|
1 | 1 | /* |
2 | | - * Copyright (c) 2010,2022, Oracle and/or its affiliates. All rights reserved. |
| 2 | + * Copyright (c) 2010,2024, Oracle and/or its affiliates. All rights reserved. |
3 | 3 | * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
4 | 4 | * |
5 | 5 | * This code is free software; you can redistribute it and/or modify it |
|
42 | 42 | importjava.security.spec.PSSParameterSpec; |
43 | 43 | importjava.time.DateTimeException; |
44 | 44 | importjava.time.Instant; |
45 | | -importjava.time.ZonedDateTime; |
46 | 45 | importjava.time.ZoneId; |
| 46 | +importjava.time.ZonedDateTime; |
47 | 47 | importjava.util.ArrayList; |
48 | 48 | importjava.util.Arrays; |
| 49 | +importjava.util.Collection; |
49 | 50 | importjava.util.Date; |
50 | 51 | importjava.util.HashMap; |
51 | 52 | importjava.util.HashSet; |
52 | 53 | importjava.util.List; |
53 | 54 | importjava.util.Locale; |
54 | 55 | importjava.util.Map; |
55 | 56 | importjava.util.Set; |
56 | | -importjava.util.Collection; |
57 | 57 | importjava.util.StringTokenizer; |
58 | 58 | importjava.util.concurrent.ConcurrentHashMap; |
59 | | -importjava.util.regex.Pattern; |
60 | 59 | importjava.util.regex.Matcher; |
| 60 | +importjava.util.regex.Pattern; |
61 | 61 |
|
62 | 62 | /** |
63 | 63 | * Algorithm constraints for disabled algorithms property |
@@ -102,6 +102,7 @@ private static class JarHolder { |
102 | 102 | } |
103 | 103 |
|
104 | 104 | privatefinalSet<String>disabledAlgorithms; |
| 105 | +privatefinalList<Pattern>disabledPatterns; |
105 | 106 | privatefinalConstraintsalgorithmConstraints; |
106 | 107 | privatevolatileSoftReference<Map<String,Boolean>>cacheRef = |
107 | 108 | newSoftReference<>(null); |
@@ -137,6 +138,13 @@ public DisabledAlgorithmConstraints(String propertyName, |
137 | 138 | super(decomposer); |
138 | 139 | disabledAlgorithms =getAlgorithms(propertyName); |
139 | 140 |
|
| 141 | +// Support patterns only for jdk.tls.disabledAlgorithms |
| 142 | +if (PROPERTY_TLS_DISABLED_ALGS.equals(propertyName)) { |
| 143 | +disabledPatterns =getDisabledPatterns(); |
| 144 | + }else { |
| 145 | +disabledPatterns =null; |
| 146 | + } |
| 147 | + |
140 | 148 | // Check for alias |
141 | 149 | for (Strings :disabledAlgorithms) { |
142 | 150 | Matchermatcher =INCLUDE_PATTERN.matcher(s); |
@@ -967,11 +975,48 @@ private boolean cachedCheckAlgorithm(String algorithm) { |
967 | 975 | if (result !=null) { |
968 | 976 | returnresult; |
969 | 977 | } |
970 | | -result =checkAlgorithm(disabledAlgorithms,algorithm,decomposer); |
| 978 | +// We won't check patterns if algorithm check fails. |
| 979 | +result =checkAlgorithm(disabledAlgorithms,algorithm,decomposer) |
| 980 | + &&checkDisabledPatterns(algorithm); |
971 | 981 | cache.put(algorithm,result); |
972 | 982 | returnresult; |
973 | 983 | } |
974 | 984 |
|
| 985 | +privatebooleancheckDisabledPatterns(finalStringalgorithm) { |
| 986 | +returndisabledPatterns ==null ||disabledPatterns.stream().noneMatch( |
| 987 | +p ->p.matcher(algorithm).matches()); |
| 988 | + } |
| 989 | + |
| 990 | +privateList<Pattern>getDisabledPatterns() { |
| 991 | +List<Pattern>ret =null; |
| 992 | +List<String>patternStrings =newArrayList<>(4); |
| 993 | + |
| 994 | +for (Stringp :disabledAlgorithms) { |
| 995 | +if (p.contains("*")) { |
| 996 | +if (!p.startsWith("TLS_")) { |
| 997 | +thrownewIllegalArgumentException( |
| 998 | +"Wildcard pattern must start with\"TLS_\""); |
| 999 | + } |
| 1000 | +patternStrings.add(p); |
| 1001 | + } |
| 1002 | + } |
| 1003 | + |
| 1004 | +if (!patternStrings.isEmpty()) { |
| 1005 | +ret =newArrayList<>(patternStrings.size()); |
| 1006 | + |
| 1007 | +for (Stringp :patternStrings) { |
| 1008 | +// Exclude patterns from algorithm code flow. |
| 1009 | +disabledAlgorithms.remove(p); |
| 1010 | + |
| 1011 | +// Ignore all regex characters but asterisk. |
| 1012 | +ret.add(Pattern.compile( |
| 1013 | +"^\\Q" +p.replace("*","\\E.*\\Q") +"\\E$")); |
| 1014 | + } |
| 1015 | + } |
| 1016 | + |
| 1017 | +returnret; |
| 1018 | + } |
| 1019 | + |
975 | 1020 | /* |
976 | 1021 | * This constraint is used for the complete disabling of the algorithm. |
977 | 1022 | */ |
|