From f1212e26c3126297268374142cf285ee66fe4e60 Mon Sep 17 00:00:00 2001 From: Martin Balao Date: Wed, 13 Dec 2017 01:29:58 +0800 Subject: [PATCH] 8165996: PKCS11 using NSS throws an error regarding secmod.db when NSS uses sqlite Reviewed-by: weijun --- .../classes/sun/security/pkcs11/Secmod.java | 22 ++- test/jdk/sun/security/pkcs11/PKCS11Test.java | 17 ++- .../sun/security/pkcs11/Secmod/README-SQLITE | 8 ++ .../pkcs11/Secmod/TestNssDbSqlite.java | 134 ++++++++++++++++++ test/jdk/sun/security/pkcs11/Secmod/cert9.db | Bin 0 -> 9216 bytes test/jdk/sun/security/pkcs11/Secmod/key4.db | Bin 0 -> 11264 bytes .../sun/security/pkcs11/Secmod/nss-sqlite.cfg | 13 ++ test/jdk/sun/security/pkcs11/SecmodTest.java | 23 ++- 8 files changed, 201 insertions(+), 16 deletions(-) create mode 100644 test/jdk/sun/security/pkcs11/Secmod/README-SQLITE create mode 100644 test/jdk/sun/security/pkcs11/Secmod/TestNssDbSqlite.java create mode 100644 test/jdk/sun/security/pkcs11/Secmod/cert9.db create mode 100644 test/jdk/sun/security/pkcs11/Secmod/key4.db create mode 100644 test/jdk/sun/security/pkcs11/Secmod/nss-sqlite.cfg diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Secmod.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Secmod.java index 2059e4bc5bf..c26c79c7209 100644 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Secmod.java +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Secmod.java @@ -196,13 +196,23 @@ public final class Secmod { } if (configDir != null) { - File configBase = new File(configDir); - if (configBase.isDirectory() == false ) { - throw new IOException("configDir must be a directory: " + configDir); + String configDirPath = null; + String sqlPrefix = "sql:/"; + if (!configDir.startsWith(sqlPrefix)) { + configDirPath = configDir; + } else { + StringBuilder configDirPathSB = new StringBuilder(configDir); + configDirPath = configDirPathSB.substring(sqlPrefix.length()); } - File secmodFile = new File(configBase, "secmod.db"); - if (secmodFile.isFile() == false) { - throw new FileNotFoundException(secmodFile.getPath()); + File configBase = new File(configDirPath); + if (configBase.isDirectory() == false ) { + throw new IOException("configDir must be a directory: " + configDirPath); + } + if (!configDir.startsWith(sqlPrefix)) { + File secmodFile = new File(configBase, "secmod.db"); + if (secmodFile.isFile() == false) { + throw new FileNotFoundException(secmodFile.getPath()); + } } } diff --git a/test/jdk/sun/security/pkcs11/PKCS11Test.java b/test/jdk/sun/security/pkcs11/PKCS11Test.java index 7b23e808e77..49d0a0edbb3 100644 --- a/test/jdk/sun/security/pkcs11/PKCS11Test.java +++ b/test/jdk/sun/security/pkcs11/PKCS11Test.java @@ -741,13 +741,18 @@ public abstract class PKCS11Test { } private static String distro() { - try (BufferedReader in = - new BufferedReader(new InputStreamReader( - Runtime.getRuntime().exec("uname -v").getInputStream()))) { + if (props.getProperty("os.name").equals("SunOS")) { + try (BufferedReader in = + new BufferedReader(new InputStreamReader( + Runtime.getRuntime().exec("uname -v").getInputStream()))) { - return in.readLine(); - } catch (Exception e) { - throw new RuntimeException("Failed to determine distro.", e); + return in.readLine(); + } catch (Exception e) { + throw new RuntimeException("Failed to determine distro.", e); + } + } else { + // Not used outside Solaris + return null; } } diff --git a/test/jdk/sun/security/pkcs11/Secmod/README-SQLITE b/test/jdk/sun/security/pkcs11/Secmod/README-SQLITE new file mode 100644 index 00000000000..761866258c6 --- /dev/null +++ b/test/jdk/sun/security/pkcs11/Secmod/README-SQLITE @@ -0,0 +1,8 @@ +// How to create key4.db and cert9.db +cd +echo "" > 1 +echo "test12" > 2 +modutil -create -force -dbdir sql:/$(pwd) +modutil -list "NSS Internal PKCS #11 Module" -dbdir sql:/$(pwd) +modutil -changepw "NSS Certificate DB" -force -dbdir sql:/$(pwd) -pwfile $(pwd)/1 -newpwfile $(pwd)/2 + diff --git a/test/jdk/sun/security/pkcs11/Secmod/TestNssDbSqlite.java b/test/jdk/sun/security/pkcs11/Secmod/TestNssDbSqlite.java new file mode 100644 index 00000000000..ab503aeb94f --- /dev/null +++ b/test/jdk/sun/security/pkcs11/Secmod/TestNssDbSqlite.java @@ -0,0 +1,134 @@ +/* + * Copyright (c) 2017, Red Hat, Inc. and/or its affiliates. + * + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +/* + * @test + * @bug 8165996 + * @summary Test NSS DB Sqlite + * @library ../ + * @modules java.base/sun.security.rsa + * java.base/sun.security.provider + * java.base/sun.security.jca + * java.base/sun.security.tools.keytool + * java.base/sun.security.x509 + * java.base/com.sun.crypto.provider + * jdk.crypto.cryptoki/sun.security.pkcs11:+open + * @run main/othervm/timeout=120 TestNssDbSqlite + * @author Martin Balao (mbalao@redhat.com) + */ + +import java.security.PrivateKey; +import java.security.cert.Certificate; +import java.security.KeyStore; +import java.security.Provider; +import java.security.Signature; + +import sun.security.rsa.SunRsaSign; +import sun.security.jca.ProviderList; +import sun.security.jca.Providers; +import sun.security.tools.keytool.CertAndKeyGen; +import sun.security.x509.X500Name; + +public final class TestNssDbSqlite extends SecmodTest { + + private static final boolean enableDebug = true; + + private static Provider sunPKCS11NSSProvider; + private static Provider sunRsaSignProvider; + private static Provider sunJCEProvider; + private static KeyStore ks; + private static char[] passphrase = "test12".toCharArray(); + private static PrivateKey privateKey; + private static Certificate certificate; + + public static void main(String[] args) throws Exception { + + initialize(); + + if (enableDebug) { + System.out.println("SunPKCS11 provider: " + + sunPKCS11NSSProvider); + } + + testRetrieveKeysFromKeystore(); + + System.out.println("Test PASS - OK"); + } + + private static void testRetrieveKeysFromKeystore() throws Exception { + + String plainText = "known plain text"; + + ks.setKeyEntry("root_ca_1", privateKey, passphrase, + new Certificate[]{certificate}); + PrivateKey k1 = (PrivateKey) ks.getKey("root_ca_1", passphrase); + + Signature sS = Signature.getInstance( + "SHA256withRSA", sunPKCS11NSSProvider); + sS.initSign(k1); + sS.update(plainText.getBytes()); + byte[] generatedSignature = sS.sign(); + + if (enableDebug) { + System.out.println("Generated signature: "); + for (byte b : generatedSignature) { + System.out.printf("0x%02x, ", (int)(b) & 0xFF); + } + System.out.println(""); + } + + Signature sV = Signature.getInstance("SHA256withRSA", sunRsaSignProvider); + sV.initVerify(certificate); + sV.update(plainText.getBytes()); + if(!sV.verify(generatedSignature)){ + throw new Exception("Couldn't verify signature"); + } + } + + private static void initialize() throws Exception { + initializeProvider(); + } + + private static void initializeProvider () throws Exception { + useSqlite(true); + if (!initSecmod()) { + return; + } + + sunPKCS11NSSProvider = getSunPKCS11(BASE + SEP + "nss-sqlite.cfg"); + sunJCEProvider = new com.sun.crypto.provider.SunJCE(); + sunRsaSignProvider = new SunRsaSign(); + Providers.setProviderList(ProviderList.newList( + sunJCEProvider, sunPKCS11NSSProvider, + new sun.security.provider.Sun(), sunRsaSignProvider)); + + ks = KeyStore.getInstance("PKCS11-NSS-Sqlite", sunPKCS11NSSProvider); + ks.load(null, passphrase); + + CertAndKeyGen gen = new CertAndKeyGen("RSA", "SHA256withRSA"); + gen.generate(2048); + privateKey = gen.getPrivateKey(); + certificate = gen.getSelfCertificate(new X500Name("CN=Me"), 365); + } +} diff --git a/test/jdk/sun/security/pkcs11/Secmod/cert9.db b/test/jdk/sun/security/pkcs11/Secmod/cert9.db new file mode 100644 index 0000000000000000000000000000000000000000..a202bea21e99c8063fdce58c3fedff9c29bcc306 GIT binary patch literal 9216 zcmeHL&r2IY6y9}{s0HyDN)MT%ffnY+?z*8+jJkzT8#Rqk4@Gv971E|kO#=N73O)4i z>ABEj|CpY8>AY`eH|j+MEvC%EynHk7y>H%pJClsQIoumfGj@7@@iCb)Pvwo|9Rp9;=sJLr1$>mdh|C8Do ztO8bn2cp0us>7cD2l6&-8CHRRtH7G~Q(xrQ9cNtw$N8e%<$9yxeha2aI?m1}lY?10 z9t}#cw9|{*{h0OJ+j}u9huOwx$PRj)*X`ahdletEqi*N$C}#UzwzJ=Tx!2k0v-b9W zum6-KTsNVc)J+k_0F4M5il`e=H$s;}BA-k^CM2^-CL+@!laNWZX@QF87L1%Y1kdLo z7Qu-|aN-f1hy*7l!HG(6;u4(51Rsz!<>mE(S>_nb63i0J63i0J63i0J3RwzS3RwzS z3Rxk%A-o~HA-rMk1!oA(O+-Q;0f8h|Dmmp!tW=^}pX)~o8a9x46`~cQ6{58hA$cIh z_)yB{G`A0>d?@8(Rv)wacrO8R1F!{P3y?d=0_CfKC=DcD18HFf(hLUD5)Gtv8b|^f zNGj$Kq8K<&gFI$*o)#8q;k+CTi*ht9%F(bWN5g_w!=fAw3tkN`@zS25iS;OL90O_h z7)V>lz~LNbb9h=pY=k^EotKkRIl~~~!xV}~^lmw1r&wQwt)@P>&u{;=u|g^K_y6|7 z*$k_||Dpi>{a;=B;dsBiuima#(a=6tfdx`vt5&Pm8}9MwY?yr>d`L#a@>aTPE~}mH zZv2+PM>o>a&o=ZWPc~mv!EgkIagt`^GGgTl1ANyRRCBjdt3PSD?~p&4rSG%Bv}9Pm z!eG4DIRqEYwpXh^F4i%cOlH|dNm9K+k~^<+M4~B{YW29`I(Z?V#`-_|C&_Gjj{Zr> sb|OmX+28*K+UmActH2#AV9);@3u@`C0t=*oJ^u^zvTUhVfjd^zQB-lYi7PmC0V2VJxRYskE~qM-KR$|rvGyHobniBo zxvZB8NCp0$0uj;4igs_mmw|_FjhbfhpH?*X5lf5k6@CupvXXB zL(v6A7K&~t94IQH=te5$mB`3|gEKDih;5-#7Aj?7R12e8_+B#T zn?be=vSrYB)XkWdnE^^40_81M=hq$6O!E8sL<7&8!9)WX2=A&ed$!VvOdHH2;mkNt)?5IoyT zm`(-Ksb(Bjt)Svrc()8?2V2XuyVG+0U%*#Sx=ICFT!D7=ff7?Y6z!!prEODxsE^bR z^+JnxN~S-51?sU_BAFzYHsVHZ%xyY5oTd}pm(JM41+{;&g)0??`g8fhCMte6kBKE7 zZbo`bTu!P;oOg6{yxg7A9d4S-5bR0U@qw9%8iX2A6(GyOs8ty2U z_(>KAb`%a!Y=qrpXh1u~4$Vk!k0Qr@8_^SMQl#vqKUq2M zjy6M%*bI(_*F1}bGoH?CdSZ3Zn_8nW=}v?+(HS&e>nxTmPn)Wq*qNG3%aE_kL#)a5 zfBsWNdP)UaT>&}&Tm22n{G|f(S3u7H`D-UVr2?(40RI2i?kM7vhg3i+@NX$lCefsI zDSpanG|rAsRJUGx`r`8YyI+rVK3lPFWcjQ6yKcT_TUn>xwqdGo>PtIW79|>69a;7H zaq-RbL+d}B|Fr*N?#j=1N89?os)R&VJX!np;SKB7x4x?{?!|kDZo~Rdv`>mS