Merge pull request ibmruntimes#522 from KostasTsiounis/check_provider_services

Check if service is allowed in RestrictedSecurity mode

Author: keithc-ca

src/java.base/share/classes/java/security/Provider.java

@@ -1294,10 +1294,14 @@ public Service getService(String type, String algorithm) {
         Service s = serviceMap.get(key);
         if (s == null) {
             s = legacyMap.get(key);
-            if (s != null && !s.isValid()) {
+            if (s != null && (!s.isValid() || !RestrictedSecurity.isServiceAllowed(s))) {
                 legacyMap.remove(key, s);
                 return null;
             }
+        } else {
+            if (!RestrictedSecurity.isServiceAllowed(s)) {
+                return null;
+            }
         }
 
         if (s != null && SecurityProviderServiceEvent.isTurnedOn()) {
@@ -1334,19 +1338,24 @@ public Set<Service> getServices() {
         if (serviceSet == null || legacyChanged || servicesChanged) {
             Set<Service> set = new LinkedHashSet<>();
             if (!serviceMap.isEmpty()) {
-                set.addAll(serviceMap.values());
+                serviceMap.values().forEach(service -> {
+                    if (RestrictedSecurity.isServiceAllowed(service)) {
+                        // If allowed by RestrictedSecurity, add it to set.
+                        set.add(service);
+                    }
+                });
             }
             if (!legacyMap.isEmpty()) {
                 legacyMap.entrySet().forEach(entry -> {
-                    if (!entry.getValue().isValid()) {
+                    if (!entry.getValue().isValid() || !RestrictedSecurity.isServiceAllowed(entry.getValue())) {
                         legacyMap.remove(entry.getKey(), entry.getValue());
                     } else {
                         set.add(entry.getValue());
                     }
                 });
             }
             serviceSet = Collections.unmodifiableSet(set);
-            servicesChanged = false;
+            servicesChanged = RestrictedSecurity.isEnabled();
             legacyChanged = false;
         }
         return serviceSet;

src/java.base/share/classes/sun/security/jca/ProviderList.java

@@ -402,8 +402,7 @@ public Service getService(String type, String name) {
             for (i = 0; i < pList.size(); i++) {
                 Provider p = getProvider(pList.get(i).provider);
                 Service s = p.getService(type, name);
-                if ((s != null) && RestrictedSecurity.isServiceAllowed(s)) {
-                    // We found a service that is allowed in restricted security mode.
+                if (s != null) {
                     return s;
                 }
             }
@@ -412,8 +411,7 @@ public Service getService(String type, String name) {
         for (i = 0; i < configs.length; i++) {
             Provider p = getProvider(i);
             Service s = p.getService(type, name);
-            if ((s != null) && RestrictedSecurity.isServiceAllowed(s)) {
-                // We found a service that is allowed in restricted security mode.
+            if (s != null) {
                 return s;
             }
         }
@@ -549,14 +547,14 @@ private Service tryGet(int index) {
                 if (type != null) {
                     // simple lookup
                     Service s = p.getService(type, algorithm);
-                    if ((s != null) && RestrictedSecurity.isServiceAllowed(s)) {
+                    if (s != null) {
                         addService(s);
                     }
                 } else {
                     // parallel lookup
                     for (ServiceId id : ids) {
                         Service s = p.getService(id.type, id.algorithm);
-                        if ((s != null) && RestrictedSecurity.isServiceAllowed(s)) {
+                        if (s != null) {
                             addService(s);
                         }
                     }