8139436: sun.security.mscapi.KeyStore might load incomplete data

Reviewed-by: vinnie, weijun

jdk/src/jdk.crypto.mscapi/windows/classes/sun/security/mscapi/KeyStore.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2005, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2005, 2015, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -310,7 +310,7 @@ abstract class KeyStore extends KeyStoreSpi {
             if (alias.equals(entry.getAlias()))
             {
                 X509Certificate[] certChain = entry.getCertificateChain();
-                return certChain[0];
+                return certChain.length == 0 ? null : certChain[0];
             }
         }
 
@@ -840,7 +840,7 @@ abstract class KeyStore extends KeyStoreSpi {
 
             // Obtain certificate factory
             if (certificateFactory == null) {
-                certificateFactory = CertificateFactory.getInstance("X.509");
+                certificateFactory = CertificateFactory.getInstance("X.509", "SUN");
             }
 
             // Generate certificate

jdk/test/sun/security/mscapi/AccessKeyStore.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2005, 2015, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -36,17 +36,6 @@ public class AccessKeyStore {
 
     public static void main(String[] args) throws Exception {
 
-        // Check if the provider is available
-        try {
-            Class.forName("sun.security.mscapi.SunMSCAPI");
-
-        } catch (Exception e) {
-            System.out.println(
-                "The SunMSCAPI provider is not available on this platform: " +
-                e);
-            return;
-        }
-
         // Check that a security manager has been installed
         if (System.getSecurityManager() == null) {
             throw new Exception("A security manager has not been installed");
@@ -86,8 +75,8 @@ public class AccessKeyStore {
         }
 
         int i = 0;
-        for (Enumeration e = keyStore.aliases(); e.hasMoreElements(); ) {
+        for (Enumeration<String> e = keyStore.aliases(); e.hasMoreElements(); ) {
-            String alias = (String) e.nextElement();
+            String alias = e.nextElement();
             displayEntry(keyStore, alias, i++);
         }
     }

jdk/test/sun/security/mscapi/AccessKeyStore.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 #
-# Copyright (c) 2005, 2011, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2005, 2015, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -26,6 +26,7 @@
 
 # @test
 # @bug 6324295 6931562
+# @requires os.family == "windows"
 # @run shell AccessKeyStore.sh
 # @summary Confirm that permission must be granted to access keystores.
 

jdk/test/sun/security/mscapi/IsSunMSCAPIAvailable.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2005, 2007, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2005, 2015, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -33,16 +33,6 @@ public class IsSunMSCAPIAvailable {
 
     public static void main(String[] args) throws Exception {
 
-        // Check if the provider is available
-        try {
-            Class.forName("sun.security.mscapi.SunMSCAPI");
-
-        } catch (Exception e) {
-            System.out.println(
-                "The SunMSCAPI provider is not available on this platform");
-            return;
-        }
-
         // Dynamically register the SunMSCAPI provider
         Security.addProvider(new sun.security.mscapi.SunMSCAPI());
 
@@ -58,7 +48,6 @@ public class IsSunMSCAPIAvailable {
         /*
          * Secure Random
          */
-
         SecureRandom random = SecureRandom.getInstance("Windows-PRNG", p);
         System.out.println("    Windows-PRNG is implemented by: " +
             random.getClass().getName());

jdk/test/sun/security/mscapi/IsSunMSCAPIAvailable.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 #
-# Copyright (c) 2005, 2011, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2005, 2015, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -26,6 +26,7 @@
 
 # @test
 # @bug 6318171 6931562
+# @requires os.family == "windows"
 # @run shell IsSunMSCAPIAvailable.sh
 # @summary Basic test of the Microsoft CryptoAPI provider.
 

jdk/test/sun/security/mscapi/IterateWindowsRootStore.java

@@ -0,0 +1,130 @@
+/*
+ * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.InputStream;
+import java.security.KeyStore;
+import java.security.Provider;
+import java.security.Security;
+import java.security.cert.CRL;
+import java.security.cert.CRLException;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactorySpi;
+import java.util.Collection;
+import java.util.Enumeration;
+
+/*
+ * @test
+ * @bug 8139436
+ * @summary This test validates an iteration over the Windows-ROOT certificate store
+ *          and retrieving all certificates.
+ *          Bug 8139436 reports an issue when 3rd party JCE providers would throw exceptions
+ *          upon creating Certificate objects.
+ *          This would for instance happen when using IAIK 3.15 and Elliptic Curve certificates
+ *          are contained in the Windows-ROOT certificate store.
+ *          The test uses a simple dummy provider which just throws Exceptions in its CertificateFactory.
+ *          To test an external provider, you can use property sun.security.mscapi.testprovider and
+ *          set it to the provider class name which has to be constructible by a constructor without
+ *          arguments. The provider jar has to be added to the classpath.
+ *          E.g. run jtreg with -javaoption:-Dsun.security.mscapi.testprovider=iaik.security.provider.IAIK and
+ *          -cpa:<path to iaik_jce.jar>
+ *
+ * @requires os.family == "windows"
+ * @author Christoph Langer
+ * @run main IterateWindowsRootStore
+ */
+public class IterateWindowsRootStore {
+    public static class TestFactory extends CertificateFactorySpi {
+        @Override
+        public Certificate engineGenerateCertificate(InputStream inStream) throws CertificateException {
+            throw new CertificateException("unimplemented");
+        }
+
+        @Override
+        public Collection<? extends Certificate> engineGenerateCertificates(InputStream inStream) throws CertificateException {
+            throw new CertificateException("unimplemented");
+        }
+
+        @Override
+        public CRL engineGenerateCRL(InputStream inStream) throws CRLException {
+            throw new CRLException("unimplemented");
+        }
+
+        @Override
+        public Collection<? extends CRL> engineGenerateCRLs(InputStream inStream) throws CRLException {
+            throw new CRLException("unimplemented");
+        }
+    }
+
+    public static class TestProvider extends Provider {
+        private static final long serialVersionUID = 1L;
+
+        public TestProvider() {
+            super("TestProvider", 0.1, "Test provider for IterateWindowsRootStore");
+
+            /*
+             * Certificates
+             */
+            this.put("CertificateFactory.X.509", "IterateWindowsRootStore$TestFactory");
+            this.put("Alg.Alias.CertificateFactory.X509", "X.509");
+        }
+    }
+
+    public static void main(String[] args) throws Exception {
+        // Try to register a JCE provider from property sun.security.mscapi.testprovider in the first slot
+        // otherwise register a dummy provider which would provoke the issue of bug 8139436
+        boolean providerPrepended = false;
+        String testprovider = System.getProperty("sun.security.mscapi.testprovider");
+        if (testprovider != null && !testprovider.isEmpty()) {
+            try {
+                System.out.println("Trying to prepend external JCE provider " + testprovider);
+                Class<?> providerclass = Class.forName(testprovider);
+                Object provider = providerclass.newInstance();
+                Security.insertProviderAt((Provider)provider, 1);
+            } catch (Exception e) {
+                System.out.println("Could not load JCE provider " + testprovider +". Exception is:");
+                e.printStackTrace(System.out);
+            }
+            providerPrepended = true;
+            System.out.println("Sucessfully prepended JCE provider " + testprovider);
+        }
+        if (!providerPrepended) {
+            System.out.println("Trying to prepend dummy JCE provider");
+            Security.insertProviderAt(new TestProvider(), 1);
+            System.out.println("Sucessfully prepended dummy JCE provider");
+        }
+
+        // load Windows-ROOT KeyStore
+        KeyStore keyStore = KeyStore.getInstance("Windows-ROOT", "SunMSCAPI");
+        keyStore.load(null, null);
+
+        // iterate KeyStore
+        Enumeration<String> aliases = keyStore.aliases();
+        while (aliases.hasMoreElements()) {
+            String alias = aliases.nextElement();
+            System.out.print("Reading certificate for alias: " + alias + "...");
+            keyStore.getCertificate(alias);
+            System.out.println(" done.");
+        }
+    }
+}

jdk/test/sun/security/mscapi/KeyStoreCompatibilityMode.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2005, 2015, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -38,17 +38,6 @@ public class KeyStoreCompatibilityMode {
 
     public static void main(String[] args) throws Exception {
 
-        // Check if the provider is available
-        try {
-            Class.forName("sun.security.mscapi.SunMSCAPI");
-
-        } catch (Exception e) {
-            System.out.println(
-                "The SunMSCAPI provider is not available on this platform: " +
-                e);
-            return;
-        }
-
         if (args.length > 0 && "-disable".equals(args[0])) {
             mode = false;
         } else {

jdk/test/sun/security/mscapi/KeyStoreCompatibilityMode.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 #
-# Copyright (c) 2005, 2011, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2005, 2015, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -23,9 +23,9 @@
 # questions.
 #
 
-
 # @test
 # @bug 6324294 6931562
+# @requires os.family == "windows"
 # @run shell KeyStoreCompatibilityMode.sh
 # @summary Confirm that a null stream or password is not permitted when 
 #          compatibility mode is enabled (and vice versa).

jdk/test/sun/security/mscapi/KeytoolChangeAlias.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 #
-# Copyright (c) 2006, 2011, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2006, 2015, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -26,6 +26,7 @@
 
 # @test
 # @bug 6415696 6931562
+# @requires os.family == "windows"
 # @run shell KeytoolChangeAlias.sh
 # @summary Test "keytool -changealias" using the Microsoft CryptoAPI provider.
 

jdk/test/sun/security/mscapi/PrngSlow.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2006, 2015 Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -24,6 +24,7 @@
 /**
  * @test
  * @bug 6449335
+ * @requires os.family == "windows"
  * @summary MSCAPI's PRNG is too slow
  * @key randomness
  */
@@ -34,23 +35,15 @@ public class PrngSlow {
 
     public static void main(String[] args) throws Exception {
         double t = 0.0;
-        try {
+        SecureRandom sr = null;
-            SecureRandom sr = null;
+        sr = SecureRandom.getInstance("Windows-PRNG", "SunMSCAPI");
-            sr = SecureRandom.getInstance("PRNG", "SunMSCAPI");
+        long start = System.nanoTime();
-            long start = System.nanoTime();
+        for (int i = 0; i < 10000; i++) {
-            int x = 0;
+            if (i % 100 == 0) System.err.print(".");
-            for(int i = 0; i < 10000; i++) {
+            sr.nextBoolean();
-                if (i % 100 == 0) System.err.print(".");
+        };
-                if (sr.nextBoolean()) x++;
+        t = (System.nanoTime() - start) / 1000000000.0;
-            };
+        System.err.println("\nSpend " + t + " seconds");
-            t = (System.nanoTime() - start) / 1000000000.0;
-            System.err.println("\nSpend " + t + " seconds");
-        } catch (Exception e) {
-            // Not supported here, maybe not a Win32
-            System.err.println("Cannot find PRNG for SunMSCAPI or other mysterious bugs");
-            e.printStackTrace();
-            return;
-        }
         if (t > 5)
             throw new RuntimeException("Still too slow");
     }

jdk/test/sun/security/mscapi/PublicKeyInterop.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, 2015, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -38,8 +38,6 @@ import sun.misc.HexDumpEncoder;
 public class PublicKeyInterop {
 
     public static void main(String[] arg) throws Exception {
-        PrivateKey privKey = null;
-        Certificate cert = null;
         KeyStore ks = KeyStore.getInstance("Windows-MY");
         ks.load(null, null);
         System.out.println("Loaded keystore: Windows-MY");

jdk/test/sun/security/mscapi/PublicKeyInterop.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 #
-# Copyright (c) 2011, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2011, 2015 Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,7 @@
 
 # @test
 # @bug 6888925
+# @requires os.family == "windows"
 # @run shell PublicKeyInterop.sh
 # @summary SunMSCAPI's Cipher can't use RSA public keys obtained from other
 #          sources.

jdk/test/sun/security/mscapi/RSAEncryptDecrypt.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 #
-# Copyright (c) 2006, 2011, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2006, 2015, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,7 @@
 
 # @test
 # @bug 6457422 6931562
+# @requires os.family == "windows"
 # @run shell RSAEncryptDecrypt.sh
 # @summary Confirm that plaintext can be encrypted and then decrypted using the
 #	   RSA cipher in the SunMSCAPI crypto provider. NOTE: The RSA cipher is 

jdk/test/sun/security/mscapi/ShortRSAKey1024.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 #
-# Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2012, 2015, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -27,6 +27,7 @@
 # @test
 # @bug 7106773
 # @summary 512 bits RSA key cannot work with SHA384 and SHA512
+# @requires os.family == "windows"
 # @run shell ShortRSAKey1024.sh 1024
 # @run shell ShortRSAKey1024.sh 768
 # @run shell ShortRSAKey1024.sh 512

jdk/test/sun/security/mscapi/ShortRSAKeyWithinTLS.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2015, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -22,12 +22,9 @@
  */
 
 import java.io.*;
-import java.net.*;
-import java.util.*;
 import java.security.*;
 import javax.net.*;
 import javax.net.ssl.*;
-import java.lang.reflect.*;
 
 import sun.security.util.KeyUtil;
 

jdk/test/sun/security/mscapi/SignUsingNONEwithRSA.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2012, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, 2015, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -118,12 +118,12 @@ public class SignUsingNONEwithRSA {
         ks.load(null, null);
         System.out.println("Loaded keystore: Windows-MY");
 
-        Enumeration e = ks.aliases();
+        Enumeration<String> e = ks.aliases();
         PrivateKey privateKey = null;
         PublicKey publicKey = null;
 
         while (e.hasMoreElements()) {
-            String alias = (String) e.nextElement();
+            String alias = e.nextElement();
             if (alias.equals("6578658")) {
                 System.out.println("Loaded entry: " + alias);
                 privateKey = (PrivateKey) ks.getKey(alias, null);

jdk/test/sun/security/mscapi/SignUsingNONEwithRSA.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 #
-# Copyright (c) 2011, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2011, 2015, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -26,6 +26,7 @@
 
 # @test
 # @bug 6578658
+# @requires os.family == "windows"
 # @run shell SignUsingNONEwithRSA.sh
 # @summary Sign using the NONEwithRSA signature algorithm from SunMSCAPI
 # @key intermittent

jdk/test/sun/security/mscapi/SignUsingSHA2withRSA.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2012, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, 2015, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -58,12 +58,12 @@ public class SignUsingSHA2withRSA {
         ks.load(null, null);
         System.out.println("Loaded keystore: Windows-MY");
 
-        Enumeration e = ks.aliases();
+        Enumeration<String> e = ks.aliases();
         PrivateKey privateKey = null;
         PublicKey publicKey = null;
 
         while (e.hasMoreElements()) {
-            String alias = (String) e.nextElement();
+            String alias = e.nextElement();
             if (alias.equals("6753664")) {
                 System.out.println("Loaded entry: " + alias);
                 privateKey = (PrivateKey) ks.getKey(alias, null);

jdk/test/sun/security/mscapi/SignUsingSHA2withRSA.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 #
-# Copyright (c) 2011, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2011, 2015, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -26,6 +26,7 @@
 
 # @test
 # @bug 6753664
+# @requires os.family == "windows"
 # @run shell SignUsingSHA2withRSA.sh
 # @summary Support SHA256 (and higher) in SunMSCAPI
 # @key intermittent

jdk/test/sun/security/mscapi/SignatureOffsets.java

@@ -36,6 +36,7 @@ import java.security.SignatureException;
  *          and passing in different signature offset (0, 33, 66, 99).
  * @library /lib/testlibrary
  * @compile ../../../java/security/Signature/Offsets.java
+ * @requires os.family == "windows"
  * @run main SignatureOffsets SunMSCAPI NONEwithRSA
  * @run main SignatureOffsets SunMSCAPI MD2withRSA
  * @run main SignatureOffsets SunMSCAPI MD5withRSA

jdk/test/sun/security/mscapi/SignedObjectChain.java

@@ -25,6 +25,7 @@
  * @test
  * @bug 8050374
  * @compile ../../../java/security/SignedObject/Chain.java
+ * @requires os.family == "windows"
  * @summary Verify a chain of signed objects
  */
 public class SignedObjectChain {

jdk/test/sun/security/mscapi/SmallPrimeExponentP.java

@@ -28,8 +28,6 @@ import java.security.KeyStore;
 import java.security.SecureRandom;
 import java.security.cert.X509Certificate;
 import java.security.interfaces.RSAPrivateCrtKey;
-import java.util.HashSet;
-import java.util.Set;
 
 /*
  * @test
@@ -37,6 +35,7 @@ import java.util.Set;
  * @modules java.base/sun.security.x509
  *          java.base/sun.security.tools.keytool
  * @summary sun/security/mscapi/ShortRSAKey1024.sh fails intermittently
+ * @requires os.family == "windows"
  */
 public class SmallPrimeExponentP {