i8c
changed/i8c/java-1.8.0-openjdk-1.8.0.372.b07-1.el8_7
MSVSphere Packaging Team
1 year ago
parent
88cf9ccaac
commit
b4213520d8
@ -1,2 +1,2 @@
|
|||||||
SOURCES/openjdk-shenandoah-jdk8u-shenandoah-jdk8u362-b09-4curve.tar.xz
|
SOURCES/openjdk-shenandoah-jdk8u-shenandoah-jdk8u372-b07-4curve.tar.xz
|
||||||
SOURCES/tapsets-icedtea-3.15.0.tar.xz
|
SOURCES/tapsets-icedtea-3.15.0.tar.xz
|
||||||
|
|||||||
@ -1,2 +1,2 @@
|
|||||||
10817d699dd7c85b03cfbd8eb820e00b19ddcae7 SOURCES/openjdk-shenandoah-jdk8u-shenandoah-jdk8u362-b09-4curve.tar.xz
|
3f015b60e085b0e1f0fd9ea13abf775a890c2b1b SOURCES/openjdk-shenandoah-jdk8u-shenandoah-jdk8u372-b07-4curve.tar.xz
|
||||||
7ae2cba67467825b2c2a5fec7aea041865023002 SOURCES/tapsets-icedtea-3.15.0.tar.xz
|
7ae2cba67467825b2c2a5fec7aea041865023002 SOURCES/tapsets-icedtea-3.15.0.tar.xz
|
||||||
|
|||||||
@ -0,0 +1,167 @@
|
|||||||
|
commit d41618f34f1d2f5416ec3c035f33dcb15cf5ab99
|
||||||
|
Author: Alexey Bakhtin <abakhtin@openjdk.org>
|
||||||
|
Date: Tue Apr 4 10:29:11 2023 +0000
|
||||||
|
|
||||||
|
8271199: Mutual TLS handshake fails signing client certificate with custom sensitive PKCS11 key
|
||||||
|
|
||||||
|
Reviewed-by: andrew, mbalao
|
||||||
|
Backport-of: f6232982b91cb2314e96ddbde3984836a810a556
|
||||||
|
|
||||||
|
diff --git a/jdk/src/share/classes/sun/security/rsa/RSAPSSSignature.java b/jdk/src/share/classes/sun/security/rsa/RSAPSSSignature.java
|
||||||
|
index a79e97d7c74..5378446b97b 100644
|
||||||
|
--- a/jdk/src/share/classes/sun/security/rsa/RSAPSSSignature.java
|
||||||
|
+++ b/jdk/src/share/classes/sun/security/rsa/RSAPSSSignature.java
|
||||||
|
@@ -127,12 +127,15 @@ public class RSAPSSSignature extends SignatureSpi {
|
||||||
|
@Override
|
||||||
|
protected void engineInitVerify(PublicKey publicKey)
|
||||||
|
throws InvalidKeyException {
|
||||||
|
- if (!(publicKey instanceof RSAPublicKey)) {
|
||||||
|
+ if (publicKey instanceof RSAPublicKey) {
|
||||||
|
+ RSAPublicKey rsaPubKey = (RSAPublicKey)publicKey;
|
||||||
|
+ isPublicKeyValid(rsaPubKey);
|
||||||
|
+ this.pubKey = rsaPubKey;
|
||||||
|
+ this.privKey = null;
|
||||||
|
+ resetDigest();
|
||||||
|
+ } else {
|
||||||
|
throw new InvalidKeyException("key must be RSAPublicKey");
|
||||||
|
}
|
||||||
|
- this.pubKey = (RSAPublicKey) isValid((RSAKey)publicKey);
|
||||||
|
- this.privKey = null;
|
||||||
|
- resetDigest();
|
||||||
|
}
|
||||||
|
|
||||||
|
// initialize for signing. See JCA doc
|
||||||
|
@@ -146,14 +149,17 @@ public class RSAPSSSignature extends SignatureSpi {
|
||||||
|
@Override
|
||||||
|
protected void engineInitSign(PrivateKey privateKey, SecureRandom random)
|
||||||
|
throws InvalidKeyException {
|
||||||
|
- if (!(privateKey instanceof RSAPrivateKey)) {
|
||||||
|
+ if (privateKey instanceof RSAPrivateKey) {
|
||||||
|
+ RSAPrivateKey rsaPrivateKey = (RSAPrivateKey)privateKey;
|
||||||
|
+ isPrivateKeyValid(rsaPrivateKey);
|
||||||
|
+ this.privKey = rsaPrivateKey;
|
||||||
|
+ this.pubKey = null;
|
||||||
|
+ this.random =
|
||||||
|
+ (random == null ? JCAUtil.getSecureRandom() : random);
|
||||||
|
+ resetDigest();
|
||||||
|
+ } else {
|
||||||
|
throw new InvalidKeyException("key must be RSAPrivateKey");
|
||||||
|
}
|
||||||
|
- this.privKey = (RSAPrivateKey) isValid((RSAKey)privateKey);
|
||||||
|
- this.pubKey = null;
|
||||||
|
- this.random =
|
||||||
|
- (random == null? JCAUtil.getSecureRandom() : random);
|
||||||
|
- resetDigest();
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
@@ -205,11 +211,57 @@ public class RSAPSSSignature extends SignatureSpi {
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
+ /**
|
||||||
|
+ * Validate the specified RSAPrivateKey
|
||||||
|
+ */
|
||||||
|
+ private void isPrivateKeyValid(RSAPrivateKey prKey) throws InvalidKeyException {
|
||||||
|
+ try {
|
||||||
|
+ if (prKey instanceof RSAPrivateCrtKey) {
|
||||||
|
+ RSAPrivateCrtKey crtKey = (RSAPrivateCrtKey)prKey;
|
||||||
|
+ if (RSAPrivateCrtKeyImpl.checkComponents(crtKey)) {
|
||||||
|
+ RSAKeyFactory.checkRSAProviderKeyLengths(
|
||||||
|
+ crtKey.getModulus().bitLength(),
|
||||||
|
+ crtKey.getPublicExponent());
|
||||||
|
+ } else {
|
||||||
|
+ throw new InvalidKeyException(
|
||||||
|
+ "Some of the CRT-specific components are not available");
|
||||||
|
+ }
|
||||||
|
+ } else {
|
||||||
|
+ RSAKeyFactory.checkRSAProviderKeyLengths(
|
||||||
|
+ prKey.getModulus().bitLength(),
|
||||||
|
+ null);
|
||||||
|
+ }
|
||||||
|
+ } catch (InvalidKeyException ikEx) {
|
||||||
|
+ throw ikEx;
|
||||||
|
+ } catch (Exception e) {
|
||||||
|
+ throw new InvalidKeyException(
|
||||||
|
+ "Can not access private key components", e);
|
||||||
|
+ }
|
||||||
|
+ isValid(prKey);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /**
|
||||||
|
+ * Validate the specified RSAPublicKey
|
||||||
|
+ */
|
||||||
|
+ private void isPublicKeyValid(RSAPublicKey pKey) throws InvalidKeyException {
|
||||||
|
+ try {
|
||||||
|
+ RSAKeyFactory.checkRSAProviderKeyLengths(
|
||||||
|
+ pKey.getModulus().bitLength(),
|
||||||
|
+ pKey.getPublicExponent());
|
||||||
|
+ } catch (InvalidKeyException ikEx) {
|
||||||
|
+ throw ikEx;
|
||||||
|
+ } catch (Exception e) {
|
||||||
|
+ throw new InvalidKeyException(
|
||||||
|
+ "Can not access public key components", e);
|
||||||
|
+ }
|
||||||
|
+ isValid(pKey);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
/**
|
||||||
|
* Validate the specified RSAKey and its associated parameters against
|
||||||
|
* internal signature parameters.
|
||||||
|
*/
|
||||||
|
- private RSAKey isValid(RSAKey rsaKey) throws InvalidKeyException {
|
||||||
|
+ private void isValid(RSAKey rsaKey) throws InvalidKeyException {
|
||||||
|
try {
|
||||||
|
AlgorithmParameterSpec keyParams = rsaKey.getParams();
|
||||||
|
// validate key parameters
|
||||||
|
@@ -227,7 +279,6 @@ public class RSAPSSSignature extends SignatureSpi {
|
||||||
|
}
|
||||||
|
checkKeyLength(rsaKey, hLen, this.sigParams.getSaltLength());
|
||||||
|
}
|
||||||
|
- return rsaKey;
|
||||||
|
} catch (SignatureException e) {
|
||||||
|
throw new InvalidKeyException(e);
|
||||||
|
}
|
||||||
|
diff --git a/jdk/src/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java b/jdk/src/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java
|
||||||
|
index 6b219937981..b3c1fae9672 100644
|
||||||
|
--- a/jdk/src/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java
|
||||||
|
+++ b/jdk/src/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java
|
||||||
|
@@ -80,22 +80,28 @@ public final class RSAPrivateCrtKeyImpl
|
||||||
|
RSAPrivateCrtKeyImpl key = new RSAPrivateCrtKeyImpl(encoded);
|
||||||
|
// check all CRT-specific components are available, if any one
|
||||||
|
// missing, return a non-CRT key instead
|
||||||
|
- if ((key.getPublicExponent().signum() == 0) ||
|
||||||
|
- (key.getPrimeExponentP().signum() == 0) ||
|
||||||
|
- (key.getPrimeExponentQ().signum() == 0) ||
|
||||||
|
- (key.getPrimeP().signum() == 0) ||
|
||||||
|
- (key.getPrimeQ().signum() == 0) ||
|
||||||
|
- (key.getCrtCoefficient().signum() == 0)) {
|
||||||
|
+ if (checkComponents(key)) {
|
||||||
|
+ return key;
|
||||||
|
+ } else {
|
||||||
|
return new RSAPrivateKeyImpl(
|
||||||
|
key.algid,
|
||||||
|
key.getModulus(),
|
||||||
|
- key.getPrivateExponent()
|
||||||
|
- );
|
||||||
|
- } else {
|
||||||
|
- return key;
|
||||||
|
+ key.getPrivateExponent());
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
+ /**
|
||||||
|
+ * Validate if all CRT-specific components are available.
|
||||||
|
+ */
|
||||||
|
+ static boolean checkComponents(RSAPrivateCrtKey key) {
|
||||||
|
+ return !((key.getPublicExponent().signum() == 0) ||
|
||||||
|
+ (key.getPrimeExponentP().signum() == 0) ||
|
||||||
|
+ (key.getPrimeExponentQ().signum() == 0) ||
|
||||||
|
+ (key.getPrimeP().signum() == 0) ||
|
||||||
|
+ (key.getPrimeQ().signum() == 0) ||
|
||||||
|
+ (key.getCrtCoefficient().signum() == 0));
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
/**
|
||||||
|
* Generate a new key from the specified type and components.
|
||||||
|
* Returns a CRT key if possible and a non-CRT key otherwise.
|
||||||
@ -1,26 +0,0 @@
|
|||||||
diff --git openjdk.orig/jdk/src/share/classes/com/sun/jndi/ldap/LdapCtxFactory.java openjdk/jdk/src/share/classes/com/sun/jndi/ldap/LdapCtxFactory.java
|
|
||||||
index cf4becb7db..4ab2ac0a31 100644
|
|
||||||
--- openjdk.orig/jdk/src/share/classes/com/sun/jndi/ldap/LdapCtxFactory.java
|
|
||||||
+++ openjdk/jdk/src/share/classes/com/sun/jndi/ldap/LdapCtxFactory.java
|
|
||||||
@@ -189,6 +189,10 @@ final public class LdapCtxFactory implements ObjectFactory, InitialContextFactor
|
|
||||||
ctx = getLdapCtxFromUrl(
|
|
||||||
r.getDomainName(), url, new LdapURL(u), env);
|
|
||||||
return ctx;
|
|
||||||
+ } catch (AuthenticationException e) {
|
|
||||||
+ // do not retry on a different endpoint to avoid blocking
|
|
||||||
+ // the user if authentication credentials are wrong.
|
|
||||||
+ throw e;
|
|
||||||
} catch (NamingException e) {
|
|
||||||
// try the next element
|
|
||||||
lastException = e;
|
|
||||||
@@ -241,6 +245,10 @@ final public class LdapCtxFactory implements ObjectFactory, InitialContextFactor
|
|
||||||
for (String u : urls) {
|
|
||||||
try {
|
|
||||||
return getUsingURL(u, env);
|
|
||||||
+ } catch (AuthenticationException e) {
|
|
||||||
+ // do not retry on a different URL to avoid blocking
|
|
||||||
+ // the user if authentication credentials are wrong.
|
|
||||||
+ throw e;
|
|
||||||
} catch (NamingException e) {
|
|
||||||
ex = e;
|
|
||||||
}
|
|
||||||
Loading…
Reference in new issue