e426a3c6f9
Update RH1655466 FIPS patch with changes in OpenJDK 8 version. SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the name in the config file. Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with nss.cfg. No need to substitute path to nss.fips.cfg as java.security file supports a java.home variable. Disable FIPS mode support unless com.redhat.fips is set to "true". Use appropriate keystore types when in FIPS mode (RH1818909) Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to disable). Disable TLSv1.3 when the FIPS crypto policy and the NSS-FIPS provider are in use (RH1860986) Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs (RH1915071)
53 lines
2.7 KiB
Diff
53 lines
2.7 KiB
Diff
diff -r 6efbd7b35a10 src/share/classes/java/security/SystemConfigurator.java
|
|
--- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java Thu Jan 23 18:22:31 2020 -0300
|
|
+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java Mon Mar 02 19:20:17 2020 -0300
|
|
@@ -123,6 +123,33 @@
|
|
}
|
|
props.put(fipsProviderKey, fipsProviderValue);
|
|
}
|
|
+ // Add other security properties
|
|
+ String keystoreTypeValue = (String) props.get("fips.keystore.type");
|
|
+ if (keystoreTypeValue != null) {
|
|
+ String nonFipsKeystoreType = props.getProperty("keystore.type");
|
|
+ props.put("keystore.type", keystoreTypeValue);
|
|
+ if (keystoreTypeValue.equals("PKCS11")) {
|
|
+ // If keystore.type is PKCS11, javax.net.ssl.keyStore
|
|
+ // must be "NONE". See JDK-8238264.
|
|
+ System.setProperty("javax.net.ssl.keyStore", "NONE");
|
|
+ }
|
|
+ if (System.getProperty("javax.net.ssl.trustStoreType") == null) {
|
|
+ // If no trustStoreType has been set, use the
|
|
+ // previous keystore.type under FIPS mode. In
|
|
+ // a default configuration, the Trust Store will
|
|
+ // be 'cacerts' (JKS type).
|
|
+ System.setProperty("javax.net.ssl.trustStoreType",
|
|
+ nonFipsKeystoreType);
|
|
+ }
|
|
+ if (sdebug != null) {
|
|
+ sdebug.println("FIPS mode default keystore.type = " +
|
|
+ keystoreTypeValue);
|
|
+ sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
|
|
+ System.getProperty("javax.net.ssl.keyStore", ""));
|
|
+ sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
|
|
+ System.getProperty("javax.net.ssl.trustStoreType", ""));
|
|
+ }
|
|
+ }
|
|
loadedProps = true;
|
|
}
|
|
} catch (Exception e) {
|
|
diff -r 6efbd7b35a10 src/share/lib/security/java.security-linux
|
|
--- openjdk.orig/src/java.base/share/conf/security/java.security Thu Jan 23 18:22:31 2020 -0300
|
|
+++ openjdk/src/java.base/share/conf/security/java.security Mon Mar 02 19:20:17 2020 -0300
|
|
@@ -299,6 +299,11 @@
|
|
keystore.type=pkcs12
|
|
|
|
#
|
|
+# Default keystore type used when global crypto-policies are set to FIPS.
|
|
+#
|
|
+fips.keystore.type=PKCS11
|
|
+
|
|
+#
|
|
# Controls compatibility mode for JKS and PKCS12 keystore types.
|
|
#
|
|
# When set to 'true', both JKS and PKCS12 keystore types support loading
|