Skip to content

Commit

Permalink
8284105: Update security libraries to use sealed classes
Browse files Browse the repository at this point in the history
Reviewed-by: darcy, weijun, xuelei
  • Loading branch information
seanjmullan committed Apr 11, 2022
1 parent 470a668 commit dc6ec2a
Show file tree
Hide file tree
Showing 23 changed files with 101 additions and 89 deletions.
4 changes: 2 additions & 2 deletions make/jdk/src/classes/build/tools/intpoly/FieldGen.java
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -614,7 +614,7 @@ private String generate(FieldParams params) throws IOException {
}
result.appendLine("import java.math.BigInteger;");

result.appendLine("public class " + params.getClassName()
result.appendLine("public final class " + params.getClassName()
+ " extends " + this.parentName + " {");
result.incrIndent();

Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 1997, 2021, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 1997, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -54,7 +54,7 @@
* @since 1.2
*/

public abstract class JavaKeyStore extends KeyStoreSpi {
public abstract sealed class JavaKeyStore extends KeyStoreSpi {

// regular JKS
public static final class JKS extends JavaKeyStore {
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2000, 2021, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -50,7 +50,7 @@
* @author Yassir Elley
*/

public abstract class Builder {
abstract class Builder {

private static final Debug debug = Debug.getInstance("certpath");
private Set<String> matchingPolicies;
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2000, 2021, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -59,7 +59,7 @@
* @author Yassir Elley
* @author Sean Mullan
*/
class ForwardBuilder extends Builder {
final class ForwardBuilder extends Builder {

private static final Debug debug = Debug.getInstance("certpath");
private final Set<X509Certificate> trustedCerts;
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -47,7 +47,7 @@
//@@@ Note: this class is not in public API and access to adjacency list is
//@@@ intended for debugging/replay of Sun PKIX CertPathBuilder implementation.

public class SunCertPathBuilderResult extends PKIXCertPathBuilderResult {
public final class SunCertPathBuilderResult extends PKIXCertPathBuilderResult {

private static final Debug debug = Debug.getInstance("certpath");

Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -46,7 +46,7 @@
* @author Sean Mullan
* @since 1.4
*/
public class Vertex {
final class Vertex {

private static final Debug debug = Debug.getInstance("certpath");
private X509Certificate cert;
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -47,7 +47,7 @@
* @since 1.5
* @author Andreas Sterbenz
*/
public abstract class RSAKeyPairGenerator extends KeyPairGeneratorSpi {
abstract class RSAKeyPairGenerator extends KeyPairGeneratorSpi {

private static final BigInteger SQRT_2048;
private static final BigInteger SQRT_3072;
Expand Down
46 changes: 4 additions & 42 deletions src/java.base/share/classes/sun/security/rsa/RSASignature.java
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -47,7 +47,7 @@
* @since 1.5
* @author Andreas Sterbenz
*/
public abstract class RSASignature extends SignatureSpi {
abstract class RSASignature extends SignatureSpi {

// we sign an ASN.1 SEQUENCE of AlgorithmId and digest
// it has the form 30:xx:30:xx:[digestOID]:05:00:04:xx:[digest]
Expand Down Expand Up @@ -188,7 +188,7 @@ protected byte[] engineSign() throws SignatureException {
}
byte[] digest = getDigestValue();
try {
byte[] encoded = encodeSignature(digestOID, digest);
byte[] encoded = RSAUtil.encodeSignature(digestOID, digest);
byte[] padded = padding.pad(encoded);
byte[] encrypted = RSACore.rsa(padded, privateKey, true);
return encrypted;
Expand All @@ -215,7 +215,7 @@ protected boolean engineVerify(byte[] sigBytes) throws SignatureException {
byte[] digest = getDigestValue();
byte[] decrypted = RSACore.rsa(sigBytes, publicKey);
byte[] unpadded = padding.unpad(decrypted);
byte[] decodedDigest = decodeSignature(digestOID, unpadded);
byte[] decodedDigest = RSAUtil.decodeSignature(digestOID, unpadded);
return MessageDigest.isEqual(digest, decodedDigest);
} catch (javax.crypto.BadPaddingException e) {
// occurs if the app has used the wrong RSA public key
Expand All @@ -230,44 +230,6 @@ protected boolean engineVerify(byte[] sigBytes) throws SignatureException {
}
}

/**
* Encode the digest, return the to-be-signed data.
* Also used by the PKCS#11 provider.
*/
public static byte[] encodeSignature(ObjectIdentifier oid, byte[] digest)
throws IOException {
DerOutputStream out = new DerOutputStream();
new AlgorithmId(oid).encode(out);
out.putOctetString(digest);
DerValue result =
new DerValue(DerValue.tag_Sequence, out.toByteArray());
return result.toByteArray();
}

/**
* Decode the signature data. Verify that the object identifier matches
* and return the message digest.
*/
public static byte[] decodeSignature(ObjectIdentifier oid, byte[] sig)
throws IOException {
// Enforce strict DER checking for signatures
DerInputStream in = new DerInputStream(sig, 0, sig.length, false);
DerValue[] values = in.getSequence(2);
if ((values.length != 2) || (in.available() != 0)) {
throw new IOException("SEQUENCE length error");
}
AlgorithmId algId = AlgorithmId.parse(values[0]);
if (algId.getOID().equals(oid) == false) {
throw new IOException("ObjectIdentifier mismatch: "
+ algId.getOID());
}
if (algId.getEncodedParams() != null) {
throw new IOException("Unexpected AlgorithmId parameters");
}
byte[] digest = values[1].getOctetString();
return digest;
}

// set parameter, not supported. See JCA doc
@Deprecated
@Override
Expand Down
44 changes: 43 additions & 1 deletion src/java.base/share/classes/sun/security/rsa/RSAUtil.java
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2018, 2021, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand All @@ -25,8 +25,12 @@

package sun.security.rsa;

import java.io.IOException;
import java.security.*;
import java.security.spec.*;
import sun.security.util.DerInputStream;
import sun.security.util.DerOutputStream;
import sun.security.util.DerValue;
import sun.security.util.ObjectIdentifier;
import sun.security.x509.AlgorithmId;

Expand Down Expand Up @@ -161,4 +165,42 @@ public static Object[] getTypeAndParamSpec(AlgorithmId algid)
result[1] = getParamSpec(algid.getParameters());
return result;
}

/**
* Encode the digest, return the to-be-signed data.
* Also used by the PKCS#11 provider.
*/
public static byte[] encodeSignature(ObjectIdentifier oid, byte[] digest)
throws IOException {
DerOutputStream out = new DerOutputStream();
new AlgorithmId(oid).encode(out);
out.putOctetString(digest);
DerValue result =
new DerValue(DerValue.tag_Sequence, out.toByteArray());
return result.toByteArray();
}

/**
* Decode the signature data. Verify that the object identifier matches
* and return the message digest.
*/
public static byte[] decodeSignature(ObjectIdentifier oid, byte[] sig)
throws IOException {
// Enforce strict DER checking for signatures
DerInputStream in = new DerInputStream(sig, 0, sig.length, false);
DerValue[] values = in.getSequence(2);
if ((values.length != 2) || (in.available() != 0)) {
throw new IOException("SEQUENCE length error");
}
AlgorithmId algId = AlgorithmId.parse(values[0]);
if (algId.getOID().equals(oid) == false) {
throw new IOException("ObjectIdentifier mismatch: "
+ algId.getOID());
}
if (algId.getEncodedParams() != null) {
throw new IOException("Unexpected AlgorithmId parameters");
}
byte[] digest = values[1].getOctetString();
return digest;
}
}
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -99,7 +99,7 @@
* @see Timestamper
*/

public class TSResponse {
public final class TSResponse {

// Status codes (from RFC 3161)

Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -61,7 +61,14 @@
*
*/

public abstract class IntegerPolynomial implements IntegerFieldModuloP {
public abstract sealed class IntegerPolynomial implements IntegerFieldModuloP
permits IntegerPolynomial1305, IntegerPolynomial25519,
IntegerPolynomial448, IntegerPolynomialP256,
IntegerPolynomialP384, IntegerPolynomialP521,
IntegerPolynomialModBinP, P256OrderField,
P384OrderField, P521OrderField,
sun.security.util.math.intpoly.Curve25519OrderField,
sun.security.util.math.intpoly.Curve448OrderField {

protected static final BigInteger TWO = BigInteger.valueOf(2);

Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -35,7 +35,7 @@
* The representation uses 5 signed long values.
*/

public class IntegerPolynomial1305 extends IntegerPolynomial {
public final class IntegerPolynomial1305 extends IntegerPolynomial {

protected static final int SUBTRAHEND = 5;
protected static final int NUM_LIMBS = 5;
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -32,7 +32,7 @@
* The representation uses 10 signed long values.
*/

public class IntegerPolynomial25519 extends IntegerPolynomial {
public final class IntegerPolynomial25519 extends IntegerPolynomial {

private static final int POWER = 255;
private static final int SUBTRAHEND = 19;
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -32,7 +32,7 @@
* The representation uses 16 signed long values.
*/

public class IntegerPolynomial448 extends IntegerPolynomial {
public final class IntegerPolynomial448 extends IntegerPolynomial {

private static final int POWER = 448;
private static final int NUM_LIMBS = 16;
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2020, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -38,7 +38,7 @@
* This class may only be used for primes of the form 2^a + b.
*/

public class IntegerPolynomialModBinP extends IntegerPolynomial {
public sealed class IntegerPolynomialModBinP extends IntegerPolynomial {

private final long[] reduceLimbs;
private final int bitOffset;
Expand Down Expand Up @@ -206,7 +206,7 @@ protected void square(long[] a, long[] r) {
/**
* The field of integers modulo the order of the Curve25519 subgroup
*/
public static class Curve25519OrderField extends IntegerPolynomialModBinP {
public final static class Curve25519OrderField extends IntegerPolynomialModBinP {

public Curve25519OrderField() {
super(26, 10, 252,
Expand All @@ -217,7 +217,7 @@ public Curve25519OrderField() {
/**
* The field of integers modulo the order of the Curve448 subgroup
*/
public static class Curve448OrderField extends IntegerPolynomialModBinP {
public final static class Curve448OrderField extends IntegerPolynomialModBinP {

public Curve448OrderField() {
super(28, 16, 446,
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2002, 2021, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2002, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
Expand Down Expand Up @@ -83,7 +83,7 @@
*
* @author Andreas Sterbenz
*/
public abstract class Validator {
public abstract sealed class Validator permits PKIXValidator, SimpleValidator {

static final X509Certificate[] CHAIN0 = {};

Expand Down
Loading

1 comment on commit dc6ec2a

@openjdk-notifier
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please sign in to comment.