commit c28417b0f421b80cd7efa339a3cce5609aafc880
Author: Andrew John Hughes <andrew@openjdk.org>
Date: Mon Apr 18 20:04:49 2022 +0100
Support security.systemCACerts security property which can be disabled with -Djava.security.disableSystemCACerts=true
PR2888: OpenJDK should check for system cacerts database (e.g. /etc/pki/java/cacerts)
PR3575: System cacerts database handling should not affect jssecacerts
RH2055274: Revert default keystore to JAVA_HOME/jre/lib/security/cacerts in portable builds
diff --git a/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java b/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java
index e7b4763db53..4b38d1f9465 100644
--- a/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java
+++ b/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java
@@ -68,7 +68,7 @@ final class TrustStoreManager {
* The preference of the default trusted KeyStore is:
* javax.net.ssl.trustStore
* jssecacerts
- * cacerts
+ * cacerts (system and local)
*/
private static final class TrustStoreDescriptor {
private static final String fileSep = File.separator;
@@ -79,6 +79,11 @@ final class TrustStoreManager {
defaultStorePath + fileSep + "cacerts";
private static final String jsseDefaultStore =
defaultStorePath + fileSep + "jssecacerts";
+ /* Check system cacerts DB */
+ private static final boolean systemStoreOff =
+ privilegedGetBooleanProperty("java.security.disableSystemCACerts");
+ private static final String systemStore = (systemStoreOff ? defaultStore :
+ privilegedGetSecurityProperty("security.systemCACerts"));
// the trust store name
private final String storeName;
@@ -139,28 +144,35 @@ final class TrustStoreManager {
String storePropPassword = System.getProperty(
"javax.net.ssl.trustStorePassword", "");
+ if (SSLLogger.isOn && SSLLogger.isOn("trustmanager")) {
+ SSLLogger.fine("System store disabled: " + systemStoreOff);
+ SSLLogger.fine("System store: " + systemStore);
+ }
+
String temporaryName = "";
File temporaryFile = null;
long temporaryTime = 0L;
if (!"NONE".equals(storePropName)) {
String[] fileNames =
- new String[] {storePropName, defaultStore};
+ new String[] {storePropName,
+ systemStore, defaultStore};
for (String fileName : fileNames) {
- File f = new File(fileName);
- if (f.isFile() && f.canRead()) {
- temporaryName = fileName;;
- temporaryFile = f;
- temporaryTime = f.lastModified();
-
- break;
- }
-
- // Not break, the file is inaccessible.
- if (SSLLogger.isOn &&
+ if (fileName != null && !"".equals(fileName)) {
+ File f = new File(fileName);
+ if (f.isFile() && f.canRead()) {
+ temporaryName = fileName;;
+ temporaryFile = f;
+ temporaryTime = f.lastModified();
+
+ break;
+ }
+ // Not break, the file is inaccessible.
+ if (SSLLogger.isOn &&
SSLLogger.isOn("trustmanager")) {
- SSLLogger.fine(
- "Inaccessible trust store: " +
- storePropName);
+ SSLLogger.fine(
+ "Inaccessible trust store: " +
+ fileName);
+ }
}
}
} else {
@@ -390,4 +402,31 @@ final class TrustStoreManager {
return TrustStoreUtil.getTrustedCerts(ks);
}
}
+
+ private static String privilegedGetSecurityProperty(final String prop) {
+ if (System.getSecurityManager() == null) {
+ return Security.getProperty(prop);
+ } else {
+ return AccessController.doPrivileged(new PrivilegedAction<String>() {
+ @Override
+ public String run() {
+ return Security.getProperty(prop);
+ }
+ });
+ }
+ }
+
+ /**
+ * Returns {@code true} if the {@code System} property is present and set to @{code "true"}.
+ *
+ * @param prop the name of the property to check.
+ * @return true if the property is present and set to {@code "true"}.
+ */
+ private static boolean privilegedGetBooleanProperty(final String prop) {
+ if (System.getSecurityManager() == null) {
+ return Boolean.getBoolean(prop);
+ } else {
+ return AccessController.doPrivileged(new GetBooleanAction(prop));
+ }
+ }
}
diff --git a/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java b/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java
index fcc77786da1..639fc220b6b 100644
--- a/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java
+++ b/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java
@@ -34,6 +34,7 @@ import java.io.InputStreamReader;
import java.net.URL;
import java.security.KeyStore;
+import java.security.Security;
import java.security.cert.X509Certificate;
import java.text.Collator;
@@ -103,9 +104,18 @@ public class KeyStoreUtil {
throws Exception
{
String sep = File.separator;
- File file = new File(System.getProperty("java.home") + sep
- + "lib" + sep + "security" + sep
- + "cacerts");
+ File file = null;
+ /* Check system cacerts DB first */
+ String systemDB = Security.getProperty("security.systemCACerts");
+ boolean systemStoreOff = Boolean.getBoolean("java.security.disableSystemCACerts");
+ if (!systemStoreOff && systemDB != null && !"".equals(systemDB)) {
+ file = new File(systemDB);
+ }
+ if (file == null || !file.exists()) {
+ file = new File(System.getProperty("java.home") + sep
+ + "lib" + sep + "security" + sep
+ + "cacerts");
+ }
if (!file.exists()) {
return null;
}
diff --git a/jdk/src/share/lib/security/java.security-aix b/jdk/src/share/lib/security/java.security-aix
index bfe0c593adb..093bc09bf95 100644
--- a/jdk/src/share/lib/security/java.security-aix
+++ b/jdk/src/share/lib/security/java.security-aix
@@ -294,6 +294,13 @@ security.overridePropertiesFile=true
#
security.useSystemPropertiesFile=false
+#
+# Specifies the system certificate store
+# This property may be disabled using
+# -Djava.security.disableSystemCACerts=true
+#
+security.systemCACerts=${java.home}/lib/security/cacerts
+
#
# Determines the default key and trust manager factory algorithms for
# the javax.net.ssl package.
diff --git a/jdk/src/share/lib/security/java.security-linux b/jdk/src/share/lib/security/java.security-linux
index 9d1c8fe8a8e..16c9281cc1f 100644
--- a/jdk/src/share/lib/security/java.security-linux
+++ b/jdk/src/share/lib/security/java.security-linux
@@ -307,6 +307,13 @@ security.overridePropertiesFile=true
#
security.useSystemPropertiesFile=false
+#
+# Specifies the system certificate store
+# This property may be disabled using
+# -Djava.security.disableSystemCACerts=true
+#
+security.systemCACerts=${java.home}/lib/security/cacerts
+
#
# Determines the default key and trust manager factory algorithms for
# the javax.net.ssl package.
diff --git a/jdk/src/share/lib/security/java.security-macosx b/jdk/src/share/lib/security/java.security-macosx
index 19047c61097..43e034cdeaf 100644
--- a/jdk/src/share/lib/security/java.security-macosx
+++ b/jdk/src/share/lib/security/java.security-macosx
@@ -297,6 +297,13 @@ security.overridePropertiesFile=true
#
security.useSystemPropertiesFile=false
+#
+# Specifies the system certificate store
+# This property may be disabled using
+# -Djava.security.disableSystemCACerts=true
+#
+security.systemCACerts=${java.home}/lib/security/cacerts
+
#
# Determines the default key and trust manager factory algorithms for
# the javax.net.ssl package.
diff --git a/jdk/src/share/lib/security/java.security-solaris b/jdk/src/share/lib/security/java.security-solaris
index 7eda556ae13..325937e97fb 100644
--- a/jdk/src/share/lib/security/java.security-solaris
+++ b/jdk/src/share/lib/security/java.security-solaris
@@ -295,6 +295,13 @@ security.overridePropertiesFile=true
#
security.useSystemPropertiesFile=false
+#
+# Specifies the system certificate store
+# This property may be disabled using
+# -Djava.security.disableSystemCACerts=true
+#
+security.systemCACerts=${java.home}/lib/security/cacerts
+
#
# Determines the default key and trust manager factory algorithms for
# the javax.net.ssl package.
diff --git a/jdk/src/share/lib/security/java.security-windows b/jdk/src/share/lib/security/java.security-windows
index dfa1a669aa9..92ef777e065 100644
--- a/jdk/src/share/lib/security/java.security-windows
+++ b/jdk/src/share/lib/security/java.security-windows
@@ -297,6 +297,13 @@ security.overridePropertiesFile=true
#
security.useSystemPropertiesFile=false
+#
+# Specifies the system certificate store
+# This property may be disabled using
+# -Djava.security.disableSystemCACerts=true
+#
+security.systemCACerts=${java.home}/lib/security/cacerts
+
#
# Determines the default key and trust manager factory algorithms for
# the javax.net.ssl package.