8259401: Add checking to jarsigner to warn weak algorithms used in signer’s cert chain #2042

haimaychao · 2021-01-12T03:34:00Z

The jarsigner tool currently provides warning associated with the signer’s cert when it uses weak algorithms, but not for the CA certs. This change is to process the signer’s cert chain to warn if CA certs use weak algorithms.

Progress

Change must not contain extraneous whitespace
Commit message must refer to an issue
Change must be properly reviewed

Issue

JDK-8259401: Add checking to jarsigner to warn weak algorithms used in signer’s cert chain

Reviewers

Sean Mullan (@seanjmullan - Reviewer) ⚠️ Review applies to 5a3e184
Weijun Wang (@wangweij - Reviewer) ⚠️ Review applies to 5a3e184
Rajan Halade (@rhalade - Reviewer) ⚠️ Review applies to 5a3e184

Download

$ git fetch https://git.openjdk.java.net/jdk pull/2042/head:pull/2042
$ git checkout pull/2042

…gner’s cert chain

bridgekeeper · 2021-01-12T03:34:56Z

👋 Welcome back hchao! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2021-01-12T03:36:19Z

@haimaychao The following labels will be automatically applied to this pull request:

compiler
core-libs
security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing lists. If you would like to change these labels, use the /label pull request command.

mlbridge · 2021-01-12T03:39:21Z

Webrevs

AlanBateman · 2021-01-12T08:35:16Z

/label remove core-libs

openjdk · 2021-01-12T08:35:53Z

@AlanBateman
The core-libs label was successfully removed.

haimaychao · 2021-01-12T18:15:49Z

/label remove compiler

openjdk · 2021-01-12T18:16:04Z

@haimaychao
The compiler label was successfully removed.

seanjmullan · 2021-01-12T20:37:25Z

src/jdk.jartool/share/classes/sun/security/tools/jarsigner/Main.java

@@ -1401,6 +1401,35 @@ private void checkWeakSign(PrivateKey key) {
        }
    }

+    private String checkWeakKey(PublicKey key) {


Can this method be static?

static added.

seanjmullan · 2021-01-12T20:38:30Z

src/jdk.jartool/share/classes/sun/security/tools/jarsigner/Main.java

+        }
+    }
+
+    private String checkWeakAlg(String alg) {


Can this method be static?

static added.

seanjmullan · 2021-01-12T20:57:21Z

src/jdk.jartool/share/classes/sun/security/tools/jarsigner/Main.java

+            // weak algorithms are used, and provide warnings as needed.
+            certStr.append("\n").append(tab)
+                    .append("Signature algorithm: ")
+                    .append(checkWeakAlg(sigalg))


If the cert is trusted, I don't think we should print a warning if the signature algorithm is weak. Otherwise this will generate false warnings for SHA-1 roots which are not an issue. You should check the key size though. And you can still print the signature algorithm. You may need to move line 1489-1490 before this to first determine if the cert is trusted.

Fixed to not check the signature algorithm for a trusted cert, and updated the test accordingly.

rhalade · 2021-01-12T22:22:55Z

test/jdk/sun/security/tools/jarsigner/CheckSignerCertChain.java

+
+    public static void main(String[] args) throws Exception {
+
+        // root certificate using SHA1withRSA and 1024-bit key


It will be helpful to have these comments logged as debug messages with System.out

comment messages added.

haimaychao · 2021-01-13T01:15:34Z

Thanks for your review, Sean and Rajan. I've updated the webrev with your comments.

wangweij · 2021-01-13T15:13:52Z

src/jdk.jartool/share/classes/sun/security/tools/jarsigner/Main.java

            if (trustedCerts.contains(x509Cert)) {
+                // If the cert is trusted, only check its key size, but not its
+                // signature algorithm. This is because warning should not be
+                // generated for SHA-1 roots which are not an issue.


SHA-1 is just a glitch in the long history at this very moment, and thus I think it's inappropriate to mention it in the source code. In my opinion, the general reason we don't check the signature is that we trust its origin anyway and we don't verify the signature at all (do we?). On the other hand, since its key is used to sign other certs, we need to make sure the key size is big enough so that no one else is able to recover the key and use it to sign other certs.

Yes, I would remove the 2nd sentence that starts with "This is ...". There are plenty of references on the Internet which explain this, so no need to add much detail.

wangweij · 2021-01-13T15:17:22Z

src/jdk.jartool/share/classes/sun/security/tools/jarsigner/Main.java

+                        .append(rb.getString("COMMA"))
+                        .append(checkWeakKey(key));
+
+                certStr.append("\n").append(tab).append("[");


It's a little strange to leave the other half of the bracket (certStr.append("]"); on line 1568) outside the if-else block. Can you please move it inside? Of course you will have to duplicate them.

I'd prefer to keep it as is instead of duplicating the code in several places inside if block and else block.

haimaychao · 2021-01-13T22:17:10Z

Thanks for the review, Max. The comment about trusted cert's sigalg checking has been removed.

openjdk · 2021-01-13T22:18:35Z

@haimaychao This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8259401: Add checking to jarsigner to warn weak algorithms used in signer’s cert chain

Reviewed-by: mullan, weijun, rhalade

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 44 new commits pushed to the master branch:

ccdf171: 8259377: Shenandoah: Enhance weak reference processing time tracking
916ab4e: 8259283: use new HtmlId and HtmlIds classes
5df2a94: 8212035: merge jdk.test.lib.util.SimpleHttpServer with jaxp.library.SimpleHttpServer
535f2da: 8259486: Replace PreserveExceptionMark with implementation for CautiouslyPreserveExceptionMark
ce94512: 8259619: C1: 3-arg StubAssembler::call_RT stack-use condition is incorrect
2e12454: 8259580: Shenandoah: uninitialized label in VerifyThreadGCState
77ca103: 8257236: can't use var with a class named Z
2243a17: 8259485: Document need for short paths when building on Windows
139b6da: 8259372: remove AIX related USE_LIBRARY_BASED_TLS_ONLY and THREAD_LOCAL special handling
a483869: 8225045: javax/swing/JInternalFrame/8146321/JInternalFrameIconTest.java fails on linux-x64
... and 34 more: https://git.openjdk.java.net/jdk/compare/cd73939b794320d92d45e00b220fd953d83183cf...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

As you do not have Committer status in this project an existing Committer must agree to sponsor your change. Possible candidates are the reviewers of this PR (@seanjmullan, @wangweij, @rhalade) but any other Committer may sponsor as well.

➡️ To flag this PR as ready for integration with the above commit message, type /integrate in a new comment. (Afterwards, your sponsor types /sponsor in a new comment to perform the integration).

haimaychao · 2021-01-13T22:21:46Z

/integrate

openjdk · 2021-01-13T22:22:16Z

@haimaychao
Your change (at version 88d94df) is now ready to be sponsored by a Committer.

wangweij · 2021-01-13T22:32:16Z

/sponsor

openjdk · 2021-01-13T22:32:59Z

@wangweij @haimaychao Since your change was applied there have been 44 commits pushed to the master branch:

ccdf171: 8259377: Shenandoah: Enhance weak reference processing time tracking
916ab4e: 8259283: use new HtmlId and HtmlIds classes
5df2a94: 8212035: merge jdk.test.lib.util.SimpleHttpServer with jaxp.library.SimpleHttpServer
535f2da: 8259486: Replace PreserveExceptionMark with implementation for CautiouslyPreserveExceptionMark
ce94512: 8259619: C1: 3-arg StubAssembler::call_RT stack-use condition is incorrect
2e12454: 8259580: Shenandoah: uninitialized label in VerifyThreadGCState
77ca103: 8257236: can't use var with a class named Z
2243a17: 8259485: Document need for short paths when building on Windows
139b6da: 8259372: remove AIX related USE_LIBRARY_BASED_TLS_ONLY and THREAD_LOCAL special handling
a483869: 8225045: javax/swing/JInternalFrame/8146321/JInternalFrameIconTest.java fails on linux-x64
... and 34 more: https://git.openjdk.java.net/jdk/compare/cd73939b794320d92d45e00b220fd953d83183cf...master

Your commit was automatically rebased without conflicts.

Pushed as commit c7e2174.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

8259401: Add checking to jarsigner to warn weak algorithms used in si…

eb4f93e

…gner’s cert chain

openjdk bot added the rfr Pull request is ready for review label Jan 12, 2021

openjdk bot added security security-dev@openjdk.org core-libs core-libs-dev@openjdk.org compiler compiler-dev@openjdk.org labels Jan 12, 2021

openjdk bot removed the core-libs core-libs-dev@openjdk.org label Jan 12, 2021

openjdk bot removed the compiler compiler-dev@openjdk.org label Jan 12, 2021

seanjmullan suggested changes Jan 12, 2021

View reviewed changes

rhalade reviewed Jan 12, 2021

View reviewed changes

No warning for trusted cert's SHA1, and added debug output to test

5a3e184

wangweij approved these changes Jan 13, 2021

View reviewed changes

rhalade approved these changes Jan 13, 2021

View reviewed changes

seanjmullan approved these changes Jan 13, 2021

View reviewed changes

remove comment about checking sigalg for trusted cert

88d94df

haimaychao changed the title ~~8259401: Add checking to jarsigner to warn weak algorithms used in si…~~ 8259401: Add checking to jarsigner to warn weak algorithms used in signer’s cert chain Jan 13, 2021

openjdk bot added the ready Pull request is ready to be integrated label Jan 13, 2021

openjdk bot added the sponsor Pull request is ready to be sponsored label Jan 13, 2021

openjdk bot closed this Jan 13, 2021

openjdk bot added integrated Pull request has been integrated and removed sponsor Pull request is ready to be sponsored ready Pull request is ready to be integrated rfr Pull request is ready for review labels Jan 13, 2021

8259401: Add checking to jarsigner to warn weak algorithms used in signer’s cert chain #2042

8259401: Add checking to jarsigner to warn weak algorithms used in signer’s cert chain #2042

haimaychao commented Jan 12, 2021 •

edited by openjdk bot

bridgekeeper bot commented Jan 12, 2021

openjdk bot commented Jan 12, 2021

mlbridge bot commented Jan 12, 2021 •

edited

AlanBateman commented Jan 12, 2021

openjdk bot commented Jan 12, 2021

haimaychao commented Jan 12, 2021

openjdk bot commented Jan 12, 2021

seanjmullan Jan 12, 2021

haimaychao Jan 13, 2021

seanjmullan Jan 12, 2021

haimaychao Jan 13, 2021

seanjmullan Jan 12, 2021

haimaychao Jan 13, 2021

rhalade Jan 12, 2021

haimaychao Jan 13, 2021

haimaychao commented Jan 13, 2021

wangweij Jan 13, 2021 •

edited

seanjmullan Jan 13, 2021

haimaychao Jan 13, 2021

wangweij Jan 13, 2021

haimaychao Jan 13, 2021

haimaychao commented Jan 13, 2021

openjdk bot commented Jan 13, 2021 •

edited

haimaychao commented Jan 13, 2021

openjdk bot commented Jan 13, 2021

wangweij commented Jan 13, 2021

openjdk bot commented Jan 13, 2021


		public static void main(String[] args) throws Exception {

		// root certificate using SHA1withRSA and 1024-bit key

8259401: Add checking to jarsigner to warn weak algorithms used in signer’s cert chain #2042

8259401: Add checking to jarsigner to warn weak algorithms used in signer’s cert chain #2042

Conversation

haimaychao commented Jan 12, 2021 • edited by openjdk bot

Progress

Issue

Reviewers

Download

bridgekeeper bot commented Jan 12, 2021

openjdk bot commented Jan 12, 2021

mlbridge bot commented Jan 12, 2021 • edited

Webrevs

AlanBateman commented Jan 12, 2021

openjdk bot commented Jan 12, 2021

haimaychao commented Jan 12, 2021

openjdk bot commented Jan 12, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

haimaychao commented Jan 13, 2021

wangweij Jan 13, 2021 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

haimaychao commented Jan 13, 2021

openjdk bot commented Jan 13, 2021 • edited

haimaychao commented Jan 13, 2021

openjdk bot commented Jan 13, 2021

wangweij commented Jan 13, 2021

openjdk bot commented Jan 13, 2021

haimaychao commented Jan 12, 2021 •

edited by openjdk bot

mlbridge bot commented Jan 12, 2021 •

edited

wangweij Jan 13, 2021 •

edited

openjdk bot commented Jan 13, 2021 •

edited