Skip to content

Commit 2e85ff0

Browse files
GoeLinGoeLin
authored
Merge branch 'openjdk:master' into backport-GoeLin-0c697daf-master
2 parents cc20fde + 599e263 commit 2e85ff0

File tree

130 files changed

+4403
-5003
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

130 files changed

+4403
-5003
lines changed

‎.github/actions/do-build/action.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#
2-
# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
2+
# Copyright (c) 2022, 2025, Oracle and/or its affiliates. All rights reserved.
33
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
#
55
# This code is free software; you can redistribute it and/or modify it
@@ -42,7 +42,7 @@ runs:
4242
- name: 'Build'
4343
id: build
4444
run: >
45-
make LOG=info ${{ inputs.make-target }}
45+
make -k LOG=info ${{ inputs.make-target }}
4646
|| bash ./.github/scripts/gen-build-failure-report.sh "$GITHUB_STEP_SUMMARY"
4747
shell: bash
4848

‎.github/workflows/build-cross-compile.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -60,26 +60,26 @@ jobs:
6060
gnu-arch: aarch64
6161
debian-arch: arm64
6262
debian-repository: https://httpredir.debian.org/debian/
63-
debian-version: bullseye
63+
debian-version: bookworm
6464
tolerate-sysroot-errors: false
6565
- target-cpu: arm
6666
gnu-arch: arm
6767
debian-arch: armhf
6868
debian-repository: https://httpredir.debian.org/debian/
69-
debian-version: bullseye
69+
debian-version: bookworm
7070
tolerate-sysroot-errors: false
7171
gnu-abi: eabihf
7272
- target-cpu: s390x
7373
gnu-arch: s390x
7474
debian-arch: s390x
7575
debian-repository: https://httpredir.debian.org/debian/
76-
debian-version: bullseye
76+
debian-version: bookworm
7777
tolerate-sysroot-errors: false
7878
- target-cpu: ppc64le
7979
gnu-arch: powerpc64le
8080
debian-arch: ppc64el
8181
debian-repository: https://httpredir.debian.org/debian/
82-
debian-version: bullseye
82+
debian-version: bookworm
8383
tolerate-sysroot-errors: false
8484
- target-cpu: riscv64
8585
gnu-arch: riscv64

‎make/autoconf/flags-cflags.m4

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -316,7 +316,7 @@ AC_DEFUN([FLAGS_SETUP_OPTIMIZATION],
316316
C_O_FLAG_DEBUG="-Od"
317317
C_O_FLAG_DEBUG_JVM=""
318318
C_O_FLAG_NONE="-Od"
319-
C_O_FLAG_SIZE="-Os"
319+
C_O_FLAG_SIZE="-O1"
320320
fi
321321
322322
# Now copy to C++ flags

‎make/data/cacerts/affirmtrustcommercialca

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎make/data/cacerts/affirmtrustnetworkingca

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎make/data/cacerts/affirmtrustpremiumca

Lines changed: 0 additions & 38 deletions
This file was deleted.

‎make/data/cacerts/affirmtrustpremiumeccca

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎src/java.base/share/classes/sun/security/ssl/CertSignAlgsExtension.java

Lines changed: 30 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2018, 2025, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,8 @@
2525

2626
package sun.security.ssl;
2727

28+
import static sun.security.ssl.SignatureScheme.CERTIFICATE_SCOPE;
29+
2830
import java.io.IOException;
2931
import java.nio.ByteBuffer;
3032
import java.util.List;
@@ -97,26 +99,27 @@ public byte[] produce(ConnectionContext context,
9799
}
98100

99101
// Produce the extension.
100-
if (chc.localSupportedSignAlgs == null) {
101-
chc.localSupportedSignAlgs =
102-
SignatureScheme.getSupportedAlgorithms(
103-
chc.sslConfig,
104-
chc.algorithmConstraints, chc.activeProtocols);
102+
if (chc.localSupportedCertSignAlgs == null) {
103+
chc.localSupportedCertSignAlgs =
104+
SignatureScheme.getSupportedAlgorithms(
105+
chc.sslConfig,
106+
chc.algorithmConstraints, chc.activeProtocols,
107+
CERTIFICATE_SCOPE);
105108
}
106109

107110
int vectorLen = SignatureScheme.sizeInRecord() *
108-
chc.localSupportedSignAlgs.size();
111+
chc.localSupportedCertSignAlgs.size();
109112
byte[] extData = new byte[vectorLen + 2];
110113
ByteBuffer m = ByteBuffer.wrap(extData);
111114
Record.putInt16(m, vectorLen);
112-
for (SignatureScheme ss : chc.localSupportedSignAlgs) {
115+
for (SignatureScheme ss : chc.localSupportedCertSignAlgs) {
113116
Record.putInt16(m, ss.id);
114117
}
115118

116119
// Update the context.
117120
chc.handshakeExtensions.put(
118121
SSLExtension.CH_SIGNATURE_ALGORITHMS_CERT,
119-
new SignatureSchemesSpec(chc.localSupportedSignAlgs));
122+
new SignatureSchemesSpec(chc.localSupportedCertSignAlgs));
120123

121124
return extData;
122125
}
@@ -191,7 +194,9 @@ public void consume(ConnectionContext context,
191194
SignatureScheme.getSupportedAlgorithms(
192195
shc.sslConfig,
193196
shc.algorithmConstraints, shc.negotiatedProtocol,
194-
spec.signatureSchemes);
197+
spec.signatureSchemes,
198+
CERTIFICATE_SCOPE);
199+
195200
shc.peerRequestedCertSignSchemes = schemes;
196201
shc.handshakeSession.setPeerSupportedSignatureAlgorithms(schemes);
197202

@@ -240,24 +245,28 @@ public byte[] produce(ConnectionContext context,
240245
}
241246

242247
// Produce the extension.
243-
List<SignatureScheme> sigAlgs =
244-
SignatureScheme.getSupportedAlgorithms(
245-
shc.sslConfig,
246-
shc.algorithmConstraints,
247-
List.of(shc.negotiatedProtocol));
248+
if (shc.localSupportedCertSignAlgs == null) {
249+
shc.localSupportedCertSignAlgs =
250+
SignatureScheme.getSupportedAlgorithms(
251+
shc.sslConfig,
252+
shc.algorithmConstraints,
253+
List.of(shc.negotiatedProtocol),
254+
CERTIFICATE_SCOPE);
255+
}
248256

249-
int vectorLen = SignatureScheme.sizeInRecord() * sigAlgs.size();
257+
int vectorLen = SignatureScheme.sizeInRecord()
258+
* shc.localSupportedCertSignAlgs.size();
250259
byte[] extData = new byte[vectorLen + 2];
251260
ByteBuffer m = ByteBuffer.wrap(extData);
252261
Record.putInt16(m, vectorLen);
253-
for (SignatureScheme ss : sigAlgs) {
262+
for (SignatureScheme ss : shc.localSupportedCertSignAlgs) {
254263
Record.putInt16(m, ss.id);
255264
}
256265

257266
// Update the context.
258267
shc.handshakeExtensions.put(
259268
SSLExtension.CR_SIGNATURE_ALGORITHMS_CERT,
260-
new SignatureSchemesSpec(shc.localSupportedSignAlgs));
269+
new SignatureSchemesSpec(shc.localSupportedCertSignAlgs));
261270

262271
return extData;
263272
}
@@ -331,7 +340,9 @@ public void consume(ConnectionContext context,
331340
SignatureScheme.getSupportedAlgorithms(
332341
chc.sslConfig,
333342
chc.algorithmConstraints, chc.negotiatedProtocol,
334-
spec.signatureSchemes);
343+
spec.signatureSchemes,
344+
CERTIFICATE_SCOPE);
345+
335346
chc.peerRequestedCertSignSchemes = schemes;
336347
chc.handshakeSession.setPeerSupportedSignatureAlgorithms(schemes);
337348
}

‎src/java.base/share/classes/sun/security/ssl/CertificateAuthoritiesExtension.java

Lines changed: 24 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2022, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -122,8 +122,11 @@ private static List<byte[]> getEncodedAuthorities(
122122
return authorities;
123123
}
124124

125+
// This method will throw IllegalArgumentException if the
126+
// X500Principal cannot be parsed.
125127
X500Principal[] getAuthorities() {
126128
X500Principal[] principals = new X500Principal[authorities.size()];
129+
127130
int i = 0;
128131
for (byte[] encoded : authorities) {
129132
principals[i++] = new X500Principal(encoded);
@@ -138,8 +141,12 @@ public String toString() {
138141
"\"certificate authorities\": '['\n{0}']'", Locale.ENGLISH);
139142
StringBuilder builder = new StringBuilder(512);
140143
for (byte[] encoded : authorities) {
141-
X500Principal principal = new X500Principal(encoded);
142-
builder.append(principal.toString());
144+
try {
145+
X500Principal principal = new X500Principal(encoded);
146+
builder.append(principal.toString());
147+
} catch (IllegalArgumentException iae) {
148+
builder.append("unparseable distinguished name: " + iae);
149+
}
143150
builder.append("\n");
144151
}
145152
Object[] messageFields = {
@@ -277,7 +284,13 @@ public void consume(ConnectionContext context,
277284
new CertificateAuthoritiesSpec(shc, buffer);
278285

279286
// Update the context.
280-
shc.peerSupportedAuthorities = spec.getAuthorities();
287+
try {
288+
shc.peerSupportedAuthorities = spec.getAuthorities();
289+
} catch (IllegalArgumentException iae) {
290+
shc.conContext.fatal(Alert.DECODE_ERROR, "The distinguished " +
291+
"names of the peer's certificate authorities could " +
292+
"not be parsed", iae);
293+
}
281294
shc.handshakeExtensions.put(
282295
SSLExtension.CH_CERTIFICATE_AUTHORITIES, spec);
283296

@@ -398,7 +411,13 @@ public void consume(ConnectionContext context,
398411
new CertificateAuthoritiesSpec(chc, buffer);
399412

400413
// Update the context.
401-
chc.peerSupportedAuthorities = spec.getAuthorities();
414+
try {
415+
chc.peerSupportedAuthorities = spec.getAuthorities();
416+
} catch (IllegalArgumentException iae) {
417+
chc.conContext.fatal(Alert.DECODE_ERROR, "The distinguished " +
418+
"names of the peer's certificate authorities could " +
419+
"not be parsed", iae);
420+
}
402421
chc.handshakeExtensions.put(
403422
SSLExtension.CR_CERTIFICATE_AUTHORITIES, spec);
404423

0 commit comments

Comments
 (0)