8349583: Add mechanism to disable signature schemes based on their TLS scope

[jerboaa]

Unclean backport of JDK-8349583 because some dependencies aren't in 8u. This is a needed backport for JDK-8340321 which we'd like to bring into 8u. The dep missing for this backport is JDK-8226374: Restrict TLS signature schemes and named groups. Getting that in would also require 8171279: Support X25519 and X448 in TLS. So I've omitted it and only added relevant parts of it to make the backport work:

In SignatureScheme:

• use SigAlgParamSpec signAlgParams over AlgorithmParameterSpec signAlgParameter field.
• Update usages of getPreferableAlgorithm()
  and getSignerOfPreferableAlgorithm() in:
  CertificateVerify, DHServerKeyExchange, ECDHServerKeyExchange,
  CertificateRequest and CertificateMessage passing in SSLAlgorithmConstraints
  as an extra parameter.
• Add isPermitted() without the extra bit added by JDK-8226374.
• Update SignatureUtil.initVerifyWithParam() with the change of the
  signAlgParams field.

The change to java.security-* is duplicated to all OS versions.
Since 8341964: Add mechanism to disable different parts of TLS cipher suite is not
a dependency only include the relevant parts for JDK-8349583 (this patch).

Various test changes to adapt to 8u library code:

• /test/lib => /lib/testlibrary
• Utils.java is in jdk.testlibrary.Utils package in 8u.
• Remove DTLS 1.2 test which isn't supported in 8u TLS 1.3
• Change usage of Map.ofEntries() which is JDK 11+ only API
• Change usage of List.of() which is JDK 11+ only API

Other changes:

• Set.of(x) => Collections.unmodifiableSet(EnumSet.of(x))
• This change introduces sun.security.ssl.SSLScope enum which is being used in signatures of DisabledAlgorithmConstraints which is being processed during the build for ct.sym creation. Since this tool - and annotation processor - runs on the boot JDK during the build with a modified boot classpath that originally didn't include the new SSLScope class, the processing failed when looking up the class bytes for this class. The fix is to create an extra limited boot classpath that adds this class so that the build also works with an older boot JDK. See second commit.

Testing:

• jdk/test/javax/net/ssl jdk/test/sun/net/www/protocol/https/ jdk/test/sun/security/ssl/ with these results: Test results: passed: 270; failed: 2; error: 1 Failures are the same as in master.
• GHA - jdk/security_infra tests are known failures. JDK-8333788 and JDK-8385584

---

• I confirm that I make this contribution in accordance with the OpenJDK Interim AI Policy.

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• Change must not contain extraneous whitespace
• Commit message must refer to an issue
• JDK-8349583 needs maintainer approval
• Change requires CSR request JDK-8350902 to be approved

Integration blocker

 ⚠️ Dependency #822 must be integrated first

Issues

• JDK-8349583: Add mechanism to disable signature schemes based on their TLS scope (Enhancement - P2)
• JDK-8350902: Add mechanism to disable signature schemes based on their TLS scope (CSR)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk8u-dev.git pull/830/head:pull/830
$ git checkout pull/830

Update a local copy of the PR:
$ git checkout pull/830
$ git pull https://git.openjdk.org/jdk8u-dev.git pull/830/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 830

View PR using the GUI difftool:
$ git pr show -t 830

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk8u-dev/pull/830.diff

Using Webrev

Link to Webrev Comment

[bridgekeeper]

👋 Welcome back sgehwolf! A progress list of the required criteria for merging this PR into pr/822 will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

❗ This change is not yet ready to be integrated.
See the Progress checklist in the description for automated requirements.

[openjdk]

This backport pull request has now been updated with issue from the original commit.

[mlbridge]

Webrevs

• 00: Full (91fcc834)