Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
openanolis
dragonwell8_jdk
提交
27d9bbd5
D
dragonwell8_jdk
项目概览
openanolis
/
dragonwell8_jdk
通知
3
Star
2
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
D
dragonwell8_jdk
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
前往新版Gitcode,体验更适合开发者的 AI 搜索 >>
提交
27d9bbd5
编写于
10月 30, 2018
作者:
P
pkoppula
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
8211883: Disable anon and NULL cipher suites
Reviewed-by: mullan, coffeys
上级
0635102b
变更
8
隐藏空白更改
内联
并排
Showing
8 changed file
with
61 addition
and
26 deletion
+61
-26
src/share/lib/security/java.security-aix
src/share/lib/security/java.security-aix
+1
-1
src/share/lib/security/java.security-linux
src/share/lib/security/java.security-linux
+1
-1
src/share/lib/security/java.security-macosx
src/share/lib/security/java.security-macosx
+1
-1
src/share/lib/security/java.security-solaris
src/share/lib/security/java.security-solaris
+1
-1
src/share/lib/security/java.security-windows
src/share/lib/security/java.security-windows
+1
-1
test/javax/net/ssl/ciphersuites/DisabledAlgorithms.java
test/javax/net/ssl/ciphersuites/DisabledAlgorithms.java
+34
-9
test/sun/security/ssl/SSLContextImpl/CustomizedCipherSuites.java
...n/security/ssl/SSLContextImpl/CustomizedCipherSuites.java
+16
-11
test/sun/security/ssl/javax/net/ssl/NewAPIs/JSSERenegotiate.java
...n/security/ssl/javax/net/ssl/NewAPIs/JSSERenegotiate.java
+6
-1
未找到文件。
src/share/lib/security/java.security-aix
浏览文件 @
27d9bbd5
...
...
@@ -620,7 +620,7 @@ jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, DSA keySize < 1024
# Example:
# jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048
jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, \
EC keySize < 224, 3DES_EDE_CBC
EC keySize < 224, 3DES_EDE_CBC
, anon, NULL
# Legacy algorithms for Secure Socket Layer/Transport Layer Security (SSL/TLS)
# processing in JSSE implementation.
...
...
src/share/lib/security/java.security-linux
浏览文件 @
27d9bbd5
...
...
@@ -620,7 +620,7 @@ jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, DSA keySize < 1024
# Example:
# jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048
jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, \
EC keySize < 224, 3DES_EDE_CBC
EC keySize < 224, 3DES_EDE_CBC
, anon, NULL
# Legacy algorithms for Secure Socket Layer/Transport Layer Security (SSL/TLS)
# processing in JSSE implementation.
...
...
src/share/lib/security/java.security-macosx
浏览文件 @
27d9bbd5
...
...
@@ -623,7 +623,7 @@ jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, DSA keySize < 1024
# Example:
# jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048
jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, \
EC keySize < 224, 3DES_EDE_CBC
EC keySize < 224, 3DES_EDE_CBC
, anon, NULL
# Legacy algorithms for Secure Socket Layer/Transport Layer Security (SSL/TLS)
# processing in JSSE implementation.
...
...
src/share/lib/security/java.security-solaris
浏览文件 @
27d9bbd5
...
...
@@ -622,7 +622,7 @@ jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, DSA keySize < 1024
# Example:
# jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048
jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, \
EC keySize < 224, 3DES_EDE_CBC
EC keySize < 224, 3DES_EDE_CBC
, anon, NULL
# Legacy algorithms for Secure Socket Layer/Transport Layer Security (SSL/TLS)
# processing in JSSE implementation.
...
...
src/share/lib/security/java.security-windows
浏览文件 @
27d9bbd5
...
...
@@ -623,7 +623,7 @@ jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, DSA keySize < 1024
# Example:
# jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048
jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, \
EC keySize < 224, 3DES_EDE_CBC
EC keySize < 224, 3DES_EDE_CBC
, anon, NULL
# Legacy algorithms for Secure Socket Layer/Transport Layer Security (SSL/TLS)
# processing in JSSE implementation.
...
...
test/javax/net/ssl/ciphersuites/DisabledAlgorithms.java
浏览文件 @
27d9bbd5
/*
* Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2015,
2018,
Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
...
...
@@ -38,7 +38,7 @@ import javax.net.ssl.SSLSocketFactory;
/**
* @test
* @bug 8076221 8157035
* @bug 8076221 8157035
8211883
* @summary Check if weak cipher suites are disabled
* @run main/othervm DisabledAlgorithms default
* @run main/othervm DisabledAlgorithms empty
...
...
@@ -59,9 +59,9 @@ public class DisabledAlgorithms {
System
.
getProperty
(
"test.src"
,
"./"
)
+
"/"
+
pathToStores
+
"/"
+
trustStoreFile
;
// supported RC4 cipher suites
// supported RC4
, NULL, and anon
cipher suites
// it does not contain KRB5 cipher suites because they need a KDC
private
static
final
String
[]
rc4_ciphersuites
=
new
String
[]
{
private
static
final
String
[]
rc4_
null_anon_
ciphersuites
=
new
String
[]
{
"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"
,
"TLS_ECDHE_RSA_WITH_RC4_128_SHA"
,
"SSL_RSA_WITH_RC4_128_SHA"
,
...
...
@@ -69,7 +69,31 @@ public class DisabledAlgorithms {
"TLS_ECDH_RSA_WITH_RC4_128_SHA"
,
"SSL_RSA_WITH_RC4_128_MD5"
,
"TLS_ECDH_anon_WITH_RC4_128_SHA"
,
"SSL_DH_anon_WITH_RC4_128_MD5"
"SSL_DH_anon_WITH_RC4_128_MD5"
,
"SSL_RSA_WITH_NULL_MD5"
,
"SSL_RSA_WITH_NULL_SHA"
,
"TLS_RSA_WITH_NULL_SHA256"
,
"TLS_ECDH_ECDSA_WITH_NULL_SHA"
,
"TLS_ECDHE_ECDSA_WITH_NULL_SHA"
,
"TLS_ECDH_RSA_WITH_NULL_SHA"
,
"TLS_ECDHE_RSA_WITH_NULL_SHA"
,
"TLS_ECDH_anon_WITH_NULL_SHA"
,
"SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA"
,
"SSL_DH_anon_EXPORT_WITH_RC4_40_MD5"
,
"SSL_DH_anon_WITH_3DES_EDE_CBC_SHA"
,
"SSL_DH_anon_WITH_DES_CBC_SHA"
,
"SSL_DH_anon_WITH_RC4_128_MD5"
,
"TLS_DH_anon_WITH_AES_128_CBC_SHA"
,
"TLS_DH_anon_WITH_AES_128_CBC_SHA256"
,
"TLS_DH_anon_WITH_AES_128_GCM_SHA256"
,
"TLS_DH_anon_WITH_AES_256_CBC_SHA"
,
"TLS_DH_anon_WITH_AES_256_CBC_SHA256"
,
"TLS_DH_anon_WITH_AES_256_GCM_SHA384"
,
"TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA"
,
"TLS_ECDH_anon_WITH_AES_128_CBC_SHA"
,
"TLS_ECDH_anon_WITH_AES_256_CBC_SHA"
,
"TLS_ECDH_anon_WITH_NULL_SHA"
,
"TLS_ECDH_anon_WITH_RC4_128_SHA"
};
public
static
void
main
(
String
[]
args
)
throws
Exception
{
...
...
@@ -88,8 +112,9 @@ public class DisabledAlgorithms {
System
.
out
.
println
(
"jdk.tls.disabledAlgorithms = "
+
Security
.
getProperty
(
"jdk.tls.disabledAlgorithms"
));
// check if RC4 cipher suites can't be used by default
checkFailure
(
rc4_ciphersuites
);
// check if RC4, NULL, and anon cipher suites
// can't be used by default
checkFailure
(
rc4_null_anon_ciphersuites
);
break
;
case
"empty"
:
// reset jdk.tls.disabledAlgorithms
...
...
@@ -97,9 +122,9 @@ public class DisabledAlgorithms {
System
.
out
.
println
(
"jdk.tls.disabledAlgorithms = "
+
Security
.
getProperty
(
"jdk.tls.disabledAlgorithms"
));
// check if RC4 cipher suites can be used
// check if RC4
, NULL, and anon
cipher suites can be used
// if jdk.tls.disabledAlgorithms is empty
checkSuccess
(
rc4_ciphersuites
);
checkSuccess
(
rc4_
null_anon_
ciphersuites
);
break
;
default
:
throw
new
RuntimeException
(
"Wrong parameter: "
+
args
[
0
]);
...
...
test/sun/security/ssl/SSLContextImpl/CustomizedCipherSuites.java
浏览文件 @
27d9bbd5
...
...
@@ -74,6 +74,7 @@
* TLS_ECDH_anon_WITH_AES_128_CBC_SHA
*/
import
java.security.Security
;
import
javax.net.ssl.*
;
/**
...
...
@@ -90,14 +91,18 @@ public class CustomizedCipherSuites {
private
static
boolean
isClientMode
;
private
static
String
enabledCipherSuite
;
private
static
String
dis
abledCipherSuite
;
private
static
String
notEn
abledCipherSuite
;
public
static
void
main
(
String
[]
args
)
throws
Exception
{
// reset the security property to make sure the cipher suites
// used in this test are not disabled
Security
.
setProperty
(
"jdk.tls.disabledAlgorithms"
,
""
);
contextProtocol
=
trimQuotes
(
args
[
0
]);
isClientMode
=
Boolean
.
parseBoolean
(
args
[
1
]);
enabledCipherSuite
=
trimQuotes
(
args
[
2
]);
dis
abledCipherSuite
=
trimQuotes
(
args
[
3
]);
notEn
abledCipherSuite
=
trimQuotes
(
args
[
3
]);
//
// Create instance of SSLContext with the specified protocol.
...
...
@@ -206,8 +211,8 @@ public class CustomizedCipherSuites {
isMatch
=
true
;
}
if
(!
dis
abledCipherSuite
.
isEmpty
()
&&
cipher
.
equals
(
dis
abledCipherSuite
))
{
if
(!
notEn
abledCipherSuite
.
isEmpty
()
&&
cipher
.
equals
(
notEn
abledCipherSuite
))
{
isBroken
=
true
;
}
}
...
...
@@ -219,7 +224,7 @@ public class CustomizedCipherSuites {
if
(
isBroken
)
{
throw
new
Exception
(
"Cipher suite "
+
disabledCipherSuite
+
" should be dis
abled"
);
"Cipher suite "
+
notEnabledCipherSuite
+
" should not be en
abled"
);
}
}
...
...
@@ -231,7 +236,7 @@ public class CustomizedCipherSuites {
}
boolean
hasEnabledCipherSuite
=
enabledCipherSuite
.
isEmpty
();
boolean
has
DisabledCipherSuite
=
dis
abledCipherSuite
.
isEmpty
();
boolean
has
NotEnabledCipherSuite
=
notEn
abledCipherSuite
.
isEmpty
();
for
(
String
cipher
:
ciphers
)
{
System
.
out
.
println
(
"\tsupported cipher suite "
+
cipher
);
if
(!
enabledCipherSuite
.
isEmpty
()
&&
...
...
@@ -239,9 +244,9 @@ public class CustomizedCipherSuites {
hasEnabledCipherSuite
=
true
;
}
if
(!
dis
abledCipherSuite
.
isEmpty
()
&&
cipher
.
equals
(
dis
abledCipherSuite
))
{
has
Dis
abledCipherSuite
=
true
;
if
(!
notEn
abledCipherSuite
.
isEmpty
()
&&
cipher
.
equals
(
notEn
abledCipherSuite
))
{
has
NotEn
abledCipherSuite
=
true
;
}
}
...
...
@@ -250,9 +255,9 @@ public class CustomizedCipherSuites {
"Cipher suite "
+
enabledCipherSuite
+
" should be supported"
);
}
if
(!
has
Dis
abledCipherSuite
)
{
if
(!
has
NotEn
abledCipherSuite
)
{
throw
new
Exception
(
"Cipher suite "
+
disabledCipherSuite
+
" should be support
ed"
);
"Cipher suite "
+
notEnabledCipherSuite
+
" should not be enabl
ed"
);
}
}
...
...
test/sun/security/ssl/javax/net/ssl/NewAPIs/JSSERenegotiate.java
浏览文件 @
27d9bbd5
/*
* Copyright (c) 2001, 201
1
, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2001, 201
8
, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
...
...
@@ -37,6 +37,7 @@
import
java.io.*
;
import
java.net.*
;
import
java.security.Security
;
import
javax.net.ssl.*
;
public
class
JSSERenegotiate
{
...
...
@@ -190,6 +191,10 @@ public class JSSERenegotiate {
volatile
Exception
clientException
=
null
;
public
static
void
main
(
String
[]
args
)
throws
Exception
{
// reset the security property to make sure that the cipher suites
// used in this test are not disabled
Security
.
setProperty
(
"jdk.tls.disabledAlgorithms"
,
""
);
String
keyFilename
=
System
.
getProperty
(
"test.src"
,
"./"
)
+
"/"
+
pathToStores
+
"/"
+
keyStoreFile
;
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录