|
 |
53c576 |
diff -r bbc65dfa59d1 src/share/classes/java/security/SystemConfigurator.java
|
|
|
53c576 |
--- openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java Thu Jan 23 18:22:31 2020 -0300
|
|
|
53c576 |
+++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java Sat Aug 01 23:16:51 2020 -0300
|
|
|
53c576 |
@@ -1,11 +1,13 @@
|
|
|
53c576 |
/*
|
|
|
53c576 |
- * Copyright (c) 2019, Red Hat, Inc.
|
|
|
53c576 |
+ * Copyright (c) 2019, 2020, Red Hat, Inc.
|
|
|
53c576 |
*
|
|
|
53c576 |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
|
53c576 |
*
|
|
|
53c576 |
* This code is free software; you can redistribute it and/or modify it
|
|
|
53c576 |
* under the terms of the GNU General Public License version 2 only, as
|
|
|
53c576 |
- * published by the Free Software Foundation.
|
|
|
53c576 |
+ * published by the Free Software Foundation. Oracle designates this
|
|
|
53c576 |
+ * particular file as subject to the "Classpath" exception as provided
|
|
|
53c576 |
+ * by Oracle in the LICENSE file that accompanied this code.
|
|
|
53c576 |
*
|
|
|
53c576 |
* This code is distributed in the hope that it will be useful, but WITHOUT
|
|
|
53c576 |
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
|
53c576 |
@@ -34,10 +36,10 @@
|
|
|
53c576 |
import java.util.Iterator;
|
|
|
53c576 |
import java.util.Map.Entry;
|
|
|
53c576 |
import java.util.Properties;
|
|
|
53c576 |
-import java.util.function.Consumer;
|
|
|
53c576 |
-import java.util.regex.Matcher;
|
|
|
53c576 |
import java.util.regex.Pattern;
|
|
|
53c576 |
|
|
|
53c576 |
+import sun.misc.SharedSecrets;
|
|
|
53c576 |
+import sun.misc.JavaSecuritySystemConfiguratorAccess;
|
|
|
53c576 |
import sun.security.util.Debug;
|
|
|
53c576 |
|
|
|
53c576 |
/**
|
|
|
53c576 |
@@ -47,7 +49,7 @@
|
|
|
53c576 |
*
|
|
|
53c576 |
*/
|
|
|
53c576 |
|
|
|
53c576 |
-class SystemConfigurator {
|
|
|
53c576 |
+final class SystemConfigurator {
|
|
|
53c576 |
|
|
|
53c576 |
private static final Debug sdebug =
|
|
|
53c576 |
Debug.getInstance("properties");
|
|
|
53c576 |
@@ -61,15 +63,16 @@
|
|
|
53c576 |
private static final String CRYPTO_POLICIES_CONFIG =
|
|
|
53c576 |
CRYPTO_POLICIES_BASE_DIR + "/config";
|
|
|
53c576 |
|
|
|
53c576 |
- private static final class SecurityProviderInfo {
|
|
|
53c576 |
- int number;
|
|
|
53c576 |
- String key;
|
|
|
53c576 |
- String value;
|
|
|
53c576 |
- SecurityProviderInfo(int number, String key, String value) {
|
|
|
53c576 |
- this.number = number;
|
|
|
53c576 |
- this.key = key;
|
|
|
53c576 |
- this.value = value;
|
|
|
53c576 |
- }
|
|
|
53c576 |
+ private static boolean systemFipsEnabled = false;
|
|
|
53c576 |
+
|
|
|
53c576 |
+ static {
|
|
|
53c576 |
+ SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
|
|
|
53c576 |
+ new JavaSecuritySystemConfiguratorAccess() {
|
|
|
53c576 |
+ @Override
|
|
|
53c576 |
+ public boolean isSystemFipsEnabled() {
|
|
|
53c576 |
+ return SystemConfigurator.isSystemFipsEnabled();
|
|
|
53c576 |
+ }
|
|
|
53c576 |
+ });
|
|
|
53c576 |
}
|
|
|
53c576 |
|
|
|
53c576 |
/*
|
|
|
53c576 |
@@ -128,9 +131,9 @@
|
|
|
53c576 |
String nonFipsKeystoreType = props.getProperty("keystore.type");
|
|
|
53c576 |
props.put("keystore.type", keystoreTypeValue);
|
|
|
53c576 |
if (keystoreTypeValue.equals("PKCS11")) {
|
|
|
53c576 |
- // If keystore.type is PKCS11, javax.net.ssl.keyStore
|
|
|
53c576 |
- // must be "NONE". See JDK-8238264.
|
|
|
53c576 |
- System.setProperty("javax.net.ssl.keyStore", "NONE");
|
|
|
53c576 |
+ // If keystore.type is PKCS11, javax.net.ssl.keyStore
|
|
|
53c576 |
+ // must be "NONE". See JDK-8238264.
|
|
|
53c576 |
+ System.setProperty("javax.net.ssl.keyStore", "NONE");
|
|
|
53c576 |
}
|
|
|
53c576 |
if (System.getProperty("javax.net.ssl.trustStoreType") == null) {
|
|
|
53c576 |
// If no trustStoreType has been set, use the
|
|
|
53c576 |
@@ -144,12 +147,13 @@
|
|
|
53c576 |
sdebug.println("FIPS mode default keystore.type = " +
|
|
|
53c576 |
keystoreTypeValue);
|
|
|
53c576 |
sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
|
|
|
53c576 |
- System.getProperty("javax.net.ssl.keyStore", ""));
|
|
|
53c576 |
+ System.getProperty("javax.net.ssl.keyStore", ""));
|
|
|
53c576 |
sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
|
|
|
53c576 |
System.getProperty("javax.net.ssl.trustStoreType", ""));
|
|
|
53c576 |
}
|
|
|
53c576 |
}
|
|
|
53c576 |
loadedProps = true;
|
|
|
53c576 |
+ systemFipsEnabled = true;
|
|
|
53c576 |
}
|
|
|
53c576 |
} catch (Exception e) {
|
|
|
53c576 |
if (sdebug != null) {
|
|
|
53c576 |
@@ -165,20 +165,37 @@
|
|
|
53c576 |
return loadedProps;
|
|
|
53c576 |
}
|
|
|
53c576 |
|
|
|
53c576 |
+ /**
|
|
|
53c576 |
+ * Returns whether or not global system FIPS alignment is enabled.
|
|
|
53c576 |
+ *
|
|
|
53c576 |
+ * Value is always 'false' before java.security.Security class is
|
|
|
53c576 |
+ * initialized.
|
|
|
53c576 |
+ *
|
|
|
53c576 |
+ * Call from out of this package through SharedSecrets:
|
|
|
53c576 |
+ * SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
|
|
|
53c576 |
+ * .isSystemFipsEnabled();
|
|
|
53c576 |
+ *
|
|
|
53c576 |
+ * @return a boolean value indicating whether or not global
|
|
|
53c576 |
+ * system FIPS alignment is enabled.
|
|
|
53c576 |
+ */
|
|
|
53c576 |
+ static boolean isSystemFipsEnabled() {
|
|
|
53c576 |
+ return systemFipsEnabled;
|
|
|
53c576 |
+ }
|
|
|
53c576 |
+
|
|
|
53c576 |
/*
|
|
|
53c576 |
* FIPS is enabled only if crypto-policies are set to "FIPS"
|
|
|
53c576 |
* and the com.redhat.fips property is true.
|
|
|
53c576 |
*/
|
|
|
53c576 |
private static boolean enableFips() throws Exception {
|
|
|
53c576 |
- boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
|
|
|
53c576 |
- if (fipsEnabled) {
|
|
|
53c576 |
- Path configPath = FileSystems.getDefault().getPath(CRYPTO_POLICIES_CONFIG);
|
|
|
53c576 |
- String cryptoPoliciesConfig = new String(Files.readAllBytes(configPath));
|
|
|
53c576 |
- if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); }
|
|
|
53c576 |
- Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
|
|
|
53c576 |
- return pattern.matcher(cryptoPoliciesConfig).find();
|
|
|
53c576 |
- } else {
|
|
|
53c576 |
- return false;
|
|
|
53c576 |
- }
|
|
|
53c576 |
+ boolean shouldEnable = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
|
|
|
53c576 |
+ if (shouldEnable) {
|
|
|
53c576 |
+ Path configPath = FileSystems.getDefault().getPath(CRYPTO_POLICIES_CONFIG);
|
|
|
53c576 |
+ String cryptoPoliciesConfig = new String(Files.readAllBytes(configPath));
|
|
|
53c576 |
+ if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); }
|
|
|
53c576 |
+ Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
|
|
|
53c576 |
+ return pattern.matcher(cryptoPoliciesConfig).find();
|
|
|
53c576 |
+ } else {
|
|
|
53c576 |
+ return false;
|
|
|
53c576 |
+ }
|
|
|
53c576 |
}
|
|
|
53c576 |
}
|
|
|
53c576 |
diff --git openjdk.orig/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java openjdk/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
|
|
|
53c576 |
new file mode 100644
|
|
|
53c576 |
--- /dev/null
|
|
|
53c576 |
+++ openjdk/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
|
|
|
53c576 |
@@ -0,0 +1,30 @@
|
|
|
53c576 |
+/*
|
|
|
53c576 |
+ * Copyright (c) 2020, Red Hat, Inc.
|
|
|
53c576 |
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
|
53c576 |
+ *
|
|
|
53c576 |
+ * This code is free software; you can redistribute it and/or modify it
|
|
|
53c576 |
+ * under the terms of the GNU General Public License version 2 only, as
|
|
|
53c576 |
+ * published by the Free Software Foundation. Oracle designates this
|
|
|
53c576 |
+ * particular file as subject to the "Classpath" exception as provided
|
|
|
53c576 |
+ * by Oracle in the LICENSE file that accompanied this code.
|
|
|
53c576 |
+ *
|
|
|
53c576 |
+ * This code is distributed in the hope that it will be useful, but WITHOUT
|
|
|
53c576 |
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
|
53c576 |
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
|
53c576 |
+ * version 2 for more details (a copy is included in the LICENSE file that
|
|
|
53c576 |
+ * accompanied this code).
|
|
|
53c576 |
+ *
|
|
|
53c576 |
+ * You should have received a copy of the GNU General Public License version
|
|
|
53c576 |
+ * 2 along with this work; if not, write to the Free Software Foundation,
|
|
|
53c576 |
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
|
53c576 |
+ *
|
|
|
53c576 |
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
|
|
53c576 |
+ * or visit www.oracle.com if you need additional information or have any
|
|
|
53c576 |
+ * questions.
|
|
|
53c576 |
+ */
|
|
|
53c576 |
+
|
|
|
53c576 |
+package sun.misc;
|
|
|
53c576 |
+
|
|
|
53c576 |
+public interface JavaSecuritySystemConfiguratorAccess {
|
|
|
53c576 |
+ boolean isSystemFipsEnabled();
|
|
|
53c576 |
+}
|
|
|
53c576 |
diff --git openjdk.orig/jdk/src/share/classes/sun/misc/SharedSecrets.java openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java
|
|
|
53c576 |
--- openjdk.orig/jdk/src/share/classes/sun/misc/SharedSecrets.java
|
|
|
53c576 |
+++ openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java
|
|
|
53c576 |
@@ -63,6 +63,7 @@
|
|
|
53c576 |
private static JavaObjectInputStreamReadString javaObjectInputStreamReadString;
|
|
|
53c576 |
private static JavaObjectInputStreamAccess javaObjectInputStreamAccess;
|
|
|
53c576 |
private static JavaSecuritySignatureAccess javaSecuritySignatureAccess;
|
|
|
53c576 |
+ private static JavaSecuritySystemConfiguratorAccess javaSecuritySystemConfiguratorAccess;
|
|
|
53c576 |
|
|
|
53c576 |
public static JavaUtilJarAccess javaUtilJarAccess() {
|
|
|
53c576 |
if (javaUtilJarAccess == null) {
|
|
|
53c576 |
@@ -248,4 +249,12 @@
|
|
|
53c576 |
}
|
|
|
53c576 |
return javaxCryptoSealedObjectAccess;
|
|
|
53c576 |
}
|
|
|
53c576 |
+
|
|
|
53c576 |
+ public static void setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) {
|
|
|
53c576 |
+ javaSecuritySystemConfiguratorAccess = jssca;
|
|
|
53c576 |
+ }
|
|
|
53c576 |
+
|
|
|
53c576 |
+ public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() {
|
|
|
53c576 |
+ return javaSecuritySystemConfiguratorAccess;
|
|
|
53c576 |
+ }
|
|
|
53c576 |
}
|
|
|
53c576 |
diff --git openjdk.orig/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java openjdk/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
|
|
|
53c576 |
--- openjdk.orig/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
|
|
|
53c576 |
+++ openjdk/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
|
|
|
53c576 |
@@ -31,6 +31,7 @@
|
|
|
53c576 |
import java.security.cert.*;
|
|
|
53c576 |
import java.util.*;
|
|
|
53c576 |
import javax.net.ssl.*;
|
|
|
53c576 |
+import sun.misc.SharedSecrets;
|
|
|
53c576 |
import sun.security.action.GetPropertyAction;
|
|
|
53c576 |
import sun.security.provider.certpath.AlgorithmChecker;
|
|
|
53c576 |
import sun.security.validator.Validator;
|
|
|
53c576 |
@@ -539,20 +540,38 @@
|
|
|
53c576 |
|
|
|
53c576 |
static {
|
|
|
53c576 |
if (SunJSSE.isFIPS()) {
|
|
|
53c576 |
- supportedProtocols = Arrays.asList(
|
|
|
53c576 |
- ProtocolVersion.TLS13,
|
|
|
53c576 |
- ProtocolVersion.TLS12,
|
|
|
53c576 |
- ProtocolVersion.TLS11,
|
|
|
53c576 |
- ProtocolVersion.TLS10
|
|
|
53c576 |
- );
|
|
|
53c576 |
+ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
|
|
|
53c576 |
+ .isSystemFipsEnabled()) {
|
|
|
53c576 |
+ // RH1860986: TLSv1.3 key derivation not supported with
|
|
|
53c576 |
+ // the Security Providers available in system FIPS mode.
|
|
|
53c576 |
+ supportedProtocols = Arrays.asList(
|
|
|
53c576 |
+ ProtocolVersion.TLS12,
|
|
|
53c576 |
+ ProtocolVersion.TLS11,
|
|
|
53c576 |
+ ProtocolVersion.TLS10
|
|
|
53c576 |
+ );
|
|
|
53c576 |
|
|
|
53c576 |
- serverDefaultProtocols = getAvailableProtocols(
|
|
|
53c576 |
- new ProtocolVersion[] {
|
|
|
53c576 |
- ProtocolVersion.TLS13,
|
|
|
53c576 |
- ProtocolVersion.TLS12,
|
|
|
53c576 |
- ProtocolVersion.TLS11,
|
|
|
53c576 |
- ProtocolVersion.TLS10
|
|
|
53c576 |
- });
|
|
|
53c576 |
+ serverDefaultProtocols = getAvailableProtocols(
|
|
|
53c576 |
+ new ProtocolVersion[] {
|
|
|
53c576 |
+ ProtocolVersion.TLS12,
|
|
|
53c576 |
+ ProtocolVersion.TLS11,
|
|
|
53c576 |
+ ProtocolVersion.TLS10
|
|
|
53c576 |
+ });
|
|
|
53c576 |
+ } else {
|
|
|
53c576 |
+ supportedProtocols = Arrays.asList(
|
|
|
53c576 |
+ ProtocolVersion.TLS13,
|
|
|
53c576 |
+ ProtocolVersion.TLS12,
|
|
|
53c576 |
+ ProtocolVersion.TLS11,
|
|
|
53c576 |
+ ProtocolVersion.TLS10
|
|
|
53c576 |
+ );
|
|
|
53c576 |
+
|
|
|
53c576 |
+ serverDefaultProtocols = getAvailableProtocols(
|
|
|
53c576 |
+ new ProtocolVersion[] {
|
|
|
53c576 |
+ ProtocolVersion.TLS13,
|
|
|
53c576 |
+ ProtocolVersion.TLS12,
|
|
|
53c576 |
+ ProtocolVersion.TLS11,
|
|
|
53c576 |
+ ProtocolVersion.TLS10
|
|
|
53c576 |
+ });
|
|
|
53c576 |
+ }
|
|
|
53c576 |
} else {
|
|
|
53c576 |
supportedProtocols = Arrays.asList(
|
|
|
53c576 |
ProtocolVersion.TLS13,
|
|
|
53c576 |
@@ -612,6 +631,16 @@
|
|
|
53c576 |
|
|
|
53c576 |
static ProtocolVersion[] getSupportedProtocols() {
|
|
|
53c576 |
if (SunJSSE.isFIPS()) {
|
|
|
53c576 |
+ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
|
|
|
53c576 |
+ .isSystemFipsEnabled()) {
|
|
|
53c576 |
+ // RH1860986: TLSv1.3 key derivation not supported with
|
|
|
53c576 |
+ // the Security Providers available in system FIPS mode.
|
|
|
53c576 |
+ return new ProtocolVersion[] {
|
|
|
53c576 |
+ ProtocolVersion.TLS12,
|
|
|
53c576 |
+ ProtocolVersion.TLS11,
|
|
|
53c576 |
+ ProtocolVersion.TLS10
|
|
|
53c576 |
+ };
|
|
|
53c576 |
+ }
|
|
|
53c576 |
return new ProtocolVersion[] {
|
|
|
53c576 |
ProtocolVersion.TLS13,
|
|
|
53c576 |
ProtocolVersion.TLS12,
|
|
|
53c576 |
@@ -939,6 +968,16 @@
|
|
|
53c576 |
|
|
|
53c576 |
static ProtocolVersion[] getProtocols() {
|
|
|
53c576 |
if (SunJSSE.isFIPS()) {
|
|
|
53c576 |
+ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
|
|
|
53c576 |
+ .isSystemFipsEnabled()) {
|
|
|
53c576 |
+ // RH1860986: TLSv1.3 key derivation not supported with
|
|
|
53c576 |
+ // the Security Providers available in system FIPS mode.
|
|
|
53c576 |
+ return new ProtocolVersion[] {
|
|
|
53c576 |
+ ProtocolVersion.TLS12,
|
|
|
53c576 |
+ ProtocolVersion.TLS11,
|
|
|
53c576 |
+ ProtocolVersion.TLS10
|
|
|
53c576 |
+ };
|
|
|
53c576 |
+ }
|
|
|
53c576 |
return new ProtocolVersion[]{
|
|
|
53c576 |
ProtocolVersion.TLS12,
|
|
|
53c576 |
ProtocolVersion.TLS11,
|
|
|
53c576 |
diff --git openjdk.orig/jdk/src/share/classes/sun/security/ssl/SunJSSE.java openjdk/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
|
|
|
53c576 |
--- openjdk.orig/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
|
|
|
53c576 |
+++ openjdk/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
|
|
|
53c576 |
@@ -30,6 +30,8 @@
|
|
|
53c576 |
|
|
|
53c576 |
import java.security.*;
|
|
|
53c576 |
|
|
|
53c576 |
+import sun.misc.SharedSecrets;
|
|
|
53c576 |
+
|
|
|
53c576 |
/**
|
|
|
53c576 |
* The JSSE provider.
|
|
|
53c576 |
*
|
|
|
53c576 |
@@ -215,8 +217,13 @@
|
|
|
53c576 |
"sun.security.ssl.SSLContextImpl$TLS11Context");
|
|
|
53c576 |
put("SSLContext.TLSv1.2",
|
|
|
53c576 |
"sun.security.ssl.SSLContextImpl$TLS12Context");
|
|
|
53c576 |
- put("SSLContext.TLSv1.3",
|
|
|
53c576 |
- "sun.security.ssl.SSLContextImpl$TLS13Context");
|
|
|
53c576 |
+ if (!SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
|
|
|
53c576 |
+ .isSystemFipsEnabled()) {
|
|
|
53c576 |
+ // RH1860986: TLSv1.3 key derivation not supported with
|
|
|
53c576 |
+ // the Security Providers available in system FIPS mode.
|
|
|
53c576 |
+ put("SSLContext.TLSv1.3",
|
|
|
53c576 |
+ "sun.security.ssl.SSLContextImpl$TLS13Context");
|
|
|
53c576 |
+ }
|
|
|
53c576 |
put("SSLContext.TLS",
|
|
|
53c576 |
"sun.security.ssl.SSLContextImpl$TLSContext");
|
|
|
53c576 |
if (isfips == false) {
|