Skip to content

Commit 2536cbf

Browse files
wangweijwangweij
committed
8245679: KeyStore cannot probe PKCS12 keystore if BouncyCastle is the top security provider
Reviewed-by: mullan
1 parent 241f401 commit 2536cbf

3 files changed

Lines changed: 134 additions & 44 deletions

File tree

‎src/java.base/share/classes/java/security/KeyStore.java‎

Lines changed: 25 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 1997, 2019, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 1997, 2020, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -1762,35 +1762,33 @@ private static final KeyStore getInstance(File file, char[] password,
17621762
dataStream.mark(Integer.MAX_VALUE);
17631763

17641764
// Detect the keystore type
1765-
for (String type : Security.getAlgorithms("KeyStore")) {
1766-
Object[] objs = null;
1767-
1768-
try {
1769-
objs = Security.getImpl(type, "KeyStore", (String)null);
1770-
1771-
KeyStoreSpi impl = (KeyStoreSpi)objs[0];
1772-
if (impl.engineProbe(dataStream)) {
1773-
1774-
if (kdebug != null) {
1775-
kdebug.println(type + " keystore detected: " +
1776-
file);
1765+
for (Provider p : Security.getProviders()) {
1766+
for (Provider.Service s : p.getServices()) {
1767+
if (s.getType().equals("KeyStore")) {
1768+
try {
1769+
KeyStoreSpi impl = (KeyStoreSpi) s.newInstance(null);
1770+
if (impl.engineProbe(dataStream)) {
1771+
if (kdebug != null) {
1772+
kdebug.println(s.getAlgorithm()
1773+
+ " keystore detected: " + file);
1774+
}
1775+
keystore = new KeyStore(impl, p, s.getAlgorithm());
1776+
break;
1777+
}
1778+
} catch (NoSuchAlgorithmException e) {
1779+
// ignore
1780+
if (kdebug != null) {
1781+
kdebug.println("not found - " + e);
1782+
}
1783+
} catch (IOException e) {
1784+
// ignore
1785+
if (kdebug != null) {
1786+
kdebug.println("I/O error in " + file + " - " + e);
1787+
}
17771788
}
1778-
1779-
keystore = new KeyStore(impl, (Provider)objs[1], type);
1780-
break;
1781-
}
1782-
} catch (NoSuchAlgorithmException | NoSuchProviderException e) {
1783-
// ignore
1784-
if (kdebug != null) {
1785-
kdebug.println(type + " not found - " + e);
1786-
}
1787-
} catch (IOException e) {
1788-
// ignore
1789-
if (kdebug != null) {
1790-
kdebug.println("I/O error in " + file + " - " + e);
1789+
dataStream.reset(); // prepare the stream for the next probe
17911790
}
17921791
}
1793-
dataStream.reset(); // prepare the stream for the next probe
17941792
}
17951793

17961794
// Load the keystore data

‎src/java.base/share/classes/sun/security/provider/JavaKeyStore.java‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 1997, 2019, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 1997, 2020, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -75,6 +75,22 @@ public static final class DualFormatJKS extends KeyStoreDelegator {
7575
public DualFormatJKS() {
7676
super("JKS", JKS.class, "PKCS12", PKCS12KeyStore.class);
7777
}
78+
79+
/**
80+
* Probe the first few bytes of the keystore data stream for a valid
81+
* JKS keystore encoding.
82+
*/
83+
@Override
84+
public boolean engineProbe(InputStream stream) throws IOException {
85+
DataInputStream dataStream;
86+
if (stream instanceof DataInputStream) {
87+
dataStream = (DataInputStream)stream;
88+
} else {
89+
dataStream = new DataInputStream(stream);
90+
}
91+
92+
return MAGIC == dataStream.readInt();
93+
}
7894
}
7995

8096
private static final Debug debug = Debug.getInstance("keystore");
@@ -828,20 +844,4 @@ private byte[] convertToBytes(char[] password) {
828844
}
829845
return passwdBytes;
830846
}
831-
832-
/**
833-
* Probe the first few bytes of the keystore data stream for a valid
834-
* JKS keystore encoding.
835-
*/
836-
@Override
837-
public boolean engineProbe(InputStream stream) throws IOException {
838-
DataInputStream dataStream;
839-
if (stream instanceof DataInputStream) {
840-
dataStream = (DataInputStream)stream;
841-
} else {
842-
dataStream = new DataInputStream(stream);
843-
}
844-
845-
return MAGIC == dataStream.readInt();
846-
}
847847
}

‎test/jdk/java/security/KeyStore/OneProbeOneNot.java‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
/*
2+
* Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation.
8+
*
9+
* This code is distributed in the hope that it will be useful, but WITHOUT
10+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12+
* version 2 for more details (a copy is included in the LICENSE file that
13+
* accompanied this code).
14+
*
15+
* You should have received a copy of the GNU General Public License version
16+
* 2 along with this work; if not, write to the Free Software Foundation,
17+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18+
*
19+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20+
* or visit www.oracle.com if you need additional information or have any
21+
* questions.
22+
*/
23+
24+
/*
25+
* @test
26+
* @bug 8245679
27+
* @summary KeyStore cannot probe PKCS12 keystore if BouncyCastle is the top security provider
28+
* @run main/othervm OneProbeOneNot
29+
*/
30+
31+
import java.io.File;
32+
import java.io.InputStream;
33+
import java.io.OutputStream;
34+
import java.nio.file.Files;
35+
import java.nio.file.Path;
36+
import java.security.*;
37+
import java.security.cert.Certificate;
38+
import java.util.Date;
39+
import java.util.Enumeration;
40+
41+
public class OneProbeOneNot {
42+
public static final void main(String[] args) throws Exception {
43+
Files.write(Path.of("ks"), "".getBytes());
44+
// 1st provider do not support probe
45+
Security.insertProviderAt(new P1(), 1);
46+
// 2nd provider support probe
47+
Security.insertProviderAt(new P2(), 2);
48+
KeyStore ks = KeyStore.getInstance(new File("ks"), (char[])null);
49+
System.out.println(ks.getProvider().getName());
50+
System.out.println(ks.getType());
51+
}
52+
53+
public static class P1 extends Provider {
54+
public P1() {
55+
super("P1", "P1", "P1");
56+
putService(new Service(this, "KeyStore", "Oops",
57+
K1.class.getName(), null, null));
58+
}
59+
}
60+
public static class P2 extends Provider {
61+
public P2() {
62+
super("P2", "P2", "P2");
63+
putService(new Service(this, "KeyStore", "Oops",
64+
K2.class.getName(), null, null));
65+
}
66+
}
67+
68+
public static class K1 extends KeyStoreSpi {
69+
public Key engineGetKey(String a, char[] p) { return null; }
70+
public Certificate[] engineGetCertificateChain(String a) { return null; }
71+
public Certificate engineGetCertificate(String a) { return null; }
72+
public Date engineGetCreationDate(String a) { return null; }
73+
public void engineSetKeyEntry(String a, Key k, char[] p, Certificate[] c) { }
74+
public void engineSetKeyEntry(String a, byte[] k, Certificate[] c) { }
75+
public void engineSetCertificateEntry(String a, Certificate c) { }
76+
public void engineDeleteEntry(String a) { }
77+
public Enumeration<String> engineAliases() { return null; }
78+
public boolean engineContainsAlias(String a) { return false; }
79+
public int engineSize() { return 0; }
80+
public boolean engineIsKeyEntry(String a) { return false; }
81+
public boolean engineIsCertificateEntry(String a) { return false; }
82+
public String engineGetCertificateAlias(Certificate c) { return null; }
83+
public void engineStore(OutputStream stream, char[] password) { }
84+
public void engineLoad(InputStream stream, char[] password) { }
85+
}
86+
87+
public static class K2 extends K1 {
88+
public boolean engineProbe(InputStream s) {
89+
return true;
90+
}
91+
}
92+
}

0 commit comments

Comments
 (0)