Added fips pathces and adapted specfile
This commit is contained in:
parent
6eadba01e7
commit
680e1acb05
@ -754,8 +754,9 @@ exit 0
|
|||||||
%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/java.security
|
%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/java.security
|
||||||
%config(noreplace) %{etcjavadir -- %{?1}}/conf/logging.properties
|
%config(noreplace) %{etcjavadir -- %{?1}}/conf/logging.properties
|
||||||
%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/nss.cfg
|
%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/nss.cfg
|
||||||
|
%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/nss.fips.cfg
|
||||||
%config(noreplace) %{etcjavadir -- %{?1}}/conf/management/jmxremote.access
|
%config(noreplace) %{etcjavadir -- %{?1}}/conf/management/jmxremote.access
|
||||||
# these are config templates, thus not config-noreplace
|
# this is conifg template, thus not config-noreplace
|
||||||
%config %{etcjavadir -- %{?1}}/conf/management/jmxremote.password.template
|
%config %{etcjavadir -- %{?1}}/conf/management/jmxremote.password.template
|
||||||
%config %{etcjavadir -- %{?1}}/conf/sdp/sdp.conf.template
|
%config %{etcjavadir -- %{?1}}/conf/sdp/sdp.conf.template
|
||||||
%config(noreplace) %{etcjavadir -- %{?1}}/conf/management/management.properties
|
%config(noreplace) %{etcjavadir -- %{?1}}/conf/management/management.properties
|
||||||
@ -976,6 +977,8 @@ OrderWithRequires: copy-jdk-configs
|
|||||||
%endif
|
%endif
|
||||||
# for printing support
|
# for printing support
|
||||||
Requires: cups-libs
|
Requires: cups-libs
|
||||||
|
# for FIPS PKCS11 provider
|
||||||
|
Requires: nss
|
||||||
# Post requires alternatives to install tool alternatives
|
# Post requires alternatives to install tool alternatives
|
||||||
Requires(post): %{alternatives_requires}
|
Requires(post): %{alternatives_requires}
|
||||||
# Postun requires alternatives to uninstall tool alternatives
|
# Postun requires alternatives to uninstall tool alternatives
|
||||||
@ -1143,8 +1146,11 @@ Source13: TestCryptoLevel.java
|
|||||||
# Ensure ECDSA is working
|
# Ensure ECDSA is working
|
||||||
Source14: TestECDSA.java
|
Source14: TestECDSA.java
|
||||||
|
|
||||||
|
# nss fips configuration file
|
||||||
|
Source15: nss.fips.cfg.in
|
||||||
|
|
||||||
# Verify system crypto (policy) can be disabled via a property
|
# Verify system crypto (policy) can be disabled via a property
|
||||||
Source15: TestSecurityProperties.java
|
Source17: TestSecurityProperties.java
|
||||||
|
|
||||||
############################################
|
############################################
|
||||||
#
|
#
|
||||||
@ -1152,21 +1158,31 @@ Source15: TestSecurityProperties.java
|
|||||||
#
|
#
|
||||||
############################################
|
############################################
|
||||||
|
|
||||||
# NSS via SunPKCS11 Provider (disabled comment
|
|
||||||
# due to memory leak).
|
|
||||||
Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
|
|
||||||
# enable build of speculative store bypass hardened alt-java
|
|
||||||
Patch600: rh1750419-redhat_alt_java.patch
|
|
||||||
|
|
||||||
# Ignore AWTError when assistive technologies are loaded
|
# Ignore AWTError when assistive technologies are loaded
|
||||||
Patch1: rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
|
Patch1: rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
|
||||||
# Restrict access to java-atk-wrapper classes
|
# Restrict access to java-atk-wrapper classes
|
||||||
Patch2: rh1648644-java_access_bridge_privileged_security.patch
|
Patch2: rh1648644-java_access_bridge_privileged_security.patch
|
||||||
|
# NSS via SunPKCS11 Provider (disabled due to memory leak).
|
||||||
|
Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
|
||||||
|
# enable build of speculative store bypass hardened alt-java
|
||||||
|
Patch600: rh1750419-redhat_alt_java.patch
|
||||||
Patch3: rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
|
Patch3: rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
|
||||||
# Follow system wide crypto policy RHBZ#1249083
|
# Follow system wide crypto policy RHBZ#1249083
|
||||||
Patch4: pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
|
Patch4: pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
|
||||||
# Depend on pcs-lite-libs instead of pcs-lite-devel as this is only in optional repo
|
# Depend on pcs-lite-libs instead of pcs-lite-devel as this is only in optional repo
|
||||||
Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
|
Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
|
||||||
|
# RH1582504: Use RSA as default for keytool, as DSA is disabled in all crypto policies except LEGACY
|
||||||
|
Patch1003: rh1842572-rsa_default_for_keytool.patch
|
||||||
|
|
||||||
|
# FIPS support patches
|
||||||
|
# RH1655466: Support RHEL FIPS mode using SunPKCS11 provider
|
||||||
|
Patch1001: rh1655466-global_crypto_and_fips.patch
|
||||||
|
# RH1818909: No ciphersuites availale for SSLSocket in FIPS mode
|
||||||
|
Patch1002: rh1818909-fips_default_keystore_type.patch
|
||||||
|
# RH1860986: Disable TLSv1.3 with the NSS-FIPS provider until PKCS#11 v3.0 support is available
|
||||||
|
Patch1004: rh1860986-disable_tlsv1.3_in_fips_mode.patch
|
||||||
|
# RH1915071: Always initialise JavaSecuritySystemConfiguratorAccess
|
||||||
|
Patch1007: rh1915071-always_initialise_configurator_access.patch
|
||||||
|
|
||||||
#############################################
|
#############################################
|
||||||
#
|
#
|
||||||
@ -1527,6 +1543,11 @@ popd # openjdk
|
|||||||
|
|
||||||
%patch1000
|
%patch1000
|
||||||
%patch600
|
%patch600
|
||||||
|
%patch1001
|
||||||
|
%patch1002
|
||||||
|
%patch1003
|
||||||
|
%patch1004
|
||||||
|
%patch1007
|
||||||
|
|
||||||
# Extract systemtap tapsets
|
# Extract systemtap tapsets
|
||||||
%if %{with_systemtap}
|
%if %{with_systemtap}
|
||||||
@ -1575,6 +1596,9 @@ done
|
|||||||
# Setup nss.cfg
|
# Setup nss.cfg
|
||||||
sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} > nss.cfg
|
sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} > nss.cfg
|
||||||
|
|
||||||
|
# Setup nss.fips.cfg
|
||||||
|
sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE15} > nss.fips.cfg
|
||||||
|
sed -i -e "s:@NSS_SECMOD@:/etc/pki/nssdb:g" nss.fips.cfg
|
||||||
|
|
||||||
%build
|
%build
|
||||||
# How many CPU's do we have?
|
# How many CPU's do we have?
|
||||||
@ -1729,6 +1753,9 @@ export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
|
|||||||
# Install nss.cfg right away as we will be using the JRE above
|
# Install nss.cfg right away as we will be using the JRE above
|
||||||
install -m 644 nss.cfg $JAVA_HOME/conf/security/
|
install -m 644 nss.cfg $JAVA_HOME/conf/security/
|
||||||
|
|
||||||
|
# Install nss.fips.cfg: NSS configuration for global FIPS mode (crypto-policies)
|
||||||
|
install -m 644 nss.fips.cfg $JAVA_HOME/conf/security/
|
||||||
|
|
||||||
# Use system-wide tzdata
|
# Use system-wide tzdata
|
||||||
rm $JAVA_HOME/lib/tzdb.dat
|
rm $JAVA_HOME/lib/tzdb.dat
|
||||||
ln -s %{_datadir}/javazi-1.8/tzdb.dat $JAVA_HOME/lib/tzdb.dat
|
ln -s %{_datadir}/javazi-1.8/tzdb.dat $JAVA_HOME/lib/tzdb.dat
|
||||||
@ -1769,8 +1796,8 @@ $JAVA_HOME/bin/javac -d . %{SOURCE14}
|
|||||||
$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||")
|
$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||")
|
||||||
|
|
||||||
# Check system crypto (policy) can be disabled
|
# Check system crypto (policy) can be disabled
|
||||||
$JAVA_HOME/bin/javac -d . %{SOURCE15}
|
$JAVA_HOME/bin/javac -d . %{SOURCE17}
|
||||||
$JAVA_HOME/bin/java -Djava.security.disableSystemPropertiesFile=true $(echo $(basename %{SOURCE15})|sed "s|\.java||") || echo "crypto policy are now not honored i jdk15"
|
$JAVA_HOME/bin/java -Djava.security.disableSystemPropertiesFile=true $(echo $(basename %{SOURCE17})|sed "s|\.java||") || echo "crypto policy are now not honored i jdk15"
|
||||||
|
|
||||||
# Check java launcher has no SSB mitigation
|
# Check java launcher has no SSB mitigation
|
||||||
if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
|
if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
|
||||||
@ -2230,16 +2257,19 @@ cjc.mainProgram(args)
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Tue Jun 29 2021 Jiri Vanek <jvanek@redhat.com> -1:16.0.1.0.9-5.rolling
|
||||||
|
- renamed source15 to source17 to match el8
|
||||||
|
- added fips support
|
||||||
|
|
||||||
* Thu Jun 17 2021 Petra Alice Mikova <pmikova@redhat.com> - 1:16.0.1.0.9-4.rolling
|
* Thu Jun 17 2021 Petra Alice Mikova <pmikova@redhat.com> - 1:16.0.1.0.9-4.rolling
|
||||||
- fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch which made the SunPKCS provider show up again
|
- fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch which made the SunPKCS provider show up again
|
||||||
- Resolves: rhbz#1971120
|
- Resolves: rhbz#1971120
|
||||||
|
|
||||||
* Fri May 07 2021 Jiri Vanek <jvanek@redhat.com> - 1:16.0.1.0.9-2.rolling
|
* Fri May 07 2021 Jiri Vanek <jvanek@redhat.com> - 1:16.0.1.0.9-3.rolling
|
||||||
- removed cjc backward comaptiblity, to fix when both rpm 4.16 and 4.17 are in transaction
|
- removed cjc backward comaptiblity, to fix when both rpm 4.16 and 4.17 are in transaction
|
||||||
|
|
||||||
* Thu Apr 29 2021 Jiri Vanek <jvanek@redhat.com> - 1:16.0.1.0.9-2.rolling
|
* Thu Apr 29 2021 Jiri Vanek <jvanek@redhat.com> - 1:16.0.1.0.9-2.rolling
|
||||||
- adapted to debug handling in newer cjc
|
- adapted to newst cjc to fix issue with rpm 4.17
|
||||||
- The rest of the "rpm 4.17" patch must NOT be backported, as on rpm 4.16 and down, it would casue double execution
|
|
||||||
- Disable copy-jdk-configs for Flatpak builds
|
- Disable copy-jdk-configs for Flatpak builds
|
||||||
|
|
||||||
* Sun Apr 25 2021 Petra Alice Mikova <pmikova@redhat.com> - 1:16.0.1.0.9-1.rolling
|
* Sun Apr 25 2021 Petra Alice Mikova <pmikova@redhat.com> - 1:16.0.1.0.9-1.rolling
|
||||||
|
6
nss.fips.cfg.in
Normal file
6
nss.fips.cfg.in
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
name = NSS-FIPS
|
||||||
|
nssLibraryDirectory = @NSS_LIBDIR@
|
||||||
|
nssSecmodDirectory = @NSS_SECMOD@
|
||||||
|
nssDbMode = readOnly
|
||||||
|
nssModule = fips
|
||||||
|
|
205
rh1655466-global_crypto_and_fips.patch
Normal file
205
rh1655466-global_crypto_and_fips.patch
Normal file
@ -0,0 +1,205 @@
|
|||||||
|
diff --git a/src/java.base/share/classes/javopenjdk.orig///security/Security.java openjdk///src/java.base/share/classes/java/security/Security.java
|
||||||
|
--- openjdk.orig/src/java.base/share/classes/java/security/Security.java
|
||||||
|
+++ openjdk/src/java.base/share/classes/java/security/Security.java
|
||||||
|
@@ -196,26 +196,8 @@
|
||||||
|
if (disableSystemProps == null &&
|
||||||
|
"true".equalsIgnoreCase(props.getProperty
|
||||||
|
("security.useSystemPropertiesFile"))) {
|
||||||
|
-
|
||||||
|
- // now load the system file, if it exists, so its values
|
||||||
|
- // will win if they conflict with the earlier values
|
||||||
|
- try (BufferedInputStream bis =
|
||||||
|
- new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
|
||||||
|
- props.load(bis);
|
||||||
|
+ if (SystemConfigurator.configure(props)) {
|
||||||
|
loadedProps = true;
|
||||||
|
-
|
||||||
|
- if (sdebug != null) {
|
||||||
|
- sdebug.println("reading system security properties file " +
|
||||||
|
- SYSTEM_PROPERTIES);
|
||||||
|
- sdebug.println(props.toString());
|
||||||
|
- }
|
||||||
|
- } catch (IOException e) {
|
||||||
|
- if (sdebug != null) {
|
||||||
|
- sdebug.println
|
||||||
|
- ("unable to load security properties from " +
|
||||||
|
- SYSTEM_PROPERTIES);
|
||||||
|
- e.printStackTrace();
|
||||||
|
- }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
diff --git a/src/java.base/share/classes/javopenjdk.orig///security/SystemConfigurator.java openjdk///src/java.base/share/classes/java/security/SystemConfigurator.java
|
||||||
|
new file mode 100644
|
||||||
|
--- /dev/null
|
||||||
|
+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
|
||||||
|
@@ -0,0 +1,151 @@
|
||||||
|
+/*
|
||||||
|
+ * Copyright (c) 2019, Red Hat, Inc.
|
||||||
|
+ *
|
||||||
|
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||||
|
+ *
|
||||||
|
+ * This code is free software; you can redistribute it and/or modify it
|
||||||
|
+ * under the terms of the GNU General Public License version 2 only, as
|
||||||
|
+ * published by the Free Software Foundation.
|
||||||
|
+ *
|
||||||
|
+ * This code is distributed in the hope that it will be useful, but WITHOUT
|
||||||
|
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||||
|
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||||
|
+ * version 2 for more details (a copy is included in the LICENSE file that
|
||||||
|
+ * accompanied this code).
|
||||||
|
+ *
|
||||||
|
+ * You should have received a copy of the GNU General Public License version
|
||||||
|
+ * 2 along with this work; if not, write to the Free Software Foundation,
|
||||||
|
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||||
|
+ *
|
||||||
|
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||||
|
+ * or visit www.oracle.com if you need additional information or have any
|
||||||
|
+ * questions.
|
||||||
|
+ */
|
||||||
|
+
|
||||||
|
+package java.security;
|
||||||
|
+
|
||||||
|
+import java.io.BufferedInputStream;
|
||||||
|
+import java.io.FileInputStream;
|
||||||
|
+import java.io.IOException;
|
||||||
|
+
|
||||||
|
+import java.nio.file.Files;
|
||||||
|
+import java.nio.file.Path;
|
||||||
|
+
|
||||||
|
+import java.util.Iterator;
|
||||||
|
+import java.util.Map.Entry;
|
||||||
|
+import java.util.Properties;
|
||||||
|
+import java.util.function.Consumer;
|
||||||
|
+import java.util.regex.Matcher;
|
||||||
|
+import java.util.regex.Pattern;
|
||||||
|
+
|
||||||
|
+import sun.security.util.Debug;
|
||||||
|
+
|
||||||
|
+/**
|
||||||
|
+ * Internal class to align OpenJDK with global crypto-policies.
|
||||||
|
+ * Called from java.security.Security class initialization,
|
||||||
|
+ * during startup.
|
||||||
|
+ *
|
||||||
|
+ */
|
||||||
|
+
|
||||||
|
+class SystemConfigurator {
|
||||||
|
+
|
||||||
|
+ private static final Debug sdebug =
|
||||||
|
+ Debug.getInstance("properties");
|
||||||
|
+
|
||||||
|
+ private static final String CRYPTO_POLICIES_BASE_DIR =
|
||||||
|
+ "/etc/crypto-policies";
|
||||||
|
+
|
||||||
|
+ private static final String CRYPTO_POLICIES_JAVA_CONFIG =
|
||||||
|
+ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config";
|
||||||
|
+
|
||||||
|
+ private static final String CRYPTO_POLICIES_CONFIG =
|
||||||
|
+ CRYPTO_POLICIES_BASE_DIR + "/config";
|
||||||
|
+
|
||||||
|
+ private static final class SecurityProviderInfo {
|
||||||
|
+ int number;
|
||||||
|
+ String key;
|
||||||
|
+ String value;
|
||||||
|
+ SecurityProviderInfo(int number, String key, String value) {
|
||||||
|
+ this.number = number;
|
||||||
|
+ this.key = key;
|
||||||
|
+ this.value = value;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
+ * Invoked when java.security.Security class is initialized, if
|
||||||
|
+ * java.security.disableSystemPropertiesFile property is not set and
|
||||||
|
+ * security.useSystemPropertiesFile is true.
|
||||||
|
+ */
|
||||||
|
+ static boolean configure(Properties props) {
|
||||||
|
+ boolean loadedProps = false;
|
||||||
|
+
|
||||||
|
+ try (BufferedInputStream bis =
|
||||||
|
+ new BufferedInputStream(
|
||||||
|
+ new FileInputStream(CRYPTO_POLICIES_JAVA_CONFIG))) {
|
||||||
|
+ props.load(bis);
|
||||||
|
+ loadedProps = true;
|
||||||
|
+ if (sdebug != null) {
|
||||||
|
+ sdebug.println("reading system security properties file " +
|
||||||
|
+ CRYPTO_POLICIES_JAVA_CONFIG);
|
||||||
|
+ sdebug.println(props.toString());
|
||||||
|
+ }
|
||||||
|
+ } catch (IOException e) {
|
||||||
|
+ if (sdebug != null) {
|
||||||
|
+ sdebug.println("unable to load security properties from " +
|
||||||
|
+ CRYPTO_POLICIES_JAVA_CONFIG);
|
||||||
|
+ e.printStackTrace();
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ try {
|
||||||
|
+ if (enableFips()) {
|
||||||
|
+ if (sdebug != null) { sdebug.println("FIPS mode detected"); }
|
||||||
|
+ loadedProps = false;
|
||||||
|
+ // Remove all security providers
|
||||||
|
+ Iterator<Entry<Object, Object>> i = props.entrySet().iterator();
|
||||||
|
+ while (i.hasNext()) {
|
||||||
|
+ Entry<Object, Object> e = i.next();
|
||||||
|
+ if (((String) e.getKey()).startsWith("security.provider")) {
|
||||||
|
+ if (sdebug != null) { sdebug.println("Removing provider: " + e); }
|
||||||
|
+ i.remove();
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ // Add FIPS security providers
|
||||||
|
+ String fipsProviderValue = null;
|
||||||
|
+ for (int n = 1;
|
||||||
|
+ (fipsProviderValue = (String) props.get("fips.provider." + n)) != null; n++) {
|
||||||
|
+ String fipsProviderKey = "security.provider." + n;
|
||||||
|
+ if (sdebug != null) {
|
||||||
|
+ sdebug.println("Adding provider " + n + ": " +
|
||||||
|
+ fipsProviderKey + "=" + fipsProviderValue);
|
||||||
|
+ }
|
||||||
|
+ props.put(fipsProviderKey, fipsProviderValue);
|
||||||
|
+ }
|
||||||
|
+ loadedProps = true;
|
||||||
|
+ }
|
||||||
|
+ } catch (Exception e) {
|
||||||
|
+ if (sdebug != null) {
|
||||||
|
+ sdebug.println("unable to load FIPS configuration");
|
||||||
|
+ e.printStackTrace();
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ return loadedProps;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ /*
|
||||||
|
+ * FIPS is enabled only if crypto-policies are set to "FIPS"
|
||||||
|
+ * and the com.redhat.fips property is true.
|
||||||
|
+ */
|
||||||
|
+ private static boolean enableFips() throws Exception {
|
||||||
|
+ boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
|
||||||
|
+ if (fipsEnabled) {
|
||||||
|
+ String cryptoPoliciesConfig = new String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG)));
|
||||||
|
+ if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); }
|
||||||
|
+ Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
|
||||||
|
+ return pattern.matcher(cryptoPoliciesConfig).find();
|
||||||
|
+ } else {
|
||||||
|
+ return false;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+}
|
||||||
|
diff --git openjdk.orig///src/java.base/share/conf/security/java.security openjdk///src/java.base/share/conf/security/java.security
|
||||||
|
--- openjdk.orig/src/java.base/share/conf/security/java.security
|
||||||
|
+++ openjdk/src/java.base/share/conf/security/java.security
|
||||||
|
@@ -87,6 +87,14 @@
|
||||||
|
#security.provider.tbd=SunPKCS11 ${java.home}/lib/security/nss.cfg
|
||||||
|
|
||||||
|
#
|
||||||
|
+# Security providers used when global crypto-policies are set to FIPS.
|
||||||
|
+#
|
||||||
|
+fips.provider.1=SunPKCS11 ${java.home}/conf/security/nss.fips.cfg
|
||||||
|
+fips.provider.2=SUN
|
||||||
|
+fips.provider.3=SunEC
|
||||||
|
+fips.provider.4=com.sun.net.ssl.internal.ssl.Provider SunPKCS11-NSS-FIPS
|
||||||
|
+
|
||||||
|
+#
|
||||||
|
# A list of preferred providers for specific algorithms. These providers will
|
||||||
|
# be searched for matching algorithms before the list of registered providers.
|
||||||
|
# Entries containing errors (parsing, etc) will be ignored. Use the
|
52
rh1818909-fips_default_keystore_type.patch
Normal file
52
rh1818909-fips_default_keystore_type.patch
Normal file
@ -0,0 +1,52 @@
|
|||||||
|
diff -r 6efbd7b35a10 src/share/classes/java/security/SystemConfigurator.java
|
||||||
|
--- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java Thu Jan 23 18:22:31 2020 -0300
|
||||||
|
+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java Mon Mar 02 19:20:17 2020 -0300
|
||||||
|
@@ -123,6 +123,33 @@
|
||||||
|
}
|
||||||
|
props.put(fipsProviderKey, fipsProviderValue);
|
||||||
|
}
|
||||||
|
+ // Add other security properties
|
||||||
|
+ String keystoreTypeValue = (String) props.get("fips.keystore.type");
|
||||||
|
+ if (keystoreTypeValue != null) {
|
||||||
|
+ String nonFipsKeystoreType = props.getProperty("keystore.type");
|
||||||
|
+ props.put("keystore.type", keystoreTypeValue);
|
||||||
|
+ if (keystoreTypeValue.equals("PKCS11")) {
|
||||||
|
+ // If keystore.type is PKCS11, javax.net.ssl.keyStore
|
||||||
|
+ // must be "NONE". See JDK-8238264.
|
||||||
|
+ System.setProperty("javax.net.ssl.keyStore", "NONE");
|
||||||
|
+ }
|
||||||
|
+ if (System.getProperty("javax.net.ssl.trustStoreType") == null) {
|
||||||
|
+ // If no trustStoreType has been set, use the
|
||||||
|
+ // previous keystore.type under FIPS mode. In
|
||||||
|
+ // a default configuration, the Trust Store will
|
||||||
|
+ // be 'cacerts' (JKS type).
|
||||||
|
+ System.setProperty("javax.net.ssl.trustStoreType",
|
||||||
|
+ nonFipsKeystoreType);
|
||||||
|
+ }
|
||||||
|
+ if (sdebug != null) {
|
||||||
|
+ sdebug.println("FIPS mode default keystore.type = " +
|
||||||
|
+ keystoreTypeValue);
|
||||||
|
+ sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
|
||||||
|
+ System.getProperty("javax.net.ssl.keyStore", ""));
|
||||||
|
+ sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
|
||||||
|
+ System.getProperty("javax.net.ssl.trustStoreType", ""));
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
loadedProps = true;
|
||||||
|
}
|
||||||
|
} catch (Exception e) {
|
||||||
|
diff -r 6efbd7b35a10 src/share/lib/security/java.security-linux
|
||||||
|
--- openjdk.orig/src/java.base/share/conf/security/java.security Thu Jan 23 18:22:31 2020 -0300
|
||||||
|
+++ openjdk/src/java.base/share/conf/security/java.security Mon Mar 02 19:20:17 2020 -0300
|
||||||
|
@@ -299,6 +299,11 @@
|
||||||
|
keystore.type=pkcs12
|
||||||
|
|
||||||
|
#
|
||||||
|
+# Default keystore type used when global crypto-policies are set to FIPS.
|
||||||
|
+#
|
||||||
|
+fips.keystore.type=PKCS11
|
||||||
|
+
|
||||||
|
+#
|
||||||
|
# Controls compatibility mode for JKS and PKCS12 keystore types.
|
||||||
|
#
|
||||||
|
# When set to 'true', both JKS and PKCS12 keystore types support loading
|
12
rh1842572-rsa_default_for_keytool.patch
Normal file
12
rh1842572-rsa_default_for_keytool.patch
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
diff --git openjdk.orig/src/java.base/share/classes/sun/security/tools/keytool/Main.java openjdk/src/java.base/share/classes/sun/security/tools/keytool/Main.java
|
||||||
|
--- openjdk.orig/src/java.base/share/classes/sun/security/tools/keytool/Main.java
|
||||||
|
+++ openjdk/src/java.base/share/classes/sun/security/tools/keytool/Main.java
|
||||||
|
@@ -1135,7 +1135,7 @@
|
||||||
|
}
|
||||||
|
} else if (command == GENKEYPAIR) {
|
||||||
|
if (keyAlgName == null) {
|
||||||
|
- keyAlgName = "DSA";
|
||||||
|
+ keyAlgName = "RSA";
|
||||||
|
}
|
||||||
|
doGenKeyPair(alias, dname, keyAlgName, keysize, groupName, sigAlgName);
|
||||||
|
kssave = true;
|
311
rh1860986-disable_tlsv1.3_in_fips_mode.patch
Normal file
311
rh1860986-disable_tlsv1.3_in_fips_mode.patch
Normal file
@ -0,0 +1,311 @@
|
|||||||
|
diff -r bbc65dfa59d1 src/java.base/share/classes/java/security/SystemConfigurator.java
|
||||||
|
--- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java Thu Jan 23 18:22:31 2020 -0300
|
||||||
|
+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java Sat Aug 01 23:16:51 2020 -0300
|
||||||
|
@@ -1,11 +1,13 @@
|
||||||
|
/*
|
||||||
|
- * Copyright (c) 2019, Red Hat, Inc.
|
||||||
|
+ * Copyright (c) 2019, 2020, Red Hat, Inc.
|
||||||
|
*
|
||||||
|
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||||
|
*
|
||||||
|
* This code is free software; you can redistribute it and/or modify it
|
||||||
|
* under the terms of the GNU General Public License version 2 only, as
|
||||||
|
- * published by the Free Software Foundation.
|
||||||
|
+ * published by the Free Software Foundation. Oracle designates this
|
||||||
|
+ * particular file as subject to the "Classpath" exception as provided
|
||||||
|
+ * by Oracle in the LICENSE file that accompanied this code.
|
||||||
|
*
|
||||||
|
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||||
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||||
|
@@ -34,10 +36,10 @@
|
||||||
|
import java.util.Iterator;
|
||||||
|
import java.util.Map.Entry;
|
||||||
|
import java.util.Properties;
|
||||||
|
-import java.util.function.Consumer;
|
||||||
|
-import java.util.regex.Matcher;
|
||||||
|
import java.util.regex.Pattern;
|
||||||
|
|
||||||
|
+import jdk.internal.misc.SharedSecrets;
|
||||||
|
+import jdk.internal.misc.JavaSecuritySystemConfiguratorAccess;
|
||||||
|
import sun.security.util.Debug;
|
||||||
|
|
||||||
|
/**
|
||||||
|
@@ -47,7 +49,7 @@
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
|
||||||
|
-class SystemConfigurator {
|
||||||
|
+final class SystemConfigurator {
|
||||||
|
|
||||||
|
private static final Debug sdebug =
|
||||||
|
Debug.getInstance("properties");
|
||||||
|
@@ -61,15 +63,16 @@
|
||||||
|
private static final String CRYPTO_POLICIES_CONFIG =
|
||||||
|
CRYPTO_POLICIES_BASE_DIR + "/config";
|
||||||
|
|
||||||
|
- private static final class SecurityProviderInfo {
|
||||||
|
- int number;
|
||||||
|
- String key;
|
||||||
|
- String value;
|
||||||
|
- SecurityProviderInfo(int number, String key, String value) {
|
||||||
|
- this.number = number;
|
||||||
|
- this.key = key;
|
||||||
|
- this.value = value;
|
||||||
|
- }
|
||||||
|
+ private static boolean systemFipsEnabled = false;
|
||||||
|
+
|
||||||
|
+ static {
|
||||||
|
+ SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
|
||||||
|
+ new JavaSecuritySystemConfiguratorAccess() {
|
||||||
|
+ @Override
|
||||||
|
+ public boolean isSystemFipsEnabled() {
|
||||||
|
+ return SystemConfigurator.isSystemFipsEnabled();
|
||||||
|
+ }
|
||||||
|
+ });
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
@@ -128,9 +131,9 @@
|
||||||
|
String nonFipsKeystoreType = props.getProperty("keystore.type");
|
||||||
|
props.put("keystore.type", keystoreTypeValue);
|
||||||
|
if (keystoreTypeValue.equals("PKCS11")) {
|
||||||
|
- // If keystore.type is PKCS11, javax.net.ssl.keyStore
|
||||||
|
- // must be "NONE". See JDK-8238264.
|
||||||
|
- System.setProperty("javax.net.ssl.keyStore", "NONE");
|
||||||
|
+ // If keystore.type is PKCS11, javax.net.ssl.keyStore
|
||||||
|
+ // must be "NONE". See JDK-8238264.
|
||||||
|
+ System.setProperty("javax.net.ssl.keyStore", "NONE");
|
||||||
|
}
|
||||||
|
if (System.getProperty("javax.net.ssl.trustStoreType") == null) {
|
||||||
|
// If no trustStoreType has been set, use the
|
||||||
|
@@ -144,12 +147,13 @@
|
||||||
|
sdebug.println("FIPS mode default keystore.type = " +
|
||||||
|
keystoreTypeValue);
|
||||||
|
sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
|
||||||
|
- System.getProperty("javax.net.ssl.keyStore", ""));
|
||||||
|
+ System.getProperty("javax.net.ssl.keyStore", ""));
|
||||||
|
sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
|
||||||
|
System.getProperty("javax.net.ssl.trustStoreType", ""));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
loadedProps = true;
|
||||||
|
+ systemFipsEnabled = true;
|
||||||
|
}
|
||||||
|
} catch (Exception e) {
|
||||||
|
if (sdebug != null) {
|
||||||
|
@@ -160,13 +164,30 @@
|
||||||
|
return loadedProps;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ /**
|
||||||
|
+ * Returns whether or not global system FIPS alignment is enabled.
|
||||||
|
+ *
|
||||||
|
+ * Value is always 'false' before java.security.Security class is
|
||||||
|
+ * initialized.
|
||||||
|
+ *
|
||||||
|
+ * Call from out of this package through SharedSecrets:
|
||||||
|
+ * SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
|
||||||
|
+ * .isSystemFipsEnabled();
|
||||||
|
+ *
|
||||||
|
+ * @return a boolean value indicating whether or not global
|
||||||
|
+ * system FIPS alignment is enabled.
|
||||||
|
+ */
|
||||||
|
+ static boolean isSystemFipsEnabled() {
|
||||||
|
+ return systemFipsEnabled;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* FIPS is enabled only if crypto-policies are set to "FIPS"
|
||||||
|
* and the com.redhat.fips property is true.
|
||||||
|
*/
|
||||||
|
private static boolean enableFips() throws Exception {
|
||||||
|
- boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
|
||||||
|
- if (fipsEnabled) {
|
||||||
|
+ boolean shouldEnable = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
|
||||||
|
+ if (shouldEnable) {
|
||||||
|
String cryptoPoliciesConfig = new String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG)));
|
||||||
|
if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); }
|
||||||
|
Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
|
||||||
|
diff -r bbc65dfa59d1 src/java.base/share/classes/jdk/internal/misc/JavaSecuritySystemConfiguratorAccess.java
|
||||||
|
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
|
||||||
|
+++ openjdk/src/java.base/share/classes/jdk/internal/misc/JavaSecuritySystemConfiguratorAccess.java Sat Aug 01 23:16:51 2020 -0300
|
||||||
|
@@ -0,0 +1,30 @@
|
||||||
|
+/*
|
||||||
|
+ * Copyright (c) 2020, Red Hat, Inc.
|
||||||
|
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||||
|
+ *
|
||||||
|
+ * This code is free software; you can redistribute it and/or modify it
|
||||||
|
+ * under the terms of the GNU General Public License version 2 only, as
|
||||||
|
+ * published by the Free Software Foundation. Oracle designates this
|
||||||
|
+ * particular file as subject to the "Classpath" exception as provided
|
||||||
|
+ * by Oracle in the LICENSE file that accompanied this code.
|
||||||
|
+ *
|
||||||
|
+ * This code is distributed in the hope that it will be useful, but WITHOUT
|
||||||
|
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||||
|
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||||
|
+ * version 2 for more details (a copy is included in the LICENSE file that
|
||||||
|
+ * accompanied this code).
|
||||||
|
+ *
|
||||||
|
+ * You should have received a copy of the GNU General Public License version
|
||||||
|
+ * 2 along with this work; if not, write to the Free Software Foundation,
|
||||||
|
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||||
|
+ *
|
||||||
|
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||||
|
+ * or visit www.oracle.com if you need additional information or have any
|
||||||
|
+ * questions.
|
||||||
|
+ */
|
||||||
|
+
|
||||||
|
+package jdk.internal.misc;
|
||||||
|
+
|
||||||
|
+public interface JavaSecuritySystemConfiguratorAccess {
|
||||||
|
+ boolean isSystemFipsEnabled();
|
||||||
|
+}
|
||||||
|
diff -r bbc65dfa59d1 src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java
|
||||||
|
--- openjdk/src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java Thu Jan 23 18:22:31 2020 -0300
|
||||||
|
+++ openjdk/src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java Sat Aug 01 23:16:51 2020 -0300
|
||||||
|
@@ -76,6 +76,7 @@
|
||||||
|
private static JavaIORandomAccessFileAccess javaIORandomAccessFileAccess;
|
||||||
|
private static JavaSecuritySignatureAccess javaSecuritySignatureAccess;
|
||||||
|
private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess;
|
||||||
|
+ private static JavaSecuritySystemConfiguratorAccess javaSecuritySystemConfiguratorAccess;
|
||||||
|
|
||||||
|
public static JavaUtilJarAccess javaUtilJarAccess() {
|
||||||
|
if (javaUtilJarAccess == null) {
|
||||||
|
@@ -361,4 +362,12 @@
|
||||||
|
}
|
||||||
|
return javaxCryptoSealedObjectAccess;
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+ public static void setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) {
|
||||||
|
+ javaSecuritySystemConfiguratorAccess = jssca;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() {
|
||||||
|
+ return javaSecuritySystemConfiguratorAccess;
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
diff -r bbc65dfa59d1 src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java
|
||||||
|
--- openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java Thu Jan 23 18:22:31 2020 -0300
|
||||||
|
+++ openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java Sat Aug 01 23:16:51 2020 -0300
|
||||||
|
@@ -31,6 +31,7 @@
|
||||||
|
import java.security.cert.*;
|
||||||
|
import java.util.*;
|
||||||
|
import javax.net.ssl.*;
|
||||||
|
+import jdk.internal.misc.SharedSecrets;
|
||||||
|
import sun.security.action.GetPropertyAction;
|
||||||
|
import sun.security.provider.certpath.AlgorithmChecker;
|
||||||
|
import sun.security.validator.Validator;
|
||||||
|
@@ -542,20 +543,38 @@
|
||||||
|
|
||||||
|
static {
|
||||||
|
if (SunJSSE.isFIPS()) {
|
||||||
|
- supportedProtocols = Arrays.asList(
|
||||||
|
- ProtocolVersion.TLS13,
|
||||||
|
- ProtocolVersion.TLS12,
|
||||||
|
- ProtocolVersion.TLS11,
|
||||||
|
- ProtocolVersion.TLS10
|
||||||
|
- );
|
||||||
|
+ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
|
||||||
|
+ .isSystemFipsEnabled()) {
|
||||||
|
+ // RH1860986: TLSv1.3 key derivation not supported with
|
||||||
|
+ // the Security Providers available in system FIPS mode.
|
||||||
|
+ supportedProtocols = Arrays.asList(
|
||||||
|
+ ProtocolVersion.TLS12,
|
||||||
|
+ ProtocolVersion.TLS11,
|
||||||
|
+ ProtocolVersion.TLS10
|
||||||
|
+ );
|
||||||
|
|
||||||
|
- serverDefaultProtocols = getAvailableProtocols(
|
||||||
|
- new ProtocolVersion[] {
|
||||||
|
- ProtocolVersion.TLS13,
|
||||||
|
- ProtocolVersion.TLS12,
|
||||||
|
- ProtocolVersion.TLS11,
|
||||||
|
- ProtocolVersion.TLS10
|
||||||
|
- });
|
||||||
|
+ serverDefaultProtocols = getAvailableProtocols(
|
||||||
|
+ new ProtocolVersion[] {
|
||||||
|
+ ProtocolVersion.TLS12,
|
||||||
|
+ ProtocolVersion.TLS11,
|
||||||
|
+ ProtocolVersion.TLS10
|
||||||
|
+ });
|
||||||
|
+ } else {
|
||||||
|
+ supportedProtocols = Arrays.asList(
|
||||||
|
+ ProtocolVersion.TLS13,
|
||||||
|
+ ProtocolVersion.TLS12,
|
||||||
|
+ ProtocolVersion.TLS11,
|
||||||
|
+ ProtocolVersion.TLS10
|
||||||
|
+ );
|
||||||
|
+
|
||||||
|
+ serverDefaultProtocols = getAvailableProtocols(
|
||||||
|
+ new ProtocolVersion[] {
|
||||||
|
+ ProtocolVersion.TLS13,
|
||||||
|
+ ProtocolVersion.TLS12,
|
||||||
|
+ ProtocolVersion.TLS11,
|
||||||
|
+ ProtocolVersion.TLS10
|
||||||
|
+ });
|
||||||
|
+ }
|
||||||
|
} else {
|
||||||
|
supportedProtocols = Arrays.asList(
|
||||||
|
ProtocolVersion.TLS13,
|
||||||
|
@@ -620,6 +639,16 @@
|
||||||
|
|
||||||
|
static ProtocolVersion[] getSupportedProtocols() {
|
||||||
|
if (SunJSSE.isFIPS()) {
|
||||||
|
+ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
|
||||||
|
+ .isSystemFipsEnabled()) {
|
||||||
|
+ // RH1860986: TLSv1.3 key derivation not supported with
|
||||||
|
+ // the Security Providers available in system FIPS mode.
|
||||||
|
+ return new ProtocolVersion[] {
|
||||||
|
+ ProtocolVersion.TLS12,
|
||||||
|
+ ProtocolVersion.TLS11,
|
||||||
|
+ ProtocolVersion.TLS10
|
||||||
|
+ };
|
||||||
|
+ }
|
||||||
|
return new ProtocolVersion[] {
|
||||||
|
ProtocolVersion.TLS13,
|
||||||
|
ProtocolVersion.TLS12,
|
||||||
|
@@ -949,6 +978,16 @@
|
||||||
|
|
||||||
|
static ProtocolVersion[] getProtocols() {
|
||||||
|
if (SunJSSE.isFIPS()) {
|
||||||
|
+ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
|
||||||
|
+ .isSystemFipsEnabled()) {
|
||||||
|
+ // RH1860986: TLSv1.3 key derivation not supported with
|
||||||
|
+ // the Security Providers available in system FIPS mode.
|
||||||
|
+ return new ProtocolVersion[] {
|
||||||
|
+ ProtocolVersion.TLS12,
|
||||||
|
+ ProtocolVersion.TLS11,
|
||||||
|
+ ProtocolVersion.TLS10
|
||||||
|
+ };
|
||||||
|
+ }
|
||||||
|
return new ProtocolVersion[]{
|
||||||
|
ProtocolVersion.TLS13,
|
||||||
|
ProtocolVersion.TLS12,
|
||||||
|
diff -r bbc65dfa59d1 src/java.base/share/classes/sun/security/ssl/SunJSSE.java
|
||||||
|
--- openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java Thu Jan 23 18:22:31 2020 -0300
|
||||||
|
+++ openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java Sat Aug 01 23:16:51 2020 -0300
|
||||||
|
@@ -27,6 +27,8 @@
|
||||||
|
|
||||||
|
import java.security.*;
|
||||||
|
import java.util.*;
|
||||||
|
+
|
||||||
|
+import jdk.internal.misc.SharedSecrets;
|
||||||
|
import sun.security.rsa.SunRsaSignEntries;
|
||||||
|
import static sun.security.util.SecurityConstants.PROVIDER_VER;
|
||||||
|
import static sun.security.provider.SunEntries.createAliases;
|
||||||
|
@@ -195,8 +197,13 @@
|
||||||
|
"sun.security.ssl.SSLContextImpl$TLS11Context", null, null);
|
||||||
|
ps("SSLContext", "TLSv1.2",
|
||||||
|
"sun.security.ssl.SSLContextImpl$TLS12Context", null, null);
|
||||||
|
- ps("SSLContext", "TLSv1.3",
|
||||||
|
- "sun.security.ssl.SSLContextImpl$TLS13Context", null, null);
|
||||||
|
+ if (!SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
|
||||||
|
+ .isSystemFipsEnabled()) {
|
||||||
|
+ // RH1860986: TLSv1.3 key derivation not supported with
|
||||||
|
+ // the Security Providers available in system FIPS mode.
|
||||||
|
+ ps("SSLContext", "TLSv1.3",
|
||||||
|
+ "sun.security.ssl.SSLContextImpl$TLS13Context", null, null);
|
||||||
|
+ }
|
||||||
|
ps("SSLContext", "TLS",
|
||||||
|
"sun.security.ssl.SSLContextImpl$TLSContext",
|
||||||
|
(isfips? null : createAliases("SSL")), null);
|
68
rh1915071-always_initialise_configurator_access.patch
Normal file
68
rh1915071-always_initialise_configurator_access.patch
Normal file
@ -0,0 +1,68 @@
|
|||||||
|
diff --git openjdk.orig/src/java.base/share/classes/java/security/Security.java openjdk/src/java.base/share/classes/java/security/Security.java
|
||||||
|
--- openjdk.orig/src/java.base/share/classes/java/security/Security.java
|
||||||
|
+++ openjdk/src/java.base/share/classes/java/security/Security.java
|
||||||
|
@@ -32,6 +32,7 @@
|
||||||
|
|
||||||
|
import jdk.internal.event.EventHelper;
|
||||||
|
import jdk.internal.event.SecurityPropertyModificationEvent;
|
||||||
|
+import jdk.internal.misc.JavaSecuritySystemConfiguratorAccess;
|
||||||
|
import jdk.internal.misc.SharedSecrets;
|
||||||
|
import jdk.internal.util.StaticProperty;
|
||||||
|
import sun.security.util.Debug;
|
||||||
|
@@ -74,6 +75,15 @@
|
||||||
|
}
|
||||||
|
|
||||||
|
static {
|
||||||
|
+ // Initialise here as used by code with system properties disabled
|
||||||
|
+ SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
|
||||||
|
+ new JavaSecuritySystemConfiguratorAccess() {
|
||||||
|
+ @Override
|
||||||
|
+ public boolean isSystemFipsEnabled() {
|
||||||
|
+ return SystemConfigurator.isSystemFipsEnabled();
|
||||||
|
+ }
|
||||||
|
+ });
|
||||||
|
+
|
||||||
|
// doPrivileged here because there are multiple
|
||||||
|
// things in initialize that might require privs.
|
||||||
|
// (the FileInputStream call and the File.exists call,
|
||||||
|
@@ -193,9 +203,8 @@
|
||||||
|
}
|
||||||
|
|
||||||
|
String disableSystemProps = System.getProperty("java.security.disableSystemPropertiesFile");
|
||||||
|
- if (disableSystemProps == null &&
|
||||||
|
- "true".equalsIgnoreCase(props.getProperty
|
||||||
|
- ("security.useSystemPropertiesFile"))) {
|
||||||
|
+ if ((disableSystemProps == null || "false".equalsIgnoreCase(disableSystemProps)) &&
|
||||||
|
+ "true".equalsIgnoreCase(props.getProperty("security.useSystemPropertiesFile"))) {
|
||||||
|
if (SystemConfigurator.configure(props)) {
|
||||||
|
loadedProps = true;
|
||||||
|
}
|
||||||
|
diff --git openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
|
||||||
|
--- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java
|
||||||
|
+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
|
||||||
|
@@ -38,8 +38,6 @@
|
||||||
|
import java.util.Properties;
|
||||||
|
import java.util.regex.Pattern;
|
||||||
|
|
||||||
|
-import jdk.internal.misc.SharedSecrets;
|
||||||
|
-import jdk.internal.misc.JavaSecuritySystemConfiguratorAccess;
|
||||||
|
import sun.security.util.Debug;
|
||||||
|
|
||||||
|
/**
|
||||||
|
@@ -65,16 +63,6 @@
|
||||||
|
|
||||||
|
private static boolean systemFipsEnabled = false;
|
||||||
|
|
||||||
|
- static {
|
||||||
|
- SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
|
||||||
|
- new JavaSecuritySystemConfiguratorAccess() {
|
||||||
|
- @Override
|
||||||
|
- public boolean isSystemFipsEnabled() {
|
||||||
|
- return SystemConfigurator.isSystemFipsEnabled();
|
||||||
|
- }
|
||||||
|
- });
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
/*
|
||||||
|
* Invoked when java.security.Security class is initialized, if
|
||||||
|
* java.security.disableSystemPropertiesFile property is not set and
|
Loading…
Reference in New Issue
Block a user