8284105: Update security libraries to use sealed classes

seanjmullan · seanjmullan · commit dc6ec2a46720 · 2022-04-11T18:01:47.000Z
Reviewed-by: darcy, weijun, xuelei
diff --git a/make/jdk/src/classes/build/tools/intpoly/FieldGen.java b/make/jdk/src/classes/build/tools/intpoly/FieldGen.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -614,7 +614,7 @@ private String generate(FieldParams params) throws IOException {
         }
         result.appendLine("import java.math.BigInteger;");
 
-        result.appendLine("public class " + params.getClassName()
+        result.appendLine("public final class " + params.getClassName()
                 + " extends " + this.parentName + " {");
         result.incrIndent();
 
diff --git a/src/java.base/share/classes/sun/security/provider/JavaKeyStore.java b/src/java.base/share/classes/sun/security/provider/JavaKeyStore.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -54,7 +54,7 @@
  * @since 1.2
  */
 
-public abstract class JavaKeyStore extends KeyStoreSpi {
+public abstract sealed class JavaKeyStore extends KeyStoreSpi {
 
     // regular JKS
     public static final class JKS extends JavaKeyStore {
diff --git a/src/java.base/share/classes/sun/security/provider/certpath/Builder.java b/src/java.base/share/classes/sun/security/provider/certpath/Builder.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -50,7 +50,7 @@
  * @author      Yassir Elley
  */
 
-public abstract class Builder {
+abstract class Builder {
 
     private static final Debug debug = Debug.getInstance("certpath");
     private Set<String> matchingPolicies;
diff --git a/src/java.base/share/classes/sun/security/provider/certpath/ForwardBuilder.java b/src/java.base/share/classes/sun/security/provider/certpath/ForwardBuilder.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -59,7 +59,7 @@
  * @author      Yassir Elley
  * @author      Sean Mullan
  */
-class ForwardBuilder extends Builder {
+final class ForwardBuilder extends Builder {
 
     private static final Debug debug = Debug.getInstance("certpath");
     private final Set<X509Certificate> trustedCerts;
diff --git a/src/java.base/share/classes/sun/security/provider/certpath/SunCertPathBuilderResult.java b/src/java.base/share/classes/sun/security/provider/certpath/SunCertPathBuilderResult.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -47,7 +47,7 @@
 //@@@ Note: this class is not in public API and access to adjacency list is
 //@@@ intended for debugging/replay of Sun PKIX CertPathBuilder implementation.
 
-public class SunCertPathBuilderResult extends PKIXCertPathBuilderResult {
+public final class SunCertPathBuilderResult extends PKIXCertPathBuilderResult {
 
     private static final Debug debug = Debug.getInstance("certpath");
 
diff --git a/src/java.base/share/classes/sun/security/provider/certpath/Vertex.java b/src/java.base/share/classes/sun/security/provider/certpath/Vertex.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -46,7 +46,7 @@
  * @author      Sean Mullan
  * @since       1.4
  */
-public class Vertex {
+final class Vertex {
 
     private static final Debug debug = Debug.getInstance("certpath");
     private X509Certificate cert;
diff --git a/src/java.base/share/classes/sun/security/rsa/RSAKeyPairGenerator.java b/src/java.base/share/classes/sun/security/rsa/RSAKeyPairGenerator.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -47,7 +47,7 @@
  * @since   1.5
  * @author  Andreas Sterbenz
  */
-public abstract class RSAKeyPairGenerator extends KeyPairGeneratorSpi {
+abstract class RSAKeyPairGenerator extends KeyPairGeneratorSpi {
 
     private static final BigInteger SQRT_2048;
     private static final BigInteger SQRT_3072;
diff --git a/src/java.base/share/classes/sun/security/rsa/RSASignature.java b/src/java.base/share/classes/sun/security/rsa/RSASignature.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -47,7 +47,7 @@
  * @since   1.5
  * @author  Andreas Sterbenz
  */
-public abstract class RSASignature extends SignatureSpi {
+abstract class RSASignature extends SignatureSpi {
 
     // we sign an ASN.1 SEQUENCE of AlgorithmId and digest
     // it has the form 30:xx:30:xx:[digestOID]:05:00:04:xx:[digest]
@@ -188,7 +188,7 @@ protected byte[] engineSign() throws SignatureException {
         }
         byte[] digest = getDigestValue();
         try {
-            byte[] encoded = encodeSignature(digestOID, digest);
+            byte[] encoded = RSAUtil.encodeSignature(digestOID, digest);
             byte[] padded = padding.pad(encoded);
             byte[] encrypted = RSACore.rsa(padded, privateKey, true);
             return encrypted;
@@ -215,7 +215,7 @@ protected boolean engineVerify(byte[] sigBytes) throws SignatureException {
             byte[] digest = getDigestValue();
             byte[] decrypted = RSACore.rsa(sigBytes, publicKey);
             byte[] unpadded = padding.unpad(decrypted);
-            byte[] decodedDigest = decodeSignature(digestOID, unpadded);
+            byte[] decodedDigest = RSAUtil.decodeSignature(digestOID, unpadded);
             return MessageDigest.isEqual(digest, decodedDigest);
         } catch (javax.crypto.BadPaddingException e) {
             // occurs if the app has used the wrong RSA public key
@@ -230,44 +230,6 @@ protected boolean engineVerify(byte[] sigBytes) throws SignatureException {
         }
     }
 
-    /**
-     * Encode the digest, return the to-be-signed data.
-     * Also used by the PKCS#11 provider.
-     */
-    public static byte[] encodeSignature(ObjectIdentifier oid, byte[] digest)
-            throws IOException {
-        DerOutputStream out = new DerOutputStream();
-        new AlgorithmId(oid).encode(out);
-        out.putOctetString(digest);
-        DerValue result =
-            new DerValue(DerValue.tag_Sequence, out.toByteArray());
-        return result.toByteArray();
-    }
-
-    /**
-     * Decode the signature data. Verify that the object identifier matches
-     * and return the message digest.
-     */
-    public static byte[] decodeSignature(ObjectIdentifier oid, byte[] sig)
-            throws IOException {
-        // Enforce strict DER checking for signatures
-        DerInputStream in = new DerInputStream(sig, 0, sig.length, false);
-        DerValue[] values = in.getSequence(2);
-        if ((values.length != 2) || (in.available() != 0)) {
-            throw new IOException("SEQUENCE length error");
-        }
-        AlgorithmId algId = AlgorithmId.parse(values[0]);
-        if (algId.getOID().equals(oid) == false) {
-            throw new IOException("ObjectIdentifier mismatch: "
-                + algId.getOID());
-        }
-        if (algId.getEncodedParams() != null) {
-            throw new IOException("Unexpected AlgorithmId parameters");
-        }
-        byte[] digest = values[1].getOctetString();
-        return digest;
-    }
-
     // set parameter, not supported. See JCA doc
     @Deprecated
     @Override
diff --git a/src/java.base/share/classes/sun/security/rsa/RSAUtil.java b/src/java.base/share/classes/sun/security/rsa/RSAUtil.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -25,8 +25,12 @@
 
 package sun.security.rsa;
 
+import java.io.IOException;
 import java.security.*;
 import java.security.spec.*;
+import sun.security.util.DerInputStream;
+import sun.security.util.DerOutputStream;
+import sun.security.util.DerValue;
 import sun.security.util.ObjectIdentifier;
 import sun.security.x509.AlgorithmId;
 
@@ -161,4 +165,42 @@ public static Object[] getTypeAndParamSpec(AlgorithmId algid)
         result[1] = getParamSpec(algid.getParameters());
         return result;
     }
+
+    /**
+     * Encode the digest, return the to-be-signed data.
+     * Also used by the PKCS#11 provider.
+     */
+    public static byte[] encodeSignature(ObjectIdentifier oid, byte[] digest)
+            throws IOException {
+        DerOutputStream out = new DerOutputStream();
+        new AlgorithmId(oid).encode(out);
+        out.putOctetString(digest);
+        DerValue result =
+            new DerValue(DerValue.tag_Sequence, out.toByteArray());
+        return result.toByteArray();
+    }
+
+    /**
+     * Decode the signature data. Verify that the object identifier matches
+     * and return the message digest.
+     */
+    public static byte[] decodeSignature(ObjectIdentifier oid, byte[] sig)
+            throws IOException {
+        // Enforce strict DER checking for signatures
+        DerInputStream in = new DerInputStream(sig, 0, sig.length, false);
+        DerValue[] values = in.getSequence(2);
+        if ((values.length != 2) || (in.available() != 0)) {
+            throw new IOException("SEQUENCE length error");
+        }
+        AlgorithmId algId = AlgorithmId.parse(values[0]);
+        if (algId.getOID().equals(oid) == false) {
+            throw new IOException("ObjectIdentifier mismatch: "
+                + algId.getOID());
+        }
+        if (algId.getEncodedParams() != null) {
+            throw new IOException("Unexpected AlgorithmId parameters");
+        }
+        byte[] digest = values[1].getOctetString();
+        return digest;
+    }
 }
diff --git a/src/java.base/share/classes/sun/security/timestamp/TSResponse.java b/src/java.base/share/classes/sun/security/timestamp/TSResponse.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -99,7 +99,7 @@
  * @see Timestamper
  */
 
-public class TSResponse {
+public final class TSResponse {
 
     // Status codes (from RFC 3161)
 
diff --git a/src/java.base/share/classes/sun/security/util/math/intpoly/IntegerPolynomial.java b/src/java.base/share/classes/sun/security/util/math/intpoly/IntegerPolynomial.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -61,7 +61,14 @@
  *
  */
 
-public abstract class IntegerPolynomial implements IntegerFieldModuloP {
+public abstract sealed class IntegerPolynomial implements IntegerFieldModuloP
+    permits IntegerPolynomial1305, IntegerPolynomial25519,
+            IntegerPolynomial448, IntegerPolynomialP256,
+            IntegerPolynomialP384, IntegerPolynomialP521,
+            IntegerPolynomialModBinP, P256OrderField,
+            P384OrderField, P521OrderField,
+            sun.security.util.math.intpoly.Curve25519OrderField,
+            sun.security.util.math.intpoly.Curve448OrderField {
 
     protected static final BigInteger TWO = BigInteger.valueOf(2);
 
diff --git a/src/java.base/share/classes/sun/security/util/math/intpoly/IntegerPolynomial1305.java b/src/java.base/share/classes/sun/security/util/math/intpoly/IntegerPolynomial1305.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -35,7 +35,7 @@
  * The representation uses 5 signed long values.
  */
 
-public class IntegerPolynomial1305 extends IntegerPolynomial {
+public final class IntegerPolynomial1305 extends IntegerPolynomial {
 
     protected static final int SUBTRAHEND = 5;
     protected static final int NUM_LIMBS = 5;
diff --git a/src/java.base/share/classes/sun/security/util/math/intpoly/IntegerPolynomial25519.java b/src/java.base/share/classes/sun/security/util/math/intpoly/IntegerPolynomial25519.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -32,7 +32,7 @@
  * The representation uses 10 signed long values.
  */
 
-public class IntegerPolynomial25519 extends IntegerPolynomial {
+public final class IntegerPolynomial25519 extends IntegerPolynomial {
 
     private static final int POWER = 255;
     private static final int SUBTRAHEND = 19;
diff --git a/src/java.base/share/classes/sun/security/util/math/intpoly/IntegerPolynomial448.java b/src/java.base/share/classes/sun/security/util/math/intpoly/IntegerPolynomial448.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -32,7 +32,7 @@
  * The representation uses 16 signed long values.
  */
 
-public class IntegerPolynomial448 extends IntegerPolynomial {
+public final class IntegerPolynomial448 extends IntegerPolynomial {
 
     private static final int POWER = 448;
     private static final int NUM_LIMBS = 16;
diff --git a/src/java.base/share/classes/sun/security/util/math/intpoly/IntegerPolynomialModBinP.java b/src/java.base/share/classes/sun/security/util/math/intpoly/IntegerPolynomialModBinP.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2020, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -38,7 +38,7 @@
  * This class may only be used for primes of the form 2^a + b.
  */
 
-public class IntegerPolynomialModBinP extends IntegerPolynomial {
+public sealed class IntegerPolynomialModBinP extends IntegerPolynomial {
 
     private final long[] reduceLimbs;
     private final int bitOffset;
@@ -206,7 +206,7 @@ protected void square(long[] a, long[] r) {
     /**
      * The field of integers modulo the order of the Curve25519 subgroup
      */
-    public static class Curve25519OrderField extends IntegerPolynomialModBinP {
+    public final static class Curve25519OrderField extends IntegerPolynomialModBinP {
 
         public Curve25519OrderField() {
             super(26, 10, 252,
@@ -217,7 +217,7 @@ public Curve25519OrderField() {
     /**
      * The field of integers modulo the order of the Curve448 subgroup
      */
-    public static class Curve448OrderField extends IntegerPolynomialModBinP {
+    public final static class Curve448OrderField extends IntegerPolynomialModBinP {
 
         public Curve448OrderField() {
             super(28, 16, 446,
diff --git a/src/java.base/share/classes/sun/security/validator/Validator.java b/src/java.base/share/classes/sun/security/validator/Validator.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2002, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2002, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -83,7 +83,7 @@
  *
  * @author Andreas Sterbenz
  */
-public abstract class Validator {
+public abstract sealed class Validator permits PKIXValidator, SimpleValidator {
 
     static final X509Certificate[] CHAIN0 = {};
 
diff --git a/src/java.security.jgss/share/classes/sun/security/jgss/GSSCaller.java b/src/java.security.jgss/share/classes/sun/security/jgss/GSSCaller.java
diff --git a/src/java.security.jgss/share/classes/sun/security/jgss/GSSNameImpl.java b/src/java.security.jgss/share/classes/sun/security/jgss/GSSNameImpl.java
diff --git a/src/java.security.jgss/share/classes/sun/security/jgss/HttpCaller.java b/src/java.security.jgss/share/classes/sun/security/jgss/HttpCaller.java
diff --git a/src/java.security.jgss/share/classes/sun/security/jgss/krb5/Krb5ProxyCredential.java b/src/java.security.jgss/share/classes/sun/security/jgss/krb5/Krb5ProxyCredential.java
diff --git a/src/java.security.jgss/share/classes/sun/security/krb5/KrbAsRep.java b/src/java.security.jgss/share/classes/sun/security/krb5/KrbAsRep.java
diff --git a/src/java.security.jgss/share/classes/sun/security/krb5/KrbTgsRep.java b/src/java.security.jgss/share/classes/sun/security/krb5/KrbTgsRep.java
diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Signature.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Signature.java

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,5 @@`
`1`	`1`	`/*`
`2`		`- * Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.`
	`2`	`+ * Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.`
`3`	`3`	`* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.`
`4`	`4`	`*`
`5`	`5`	`* This code is free software; you can redistribute it and/or modify it`
`@@ -614,7 +614,7 @@ private String generate(FieldParams params) throws IOException {`
`614`	`614`	`}`
`615`	`615`	`result.appendLine("import java.math.BigInteger;");`
`616`	`616`
`617`		`- result.appendLine("public class " + params.getClassName()`
	`617`	`+ result.appendLine("public final class " + params.getClassName()`
`618`	`618`	`+ " extends " + this.parentName + " {");`
`619`	`619`	`result.incrIndent();`
`620`	`620`