Mercurial > hg > release > icedtea8-forest-3.0 > jdk
changeset 11716:f94285e53b66
8144773: Further reduce use of MD5
Reviewed-by: mullan, wetmore, jnimeh, ahgross
line wrap: on
line diff
--- a/src/share/classes/sun/security/ssl/ClientHandshaker.java Thu Dec 10 12:13:18 2015 +0300 +++ b/src/share/classes/sun/security/ssl/ClientHandshaker.java Tue Dec 15 16:20:09 2015 +0300 @@ -269,7 +269,7 @@ input, serverKey, clnt_random.random_bytes, svr_random.random_bytes, messageLen, - localSupportedSignAlgs, protocolVersion)); + getLocalSupportedSignAlgs(), protocolVersion)); } catch (GeneralSecurityException e) { throwSSLException("Server key", e); } @@ -281,7 +281,7 @@ this.serverKeyExchange(new ECDH_ServerKeyExchange (input, serverKey, clnt_random.random_bytes, svr_random.random_bytes, - localSupportedSignAlgs, protocolVersion)); + getLocalSupportedSignAlgs(), protocolVersion)); } catch (GeneralSecurityException e) { throwSSLException("Server key", e); } @@ -331,7 +331,7 @@ Collection<SignatureAndHashAlgorithm> supportedPeerSignAlgs = SignatureAndHashAlgorithm.getSupportedAlgorithms( - peerSignAlgs); + algorithmConstraints, peerSignAlgs); if (supportedPeerSignAlgs.isEmpty()) { throw new SSLHandshakeException( "No supported signature and hash algorithm in common"); @@ -1094,8 +1094,8 @@ if (protocolVersion.v >= ProtocolVersion.TLS12.v) { preferableSignatureAlgorithm = SignatureAndHashAlgorithm.getPreferableAlgorithm( - peerSupportedSignAlgs, signingKey.getAlgorithm(), - signingKey); + getPeerSupportedSignAlgs(), + signingKey.getAlgorithm(), signingKey); if (preferableSignatureAlgorithm == null) { throw new SSLHandshakeException(
--- a/src/share/classes/sun/security/ssl/HandshakeMessage.java Thu Dec 10 12:13:18 2015 +0300 +++ b/src/share/classes/sun/security/ssl/HandshakeMessage.java Tue Dec 15 16:20:09 2015 +0300 @@ -1557,7 +1557,7 @@ // the signature bytes private byte[] signature; - // protocol version being established using this ServerKeyExchange message + // protocol version being established using this CertificateVerify message ProtocolVersion protocolVersion; // the preferable signature algorithm used by this CertificateVerify message @@ -1610,7 +1610,7 @@ preferableSignatureAlgorithm)) { throw new SSLHandshakeException( "Unsupported SignatureAndHashAlgorithm in " + - "ServerKeyExchange message"); + "CertificateVerify message"); } }
--- a/src/share/classes/sun/security/ssl/Handshaker.java Thu Dec 10 12:13:18 2015 +0300 +++ b/src/share/classes/sun/security/ssl/Handshaker.java Tue Dec 15 16:20:09 2015 +0300 @@ -89,7 +89,7 @@ AlgorithmConstraints algorithmConstraints = null; // Local supported signature and algorithms - Collection<SignatureAndHashAlgorithm> localSupportedSignAlgs; + private Collection<SignatureAndHashAlgorithm> localSupportedSignAlgs; // Peer supported signature and algorithms Collection<SignatureAndHashAlgorithm> peerSupportedSignAlgs;
--- a/src/share/classes/sun/security/ssl/ServerHandshaker.java Thu Dec 10 12:13:18 2015 +0300 +++ b/src/share/classes/sun/security/ssl/ServerHandshaker.java Tue Dec 15 16:20:09 2015 +0300 @@ -291,7 +291,7 @@ case HandshakeMessage.ht_certificate_verify: this.clientCertificateVerify(new CertificateVerify(input, - localSupportedSignAlgs, protocolVersion)); + getLocalSupportedSignAlgs(), protocolVersion)); break; case HandshakeMessage.ht_finished: @@ -700,11 +700,10 @@ Collection<SignatureAndHashAlgorithm> supportedPeerSignAlgs = SignatureAndHashAlgorithm.getSupportedAlgorithms( - peerSignAlgs); + algorithmConstraints, peerSignAlgs); if (supportedPeerSignAlgs.isEmpty()) { throw new SSLHandshakeException( - "No supported signature and hash algorithm " + - "in common"); + "No signature and hash algorithm in common"); } setPeerSupportedSignAlgs(supportedPeerSignAlgs); @@ -1134,6 +1133,13 @@ supportedSignAlgs = new ArrayList<SignatureAndHashAlgorithm>(1); supportedSignAlgs.add(algorithm); + + supportedSignAlgs = + SignatureAndHashAlgorithm.getSupportedAlgorithms( + algorithmConstraints, supportedSignAlgs); + + // May be no default activated signature algorithm, but + // let the following process make the final decision. } // Sets the peer supported signature algorithm to use in KM @@ -1178,6 +1184,11 @@ SignatureAndHashAlgorithm.getPreferableAlgorithm( supportedSignAlgs, "RSA", privateKey); if (preferableSignatureAlgorithm == null) { + if ((debug != null) && Debug.isOn("handshake")) { + System.out.println( + "No signature and hash algorithm for cipher " + + suite); + } return false; } } @@ -1196,6 +1207,11 @@ SignatureAndHashAlgorithm.getPreferableAlgorithm( supportedSignAlgs, "RSA", privateKey); if (preferableSignatureAlgorithm == null) { + if ((debug != null) && Debug.isOn("handshake")) { + System.out.println( + "No signature and hash algorithm for cipher " + + suite); + } return false; } } @@ -1211,6 +1227,11 @@ SignatureAndHashAlgorithm.getPreferableAlgorithm( supportedSignAlgs, "DSA"); if (preferableSignatureAlgorithm == null) { + if ((debug != null) && Debug.isOn("handshake")) { + System.out.println( + "No signature and hash algorithm for cipher " + + suite); + } return false; } } @@ -1229,6 +1250,11 @@ SignatureAndHashAlgorithm.getPreferableAlgorithm( supportedSignAlgs, "ECDSA"); if (preferableSignatureAlgorithm == null) { + if ((debug != null) && Debug.isOn("handshake")) { + System.out.println( + "No signature and hash algorithm for cipher " + + suite); + } return false; } } @@ -1274,7 +1300,8 @@ break; default: // internal error, unknown key exchange - throw new RuntimeException("Unrecognized cipherSuite: " + suite); + throw new RuntimeException( + "Unrecognized cipherSuite: " + suite); } setCipherSuite(suite);
--- a/src/share/classes/sun/security/ssl/SignatureAndHashAlgorithm.java Thu Dec 10 12:13:18 2015 +0300 +++ b/src/share/classes/sun/security/ssl/SignatureAndHashAlgorithm.java Tue Dec 15 16:20:09 2015 +0300 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010, 2013, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2010, 2015, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -167,10 +167,13 @@ // Get supported algorithm collection from an untrusted collection static Collection<SignatureAndHashAlgorithm> getSupportedAlgorithms( + AlgorithmConstraints constraints, Collection<SignatureAndHashAlgorithm> algorithms ) { Collection<SignatureAndHashAlgorithm> supported = new ArrayList<>(); for (SignatureAndHashAlgorithm sigAlg : algorithms) { - if (sigAlg.priority <= SUPPORTED_ALG_PRIORITY_MAX_NUM) { + if (sigAlg.priority <= SUPPORTED_ALG_PRIORITY_MAX_NUM && + constraints.permits(SIGNATURE_PRIMITIVE_SET, + sigAlg.algorithm, null)) { supported.add(sigAlg); } } @@ -234,30 +237,42 @@ } static SignatureAndHashAlgorithm getPreferableAlgorithm( - Collection<SignatureAndHashAlgorithm> algorithms, - String expected, PrivateKey signingKey) { + Collection<SignatureAndHashAlgorithm> algorithms, + String expected, PrivateKey signingKey) { - if (expected == null && !algorithms.isEmpty()) { - for (SignatureAndHashAlgorithm sigAlg : algorithms) { - if (sigAlg.priority <= SUPPORTED_ALG_PRIORITY_MAX_NUM) { - return sigAlg; + int maxDigestLength = getMaxDigestLength(signingKey); + for (SignatureAndHashAlgorithm algorithm : algorithms) { + int signValue = algorithm.id & 0xFF; + if ((expected == null) || + (expected.equalsIgnoreCase("rsa") && + signValue == SignatureAlgorithm.RSA.value) || + (expected.equalsIgnoreCase("dsa") && + signValue == SignatureAlgorithm.DSA.value) || + (expected.equalsIgnoreCase("ecdsa") && + signValue == SignatureAlgorithm.ECDSA.value) || + (expected.equalsIgnoreCase("ec") && + signValue == SignatureAlgorithm.ECDSA.value)) { + + if (algorithm.priority <= SUPPORTED_ALG_PRIORITY_MAX_NUM && + algorithm.hash.length <= maxDigestLength) { + + return algorithm; } } - - return null; // no supported algorithm - } - - if (expected == null ) { - return null; // no expected algorithm, no supported algorithm } - /* - * Need to check RSA key length to match the length of hash value - */ + return null; + } + + /* + * Need to check key length to match the length of hash value + */ + private static int getMaxDigestLength(PrivateKey signingKey) { int maxDigestLength = Integer.MAX_VALUE; + + // only need to check RSA algorithm at present. if (signingKey != null && - "rsa".equalsIgnoreCase(signingKey.getAlgorithm()) && - expected.equalsIgnoreCase("rsa")) { + "rsa".equalsIgnoreCase(signingKey.getAlgorithm())) { /* * RSA keys of 512 bits have been shown to be practically * breakable, it does not make much sense to use the strong @@ -285,25 +300,7 @@ // preferable hash algorithm. } - for (SignatureAndHashAlgorithm algorithm : algorithms) { - int signValue = algorithm.id & 0xFF; - if (expected.equalsIgnoreCase("rsa") && - signValue == SignatureAlgorithm.RSA.value) { - if (algorithm.hash.length <= maxDigestLength) { - return algorithm; - } - } else if ( - (expected.equalsIgnoreCase("dsa") && - signValue == SignatureAlgorithm.DSA.value) || - (expected.equalsIgnoreCase("ecdsa") && - signValue == SignatureAlgorithm.ECDSA.value) || - (expected.equalsIgnoreCase("ec") && - signValue == SignatureAlgorithm.ECDSA.value)) { - return algorithm; - } - } - - return null; + return maxDigestLength; } static enum HashAlgorithm {
--- a/src/share/lib/security/java.security-aix Thu Dec 10 12:13:18 2015 +0300 +++ b/src/share/lib/security/java.security-aix Tue Dec 15 16:20:09 2015 +0300 @@ -509,7 +509,7 @@ # # Example: # jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048 -jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 768 +jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 768 # Legacy algorithms for Secure Socket Layer/Transport Layer Security (SSL/TLS) # processing in JSSE implementation.
--- a/src/share/lib/security/java.security-linux Thu Dec 10 12:13:18 2015 +0300 +++ b/src/share/lib/security/java.security-linux Tue Dec 15 16:20:09 2015 +0300 @@ -509,7 +509,7 @@ # # Example: # jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048 -jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 768 +jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 768 # Legacy algorithms for Secure Socket Layer/Transport Layer Security (SSL/TLS) # processing in JSSE implementation.
--- a/src/share/lib/security/java.security-macosx Thu Dec 10 12:13:18 2015 +0300 +++ b/src/share/lib/security/java.security-macosx Tue Dec 15 16:20:09 2015 +0300 @@ -512,7 +512,7 @@ # # Example: # jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048 -jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 768 +jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 768 # Legacy algorithms for Secure Socket Layer/Transport Layer Security (SSL/TLS) # processing in JSSE implementation.
--- a/src/share/lib/security/java.security-solaris Thu Dec 10 12:13:18 2015 +0300 +++ b/src/share/lib/security/java.security-solaris Tue Dec 15 16:20:09 2015 +0300 @@ -511,7 +511,7 @@ # # Example: # jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048 -jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 768 +jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 768 # Legacy algorithms for Secure Socket Layer/Transport Layer Security (SSL/TLS) # processing in JSSE implementation.
--- a/src/share/lib/security/java.security-windows Thu Dec 10 12:13:18 2015 +0300 +++ b/src/share/lib/security/java.security-windows Tue Dec 15 16:20:09 2015 +0300 @@ -512,7 +512,7 @@ # # Example: # jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048 -jdk.tls.disabledAlgorithms=SSLv3, RC4, DH keySize < 768 +jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 768 # Legacy algorithms for Secure Socket Layer/Transport Layer Security (SSL/TLS) # processing in JSSE implementation.
--- a/test/sun/security/ssl/com/sun/net/ssl/internal/ssl/SSLContextImpl/MD2InTrustAnchor.java Thu Dec 10 12:13:18 2015 +0300 +++ b/test/sun/security/ssl/com/sun/net/ssl/internal/ssl/SSLContextImpl/MD2InTrustAnchor.java Tue Dec 15 16:20:09 2015 +0300 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2011, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2011, 2015, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -287,8 +287,10 @@ public static void main(String[] args) throws Exception { // MD5 is used in this test case, don't disable MD5 algorithm. - Security.setProperty( - "jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.certpath.disabledAlgorithms", + "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.tls.disabledAlgorithms", + "SSLv3, RC4, DH keySize < 768"); if (debug) System.setProperty("javax.net.debug", "all");
--- a/test/sun/security/ssl/com/sun/net/ssl/internal/ssl/SSLContextImpl/TrustTrustedCert.java Thu Dec 10 12:13:18 2015 +0300 +++ b/test/sun/security/ssl/com/sun/net/ssl/internal/ssl/SSLContextImpl/TrustTrustedCert.java Tue Dec 15 16:20:09 2015 +0300 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2011, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2011, 2015, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -339,8 +339,10 @@ public static void main(String[] args) throws Exception { // MD5 is used in this test case, don't disable MD5 algorithm. - Security.setProperty( - "jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.certpath.disabledAlgorithms", + "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.tls.disabledAlgorithms", + "SSLv3, RC4, DH keySize < 768"); if (debug) System.setProperty("javax.net.debug", "all");
--- a/test/sun/security/ssl/com/sun/net/ssl/internal/ssl/X509KeyManager/PreferredKey.java Thu Dec 10 12:13:18 2015 +0300 +++ b/test/sun/security/ssl/com/sun/net/ssl/internal/ssl/X509KeyManager/PreferredKey.java Tue Dec 15 16:20:09 2015 +0300 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2005, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2005, 2015, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -57,8 +57,10 @@ public static void main(String[] args) throws Exception { // MD5 is used in this test case, don't disable MD5 algorithm. - Security.setProperty( - "jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.certpath.disabledAlgorithms", + "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.tls.disabledAlgorithms", + "SSLv3, RC4, DH keySize < 768"); KeyStore ks; KeyManagerFactory kmf;
--- a/test/sun/security/ssl/com/sun/net/ssl/internal/ssl/X509TrustManagerImpl/BasicConstraints.java Thu Dec 10 12:13:18 2015 +0300 +++ b/test/sun/security/ssl/com/sun/net/ssl/internal/ssl/X509TrustManagerImpl/BasicConstraints.java Tue Dec 15 16:20:09 2015 +0300 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2012, 2015, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -458,8 +458,10 @@ public static void main(String args[]) throws Exception { // MD5 is used in this test case, don't disable MD5 algorithm. - Security.setProperty( - "jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.certpath.disabledAlgorithms", + "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.tls.disabledAlgorithms", + "SSLv3, RC4, DH keySize < 768"); if (debug) System.setProperty("javax.net.debug", "all");
--- a/test/sun/security/ssl/com/sun/net/ssl/internal/ssl/X509TrustManagerImpl/PKIXExtendedTM.java Thu Dec 10 12:13:18 2015 +0300 +++ b/test/sun/security/ssl/com/sun/net/ssl/internal/ssl/X509TrustManagerImpl/PKIXExtendedTM.java Tue Dec 15 16:20:09 2015 +0300 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2010, 2015, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -794,8 +794,10 @@ public static void main(String args[]) throws Exception { // MD5 is used in this test case, don't disable MD5 algorithm. - Security.setProperty( - "jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.certpath.disabledAlgorithms", + "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.tls.disabledAlgorithms", + "SSLv3, RC4, DH keySize < 768"); if (debug) System.setProperty("javax.net.debug", "all");
--- a/test/sun/security/ssl/com/sun/net/ssl/internal/ssl/X509TrustManagerImpl/SelfIssuedCert.java Thu Dec 10 12:13:18 2015 +0300 +++ b/test/sun/security/ssl/com/sun/net/ssl/internal/ssl/X509TrustManagerImpl/SelfIssuedCert.java Tue Dec 15 16:20:09 2015 +0300 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2009, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2009, 2015, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -306,8 +306,10 @@ public static void main(String args[]) throws Exception { // MD5 is used in this test case, don't disable MD5 algorithm. - Security.setProperty( - "jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.certpath.disabledAlgorithms", + "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.tls.disabledAlgorithms", + "SSLv3, RC4, DH keySize < 768"); if (debug) System.setProperty("javax.net.debug", "all");
--- a/test/sun/security/ssl/com/sun/net/ssl/internal/ssl/X509TrustManagerImpl/SunX509ExtendedTM.java Thu Dec 10 12:13:18 2015 +0300 +++ b/test/sun/security/ssl/com/sun/net/ssl/internal/ssl/X509TrustManagerImpl/SunX509ExtendedTM.java Tue Dec 15 16:20:09 2015 +0300 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2010, 2015, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -796,8 +796,10 @@ public static void main(String args[]) throws Exception { // MD5 is used in this test case, don't disable MD5 algorithm. - Security.setProperty( - "jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.certpath.disabledAlgorithms", + "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.tls.disabledAlgorithms", + "SSLv3, RC4, DH keySize < 768"); if (debug) System.setProperty("javax.net.debug", "all");
--- a/test/sun/security/ssl/com/sun/net/ssl/internal/www/protocol/https/HttpsURLConnection/CriticalSubjectAltName.java Thu Dec 10 12:13:18 2015 +0300 +++ b/test/sun/security/ssl/com/sun/net/ssl/internal/www/protocol/https/HttpsURLConnection/CriticalSubjectAltName.java Tue Dec 15 16:20:09 2015 +0300 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2001, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2001, 2015, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -159,8 +159,10 @@ public static void main(String[] args) throws Exception { // MD5 is used in this test case, don't disable MD5 algorithm. - Security.setProperty( - "jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.certpath.disabledAlgorithms", + "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.tls.disabledAlgorithms", + "SSLv3, RC4, DH keySize < 768"); String keyFilename = System.getProperty("test.src", "./") + "/" + pathToStores +
--- a/test/sun/security/ssl/javax/net/ssl/ServerName/SSLSocketSNISensitive.java Thu Dec 10 12:13:18 2015 +0300 +++ b/test/sun/security/ssl/javax/net/ssl/ServerName/SSLSocketSNISensitive.java Tue Dec 15 16:20:09 2015 +0300 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2012, 2015, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -433,8 +433,10 @@ public static void main(String[] args) throws Exception { // MD5 is used in this test case, don't disable MD5 algorithm. - Security.setProperty( - "jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.certpath.disabledAlgorithms", + "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.tls.disabledAlgorithms", + "SSLv3, RC4, DH keySize < 768"); if (debug) System.setProperty("javax.net.debug", "all");
--- a/test/sun/security/ssl/javax/net/ssl/TLSv11/EmptyCertificateAuthorities.java Thu Dec 10 12:13:18 2015 +0300 +++ b/test/sun/security/ssl/javax/net/ssl/TLSv11/EmptyCertificateAuthorities.java Tue Dec 15 16:20:09 2015 +0300 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2010, 2015, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -230,8 +230,10 @@ public static void main(String[] args) throws Exception { // MD5 is used in this test case, don't disable MD5 algorithm. - Security.setProperty( - "jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.certpath.disabledAlgorithms", + "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.tls.disabledAlgorithms", + "SSLv3, RC4, DH keySize < 768"); String keyFilename = System.getProperty("test.src", ".") + "/" + pathToStores +
--- a/test/sun/security/ssl/javax/net/ssl/TLSv12/ShortRSAKey512.java Thu Dec 10 12:13:18 2015 +0300 +++ b/test/sun/security/ssl/javax/net/ssl/TLSv12/ShortRSAKey512.java Tue Dec 15 16:20:09 2015 +0300 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012, 2013, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2012, 2015, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -282,6 +282,8 @@ // reset the security property to make sure that the algorithms // and keys used in this test are not disabled. Security.setProperty("jdk.certpath.disabledAlgorithms", "MD2"); + Security.setProperty("jdk.tls.disabledAlgorithms", + "SSLv3, RC4, DH keySize < 768"); if (debug) System.setProperty("javax.net.debug", "all");
--- a/test/sun/security/ssl/javax/net/ssl/TLSv12/ShortRSAKeyGCM.java Thu Dec 10 12:13:18 2015 +0300 +++ b/test/sun/security/ssl/javax/net/ssl/TLSv12/ShortRSAKeyGCM.java Tue Dec 15 16:20:09 2015 +0300 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012, 2013, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2012, 2015, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -304,6 +304,8 @@ // reset the security property to make sure that the algorithms // and keys used in this test are not disabled. Security.setProperty("jdk.certpath.disabledAlgorithms", "MD2"); + Security.setProperty("jdk.tls.disabledAlgorithms", + "SSLv3, RC4, DH keySize < 768"); if (debug) { System.setProperty("javax.net.debug", "all");
--- a/test/sun/security/ssl/sun/net/www/protocol/https/HttpsURLConnection/DNSIdentities.java Thu Dec 10 12:13:18 2015 +0300 +++ b/test/sun/security/ssl/sun/net/www/protocol/https/HttpsURLConnection/DNSIdentities.java Tue Dec 15 16:20:09 2015 +0300 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2010, 2015, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -747,8 +747,10 @@ public static void main(String args[]) throws Exception { // MD5 is used in this test case, don't disable MD5 algorithm. - Security.setProperty( - "jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.certpath.disabledAlgorithms", + "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.tls.disabledAlgorithms", + "SSLv3, RC4, DH keySize < 768"); if (debug) System.setProperty("javax.net.debug", "all");
--- a/test/sun/security/ssl/sun/net/www/protocol/https/HttpsURLConnection/IPAddressIPIdentities.java Thu Dec 10 12:13:18 2015 +0300 +++ b/test/sun/security/ssl/sun/net/www/protocol/https/HttpsURLConnection/IPAddressIPIdentities.java Tue Dec 15 16:20:09 2015 +0300 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2010, 2015, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -748,8 +748,10 @@ public static void main(String args[]) throws Exception { // MD5 is used in this test case, don't disable MD5 algorithm. - Security.setProperty( - "jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.certpath.disabledAlgorithms", + "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.tls.disabledAlgorithms", + "SSLv3, RC4, DH keySize < 768"); if (debug) System.setProperty("javax.net.debug", "all");
--- a/test/sun/security/ssl/sun/net/www/protocol/https/HttpsURLConnection/IPIdentities.java Thu Dec 10 12:13:18 2015 +0300 +++ b/test/sun/security/ssl/sun/net/www/protocol/https/HttpsURLConnection/IPIdentities.java Tue Dec 15 16:20:09 2015 +0300 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2010, 2015, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -747,8 +747,10 @@ public static void main(String args[]) throws Exception { // MD5 is used in this test case, don't disable MD5 algorithm. - Security.setProperty( - "jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.certpath.disabledAlgorithms", + "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.tls.disabledAlgorithms", + "SSLv3, RC4, DH keySize < 768"); if (debug) System.setProperty("javax.net.debug", "all");
--- a/test/sun/security/ssl/sun/net/www/protocol/https/HttpsURLConnection/Identities.java Thu Dec 10 12:13:18 2015 +0300 +++ b/test/sun/security/ssl/sun/net/www/protocol/https/HttpsURLConnection/Identities.java Tue Dec 15 16:20:09 2015 +0300 @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010, 2014, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2010, 2015, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -747,8 +747,10 @@ public static void main(String args[]) throws Exception { // MD5 is used in this test case, don't disable MD5 algorithm. - Security.setProperty( - "jdk.certpath.disabledAlgorithms", "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.certpath.disabledAlgorithms", + "MD2, RSA keySize < 1024"); + Security.setProperty("jdk.tls.disabledAlgorithms", + "SSLv3, RC4, DH keySize < 768"); if (debug) System.setProperty("javax.net.debug", "all");