Blame SOURCES/jdk8271199-rh2175317-custom_pkcs11_provider_support.patch

7ea29a
commit d41618f34f1d2f5416ec3c035f33dcb15cf5ab99
7ea29a
Author: Alexey Bakhtin <abakhtin@openjdk.org>
7ea29a
Date:   Tue Apr 4 10:29:11 2023 +0000
7ea29a
7ea29a
    8271199: Mutual TLS handshake fails signing client certificate with custom sensitive PKCS11 key
7ea29a
    
7ea29a
    Reviewed-by: andrew, mbalao
7ea29a
    Backport-of: f6232982b91cb2314e96ddbde3984836a810a556
7ea29a
7ea29a
diff --git a/jdk/src/share/classes/sun/security/rsa/RSAPSSSignature.java b/jdk/src/share/classes/sun/security/rsa/RSAPSSSignature.java
7ea29a
index a79e97d7c74..5378446b97b 100644
7ea29a
--- a/jdk/src/share/classes/sun/security/rsa/RSAPSSSignature.java
7ea29a
+++ b/jdk/src/share/classes/sun/security/rsa/RSAPSSSignature.java
7ea29a
@@ -127,12 +127,15 @@ public class RSAPSSSignature extends SignatureSpi {
7ea29a
     @Override
7ea29a
     protected void engineInitVerify(PublicKey publicKey)
7ea29a
             throws InvalidKeyException {
7ea29a
-        if (!(publicKey instanceof RSAPublicKey)) {
7ea29a
+        if (publicKey instanceof RSAPublicKey) {
7ea29a
+            RSAPublicKey rsaPubKey = (RSAPublicKey)publicKey;
7ea29a
+            isPublicKeyValid(rsaPubKey);
7ea29a
+            this.pubKey = rsaPubKey;
7ea29a
+            this.privKey = null;
7ea29a
+            resetDigest();
7ea29a
+        } else {
7ea29a
             throw new InvalidKeyException("key must be RSAPublicKey");
7ea29a
         }
7ea29a
-        this.pubKey = (RSAPublicKey) isValid((RSAKey)publicKey);
7ea29a
-        this.privKey = null;
7ea29a
-        resetDigest();
7ea29a
     }
7ea29a
 
7ea29a
     // initialize for signing. See JCA doc
7ea29a
@@ -146,14 +149,17 @@ public class RSAPSSSignature extends SignatureSpi {
7ea29a
     @Override
7ea29a
     protected void engineInitSign(PrivateKey privateKey, SecureRandom random)
7ea29a
             throws InvalidKeyException {
7ea29a
-        if (!(privateKey instanceof RSAPrivateKey)) {
7ea29a
+        if (privateKey instanceof RSAPrivateKey) {
7ea29a
+            RSAPrivateKey rsaPrivateKey = (RSAPrivateKey)privateKey;
7ea29a
+            isPrivateKeyValid(rsaPrivateKey);
7ea29a
+            this.privKey = rsaPrivateKey;
7ea29a
+            this.pubKey = null;
7ea29a
+            this.random =
7ea29a
+                    (random == null ? JCAUtil.getSecureRandom() : random);
7ea29a
+            resetDigest();
7ea29a
+        } else {
7ea29a
             throw new InvalidKeyException("key must be RSAPrivateKey");
7ea29a
         }
7ea29a
-        this.privKey = (RSAPrivateKey) isValid((RSAKey)privateKey);
7ea29a
-        this.pubKey = null;
7ea29a
-        this.random =
7ea29a
-            (random == null? JCAUtil.getSecureRandom() : random);
7ea29a
-        resetDigest();
7ea29a
     }
7ea29a
 
7ea29a
     /**
7ea29a
@@ -205,11 +211,57 @@ public class RSAPSSSignature extends SignatureSpi {
7ea29a
         }
7ea29a
     }
7ea29a
 
7ea29a
+    /**
7ea29a
+     * Validate the specified RSAPrivateKey
7ea29a
+     */
7ea29a
+    private void isPrivateKeyValid(RSAPrivateKey prKey)  throws InvalidKeyException {
7ea29a
+        try {
7ea29a
+            if (prKey instanceof RSAPrivateCrtKey) {
7ea29a
+                RSAPrivateCrtKey crtKey = (RSAPrivateCrtKey)prKey;
7ea29a
+                if (RSAPrivateCrtKeyImpl.checkComponents(crtKey)) {
7ea29a
+                    RSAKeyFactory.checkRSAProviderKeyLengths(
7ea29a
+                            crtKey.getModulus().bitLength(),
7ea29a
+                            crtKey.getPublicExponent());
7ea29a
+                } else {
7ea29a
+                    throw new InvalidKeyException(
7ea29a
+                            "Some of the CRT-specific components are not available");
7ea29a
+                }
7ea29a
+            } else {
7ea29a
+                RSAKeyFactory.checkRSAProviderKeyLengths(
7ea29a
+                        prKey.getModulus().bitLength(),
7ea29a
+                        null);
7ea29a
+            }
7ea29a
+        } catch (InvalidKeyException ikEx) {
7ea29a
+            throw ikEx;
7ea29a
+        } catch (Exception e) {
7ea29a
+            throw new InvalidKeyException(
7ea29a
+                    "Can not access private key components", e);
7ea29a
+        }
7ea29a
+        isValid(prKey);
7ea29a
+    }
7ea29a
+
7ea29a
+    /**
7ea29a
+     * Validate the specified RSAPublicKey
7ea29a
+     */
7ea29a
+    private void isPublicKeyValid(RSAPublicKey pKey)  throws InvalidKeyException {
7ea29a
+        try {
7ea29a
+            RSAKeyFactory.checkRSAProviderKeyLengths(
7ea29a
+                    pKey.getModulus().bitLength(),
7ea29a
+                    pKey.getPublicExponent());
7ea29a
+        } catch (InvalidKeyException ikEx) {
7ea29a
+            throw ikEx;
7ea29a
+        } catch (Exception e) {
7ea29a
+            throw new InvalidKeyException(
7ea29a
+                    "Can not access public key components", e);
7ea29a
+        }
7ea29a
+        isValid(pKey);
7ea29a
+    }
7ea29a
+
7ea29a
     /**
7ea29a
      * Validate the specified RSAKey and its associated parameters against
7ea29a
      * internal signature parameters.
7ea29a
      */
7ea29a
-    private RSAKey isValid(RSAKey rsaKey) throws InvalidKeyException {
7ea29a
+    private void isValid(RSAKey rsaKey) throws InvalidKeyException {
7ea29a
         try {
7ea29a
             AlgorithmParameterSpec keyParams = rsaKey.getParams();
7ea29a
             // validate key parameters
7ea29a
@@ -227,7 +279,6 @@ public class RSAPSSSignature extends SignatureSpi {
7ea29a
                 }
7ea29a
                 checkKeyLength(rsaKey, hLen, this.sigParams.getSaltLength());
7ea29a
             }
7ea29a
-            return rsaKey;
7ea29a
         } catch (SignatureException e) {
7ea29a
             throw new InvalidKeyException(e);
7ea29a
         }
7ea29a
diff --git a/jdk/src/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java b/jdk/src/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java
7ea29a
index 6b219937981..b3c1fae9672 100644
7ea29a
--- a/jdk/src/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java
7ea29a
+++ b/jdk/src/share/classes/sun/security/rsa/RSAPrivateCrtKeyImpl.java
7ea29a
@@ -80,22 +80,28 @@ public final class RSAPrivateCrtKeyImpl
7ea29a
         RSAPrivateCrtKeyImpl key = new RSAPrivateCrtKeyImpl(encoded);
7ea29a
         // check all CRT-specific components are available, if any one
7ea29a
         // missing, return a non-CRT key instead
7ea29a
-        if ((key.getPublicExponent().signum() == 0) ||
7ea29a
-            (key.getPrimeExponentP().signum() == 0) ||
7ea29a
-            (key.getPrimeExponentQ().signum() == 0) ||
7ea29a
-            (key.getPrimeP().signum() == 0) ||
7ea29a
-            (key.getPrimeQ().signum() == 0) ||
7ea29a
-            (key.getCrtCoefficient().signum() == 0)) {
7ea29a
+        if (checkComponents(key)) {
7ea29a
+            return key;
7ea29a
+        } else {
7ea29a
             return new RSAPrivateKeyImpl(
7ea29a
                 key.algid,
7ea29a
                 key.getModulus(),
7ea29a
-                key.getPrivateExponent()
7ea29a
-            );
7ea29a
-        } else {
7ea29a
-            return key;
7ea29a
+                key.getPrivateExponent());
7ea29a
         }
7ea29a
     }
7ea29a
 
7ea29a
+    /**
7ea29a
+     * Validate if all CRT-specific components are available.
7ea29a
+     */
7ea29a
+    static boolean checkComponents(RSAPrivateCrtKey key) {
7ea29a
+        return !((key.getPublicExponent().signum() == 0) ||
7ea29a
+            (key.getPrimeExponentP().signum() == 0) ||
7ea29a
+            (key.getPrimeExponentQ().signum() == 0) ||
7ea29a
+            (key.getPrimeP().signum() == 0) ||
7ea29a
+            (key.getPrimeQ().signum() == 0) ||
7ea29a
+            (key.getCrtCoefficient().signum() == 0));
7ea29a
+    }
7ea29a
+
7ea29a
     /**
7ea29a
      * Generate a new key from the specified type and components.
7ea29a
      * Returns a CRT key if possible and a non-CRT key otherwise.