changeset 13783:56c5df40f2fe

8230318: Better trust store usage Reviewed-by: andrew
author alvdavi
date Sun, 12 Jan 2020 06:59:35 +0000
parents 31c836956458
children decb51098c77
files src/share/classes/sun/security/validator/PKIXValidator.java test/sun/security/tools/jarsigner/TsacertOptionTest.java test/sun/security/tools/jarsigner/Warning.java test/sun/security/tools/jarsigner/concise_jarsigner.sh test/sun/security/tools/jarsigner/ec.sh test/sun/security/tools/jarsigner/onlymanifest.sh test/sun/security/tools/jarsigner/warnings/BadExtendedKeyUsageTest.java test/sun/security/tools/jarsigner/warnings/BadKeyUsageTest.java test/sun/security/tools/jarsigner/warnings/BadNetscapeCertTypeTest.java test/sun/security/tools/jarsigner/warnings/ChainNotValidatedTest.java test/sun/security/tools/jarsigner/warnings/HasExpiredCertTest.java test/sun/security/tools/jarsigner/warnings/HasExpiringCertTest.java test/sun/security/tools/jarsigner/warnings/HasUnsignedEntryTest.java test/sun/security/tools/jarsigner/warnings/MultipleWarningsTest.java test/sun/security/tools/jarsigner/warnings/NoTimestampTest.java test/sun/security/tools/jarsigner/warnings/NotSignedByAliasTest.java test/sun/security/tools/jarsigner/warnings/NotYetValidCertTest.java test/sun/security/validator/EndEntityExtensionCheck.java
diffstat 18 files changed, 85 insertions(+), 32 deletions(-) [+]
line wrap: on
line diff
--- a/src/share/classes/sun/security/validator/PKIXValidator.java	Mon Oct 21 16:52:21 2019 -0700
+++ b/src/share/classes/sun/security/validator/PKIXValidator.java	Sun Jan 12 06:59:35 2020 +0000
@@ -32,6 +32,7 @@
 
 import javax.security.auth.x500.X500Principal;
 import sun.security.action.GetBooleanAction;
+import sun.security.action.GetPropertyAction;
 import sun.security.provider.certpath.AlgorithmChecker;
 import sun.security.provider.certpath.PKIXExtendedParameters;
 
@@ -64,6 +65,18 @@
     // enable use of the validator if possible
     private final static boolean TRY_VALIDATOR = true;
 
+    /**
+     * System property that if set (or set to "true"), allows trust anchor
+     * certificates to be used if they do not have the proper CA extensions.
+     * Set to false if prop is not set, or set to any other value.
+     */
+    private static final boolean ALLOW_NON_CA_ANCHOR = allowNonCaAnchor();
+    private static boolean allowNonCaAnchor() {
+        String prop = GetPropertyAction
+            .privilegedGetProperty("jdk.security.allowNonCaAnchor");
+        return prop != null && (prop.isEmpty() || prop.equalsIgnoreCase("true"));
+    }
+
     private final Set<X509Certificate> trustedCerts;
     private final PKIXBuilderParameters parameterTemplate;
     private int certPathLength = -1;
@@ -322,15 +335,18 @@
 
     private static X509Certificate[] toArray(CertPath path, TrustAnchor anchor)
             throws CertificateException {
-        List<? extends java.security.cert.Certificate> list =
-                                                path.getCertificates();
-        X509Certificate[] chain = new X509Certificate[list.size() + 1];
-        list.toArray(chain);
         X509Certificate trustedCert = anchor.getTrustedCert();
         if (trustedCert == null) {
             throw new ValidatorException
                 ("TrustAnchor must be specified as certificate");
         }
+
+        verifyTrustAnchor(trustedCert);
+
+        List<? extends java.security.cert.Certificate> list =
+                                                path.getCertificates();
+        X509Certificate[] chain = new X509Certificate[list.size() + 1];
+        list.toArray(chain);
         chain[chain.length - 1] = trustedCert;
         return chain;
     }
@@ -365,6 +381,41 @@
         }
     }
 
+    /**
+     * Verify that a trust anchor certificate is a CA certificate.
+     */
+    private static void verifyTrustAnchor(X509Certificate trustedCert)
+        throws ValidatorException {
+
+        // skip check if jdk.security.allowNonCAAnchor system property is set
+        if (ALLOW_NON_CA_ANCHOR) {
+            return;
+        }
+
+        // allow v1 trust anchor certificates
+        if (trustedCert.getVersion() < 3) {
+            return;
+        }
+
+        // check that the BasicConstraints cA field is not set to false
+        if (trustedCert.getBasicConstraints() == -1) {
+            throw new ValidatorException
+                ("TrustAnchor with subject \"" +
+                 trustedCert.getSubjectX500Principal() +
+                 "\" is not a CA certificate");
+        }
+
+        // check that the KeyUsage extension, if included, asserts the
+        // keyCertSign bit
+        boolean[] keyUsageBits = trustedCert.getKeyUsage();
+        if (keyUsageBits != null && !keyUsageBits[5]) {
+            throw new ValidatorException
+                ("TrustAnchor with subject \"" +
+                 trustedCert.getSubjectX500Principal() +
+                 "\" does not have keyCertSign bit set in KeyUsage extension");
+        }
+    }
+
     private X509Certificate[] doBuild(X509Certificate[] chain,
         Collection<X509Certificate> otherCerts,
         PKIXBuilderParameters params) throws CertificateException {
--- a/test/sun/security/tools/jarsigner/TsacertOptionTest.java	Mon Oct 21 16:52:21 2019 -0700
+++ b/test/sun/security/tools/jarsigner/TsacertOptionTest.java	Sun Jan 12 06:59:35 2020 +0000
@@ -87,6 +87,7 @@
                 "-storepass", PASSWORD,
                 "-keypass", PASSWORD,
                 "-dname", "CN=CA",
+                "-ext", "bc:c",
                 "-validity", Integer.toString(VALIDITY)).shouldHaveExitValue(0);
         ProcessTools.executeCommand(KEYTOOL,
                 "-genkey",
--- a/test/sun/security/tools/jarsigner/Warning.java	Mon Oct 21 16:52:21 2019 -0700
+++ b/test/sun/security/tools/jarsigner/Warning.java	Sun Jan 12 06:59:35 2020 +0000
@@ -42,7 +42,7 @@
 
         Files.deleteIfExists(Paths.get("ks"));
 
-        newCert("ca", "-validity 365000");
+        newCert("ca", "-validity 365000", "-ext bc:c");
 
         recreateJar();
 
--- a/test/sun/security/tools/jarsigner/concise_jarsigner.sh	Mon Oct 21 16:52:21 2019 -0700
+++ b/test/sun/security/tools/jarsigner/concise_jarsigner.sh	Sun Jan 12 06:59:35 2020 +0000
@@ -224,8 +224,8 @@
 # ==========================================================
 
 $KT -genkeypair -alias ee -dname CN=ee
-$KT -genkeypair -alias caone -dname CN=caone
-$KT -genkeypair -alias catwo -dname CN=catwo
+$KT -genkeypair -alias caone -dname CN=caone -ext bc:c
+$KT -genkeypair -alias catwo -dname CN=catwo -ext bc:c
 
 $KT -certreq -alias ee | $KT -gencert -alias catwo -rfc > ee.cert
 $KT -certreq -alias catwo | $KT -gencert -alias caone -sigalg MD5withRSA -rfc > catwo.cert
--- a/test/sun/security/tools/jarsigner/ec.sh	Mon Oct 21 16:52:21 2019 -0700
+++ b/test/sun/security/tools/jarsigner/ec.sh	Sun Jan 12 06:59:35 2020 +0000
@@ -53,7 +53,7 @@
 echo A > A
 $JAR cvf $JFILE A
 
-$KT -alias ca -dname CN=ca -keyalg ec -genkey -validity 300 || exit 11
+$KT -alias ca -dname CN=ca -keyalg ec -genkey -validity 300 -ext bc:c || exit 11
 
 $KT -alias a -dname CN=a -keyalg ec -genkey || exit 11
 $KT -alias a -certreq | $KT -gencert -alias ca -validity 300 | $KT -import -alias a || exit 111
--- a/test/sun/security/tools/jarsigner/onlymanifest.sh	Mon Oct 21 16:52:21 2019 -0700
+++ b/test/sun/security/tools/jarsigner/onlymanifest.sh	Sun Jan 12 06:59:35 2020 +0000
@@ -57,7 +57,7 @@
 echo "Key: Value" > manifest
 $JAR cvfm $JFILE manifest
 
-$KT -alias ca -dname CN=ca -genkey -validity 300 || exit 1
+$KT -alias ca -dname CN=ca -genkey -validity 300 -ext bc:c || exit 1
 $KT -alias a -dname CN=a -genkey -validity 300 || exit 2
 $KT -alias a -certreq | $KT -gencert -alias ca -validity 300 | $KT -import -alias a || exit 3
 $JARSIGNER -keystore $KS -storepass changeit $JFILE a -debug -strict || exit 4
--- a/test/sun/security/tools/jarsigner/warnings/BadExtendedKeyUsageTest.java	Mon Oct 21 16:52:21 2019 -0700
+++ b/test/sun/security/tools/jarsigner/warnings/BadExtendedKeyUsageTest.java	Sun Jan 12 06:59:35 2020 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -53,7 +53,7 @@
         // create a certificate whose signer certificate's
         // ExtendedKeyUsage extension doesn't allow code signing
         // create key pair for jar signing
-        createAlias(CA_KEY_ALIAS);
+        createAlias(CA_KEY_ALIAS, "-ext", "bc:c");
         createAlias(KEY_ALIAS);
 
         issueCert(
--- a/test/sun/security/tools/jarsigner/warnings/BadKeyUsageTest.java	Mon Oct 21 16:52:21 2019 -0700
+++ b/test/sun/security/tools/jarsigner/warnings/BadKeyUsageTest.java	Sun Jan 12 06:59:35 2020 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -53,7 +53,7 @@
 
         // create a certificate whose signer certificate's KeyUsage extension
         // doesn't allow code signing
-        createAlias(CA_KEY_ALIAS);
+        createAlias(CA_KEY_ALIAS, "-ext", "bc:c");
         createAlias(KEY_ALIAS);
 
         issueCert(
--- a/test/sun/security/tools/jarsigner/warnings/BadNetscapeCertTypeTest.java	Mon Oct 21 16:52:21 2019 -0700
+++ b/test/sun/security/tools/jarsigner/warnings/BadNetscapeCertTypeTest.java	Sun Jan 12 06:59:35 2020 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -54,7 +54,7 @@
         // create a certificate whose signer certificate's
         // NetscapeCertType extension doesn't allow code signing
         // create key pair for jar signing
-        createAlias(CA_KEY_ALIAS);
+        createAlias(CA_KEY_ALIAS, "-ext", "bc:c");
         createAlias(KEY_ALIAS);
 
         issueCert(
--- a/test/sun/security/tools/jarsigner/warnings/ChainNotValidatedTest.java	Mon Oct 21 16:52:21 2019 -0700
+++ b/test/sun/security/tools/jarsigner/warnings/ChainNotValidatedTest.java	Sun Jan 12 06:59:35 2020 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -54,7 +54,7 @@
         // Root CA is not checked at all. If the intermediate CA has
         // BasicConstraints extension set to true, it will be valid.
         // Otherwise, chain validation will fail.
-        createAlias(CA_KEY_ALIAS);
+        createAlias(CA_KEY_ALIAS, "-ext", "bc:c");
         createAlias(CA2_KEY_ALIAS);
         issueCert(CA2_KEY_ALIAS,
                 "-ext",
--- a/test/sun/security/tools/jarsigner/warnings/HasExpiredCertTest.java	Mon Oct 21 16:52:21 2019 -0700
+++ b/test/sun/security/tools/jarsigner/warnings/HasExpiredCertTest.java	Sun Jan 12 06:59:35 2020 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -52,7 +52,7 @@
         JarUtils.createJar(UNSIGNED_JARFILE, FIRST_FILE);
 
         // create key pair for jar signing
-        createAlias(CA_KEY_ALIAS);
+        createAlias(CA_KEY_ALIAS, "-ext", "bc:c");
         createAlias(KEY_ALIAS);
 
         issueCert(
--- a/test/sun/security/tools/jarsigner/warnings/HasExpiringCertTest.java	Mon Oct 21 16:52:21 2019 -0700
+++ b/test/sun/security/tools/jarsigner/warnings/HasExpiringCertTest.java	Sun Jan 12 06:59:35 2020 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -52,7 +52,7 @@
         JarUtils.createJar(UNSIGNED_JARFILE, FIRST_FILE);
 
         // create key pair for jar signing
-        createAlias(CA_KEY_ALIAS);
+        createAlias(CA_KEY_ALIAS, "-ext", "bc:c");
         createAlias(KEY_ALIAS);
 
         issueCert(
--- a/test/sun/security/tools/jarsigner/warnings/HasUnsignedEntryTest.java	Mon Oct 21 16:52:21 2019 -0700
+++ b/test/sun/security/tools/jarsigner/warnings/HasUnsignedEntryTest.java	Sun Jan 12 06:59:35 2020 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -51,7 +51,7 @@
         JarUtils.createJar(UNSIGNED_JARFILE, FIRST_FILE);
 
         // create key pair for signing
-        createAlias(CA_KEY_ALIAS);
+        createAlias(CA_KEY_ALIAS, "-ext", "bc:c");
         createAlias(KEY_ALIAS);
         issueCert(
                 KEY_ALIAS,
--- a/test/sun/security/tools/jarsigner/warnings/MultipleWarningsTest.java	Mon Oct 21 16:52:21 2019 -0700
+++ b/test/sun/security/tools/jarsigner/warnings/MultipleWarningsTest.java	Sun Jan 12 06:59:35 2020 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -54,7 +54,7 @@
         // create a jar file that contains one class file
         JarUtils.createJar(UNSIGNED_JARFILE, FIRST_FILE);
 
-        createAlias(CA_KEY_ALIAS);
+        createAlias(CA_KEY_ALIAS, "-ext", "bc:c");
 
         // create first expired certificate
         // whose ExtendedKeyUsage extension does not allow code signing
--- a/test/sun/security/tools/jarsigner/warnings/NoTimestampTest.java	Mon Oct 21 16:52:21 2019 -0700
+++ b/test/sun/security/tools/jarsigner/warnings/NoTimestampTest.java	Sun Jan 12 06:59:35 2020 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -57,7 +57,7 @@
                 * 24 * 60 * 60 * 1000L);
 
         // create key pair
-        createAlias(CA_KEY_ALIAS);
+        createAlias(CA_KEY_ALIAS, "-ext", "bc:c");
         createAlias(KEY_ALIAS);
         issueCert(KEY_ALIAS,
                 "-validity", Integer.toString(VALIDITY));
--- a/test/sun/security/tools/jarsigner/warnings/NotSignedByAliasTest.java	Mon Oct 21 16:52:21 2019 -0700
+++ b/test/sun/security/tools/jarsigner/warnings/NotSignedByAliasTest.java	Sun Jan 12 06:59:35 2020 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -49,7 +49,7 @@
         Utils.createFiles(FIRST_FILE);
         JarUtils.createJar(UNSIGNED_JARFILE, FIRST_FILE);
 
-        createAlias(CA_KEY_ALIAS);
+        createAlias(CA_KEY_ALIAS, "-ext", "bc:c");
 
         // create first key pair for signing
         createAlias(FIRST_KEY_ALIAS);
--- a/test/sun/security/tools/jarsigner/warnings/NotYetValidCertTest.java	Mon Oct 21 16:52:21 2019 -0700
+++ b/test/sun/security/tools/jarsigner/warnings/NotYetValidCertTest.java	Sun Jan 12 06:59:35 2020 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -50,7 +50,7 @@
         JarUtils.createJar(UNSIGNED_JARFILE, FIRST_FILE);
 
         // create certificate that will be valid only tomorrow
-        createAlias(CA_KEY_ALIAS);
+        createAlias(CA_KEY_ALIAS, "-ext", "bc:c");
         createAlias(KEY_ALIAS);
 
         issueCert(
--- a/test/sun/security/validator/EndEntityExtensionCheck.java	Mon Oct 21 16:52:21 2019 -0700
+++ b/test/sun/security/validator/EndEntityExtensionCheck.java	Sun Jan 12 06:59:35 2020 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015, 2016, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2015, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -26,6 +26,7 @@
  * @bug 8076117
  * @summary EndEntityChecker should not process custom extensions
  *          after PKIX validation
+ * @run main/othervm -Djdk.security.allowNonCaAnchor EndEntityExtensionCheck
  */
 
 import java.io.ByteArrayInputStream;