rpms / java-1.8.0-openjdk

Clone
Source Code
GIT

Blame SOURCES/rh2052829-fips_runtime_nss_detection.patch

c7 c7-alt c7-armhfp c7-beta c8 c8-beta c8-containeronly-stream-flatpak c8s c9 c9-beta
  1.   2a33cfbf7a8f090ff10ee40ff308029b0ea8b398
  2.   SOURCES
  3.   rh2052829-fips_runtime_nss_detection.patch
Blob History Raw
53c576 
commit 820d1b1b23be6ea2fd34c687a1be384e7a9830e2
53c576 
Author: Andrew John Hughes <andrew@openjdk.org>
53c576 
Date:   Mon Feb 28 05:50:10 2022 +0000
53c576
53c576 
    RH2051605: Detect NSS at Runtime for FIPS detection
53c576
53c576 
diff --git openjdk.orig/jdk/src/solaris/native/java/security/systemconf.c openjdk/jdk/src/solaris/native/java/security/systemconf.c
53c576 
index 34d0ff0ce9..8dcb7d9073 100644
53c576 
--- openjdk.orig/jdk/src/solaris/native/java/security/systemconf.c
53c576 
+++ openjdk/jdk/src/solaris/native/java/security/systemconf.c
53c576 
@@ -23,25 +23,99 @@
53c576 
  * questions.
53c576 
  */
53c576
53c576 
-#include <dlfcn.h>
53c576 
 #include <jni.h>
53c576 
 #include <jni_util.h>
53c576 
+#include "jvm_md.h"
53c576 
 #include <stdio.h>
53c576
53c576 
 #ifdef SYSCONF_NSS
53c576 
 #include <nss3/pk11pub.h>
53c576 
+#else
53c576 
+#include <dlfcn.h>
53c576 
 #endif //SYSCONF_NSS
53c576
53c576 
 #include "java_security_SystemConfigurator.h"
53c576
53c576 
+#define MSG_MAX_SIZE 256
53c576 
 #define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled"
53c576 
-#define MSG_MAX_SIZE 96
53c576
53c576 
+typedef int (SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE)(void);
53c576 
+
53c576 
+static SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE *getSystemFIPSEnabled;
53c576 
 static jmethodID debugPrintlnMethodID = NULL;
53c576 
 static jobject debugObj = NULL;
53c576
53c576 
-static void throwIOException(JNIEnv *env, const char *msg);
53c576 
-static void dbgPrint(JNIEnv *env, const char* msg);
53c576 
+static void dbgPrint(JNIEnv *env, const char* msg)
53c576 
+{
53c576 
+    jstring jMsg;
53c576 
+    if (debugObj != NULL) {
53c576 
+        jMsg = (*env)->NewStringUTF(env, msg);
53c576 
+        CHECK_NULL(jMsg);
53c576 
+        (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg);
53c576 
+    }
53c576 
+}
53c576 
+
53c576 
+static void throwIOException(JNIEnv *env, const char *msg)
53c576 
+{
53c576 
+    jclass cls = (*env)->FindClass(env, "java/io/IOException");
53c576 
+    if (cls != 0)
53c576 
+        (*env)->ThrowNew(env, cls, msg);
53c576 
+}
53c576 
+
53c576 
+static void handle_msg(JNIEnv *env, const char* msg, int msg_bytes)
53c576 
+{
53c576 
+  if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) {
53c576 
+    dbgPrint(env, msg);
53c576 
+  } else {
53c576 
+    dbgPrint(env, "systemconf: cannot render message");
53c576 
+  }
53c576 
+}
53c576 
+
53c576 
+// Only used when NSS is not linked at build time
53c576 
+#ifndef SYSCONF_NSS
53c576 
+
53c576 
+static void *nss_handle;
53c576 
+
53c576 
+static jboolean loadNSS(JNIEnv *env)
53c576 
+{
53c576 
+  char msg[MSG_MAX_SIZE];
53c576 
+  int msg_bytes;
53c576 
+  const char* errmsg;
53c576 
+
53c576 
+  nss_handle = dlopen(JNI_LIB_NAME("nss3"), RTLD_LAZY);
53c576 
+  if (nss_handle == NULL) {
53c576 
+    errmsg = dlerror();
53c576 
+    msg_bytes = snprintf(msg, MSG_MAX_SIZE, "loadNSS: dlopen: %s\n",
53c576 
+                         errmsg);
53c576 
+    handle_msg(env, msg, msg_bytes);
53c576 
+    return JNI_FALSE;
53c576 
+  }
53c576 
+  dlerror(); /* Clear errors */
53c576 
+  getSystemFIPSEnabled = (SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE*)dlsym(nss_handle, "SECMOD_GetSystemFIPSEnabled");
53c576 
+  if ((errmsg = dlerror()) != NULL) {
53c576 
+    msg_bytes = snprintf(msg, MSG_MAX_SIZE, "loadNSS: dlsym: %s\n",
53c576 
+                         errmsg);
53c576 
+    handle_msg(env, msg, msg_bytes);
53c576 
+    return JNI_FALSE;
53c576 
+  }
53c576 
+  return JNI_TRUE;
53c576 
+}
53c576 
+
53c576 
+static void closeNSS(JNIEnv *env)
53c576 
+{
53c576 
+  char msg[MSG_MAX_SIZE];
53c576 
+  int msg_bytes;
53c576 
+  const char* errmsg;
53c576 
+
53c576 
+  if (dlclose(nss_handle) != 0) {
53c576 
+    errmsg = dlerror();
53c576 
+    msg_bytes = snprintf(msg, MSG_MAX_SIZE, "closeNSS: dlclose: %s\n",
53c576 
+                         errmsg);
53c576 
+    handle_msg(env, msg, msg_bytes);
53c576 
+  }
53c576 
+}
53c576 
+
53c576 
+#endif
53c576
53c576 
 /*
53c576 
  * Class:     java_security_SystemConfigurator
53c576 
@@ -84,6 +158,14 @@ JNIEXPORT jint JNICALL DEF_JNI_OnLoad(JavaVM *vm, void *reserved)
53c576 
         debugObj = (*env)->NewGlobalRef(env, debugObj);
53c576 
     }
53c576
53c576 
+#ifdef SYSCONF_NSS
53c576 
+    getSystemFIPSEnabled = *SECMOD_GetSystemFIPSEnabled;
53c576 
+#else
53c576 
+    if (loadNSS(env) == JNI_FALSE) {
53c576 
+      dbgPrint(env, "libsystemconf: Failed to load NSS library.");
53c576 
+    }
53c576 
+#endif
53c576 
+
53c576 
     return (*env)->GetVersion(env);
53c576 
 }
53c576
53c576 
@@ -99,6 +181,9 @@ JNIEXPORT void JNICALL DEF_JNI_OnUnload(JavaVM *vm, void *reserved)
53c576 
         if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) {
53c576 
             return; /* Should not happen */
53c576 
         }
53c576 
+#ifndef SYSCONF_NSS
53c576 
+        closeNSS(env);
53c576 
+#endif
53c576 
         (*env)->DeleteGlobalRef(env, debugObj);
53c576 
     }
53c576 
 }
53c576 
@@ -110,61 +195,30 @@ JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEn
53c576 
     char msg[MSG_MAX_SIZE];
53c576 
     int msg_bytes;
53c576
53c576 
-#ifdef SYSCONF_NSS
53c576 
-
53c576 
-    dbgPrint(env, "getSystemFIPSEnabled: calling SECMOD_GetSystemFIPSEnabled");
53c576 
-    fips_enabled = SECMOD_GetSystemFIPSEnabled();
53c576 
-    msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
53c576 
-            " SECMOD_GetSystemFIPSEnabled returned 0x%x", fips_enabled);
53c576 
-    if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) {
53c576 
-        dbgPrint(env, msg);
53c576 
+    if (getSystemFIPSEnabled != NULL) {
53c576 
+      dbgPrint(env, "getSystemFIPSEnabled: calling SECMOD_GetSystemFIPSEnabled");
53c576 
+      fips_enabled = (*getSystemFIPSEnabled)();
53c576 
+      msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:"   \
53c576 
+                           " SECMOD_GetSystemFIPSEnabled returned 0x%x", fips_enabled);
53c576 
+      handle_msg(env, msg, msg_bytes);
53c576 
+      return (fips_enabled == 1 ? JNI_TRUE : JNI_FALSE);
53c576 
     } else {
53c576 
-        dbgPrint(env, "getSystemFIPSEnabled: cannot render" \
53c576 
-                " SECMOD_GetSystemFIPSEnabled return value");
53c576 
-    }
53c576 
-    return (fips_enabled == 1 ? JNI_TRUE : JNI_FALSE);
53c576 
-
53c576 
-#else // SYSCONF_NSS
53c576 
+      FILE *fe;
53c576
53c576 
-    FILE *fe;
53c576 
-
53c576 
-    dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH);
53c576 
-    if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) {
53c576 
+      dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH);
53c576 
+      if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) {
53c576 
         throwIOException(env, "Cannot open " FIPS_ENABLED_PATH);
53c576 
         return JNI_FALSE;
53c576 
-    }
53c576 
-    fips_enabled = fgetc(fe);
53c576 
-    fclose(fe);
53c576 
-    if (fips_enabled == EOF) {
53c576 
+      }
53c576 
+      fips_enabled = fgetc(fe);
53c576 
+      fclose(fe);
53c576 
+      if (fips_enabled == EOF) {
53c576 
         throwIOException(env, "Cannot read " FIPS_ENABLED_PATH);
53c576 
         return JNI_FALSE;
53c576 
-    }
53c576 
-    msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
53c576 
-            " read character is '%c'", fips_enabled);
53c576 
-    if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) {
53c576 
-        dbgPrint(env, msg);
53c576 
-    } else {
53c576 
-        dbgPrint(env, "getSystemFIPSEnabled: cannot render" \
53c576 
-                " read character");
53c576 
-    }
53c576 
-    return (fips_enabled == '1' ? JNI_TRUE : JNI_FALSE);
53c576 
-
53c576 
-#endif // SYSCONF_NSS
53c576 
-}
53c576 
-
53c576 
-static void throwIOException(JNIEnv *env, const char *msg)
53c576 
-{
53c576 
-    jclass cls = (*env)->FindClass(env, "java/io/IOException");
53c576 
-    if (cls != 0)
53c576 
-        (*env)->ThrowNew(env, cls, msg);
53c576 
-}
53c576 
-
53c576 
-static void dbgPrint(JNIEnv *env, const char* msg)
53c576 
-{
53c576 
-    jstring jMsg;
53c576 
-    if (debugObj != NULL) {
53c576 
-        jMsg = (*env)->NewStringUTF(env, msg);
53c576 
-        CHECK_NULL(jMsg);
53c576 
-        (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg);
53c576 
+      }
53c576 
+      msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:"   \
53c576 
+                           " read character is '%c'", fips_enabled);
53c576 
+      handle_msg(env, msg, msg_bytes);
53c576 
+      return (fips_enabled == '1' ? JNI_TRUE : JNI_FALSE);
53c576 
     }
53c576 
 }

Powered by Pagure 5.14.1

SSH Hostkey/Fingerprint | Documentation