Skip to content

Commit 3349b52

Browse files
GoeLinGoeLin
authored
Merge branch 'master' into goetz_backport_8342075
2 parents 211a455 + 32fa287 commit 3349b52

File tree

55 files changed

+1760
-1464
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+1760
-1464
lines changed

‎.github/actions/do-build/action.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#
2-
# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
2+
# Copyright (c) 2022, 2025, Oracle and/or its affiliates. All rights reserved.
33
# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
#
55
# This code is free software; you can redistribute it and/or modify it
@@ -42,7 +42,7 @@ runs:
4242
- name: 'Build'
4343
id: build
4444
run: >
45-
make LOG=info ${{ inputs.make-target }}
45+
make -k LOG=info ${{ inputs.make-target }}
4646
|| bash ./.github/scripts/gen-build-failure-report.sh "$GITHUB_STEP_SUMMARY"
4747
shell: bash
4848

‎.github/workflows/build-cross-compile.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -60,26 +60,26 @@ jobs:
6060
gnu-arch: aarch64
6161
debian-arch: arm64
6262
debian-repository: https://httpredir.debian.org/debian/
63-
debian-version: bullseye
63+
debian-version: bookworm
6464
tolerate-sysroot-errors: false
6565
- target-cpu: arm
6666
gnu-arch: arm
6767
debian-arch: armhf
6868
debian-repository: https://httpredir.debian.org/debian/
69-
debian-version: bullseye
69+
debian-version: bookworm
7070
tolerate-sysroot-errors: false
7171
gnu-abi: eabihf
7272
- target-cpu: s390x
7373
gnu-arch: s390x
7474
debian-arch: s390x
7575
debian-repository: https://httpredir.debian.org/debian/
76-
debian-version: bullseye
76+
debian-version: bookworm
7777
tolerate-sysroot-errors: false
7878
- target-cpu: ppc64le
7979
gnu-arch: powerpc64le
8080
debian-arch: ppc64el
8181
debian-repository: https://httpredir.debian.org/debian/
82-
debian-version: bullseye
82+
debian-version: bookworm
8383
tolerate-sysroot-errors: false
8484
- target-cpu: riscv64
8585
gnu-arch: riscv64

‎make/autoconf/flags-cflags.m4

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -316,7 +316,7 @@ AC_DEFUN([FLAGS_SETUP_OPTIMIZATION],
316316
C_O_FLAG_DEBUG="-Od"
317317
C_O_FLAG_DEBUG_JVM=""
318318
C_O_FLAG_NONE="-Od"
319-
C_O_FLAG_SIZE="-Os"
319+
C_O_FLAG_SIZE="-O1"
320320
fi
321321
322322
# Now copy to C++ flags

‎src/java.base/share/classes/sun/security/ssl/CertificateAuthoritiesExtension.java

Lines changed: 24 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2022, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -122,8 +122,11 @@ private static List<byte[]> getEncodedAuthorities(
122122
return authorities;
123123
}
124124

125+
// This method will throw IllegalArgumentException if the
126+
// X500Principal cannot be parsed.
125127
X500Principal[] getAuthorities() {
126128
X500Principal[] principals = new X500Principal[authorities.size()];
129+
127130
int i = 0;
128131
for (byte[] encoded : authorities) {
129132
principals[i++] = new X500Principal(encoded);
@@ -138,8 +141,12 @@ public String toString() {
138141
"\"certificate authorities\": '['\n{0}']'", Locale.ENGLISH);
139142
StringBuilder builder = new StringBuilder(512);
140143
for (byte[] encoded : authorities) {
141-
X500Principal principal = new X500Principal(encoded);
142-
builder.append(principal.toString());
144+
try {
145+
X500Principal principal = new X500Principal(encoded);
146+
builder.append(principal.toString());
147+
} catch (IllegalArgumentException iae) {
148+
builder.append("unparseable distinguished name: " + iae);
149+
}
143150
builder.append("\n");
144151
}
145152
Object[] messageFields = {
@@ -277,7 +284,13 @@ public void consume(ConnectionContext context,
277284
new CertificateAuthoritiesSpec(shc, buffer);
278285

279286
// Update the context.
280-
shc.peerSupportedAuthorities = spec.getAuthorities();
287+
try {
288+
shc.peerSupportedAuthorities = spec.getAuthorities();
289+
} catch (IllegalArgumentException iae) {
290+
shc.conContext.fatal(Alert.DECODE_ERROR, "The distinguished " +
291+
"names of the peer's certificate authorities could " +
292+
"not be parsed", iae);
293+
}
281294
shc.handshakeExtensions.put(
282295
SSLExtension.CH_CERTIFICATE_AUTHORITIES, spec);
283296

@@ -398,7 +411,13 @@ public void consume(ConnectionContext context,
398411
new CertificateAuthoritiesSpec(chc, buffer);
399412

400413
// Update the context.
401-
chc.peerSupportedAuthorities = spec.getAuthorities();
414+
try {
415+
chc.peerSupportedAuthorities = spec.getAuthorities();
416+
} catch (IllegalArgumentException iae) {
417+
chc.conContext.fatal(Alert.DECODE_ERROR, "The distinguished " +
418+
"names of the peer's certificate authorities could " +
419+
"not be parsed", iae);
420+
}
402421
chc.handshakeExtensions.put(
403422
SSLExtension.CR_CERTIFICATE_AUTHORITIES, spec);
404423

‎src/java.base/share/classes/sun/security/ssl/CertificateMessage.java

Lines changed: 14 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1042,46 +1042,22 @@ private static SSLPossession choosePossession(
10421042
return null;
10431043
}
10441044

1045-
Collection<String> checkedKeyTypes = new HashSet<>();
1046-
List<String> supportedKeyTypes = new ArrayList<>();
1047-
for (SignatureScheme ss : hc.peerRequestedCertSignSchemes) {
1048-
if (checkedKeyTypes.contains(ss.keyAlgorithm)) {
1049-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
1050-
SSLLogger.warning(
1051-
"Unsupported authentication scheme: " + ss.name);
1052-
}
1053-
continue;
1054-
}
1055-
checkedKeyTypes.add(ss.keyAlgorithm);
1056-
1057-
// Don't select a signature scheme unless we will be able to
1058-
// produce a CertificateVerify message later
1059-
if (SignatureScheme.getPreferableAlgorithm(
1060-
hc.algorithmConstraints,
1061-
hc.peerRequestedSignatureSchemes,
1062-
ss, hc.negotiatedProtocol) == null) {
1063-
1064-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
1065-
SSLLogger.warning(
1066-
"Unable to produce CertificateVerify for " +
1067-
"signature scheme: " + ss.name);
1068-
}
1069-
continue;
1070-
}
1071-
1072-
X509Authentication ka = X509Authentication.valueOf(ss);
1073-
if (ka == null) {
1074-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
1075-
SSLLogger.warning(
1076-
"Unsupported authentication scheme: " + ss.name);
1077-
}
1078-
continue;
1079-
}
1080-
supportedKeyTypes.add(ss.keyAlgorithm);
1081-
}
1045+
String[] supportedKeyTypes = hc.peerRequestedCertSignSchemes
1046+
.stream()
1047+
.map(ss -> ss.keyAlgorithm)
1048+
.distinct()
1049+
.filter(ka -> SignatureScheme.getPreferableAlgorithm( // Don't select a signature scheme unless
1050+
hc.algorithmConstraints, // we will be able to produce
1051+
hc.peerRequestedSignatureSchemes, // a CertificateVerify message later
1052+
ka, hc.negotiatedProtocol) != null
1053+
|| SSLLogger.logWarning("ssl,handshake",
1054+
"Unable to produce CertificateVerify for key algorithm: " + ka))
1055+
.filter(ka -> X509Authentication.valueOfKeyAlgorithm(ka) != null
1056+
|| SSLLogger.logWarning("ssl,handshake", "Unsupported key algorithm: " + ka))
1057+
.toArray(String[]::new);
10821058

10831059
SSLPossession pos = X509Authentication
1084-
.createPossession(hc, supportedKeyTypes.toArray(String[]::new));
1060+
.createPossession(hc, supportedKeyTypes);
10851061
if (pos == null) {
10861062
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
10871063
SSLLogger.warning("No available authentication scheme");

‎src/java.base/share/classes/sun/security/ssl/CertificateRequest.java

Lines changed: 64 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2015, 2021, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2015, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -32,9 +32,7 @@
3232
import java.text.MessageFormat;
3333
import java.util.ArrayList;
3434
import java.util.Arrays;
35-
import java.util.Collection;
3635
import java.util.Collections;
37-
import java.util.HashSet;
3836
import java.util.LinkedList;
3937
import java.util.List;
4038
import java.util.Locale;
@@ -205,9 +203,12 @@ String[] getKeyTypes() {
205203
return ClientCertificateType.getKeyTypes(types);
206204
}
207205

206+
// This method will throw IllegalArgumentException if the
207+
// X500Principal cannot be parsed.
208208
X500Principal[] getAuthorities() {
209209
X500Principal[] principals = new X500Principal[authorities.size()];
210210
int i = 0;
211+
211212
for (byte[] encoded : authorities) {
212213
principals[i++] = new X500Principal(encoded);
213214
}
@@ -260,8 +261,12 @@ public String toString() {
260261

261262
List<String> authorityNames = new ArrayList<>(authorities.size());
262263
for (byte[] encoded : authorities) {
263-
X500Principal principal = new X500Principal(encoded);
264-
authorityNames.add(principal.toString());
264+
try {
265+
X500Principal principal = new X500Principal(encoded);
266+
authorityNames.add(principal.toString());
267+
} catch (IllegalArgumentException iae) {
268+
authorityNames.add("unparseable distinguished name: " + iae);
269+
}
265270
}
266271
Object[] messageFields = {
267272
typeNames,
@@ -376,12 +381,23 @@ public void consume(ConnectionContext context,
376381

377382
X509ExtendedKeyManager km = chc.sslContext.getX509KeyManager();
378383
String clientAlias = null;
379-
if (chc.conContext.transport instanceof SSLSocketImpl) {
380-
clientAlias = km.chooseClientAlias(crm.getKeyTypes(),
381-
crm.getAuthorities(), (SSLSocket)chc.conContext.transport);
382-
} else if (chc.conContext.transport instanceof SSLEngineImpl) {
383-
clientAlias = km.chooseEngineClientAlias(crm.getKeyTypes(),
384-
crm.getAuthorities(), (SSLEngine)chc.conContext.transport);
384+
385+
try {
386+
if (chc.conContext.transport instanceof SSLSocketImpl) {
387+
clientAlias = km.chooseClientAlias(crm.getKeyTypes(),
388+
crm.getAuthorities(),
389+
(SSLSocket) chc.conContext.transport);
390+
} else if (chc.conContext.transport instanceof SSLEngineImpl) {
391+
clientAlias =
392+
km.chooseEngineClientAlias(crm.getKeyTypes(),
393+
crm.getAuthorities(),
394+
(SSLEngine) chc.conContext.transport);
395+
}
396+
} catch (IllegalArgumentException iae) {
397+
chc.conContext.fatal(Alert.DECODE_ERROR,
398+
"The distinguished names of the peer's "
399+
+ "certificate authorities could not be parsed",
400+
iae);
385401
}
386402

387403

@@ -518,9 +534,12 @@ String[] getKeyTypes() {
518534
return ClientCertificateType.getKeyTypes(types);
519535
}
520536

537+
// This method will throw IllegalArgumentException if the
538+
// X500Principal cannot be parsed.
521539
X500Principal[] getAuthorities() {
522540
X500Principal[] principals = new X500Principal[authorities.size()];
523541
int i = 0;
542+
524543
for (byte[] encoded : authorities) {
525544
principals[i++] = new X500Principal(encoded);
526545
}
@@ -584,8 +603,13 @@ public String toString() {
584603

585604
List<String> authorityNames = new ArrayList<>(authorities.size());
586605
for (byte[] encoded : authorities) {
587-
X500Principal principal = new X500Principal(encoded);
588-
authorityNames.add(principal.toString());
606+
try {
607+
X500Principal principal = new X500Principal(encoded);
608+
authorityNames.add(principal.toString());
609+
} catch (IllegalArgumentException iae) {
610+
authorityNames.add("unparseable distinguished name: " +
611+
iae);
612+
}
589613
}
590614
Object[] messageFields = {
591615
typeNames,
@@ -723,8 +747,13 @@ public void consume(ConnectionContext context,
723747
chc.peerRequestedSignatureSchemes = sss;
724748
chc.peerRequestedCertSignSchemes = sss; // use the same schemes
725749
chc.handshakeSession.setPeerSupportedSignatureAlgorithms(sss);
726-
chc.peerSupportedAuthorities = crm.getAuthorities();
727-
750+
try {
751+
chc.peerSupportedAuthorities = crm.getAuthorities();
752+
} catch (IllegalArgumentException iae) {
753+
chc.conContext.fatal(Alert.DECODE_ERROR, "The "
754+
+ "distinguished names of the peer's certificate "
755+
+ "authorities could not be parsed", iae);
756+
}
728757
// For TLS 1.2, we no longer use the certificate_types field
729758
// from the CertificateRequest message to directly determine
730759
// the SSLPossession. Instead, the choosePossession method
@@ -760,59 +789,28 @@ private static SSLPossession choosePossession(HandshakeContext hc,
760789
crKeyTypes.add("RSASSA-PSS");
761790
}
762791

763-
Collection<String> checkedKeyTypes = new HashSet<>();
764-
List<String> supportedKeyTypes = new ArrayList<>();
765-
for (SignatureScheme ss : hc.peerRequestedCertSignSchemes) {
766-
if (checkedKeyTypes.contains(ss.keyAlgorithm)) {
767-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
768-
SSLLogger.warning(
769-
"Unsupported authentication scheme: " + ss.name);
770-
}
771-
continue;
772-
}
773-
checkedKeyTypes.add(ss.keyAlgorithm);
774-
775-
// Don't select a signature scheme unless we will be able to
776-
// produce a CertificateVerify message later
777-
if (SignatureScheme.getPreferableAlgorithm(
778-
hc.algorithmConstraints,
779-
hc.peerRequestedSignatureSchemes,
780-
ss, hc.negotiatedProtocol) == null) {
781-
782-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
783-
SSLLogger.warning(
784-
"Unable to produce CertificateVerify for " +
785-
"signature scheme: " + ss.name);
786-
}
787-
continue;
788-
}
789-
790-
X509Authentication ka = X509Authentication.valueOf(ss);
791-
if (ka == null) {
792-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
793-
SSLLogger.warning(
794-
"Unsupported authentication scheme: " + ss.name);
795-
}
796-
continue;
797-
} else {
798-
// Any auth object will have a set of allowed key types.
799-
// This set should share at least one common algorithm with
800-
// the CR's allowed key types.
801-
if (Collections.disjoint(crKeyTypes,
802-
Arrays.asList(ka.keyTypes))) {
803-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
804-
SSLLogger.warning(
805-
"Unsupported authentication scheme: " +
806-
ss.name);
807-
}
808-
continue;
809-
}
810-
}
811-
supportedKeyTypes.add(ss.keyAlgorithm);
812-
}
792+
String[] supportedKeyTypes = hc.peerRequestedCertSignSchemes
793+
.stream()
794+
.map(ss -> ss.keyAlgorithm)
795+
.distinct()
796+
.filter(ka -> SignatureScheme.getPreferableAlgorithm( // Don't select a signature scheme unless
797+
hc.algorithmConstraints, // we will be able to produce
798+
hc.peerRequestedSignatureSchemes, // a CertificateVerify message later
799+
ka, hc.negotiatedProtocol) != null
800+
|| SSLLogger.logWarning("ssl,handshake",
801+
"Unable to produce CertificateVerify for key algorithm: " + ka))
802+
.filter(ka -> {
803+
var xa = X509Authentication.valueOfKeyAlgorithm(ka);
804+
// Any auth object will have a set of allowed key types.
805+
// This set should share at least one common algorithm with
806+
// the CR's allowed key types.
807+
return xa != null && !Collections.disjoint(crKeyTypes, Arrays.asList(xa.keyTypes))
808+
|| SSLLogger.logWarning("ssl,handshake", "Unsupported key algorithm: " + ka);
809+
})
810+
.toArray(String[]::new);
813811

814812
SSLPossession pos = X509Authentication
815-
.createPossession(hc, supportedKeyTypes.toArray(String[]::new));
813+
.createPossession(hc, supportedKeyTypes);
816814
if (pos == null) {
817815
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
818816
SSLLogger.warning("No available authentication scheme");

‎src/java.base/share/classes/sun/security/ssl/SSLLogger.java

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -210,6 +210,15 @@ static String toString(Object... params) {
210210
}
211211
}
212212

213+
// Logs a warning message and always returns false. This method
214+
// can be used as an OR Predicate to add a log in a stream filter.
215+
public static boolean logWarning(String option, String s) {
216+
if (SSLLogger.isOn && SSLLogger.isOn(option)) {
217+
SSLLogger.warning(s);
218+
}
219+
return false;
220+
}
221+
213222
private static class SSLConsoleLogger implements Logger {
214223
private final String loggerName;
215224
private final boolean useCompactFormat;

0 commit comments

Comments
 (0)