Provide try-with-resources-like function to SHA256

src/freenet/client/Metadata.java

@@ -12,7 +12,6 @@
 import java.io.Serializable;
 import java.io.UnsupportedEncodingException;
 import java.net.MalformedURLException;
-import java.security.MessageDigest;
 import java.util.HashMap;
 import java.util.LinkedList;
 import java.util.Map;
@@ -748,12 +747,10 @@ public static byte[] getCryptoKey(HashResult[] hashes) {
 	public static byte[] getCryptoKey(byte[] hash) {
 		// This is exactly the same algorithm used by e.g. JFK for generating multiple session keys from a single generated value.
 		// The only difference is we use a constant of more than one byte's length here, to avoid having to keep a registry.
-		MessageDigest md = SHA256.getMessageDigest();
-		md.update(hash);
-		md.update(SPLITKEY);
-		byte[] buf = md.digest();
-		SHA256.returnMessageDigest(md);
-		return buf;
+		return SHA256.digest(md -> {
+			md.update(hash);
+			md.update(SPLITKEY);
+		});
 	}
 
 	public static byte[] getCrossSegmentSeed(HashResult[] hashes, byte[] hashThisLayerOnly) {
@@ -769,12 +766,10 @@ public static byte[] getCrossSegmentSeed(HashResult[] hashes, byte[] hashThisLay
 	public static byte[] getCrossSegmentSeed(byte[] hash) {
 		// This is exactly the same algorithm used by e.g. JFK for generating multiple session keys from a single generated value.
 		// The only difference is we use a constant of more than one byte's length here, to avoid having to keep a registry.
-		MessageDigest md = SHA256.getMessageDigest();
-		md.update(hash);
-		md.update(CROSS_SEGMENT_SEED);
-		byte[] buf = md.digest();
-		SHA256.returnMessageDigest(md);
-		return buf;
+		return SHA256.digest(md -> {
+			md.update(hash);
+			md.update(CROSS_SEGMENT_SEED);
+		});
 	}
 
 	/**

src/freenet/client/async/KeyListenerTracker.java

@@ -5,7 +5,6 @@
 
 import static java.lang.String.format;
 
-import java.security.MessageDigest;
 import java.util.Arrays;
 import java.util.ArrayList;
 import java.util.HashMap;
@@ -20,7 +19,6 @@
 import freenet.keys.KeyBlock;
 import freenet.keys.NodeSSK;
 import freenet.node.SendableGet;
-import freenet.node.SendableRequest;
 import freenet.support.ByteArrayWrapper;
 import freenet.support.LogThresholdCallback;
 import freenet.support.Logger;
@@ -464,14 +462,13 @@ public byte[] saltKey(Key key) {
 	}
 
 	private byte[] saltKey(byte[] key) {
-		if (isSSKScheduler)
+		if (isSSKScheduler) {
 			return key;
-		MessageDigest md = SHA256.getMessageDigest();
-		md.update(key);
-		md.update(globalSalt);
-		byte[] ret = md.digest();
-		SHA256.returnMessageDigest(md);
-		return ret;
+		}
+		return SHA256.digest(md -> {
+			md.update(key);
+			md.update(globalSalt);
+		});
 	}
 
 	protected void hintGlobalSalt(byte[] globalSalt2) {

src/freenet/client/async/SplitFileFetcherKeyListener.java

@@ -5,7 +5,6 @@
 import java.io.IOException;
 import java.io.OutputStream;
 import java.nio.ByteBuffer;
-import java.security.MessageDigest;
 
 import freenet.client.FetchException;
 import freenet.client.FetchException.FetchExceptionMode;
@@ -201,12 +200,10 @@ synchronized void finishedSetup() {
     }
 
     private byte[] localSaltKey(Key key) {
-        MessageDigest md = SHA256.getMessageDigest();
-        md.update(key.getRoutingKey());
-        md.update(localSalt);
-        byte[] ret = md.digest();
-        SHA256.returnMessageDigest(md);
-        return ret;
+        return SHA256.digest(md -> {
+            md.update(key.getRoutingKey());
+            md.update(localSalt);
+        });
     }
 
     /** The segment bloom filters should only need to be written ONCE, and can all be written at 

src/freenet/crypt/SHA256.java

@@ -41,6 +41,7 @@ LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 import java.security.Provider;
 import java.util.Queue;
 import java.util.concurrent.ConcurrentLinkedQueue;
+import java.util.function.Consumer;
 
 import org.tanukisoftware.wrapper.WrapperManager;
 
@@ -119,10 +120,26 @@ public static void returnMessageDigest(MessageDigest md256) {
 	}
 
 	public static byte[] digest(byte[] data) {
+		return digest(md -> md.update(data));
+	}
+
+	public static byte[] digest(Consumer<MessageDigest> updater) {
+		MessageDigest md = null;
+		try {
+			md = getMessageDigest();
+			updater.accept(md);
+			return md.digest();
+		} finally {
+			returnMessageDigest(md);
+		}
+	}
+
+	public static byte[] digest(InputStream is) throws IOException {
 		MessageDigest md = null;
 		try {
 			md = getMessageDigest();
-			return md.digest(data);
+			hash(is, md);
+			return md.digest();
 		} finally {
 			returnMessageDigest(md);
 		}

src/freenet/keys/CHKBlock.java

@@ -3,7 +3,6 @@
  * http://www.gnu.org/ for further details of the GPL. */
 package freenet.keys;
 
-import java.security.MessageDigest;
 import java.util.Arrays;
 
 import freenet.crypt.SHA256;
@@ -76,12 +75,12 @@ public CHKBlock(byte[] data2, byte[] header2, NodeCHK key, boolean verify, byte
         // Check the hash
         if(hashIdentifier != HASH_SHA256)
             throw new CHKVerifyException("Hash not SHA-256");
-        MessageDigest md = SHA256.getMessageDigest();
-
-        md.update(headers);
-        md.update(data);
-        byte[] hash = md.digest();
-        SHA256.returnMessageDigest(md);
+
+        byte[] hash = SHA256.digest(md -> {
+            md.update(headers);
+            md.update(data);
+        });
+
         if(key == null) {
         	chk = new NodeCHK(hash, cryptoAlgorithm);
         } else {

src/freenet/keys/ClientCHKBlock.java

@@ -138,11 +138,10 @@ public Bucket decodeOld(BucketFactory bf, int maxLength, boolean dontCompress) t
         // Decipher header first - functions as IV
         pcfb.blockDecipher(hbuf, 0, hbuf.length);
         pcfb.blockDecipher(dbuf, 0, dbuf.length);
-        MessageDigest md256 = SHA256.getMessageDigest();
         byte[] dkey = key.cryptoKey;
         // Check: IV == hash of decryption key
-        byte[] predIV = md256.digest(dkey);
-        SHA256.returnMessageDigest(md256); md256 = null;
+        byte[] predIV = SHA256.digest(dkey);
+
         // Extract the IV
         byte[] iv = Arrays.copyOf(hbuf, 32);
         if(!Arrays.equals(iv, predIV))

src/freenet/keys/ClientKSK.java

@@ -7,6 +7,7 @@
  * requested and inserted. */
 import java.io.UnsupportedEncodingException;
 import java.net.MalformedURLException;
+import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
 
 import freenet.support.math.MersenneTwister;
@@ -43,25 +44,15 @@ public static InsertableClientSSK create(FreenetURI uri) {
 	}
 
 	public static ClientKSK create(String keyword) {
-		MessageDigest md256 = SHA256.getMessageDigest();
+		byte[] keywordHash = SHA256.digest(keyword.getBytes(StandardCharsets.UTF_8));
+		MersenneTwister mt = new MersenneTwister(keywordHash);
+		DSAPrivateKey privKey = new DSAPrivateKey(Global.DSAgroupBigA, mt);
+		DSAPublicKey pubKey = new DSAPublicKey(Global.DSAgroupBigA, privKey);
+		byte[] pubKeyHash = SHA256.digest(pubKey.asBytes());
 		try {
-			byte[] keywordHash;
-			try {
-				keywordHash = md256.digest(keyword.getBytes("UTF-8"));
-			} catch (UnsupportedEncodingException e) {
-				throw new Error("Impossible: JVM doesn't support UTF-8: " + e, e);
-			}
-			MersenneTwister mt = new MersenneTwister(keywordHash);
-			DSAPrivateKey privKey = new DSAPrivateKey(Global.DSAgroupBigA, mt);
-			DSAPublicKey pubKey = new DSAPublicKey(Global.DSAgroupBigA, privKey);
-			byte[] pubKeyHash = md256.digest(pubKey.asBytes());
-			try {
-				return new ClientKSK(keyword, pubKeyHash, pubKey, privKey, keywordHash);
-			} catch (MalformedURLException e) {
-				throw new Error(e);
-			}
-		} finally {
-			SHA256.returnMessageDigest(md256);
+			return new ClientKSK(keyword, pubKeyHash, pubKey, privKey, keywordHash);
+		} catch (MalformedURLException e) {
+			throw new Error(e);
 		}
 	}
 

src/freenet/keys/ClientSSK.java

@@ -5,6 +5,7 @@
 
 import java.io.UnsupportedEncodingException;
 import java.net.MalformedURLException;
+import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
 import java.util.Arrays;
 
@@ -73,33 +74,26 @@ public ClientSSK(String docName, byte[] pubKeyHash, byte[] extras, DSAPublicKey
 			throw new MalformedURLException("Pubkey hash wrong length: "+pubKeyHash.length+" should be "+NodeSSK.PUBKEY_HASH_SIZE);
 		if(cryptoKey.length != CRYPTO_KEY_LENGTH)
 			throw new MalformedURLException("Decryption key wrong length: "+cryptoKey.length+" should be "+CRYPTO_KEY_LENGTH);
-		MessageDigest md = SHA256.getMessageDigest();
-		try {
-			if (pubKey != null) {
-				byte[] pubKeyAsBytes = pubKey.asBytes();
-				md.update(pubKeyAsBytes);
-				byte[] otherPubKeyHash = md.digest();
-				if (!Arrays.equals(otherPubKeyHash, pubKeyHash))
-					throw new IllegalArgumentException();
-			}
-			this.cryptoKey = cryptoKey;
-			try {
-				md.update(docName.getBytes("UTF-8"));
-			} catch (UnsupportedEncodingException e) {
-				throw new Error("Impossible: JVM doesn't support UTF-8: " + e, e);
-			}
-			byte[] buf = md.digest();
-			try {
-				Rijndael aes = new Rijndael(256, 256);
-				aes.initialize(cryptoKey);
-				aes.encipher(buf, buf);
-				ehDocname = buf;
-			} catch (UnsupportedCipherException e) {
-				throw new Error(e);
+
+		if (pubKey != null) {
+			byte[] otherPubKeyHash = SHA256.digest(pubKey.asBytes());
+			if (!Arrays.equals(otherPubKeyHash, pubKeyHash)) {
+				throw new IllegalArgumentException();
 			}
-		} finally {
-			SHA256.returnMessageDigest(md);
 		}
+
+		this.cryptoKey = cryptoKey;
+
+		byte[] buf = SHA256.digest(docName.getBytes(StandardCharsets.UTF_8));
+		try {
+			Rijndael aes = new Rijndael(256, 256);
+			aes.initialize(cryptoKey);
+			aes.encipher(buf, buf);
+			ehDocname = buf;
+		} catch (UnsupportedCipherException e) {
+			throw new Error(e);
+		}
+
 		if(ehDocname == null)
 			throw new NullPointerException();
 		hashCode = Fields.hashCode(pubKeyHash) ^ Fields.hashCode(cryptoKey) ^ Fields.hashCode(ehDocname) ^ docName.hashCode();

src/freenet/keys/Key.java

@@ -8,7 +8,6 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
-import java.security.MessageDigest;
 import java.util.Arrays;
 
 import freenet.crypt.CryptFormatException;
@@ -126,17 +125,22 @@ public static KeyBlock createBlock(short keyType, byte[] keyBytes, byte[] header
      * make chosen-key attacks harder.
      */
     public synchronized double toNormalizedDouble() {
-        if(cachedNormalizedDouble > 0) return cachedNormalizedDouble;
-        MessageDigest md = SHA256.getMessageDigest();
-        if(routingKey == null) throw new NullPointerException();
-        md.update(routingKey);
-        int TYPE = getType();
-        md.update((byte)(TYPE >> 8));
-        md.update((byte)TYPE);
-        byte[] digest = md.digest();
-        SHA256.returnMessageDigest(md); md = null;
-			cachedNormalizedDouble = Util.keyDigestAsNormalizedDouble(digest);
+        if (cachedNormalizedDouble > 0) {
 			return cachedNormalizedDouble;
+		}
+		if (routingKey == null) {
+			throw new NullPointerException();
+		}
+
+		byte[] digest = SHA256.digest(md -> {
+			md.update(routingKey);
+			int TYPE = getType();
+			md.update((byte) (TYPE >> 8));
+			md.update((byte) TYPE);
+		});
+
+		cachedNormalizedDouble = Util.keyDigestAsNormalizedDouble(digest);
+		return cachedNormalizedDouble;
     }
 
 	/**

src/freenet/keys/NodeSSK.java

@@ -104,12 +104,10 @@ public Key cloneKey() {
 
 	// routingKey = H( E(H(docname)) + H(pubkey) )
 	private static byte[] makeRoutingKey(byte[] pkHash, byte[] ehDocname) {
-		MessageDigest md256 = SHA256.getMessageDigest();
-		md256.update(ehDocname);
-		md256.update(pkHash);
-		byte[] key = md256.digest();
-		SHA256.returnMessageDigest(md256);
-		return key;
+		return SHA256.digest(md -> {
+			md.update(ehDocname);
+			md.update(pkHash);
+		});
 	}
 
 	@Override

src/freenet/node/FNPPacketMangler.java

@@ -6,6 +6,7 @@
 import java.io.File;
 import java.io.UnsupportedEncodingException;
 import java.net.InetAddress;
+import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
 import java.security.interfaces.ECPublicKey;
 import java.util.Arrays;
@@ -1766,31 +1767,21 @@ public void run() {
 	}
 
 	private int getInitialMessageID(byte[] identity) {
-		MessageDigest md = SHA256.getMessageDigest();
-		md.update(identity);
-		// Similar to JFK keygen, should be safe enough.
-		try {
-			md.update("INITIAL0".getBytes("UTF-8"));
-		} catch (UnsupportedEncodingException e) {
-			throw new Error(e);
-		}
-		byte[] hashed = md.digest();
-		SHA256.returnMessageDigest(md);
+		byte[] hashed = SHA256.digest(md -> {
+			md.update(identity);
+			// Similar to JFK keygen, should be safe enough.
+			md.update("INITIAL0".getBytes(StandardCharsets.UTF_8));
+		});
 		return Fields.bytesToInt(hashed, 0);
 	}
 
 	private int getInitialMessageID(byte[] identity, byte[] otherIdentity) {
-		MessageDigest md = SHA256.getMessageDigest();
-		md.update(identity);
-		md.update(otherIdentity);
-		// Similar to JFK keygen, should be safe enough.
-		try {
-			md.update("INITIAL1".getBytes("UTF-8"));
-		} catch (UnsupportedEncodingException e) {
-			throw new Error(e);
-		}
-		byte[] hashed = md.digest();
-		SHA256.returnMessageDigest(md);
+		byte[] hashed = SHA256.digest(md -> {
+			md.update(identity);
+			md.update(otherIdentity);
+			// Similar to JFK keygen, should be safe enough.
+			md.update("INITIAL1".getBytes(StandardCharsets.UTF_8));
+		});
 		return Fields.bytesToInt(hashed, 0);
 	}