Skip to content

Commit 7ad9a11

Browse files
KostasTsiounisKostasTsiounis
committed
Updated tests
1 parent f1f2665 commit 7ad9a11

File tree

4 files changed

+219
-35
lines changed

4 files changed

+219
-35
lines changed

‎closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java

+2-3
Original file line numberDiff line numberDiff line change
@@ -855,7 +855,6 @@ boolean isRestrictedServiceAllowed(Service service, boolean isServiceAdded) {
855855
// See if a regex for accepted uses has been specified and apply
856856
// it to the call stack.
857857
if (!isServiceAdded && !isNullOrBlank(cAcceptedUses)) {
858-
cAcceptedUses = cAcceptedUses.substring(1);
859858
String[] optionAndValue = cAcceptedUses.split(":");
860859
if (optionAndValue.length != 2) {
861860
printStackTraceAndExit("Incorrect specification of accepted uses in constraint: " + constraint);
@@ -1521,7 +1520,7 @@ private void setConstraints(String providerName, String providerInfo, boolean pr
15211520
final String typeRE = "\\w+";
15221521
final String algoRE = "[A-Za-z0-9./_-]+";
15231522
final String attrRE = "[A-Za-z0-9=*|.:]+";
1524-
final String usesRE = "[A-Za-z0-9._:/]+";
1523+
final String usesRE = "[A-Za-z0-9._:/$]+";
15251524
final String consRE = "\\{(" + typeRE + "),(" + algoRE + "),(" + attrRE + ")(," + usesRE + ")?\\}";
15261525
p = Pattern.compile(
15271526
"\\["
@@ -1545,7 +1544,7 @@ private void setConstraints(String providerName, String providerInfo, boolean pr
15451544
String inType = m.group(1);
15461545
String inAlgorithm = m.group(2);
15471546
String inAttributes = m.group(3);
1548-
String inAcceptedUses = m.group(4);
1547+
String inAcceptedUses = m.group(4).substring(1);
15491548

15501549
// Each attribute must includes 2 fields (key and value) or *.
15511550
if (!isAsterisk(inAttributes)) {

‎closed/test/jdk/openj9/internal/security/TestConstraintsFailure.java

+183
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
/*
2+
* ===========================================================================
3+
* (c) Copyright IBM Corp. 2025, 2025 All Rights Reserved
4+
* ===========================================================================
5+
*
6+
* This code is free software; you can redistribute it and/or modify it
7+
* under the terms of the GNU General Public License version 2 only, as
8+
* published by the Free Software Foundation.
9+
*
10+
* IBM designates this particular file as subject to the "Classpath" exception
11+
* as provided by IBM in the LICENSE file that accompanied this code.
12+
*
13+
* This code is distributed in the hope that it will be useful, but WITHOUT
14+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
15+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16+
* version 2 for more details (a copy is included in the LICENSE file that
17+
* accompanied this code).
18+
*
19+
* You should have received a copy of the GNU General Public License version
20+
* 2 along with this work; if not, see <http://www.gnu.org/licenses/>.
21+
*
22+
* ===========================================================================
23+
*/
24+
25+
/*
26+
* @test
27+
* @summary Test Restricted Security Mode Constraints
28+
* @library /test/lib
29+
* @run junit TestConstraintsFailure
30+
*/
31+
32+
import java.security.AlgorithmParameterGenerator;
33+
import java.security.KeyFactory;
34+
import java.security.KeyPairGenerator;
35+
import java.security.KeyStore;
36+
import java.security.MessageDigest;
37+
import java.security.NoSuchAlgorithmException;
38+
import java.security.Signature;
39+
import java.security.cert.CertPathValidator;
40+
import java.security.cert.CertStore;
41+
import java.security.cert.CertificateFactory;
42+
43+
import javax.crypto.Cipher;
44+
//import javax.crypto.KDF;
45+
import javax.crypto.KeyAgreement;
46+
import javax.crypto.KeyGenerator;
47+
import javax.crypto.Mac;
48+
import javax.crypto.SecretKeyFactory;
49+
import javax.net.ssl.KeyManagerFactory;
50+
import javax.net.ssl.SSLContext;
51+
import javax.net.ssl.TrustManagerFactory;
52+
53+
import jdk.test.lib.process.OutputAnalyzer;
54+
import jdk.test.lib.process.ProcessTools;
55+
56+
public class TestConstraintsFailure {
57+
58+
private static void getInstances() throws NoSuchAlgorithmException {
59+
try {
60+
CertificateFactory.getInstance("X.509");
61+
throw new RuntimeException("A NoSuchAlgorithmException should have been thrown");
62+
} catch(NoSuchAlgorithmException nsae) {
63+
// Do nothing. This is expected.
64+
}
65+
try {
66+
CertPathValidator.getInstance("PKIX");
67+
throw new RuntimeException("A NoSuchAlgorithmException should have been thrown");
68+
} catch(NoSuchAlgorithmException nsae) {
69+
// Do nothing. This is expected.
70+
}
71+
try {
72+
MessageDigest.getInstance("SHA-256");
73+
throw new RuntimeException("A NoSuchAlgorithmException should have been thrown");
74+
} catch(NoSuchAlgorithmException nsae) {
75+
// Do nothing. This is expected.
76+
}
77+
try {
78+
KeyStore.getInstance("PKCS12");
79+
throw new RuntimeException("A NoSuchAlgorithmException should have been thrown");
80+
} catch(NoSuchAlgorithmException nsae) {
81+
// Do nothing. This is expected.
82+
}
83+
84+
try {
85+
Signature.getInstance("SHA256withECDSA");
86+
throw new RuntimeException("A NoSuchAlgorithmException should have been thrown");
87+
} catch(NoSuchAlgorithmException nsae) {
88+
// Do nothing. This is expected.
89+
}
90+
try {
91+
KeyPairGenerator.getInstance("EC");
92+
throw new RuntimeException("A NoSuchAlgorithmException should have been thrown");
93+
} catch(NoSuchAlgorithmException nsae) {
94+
// Do nothing. This is expected.
95+
}
96+
try {
97+
KeyAgreement.getInstance("ECDH");
98+
throw new RuntimeException("A NoSuchAlgorithmException should have been thrown");
99+
} catch(NoSuchAlgorithmException nsae) {
100+
// Do nothing. This is expected.
101+
}
102+
try {
103+
KeyFactory.getInstance("EC");
104+
throw new RuntimeException("A NoSuchAlgorithmException should have been thrown");
105+
} catch(NoSuchAlgorithmException nsae) {
106+
// Do nothing. This is expected.
107+
}
108+
109+
try {
110+
Cipher.getInstance("RSA");
111+
throw new RuntimeException("A NoSuchAlgorithmException should have been thrown");
112+
} catch(NoSuchAlgorithmException nsae) {
113+
// Do nothing. This is expected.
114+
}
115+
try {
116+
KeyGenerator.getInstance("AES");
117+
throw new RuntimeException("A NoSuchAlgorithmException should have been thrown");
118+
} catch(NoSuchAlgorithmException nsae) {
119+
// Do nothing. This is expected.
120+
}
121+
try {
122+
AlgorithmParameterGenerator.getInstance("DiffieHellman");
123+
throw new RuntimeException("A NoSuchAlgorithmException should have been thrown");
124+
} catch(NoSuchAlgorithmException nsae) {
125+
// Do nothing. This is expected.
126+
}
127+
128+
// Still a preview, but can be enabled in future versions.
129+
/*try {
130+
KDF.getInstance("HKDF-SHA256");
131+
throw new RuntimeException("A NoSuchAlgorithmException should have been thrown");
132+
} catch(NoSuchAlgorithmException nsae) {
133+
// Do nothing. This is expected.
134+
}*/
135+
136+
try {
137+
SecretKeyFactory.getInstance("PBEWithMD5AndDES");
138+
throw new RuntimeException("A NoSuchAlgorithmException should have been thrown");
139+
} catch(NoSuchAlgorithmException nsae) {
140+
// Do nothing. This is expected.
141+
}
142+
try {
143+
Mac.getInstance("HmacSHA256");
144+
throw new RuntimeException("A NoSuchAlgorithmException should have been thrown");
145+
} catch(NoSuchAlgorithmException nsae) {
146+
// Do nothing. This is expected.
147+
}
148+
149+
try {
150+
KeyManagerFactory.getInstance("SunX509");
151+
throw new RuntimeException("A NoSuchAlgorithmException should have been thrown");
152+
} catch(NoSuchAlgorithmException nsae) {
153+
// Do nothing. This is expected.
154+
}
155+
try {
156+
TrustManagerFactory.getInstance("SunX509");
157+
throw new RuntimeException("A NoSuchAlgorithmException should have been thrown");
158+
} catch(NoSuchAlgorithmException nsae) {
159+
// Do nothing. This is expected.
160+
}
161+
try {
162+
SSLContext.getInstance("TLSv1.3");
163+
throw new RuntimeException("A NoSuchAlgorithmException should have been thrown");
164+
} catch(NoSuchAlgorithmException nsae) {
165+
// Do nothing. This is expected.
166+
}
167+
}
168+
169+
@Test
170+
public void runWithConstraints() {
171+
OutputAnalyzer outputAnalyzer = ProcessTools.executeTestJava(
172+
"-Dsemeru.customprofile=RestrictedSecurity.TestConstraints.Version",
173+
"-Djava.security.properties=" + System.getProperty("test.src") + "/constraints-java.security",
174+
"TestConstraintsFailure"
175+
);
176+
outputAnalyzer.reportDiagnosticSummary();
177+
outputAnalyzer.shouldHaveExitValue(0);
178+
}
179+
180+
public static void main(String[] args) throws NoSuchAlgorithmException {
181+
getInstances();
182+
}
183+
}

‎closed/test/jdk/openj9/internal/security/TestConstraints.java ‎closed/test/jdk/openj9/internal/security/TestConstraintsSuccess.java

+12-10
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
* ===========================================================================
3-
* (c) Copyright IBM Corp. 2024, 2024 All Rights Reserved
3+
* (c) Copyright IBM Corp. 2025, 2025 All Rights Reserved
44
* ===========================================================================
55
*
66
* This code is free software; you can redistribute it and/or modify it
@@ -26,21 +26,22 @@
2626
* @test
2727
* @summary Test Restricted Security Mode Constraints
2828
* @library /test/lib
29-
* @run junit TestConstraints
29+
* @run junit TestConstraintsSuccess
3030
*/
3131

32-
import java.lang.module.Configuration;
3332
import java.security.AlgorithmParameterGenerator;
3433
import java.security.KeyFactory;
3534
import java.security.KeyPairGenerator;
3635
import java.security.KeyStore;
3736
import java.security.MessageDigest;
37+
import java.security.NoSuchAlgorithmException;
3838
import java.security.Signature;
3939
import java.security.cert.CertPathValidator;
4040
import java.security.cert.CertStore;
4141
import java.security.cert.CertificateFactory;
4242

4343
import javax.crypto.Cipher;
44+
//import javax.crypto.KDF;
4445
import javax.crypto.KeyAgreement;
4546
import javax.crypto.KeyGenerator;
4647
import javax.crypto.Mac;
@@ -52,12 +53,10 @@
5253
import jdk.test.lib.process.OutputAnalyzer;
5354
import jdk.test.lib.process.ProcessTools;
5455

55-
public class TestConstraints {
56+
public class TestConstraintsSuccess {
5657

57-
private static void getInstances() {
58+
private static void getInstances() throws NoSuchAlgorithmException {
5859
CertificateFactory.getInstance("X.509");
59-
//CertStore.getInstance("Collection");
60-
//Configuration.getInstance("JavaLoginConfig");
6160
CertPathValidator.getInstance("PKIX");
6261
MessageDigest.getInstance("SHA-256");
6362
KeyStore.getInstance("PKCS12");
@@ -70,7 +69,10 @@ private static void getInstances() {
7069
Cipher.getInstance("RSA");
7170
KeyGenerator.getInstance("AES");
7271
AlgorithmParameterGenerator.getInstance("DiffieHellman");
73-
KDF.getInstance("HKDF-SHA256");
72+
73+
// Still a preview, but can be enabled in future versions.
74+
// KDF.getInstance("HKDF-SHA256");
75+
7476
SecretKeyFactory.getInstance("PBEWithMD5AndDES");
7577
Mac.getInstance("HmacSHA256");
7678

@@ -84,13 +86,13 @@ public void runWithConstraints() {
8486
OutputAnalyzer outputAnalyzer = ProcessTools.executeTestJava(
8587
"-Dsemeru.customprofile=RestrictedSecurity.TestConstraints.Version",
8688
"-Djava.security.properties=" + System.getProperty("test.src") + "/constraints-java.security",
87-
"TestProperties"
89+
"TestConstraintsSuccess"
8890
);
8991
outputAnalyzer.reportDiagnosticSummary();
9092
outputAnalyzer.shouldHaveExitValue(0);
9193
}
9294

93-
public static void main(String[] args) {
95+
public static void main(String[] args) throws NoSuchAlgorithmException {
9496
getInstances();
9597
}
9698
}

‎closed/test/jdk/openj9/internal/security/constraints-java.security

+22-22
Original file line numberDiff line numberDiff line change
@@ -27,36 +27,36 @@ RestrictedSecurity.TestConstraints.Version.desc.policy =
2727
RestrictedSecurity.TestConstraints.Version.fips.mode = test
2828

2929
RestrictedSecurity.TestConstraints.Version.jce.provider.1 = sun.security.provider.Sun [ \
30-
{CertificateFactory, X.509, *, FullClassName:TestConstraints}, \
31-
{CertStore, Collection, *, FullClassName:TestConstraints}, \
32-
{Configuration, JavaLoginConfig, *, FullClassName:TestConstraints}, \
33-
{CertPathBuilder, PKIX, *, FullClassName:TestConstraints}, \
34-
{CertPathValidator, PKIX, *, FullClassName:TestConstraints}, \
35-
{SecureRandom, SHA1PRNG, *, FullClassName:TestConstraints}, \
36-
{MessageDigest, SHA-256, *, FullClassName:TestConstraints}, \
37-
{KeyStore, PKCS12, *, FullClassName:TestConstraints}]
30+
{CertificateFactory, X.509, *, FullClassName:TestConstraintsSuccess}, \
31+
{CertStore, Collection, *, FullClassName:TestConstraintsSuccess}, \
32+
{Configuration, JavaLoginConfig, *, FullClassName:TestConstraintsSuccess}, \
33+
{CertPathBuilder, PKIX, *, FullClassName:TestConstraintsSuccess}, \
34+
{CertPathValidator, PKIX, *, FullClassName:TestConstraintsSuccess}, \
35+
{SecureRandom, SHA1PRNG, *, FullClassName:TestConstraintsSuccess}, \
36+
{MessageDigest, SHA-256, *, FullClassName:TestConstraintsSuccess}, \
37+
{KeyStore, PKCS12, *, FullClassName:TestConstraintsSuccess}]
3838
RestrictedSecurity.TestConstraints.Version.jce.provider.2 = sun.security.ec.SunEC [ \
39-
{AlgorithmParameters, EC, *, ModuleAndFullClassName:java.base/sun.security.ec.SunEC}, \
40-
{Signature, SHA256withECDSA, *, FullClassName:TestConstraints}, \
41-
{KeyPairGenerator, EC, *, FullClassName:TestConstraints}, \
42-
{KeyAgreement, ECDH, *, FullClassName:TestConstraints}, \
43-
{KeyFactory, EC, *, FullClassName:TestConstraints}]
39+
{AlgorithmParameters, EC, *, ModuleAndFullClassName:java.base/java.security.KeyPairGenerator}, \
40+
{Signature, SHA256withECDSA, *, FullClassName:TestConstraintsSuccess}, \
41+
{KeyPairGenerator, EC, *, FullClassName:TestConstraintsSuccess}, \
42+
{KeyAgreement, ECDH, *, FullClassName:TestConstraintsSuccess}, \
43+
{KeyFactory, EC, *, FullClassName:TestConstraintsSuccess}]
4444
RestrictedSecurity.TestConstraints.Version.jce.provider.3 = com.sun.crypto.provider.SunJCE [ \
45-
{Cipher, RSA, *, FullClassName:TestConstraints}, \
46-
{KeyGenerator, AES, *, FullClassName:TestConstraints}, \
47-
{AlgorithmParameterGenerator, DiffieHellman, *, FullClassName:TestConstraints}, \
48-
{KDF, HKDF-SHA256, *, FullClassName:TestConstraints}, \
49-
{SecretKeyFactory, PBEWithMD5AndDES, *, FullClassName:TestConstraints}, \
50-
{Mac, HmacSHA256, *, FullClassName:TestConstraints}, \
45+
{Cipher, RSA, *, FullClassName:TestConstraintsSuccess}, \
46+
{KeyGenerator, AES, *, FullClassName:TestConstraintsSuccess}, \
47+
{AlgorithmParameterGenerator, DiffieHellman, *, FullClassName:TestConstraintsSuccess}, \
48+
{KDF, HKDF-SHA256, *, FullClassName:TestConstraintsSuccess}, \
49+
{SecretKeyFactory, PBEWithMD5AndDES, *, FullClassName:TestConstraintsSuccess}, \
50+
{Mac, HmacSHA256, *, FullClassName:TestConstraintsSuccess}, \
5151
{AlgorithmParameters, PBES2, *, ModuleAndFullClassName:java.base/sun.security.pkcs12.PKCS12KeyStore}, \
5252
{AlgorithmParameters, PBEWithHmacSHA256AndAES_256, *, ModuleAndFullClassName:java.base/sun.security.pkcs12.PKCS12KeyStore}, \
5353
{SecretKeyFactory, PBEWithMD5AndDES, *, ModuleAndFullClassName:java.base/sun.security.pkcs12.PKCS12KeyStore}, \
5454
{Cipher, PBEWithHmacSHA256AndAES_256, *, ModuleAndFullClassName:java.base/sun.security.pkcs12.PKCS12KeyStore}, \
5555
{Mac, HmacPBESHA256, *, ModuleAndFullClassName:java.base/sun.security.pkcs12.PKCS12KeyStore}]
5656
RestrictedSecurity.TestConstraints.Version.jce.provider.4 = sun.security.ssl.SunJSSE [ \
57-
{KeyManagerFactory, SunX509, *, FullClassName:TestConstraints}, \
58-
{TrustManagerFactory, SunX509, *, FullClassName:TestConstraints}, \
59-
{SSLContext, TLSv1.3, *, FullClassName:TestConstraints}]
57+
{KeyManagerFactory, SunX509, *, FullClassName:TestConstraintsSuccess}, \
58+
{TrustManagerFactory, SunX509, *, FullClassName:TestConstraintsSuccess}, \
59+
{SSLContext, TLSv1.3, *, FullClassName:TestConstraintsSuccess}]
6060

6161
RestrictedSecurity.TestConstraints.Version.securerandom.provider = SUN
6262
RestrictedSecurity.TestConstraints.Version.securerandom.algorithm = SHA512DRBG

0 commit comments

Comments
 (0)