AccessControlTest.java

/*
 * Copyright (c) 2012, 2019, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.
 *
 * This code is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * version 2 for more details (a copy is included in the LICENSE file that
 * accompanied this code).
 *
 * You should have received a copy of the GNU General Public License version
 * 2 along with this work; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 *
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 * or visit www.oracle.com if you need additional information or have any
 * questions.
 */

/* @test
 * @summary test access checking by java.lang.invoke.MethodHandles.Lookup
 * @compile AccessControlTest.java AccessControlTest_subpkg/Acquaintance_remote.java
 * @run testng/othervm test.java.lang.invoke.AccessControlTest
 */

package test.java.lang.invoke;

import java.lang.invoke.*;
import java.lang.reflect.*;
import java.lang.reflect.Modifier;
import java.util.*;
import org.testng.annotations.*;

import static java.lang.invoke.MethodHandles.*;
import static java.lang.invoke.MethodHandles.Lookup.*;
import static java.lang.invoke.MethodType.*;
import static org.testng.Assert.*;

import test.java.lang.invoke.AccessControlTest_subpkg.Acquaintance_remote;


/**
 * Test many combinations of Lookup access and cross-class lookupStatic.
 * @author jrose
 */
public class AccessControlTest {
    static final Class<?> THIS_CLASS = AccessControlTest.class;
    // How much output?
    static int verbosity = 0;
    static {
        String vstr = System.getProperty(THIS_CLASS.getSimpleName()+".verbosity");
        if (vstr == null)
            vstr = System.getProperty(THIS_CLASS.getName()+".verbosity");
        if (vstr != null)  verbosity = Integer.parseInt(vstr);
    }

    private class LookupCase implements Comparable<LookupCase> {
        final Lookup   lookup;
        final Class<?> lookupClass;
        final Class<?> prevLookupClass;
        final int      lookupModes;
        public LookupCase(Lookup lookup) {
            this.lookup = lookup;
            this.lookupClass = lookup.lookupClass();
            this.prevLookupClass = lookup.previousLookupClass();
            this.lookupModes = lookup.lookupModes();

            assert(lookupString().equals(lookup.toString()));
            numberOf(lookupClass().getClassLoader()); // assign CL#
        }
        public LookupCase(Class<?> lookupClass, Class<?> prevLookupClass, int lookupModes) {
            this.lookup = null;
            this.lookupClass = lookupClass;
            this.prevLookupClass = prevLookupClass;
            this.lookupModes = lookupModes;
            numberOf(lookupClass().getClassLoader()); // assign CL#
        }

        public final Class<?> lookupClass()     { return lookupClass; }
        public final Class<?> prevLookupClass() { return prevLookupClass; }
        public final int      lookupModes()     { return lookupModes; }

        public Lookup lookup() { lookup.getClass(); return lookup; }

        @Override
        public int compareTo(LookupCase that) {
            Class<?> c1 = this.lookupClass();
            Class<?> c2 = that.lookupClass();
            Class<?> p1 = this.prevLookupClass();
            Class<?> p2 = that.prevLookupClass();
            if (c1 != c2) {
                int cmp = c1.getName().compareTo(c2.getName());
                if (cmp != 0)  return cmp;
                cmp = numberOf(c1.getClassLoader()) - numberOf(c2.getClassLoader());
                assert(cmp != 0);
                return cmp;
            } else if (p1 != p2){
                if (p1 == null)
                    return 1;
                else if (p2 == null)
                    return -1;
                int cmp = p1.getName().compareTo(p2.getName());
                if (cmp != 0)  return cmp;
                cmp = numberOf(p1.getClassLoader()) - numberOf(p2.getClassLoader());
                assert(cmp != 0);
                return cmp;
            }
            return -(this.lookupModes() - that.lookupModes());
        }

        @Override
        public boolean equals(Object that) {
            return (that instanceof LookupCase && equals((LookupCase)that));
        }
        public boolean equals(LookupCase that) {
            return (this.lookupClass() == that.lookupClass() &&
                    this.prevLookupClass() == that.prevLookupClass() &&
                    this.lookupModes() == that.lookupModes());
        }

        @Override
        public int hashCode() {
            return lookupClass().hashCode() + (lookupModes() * 31);
        }

        /** Simulate all assertions in the spec. for Lookup.toString. */
        private String lookupString() {
            String name = lookupClass.getName();
            if (prevLookupClass != null)
                name += "/" + prevLookupClass.getName();
            String suffix = "";
            if (lookupModes == 0)
                suffix = "/noaccess";
            else if (lookupModes == PUBLIC)
                suffix = "/public";
             else if (lookupModes == UNCONDITIONAL)
                suffix = "/publicLookup";
            else if (lookupModes == (PUBLIC|MODULE))
                suffix = "/module";
            else if (lookupModes == (PUBLIC|PACKAGE)
                     || lookupModes == (PUBLIC|MODULE|PACKAGE))
                suffix = "/package";
            else if (lookupModes == (PUBLIC|PACKAGE|PRIVATE)
                    || lookupModes == (PUBLIC|MODULE|PACKAGE|PRIVATE))
                suffix = "/private";
            else if (lookupModes == (PUBLIC|PACKAGE|PRIVATE|PROTECTED)
                     || lookupModes == (PUBLIC|MODULE|PACKAGE|PRIVATE|PROTECTED)
                     || lookupModes == (PUBLIC|MODULE|PACKAGE|PRIVATE|PROTECTED|ORIGINAL))
                suffix = "";
            else
                suffix = "/#"+Integer.toHexString(lookupModes);
            return name+suffix;
        }

        /** Simulate all assertions from the spec. for Lookup.in:
         * <hr>
         * Creates a lookup on the specified new lookup class.
         * [A1] The resulting object will report the specified
         * class as its own {@link #lookupClass lookupClass}.
         * [A1-a] However, the resulting {@code Lookup} object is guaranteed
         * to have no more access capabilities than the original.
         * In particular, access capabilities can be lost as follows:<ul>
         * [A2] If the new lookup class is not the same as the old lookup class,
         * then {@link #ORIGINAL ORIGINAL} access is lost.
         * [A3] If the new lookup class is in a different module from the old one,
         * i.e. {@link #MODULE MODULE} access is lost.
         * [A4] If the new lookup class is in a different package
         * than the old one, protected and default (package) members will not be accessible,
         * i.e. {@link #PROTECTED PROTECTED} and {@link #PACKAGE PACKAGE} access are lost.
         * [A5] If the new lookup class is not within the same package member
         * as the old one, private members will not be accessible, and protected members
         * will not be accessible by virtue of inheritance,
         * i.e. {@link #PRIVATE PRIVATE} access is lost.
         * (Protected members may continue to be accessible because of package sharing.)
         * [A6] If the new lookup class is not
         * {@linkplain #accessClass(Class) accessible} to this lookup,
         * then no members, not even public members, will be accessible
         * i.e. all access modes are lost.
         * [A7] If the new lookup class, the old lookup class and the previous lookup class
         * are all in different modules i.e. teleporting to a third module,
         * all access modes are lost.
         * <p>
         * The new previous lookup class is chosen as follows:
         * [A8] If the new lookup object has {@link #UNCONDITIONAL UNCONDITIONAL} bit,
         * the new previous lookup class is {@code null}.
         * [A9] If the new lookup class is in the same module as the old lookup class,
         * the new previous lookup class is the old previous lookup class.
         * [A10] If the new lookup class is in a different module from the old lookup class,
         * the new previous lookup class is the the old lookup class.
         *
         * Other than the above cases, the new lookup will have the same
         * access capabilities as the original. [A11]
         * <hr>
         */
        public LookupCase in(Class<?> c2) {
            Class<?> c1 = lookupClass();
            Module m1 = c1.getModule();
            Module m2 = c2.getModule();
            Module m0 = prevLookupClass() != null ? prevLookupClass.getModule() : c1.getModule();
            int modes1 = lookupModes();
            int changed = 0;
            // for the purposes of access control then treat classes in different unnamed
            // modules as being in the same module.
            boolean sameModule = (m1 == m2) ||
                                 (!m1.isNamed() && !m2.isNamed());
            boolean samePackage = (c1.getClassLoader() == c2.getClassLoader() &&
                                   c1.getPackageName().equals(c2.getPackageName()));
            boolean sameTopLevel = (topLevelClass(c1) == topLevelClass(c2));
            boolean sameClass = (c1 == c2);
            assert(samePackage  || !sameTopLevel);
            assert(sameTopLevel || !sameClass);
            boolean accessible = sameClass;

            if ((modes1 & PACKAGE) != 0)  accessible |= samePackage;
            if ((modes1 & PUBLIC ) != 0)  {
                if (isModuleAccessible(c2))
                    accessible |= (c2.getModifiers() & PUBLIC) != 0;
                else
                    accessible = false;
            }
            if ((modes1 & UNCONDITIONAL) != 0) {
                if (m2.isExported(c2.getPackageName()))
                    accessible |= (c2.getModifiers() & PUBLIC) != 0;
                else
                    accessible = false;
            }
            if (!accessible) {
                // no access to c2; lose all access.
                changed |= (PUBLIC|MODULE|PACKAGE|PRIVATE|PROTECTED|UNCONDITIONAL);  // [A7]
            }
            if (!sameClass) {
                changed |= ORIGINAL;  // [A2]
            }
            if (m2 != m1 && m0 != m1) {
                // hop to a third module; lose all access
                changed |= (PUBLIC|MODULE|PACKAGE|PRIVATE|PROTECTED);  // [A8]
            }
            if (!sameModule) {
                changed |= MODULE;  // [A3]
            }
            if (!samePackage) {
                // Different package; loose PACKAGE and lower access.
                changed |= (PACKAGE|PRIVATE|PROTECTED);  // [A4]
            }
            if (!sameTopLevel) {
                // Different top-level class.  Lose PRIVATE and PROTECTED access.
                changed |= (PRIVATE|PROTECTED);  // [A5]
            }
            if (sameClass) {
                assert(changed == 0);       // [A11] (no deprivation if same class)
            }

            if (accessible)  assert((changed & PUBLIC) == 0);
            int modes2 = modes1 & ~changed;
            Class<?> plc = (m1 == m2) ? prevLookupClass() : c1; // [A9] [A10]
            if ((modes1 & UNCONDITIONAL) != 0) plc = null;      // [A8]
            LookupCase l2 = new LookupCase(c2, plc, modes2);
            assert(l2.lookupClass() == c2);         // [A1]
            assert((modes1 | modes2) == modes1);    // [A1-a] (no elevation of access)
            assert(l2.prevLookupClass() == null || (modes2 & MODULE) == 0);
            return l2;
        }

        LookupCase dropLookupMode(int modeToDrop) {
            int oldModes = lookupModes();
            int newModes = oldModes & ~(modeToDrop | PROTECTED | ORIGINAL);
            switch (modeToDrop) {
                case PUBLIC: newModes &= ~(MODULE|PACKAGE|PROTECTED|PRIVATE); break;
                case MODULE: newModes &= ~(PACKAGE|PRIVATE); break;
                case PACKAGE: newModes &= ~(PRIVATE); break;
                case PROTECTED:
                case PRIVATE:
                case ORIGINAL:
                case UNCONDITIONAL: break;
                default: throw new IllegalArgumentException(modeToDrop + " is not a valid mode to drop");
            }
            if (newModes == oldModes) return this;  // return self if no change
            LookupCase l2 = new LookupCase(lookupClass(), prevLookupClass(), newModes);
            assert((oldModes | newModes) == oldModes);    // [A2] (no elevation of access)
            assert(l2.prevLookupClass() == null || (newModes & MODULE) == 0);
            return l2;
        }

        boolean isModuleAccessible(Class<?> c) {
            Module m1 = lookupClass().getModule();
            Module m2 = c.getModule();
            Module m0 = prevLookupClass() != null ? prevLookupClass.getModule() : m1;
            String pn = c.getPackageName();
            boolean accessible = m1.canRead(m2) && m2.isExported(pn, m1);
            if (m1 != m0) {
                accessible = accessible && m0.canRead(m2) && m2.isExported(pn, m0);
            }
            return accessible;
        }

        @Override
        public String toString() {
            String s = lookupClass().getSimpleName();
            String lstr = lookupString();
            int sl = lstr.indexOf('/');
            if (sl >= 0)  s += lstr.substring(sl);
            ClassLoader cld = lookupClass().getClassLoader();
            if (cld != THIS_LOADER)  s += "/loader#"+numberOf(cld);
            return s;
        }

        /** Predict the success or failure of accessing this method. */
        public boolean willAccess(Method m) {
            Class<?> c1 = lookupClass();
            Class<?> c2 = m.getDeclaringClass();
            Module m1 = c1.getModule();
            Module m2 = c2.getModule();
            Module m0 = prevLookupClass != null ? prevLookupClass.getModule() : m1;
            // unconditional has access to all public types/members of types that is in a package
            // are unconditionally exported
            if ((lookupModes & UNCONDITIONAL) != 0) {
                return m2.isExported(c2.getPackageName())
                       && Modifier.isPublic(c2.getModifiers())
                       && Modifier.isPublic(m.getModifiers());
            }

            // c1 and c2 are in different module
            if (m1 != m2 || m0 != m2) {
                return (lookupModes & PUBLIC) != 0
                       && isModuleAccessible(c2)
                       && Modifier.isPublic(c2.getModifiers())
                       && Modifier.isPublic(m.getModifiers());
            }

            assert(m1 == m2 && prevLookupClass == null);

            if (!willAccessClass(c2, false))
                return false;

            LookupCase lc = this.in(c2);
            int modes1 = lc.lookupModes();
            int modes2 = fixMods(m.getModifiers());
            // allow private lookup on nestmates. Otherwise, privacy is strictly enforced
            if (c1 != c2 && ((modes2 & PRIVATE) == 0 || !c1.isNestmateOf(c2))) {
                modes1 &= ~PRIVATE;
            }
            // protected access is sometimes allowed
            if ((modes2 & PROTECTED) != 0) {
                int prev = modes2;
                modes2 |= PACKAGE;  // it acts like a package method also
                if ((lookupModes() & PROTECTED) != 0 &&
                    c2.isAssignableFrom(c1))
                    modes2 |= PUBLIC;  // from a subclass, it acts like a public method also
            }
            if (verbosity >= 2)
                System.out.format("%s willAccess %s modes1=0x%h modes2=0x%h => %s%n", lookupString(), lc.lookupString(), modes1, modes2, (modes2 & modes1) != 0);
            return (modes2 & modes1) != 0;
        }

        /** Predict the success or failure of accessing this class. */
        public boolean willAccessClass(Class<?> c2, boolean load) {
            Class<?> c1 = lookupClass();
            if (load && c2.getClassLoader() != null) {
                if (c1.getClassLoader() == null) {
                    // not visible
                    return false;
                }
            }

            Module m1 = c1.getModule();
            Module m2 = c2.getModule();
            Module m0 = prevLookupClass != null ? prevLookupClass.getModule() : m1;
            // unconditional has access to all public types that is in an unconditionally exported package
            if ((lookupModes & UNCONDITIONAL) != 0) {
                return m2.isExported(c2.getPackageName()) && Modifier.isPublic(c2.getModifiers());
            }
            // c1 and c2 are in different module
            if (m1 != m2 || m0 != m2) {
                return (lookupModes & PUBLIC) != 0
                    && isModuleAccessible(c2)
                    && Modifier.isPublic(c2.getModifiers());
            }

            assert(m1 == m2 && prevLookupClass == null);

            LookupCase lc = this.in(c2);
            int modes1 = lc.lookupModes();
            boolean r = false;
            if (modes1 == 0) {
                r = false;
            } else {
                if (Modifier.isPublic(c2.getModifiers())) {
                    if ((modes1 & MODULE) != 0)
                        r = true;
                    else if ((modes1 & PUBLIC) != 0)
                        r = m1.isExported(c2.getPackageName());
                } else {
                    if ((modes1 & PACKAGE) != 0 && c1.getPackage() == c2.getPackage())
                        r = true;
                }
            }
            if (verbosity >= 2) {
                System.out.println(this+" willAccessClass "+lc+" c1="+c1+" c2="+c2+" => "+r);
            }
            return r;
        }
    }

    private static Class<?> topLevelClass(Class<?> cls) {
        Class<?> c = cls;
        for (Class<?> ec; (ec = c.getEnclosingClass()) != null; )
            c = ec;
        assert(c.getEnclosingClass() == null);
        assert(c == cls || cls.getEnclosingClass() != null);
        return c;
    }

    private final TreeSet<LookupCase> CASES = new TreeSet<>();
    private final TreeMap<LookupCase,TreeSet<LookupCase>> CASE_EDGES = new TreeMap<>();
    private final ArrayList<ClassLoader> LOADERS = new ArrayList<>();
    private final ClassLoader THIS_LOADER = this.getClass().getClassLoader();
    { if (THIS_LOADER != null)  LOADERS.add(THIS_LOADER); }  // #1

    private LookupCase lookupCase(String name) {
        for (LookupCase lc : CASES) {
            if (lc.toString().equals(name))
                return lc;
        }
        throw new AssertionError(name);
    }

    private int numberOf(ClassLoader cl) {
        if (cl == null)  return 0;
        int i = LOADERS.indexOf(cl);
        if (i < 0) {
            i = LOADERS.size();
            LOADERS.add(cl);
        }
        return i+1;
    }

    private void addLookupEdge(LookupCase l1, Class<?> c2, LookupCase l2, int dropAccess) {
        TreeSet<LookupCase> edges = CASE_EDGES.get(l2);
        if (edges == null)  CASE_EDGES.put(l2, edges = new TreeSet<>());
        if (edges.add(l1)) {
            Class<?> c1 = l1.lookupClass();
            assert(l2.lookupClass() == c2); // [A1]
            int m1 = l1.lookupModes();
            int m2 = l2.lookupModes();
            assert((m1 | m2) == m1);        // [A2] (no elevation of access)
            LookupCase expect = dropAccess == 0 ? l1.in(c2) : l1.in(c2).dropLookupMode(dropAccess);
            if (!expect.equals(l2))
                System.out.println("*** expect "+l1+" => "+expect+" but got "+l2);
            assertEquals(l2, expect);
        }
    }

    private void makeCases(Lookup[] originalLookups) {
        // make initial set of lookup test cases
        CASES.clear(); LOADERS.clear(); CASE_EDGES.clear();
        ArrayList<Class<?>> classes = new ArrayList<>();
        for (Lookup l : originalLookups) {
            CASES.add(new LookupCase(l));
            classes.remove(l.lookupClass());  // no dups please
            classes.add(l.lookupClass());
        }
        System.out.println("loaders = "+LOADERS);
        int rounds = 0;
        for (int lastCount = -1; lastCount != CASES.size(); ) {
            lastCount = CASES.size();  // if CASES grow in the loop we go round again
            for (LookupCase lc1 : CASES.toArray(new LookupCase[0])) {
                for (int mode : ACCESS_CASES) {
                    LookupCase lc2 = new LookupCase(lc1.lookup().dropLookupMode(mode));
                    addLookupEdge(lc1, lc1.lookupClass(), lc2, mode);
                    CASES.add(lc2);
                }
                for (Class<?> c2 : classes) {
                    LookupCase lc2 = new LookupCase(lc1.lookup().in(c2));
                    addLookupEdge(lc1, c2, lc2, 0);
                    CASES.add(lc2);
                }
            }
            rounds++;
        }
        System.out.println("filled in "+CASES.size()+" cases from "+originalLookups.length+" original cases in "+rounds+" rounds");
        if (false) {
            System.out.println("CASES: {");
            for (LookupCase lc : CASES) {
                System.out.println(lc);
                Set<LookupCase> edges = CASE_EDGES.get(lc);
                if (edges != null)
                    for (LookupCase prev : edges) {
                        System.out.println("\t"+prev);
                    }
            }
            System.out.println("}");
        }
    }

    @Test public void test() {
        makeCases(lookups());
        if (verbosity > 0) {
            verbosity += 9;
            Method pro_in_self = targetMethod(THIS_CLASS, PROTECTED, methodType(void.class));
            testOneAccess(lookupCase("AccessControlTest/module"),  pro_in_self, "find");
            testOneAccess(lookupCase("Remote_subclass/module"),    pro_in_self, "find");
            testOneAccess(lookupCase("Remote_subclass"),           pro_in_self, "find");
            verbosity -= 9;
        }
        Set<Class<?>> targetClassesDone = new HashSet<>();
        for (LookupCase targetCase : CASES) {
            Class<?> targetClass = targetCase.lookupClass();
            if (!targetClassesDone.add(targetClass))  continue;  // already saw this one
            String targetPlace = placeName(targetClass);
            if (targetPlace == null)  continue;  // Object, String, not a target
            for (int targetAccess : ACCESS_CASES) {
                if (targetAccess == MODULE || targetAccess == UNCONDITIONAL)
                    continue;
                MethodType methodType = methodType(void.class);
                Method method = targetMethod(targetClass, targetAccess, methodType);
                // Try to access target method from various contexts.
                for (LookupCase sourceCase : CASES) {
                    testOneAccess(sourceCase, method, "findClass");
                    testOneAccess(sourceCase, method, "accessClass");
                    testOneAccess(sourceCase, method, "find");
                    testOneAccess(sourceCase, method, "unreflect");
                }
            }
        }
        System.out.println("tested "+testCount+" access scenarios; "+testCountFails+" accesses were denied");
    }

    private int testCount, testCountFails;

    private void testOneAccess(LookupCase sourceCase, Method method, String kind) {
        Class<?> targetClass = method.getDeclaringClass();
        String methodName = method.getName();
        MethodType methodType = methodType(method.getReturnType(), method.getParameterTypes());
        boolean isFindOrAccessClass = "findClass".equals(kind) || "accessClass".equals(kind);
        boolean willAccess = isFindOrAccessClass ?
                sourceCase.willAccessClass(targetClass, "findClass".equals(kind)) : sourceCase.willAccess(method);
        boolean didAccess = false;
        ReflectiveOperationException accessError = null;
        try {
            switch (kind) {
            case "accessClass":
                sourceCase.lookup().accessClass(targetClass);
                break;
            case "findClass":
                sourceCase.lookup().findClass(targetClass.getName());
                break;
            case "find":
                if ((method.getModifiers() & Modifier.STATIC) != 0)
                    sourceCase.lookup().findStatic(targetClass, methodName, methodType);
                else
                    sourceCase.lookup().findVirtual(targetClass, methodName, methodType);
                break;
            case "unreflect":
                sourceCase.lookup().unreflect(method);
                break;
            default:
                throw new AssertionError(kind);
            }
            didAccess = true;
        } catch (ReflectiveOperationException ex) {
            accessError = ex;
        }
        if (willAccess != didAccess) {
            System.out.println(sourceCase+" => "+targetClass.getSimpleName()+(isFindOrAccessClass?"":"."+methodName+methodType));
            System.out.println("fail "+(isFindOrAccessClass?kind:"on "+method)+" ex="+accessError);
            assertEquals(willAccess, didAccess);
        }
        testCount++;
        if (!didAccess)  testCountFails++;
    }

    static Method targetMethod(Class<?> targetClass, int targetAccess, MethodType methodType) {
        String methodName = accessName(targetAccess)+placeName(targetClass);
        if (verbosity >= 2)
            System.out.println(targetClass.getSimpleName()+"."+methodName+methodType);
        try {
            Method method = targetClass.getDeclaredMethod(methodName, methodType.parameterArray());
            assertEquals(method.getReturnType(), methodType.returnType());
            int haveMods = method.getModifiers();
            assert(Modifier.isStatic(haveMods));
            assert(targetAccess == fixMods(haveMods));
            return method;
        } catch (NoSuchMethodException ex) {
            throw new AssertionError(methodName, ex);
        }
    }

    static String placeName(Class<?> cls) {
        // return "self", "sibling", "nestmate", etc.
        if (cls == AccessControlTest.class)  return "self";
        String cln = cls.getSimpleName();
        int under = cln.lastIndexOf('_');
        if (under < 0)  return null;
        return cln.substring(under+1);
    }
    static String accessName(int acc) {
        switch (acc) {
        case PUBLIC:     return "pub_in_";
        case PROTECTED:  return "pro_in_";
        case PACKAGE:    return "pkg_in_";
        case PRIVATE:    return "pri_in_";
        }
        assert(false);
        return "?";
    }
    private static final int[] ACCESS_CASES = {
        PUBLIC, PACKAGE, PRIVATE, PROTECTED, MODULE, UNCONDITIONAL
    };
    /*
     * Adjust PUBLIC => PUBLIC|MODULE|UNCONDITIONAL
     * Adjust 0 => PACKAGE
     */
    /** Return one of the ACCESS_CASES. */
    static int fixMods(int mods) {
        mods &= (PUBLIC|PRIVATE|PROTECTED);
        switch (mods) {
        case PUBLIC: case PRIVATE: case PROTECTED: return mods;
        case 0:  return PACKAGE;
        }
        throw new AssertionError(mods);
    }

    static Lookup[] lookups() {
        ArrayList<Lookup> tem = new ArrayList<>();
        Collections.addAll(tem,
                           AccessControlTest.lookup_in_self(),
                           Inner_nestmate.lookup_in_nestmate(),
                           AccessControlTest_sibling.lookup_in_sibling());
        if (true) {
            Collections.addAll(tem,Acquaintance_remote.lookups());
        } else {
            try {
                Class<?> remc = Class.forName("test.java.lang.invoke.AccessControlTest_subpkg.Acquaintance_remote");
                Lookup[] remls = (Lookup[]) remc.getMethod("lookups").invoke(null);
                Collections.addAll(tem, remls);
            } catch (ReflectiveOperationException ex) {
                throw new LinkageError("reflection failed", ex);
            }
        }
        tem.add(publicLookup());
        tem.add(publicLookup().in(String.class));
        tem.add(publicLookup().in(List.class));
        return tem.toArray(new Lookup[0]);
    }

    static Lookup lookup_in_self() {
        return MethodHandles.lookup();
    }
    public static      void pub_in_self() { }
    protected static   void pro_in_self() { }
    static /*package*/ void pkg_in_self() { }
    private static     void pri_in_self() { }

    static class Inner_nestmate {
        static Lookup lookup_in_nestmate() {
            return MethodHandles.lookup();
        }
        public static      void pub_in_nestmate() { }
        protected static   void pro_in_nestmate() { }
        static /*package*/ void pkg_in_nestmate() { }
        private static     void pri_in_nestmate() { }
    }
}
class AccessControlTest_sibling {
    static Lookup lookup_in_sibling() {
        return MethodHandles.lookup();
    }
    public static      void pub_in_sibling() { }
    protected static   void pro_in_sibling() { }
    static /*package*/ void pkg_in_sibling() { }
    private static     void pri_in_sibling() { }
}

// This guy tests access from outside the package:
/*
package test.java.lang.invoke.AccessControlTest_subpkg;
public class Acquaintance_remote {
    public static Lookup[] lookups() { ...
    }
    ...
}
*/