commit c28417b0f421b80cd7efa339a3cce5609aafc880 Author: Andrew John Hughes Date: Mon Apr 18 20:04:49 2022 +0100 Support security.systemCACerts security property which can be disabled with -Djava.security.disableSystemCACerts=true PR2888: OpenJDK should check for system cacerts database (e.g. /etc/pki/java/cacerts) PR3575: System cacerts database handling should not affect jssecacerts RH2055274: Revert default keystore to JAVA_HOME/jre/lib/security/cacerts in portable builds diff --git a/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java b/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java index e7b4763db53..4b38d1f9465 100644 --- a/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java +++ b/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java @@ -68,7 +68,7 @@ final class TrustStoreManager { * The preference of the default trusted KeyStore is: * javax.net.ssl.trustStore * jssecacerts - * cacerts + * cacerts (system and local) */ private static final class TrustStoreDescriptor { private static final String fileSep = File.separator; @@ -79,6 +79,11 @@ final class TrustStoreManager { defaultStorePath + fileSep + "cacerts"; private static final String jsseDefaultStore = defaultStorePath + fileSep + "jssecacerts"; + /* Check system cacerts DB */ + private static final boolean systemStoreOff = + privilegedGetBooleanProperty("java.security.disableSystemCACerts"); + private static final String systemStore = (systemStoreOff ? defaultStore : + privilegedGetSecurityProperty("security.systemCACerts")); // the trust store name private final String storeName; @@ -139,28 +144,35 @@ final class TrustStoreManager { String storePropPassword = System.getProperty( "javax.net.ssl.trustStorePassword", ""); + if (SSLLogger.isOn && SSLLogger.isOn("trustmanager")) { + SSLLogger.fine("System store disabled: " + systemStoreOff); + SSLLogger.fine("System store: " + systemStore); + } + String temporaryName = ""; File temporaryFile = null; long temporaryTime = 0L; if (!"NONE".equals(storePropName)) { String[] fileNames = - new String[] {storePropName, defaultStore}; + new String[] {storePropName, + systemStore, defaultStore}; for (String fileName : fileNames) { - File f = new File(fileName); - if (f.isFile() && f.canRead()) { - temporaryName = fileName;; - temporaryFile = f; - temporaryTime = f.lastModified(); - - break; - } - - // Not break, the file is inaccessible. - if (SSLLogger.isOn && + if (fileName != null && !"".equals(fileName)) { + File f = new File(fileName); + if (f.isFile() && f.canRead()) { + temporaryName = fileName;; + temporaryFile = f; + temporaryTime = f.lastModified(); + + break; + } + // Not break, the file is inaccessible. + if (SSLLogger.isOn && SSLLogger.isOn("trustmanager")) { - SSLLogger.fine( - "Inaccessible trust store: " + - storePropName); + SSLLogger.fine( + "Inaccessible trust store: " + + fileName); + } } } } else { @@ -390,4 +402,31 @@ final class TrustStoreManager { return TrustStoreUtil.getTrustedCerts(ks); } } + + private static String privilegedGetSecurityProperty(final String prop) { + if (System.getSecurityManager() == null) { + return Security.getProperty(prop); + } else { + return AccessController.doPrivileged(new PrivilegedAction() { + @Override + public String run() { + return Security.getProperty(prop); + } + }); + } + } + + /** + * Returns {@code true} if the {@code System} property is present and set to @{code "true"}. + * + * @param prop the name of the property to check. + * @return true if the property is present and set to {@code "true"}. + */ + private static boolean privilegedGetBooleanProperty(final String prop) { + if (System.getSecurityManager() == null) { + return Boolean.getBoolean(prop); + } else { + return AccessController.doPrivileged(new GetBooleanAction(prop)); + } + } } diff --git a/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java b/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java index fcc77786da1..639fc220b6b 100644 --- a/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java +++ b/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java @@ -34,6 +34,7 @@ import java.io.InputStreamReader; import java.net.URL; import java.security.KeyStore; +import java.security.Security; import java.security.cert.X509Certificate; import java.text.Collator; @@ -103,9 +104,18 @@ public class KeyStoreUtil { throws Exception { String sep = File.separator; - File file = new File(System.getProperty("java.home") + sep - + "lib" + sep + "security" + sep - + "cacerts"); + File file = null; + /* Check system cacerts DB first */ + String systemDB = Security.getProperty("security.systemCACerts"); + boolean systemStoreOff = Boolean.getBoolean("java.security.disableSystemCACerts"); + if (!systemStoreOff && systemDB != null && !"".equals(systemDB)) { + file = new File(systemDB); + } + if (file == null || !file.exists()) { + file = new File(System.getProperty("java.home") + sep + + "lib" + sep + "security" + sep + + "cacerts"); + } if (!file.exists()) { return null; } diff --git a/jdk/src/share/lib/security/java.security-aix b/jdk/src/share/lib/security/java.security-aix index bfe0c593adb..093bc09bf95 100644 --- a/jdk/src/share/lib/security/java.security-aix +++ b/jdk/src/share/lib/security/java.security-aix @@ -294,6 +294,13 @@ security.overridePropertiesFile=true # security.useSystemPropertiesFile=false +# +# Specifies the system certificate store +# This property may be disabled using +# -Djava.security.disableSystemCACerts=true +# +security.systemCACerts=${java.home}/lib/security/cacerts + # # Determines the default key and trust manager factory algorithms for # the javax.net.ssl package. diff --git a/jdk/src/share/lib/security/java.security-linux b/jdk/src/share/lib/security/java.security-linux index 9d1c8fe8a8e..16c9281cc1f 100644 --- a/jdk/src/share/lib/security/java.security-linux +++ b/jdk/src/share/lib/security/java.security-linux @@ -307,6 +307,13 @@ security.overridePropertiesFile=true # security.useSystemPropertiesFile=false +# +# Specifies the system certificate store +# This property may be disabled using +# -Djava.security.disableSystemCACerts=true +# +security.systemCACerts=${java.home}/lib/security/cacerts + # # Determines the default key and trust manager factory algorithms for # the javax.net.ssl package. diff --git a/jdk/src/share/lib/security/java.security-macosx b/jdk/src/share/lib/security/java.security-macosx index 19047c61097..43e034cdeaf 100644 --- a/jdk/src/share/lib/security/java.security-macosx +++ b/jdk/src/share/lib/security/java.security-macosx @@ -297,6 +297,13 @@ security.overridePropertiesFile=true # security.useSystemPropertiesFile=false +# +# Specifies the system certificate store +# This property may be disabled using +# -Djava.security.disableSystemCACerts=true +# +security.systemCACerts=${java.home}/lib/security/cacerts + # # Determines the default key and trust manager factory algorithms for # the javax.net.ssl package. diff --git a/jdk/src/share/lib/security/java.security-solaris b/jdk/src/share/lib/security/java.security-solaris index 7eda556ae13..325937e97fb 100644 --- a/jdk/src/share/lib/security/java.security-solaris +++ b/jdk/src/share/lib/security/java.security-solaris @@ -295,6 +295,13 @@ security.overridePropertiesFile=true # security.useSystemPropertiesFile=false +# +# Specifies the system certificate store +# This property may be disabled using +# -Djava.security.disableSystemCACerts=true +# +security.systemCACerts=${java.home}/lib/security/cacerts + # # Determines the default key and trust manager factory algorithms for # the javax.net.ssl package. diff --git a/jdk/src/share/lib/security/java.security-windows b/jdk/src/share/lib/security/java.security-windows index dfa1a669aa9..92ef777e065 100644 --- a/jdk/src/share/lib/security/java.security-windows +++ b/jdk/src/share/lib/security/java.security-windows @@ -297,6 +297,13 @@ security.overridePropertiesFile=true # security.useSystemPropertiesFile=false +# +# Specifies the system certificate store +# This property may be disabled using +# -Djava.security.disableSystemCACerts=true +# +security.systemCACerts=${java.home}/lib/security/cacerts + # # Determines the default key and trust manager factory algorithms for # the javax.net.ssl package.