Skip to content

8315487: Security Providers Filter #15539

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open

8315487: Security Providers Filter #15539

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
37d3f23
8315487: Security Providers Filter
franferrax May 8, 2025
1b2ad21
Merge openjdk:master into martinuy:JDK-8315487
franferrax Jul 4, 2025
aa2bb3f
Fix bad conflict resolution
franferrax Jul 5, 2025
59d8228
Address review comment 1
franferrax Jul 7, 2025
c59bbea
Address review comment 2
franferrax Jul 7, 2025
f3a190d
Add missing @implNote to Security::getAlgorithms
franferrax Jul 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 33 additions & 6 deletions src/java.base/share/classes/java/security/AlgorithmParameterGenerator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,12 +148,21 @@ public final String getAlgorithm() {
* the {@link Security#getProviders() Security.getProviders()} method.
*
* @implNote
* The JDK Reference Implementation additionally uses the
* {@code jdk.security.provider.preferred}
* {@link Security#getProperty(String) Security} property to determine
* the preferred provider order for the specified algorithm. This
* may be different from the order of providers returned by
* {@link Security#getProviders() Security.getProviders()}.
* The JDK Reference Implementation additionally uses the following
* properties to customize the behavior of this method:
* <ul>
* <li> The {@code jdk.security.provider.preferred}
* {@link Security#getProperty(String) Security} property determines
* the preferred provider order for the specified algorithm.
* This may be different from the order of providers returned by
* {@link Security#getProviders() Security.getProviders()}.</li>
* <li> The {@code jdk.security.providers.filter}
* {@link System#getProperty(String) System} and
* {@link Security#getProperty(String) Security} properties determine
* which {@linkplain java.security.Provider.Service services} are enabled.
* A service that is not enabled by the filter will not make its algorithm
* implementation available.</li>
* </ul>
*
* @param algorithm the name of the algorithm this
* parameter generator is associated with.
Expand Down Expand Up @@ -201,6 +210,15 @@ public static AlgorithmParameterGenerator getInstance(String algorithm)
* <p> Note that the list of registered providers may be retrieved via
* the {@link Security#getProviders() Security.getProviders()} method.
*
* @implNote
* The JDK Reference Implementation additionally uses the
* {@code jdk.security.providers.filter}
* {@link System#getProperty(String) System} and
* {@link Security#getProperty(String) Security} properties to determine
* which {@linkplain java.security.Provider.Service services} are enabled.
* A service that is not enabled by the filter will not make its algorithm
* implementation available.
*
* @param algorithm the name of the algorithm this
* parameter generator is associated with.
* See the AlgorithmParameterGenerator section in the <a href=
Expand Down Expand Up @@ -252,6 +270,15 @@ public static AlgorithmParameterGenerator getInstance(String algorithm,
* provider is returned. Note that the specified provider does not
* have to be registered in the provider list.
*
* @implNote
* The JDK Reference Implementation additionally uses the
* {@code jdk.security.providers.filter}
* {@link System#getProperty(String) System} and
* {@link Security#getProperty(String) Security} properties to determine
* which {@linkplain java.security.Provider.Service services} are enabled.
* A service that is not enabled by the filter will not make its algorithm
* implementation available.
*
* @param algorithm the string name of the algorithm this
* parameter generator is associated with.
* See the AlgorithmParameterGenerator section in the <a href=
Expand Down
39 changes: 33 additions & 6 deletions src/java.base/share/classes/java/security/AlgorithmParameters.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,12 +135,21 @@ public final String getAlgorithm() {
* parameter encoding.
*
* @implNote
* The JDK Reference Implementation additionally uses the
* {@code jdk.security.provider.preferred}
* {@link Security#getProperty(String) Security} property to determine
* the preferred provider order for the specified algorithm. This
* may be different from the order of providers returned by
* {@link Security#getProviders() Security.getProviders()}.
* The JDK Reference Implementation additionally uses the following
* properties to customize the behavior of this method:
* <ul>
* <li> The {@code jdk.security.provider.preferred}
* {@link Security#getProperty(String) Security} property determines
* the preferred provider order for the specified algorithm.
* This may be different from the order of providers returned by
* {@link Security#getProviders() Security.getProviders()}.</li>
* <li> The {@code jdk.security.providers.filter}
* {@link System#getProperty(String) System} and
* {@link Security#getProperty(String) Security} properties determine
* which {@linkplain java.security.Provider.Service services} are enabled.
* A service that is not enabled by the filter will not make its algorithm
* implementation available.</li>
* </ul>
*
* @param algorithm the name of the algorithm requested.
* See the AlgorithmParameters section in the <a href=
Expand Down Expand Up @@ -188,6 +197,15 @@ public static AlgorithmParameters getInstance(String algorithm)
* {@code init}, using an appropriate parameter specification or
* parameter encoding.
*
* @implNote
* The JDK Reference Implementation additionally uses the
* {@code jdk.security.providers.filter}
* {@link System#getProperty(String) System} and
* {@link Security#getProperty(String) Security} properties to determine
* which {@linkplain java.security.Provider.Service services} are enabled.
* A service that is not enabled by the filter will not make its algorithm
* implementation available.
*
* @param algorithm the name of the algorithm requested.
* See the AlgorithmParameters section in the <a href=
* "{@docRoot}/../specs/security/standard-names.html#algorithmparameters-algorithms">
Expand Down Expand Up @@ -239,6 +257,15 @@ public static AlgorithmParameters getInstance(String algorithm,
* {@code init}, using an appropriate parameter specification or
* parameter encoding.
*
* @implNote
* The JDK Reference Implementation additionally uses the
* {@code jdk.security.providers.filter}
* {@link System#getProperty(String) System} and
* {@link Security#getProperty(String) Security} properties to determine
* which {@linkplain java.security.Provider.Service services} are enabled.
* A service that is not enabled by the filter will not make its algorithm
* implementation available.
*
* @param algorithm the name of the algorithm requested.
* See the AlgorithmParameters section in the <a href=
* "{@docRoot}/../specs/security/standard-names.html#algorithmparameters-algorithms">
Expand Down
39 changes: 33 additions & 6 deletions src/java.base/share/classes/java/security/KeyFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,12 +157,21 @@ private KeyFactory(String algorithm) throws NoSuchAlgorithmException {
* the {@link Security#getProviders() Security.getProviders()} method.
*
* @implNote
* The JDK Reference Implementation additionally uses the
* {@code jdk.security.provider.preferred}
* {@link Security#getProperty(String) Security} property to determine
* the preferred provider order for the specified algorithm. This
* may be different from the order of providers returned by
* {@link Security#getProviders() Security.getProviders()}.
* The JDK Reference Implementation additionally uses the following
* properties to customize the behavior of this method:
* <ul>
* <li> The {@code jdk.security.provider.preferred}
* {@link Security#getProperty(String) Security} property determines
* the preferred provider order for the specified algorithm.
* This may be different from the order of providers returned by
* {@link Security#getProviders() Security.getProviders()}.</li>
* <li> The {@code jdk.security.providers.filter}
* {@link System#getProperty(String) System} and
* {@link Security#getProperty(String) Security} properties determine
* which {@linkplain java.security.Provider.Service services} are enabled.
* A service that is not enabled by the filter will not make its algorithm
* implementation available.</li>
* </ul>
*
* @param algorithm the name of the requested key algorithm.
* See the KeyFactory section in the <a href=
Expand Down Expand Up @@ -199,6 +208,15 @@ public static KeyFactory getInstance(String algorithm)
* <p> Note that the list of registered providers may be retrieved via
* the {@link Security#getProviders() Security.getProviders()} method.
*
* @implNote
* The JDK Reference Implementation additionally uses the
* {@code jdk.security.providers.filter}
* {@link System#getProperty(String) System} and
* {@link Security#getProperty(String) Security} properties to determine
* which {@linkplain java.security.Provider.Service services} are enabled.
* A service that is not enabled by the filter will not make its algorithm
* implementation available.
*
* @param algorithm the name of the requested key algorithm.
* See the KeyFactory section in the <a href=
* "{@docRoot}/../specs/security/standard-names.html#keyfactory-algorithms">
Expand Down Expand Up @@ -242,6 +260,15 @@ public static KeyFactory getInstance(String algorithm, String provider)
* is returned. Note that the specified provider does not
* have to be registered in the provider list.
*
* @implNote
* The JDK Reference Implementation additionally uses the
* {@code jdk.security.providers.filter}
* {@link System#getProperty(String) System} and
* {@link Security#getProperty(String) Security} properties to determine
* which {@linkplain java.security.Provider.Service services} are enabled.
* A service that is not enabled by the filter will not make its algorithm
* implementation available.
*
* @param algorithm the name of the requested key algorithm.
* See the KeyFactory section in the <a href=
* "{@docRoot}/../specs/security/standard-names.html#keyfactory-algorithms">
Expand Down
39 changes: 33 additions & 6 deletions src/java.base/share/classes/java/security/KeyPairGenerator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,12 +204,21 @@ private static KeyPairGenerator getInstance(Instance instance,
* the {@link Security#getProviders() Security.getProviders()} method.
*
* @implNote
* The JDK Reference Implementation additionally uses the
* {@code jdk.security.provider.preferred}
* {@link Security#getProperty(String) Security} property to determine
* the preferred provider order for the specified algorithm. This
* may be different from the order of providers returned by
* {@link Security#getProviders() Security.getProviders()}.
* The JDK Reference Implementation additionally uses the following
* properties to customize the behavior of this method:
* <ul>
* <li> The {@code jdk.security.provider.preferred}
* {@link Security#getProperty(String) Security} property determines
* the preferred provider order for the specified algorithm.
* This may be different from the order of providers returned by
* {@link Security#getProviders() Security.getProviders()}.</li>
* <li> The {@code jdk.security.providers.filter}
* {@link System#getProperty(String) System} and
* {@link Security#getProperty(String) Security} properties determine
* which {@linkplain java.security.Provider.Service services} are enabled.
* A service that is not enabled by the filter will not make its algorithm
* implementation available.</li>
* </ul>
*
* @param algorithm the standard string name of the algorithm.
* See the KeyPairGenerator section in the <a href=
Expand Down Expand Up @@ -269,6 +278,15 @@ public static KeyPairGenerator getInstance(String algorithm)
* <p> Note that the list of registered providers may be retrieved via
* the {@link Security#getProviders() Security.getProviders()} method.
*
* @implNote
* The JDK Reference Implementation additionally uses the
* {@code jdk.security.providers.filter}
* {@link System#getProperty(String) System} and
* {@link Security#getProperty(String) Security} properties to determine
* which {@linkplain java.security.Provider.Service services} are enabled.
* A service that is not enabled by the filter will not make its algorithm
* implementation available.
*
* @param algorithm the standard string name of the algorithm.
* See the KeyPairGenerator section in the <a href=
* "{@docRoot}/../specs/security/standard-names.html#keypairgenerator-algorithms">
Expand Down Expand Up @@ -312,6 +330,15 @@ public static KeyPairGenerator getInstance(String algorithm,
* is returned. Note that the specified provider does not
* have to be registered in the provider list.
*
* @implNote
* The JDK Reference Implementation additionally uses the
* {@code jdk.security.providers.filter}
* {@link System#getProperty(String) System} and
* {@link Security#getProperty(String) Security} properties to determine
* which {@linkplain java.security.Provider.Service services} are enabled.
* A service that is not enabled by the filter will not make its algorithm
* implementation available.
*
* @param algorithm the standard string name of the algorithm.
* See the KeyPairGenerator section in the <a href=
* "{@docRoot}/../specs/security/standard-names.html#keypairgenerator-algorithms">
Expand Down
61 changes: 54 additions & 7 deletions src/java.base/share/classes/java/security/KeyStore.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@
import javax.security.auth.DestroyFailedException;
import javax.security.auth.callback.*;

import sun.security.jca.ProvidersFilter;
import sun.security.util.Debug;

/**
Expand Down Expand Up @@ -841,12 +842,21 @@ private String getProviderName() {
* the {@link Security#getProviders() Security.getProviders()} method.
*
* @implNote
* The JDK Reference Implementation additionally uses the
* {@code jdk.security.provider.preferred}
* {@link Security#getProperty(String) Security} property to determine
* the preferred provider order for the specified algorithm. This
* may be different from the order of providers returned by
* {@link Security#getProviders() Security.getProviders()}.
* The JDK Reference Implementation additionally uses the following
* properties to customize the behavior of this method:
* <ul>
* <li> The {@code jdk.security.provider.preferred}
* {@link Security#getProperty(String) Security} property determines
* the preferred provider order for the specified type.
* This may be different from the order of providers returned by
* {@link Security#getProviders() Security.getProviders()}.</li>
* <li> The {@code jdk.security.providers.filter}
* {@link System#getProperty(String) System} and
* {@link Security#getProperty(String) Security} properties determine
* which {@linkplain java.security.Provider.Service services} are enabled.
* A service that is not enabled by the filter will not make its type
* implementation available.</li>
* </ul>.
*
* @param type the type of keystore.
* See the KeyStore section in the <a href=
Expand Down Expand Up @@ -888,6 +898,15 @@ public static KeyStore getInstance(String type)
* <p> Note that the list of registered providers may be retrieved via
* the {@link Security#getProviders() Security.getProviders()} method.
*
* @implNote
* The JDK Reference Implementation additionally uses the
* {@code jdk.security.providers.filter}
* {@link System#getProperty(String) System} and
* {@link Security#getProperty(String) Security} properties to determine
* which {@linkplain java.security.Provider.Service services} are enabled.
* A service that is not enabled by the filter will not make its type
* implementation available.
*
* @param type the type of keystore.
* See the KeyStore section in the <a href=
* "{@docRoot}/../specs/security/standard-names.html#keystore-types">
Expand Down Expand Up @@ -935,6 +954,15 @@ public static KeyStore getInstance(String type, String provider)
* object is returned. Note that the specified provider object
* does not have to be registered in the provider list.
*
* @implNote
* The JDK Reference Implementation additionally uses the
* {@code jdk.security.providers.filter}
* {@link System#getProperty(String) System} and
* {@link Security#getProperty(String) Security} properties to determine
* which {@linkplain java.security.Provider.Service services} are enabled.
* A service that is not enabled by the filter will not make its type
* implementation available.
*
* @param type the type of keystore.
* See the KeyStore section in the <a href=
* "{@docRoot}/../specs/security/standard-names.html#keystore-types">
Expand Down Expand Up @@ -1677,6 +1705,15 @@ public final void setEntry(String alias, Entry entry,
* <p> Note that the list of registered providers may be retrieved via
* the {@link Security#getProviders() Security.getProviders()} method.
*
* @implNote
* The JDK Reference Implementation additionally uses the
* {@code jdk.security.providers.filter}
* {@link System#getProperty(String) System} and
* {@link Security#getProperty(String) Security} properties to determine
* which {@linkplain java.security.Provider.Service services} are enabled.
* A service that is not enabled by the filter will not make its type
* implementation available.
*
* @param file the keystore file
* @param password the keystore password, which may be {@code null}
*
Expand Down Expand Up @@ -1730,6 +1767,15 @@ public static final KeyStore getInstance(File file, char[] password)
* <p> Note that the list of registered providers may be retrieved via
* the {@link Security#getProviders() Security.getProviders()} method.
*
* @implNote
* The JDK Reference Implementation additionally uses the
* {@code jdk.security.providers.filter}
* {@link System#getProperty(String) System} and
* {@link Security#getProperty(String) Security} properties to determine
* which {@linkplain java.security.Provider.Service services} are enabled.
* A service that is not enabled by the filter will not make its type
* implementation available.
*
* @param file the keystore file
* @param param the {@code LoadStoreParameter} that specifies how to load
* the keystore, which may be {@code null}
Expand Down Expand Up @@ -1790,7 +1836,8 @@ private static final KeyStore getInstance(File file, char[] password,
// Detect the keystore type
for (Provider p : Security.getProviders()) {
for (Provider.Service s : p.getServices()) {
if (s.getType().equals("KeyStore")) {
if (ProvidersFilter.isAllowed(s) &&
s.getType().equals("KeyStore")) {
try {
KeyStoreSpi impl = (KeyStoreSpi) s.newInstance(null);
if (impl.engineProbe(dataStream)) {
Expand Down
Loading