sun/security/smartcardio/TestDirect.java 8039280 generic-all
+sun/security/smartcardio/TestExclusive.java 8039280 generic-all
+sun/security/smartcardio/TestMultiplePresent.java 8039280 generic-all
+sun/security/smartcardio/TestPresent.java 8039280 generic-all
+sun/security/smartcardio/TestTransmit.java 8039280 generic-all
+com/sun/crypto/provider/Cipher/DES/PerformanceTest.java 8039280 generic-all
+com/sun/security/auth/callback/TextCallbackHandler/Default.java 8039280 generic-all
+com/sun/security/auth/callback/TextCallbackHandler/Password.java 8039280 generic-all
+com/sun/security/sasl/gsskerb/AuthOnly.java 8039280 generic-all
+com/sun/security/sasl/gsskerb/ConfSecurityLayer.java 8039280 generic-all
+com/sun/security/sasl/gsskerb/NoSecurityLayer.java 8039280 generic-all
+javax/security/auth/kerberos/KerberosHashEqualsTest.java 8039280 generic-all
+javax/security/auth/kerberos/KerberosTixDateTest.java 8039280 generic-all
+sun/security/provider/PolicyFile/GrantAllPermToExtWhenNoPolicy.java 8039280 generic-all
+sun/security/provider/PolicyParser/ExtDirsChange.java 8039280 generic-all
+sun/security/provider/PolicyParser/PrincipalExpansionError.java 8039280 generic-all
+
############################################################################
# jdk_sound
diff -r aaa83519e723 -r 0e2453f75881 test/jdk/sun/management/jmxremote/bootstrap/JMXInterfaceBindingTest.java
--- a/test/jdk/sun/management/jmxremote/bootstrap/JMXInterfaceBindingTest.java Fri Jul 19 11:09:41 2019 +0200
+++ b/test/jdk/sun/management/jmxremote/bootstrap/JMXInterfaceBindingTest.java Tue Jul 23 11:17:59 2019 -0700
@@ -22,23 +22,21 @@
*/
import java.io.File;
+import java.io.PrintWriter;
import java.net.InetAddress;
-import java.net.NetworkInterface;
import java.net.UnknownHostException;
-import java.net.SocketException;
import java.util.ArrayList;
import java.util.List;
-import java.util.stream.Collectors;
+import java.util.concurrent.CountDownLatch;
-import jdk.test.lib.thread.ProcessThread;
+import jdk.test.lib.process.OutputAnalyzer;
import jdk.test.lib.process.ProcessTools;
/**
* @test
* @bug 6425769
* @summary Test JMX agent host address binding. Same ports but different
- * interfaces to bind to (selecting plain or SSL sockets at random
- * @key intermittent
+ * interfaces to bind to (selecting plain or SSL sockets at random)
*
* @library /test/lib
* @modules java.management.rmi
@@ -52,14 +50,9 @@
public static final int STOP_PROCESS_EXIT_VAL = 10;
public static final int JMX_PORT_RANGE_LOWER = 9100;
public static final int JMX_PORT_RANGE_UPPER = 9200;
- public static final int JMX_PORT = getRandomPortInRange(JMX_PORT_RANGE_LOWER,
- JMX_PORT_RANGE_UPPER);
public static final int JMX_PORT_RANGE_LOWER_SSL = 9201; // 9200 might be RMI Port
public static final int JMX_PORT_RANGE_UPPER_SSL = 9300;
- public static final int JMX_PORT_SSL = getRandomPortInRange(JMX_PORT_RANGE_LOWER_SSL,
- JMX_PORT_RANGE_UPPER_SSL);
- public static final int RMI_PORT = JMX_PORT + 1;
- public static final int RMI_PORT_SSL = JMX_PORT_SSL + 1;
+ private static final int MAX_RETRY_ATTEMTS = 10;
public static final String READY_MSG = "MainThread: Ready for connections";
public static final String TEST_CLASS = JMXAgentInterfaceBinding.class.getSimpleName();
public static final String KEYSTORE_LOC = System.getProperty("test.src", ".") +
@@ -82,98 +75,25 @@
}
private void runTests(List addrs, boolean useSSL) {
- List jvms = new ArrayList<>(addrs.size());
- int i = 1;
+ List testThreads = new ArrayList<>(addrs.size());
+ CountDownLatch latch = new CountDownLatch(addrs.size());
for (InetAddress addr : addrs) {
String address = JMXAgentInterfaceBinding.wrapAddress(addr.getHostAddress());
- System.out.println();
- String msg = String.format("DEBUG: Launching java tester for triplet (HOSTNAME,JMX_PORT,RMI_PORT) == (%s,%d,%d)",
- address,
- useSSL ? JMX_PORT_SSL : JMX_PORT,
- useSSL ? RMI_PORT_SSL : RMI_PORT);
- System.out.println(msg);
- ProcessThread jvm = runJMXBindingTest(address, useSSL);
- jvms.add(jvm);
- jvm.start();
- System.out.println("DEBUG: Started " + (i++) + " Process(es).");
- }
- int failedProcesses = 0;
- for (ProcessThread pt: jvms) {
- try {
- pt.sendMessage("Exit: " + STOP_PROCESS_EXIT_VAL);
- pt.join();
- } catch (Throwable e) {
- System.err.println("Failed to stop process: " + pt.getName());
- throw new RuntimeException("Test failed", e);
- }
- int exitValue = pt.getOutput().getExitValue();
- // If there is a communication error (the case we care about)
- // we get a exit code of 1
- if (exitValue == COMMUNICATION_ERROR_EXIT_VAL) {
- // Failure case since the java processes should still be
- // running.
- System.err.println("Test FAILURE on " + pt.getName());
- failedProcesses++;
- } else if (exitValue == STOP_PROCESS_EXIT_VAL) {
- System.out.println("DEBUG: OK. Spawned java process terminated with expected exit code of " + STOP_PROCESS_EXIT_VAL);
- } else {
- System.err.println("Test FAILURE on " + pt.getName() + " reason: Unexpected exit code => " + exitValue);
- failedProcesses++;
- }
+ TestProcessThread t = new TestProcessThread(address, useSSL, latch);
+ testThreads.add(t);
+ t.start();
}
- if (failedProcesses > 0) {
- throw new RuntimeException("Test FAILED. " + failedProcesses + " out of " + addrs.size() + " process(es) failed to start the JMX agent.");
- }
- }
-
- private ProcessThread runJMXBindingTest(String address, boolean useSSL) {
- List args = new ArrayList<>();
- args.add("-classpath");
- args.add(TEST_CLASSPATH);
- args.add("-Dcom.sun.management.jmxremote.host=" + address);
- args.add("-Dcom.sun.management.jmxremote.port=" + (useSSL ? JMX_PORT_SSL : JMX_PORT));
- args.add("-Dcom.sun.management.jmxremote.rmi.port=" + (useSSL ? RMI_PORT_SSL : RMI_PORT));
- args.add("-Dcom.sun.management.jmxremote.authenticate=false");
- args.add("-Dcom.sun.management.jmxremote.ssl=" + Boolean.toString(useSSL));
- // This is needed for testing on loopback
- args.add("-Djava.rmi.server.hostname=" + address);
- if (useSSL) {
- args.add("-Dcom.sun.management.jmxremote.registry.ssl=true");
- args.add("-Djavax.net.ssl.keyStore=" + KEYSTORE_LOC);
- args.add("-Djavax.net.ssl.trustStore=" + TRUSTSTORE_LOC);
- args.add("-Djavax.net.ssl.keyStorePassword=password");
- args.add("-Djavax.net.ssl.trustStorePassword=trustword");
- }
- args.add(TEST_CLASS);
- args.add(address);
- args.add(Integer.toString(useSSL ? JMX_PORT_SSL : JMX_PORT));
- args.add(Integer.toString(useSSL ? RMI_PORT_SSL : RMI_PORT));
- args.add(Boolean.toString(useSSL));
try {
- ProcessBuilder builder = ProcessTools.createJavaProcessBuilder(args.toArray(new String[] {}));
- System.out.println(ProcessTools.getCommandLine(builder));
- ProcessThread jvm = new ProcessThread("JMX-Tester-" + address, JMXInterfaceBindingTest::isJMXAgentResponseAvailable, builder);
- return jvm;
- } catch (Exception e) {
+ latch.await();
+ } catch (InterruptedException e) {
+ System.err.println("Failed to wait for the test threads to complete");
throw new RuntimeException("Test failed", e);
}
- }
-
- private static boolean isJMXAgentResponseAvailable(String line) {
- if (line.equals(READY_MSG)) {
- System.out.println("DEBUG: Found expected READY_MSG.");
- return true;
- } else if (line.startsWith("Error:")) {
- // Allow for a JVM process that exits with
- // "Error: JMX connector server communication error: ..."
- // to continue as well since we handle that case elsewhere.
- // This has the effect that the test does not timeout and
- // fails with an exception in the test.
- System.err.println("PROBLEM: JMX agent of target JVM did not start as it should.");
- return true;
- } else {
- return false;
+ long failedProcesses = testThreads.stream().filter(TestProcessThread::isTestFailed).count();
+ if (failedProcesses > 0) {
+ throw new RuntimeException("Test FAILED. " + failedProcesses + " out of " + addrs.size() +
+ " process(es) failed to start the JMX agent.");
}
}
@@ -215,4 +135,128 @@
throw new RuntimeException("Test failed", e);
}
}
+
+ private static class TestProcessThread extends Thread {
+ private final String name;
+ private final String address;
+ private final boolean useSSL;
+ private final CountDownLatch latch;
+ private volatile boolean testFailed = false;
+ private OutputAnalyzer output;
+
+ public TestProcessThread(String address, boolean useSSL, CountDownLatch latch) {
+ this.address = address;
+ this.useSSL = useSSL;
+ this.name = "JMX-Tester-" + address;
+ this.latch = latch;
+ }
+
+ @Override
+ public void run() {
+ int attempts = 0;
+ boolean needRetry = false;
+ do {
+ if (needRetry) {
+ System.err.println("Retrying the test for " + name);
+ }
+ needRetry = runTest();
+ } while (needRetry && (attempts++ < MAX_RETRY_ATTEMTS));
+
+ if (testFailed) {
+ int exitValue = output.getExitValue();
+ if (needRetry) {
+ System.err.println("Test FAILURE on " + name + " reason: run out of retries to to pick free ports");
+ } else if (exitValue == COMMUNICATION_ERROR_EXIT_VAL) {
+ // Failure case since the java processes should still be
+ // running.
+ System.err.println("Test FAILURE on " + name);
+ } else if (exitValue == STOP_PROCESS_EXIT_VAL) {
+ System.out.println("Test FAILURE on " + name + " reason: The expected line \"" + READY_MSG
+ + "\" is not present in the process output");
+ } else {
+ System.err.println("Test FAILURE on " + name + " reason: Unexpected exit code => " + exitValue);
+ }
+ output.reportDiagnosticSummary();
+ }
+ latch.countDown();
+ }
+
+ public boolean isTestFailed() {
+ return testFailed;
+ }
+
+ private int getJMXPort() {
+ return useSSL ?
+ getRandomPortInRange(JMX_PORT_RANGE_LOWER_SSL, JMX_PORT_RANGE_UPPER_SSL) :
+ getRandomPortInRange(JMX_PORT_RANGE_LOWER, JMX_PORT_RANGE_UPPER);
+ }
+
+ private Process createTestProcess() {
+ int jmxPort = getJMXPort();
+ int rmiPort = jmxPort + 1;
+ String msg = String.format("DEBUG: Launching java tester for triplet (HOSTNAME,JMX_PORT,RMI_PORT)" +
+ " == (%s,%d,%d)", address, jmxPort, rmiPort);
+ System.out.println(msg);
+ List args = new ArrayList<>();
+ args.add("-classpath");
+ args.add(TEST_CLASSPATH);
+ args.add("-Dcom.sun.management.jmxremote.host=" + address);
+ args.add("-Dcom.sun.management.jmxremote.port=" + jmxPort);
+ args.add("-Dcom.sun.management.jmxremote.rmi.port=" + rmiPort);
+ args.add("-Dcom.sun.management.jmxremote.authenticate=false");
+ args.add("-Dcom.sun.management.jmxremote.ssl=" + Boolean.toString(useSSL));
+ // This is needed for testing on loopback
+ args.add("-Djava.rmi.server.hostname=" + address);
+ if (useSSL) {
+ args.add("-Dcom.sun.management.jmxremote.registry.ssl=true");
+ args.add("-Djavax.net.ssl.keyStore=" + KEYSTORE_LOC);
+ args.add("-Djavax.net.ssl.trustStore=" + TRUSTSTORE_LOC);
+ args.add("-Djavax.net.ssl.keyStorePassword=password");
+ args.add("-Djavax.net.ssl.trustStorePassword=trustword");
+ }
+ args.add(TEST_CLASS);
+ args.add(address);
+ args.add(Integer.toString(jmxPort));
+ args.add(Integer.toString(rmiPort));
+ args.add(Boolean.toString(useSSL));
+
+ try {
+ ProcessBuilder builder = ProcessTools.createJavaProcessBuilder(args.toArray(new String[]{}));
+ System.out.println(ProcessTools.getCommandLine(builder));
+ Process process = builder.start();
+ output = new OutputAnalyzer(process);
+ return process;
+ } catch (Exception e) {
+ throw new RuntimeException("Test failed", e);
+ }
+ }
+
+ // Returns true if the test failed due to "Port already in use" error.
+ private boolean runTest() {
+ testFailed = true;
+ Process process = createTestProcess();
+ try {
+ sendMessageToProcess(process, "Exit: " + STOP_PROCESS_EXIT_VAL);
+ process.waitFor();
+ } catch (Throwable e) {
+ System.err.println("Failed to stop process: " + name);
+ throw new RuntimeException("Test failed", e);
+ }
+ if (output.getExitValue() == STOP_PROCESS_EXIT_VAL && output.getStdout().contains(READY_MSG)) {
+ testFailed = false;
+ } else if (output.getStderr().contains("Port already in use")) {
+ System.out.println("The test attempt for the test " + name +" failed due to the bind error");
+ // Need to retry
+ return true;
+ }
+ return false;
+ }
+
+ private static void sendMessageToProcess(Process process, String message) {
+ try (PrintWriter pw = new PrintWriter(process.getOutputStream())) {
+ pw.println(message);
+ pw.flush();
+ }
+ }
+ }
}
diff -r aaa83519e723 -r 0e2453f75881 test/jdk/sun/security/krb5/auto/KDC.java
--- a/test/jdk/sun/security/krb5/auto/KDC.java Fri Jul 19 11:09:41 2019 +0200
+++ b/test/jdk/sun/security/krb5/auto/KDC.java Tue Jul 23 11:17:59 2019 -0700
@@ -808,8 +808,10 @@
PrincipalName cname = null;
boolean allowForwardable = true;
-
+ boolean isReferral = false;
if (body.kdcOptions.get(KDCOptions.CANONICALIZE)) {
+ System.out.println(realm + "> verifying referral for " +
+ body.sname.getNameString());
KDC referral = aliasReferrals.get(body.sname.getNameString());
if (referral != null) {
service = new PrincipalName(
@@ -817,6 +819,9 @@
PrincipalName.NAME_COMPONENT_SEPARATOR_STR +
referral.getRealm(), PrincipalName.KRB_NT_SRV_INST,
this.getRealm());
+ System.out.println(realm + "> referral to " +
+ referral.getRealm());
+ isReferral = true;
}
}
@@ -918,7 +923,8 @@
if (body.kdcOptions.get(KDCOptions.ALLOW_POSTDATE)) {
bFlags[Krb5.TKT_OPTS_MAY_POSTDATE] = true;
}
- if (body.kdcOptions.get(KDCOptions.CNAME_IN_ADDL_TKT)) {
+ if (body.kdcOptions.get(KDCOptions.CNAME_IN_ADDL_TKT) &&
+ !isReferral) {
if (!options.containsKey(Option.ALLOW_S4U2PROXY)) {
// Don't understand CNAME_IN_ADDL_TKT
throw new KrbException(Krb5.KDC_ERR_BADOPTION);
@@ -1074,8 +1080,7 @@
}
int eType = eTypes[0];
- if (body.kdcOptions.get(KDCOptions.CANONICALIZE) &&
- body.cname.getNameType() == PrincipalName.KRB_NT_ENTERPRISE) {
+ if (body.kdcOptions.get(KDCOptions.CANONICALIZE)) {
PrincipalName principal = alias2Principals.get(
body.cname.getNameString());
if (principal != null) {
diff -r aaa83519e723 -r 0e2453f75881 test/jdk/sun/security/krb5/auto/ReferralsTest.java
--- a/test/jdk/sun/security/krb5/auto/ReferralsTest.java Fri Jul 19 11:09:41 2019 +0200
+++ b/test/jdk/sun/security/krb5/auto/ReferralsTest.java Tue Jul 23 11:17:59 2019 -0700
@@ -30,9 +30,18 @@
*/
import java.io.File;
-import sun.security.krb5.Credentials;
-import sun.security.krb5.internal.CredentialsUtil;
-import sun.security.krb5.KrbAsReqBuilder;
+import java.security.Principal;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import javax.security.auth.kerberos.KerberosTicket;
+import javax.security.auth.Subject;
+
+import org.ietf.jgss.GSSName;
+
+import sun.security.jgss.GSSUtil;
import sun.security.krb5.PrincipalName;
public class ReferralsTest {
@@ -41,39 +50,32 @@
private static final String realmKDC1 = "RABBIT.HOLE";
private static final String realmKDC2 = "DEV.RABBIT.HOLE";
private static final char[] password = "123qwe@Z".toCharArray();
+
+ // Names
private static final String clientName = "test";
-
- private static final String clientAlias = clientName +
- PrincipalName.NAME_REALM_SEPARATOR_STR + realmKDC1;
-
- private static final String clientKDC1QueryName = clientAlias.replaceAll(
- PrincipalName.NAME_REALM_SEPARATOR_STR, "\\\\" +
- PrincipalName.NAME_REALM_SEPARATOR_STR) +
- PrincipalName.NAME_REALM_SEPARATOR_STR + realmKDC1;
- private static PrincipalName clientKDC1QueryPrincipal = null;
- static {
- try {
- clientKDC1QueryPrincipal = new PrincipalName(
- clientKDC1QueryName, PrincipalName.KRB_NT_ENTERPRISE,
- null);
- } catch (Throwable t) {}
- }
-
- private static final String clientKDC2Name = clientName +
- PrincipalName.NAME_REALM_SEPARATOR_STR + realmKDC2;
-
private static final String serviceName = "http" +
PrincipalName.NAME_COMPONENT_SEPARATOR_STR +
"server.dev.rabbit.hole";
- private static Credentials tgt;
- private static Credentials tgs;
+ // Alias
+ private static final String clientAlias = clientName +
+ PrincipalName.NAME_REALM_SEPARATOR_STR + realmKDC1;
+
+ // Names + realms
+ private static final String clientKDC1Name = clientAlias.replaceAll(
+ PrincipalName.NAME_REALM_SEPARATOR_STR, "\\\\" +
+ PrincipalName.NAME_REALM_SEPARATOR_STR) +
+ PrincipalName.NAME_REALM_SEPARATOR_STR + realmKDC1;
+ private static final String clientKDC2Name = clientName +
+ PrincipalName.NAME_REALM_SEPARATOR_STR + realmKDC2;
+ private static final String serviceKDC2Name = serviceName +
+ PrincipalName.NAME_REALM_SEPARATOR_STR + realmKDC2;
public static void main(String[] args) throws Exception {
try {
initializeKDCs();
- getTGT();
- getTGS();
+ testSubjectCredentials();
+ testDelegated();
} finally {
cleanup();
}
@@ -108,6 +110,11 @@
kdc1.registerAlias(serviceName, kdc2);
kdc2.registerAlias(clientAlias, clientKDC2Name);
+ Map> mapKDC2 = new HashMap<>();
+ mapKDC2.put(serviceName + "@" + realmKDC2, Arrays.asList(
+ new String[]{serviceName + "@" + realmKDC2}));
+ kdc2.setOption(KDC.Option.ALLOW_S4U2PROXY, mapKDC2);
+
KDC.saveConfig(krbConfigName, kdc1, kdc2,
"forwardable=true");
System.setProperty("java.security.krb5.conf", krbConfigName);
@@ -120,50 +127,123 @@
}
}
- private static void getTGT() throws Exception {
- KrbAsReqBuilder builder = new KrbAsReqBuilder(clientKDC1QueryPrincipal,
- password);
- tgt = builder.action().getCreds();
- builder.destroy();
+ /*
+ * The client subject (whose principal is
+ * test@RABBIT.HOLE@RABBIT.HOLE) will obtain a TGT after
+ * realm referral and name canonicalization (TGT cname
+ * will be test@DEV.RABBIT.HOLE). With this TGT, the client will request
+ * a TGS for service http/server.dev.rabbit.hole@RABBIT.HOLE. After
+ * realm referral, a http/server.dev.rabbit.hole@DEV.RABBIT.HOLE TGS
+ * will be obtained.
+ *
+ * Assert that we get the proper TGT and TGS tickets, and that they are
+ * associated to the client subject.
+ *
+ * Assert that if we request a TGS for the same service again (based on the
+ * original service name), we don't get a new one but the previous,
+ * already in the subject credentials.
+ */
+ private static void testSubjectCredentials() throws Exception {
+ Subject clientSubject = new Subject();
+ Context clientContext = Context.fromUserPass(clientSubject,
+ clientKDC1Name, password, false);
+
+ Set clientPrincipals = clientSubject.getPrincipals();
+ if (clientPrincipals.size() != 1) {
+ throw new Exception("Only one client subject principal expected");
+ }
+ Principal clientPrincipal = clientPrincipals.iterator().next();
if (DEBUG) {
- System.out.println("TGT");
- System.out.println("----------------------");
- System.out.println(tgt);
- System.out.println("----------------------");
+ System.out.println("Client subject principal: " +
+ clientPrincipal.getName());
+ }
+ if (!clientPrincipal.getName().equals(clientKDC1Name)) {
+ throw new Exception("Unexpected client subject principal.");
}
- if (tgt == null) {
- throw new Exception("TGT is null");
- }
- if (!tgt.getClient().getName().equals(clientKDC2Name)) {
- throw new Exception("Unexpected TGT client");
+
+ clientContext.startAsClient(serviceName, GSSUtil.GSS_KRB5_MECH_OID);
+ clientContext.take(new byte[0]);
+ Set clientTickets =
+ clientSubject.getPrivateCredentials(KerberosTicket.class);
+ boolean tgtFound = false;
+ boolean tgsFound = false;
+ for (KerberosTicket clientTicket : clientTickets) {
+ String cname = clientTicket.getClient().getName();
+ String sname = clientTicket.getServer().getName();
+ if (cname.equals(clientKDC2Name)) {
+ if (sname.equals(PrincipalName.TGS_DEFAULT_SRV_NAME +
+ PrincipalName.NAME_COMPONENT_SEPARATOR_STR +
+ realmKDC2 + PrincipalName.NAME_REALM_SEPARATOR_STR +
+ realmKDC2)) {
+ tgtFound = true;
+ } else if (sname.equals(serviceKDC2Name)) {
+ tgsFound = true;
+ }
+ }
+ if (DEBUG) {
+ System.out.println("Client subject KerberosTicket:");
+ System.out.println(clientTicket);
+ }
}
- String[] tgtServerNames = tgt.getServer().getNameStrings();
- if (tgtServerNames.length != 2 || !tgtServerNames[0].equals(
- PrincipalName.TGS_DEFAULT_SRV_NAME) ||
- !tgtServerNames[1].equals(realmKDC2) ||
- !tgt.getServer().getRealmString().equals(realmKDC2)) {
- throw new Exception("Unexpected TGT server");
+ if (!tgtFound || !tgsFound) {
+ throw new Exception("client subject tickets (TGT/TGS) not found.");
+ }
+ int numOfTickets = clientTickets.size();
+ clientContext.startAsClient(serviceName, GSSUtil.GSS_KRB5_MECH_OID);
+ clientContext.take(new byte[0]);
+ clientContext.status();
+ int newNumOfTickets =
+ clientSubject.getPrivateCredentials(KerberosTicket.class).size();
+ if (DEBUG) {
+ System.out.println("client subject number of tickets: " +
+ numOfTickets);
+ System.out.println("client subject new number of tickets: " +
+ newNumOfTickets);
+ }
+ if (numOfTickets != newNumOfTickets) {
+ throw new Exception("Useless client subject TGS request because" +
+ " TGS was not found in private credentials.");
}
}
- private static void getTGS() throws Exception {
- tgs = CredentialsUtil.acquireServiceCreds(serviceName +
- PrincipalName.NAME_REALM_SEPARATOR_STR + realmKDC1, tgt);
- if (DEBUG) {
- System.out.println("TGS");
- System.out.println("----------------------");
- System.out.println(tgs);
- System.out.println("----------------------");
+ /*
+ * The server (http/server.dev.rabbit.hole@DEV.RABBIT.HOLE)
+ * will authenticate on itself on behalf of the client
+ * (test@DEV.RABBIT.HOLE). Cross-realm referrals will occur
+ * when requesting different TGTs and TGSs (including the
+ * request for delegated credentials).
+ */
+ private static void testDelegated() throws Exception {
+ Context c = Context.fromUserPass(clientKDC2Name,
+ password, false);
+ c.startAsClient(serviceName, GSSUtil.GSS_KRB5_MECH_OID);
+ Context s = Context.fromUserPass(serviceKDC2Name,
+ password, true);
+ s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);
+ Context.handshake(c, s);
+ Context delegatedContext = s.delegated();
+ delegatedContext.startAsClient(serviceName, GSSUtil.GSS_KRB5_MECH_OID);
+ delegatedContext.x().requestMutualAuth(false);
+ Context s2 = Context.fromUserPass(serviceKDC2Name,
+ password, true);
+ s2.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);
+
+ // Test authentication
+ Context.handshake(delegatedContext, s2);
+ if (!delegatedContext.x().isEstablished() || !s2.x().isEstablished()) {
+ throw new Exception("Delegated authentication failed");
}
- if (tgs == null) {
- throw new Exception("TGS is null");
+
+ // Test identities
+ GSSName contextInitiatorName = delegatedContext.x().getSrcName();
+ GSSName contextAcceptorName = delegatedContext.x().getTargName();
+ if (DEBUG) {
+ System.out.println("Context initiator: " + contextInitiatorName);
+ System.out.println("Context acceptor: " + contextAcceptorName);
}
- if (!tgs.getClient().getName().equals(clientKDC2Name)) {
- throw new Exception("Unexpected TGS client");
- }
- if (!tgs.getServer().getNameString().equals(serviceName) ||
- !tgs.getServer().getRealmString().equals(realmKDC2)) {
- throw new Exception("Unexpected TGS server");
+ if (!contextInitiatorName.toString().equals(clientKDC2Name) ||
+ !contextAcceptorName.toString().equals(serviceName)) {
+ throw new Exception("Unexpected initiator or acceptor names");
}
}
}
diff -r aaa83519e723 -r 0e2453f75881 test/jdk/sun/security/ssl/SSLSessionImpl/ResumptionUpdateBoundValues.java
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/test/jdk/sun/security/ssl/SSLSessionImpl/ResumptionUpdateBoundValues.java Tue Jul 23 11:17:59 2019 -0700
@@ -0,0 +1,380 @@
+/*
+ * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @library /test/lib
+ * @summary Test that a New Session Ticket will be generated when a
+ * SSLSessionBindingListener is set (boundValues)
+ * @run main/othervm ResumptionUpdateBoundValues
+ */
+
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.lang.ref.Reference;
+import java.lang.ref.WeakReference;
+import java.util.concurrent.ArrayBlockingQueue;
+
+import javax.net.ssl.SSLServerSocket;
+import javax.net.ssl.SSLServerSocketFactory;
+import javax.net.ssl.SSLSession;
+import javax.net.ssl.SSLSessionBindingEvent;
+import javax.net.ssl.SSLSessionBindingListener;
+import javax.net.ssl.SSLSocket;
+import javax.net.ssl.SSLSocketFactory;
+
+import jdk.test.lib.process.OutputAnalyzer;
+import jdk.test.lib.process.ProcessTools;
+import jdk.test.lib.Utils;
+
+public class ResumptionUpdateBoundValues {
+
+ static boolean separateServerThread = true;
+
+ /*
+ * Where do we find the keystores?
+ */
+ static String pathToStores = "../../../../javax/net/ssl/etc/";
+ static String keyStoreFile = "keystore";
+ static String trustStoreFile = "truststore";
+ static String passwd = "passphrase";
+
+ /*
+ * Is the server ready to serve?
+ */
+ volatile static boolean serverReady = false;
+
+ /*
+ * Turn on SSL debugging?
+ */
+ static boolean debug = false;
+
+ /*
+ * Define the server side of the test.
+ *
+ * If the server prematurely exits, serverReady will be set to true
+ * to avoid infinite hangs.
+ */
+ void doServerSide() throws Exception {
+ SSLServerSocketFactory sslssf =
+ (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
+ SSLServerSocket sslServerSocket =
+ (SSLServerSocket) sslssf.createServerSocket(serverPort);
+ serverPort = sslServerSocket.getLocalPort();
+
+ /*
+ * Signal Client, we're ready for his connect.
+ */
+ serverReady = true;
+
+ while (serverReady) {
+ SSLSocket sslSocket = (SSLSocket) sslServerSocket.accept();
+ InputStream sslIS = sslSocket.getInputStream();
+ OutputStream sslOS = sslSocket.getOutputStream();
+
+ sslIS.read();
+ sslOS.write(85);
+ sslOS.flush();
+ SSLSession sslSession = sslSocket.getSession();
+ SBListener sbListener = new SBListener(sslSession);
+ sslSession.putValue("x", sbListener);
+
+ sslIS.read();
+ sslOS.write(85);
+ sslOS.flush();
+
+ sslSocket.close();
+ }
+ }
+
+ /*
+ * Define the client side of the test.
+ *
+ * If the server prematurely exits, serverReady will be set to true
+ * to avoid infinite hangs.
+ */
+ SBListener doClientSide() throws Exception {
+
+ /*
+ * Wait for server to get started.
+ */
+ while (!serverReady) {
+ Thread.sleep(50);
+ }
+
+ SSLSocketFactory sslsf =
+ (SSLSocketFactory) SSLSocketFactory.getDefault();
+
+ try {
+ SSLSocket sslSocket = (SSLSocket)
+ sslsf.createSocket("localhost", serverPort);
+ InputStream sslIS = sslSocket.getInputStream();
+ OutputStream sslOS = sslSocket.getOutputStream();
+
+ sslOS.write(280);
+ sslOS.flush();
+ sslIS.read();
+
+ SSLSession sslSession = sslSocket.getSession();
+ System.out.printf(" sslSession: %s %n %s%n", sslSession, sslSession.getClass());
+ SBListener sbListener = new SBListener(sslSession);
+
+ sslOS.write(280);
+ sslOS.flush();
+ sslIS.read();
+
+ sslOS.write(280);
+ sslOS.flush();
+ sslIS.read();
+
+ sslOS.close();
+ sslIS.close();
+ sslSocket.close();
+
+ sslOS = null;
+ sslIS = null;
+ sslSession = null;
+ sslSocket = null;
+ Reference.reachabilityFence(sslOS);
+ Reference.reachabilityFence(sslIS);
+ Reference.reachabilityFence(sslSession);
+ Reference.reachabilityFence(sslSocket);
+
+ return sbListener;
+ } catch (Exception ex) {
+ ex.printStackTrace();
+ throw ex;
+ }
+ }
+
+ /*
+ * =============================================================
+ * The remainder is just support stuff
+ */
+
+ // use any free port by default
+ volatile int serverPort = 0;
+
+ volatile Exception serverException = null;
+ volatile Exception clientException = null;
+
+ public static void main(String[] args) throws Exception {
+
+ if (args.length == 0) {
+ System.setProperty("test.java.opts",
+ "-Dtest.src=" + System.getProperty("test.src") +
+ " -Dtest.jdk=" + System.getProperty("test.jdk") +
+ " -Djavax.net.debug=ssl,handshake");
+
+ System.out.println("test.java.opts: " +
+ System.getProperty("test.java.opts"));
+
+ ProcessBuilder pb = ProcessTools.createJavaProcessBuilder(true,
+ Utils.addTestJavaOpts("ResumptionUpdateBoundValues", "p"));
+
+ OutputAnalyzer output = ProcessTools.executeProcess(pb);
+ try {
+ output.shouldContain("trigger new session ticket");
+ System.out.println("Found NST in debugging");
+ } catch (Exception e) {
+ throw e;
+ } finally {
+ System.out.println("-- BEGIN Stdout:");
+ System.out.println(output.getStdout());
+ System.out.println("-- END Stdout");
+ System.out.println("-- BEGIN Stderr:");
+ System.out.println(output.getStderr());
+ System.out.println("-- END Stderr");
+ }
+ return;
+ }
+
+ String keyFilename =
+ System.getProperty("test.src", "./") + "/" + pathToStores +
+ "/" + keyStoreFile;
+ String trustFilename =
+ System.getProperty("test.src", "./") + "/" + pathToStores +
+ "/" + trustStoreFile;
+ System.setProperty("javax.net.ssl.keyStore", keyFilename);
+ System.setProperty("javax.net.ssl.keyStorePassword", passwd);
+ System.setProperty("javax.net.ssl.trustStore", trustFilename);
+ System.setProperty("javax.net.ssl.trustStorePassword", passwd);
+
+ if (debug)
+ System.setProperty("javax.net.debug", "all");
+
+ /*
+ * Start the tests.
+ */
+
+ new ResumptionUpdateBoundValues();
+ }
+
+ ArrayBlockingQueue threads = new ArrayBlockingQueue(100);
+
+ ArrayBlockingQueue sbListeners = new ArrayBlockingQueue<>(100);
+
+ /*
+ * Primary constructor, used to drive remainder of the test.
+ *
+ * Fork off the other side, then do your work.
+ */
+ ResumptionUpdateBoundValues() throws Exception {
+ final int count = 1;
+ if (separateServerThread) {
+ startServer(true);
+ startClients(true, count);
+ } else {
+ startClients(true, count);
+ startServer(true);
+ }
+
+ /*
+ * Wait for other side to close down.
+ */
+ Thread t;
+ while ((t = threads.take()) != Thread.currentThread()) {
+ System.out.printf(" joining: %s%n", t);
+ t.join(1000L);
+ }
+ serverReady = false;
+ System.gc();
+ System.gc();
+
+
+ SBListener listener = null;
+ while ((listener = sbListeners.poll()) != null) {
+ if (!listener.check()) {
+ System.out.printf(" sbListener not called on finalize: %s%n",
+ listener);
+ }
+ }
+
+ /*
+ * When we get here, the test is pretty much over.
+ *
+ * If the main thread excepted, that propagates back
+ * immediately. If the other thread threw an exception, we
+ * should report back.
+ */
+ if (serverException != null) {
+ System.out.print("Server Exception:");
+ throw serverException;
+ }
+ if (clientException != null) {
+ System.out.print("Client Exception:");
+ throw clientException;
+ }
+ }
+
+ void startServer(boolean newThread) throws Exception {
+ if (newThread) {
+ Thread t = new Thread("Server") {
+ public void run() {
+ try {
+ doServerSide();
+ } catch (Exception e) {
+ /*
+ * Our server thread just died.
+ *
+ * Release the client, if not active already...
+ */
+ System.err.println("Server died..." + e);
+ serverReady = true;
+ serverException = e;
+ }
+ }
+ };
+ threads.add(t);
+ t.setDaemon(true);
+ t.start();
+ } else {
+ doServerSide();
+ }
+ }
+
+ void startClients(boolean newThread, int count) throws Exception {
+ for (int i = 0; i < count; i++) {
+ System.out.printf(" newClient: %d%n", i);
+ startClient(newThread);
+ }
+ serverReady = false;
+
+ threads.add(Thread.currentThread()); // add ourselves at the 'end'
+ }
+ void startClient(boolean newThread) throws Exception {
+ if (newThread) {
+ Thread t = new Thread("Client") {
+ public void run() {
+ try {
+ sbListeners.add(doClientSide());
+ } catch (Exception e) {
+ /*
+ * Our client thread just died.
+ */
+ System.err.println("Client died..." + e);
+ clientException = e;
+ }
+ }
+ };
+ System.out.printf(" starting: %s%n", t);
+ threads.add(t);
+ t.start();
+ } else {
+ sbListeners.add(doClientSide());
+ }
+ }
+
+
+ static class SBListener implements SSLSessionBindingListener {
+ private volatile int unboundNotified;
+ private final WeakReference session;
+
+ SBListener(SSLSession session) {
+ this.unboundNotified = 0;
+ this.session = new WeakReference(session);
+ }
+
+ boolean check() {
+ System.out.printf(" check: %s%n", this);
+ return unboundNotified > 0 && session.get() == null;
+ }
+
+ @Override
+ public void valueBound(SSLSessionBindingEvent event) {
+ System.out.printf(" valueBound: %s%n", event.getName());
+ }
+
+ @Override
+ public void valueUnbound(SSLSessionBindingEvent event) {
+ System.out.printf(" valueUnbound: %s%n", event.getName());
+ unboundNotified++;
+ }
+
+ public String toString() {
+ return "count: " + unboundNotified +
+ ", ref: " + session.get();
+ }
+ }
+}
+
diff -r aaa83519e723 -r 0e2453f75881 test/jdk/sun/security/tools/jarsigner/DiffEnd.java
--- a/test/jdk/sun/security/tools/jarsigner/DiffEnd.java Fri Jul 19 11:09:41 2019 +0200
+++ b/test/jdk/sun/security/tools/jarsigner/DiffEnd.java Tue Jul 23 11:17:59 2019 -0700
@@ -23,10 +23,14 @@
/*
* @test
- * @bug 6948909
+ * @bug 6948909 8217375
* @summary Jarsigner removes MANIFEST.MF info for badly packages jar's
* @library /test/lib
*/
+/*
+ * See also InsufficientSectionDelimiter.java for similar tests including cases
+ * without or with different line breaks.
+ */
import jdk.test.lib.Asserts;
import jdk.test.lib.SecurityTools;
@@ -44,47 +48,47 @@
public class DiffEnd {
static void check() throws Exception {
- SecurityTools.jarsigner("-keystore "
- + Path.of(System.getProperty("test.src"), "JarSigning.keystore")
- .toString()
- + " -storepass bbbbbb -digestalg SHA1"
- + " -signedjar diffend.new.jar diffend.jar c");
+ String ksArgs = "-keystore " + Path.of(System.getProperty("test.src"))
+ .resolve("JarSigning.keystore") + " -storepass bbbbbb";
- try (JarFile jf = new JarFile("diffend.new.jar")) {
+ SecurityTools.jarsigner(ksArgs + " -digestalg SHA1 "
+ + "-signedjar diffend.signed.jar diffend.jar c")
+ .shouldHaveExitValue(0);
+ SecurityTools.jarsigner(" -verify " + ksArgs + " -verbose "
+ + "diffend.signed.jar c")
+ .stdoutShouldMatch("^smk .* 1$").shouldHaveExitValue(0);
+
+ try (JarFile jf = new JarFile("diffend.signed.jar")) {
Asserts.assertTrue(jf.getManifest().getMainAttributes()
.containsKey(new Attributes.Name("Today")));
}
}
public static void main(String[] args) throws Exception {
-
// A MANIFEST.MF using \n as newlines and no double newlines at the end
- byte[] manifest =
- ("Manifest-Version: 1.0\n"
+ byte[] manifest = ("Manifest-Version: 1.0\n"
+ "Created-By: 1.7.0-internal (Sun Microsystems Inc.)\n"
+ "Today: Monday\n").getBytes(StandardCharsets.UTF_8);
+ // Without the fake .RSA file, to trigger the if (wasSigned) else block
+ try (FileOutputStream fos = new FileOutputStream("diffend.jar");
+ ZipOutputStream zos = new ZipOutputStream(fos)) {
+ zos.putNextEntry(new ZipEntry(JarFile.MANIFEST_NAME));
+ zos.write(manifest);
+ zos.putNextEntry(new ZipEntry("1"));
+ zos.write(new byte[10]);
+ }
+ check();
+
// With the fake .RSA file, to trigger the if (wasSigned) block
try (FileOutputStream fos = new FileOutputStream("diffend.jar");
ZipOutputStream zos = new ZipOutputStream(fos)) {
- zos.putNextEntry(new ZipEntry("META-INF/MANIFEST.MF"));
+ zos.putNextEntry(new ZipEntry(JarFile.MANIFEST_NAME));
zos.write(manifest);
- zos.putNextEntry(new ZipEntry("META-INF/x.RSA"));
+ zos.putNextEntry(new ZipEntry("META-INF/x.RSA")); // fake .RSA
zos.putNextEntry(new ZipEntry("1"));
zos.write(new byte[10]);
}
-
- check();
-
- // Without the fake .RSA file, to trigger the else block
- try (FileOutputStream fos = new FileOutputStream("diffend.jar");
- ZipOutputStream zos = new ZipOutputStream(fos)) {
- zos.putNextEntry(new ZipEntry("META-INF/MANIFEST.MF"));
- zos.write(manifest);
- zos.putNextEntry(new ZipEntry("1"));
- zos.write(new byte[10]);
- }
-
check();
}
}
diff -r aaa83519e723 -r 0e2453f75881 test/jdk/sun/security/tools/jarsigner/DigestDontIgnoreCase.java
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/test/jdk/sun/security/tools/jarsigner/DigestDontIgnoreCase.java Tue Jul 23 11:17:59 2019 -0700
@@ -0,0 +1,166 @@
+/*
+ * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.IOException;
+import java.io.OutputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Arrays;
+import java.util.Map;
+import java.util.jar.JarFile;
+import java.util.jar.JarOutputStream;
+import java.util.jar.JarEntry;
+import jdk.test.lib.SecurityTools;
+import org.testng.annotations.Test;
+import org.testng.annotations.BeforeClass;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+/**
+ * @test
+ * @bug 8217375
+ * @library /test/lib
+ * @run testng DigestDontIgnoreCase
+ * @summary Check that existing manifest digest entries are taken for valid
+ * only if they match the actual digest value also taking upper and lower
+ * case of the base64 encoded form of the digests into account.
+ */
+/*
+ *
mfDigest.equalsIgnoreCase(base64Digests[i])
+ * previously in JarSigner.java on on line 985
+ * @see jdk.security.jarsigner.JarSigner#updateDigests
+ */
+public class DigestDontIgnoreCase {
+
+ static final String KEYSTORE_FILENAME = "test.jks";
+
+ static final String DUMMY_FILE1 = "dummy1.txt";
+ static final byte[] DUMMY_CONTENTS1 = DUMMY_FILE1.getBytes(UTF_8);
+ static final String DUMMY_FILE2 = "dummy2.txt";
+ static final byte[] DUMMY_CONTENTS2 = DUMMY_FILE2.getBytes(UTF_8);
+
+ byte[] goodSignedManifest;
+
+ @BeforeClass
+ public void prepareCertificate() throws Exception {
+ SecurityTools.keytool("-genkeypair -keyalg DSA -keystore "
+ + KEYSTORE_FILENAME + " -storepass changeit -keypass changeit"
+ + " -alias a -dname CN=X").shouldHaveExitValue(0);
+ }
+
+ void prepareJarFile(String filename, Map contents)
+ throws IOException {
+ try (OutputStream out = Files.newOutputStream(Path.of(filename));
+ JarOutputStream jos = new JarOutputStream(out)) {
+ for (Map.Entry entry : contents.entrySet()) {
+ JarEntry je = new JarEntry(entry.getKey());
+ jos.putNextEntry(je);
+ jos.write(entry.getValue());
+ jos.closeEntry();
+ }
+ }
+ }
+
+ @BeforeClass(dependsOnMethods = "prepareCertificate")
+ public void prepareGoodSignedManifest() throws Exception {
+ String filename = "prepare.jar";
+ prepareJarFile(filename, Map.of(DUMMY_FILE1, DUMMY_CONTENTS1));
+ SecurityTools.jarsigner("-keystore " + KEYSTORE_FILENAME +
+ " -storepass changeit -verbose -debug " + filename + " a")
+ .shouldHaveExitValue(0);
+ goodSignedManifest = Utils.readJarManifestBytes(filename);
+ Utils.echoManifest(goodSignedManifest,
+ "reference manifest with one file signed");
+ }
+
+ void testWithManifest(String filename, byte[] manifestBytes)
+ throws Exception {
+ Utils.echoManifest(manifestBytes,
+ "going to test " + filename + " with manifest");
+ prepareJarFile(filename, Map.of(
+ JarFile.MANIFEST_NAME, manifestBytes,
+ DUMMY_FILE1, DUMMY_CONTENTS1, // with digest already in manifest
+ DUMMY_FILE2, DUMMY_CONTENTS2)); // causes manifest update
+ Utils.echoManifest(Utils.readJarManifestBytes(filename),
+ filename + " created with manifest");
+ SecurityTools.jarsigner("-keystore " + KEYSTORE_FILENAME +
+ " -storepass changeit -debug -verbose " + filename + " a")
+ .shouldHaveExitValue(0);
+ Utils.echoManifest(Utils.readJarManifestBytes(filename),
+ filename + " signed resulting in manifest");
+ SecurityTools.jarsigner("-verify -strict -keystore " +
+ KEYSTORE_FILENAME + " -storepass changeit -debug -verbose " +
+ filename + " a").shouldHaveExitValue(0);
+ }
+
+ @Test
+ public void verifyDigestGoodCase() throws Exception {
+ testWithManifest("good.jar", goodSignedManifest);
+ }
+
+ @Test
+ public void testDigestHeaderNameCase() throws Exception {
+ byte[] mfBadHeader = new String(goodSignedManifest, UTF_8).
+ replace("SHA-256-Digest", "sha-256-dIGEST").getBytes(UTF_8);
+ testWithManifest("switch-header-name-case.jar", mfBadHeader);
+ }
+
+ @Test
+ public void testDigestWrongCase() throws Exception {
+ byte[] mfBadDigest = switchCase(goodSignedManifest, "Digest");
+ testWithManifest("switch-digest-case.jar", mfBadDigest);
+ }
+
+ byte[] switchCase(byte[] manifest, String attrName) {
+ byte[] wrongCase = Arrays.copyOf(manifest, manifest.length);
+ byte[] name = (attrName + ":").getBytes(UTF_8);
+ int matched = 0; // number of bytes before position i matching attrName
+ for (int i = 0; i < wrongCase.length; i++) {
+ if (wrongCase[i] == '\r' &&
+ (i == wrongCase.length - 1 || wrongCase[i + 1] == '\n')) {
+ continue;
+ } else if ((wrongCase[i] == '\r' || wrongCase[i] == '\n')
+ && (i == wrongCase.length - 1 || wrongCase[i + 1] != ' ')) {
+ matched = 0;
+ } else if (matched == name.length) {
+ wrongCase[i] = switchCase(wrongCase[i]);
+ } else if (name[matched] == wrongCase[i]) {
+ matched++;
+ } else {
+ matched = 0;
+ }
+ }
+ return wrongCase;
+ }
+
+ byte switchCase(byte c) {
+ if (c >= 'A' && c <= 'Z') {
+ return (byte) ('a' + (c - 'A'));
+ } else if (c >= 'a' && c <= 'z') {
+ return (byte) ('A' + (c - 'a'));
+ } else {
+ return c;
+ }
+ }
+
+}
diff -r aaa83519e723 -r 0e2453f75881 test/jdk/sun/security/tools/jarsigner/EmptyIndividualSectionName.java
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/test/jdk/sun/security/tools/jarsigner/EmptyIndividualSectionName.java Tue Jul 23 11:17:59 2019 -0700
@@ -0,0 +1,139 @@
+/*
+ * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.ByteArrayInputStream;
+import java.lang.reflect.Method;
+import java.nio.file.Path;
+import java.util.jar.JarFile;
+import java.util.jar.Manifest;
+import java.util.jar.Attributes;
+import java.util.jar.Attributes.Name;
+
+import jdk.test.lib.util.JarUtils;
+import jdk.test.lib.SecurityTools;
+import org.testng.annotations.Test;
+import org.testng.annotations.BeforeClass;
+
+import static org.testng.Assert.*;
+
+/**
+ * @test
+ * @bug 8217375
+ * @library /test/lib
+ * @modules java.base/java.util.jar:+open
+ * @run testng/othervm EmptyIndividualSectionName
+ * @summary Check that an individual section with an empty name is digested
+ * and signed.
+ *
+ * See also
+ * jdk/test/jdk/sun/security/util/ManifestDigester/FindSections.java
+ * for much more detailed api level tests
+ */
+public class EmptyIndividualSectionName {
+
+ static final String KEYSTORE_FILENAME = "test.jks";
+
+ @BeforeClass
+ public void prepareCertificate() throws Exception {
+ SecurityTools.keytool("-genkeypair -keyalg EC -keystore "
+ + KEYSTORE_FILENAME + " -storepass changeit -keypass changeit "
+ + "-alias a -dname CN=X").shouldHaveExitValue(0);
+ }
+
+ /**
+ * Adds an additional section with name {@code sectionName} to the manifest
+ * of a JAR before signing it with {@code signOpts}.
+ * @return signature file {@code META-INF/A.SF} for further assertions
+ */
+ Manifest test(String sectionName, String signOpts) throws Exception {
+ Manifest mf = new Manifest();
+ mf.getMainAttributes().put(Name.MANIFEST_VERSION, "1.0");
+ mf.getEntries().put(sectionName, new Attributes());
+ String jarFilename = "test" + sectionName +
+ (signOpts != null ? signOpts : "") + ".jar";
+ JarUtils.createJarFile(Path.of(jarFilename), mf, Path.of("."));
+ SecurityTools.jarsigner("-keystore " + KEYSTORE_FILENAME +
+ " -storepass changeit -verbose -debug " +
+ (signOpts != null ? signOpts + " " : "") + jarFilename + " a")
+ .shouldHaveExitValue(0);
+ SecurityTools.jarsigner("-verify -keystore " + KEYSTORE_FILENAME +
+ " -storepass changeit -debug -verbose " + jarFilename + " a")
+ .shouldHaveExitValue(0);
+
+ byte[] mfBytes = Utils.readJarManifestBytes(jarFilename);
+ Utils.echoManifest(mfBytes, "manifest");
+ mf = new Manifest(new ByteArrayInputStream(mfBytes));
+ assertNotNull(mf.getAttributes(sectionName));
+ byte[] sfBytes = Utils.readJarEntryBytes(jarFilename, "META-INF/A.SF");
+ Utils.echoManifest(sfBytes, "signature file META-INF/A.SF");
+ return new Manifest(new ByteArrayInputStream(sfBytes));
+ }
+
+ /**
+ * Verifies that it makes a difference if the name is empty or not
+ * by running the same test as {@link #testNameEmpty} with only a different
+ * section name.
+ */
+ @Test
+ public void testNameNotEmpty() throws Exception {
+ String sectionName = "X";
+ assertNotNull(test(sectionName, null).getAttributes(sectionName));
+ }
+
+ /**
+ * Verifies that individual sections are digested and signed also if the
+ * name of such a section is empty.
+ * An empty name of an individual section cannot be tested by adding a file
+ * with an empty name to a JAR because such a file name is invalid and
+ * cannot be used to add a file because it cannot be created or added to
+ * the JAR file in the first place. However, an individual section with an
+ * empty name can be added to the manifest.
+ * Expected is a corresponding digest in the signature file which was not
+ * present or produced before resolution of bug 8217375.
+ */
+ @Test
+ public void testNameEmpty() throws Exception {
+ String sectionName = "";
+ assertNotNull(test(sectionName, null).getAttributes(sectionName));
+ }
+
+ /**
+ * Similar to {@link #testNameEmpty} but tries to show a real difference
+ * rather than just some internals in a {@code .SF} file, but TODO
+ */
+ @Test(enabled = false, description = "TODO")
+ public void testNameEmptyTrusted() throws Exception {
+ String sectionName = "";
+ test(sectionName, "-sectionsonly");
+ String jarFilename = "test" + sectionName + "-sectionsonly.jar";
+ try (JarFile jar = new JarFile(jarFilename, true)) {
+ Manifest m = jar.getManifest();
+ Method getTrustedAttributes = m.getClass()
+ .getDeclaredMethod("getTrustedAttributes", String.class);
+ getTrustedAttributes.setAccessible(true);
+ assertThrows(SecurityException.class, () ->
+ getTrustedAttributes.invoke(m, sectionName));
+ }
+ }
+
+}
diff -r aaa83519e723 -r 0e2453f75881 test/jdk/sun/security/tools/jarsigner/EmptyJar.java
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/test/jdk/sun/security/tools/jarsigner/EmptyJar.java Tue Jul 23 11:17:59 2019 -0700
@@ -0,0 +1,72 @@
+/*
+ * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.nio.file.Path;
+import java.util.jar.Manifest;
+import java.util.jar.Attributes.Name;
+
+import jdk.test.lib.util.JarUtils;
+import jdk.test.lib.SecurityTools;
+import org.testng.annotations.Test;
+import org.testng.annotations.BeforeClass;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+import static org.testng.Assert.*;
+
+/**
+ * @test
+ * @bug 8217375
+ * @modules java.base/sun.security.util
+ * @library /test/lib /lib/testlibrary
+ * @run testng EmptyJar
+ * @summary Checks that signing an empty jar file does not result in an NPE or
+ * other error condition.
+ */
+public class EmptyJar {
+
+ static final String KEYSTORE_FILENAME = "test.jks";
+
+ @BeforeClass
+ public void prepareKeyStore() throws Exception {
+ SecurityTools.keytool("-genkeypair -keyalg EC -keystore "
+ + KEYSTORE_FILENAME + " -storepass changeit -keypass changeit"
+ + " -alias a -dname CN=A").shouldHaveExitValue(0);
+ }
+
+ @Test
+ public void test() throws Exception {
+ String jarFilename = "test.jar";
+ JarUtils.createJarFile(Path.of(jarFilename), (Manifest) null,
+ Path.of("."));
+ SecurityTools.jarsigner("-keystore " + KEYSTORE_FILENAME +
+ " -storepass changeit -verbose -debug " + jarFilename + " a")
+ .shouldHaveExitValue(0);
+
+ // verify that jarsigner has added a default manifest
+ byte[] mfBytes = Utils.readJarManifestBytes(jarFilename);
+ Utils.echoManifest(mfBytes, "manifest");
+ assertTrue(new String(mfBytes, UTF_8).startsWith(
+ Name.MANIFEST_VERSION + ": 1.0\r\nCreated-By: "));
+ }
+
+}
diff -r aaa83519e723 -r 0e2453f75881 test/jdk/sun/security/tools/jarsigner/FindHeaderEndVsManifestDigesterFindFirstSection.java
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/test/jdk/sun/security/tools/jarsigner/FindHeaderEndVsManifestDigesterFindFirstSection.java Tue Jul 23 11:17:59 2019 -0700
@@ -0,0 +1,288 @@
+/*
+ * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.ByteArrayOutputStream;
+import java.security.MessageDigest;
+import java.util.ArrayList;
+import java.util.List;
+import sun.security.util.ManifestDigester;
+
+import org.testng.annotations.Test;
+import org.testng.annotations.DataProvider;
+import org.testng.annotations.Factory;
+import org.testng.annotations.BeforeClass;
+import org.testng.annotations.BeforeMethod;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+import static org.testng.Assert.*;
+
+/**
+ * @test
+ * @bug 8217375
+ * @modules java.base/sun.security.util
+ * @run testng FindHeaderEndVsManifestDigesterFindFirstSection
+ * @summary Checks that {@link JarSigner#findHeaderEnd} (moved to now
+ * {@link #findHeaderEnd} in this test) can be replaced with
+ * {@link ManifestDigester#findSection}
+ * (first invocation will identify main attributes)
+ * without making a difference.
+ */
+/*
+ * Note to future maintainer:
+ * While it might look at first glance like this test ensures backwards-
+ * compatibility between JarSigner.findHeaderEnd and
+ * ManifestDigester.findSection's first invocation that find the main
+ * attributes section, at the time of that change, this test continues to
+ * verify main attributes digestion now with ManifestDigester.findSection as
+ * opposed to previous implementation in JarSigner.findHeaderEnd.
+ * Before completely removing this test, make sure that main attributes
+ * digestion is covered appropriately with tests. After JarSigner.findHeaderEnd
+ * has been removed digests should still continue to match.
+ *
+ * See also
+ * - jdk/test/jdk/sun/security/tools/jarsigner/PreserveRawManifestEntryAndDigest.java
+ * for some end-to-end tests utilizing the jarsigner tool,
+ * - jdk/test/jdk/sun/security/util/ManifestDigester/FindSection.java and
+ * - jdk/test/jdk/sun/security/util/ManifestDigester/DigestInput.java
+ * for much more detailed tests at api level
+ *
+ * Both test mentioned above, however, originally were created when removing
+ * confusion of "Manifest-Main-Attributes" individual section with actual main
+ * attributes whereas the test here is about changes related to raw manifest
+ * reproduction and in the end test pretty much the same behavior.
+ */
+public class FindHeaderEndVsManifestDigesterFindFirstSection {
+
+ static final boolean FIXED_8217375 = true; // FIXME
+
+ /**
+ * from former {@link JarSigner#findHeaderEnd}, subject to verification if
+ * it can be replaced with {@link ManifestDigester#findSection}
+ */
+ @SuppressWarnings("fallthrough")
+ private int findHeaderEnd(byte[] bs) {
+ // Initial state true to deal with empty header
+ boolean newline = true; // just met a newline
+ int len = bs.length;
+ for (int i = 0; i < len; i++) {
+ switch (bs[i]) {
+ case '\r':
+ if (i < len - 1 && bs[i + 1] == '\n') i++;
+ // fallthrough
+ case '\n':
+ if (newline) return i + 1; //+1 to get length
+ newline = true;
+ break;
+ default:
+ newline = false;
+ }
+ }
+ // If header end is not found, it means the MANIFEST.MF has only
+ // the main attributes section and it does not end with 2 newlines.
+ // Returns the whole length so that it can be completely replaced.
+ return len;
+ }
+
+ @DataProvider(name = "parameters")
+ public static Object[][] parameters() {
+ List