commit c28417b0f421b80cd7efa339a3cce5609aafc880

Author: Andrew John Hughes <andrew@openjdk.org>

Date:   Mon Apr 18 20:04:49 2022 +0100

    Support security.systemCACerts security property which can be disabled with -Djava.security.disableSystemCACerts=true

    PR2888: OpenJDK should check for system cacerts database (e.g. /etc/pki/java/cacerts)

    PR3575: System cacerts database handling should not affect jssecacerts

    RH2055274: Revert default keystore to JAVA_HOME/jre/lib/security/cacerts in portable builds

diff --git a/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java b/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java

index e7b4763db53..4b38d1f9465 100644

--- a/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java

+++ b/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java

@@ -68,7 +68,7 @@ final class TrustStoreManager {

      * The preference of the default trusted KeyStore is:

      *    javax.net.ssl.trustStore

      *    jssecacerts

-     *    cacerts

+     *    cacerts (system and local)

      */

     private static final class TrustStoreDescriptor {

         private static final String fileSep = File.separator;

@@ -79,6 +79,11 @@ final class TrustStoreManager {

                 defaultStorePath + fileSep + "cacerts";

         private static final String jsseDefaultStore =

                 defaultStorePath + fileSep + "jssecacerts";

+        /* Check system cacerts DB */

+        private static final boolean systemStoreOff =

+                privilegedGetBooleanProperty("java.security.disableSystemCACerts");

+        private static final String systemStore = (systemStoreOff ? defaultStore :

+                privilegedGetSecurityProperty("security.systemCACerts"));

         // the trust store name

         private final String storeName;

@@ -139,28 +144,35 @@ final class TrustStoreManager {

                     String storePropPassword = System.getProperty(

                             "javax.net.ssl.trustStorePassword", "");

+                    if (SSLLogger.isOn && SSLLogger.isOn("trustmanager")) {

+                        SSLLogger.fine("System store disabled: " + systemStoreOff);

+                        SSLLogger.fine("System store: " + systemStore);

+                    }

+

                     String temporaryName = "";

                     File temporaryFile = null;

                     long temporaryTime = 0L;

                     if (!"NONE".equals(storePropName)) {

                         String[] fileNames =

-                                new String[] {storePropName, defaultStore};

+                                new String[] {storePropName,

+                                              systemStore, defaultStore};

                         for (String fileName : fileNames) {

-                            File f = new File(fileName);

-                            if (f.isFile() && f.canRead()) {

-                                temporaryName = fileName;;

-                                temporaryFile = f;

-                                temporaryTime = f.lastModified();

-

-                                break;

-                            }

-

-                            // Not break, the file is inaccessible.

-                            if (SSLLogger.isOn &&

+                            if (fileName != null && !"".equals(fileName)) {

+                                File f = new File(fileName);

+                                if (f.isFile() && f.canRead()) {

+                                    temporaryName = fileName;;

+                                    temporaryFile = f;

+                                    temporaryTime = f.lastModified();

+

+                                    break;

+                                }

+                                // Not break, the file is inaccessible.

+                                if (SSLLogger.isOn &&

                                     SSLLogger.isOn("trustmanager")) {

-                                SSLLogger.fine(

-                                        "Inaccessible trust store: " +

-                                        storePropName);

+                                    SSLLogger.fine(

+                                            "Inaccessible trust store: " +

+                                            fileName);

+                                }

                             }

                         }

                     } else {

@@ -390,4 +402,31 @@ final class TrustStoreManager {

             return TrustStoreUtil.getTrustedCerts(ks);

         }

     }

+

+    private static String privilegedGetSecurityProperty(final String prop) {

+        if (System.getSecurityManager() == null) {

+            return Security.getProperty(prop);

+        } else {

+            return AccessController.doPrivileged(new PrivilegedAction<String>() {

+                @Override

+                public String run() {

+                    return Security.getProperty(prop);

+                }

+            });

+        }

+    }

+

+    /**

+     * Returns {@code true} if the {@code System} property is present and set to @{code "true"}.

+     *

+     * @param prop the name of the property to check.

+     * @return true if the property is present and set to {@code "true"}.

+     */

+    private static boolean privilegedGetBooleanProperty(final String prop) {

+        if (System.getSecurityManager() == null) {

+            return Boolean.getBoolean(prop);

+        } else {

+            return AccessController.doPrivileged(new GetBooleanAction(prop));

+        }

+    }

 }

diff --git a/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java b/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java

index fcc77786da1..639fc220b6b 100644

--- a/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java

+++ b/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java

@@ -34,6 +34,7 @@ import java.io.InputStreamReader;

 import java.net.URL;

 import java.security.KeyStore;

+import java.security.Security;

 import java.security.cert.X509Certificate;

 import java.text.Collator;

@@ -103,9 +104,18 @@ public class KeyStoreUtil {

         throws Exception

     {

         String sep = File.separator;

-        File file = new File(System.getProperty("java.home") + sep

-                             + "lib" + sep + "security" + sep

-                             + "cacerts");

+        File file = null;

+        /* Check system cacerts DB first */

+        String systemDB = Security.getProperty("security.systemCACerts");

+        boolean systemStoreOff = Boolean.getBoolean("java.security.disableSystemCACerts");

+        if (!systemStoreOff && systemDB != null && !"".equals(systemDB)) {

+            file = new File(systemDB);

+        }

+        if (file == null || !file.exists()) {

+            file = new File(System.getProperty("java.home") + sep

+                            + "lib" + sep + "security" + sep

+                            + "cacerts");

+        }

         if (!file.exists()) {

             return null;

         }

diff --git a/jdk/src/share/lib/security/java.security-aix b/jdk/src/share/lib/security/java.security-aix

index bfe0c593adb..093bc09bf95 100644

--- a/jdk/src/share/lib/security/java.security-aix

+++ b/jdk/src/share/lib/security/java.security-aix

@@ -294,6 +294,13 @@ security.overridePropertiesFile=true

 #

 security.useSystemPropertiesFile=false

+#

+# Specifies the system certificate store

+# This property may be disabled using

+# -Djava.security.disableSystemCACerts=true

+#

+security.systemCACerts=${java.home}/lib/security/cacerts

+

 #

 # Determines the default key and trust manager factory algorithms for

 # the javax.net.ssl package.

diff --git a/jdk/src/share/lib/security/java.security-linux b/jdk/src/share/lib/security/java.security-linux

index 9d1c8fe8a8e..16c9281cc1f 100644

--- a/jdk/src/share/lib/security/java.security-linux

+++ b/jdk/src/share/lib/security/java.security-linux

@@ -307,6 +307,13 @@ security.overridePropertiesFile=true

 #

 security.useSystemPropertiesFile=false

+#

+# Specifies the system certificate store

+# This property may be disabled using

+# -Djava.security.disableSystemCACerts=true

+#

+security.systemCACerts=${java.home}/lib/security/cacerts

+

 #

 # Determines the default key and trust manager factory algorithms for

 # the javax.net.ssl package.

diff --git a/jdk/src/share/lib/security/java.security-macosx b/jdk/src/share/lib/security/java.security-macosx

index 19047c61097..43e034cdeaf 100644

--- a/jdk/src/share/lib/security/java.security-macosx

+++ b/jdk/src/share/lib/security/java.security-macosx

@@ -297,6 +297,13 @@ security.overridePropertiesFile=true

 #

 security.useSystemPropertiesFile=false

+#

+# Specifies the system certificate store

+# This property may be disabled using

+# -Djava.security.disableSystemCACerts=true

+#

+security.systemCACerts=${java.home}/lib/security/cacerts

+

 #

 # Determines the default key and trust manager factory algorithms for

 # the javax.net.ssl package.

diff --git a/jdk/src/share/lib/security/java.security-solaris b/jdk/src/share/lib/security/java.security-solaris

index 7eda556ae13..325937e97fb 100644

--- a/jdk/src/share/lib/security/java.security-solaris

+++ b/jdk/src/share/lib/security/java.security-solaris

@@ -295,6 +295,13 @@ security.overridePropertiesFile=true

 #

 security.useSystemPropertiesFile=false

+#

+# Specifies the system certificate store

+# This property may be disabled using

+# -Djava.security.disableSystemCACerts=true

+#

+security.systemCACerts=${java.home}/lib/security/cacerts

+

 #

 # Determines the default key and trust manager factory algorithms for

 # the javax.net.ssl package.

diff --git a/jdk/src/share/lib/security/java.security-windows b/jdk/src/share/lib/security/java.security-windows

index dfa1a669aa9..92ef777e065 100644

--- a/jdk/src/share/lib/security/java.security-windows

+++ b/jdk/src/share/lib/security/java.security-windows

@@ -297,6 +297,13 @@ security.overridePropertiesFile=true

 #

 security.useSystemPropertiesFile=false

+#

+# Specifies the system certificate store

+# This property may be disabled using

+# -Djava.security.disableSystemCACerts=true

+#

+security.systemCACerts=${java.home}/lib/security/cacerts

+

 #

 # Determines the default key and trust manager factory algorithms for

 # the javax.net.ssl package.