Skip to content

Commit 12c280f

Browse files
RealCLangerRealCLanger
authored
Merge pull request SAP#2041 from SAP/pr-jdk-17.0.17+3
Merge to tag jdk-17.0.17+3
2 parents 4be15e4 + fac15ce commit 12c280f

File tree

84 files changed

+2773
-3584
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

84 files changed

+2773
-3584
lines changed

‎make/data/cacerts/affirmtrustcommercialca‎

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎make/data/cacerts/affirmtrustnetworkingca‎

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎make/data/cacerts/affirmtrustpremiumca‎

Lines changed: 0 additions & 38 deletions
This file was deleted.

‎make/data/cacerts/affirmtrustpremiumeccca‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎make/modules/java.desktop/lib/Awt2dLibraries.gmk‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -205,8 +205,12 @@ ifeq ($(call isTargetOs, windows macosx), false)
205205
common/awt/systemscale \
206206
common/font \
207207
common/java2d/opengl \
208-
common/java2d/x11 \
209-
$(LIBPIPEWIRE_HEADER_DIRS)
208+
common/java2d/x11
209+
210+
# exclude pipewire from the AIX build, no Wayland support
211+
ifeq ($(call isTargetOs, aix), false)
212+
LIBAWT_XAWT_EXTRA_HEADER_DIRS += $(LIBPIPEWIRE_HEADER_DIRS)
213+
endif
210214

211215
LIBAWT_XAWT_CFLAGS += -DXAWT -DXAWT_HACK \
212216
$(FONTCONFIG_CFLAGS) \

‎src/java.base/share/classes/sun/security/ssl/CertSignAlgsExtension.java‎

Lines changed: 30 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2018, 2025, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,8 @@
2525

2626
package sun.security.ssl;
2727

28+
import static sun.security.ssl.SignatureScheme.CERTIFICATE_SCOPE;
29+
2830
import java.io.IOException;
2931
import java.nio.ByteBuffer;
3032
import java.util.List;
@@ -97,26 +99,27 @@ public byte[] produce(ConnectionContext context,
9799
}
98100

99101
// Produce the extension.
100-
if (chc.localSupportedSignAlgs == null) {
101-
chc.localSupportedSignAlgs =
102-
SignatureScheme.getSupportedAlgorithms(
103-
chc.sslConfig,
104-
chc.algorithmConstraints, chc.activeProtocols);
102+
if (chc.localSupportedCertSignAlgs == null) {
103+
chc.localSupportedCertSignAlgs =
104+
SignatureScheme.getSupportedAlgorithms(
105+
chc.sslConfig,
106+
chc.algorithmConstraints, chc.activeProtocols,
107+
CERTIFICATE_SCOPE);
105108
}
106109

107110
int vectorLen = SignatureScheme.sizeInRecord() *
108-
chc.localSupportedSignAlgs.size();
111+
chc.localSupportedCertSignAlgs.size();
109112
byte[] extData = new byte[vectorLen + 2];
110113
ByteBuffer m = ByteBuffer.wrap(extData);
111114
Record.putInt16(m, vectorLen);
112-
for (SignatureScheme ss : chc.localSupportedSignAlgs) {
115+
for (SignatureScheme ss : chc.localSupportedCertSignAlgs) {
113116
Record.putInt16(m, ss.id);
114117
}
115118

116119
// Update the context.
117120
chc.handshakeExtensions.put(
118121
SSLExtension.CH_SIGNATURE_ALGORITHMS_CERT,
119-
new SignatureSchemesSpec(chc.localSupportedSignAlgs));
122+
new SignatureSchemesSpec(chc.localSupportedCertSignAlgs));
120123

121124
return extData;
122125
}
@@ -191,7 +194,9 @@ public void consume(ConnectionContext context,
191194
SignatureScheme.getSupportedAlgorithms(
192195
shc.sslConfig,
193196
shc.algorithmConstraints, shc.negotiatedProtocol,
194-
spec.signatureSchemes);
197+
spec.signatureSchemes,
198+
CERTIFICATE_SCOPE);
199+
195200
shc.peerRequestedCertSignSchemes = schemes;
196201
shc.handshakeSession.setPeerSupportedSignatureAlgorithms(schemes);
197202

@@ -240,24 +245,28 @@ public byte[] produce(ConnectionContext context,
240245
}
241246

242247
// Produce the extension.
243-
List<SignatureScheme> sigAlgs =
244-
SignatureScheme.getSupportedAlgorithms(
245-
shc.sslConfig,
246-
shc.algorithmConstraints,
247-
List.of(shc.negotiatedProtocol));
248+
if (shc.localSupportedCertSignAlgs == null) {
249+
shc.localSupportedCertSignAlgs =
250+
SignatureScheme.getSupportedAlgorithms(
251+
shc.sslConfig,
252+
shc.algorithmConstraints,
253+
List.of(shc.negotiatedProtocol),
254+
CERTIFICATE_SCOPE);
255+
}
248256

249-
int vectorLen = SignatureScheme.sizeInRecord() * sigAlgs.size();
257+
int vectorLen = SignatureScheme.sizeInRecord()
258+
* shc.localSupportedCertSignAlgs.size();
250259
byte[] extData = new byte[vectorLen + 2];
251260
ByteBuffer m = ByteBuffer.wrap(extData);
252261
Record.putInt16(m, vectorLen);
253-
for (SignatureScheme ss : sigAlgs) {
262+
for (SignatureScheme ss : shc.localSupportedCertSignAlgs) {
254263
Record.putInt16(m, ss.id);
255264
}
256265

257266
// Update the context.
258267
shc.handshakeExtensions.put(
259268
SSLExtension.CR_SIGNATURE_ALGORITHMS_CERT,
260-
new SignatureSchemesSpec(shc.localSupportedSignAlgs));
269+
new SignatureSchemesSpec(shc.localSupportedCertSignAlgs));
261270

262271
return extData;
263272
}
@@ -331,7 +340,9 @@ public void consume(ConnectionContext context,
331340
SignatureScheme.getSupportedAlgorithms(
332341
chc.sslConfig,
333342
chc.algorithmConstraints, chc.negotiatedProtocol,
334-
spec.signatureSchemes);
343+
spec.signatureSchemes,
344+
CERTIFICATE_SCOPE);
345+
335346
chc.peerRequestedCertSignSchemes = schemes;
336347
chc.handshakeSession.setPeerSupportedSignatureAlgorithms(schemes);
337348
}

‎src/java.base/share/classes/sun/security/ssl/CertificateRequest.java‎

Lines changed: 44 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2015, 2023, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2015, 2025, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,9 @@
2525

2626
package sun.security.ssl;
2727

28+
import static sun.security.ssl.SignatureScheme.CERTIFICATE_SCOPE;
29+
import static sun.security.ssl.SignatureScheme.HANDSHAKE_SCOPE;
30+
2831
import java.io.IOException;
2932
import java.nio.ByteBuffer;
3033
import java.security.PrivateKey;
@@ -400,7 +403,6 @@ public void consume(ConnectionContext context,
400403
iae);
401404
}
402405

403-
404406
if (clientAlias == null) {
405407
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
406408
SSLLogger.warning("No available client authentication");
@@ -635,16 +637,33 @@ private T12CertificateRequestProducer() {
635637
public byte[] produce(ConnectionContext context,
636638
HandshakeMessage message) throws IOException {
637639
// The producing happens in server side only.
638-
ServerHandshakeContext shc = (ServerHandshakeContext)context;
640+
ServerHandshakeContext shc = (ServerHandshakeContext) context;
641+
639642
if (shc.localSupportedSignAlgs == null) {
640643
shc.localSupportedSignAlgs =
641-
SignatureScheme.getSupportedAlgorithms(
642-
shc.sslConfig,
643-
shc.algorithmConstraints, shc.activeProtocols);
644+
SignatureScheme.getSupportedAlgorithms(
645+
shc.sslConfig,
646+
shc.algorithmConstraints, shc.activeProtocols,
647+
HANDSHAKE_SCOPE);
648+
}
649+
650+
if (shc.localSupportedCertSignAlgs == null) {
651+
shc.localSupportedCertSignAlgs =
652+
SignatureScheme.getSupportedAlgorithms(
653+
shc.sslConfig,
654+
shc.algorithmConstraints, shc.activeProtocols,
655+
CERTIFICATE_SCOPE);
644656
}
645657

646-
if (shc.localSupportedSignAlgs == null ||
647-
shc.localSupportedSignAlgs.isEmpty()) {
658+
// According to TLSv1.2 RFC, CertificateRequest message must
659+
// contain signature schemes supported for both:
660+
// handshake signatures and certificate signatures.
661+
List<SignatureScheme> certReqSignAlgs =
662+
new ArrayList<>(shc.localSupportedSignAlgs);
663+
certReqSignAlgs.retainAll(shc.localSupportedCertSignAlgs);
664+
665+
if (certReqSignAlgs == null ||
666+
certReqSignAlgs.isEmpty()) {
648667
throw shc.conContext.fatal(Alert.HANDSHAKE_FAILURE,
649668
"No supported signature algorithm");
650669
}
@@ -653,7 +672,7 @@ public byte[] produce(ConnectionContext context,
653672
shc.sslContext.getX509TrustManager().getAcceptedIssuers();
654673
T12CertificateRequestMessage crm = new T12CertificateRequestMessage(
655674
shc, caCerts, shc.negotiatedCipherSuite.keyExchange,
656-
shc.localSupportedSignAlgs);
675+
certReqSignAlgs);
657676
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
658677
SSLLogger.fine(
659678
"Produced CertificateRequest handshake message", crm);
@@ -734,19 +753,29 @@ public void consume(ConnectionContext context,
734753
chc.handshakeProducers.put(SSLHandshake.CERTIFICATE.id,
735754
SSLHandshake.CERTIFICATE);
736755

737-
List<SignatureScheme> sss =
756+
List<SignatureScheme> signAlgs =
738757
SignatureScheme.getSupportedAlgorithms(
739758
chc.sslConfig,
740759
chc.algorithmConstraints, chc.negotiatedProtocol,
741-
crm.algorithmIds);
742-
if (sss == null || sss.isEmpty()) {
760+
crm.algorithmIds,
761+
HANDSHAKE_SCOPE);
762+
763+
List<SignatureScheme> signCertAlgs =
764+
SignatureScheme.getSupportedAlgorithms(
765+
chc.sslConfig,
766+
chc.algorithmConstraints, chc.negotiatedProtocol,
767+
crm.algorithmIds,
768+
CERTIFICATE_SCOPE);
769+
770+
if (signAlgs == null || signAlgs.isEmpty() || signCertAlgs.isEmpty()) {
743771
throw chc.conContext.fatal(Alert.HANDSHAKE_FAILURE,
744772
"No supported signature algorithm");
745773
}
746774

747-
chc.peerRequestedSignatureSchemes = sss;
748-
chc.peerRequestedCertSignSchemes = sss; // use the same schemes
749-
chc.handshakeSession.setPeerSupportedSignatureAlgorithms(sss);
775+
chc.peerRequestedSignatureSchemes = signAlgs;
776+
chc.peerRequestedCertSignSchemes = signCertAlgs;
777+
chc.handshakeSession.setPeerSupportedSignatureAlgorithms(signCertAlgs);
778+
750779
try {
751780
chc.peerSupportedAuthorities = crm.getAuthorities();
752781
} catch (IllegalArgumentException iae) {

‎src/java.base/share/classes/sun/security/ssl/HandshakeContext.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2018, 2025, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -82,7 +82,7 @@ abstract class HandshakeContext implements ConnectionContext {
8282
// consolidated parameters
8383
final List<ProtocolVersion> activeProtocols;
8484
final List<CipherSuite> activeCipherSuites;
85-
final AlgorithmConstraints algorithmConstraints;
85+
final SSLAlgorithmConstraints algorithmConstraints;
8686
final ProtocolVersion maximumActiveProtocol;
8787

8888
// output stream
@@ -137,6 +137,7 @@ abstract class HandshakeContext implements ConnectionContext {
137137

138138
// SignatureScheme
139139
List<SignatureScheme> localSupportedSignAlgs;
140+
List<SignatureScheme> localSupportedCertSignAlgs;
140141
List<SignatureScheme> peerRequestedSignatureSchemes;
141142
List<SignatureScheme> peerRequestedCertSignSchemes;
142143

‎src/java.base/share/classes/sun/security/ssl/PostHandshakeContext.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2018, 2025, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -43,7 +43,7 @@ final class PostHandshakeContext extends HandshakeContext {
4343
"Post-handshake not supported in " + negotiatedProtocol.name);
4444
}
4545

46-
this.localSupportedSignAlgs = new ArrayList<>(
46+
this.localSupportedCertSignAlgs = new ArrayList<>(
4747
context.conSession.getLocalSupportedSignatureSchemes());
4848

4949
// Add the potential post-handshake consumers.

0 commit comments

Comments
 (0)