Skip to content

Commit

Permalink
Merge pull request #505 from JasonFengJ9/mergetmp
Browse files Browse the repository at this point in the history 
Merge master jdk-11.0.15+10 into openj9-staging
  • Loading branch information
@keithc-ca
keithc-ca committed Apr 19, 2022
2 parents 7e6a135 + 7e96e10 commit 0a3e5f8
Show file tree
Hide file tree
Showing 64 changed files with 2,508 additions and 723 deletions.
39 changes: 26 additions & 13 deletions closed/GensrcJ9JCL.gmk
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# ===========================================================================
# (c) Copyright IBM Corp. 2020, 2021 All Rights Reserved
# (c) Copyright IBM Corp. 2020, 2022 All Rights Reserved
# ===========================================================================
# This code is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License version 2 only, as
Expand Down Expand Up @@ -47,26 +47,39 @@ ifeq (true,$(OPENJ9_ENABLE_OPENJDK_METHODHANDLES))
JPP_TAGS += OPENJDK_METHODHANDLES
endif # OPENJ9_ENABLE_OPENJDK_METHODHANDLES

$(J9JCL_SOURCES_DONEFILE) : $(AllJclSource) $(AllDdrSource)
@$(ECHO) Building OpenJ9 Java Preprocessor
@$(MKDIR) -p $(J9TOOLS_DIR)
$(MAKE) $(MAKE_ARGS) -C $(OPENJ9_TOPDIR)/sourcetools -f buildj9tools.mk \
BOOT_JDK=$(BOOT_JDK) \
DEST_DIR=$(call FixPath,$(J9TOOLS_DIR)) \
JAVA_HOME=$(BOOT_JDK) \
preprocessor
@$(ECHO) Generating J9JCL sources
# OpenJ9 CRIU only supports Linux, so we only need to consider the unix sub-directory.
OPENJDK_SOURCE_PROCESS_ENVIRONMENT := $(TOPDIR)/src/java.base/unix/classes/java/lang/ProcessEnvironment.java
OPENJDK_STAGED_PROCESS_ENVIRONMENT := $(patsubst $(TOPDIR)/%,$(SUPPORT_OUTPUTDIR)/overlay/%,$(OPENJDK_SOURCE_PROCESS_ENVIRONMENT))

$(OPENJDK_STAGED_PROCESS_ENVIRONMENT) : $(OPENJDK_SOURCE_PROCESS_ENVIRONMENT)
$(call install-file)

# invoke JPP to generate J9JCL sources
define jpp_generate_sources
@$(BOOT_JDK)/bin/java \
-cp "$(call FixPath,$(JPP_JAR))" \
-Dfile.encoding=US-ASCII \
com.ibm.jpp.commandline.CommandlineBuilder \
-verdict \
-baseDir "$(call FixPath,$(OPENJ9_TOPDIR))/" \
-baseDir "$(call FixPath,$1)/" \
-config JAVA$(VERSION_FEATURE) \
-srcRoot jcl/ \
-xml jpp_configuration.xml \
-srcRoot $2/ \
-xml "$(call FixPath,$(OPENJ9_TOPDIR)/jcl/jpp_configuration.xml)" \
-dest "$(call FixPath,$(J9JCL_SOURCES_DIR))" \
-tag:define "$(subst $(SPACE),;,$(sort $(JPP_TAGS)))"
endef

$(J9JCL_SOURCES_DONEFILE) : $(AllJclSource) $(AllDdrSource) $(OPENJDK_STAGED_PROCESS_ENVIRONMENT)
@$(ECHO) Building OpenJ9 Java Preprocessor
@$(MKDIR) -p $(J9TOOLS_DIR)
$(MAKE) $(MAKE_ARGS) -C $(OPENJ9_TOPDIR)/sourcetools -f buildj9tools.mk \
BOOT_JDK=$(BOOT_JDK) \
DEST_DIR=$(call FixPath,$(J9TOOLS_DIR)) \
JAVA_HOME=$(BOOT_JDK) \
preprocessor
@$(ECHO) Generating J9JCL sources
$(call jpp_generate_sources,$(call FixPath,$(OPENJ9_TOPDIR)),jcl)
$(call jpp_generate_sources,$(call FixPath,$(SUPPORT_OUTPUTDIR)),overlay)
ifeq (true,$(OPENJ9_ENABLE_DDR))
@$(ECHO) Generating DDR_VM sources
@$(BOOT_JDK)/bin/java \
Expand Down
3 changes: 1 addition & 2 deletions closed/custom/common/SetupJavaCompilers.gmk
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# ===========================================================================
# (c) Copyright IBM Corp. 2018, 2020 All Rights Reserved
# (c) Copyright IBM Corp. 2018, 2022 All Rights Reserved
# ===========================================================================
# This code is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License version 2 only, as
Expand All @@ -24,7 +24,6 @@ WARNING_MODULES := \
jdk.management \
openj9.dtfj \
openj9.dtfjview \
openj9.sharedclasses \
openj9.traceformat \
#

Expand Down
2 changes: 1 addition & 1 deletion closed/openjdk-tag.gmk
View file
Original file line number Diff line number Diff line change
@@ -1 +1 @@
OPENJDK_TAG := jdk-11.0.15+8
OPENJDK_TAG := jdk-11.0.15+10
8 changes: 6 additions & 2 deletions make/autoconf/flags-cflags.m4
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,10 @@
# questions.
#

# ===========================================================================
# (c) Copyright IBM Corp. 2022, 2022 All Rights Reserved
# ===========================================================================

################################################################################
#
# Setup flags for C/C++ compiler
Expand Down Expand Up @@ -528,10 +532,10 @@ AC_DEFUN([FLAGS_SETUP_CFLAGS_HELPER],
fi
elif test "x$TOOLCHAIN_TYPE" = xxlc; then
TOOLCHAIN_CFLAGS_JDK="-qchars=signed -qfullpath -qsaveopt" # add on both CFLAGS
TOOLCHAIN_CFLAGS_JDK="-qchars=signed -qfullpath -qsaveopt -qstackprotect" # add on both CFLAGS
TOOLCHAIN_CFLAGS_JVM="-qtune=balanced \
-qalias=noansi -qstrict -qtls=default -qlanglvl=c99vla \
-qlanglvl=noredefmac -qnortti -qnoeh -qignerrno"
-qlanglvl=noredefmac -qnortti -qnoeh -qignerrno -qstackprotect"
elif test "x$TOOLCHAIN_TYPE" = xmicrosoft; then
TOOLCHAIN_CFLAGS_JVM="-nologo -MD -MP"
TOOLCHAIN_CFLAGS_JDK="-nologo -MD -Zc:wchar_t-"
Expand Down
223 changes: 169 additions & 54 deletions src/java.base/macosx/classes/apple/security/KeychainStore.java
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2011, 2021, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2011, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -68,6 +68,25 @@ class TrustedCertEntry {

Certificate cert;
long certRef; // SecCertificateRef for this key

// Each KeyStore.TrustedCertificateEntry have 2 attributes:
// 1. "trustSettings" -> trustSettings.toString()
// 2. "2.16.840.1.113894.746875.1.1" -> trustedKeyUsageValue
// The 1st one is mainly for debugging use. The 2nd one is similar
// to the attribute with the same key in a PKCS12KeyStore.

// The SecTrustSettingsCopyTrustSettings() output for this certificate
// inside the KeyChain in its original array of CFDictionaryRef objects
// structure with values dumped as strings. For each trust, an extra
// entry "SecPolicyOid" is added whose value is the OID for this trust.
// The extra entries are used to construct trustedKeyUsageValue.
List<Map<String, String>> trustSettings;

// One or more OIDs defined in http://oidref.com/1.2.840.113635.100.1.
// It can also be "2.5.29.37.0" for a self-signed certificate with
// an empty trust settings. This value is never empty. When there are
// multiple OID values, it takes the form of "[1.1.1, 1.1.2]".
String trustedKeyUsageValue;
};

/**
Expand Down Expand Up @@ -310,6 +329,66 @@ public Certificate engineGetCertificate(String alias) {
}
}

private final class LocalAttr
implements KeyStore.Entry.Attribute {

private String name;
private String value;

public LocalAttr(String name, String value) {
this.name = name;
this.value = value;
}

@Override
public String getName() {
return name;
}

@Override
public String getValue() {
return value;
}

/**
* Calculates a hash code value for the object.
* Objects that are equal will also have the same hashcode.
*/
public int hashCode() {
return Objects.hash(name, value);
}

public boolean equals(Object obj) {
if (this == obj) return true;

if (!(obj instanceof LocalAttr)) {
return false;
}

LocalAttr other =
(LocalAttr) obj;
return (Objects.equals(name, other.getName()) &&
Objects.equals(value, other.getValue()));
}

}

@Override
public KeyStore.Entry engineGetEntry(String alias, KeyStore.ProtectionParameter protParam)
throws KeyStoreException, NoSuchAlgorithmException, UnrecoverableEntryException {
if (engineIsCertificateEntry(alias)) {
Object entry = entries.get(alias.toLowerCase());
if (entry instanceof TrustedCertEntry) {
TrustedCertEntry tEntry = (TrustedCertEntry)entry;
return new KeyStore.TrustedCertificateEntry(
tEntry.cert, Set.of(
new LocalAttr(KnownOIDs.ORACLE_TrustedKeyUsage.value(), tEntry.trustedKeyUsageValue),
new LocalAttr("trustSettings", tEntry.trustSettings.toString())));
}
}
return super.engineGetEntry(alias, protParam);
}

/**
* Returns the creation date of the entry identified by the given alias.
*
Expand Down Expand Up @@ -463,55 +542,12 @@ public void engineSetKeyEntry(String alias, byte[] key,
}

/**
* Assigns the given certificate to the given alias.
*
* <p>If the given alias already exists in this keystore and identifies a
* <i>trusted certificate entry</i>, the certificate associated with it is
* overridden by the given certificate.
*
* @param alias the alias name
* @param cert the certificate
*
* @exception KeyStoreException if the given alias already exists and does
* not identify a <i>trusted certificate entry</i>, or this operation
* fails for some other reason.
* Adding trusted certificate entry is not supported.
*/
public void engineSetCertificateEntry(String alias, Certificate cert)
throws KeyStoreException
{
permissionCheck();

synchronized(entries) {

Object entry = entries.get(alias.toLowerCase());
if ((entry != null) && (entry instanceof KeyEntry)) {
throw new KeyStoreException
("Cannot overwrite key entry with certificate");
}

// This will be slow, but necessary. Enumerate the values and then see if the cert matches the one in the trusted cert entry.
// Security framework doesn't support the same certificate twice in a keychain.
Collection<Object> allValues = entries.values();

for (Object value : allValues) {
if (value instanceof TrustedCertEntry) {
TrustedCertEntry tce = (TrustedCertEntry)value;
if (tce.cert.equals(cert)) {
throw new KeyStoreException("Keychain does not support mulitple copies of same certificate.");
}
}
}

TrustedCertEntry trustedCertEntry = new TrustedCertEntry();
trustedCertEntry.cert = cert;
trustedCertEntry.date = new Date();
String lowerAlias = alias.toLowerCase();
if (entries.get(lowerAlias) != null) {
deletedEntries.put(lowerAlias, entries.get(lowerAlias));
}
entries.put(lowerAlias, trustedCertEntry);
addedEntries.put(lowerAlias, trustedCertEntry);
}
throws KeyStoreException {
throw new KeyStoreException("Cannot set trusted certificate entry." +
" Use the macOS \"security add-trusted-cert\" command instead.");
}

/**
Expand Down Expand Up @@ -690,10 +726,7 @@ public void engineStore(OutputStream stream, char[] password)
String alias = e.nextElement();
Object entry = addedEntries.get(alias);
if (entry instanceof TrustedCertEntry) {
TrustedCertEntry tce = (TrustedCertEntry)entry;
Certificate certElem;
certElem = tce.cert;
tce.certRef = addCertificateToKeychain(alias, certElem);
// Cannot set trusted certificate entry
} else {
KeyEntry keyEntry = (KeyEntry)entry;

Expand Down Expand Up @@ -788,9 +821,28 @@ public void engineLoad(InputStream stream, char[] password)
private native void _scanKeychain();

/**
* Callback method from _scanKeychain. If a trusted certificate is found, this method will be called.
* Callback method from _scanKeychain. If a trusted certificate is found,
* this method will be called.
*
* inputTrust is a list of strings in groups. Each group contains key/value
* pairs for one trust setting and ends with a null. Thus the size of the
* whole list is (2 * s_1 + 1) + (2 * s_2 + 1) + ... + (2 * s_n + 1),
* where s_i is the size of mapping for the i'th trust setting,
* and n is the number of trust settings. Ex:
*
* key1 for trust1
* value1 for trust1
* ..
* null (end of trust1)
* key1 for trust2
* value1 for trust2
* ...
* null (end of trust2)
* ...
* null (end if trust_n)
*/
private void createTrustedCertEntry(String alias, long keychainItemRef, long creationDate, byte[] derStream) {
private void createTrustedCertEntry(String alias, List<String> inputTrust,
long keychainItemRef, long creationDate, byte[] derStream) {
TrustedCertEntry tce = new TrustedCertEntry();

try {
Expand All @@ -801,6 +853,69 @@ private void createTrustedCertEntry(String alias, long keychainItemRef, long cre
tce.cert = cert;
tce.certRef = keychainItemRef;

tce.trustSettings = new ArrayList<>();
Map<String,String> tmpMap = new LinkedHashMap<>();
for (int i = 0; i < inputTrust.size(); i++) {
if (inputTrust.get(i) == null) {
tce.trustSettings.add(tmpMap);
if (i < inputTrust.size() - 1) {
// Prepare an empty map for the next trust setting.
// Do not just clear(), must be a new object.
// Only create if not at end of list.
tmpMap = new LinkedHashMap<>();
}
} else {
tmpMap.put(inputTrust.get(i), inputTrust.get(i+1));
i++;
}
}

boolean isSelfSigned;
try {
cert.verify(cert.getPublicKey());
isSelfSigned = true;
} catch (Exception e) {
isSelfSigned = false;
}
if (tce.trustSettings.isEmpty()) {
if (isSelfSigned) {
// If a self-signed certificate has an empty trust settings,
// trust it for all purposes
tce.trustedKeyUsageValue = KnownOIDs.anyExtendedKeyUsage.value();
} else {
// Otherwise, return immediately. The certificate is not
// added into entries.
return;
}
} else {
List<String> values = new ArrayList<>();
for (var oneTrust : tce.trustSettings) {
var result = oneTrust.get("kSecTrustSettingsResult");
// https://developer.apple.com/documentation/security/sectrustsettingsresult?language=objc
// 1 = kSecTrustSettingsResultTrustRoot, 2 = kSecTrustSettingsResultTrustAsRoot
// If missing, a default value of kSecTrustSettingsResultTrustRoot is assumed
// for self-signed certificates (see doc for SecTrustSettingsCopyTrustSettings).
// Note that the same SecPolicyOid can appear in multiple trust settings
// for different kSecTrustSettingsAllowedError and/or kSecTrustSettingsPolicyString.
if ((result == null && isSelfSigned)
|| "1".equals(result) || "2".equals(result)) {
// When no kSecTrustSettingsPolicy, it means everything
String oid = oneTrust.getOrDefault("SecPolicyOid",
KnownOIDs.anyExtendedKeyUsage.value());
if (!values.contains(oid)) {
values.add(oid);
}
}
}
if (values.isEmpty()) {
return;
}
if (values.size() == 1) {
tce.trustedKeyUsageValue = values.get(0);
} else {
tce.trustedKeyUsageValue = values.toString();
}
}
// Make a creation date.
if (creationDate != 0)
tce.date = new Date(creationDate);
Expand Down

0 comments on commit 0a3e5f8

Please sign in to comment.