engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 63 sites patched across 27 ecosystems

Browse source 
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

82
test/jdk/sun/security/pkcs11/KeyGenerator/DESParity.java Normal file
View file

@ -0,0 +1,82 @@
/*
* Copyright (c) 2003, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4898479
* @summary Verify that the parity bits are set correctly
* @author Andreas Sterbenz
* @library /test/lib ..
* @key randomness
* @modules jdk.crypto.cryptoki
* @run main/othervm DESParity
*/
import jtreg.SkippedException;
import java.security.Provider;
import java.util.Random;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.DESKeySpec;
import javax.crypto.spec.DESedeKeySpec;
import javax.crypto.spec.SecretKeySpec;
public class DESParity extends PKCS11Test {
@Override
public void main(Provider p) throws Exception {
if (p.getService("SecretKeyFactory", "DES") == null) {
throw new SkippedException("Not supported by provider, skipping");
}
Random random = new Random();
SecretKeyFactory kf;
// DES
kf = SecretKeyFactory.getInstance("DES", p);
for (int i = 0; i < 10; i++ ) {
byte[] b = new byte[8];
random.nextBytes(b);
SecretKeySpec spec = new SecretKeySpec(b, "DES");
SecretKey key = kf.generateSecret(spec);
if (!DESKeySpec.isParityAdjusted(key.getEncoded(), 0)) {
throw new Exception("DES key not parity adjusted");
}
}
// DESede
kf = SecretKeyFactory.getInstance("DESede", p);
for (int i = 0; i < 10; i++ ) {
byte[] b = new byte[24];
random.nextBytes(b);
SecretKeySpec spec = new SecretKeySpec(b, "DESede");
SecretKey key = kf.generateSecret(spec);
if (!DESedeKeySpec.isParityAdjusted(key.getEncoded(), 0)) {
throw new Exception("DESede key not parity adjusted");
}
}
}
public static void main(String[] args) throws Exception {
main(new DESParity(), args);
}
}

83
test/jdk/sun/security/pkcs11/KeyGenerator/HmacDefKeySizeTest.java Normal file
View file

@ -0,0 +1,83 @@
/*
* Copyright (c) 2020, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8242332
* @summary Check that PKCS11 Hamc KeyGenerator picks appropriate default size
* @library /test/lib ..
* @modules jdk.crypto.cryptoki
* @run main/othervm HmacDefKeySizeTest
*/
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.Provider;
import java.util.List;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
public class HmacDefKeySizeTest extends PKCS11Test {
/**
* Request a KeyGenerator object from PKCS11 provider for Hmac algorithm,
* and generate the SecretKey.
*
* @param args the command line arguments
*/
public static void main(String[] args) throws Exception {
main(new HmacDefKeySizeTest(), args);
}
@Override
public void main(Provider p) {
List<String> algorithms = getSupportedAlgorithms("KeyGenerator",
"Hmac", p);
boolean success = true;
for (String alg : algorithms) {
System.out.println("Testing " + alg);
try {
KeyGenerator kg = KeyGenerator.getInstance(alg, p);
SecretKey k1 = kg.generateKey();
int keysize = k1.getEncoded().length << 3;
System.out.println("=> default key size = " + keysize);
kg.init(keysize);
SecretKey k2 = kg.generateKey();
if ((k2.getEncoded().length << 3) != keysize) {
success = false;
System.out.println("keysize check failed");
}
} catch (Exception e) {
System.out.println("Unexpected exception: " + e);
e.printStackTrace();
success = false;
}
}
if (!success) {
throw new RuntimeException("One or more tests failed");
}
}
}

90
test/jdk/sun/security/pkcs11/KeyGenerator/TestAES.java Normal file
View file

@ -0,0 +1,90 @@
/*
* Copyright (c) 2022, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8267319
* @modules java.base/sun.security.util
* jdk.crypto.cryptoki
* @summary Check AES key generator.
* @library /test/lib ..
* @run main TestAES
*/
import jtreg.SkippedException;
import sun.security.util.SecurityProviderConstants;
import java.security.Provider;
import java.security.InvalidParameterException;
import java.security.NoSuchAlgorithmException;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
public class TestAES extends PKCS11Test {
private static final String ALGO = "AES";
public static void main(String[] args) throws Exception {
main(new TestAES(), args);
}
@Override
public void main(Provider p) throws Exception {
System.out.println("Testing " + p.getName());
KeyGenerator kg;
try {
kg = KeyGenerator.getInstance(ALGO, p);
} catch (NoSuchAlgorithmException nsae) {
throw new SkippedException("Skip; no support for " + ALGO, nsae);
}
// first try w/o setting a key length and check if the generated key
// length matches
SecretKey key = kg.generateKey();
byte[] keyValue = key.getEncoded();
if (key.getEncoded().length != SecurityProviderConstants.getDefAESKeySize() >> 3) {
throw new RuntimeException("Default AES key length should be " +
SecurityProviderConstants.getDefAESKeySize());
}
for (int keySize : new int[] { 16, 32, 64, 128, 256, 512, 1024 }) {
boolean isValid = (keySize == 128 || keySize == 192 ||
keySize == 256);
try {
kg.init(keySize);
if (!isValid) {
throw new RuntimeException(keySize + " is invalid keysize");
}
key = kg.generateKey();
if (key.getEncoded().length != keySize >> 3) {
throw new RuntimeException("Generated key len mismatch!");
}
} catch (InvalidParameterException e) {
if (isValid) {
throw new RuntimeException("IPE thrown for valid keySize");
} else {
System.out.println("Expected IPE thrown for " + keySize);
}
}
}
}
}

93
test/jdk/sun/security/pkcs11/KeyGenerator/TestChaCha20.java Normal file
View file

@ -0,0 +1,93 @@
/*
* Copyright (c) 2021, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8255410
* @modules jdk.crypto.cryptoki
* @summary Check ChaCha20 key generator.
* @library /test/lib ..
* @run main/othervm TestChaCha20
*/
import jtreg.SkippedException;
import java.security.Provider;
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidParameterException;
import java.security.NoSuchAlgorithmException;
import java.util.HexFormat;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import javax.crypto.spec.ChaCha20ParameterSpec;
public class TestChaCha20 extends PKCS11Test {
private static final String ALGO = "ChaCha20";
public static void main(String[] args) throws Exception {
main(new TestChaCha20(), args);
}
@Override
public void main(Provider p) throws Exception {
System.out.println("Testing " + p.getName());
KeyGenerator kg;
try {
kg = KeyGenerator.getInstance(ALGO, p);
} catch (NoSuchAlgorithmException nsae) {
throw new SkippedException("Skip; no support for " + ALGO, nsae);
}
try {
kg.init(new ChaCha20ParameterSpec(new byte[12], 0));
throw new RuntimeException(
"ChaCha20 key generation should not need any paramSpec");
} catch (InvalidAlgorithmParameterException e) {
System.out.println("Expected IAPE: " + e.getMessage());
}
for (int keySize : new int[] { 32, 64, 128, 256, 512, 1024 }) {
try {
kg.init(keySize);
if (keySize != 256) {
throw new RuntimeException(keySize + " is invalid keysize");
}
} catch (InvalidParameterException e) {
if (keySize == 256) {
throw new RuntimeException("IPE thrown for valid keySize");
} else {
System.out.println("Expected IPE thrown for " + keySize);
}
}
}
//kg.init(256);
SecretKey key = kg.generateKey();
byte[] keyValue = key.getEncoded();
System.out.println("Key: " + HexFormat.of().formatHex(keyValue));
if (keyValue.length != 32) {
throw new RuntimeException("The size of generated key must be 256");
}
}
}

147
test/jdk/sun/security/pkcs11/KeyGenerator/TestKeyGenerator.java Normal file
View file

@ -0,0 +1,147 @@
/*
* Copyright (c) 2003, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 4917233 6461727 6490213 6720456 8242332
* @summary test the KeyGenerator
* @author Andreas Sterbenz
* @library /test/lib ..
* @modules jdk.crypto.cryptoki
* @run main/othervm TestKeyGenerator
*/
import java.security.InvalidParameterException;
import java.security.NoSuchAlgorithmException;
import java.security.Provider;
import java.security.ProviderException;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
enum TestResult {
PASS,
FAIL,
TBD
}
public class TestKeyGenerator extends PKCS11Test {
public static void main(String[] args) throws Exception {
main(new TestKeyGenerator(), args);
}
private TestResult test(String algorithm, int keyLen, Provider p,
TestResult expected)
throws Exception {
TestResult actual = TestResult.TBD;
System.out.println("Testing " + algorithm + ", " + keyLen + " bits...");
KeyGenerator kg;
try {
kg = KeyGenerator.getInstance(algorithm, p);
} catch (NoSuchAlgorithmException e) {
System.out.println("Not supported, skipping: " + e);
return TestResult.PASS;
}
try {
kg.init(keyLen);
actual = TestResult.PASS;
} catch (InvalidParameterException ipe) {
actual = TestResult.FAIL;
}
if (actual == TestResult.PASS) {
try {
SecretKey key = kg.generateKey();
if (expected == TestResult.FAIL) {
throw new Exception("Generated " + key +
" using invalid key length");
}
} catch (ProviderException e) {
e.printStackTrace();
throw (Exception) (new Exception
("key generation failed using valid length").initCause(e));
}
}
if (expected != TestResult.TBD && expected != actual) {
throw new Exception("Expected to " + expected + ", but " +
actual);
}
return actual;
}
@Override
public void main(Provider p) throws Exception {
test("DES", 0, p, TestResult.FAIL);
test("DES", 56, p, TestResult.PASS); // ensure JCE-Compatibility
test("DES", 64, p, TestResult.PASS);
test("DES", 128, p, TestResult.FAIL);
test("DESede", 0, p, TestResult.FAIL);
// Special handling since not all PKCS11 providers support
// 2-key DESede, e.g. SunPKCS11-Solaris.
TestResult temp = test("DESede", 112, p, TestResult.TBD);
test("DESede", 128, p, temp);
test("DESede", 168, p, TestResult.PASS);
test("DESede", 192, p, TestResult.PASS);
test("DESede", 64, p, TestResult.FAIL);
test("DESede", 256, p, TestResult.FAIL);
// Different PKCS11 impls have different ranges
// of supported key sizes for variable-key-length
// algorithms.
// NSS> Blowfish: n/a, RC4: 8-2048 bits
// However, we explicitly disallowed key sizes less
// than 40-bits.
test("Blowfish", 0, p, TestResult.FAIL);
test("Blowfish", 24, p, TestResult.FAIL);
test("Blowfish", 32, p, TestResult.FAIL);
test("Blowfish", 40, p, TestResult.PASS);
test("Blowfish", 128, p, TestResult.PASS);
test("Blowfish", 136, p, TestResult.TBD);
test("Blowfish", 448, p, TestResult.TBD);
test("Blowfish", 456, p, TestResult.FAIL);
test("ARCFOUR", 0, p, TestResult.FAIL);
test("ARCFOUR", 32, p, TestResult.FAIL);
test("ARCFOUR", 40, p, TestResult.PASS);
test("ARCFOUR", 128, p, TestResult.PASS);
String[] HMAC_ALGS = {
"HmacSHA1", "HmacSHA224", "HmacSHA256", "HmacSHA384", "HmacSHA512",
"HmacSHA512/224", "HmacSHA512/256", "HmacSHA3-224", "HmacSHA3-256",
"HmacSHA3-384", "HmacSHA3-512",
};
for (String hmacAlg : HMAC_ALGS) {
test(hmacAlg, 0, p, TestResult.FAIL);
test(hmacAlg, 128, p, TestResult.PASS);
test(hmacAlg, 224, p, TestResult.PASS);
}
if (p.getName().equals("SunPKCS11-NSS")) {
test("ARCFOUR", 1024, p, TestResult.PASS);
test("ARCFOUR", 2048, p, TestResult.PASS);
test("ARCFOUR", 2056, p, TestResult.FAIL);
}
}
}