Additional default values of security properties are read from a ++ * system-specific location, if available.
++ * + * @author Benjamin Renaud + * @since 1.1 + */ + + public final class Security { + ++ private static final String SYS_PROP_SWITCH = ++ "java.security.disableSystemPropertiesFile"; ++ private static final String SEC_PROP_SWITCH = ++ "security.useSystemPropertiesFile"; ++ + /* Are we debugging? -- for developers */ + private static final Debug sdebug = + Debug.getInstance("properties"); +@@ -67,6 +76,19 @@ public final class Security { + } + + static { ++ // Initialise here as used by code with system properties disabled ++ SharedSecrets.setJavaSecuritySystemConfiguratorAccess( ++ new JavaSecuritySystemConfiguratorAccess() { ++ @Override ++ public boolean isSystemFipsEnabled() { ++ return SystemConfigurator.isSystemFipsEnabled(); ++ } ++ @Override ++ public boolean isPlainKeySupportEnabled() { ++ return SystemConfigurator.isPlainKeySupportEnabled(); ++ } ++ }); ++ + // doPrivileged here because there are multiple + // things in initialize that might require privs. + // (the FileInputStream call and the File.exists call, +@@ -84,6 +106,7 @@ public final class Security { + props = new Properties(); + boolean loadedProps = false; + boolean overrideAll = false; ++ boolean systemSecPropsEnabled = false; + + // first load the system properties file + // to determine the value of security.overridePropertiesFile +@@ -99,6 +122,7 @@ public final class Security { + if (sdebug != null) { + sdebug.println("reading security properties file: " + + propFile); ++ sdebug.println(props.toString()); + } + } catch (IOException e) { + if (sdebug != null) { +@@ -193,6 +217,61 @@ public final class Security { + } + } + ++ boolean sysUseProps = Boolean.valueOf(System.getProperty(SYS_PROP_SWITCH, "false")); ++ boolean secUseProps = Boolean.valueOf(props.getProperty(SEC_PROP_SWITCH)); ++ if (sdebug != null) { ++ sdebug.println(SYS_PROP_SWITCH + "=" + sysUseProps); ++ sdebug.println(SEC_PROP_SWITCH + "=" + secUseProps); ++ } ++ if (!sysUseProps && secUseProps) { ++ systemSecPropsEnabled = SystemConfigurator.configureSysProps(props); ++ if (!systemSecPropsEnabled) { ++ if (sdebug != null) { ++ sdebug.println("WARNING: System security properties could not be loaded."); ++ } ++ } ++ } else { ++ if (sdebug != null) { ++ sdebug.println("System security property support disabled by user."); ++ } ++ } ++ ++ // FIPS support depends on the contents of java.security so ++ // ensure it has loaded first ++ if (loadedProps && systemSecPropsEnabled) { ++ boolean shouldEnable; ++ String sysProp = System.getProperty("com.redhat.fips"); ++ if (sysProp == null) { ++ shouldEnable = true; ++ if (sdebug != null) { ++ sdebug.println("com.redhat.fips unset, using default value of true"); ++ } ++ } else { ++ shouldEnable = Boolean.valueOf(sysProp); ++ if (sdebug != null) { ++ sdebug.println("com.redhat.fips set, using its value " + shouldEnable); ++ } ++ } ++ if (shouldEnable) { ++ boolean fipsEnabled = SystemConfigurator.configureFIPS(props); ++ if (sdebug != null) { ++ if (fipsEnabled) { ++ sdebug.println("FIPS mode support configured and enabled."); ++ } else { ++ sdebug.println("FIPS mode support disabled."); ++ } ++ } ++ } else { ++ if (sdebug != null ) { ++ sdebug.println("FIPS mode support disabled by user."); ++ } ++ } ++ } else { ++ if (sdebug != null) { ++ sdebug.println("WARNING: FIPS mode support can not be enabled without " + ++ "system security properties being enabled."); ++ } ++ } + } + + /* +diff --git a/src/java.base/share/classes/java/security/SystemConfigurator.java b/src/java.base/share/classes/java/security/SystemConfigurator.java +new file mode 100644 +index 00000000000..98ffced455b +--- /dev/null ++++ b/src/java.base/share/classes/java/security/SystemConfigurator.java +@@ -0,0 +1,249 @@ ++/* ++ * Copyright (c) 2019, 2021, Red Hat, Inc. ++ * ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++package java.security; ++ ++import java.io.BufferedInputStream; ++import java.io.FileInputStream; ++import java.io.IOException; ++ ++import java.util.Iterator; ++import java.util.Map.Entry; ++import java.util.Properties; ++ ++import sun.security.util.Debug; ++ ++/** ++ * Internal class to align OpenJDK with global crypto-policies. ++ * Called from java.security.Security class initialization, ++ * during startup. ++ * ++ */ ++ ++final class SystemConfigurator { ++ ++ private static final Debug sdebug = ++ Debug.getInstance("properties"); ++ ++ private static final String CRYPTO_POLICIES_BASE_DIR = ++ "/etc/crypto-policies"; ++ ++ private static final String CRYPTO_POLICIES_JAVA_CONFIG = ++ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config"; ++ ++ private static boolean systemFipsEnabled = false; ++ private static boolean plainKeySupportEnabled = false; ++ ++ private static final String SYSTEMCONF_NATIVE_LIB = "systemconf"; ++ ++ private static native boolean getSystemFIPSEnabled() ++ throws IOException; ++ ++ static { ++ @SuppressWarnings("removal") ++ var dummy = AccessController.doPrivileged(new PrivilegedAction+ * PKCS#11 structure: + *
+ * typedef struct CK_PBE_PARAMS {
+- * CK_CHAR_PTR pInitVector;
+- * CK_CHAR_PTR pPassword;
++ * CK_BYTE_PTR pInitVector;
++ * CK_UTF8CHAR_PTR pPassword;
+ * CK_ULONG ulPasswordLen;
+- * CK_CHAR_PTR pSalt;
++ * CK_BYTE_PTR pSalt;
+ * CK_ULONG ulSaltLen;
+ * CK_ULONG ulIteration;
+ * } CK_PBE_PARAMS;
+@@ -72,15 +72,15 @@ public class CK_PBE_PARAMS {
+ /**
+ * PKCS#11:
+ *
+- * CK_CHAR_PTR pInitVector;
++ * CK_BYTE_PTR pInitVector;
+ *
+ */
+- public char[] pInitVector;
++ public byte[] pInitVector;
+
+ /**
+ * PKCS#11:
+ *
+- * CK_CHAR_PTR pPassword;
++ * CK_UTF8CHAR_PTR pPassword;
+ * CK_ULONG ulPasswordLen;
+ *
+ */
+@@ -89,11 +89,11 @@ public class CK_PBE_PARAMS {
+ /**
+ * PKCS#11:
+ *
+- * CK_CHAR_PTR pSalt
++ * CK_BYTE_PTR pSalt
+ * CK_ULONG ulSaltLen;
+ *
+ */
+- public char[] pSalt;
++ public byte[] pSalt;
+
+ /**
+ * PKCS#11:
+@@ -103,6 +103,12 @@ public class CK_PBE_PARAMS {
+ */
+ public long ulIteration;
+
++ public CK_PBE_PARAMS(char[] pPassword, byte[] pSalt, long ulIteration) {
++ this.pPassword = pPassword;
++ this.pSalt = pSalt;
++ this.ulIteration = ulIteration;
++ }
++
+ /**
+ * Returns the string representation of CK_PBE_PARAMS.
+ *
+diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS.java
+index fb90bfced27..a01beb0753a 100644
+--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS.java
++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS.java
+@@ -47,7 +47,7 @@
+
+ package sun.security.pkcs11.wrapper;
+
+-
++import static sun.security.pkcs11.wrapper.PKCS11Constants.*;
+
+ /**
+ * class CK_PKCS5_PBKD2_PARAMS provides the parameters to the CKM_PKCS5_PBKD2
+@@ -55,13 +55,15 @@ package sun.security.pkcs11.wrapper;
+ * PKCS#11 structure:
+ *
+ * typedef struct CK_PKCS5_PBKD2_PARAMS {
+- * CK_PKCS5_PBKD2_SALT_SOURCE_TYPE saltSource;
++ * CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE saltSource;
+ * CK_VOID_PTR pSaltSourceData;
+ * CK_ULONG ulSaltSourceDataLen;
+ * CK_ULONG iterations;
+ * CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE prf;
+ * CK_VOID_PTR pPrfData;
+ * CK_ULONG ulPrfDataLen;
++ * CK_UTF8CHAR_PTR pPassword;
++ * CK_ULONG_PTR ulPasswordLen;
+ * } CK_PKCS5_PBKD2_PARAMS;
+ *
+ *
+@@ -112,6 +114,24 @@ public class CK_PKCS5_PBKD2_PARAMS {
+ */
+ public byte[] pPrfData;
+
++ /**
++ * PKCS#11:
++ *
++ * CK_UTF8CHAR_PTR pPassword
++ * CK_ULONG_PTR ulPasswordLen;
++ *
++ */
++ public char[] pPassword;
++
++ public CK_PKCS5_PBKD2_PARAMS(char[] pPassword, byte[] pSalt,
++ long iterations, long prf) {
++ this.pPassword = pPassword;
++ this.pSaltSourceData = pSalt;
++ this.iterations = iterations;
++ this.prf = prf;
++ this.saltSource = CKZ_SALT_SPECIFIED;
++ }
++
+ /**
+ * Returns the string representation of CK_PKCS5_PBKD2_PARAMS.
+ *
+diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS2.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS2.java
+new file mode 100644
+index 00000000000..935db656639
+--- /dev/null
++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS2.java
+@@ -0,0 +1,156 @@
++/*
++ * Copyright (c) 2022, Red Hat, Inc.
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation. Oracle designates this
++ * particular file as subject to the "Classpath" exception as provided
++ * by Oracle in the LICENSE file that accompanied this code.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++package sun.security.pkcs11.wrapper;
++
++import static sun.security.pkcs11.wrapper.PKCS11Constants.*;
++
++/**
++ * class CK_PKCS5_PBKD2_PARAMS2 provides the parameters to the CKM_PKCS5_PBKD2
++ * mechanism.
++ * PKCS#11 structure:
++ *
++ * typedef struct CK_PKCS5_PBKD2_PARAMS2 {
++ * CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE saltSource;
++ * CK_VOID_PTR pSaltSourceData;
++ * CK_ULONG ulSaltSourceDataLen;
++ * CK_ULONG iterations;
++ * CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE prf;
++ * CK_VOID_PTR pPrfData;
++ * CK_ULONG ulPrfDataLen;
++ * CK_UTF8CHAR_PTR pPassword;
++ * CK_ULONG ulPasswordLen;
++ * } CK_PKCS5_PBKD2_PARAMS2;
++ *
++ *
++ */
++public class CK_PKCS5_PBKD2_PARAMS2 {
++
++ /**
++ * PKCS#11:
++ *
++ * CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE saltSource;
++ *
++ */
++ public long saltSource;
++
++ /**
++ * PKCS#11:
++ *
++ * CK_VOID_PTR pSaltSourceData;
++ * CK_ULONG ulSaltSourceDataLen;
++ *
++ */
++ public byte[] pSaltSourceData;
++
++ /**
++ * PKCS#11:
++ *
++ * CK_ULONG iterations;
++ *
++ */
++ public long iterations;
++
++ /**
++ * PKCS#11:
++ *
++ * CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE prf;
++ *
++ */
++ public long prf;
++
++ /**
++ * PKCS#11:
++ *
++ * CK_VOID_PTR pPrfData;
++ * CK_ULONG ulPrfDataLen;
++ *
++ */
++ public byte[] pPrfData;
++
++ /**
++ * PKCS#11:
++ *
++ * CK_UTF8CHAR_PTR pPassword
++ * CK_ULONG ulPasswordLen;
++ *
++ */
++ public char[] pPassword;
++
++ public CK_PKCS5_PBKD2_PARAMS2(char[] pPassword, byte[] pSalt,
++ long iterations, long prf) {
++ this.pPassword = pPassword;
++ this.pSaltSourceData = pSalt;
++ this.iterations = iterations;
++ this.prf = prf;
++ this.saltSource = CKZ_SALT_SPECIFIED;
++ }
++
++ /**
++ * Returns the string representation of CK_PKCS5_PBKD2_PARAMS2.
++ *
++ * @return the string representation of CK_PKCS5_PBKD2_PARAMS2
++ */
++ public String toString() {
++ StringBuilder sb = new StringBuilder();
++
++ sb.append(Constants.INDENT);
++ sb.append("saltSource: ");
++ sb.append(saltSource);
++ sb.append(Constants.NEWLINE);
++
++ sb.append(Constants.INDENT);
++ sb.append("pSaltSourceData: ");
++ sb.append(Functions.toHexString(pSaltSourceData));
++ sb.append(Constants.NEWLINE);
++
++ sb.append(Constants.INDENT);
++ sb.append("ulSaltSourceDataLen: ");
++ sb.append(pSaltSourceData.length);
++ sb.append(Constants.NEWLINE);
++
++ sb.append(Constants.INDENT);
++ sb.append("iterations: ");
++ sb.append(iterations);
++ sb.append(Constants.NEWLINE);
++
++ sb.append(Constants.INDENT);
++ sb.append("prf: ");
++ sb.append(prf);
++ sb.append(Constants.NEWLINE);
++
++ sb.append(Constants.INDENT);
++ sb.append("pPrfData: ");
++ sb.append(Functions.toHexString(pPrfData));
++ sb.append(Constants.NEWLINE);
++
++ sb.append(Constants.INDENT);
++ sb.append("ulPrfDataLen: ");
++ sb.append(pPrfData.length);
++
++ return sb.toString();
++ }
++
++}
+diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_X9_42_DH1_DERIVE_PARAMS.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_X9_42_DH1_DERIVE_PARAMS.java
+index 1f9c4d39f57..5e3c1b9d29f 100644
+--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_X9_42_DH1_DERIVE_PARAMS.java
++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_X9_42_DH1_DERIVE_PARAMS.java
+@@ -94,9 +94,9 @@ public class CK_X9_42_DH1_DERIVE_PARAMS {
+ public byte[] pPublicData;
+
+ /**
+- * Returns the string representation of CK_PKCS5_PBKD2_PARAMS.
++ * Returns the string representation of CK_X9_42_DH1_DERIVE_PARAMS.
+ *
+- * @return the string representation of CK_PKCS5_PBKD2_PARAMS
++ * @return the string representation of CK_X9_42_DH1_DERIVE_PARAMS
+ */
+ public String toString() {
+ StringBuilder sb = new StringBuilder();
+diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
+index 5c0aacd1a67..5fbf8addcba 100644
+--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
+@@ -49,6 +49,9 @@ package sun.security.pkcs11.wrapper;
+
+ import java.io.File;
+ import java.io.IOException;
++import java.lang.invoke.MethodHandle;
++import java.lang.invoke.MethodHandles;
++import java.lang.invoke.MethodType;
+ import java.util.*;
+
+ import java.security.AccessController;
+@@ -113,6 +116,8 @@ public class PKCS11 {
+
+ private long pNativeData;
+
++ private CK_INFO pInfo;
++
+ /**
+ * This method does the initialization of the native library. It is called
+ * exactly once for this class.
+@@ -145,23 +150,49 @@ public class PKCS11 {
+ * @postconditions
+ */
+ PKCS11(String pkcs11ModulePath, String functionListName)
+- throws IOException {
++ throws IOException, PKCS11Exception {
+ connect(pkcs11ModulePath, functionListName);
+ this.pkcs11ModulePath = pkcs11ModulePath;
++ pInfo = C_GetInfo();
++ }
++
++ /*
++ * Compatibility wrapper to allow this method to work as before
++ * when FIPS mode support is not active.
++ */
++ public static synchronized PKCS11 getInstance(String pkcs11ModulePath,
++ String functionList, CK_C_INITIALIZE_ARGS pInitArgs,
++ boolean omitInitialize) throws IOException, PKCS11Exception {
++ return getInstance(pkcs11ModulePath, functionList,
++ pInitArgs, omitInitialize, null, null);
+ }
+
+ public static synchronized PKCS11 getInstance(String pkcs11ModulePath,
+ String functionList, CK_C_INITIALIZE_ARGS pInitArgs,
+- boolean omitInitialize) throws IOException, PKCS11Exception {
++ boolean omitInitialize, MethodHandle fipsKeyImporter,
++ MethodHandle fipsKeyExporter)
++ throws IOException, PKCS11Exception {
+ // we may only call C_Initialize once per native .so/.dll
+ // so keep a cache using the (non-canonicalized!) path
+ PKCS11 pkcs11 = moduleMap.get(pkcs11ModulePath);
+ if (pkcs11 == null) {
++ boolean nssFipsMode = fipsKeyImporter != null &&
++ fipsKeyExporter != null;
+ if ((pInitArgs != null)
+ && ((pInitArgs.flags & CKF_OS_LOCKING_OK) != 0)) {
+- pkcs11 = new PKCS11(pkcs11ModulePath, functionList);
++ if (nssFipsMode) {
++ pkcs11 = new FIPSPKCS11(pkcs11ModulePath, functionList,
++ fipsKeyImporter, fipsKeyExporter);
++ } else {
++ pkcs11 = new PKCS11(pkcs11ModulePath, functionList);
++ }
+ } else {
+- pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList);
++ if (nssFipsMode) {
++ pkcs11 = new SynchronizedFIPSPKCS11(pkcs11ModulePath,
++ functionList, fipsKeyImporter, fipsKeyExporter);
++ } else {
++ pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList);
++ }
+ }
+ if (omitInitialize == false) {
+ try {
+@@ -179,6 +210,14 @@ public class PKCS11 {
+ return pkcs11;
+ }
+
++ /**
++ * Returns the CK_INFO structure fetched at initialization with
++ * C_GetInfo. This structure represent Cryptoki library information.
++ */
++ public CK_INFO getInfo() {
++ return pInfo;
++ }
++
+ /**
+ * Connects this object to the specified PKCS#11 library. This method is for
+ * internal use only.
+@@ -1625,7 +1664,7 @@ public class PKCS11 {
+ static class SynchronizedPKCS11 extends PKCS11 {
+
+ SynchronizedPKCS11(String pkcs11ModulePath, String functionListName)
+- throws IOException {
++ throws IOException, PKCS11Exception {
+ super(pkcs11ModulePath, functionListName);
+ }
+
+@@ -1911,4 +1950,194 @@ static class SynchronizedPKCS11 extends PKCS11 {
+ super.C_GenerateRandom(hSession, randomData);
+ }
+ }
++
++// PKCS11 subclass that allows using plain private or secret keys in
++// FIPS-configured NSS Software Tokens. Only used when System FIPS
++// is enabled.
++static class FIPSPKCS11 extends PKCS11 {
++ private MethodHandle fipsKeyImporter;
++ private MethodHandle fipsKeyExporter;
++ private MethodHandle hC_GetAttributeValue;
++ FIPSPKCS11(String pkcs11ModulePath, String functionListName,
++ MethodHandle fipsKeyImporter, MethodHandle fipsKeyExporter)
++ throws IOException, PKCS11Exception {
++ super(pkcs11ModulePath, functionListName);
++ this.fipsKeyImporter = fipsKeyImporter;
++ this.fipsKeyExporter = fipsKeyExporter;
++ try {
++ hC_GetAttributeValue = MethodHandles.insertArguments(
++ MethodHandles.lookup().findSpecial(PKCS11.class,
++ "C_GetAttributeValue", MethodType.methodType(
++ void.class, long.class, long.class,
++ CK_ATTRIBUTE[].class),
++ FIPSPKCS11.class), 0, this);
++ } catch (Throwable t) {
++ throw new RuntimeException(
++ "sun.security.pkcs11.wrapper.PKCS11" +
++ "::C_GetAttributeValue method not found.", t);
++ }
++ }
++
++ public long C_CreateObject(long hSession,
++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
++ // Creating sensitive key objects from plain key material in a
++ // FIPS-configured NSS Software Token is not allowed. We apply
++ // a key-unwrapping scheme to achieve so.
++ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) {
++ try {
++ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate))
++ .longValue();
++ } catch (Throwable t) {
++ if (t instanceof PKCS11Exception) {
++ throw (PKCS11Exception)t;
++ }
++ throw new PKCS11Exception(CKR_GENERAL_ERROR,
++ t.getMessage());
++ }
++ }
++ return super.C_CreateObject(hSession, pTemplate);
++ }
++
++ public void C_GetAttributeValue(long hSession, long hObject,
++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
++ FIPSPKCS11Helper.C_GetAttributeValue(hC_GetAttributeValue,
++ fipsKeyExporter, hSession, hObject, pTemplate);
++ }
++}
++
++// FIPSPKCS11 synchronized counterpart.
++static class SynchronizedFIPSPKCS11 extends SynchronizedPKCS11 {
++ private MethodHandle fipsKeyImporter;
++ private MethodHandle fipsKeyExporter;
++ private MethodHandle hC_GetAttributeValue;
++ SynchronizedFIPSPKCS11(String pkcs11ModulePath, String functionListName,
++ MethodHandle fipsKeyImporter, MethodHandle fipsKeyExporter)
++ throws IOException, PKCS11Exception {
++ super(pkcs11ModulePath, functionListName);
++ this.fipsKeyImporter = fipsKeyImporter;
++ this.fipsKeyExporter = fipsKeyExporter;
++ try {
++ hC_GetAttributeValue = MethodHandles.insertArguments(
++ MethodHandles.lookup().findSpecial(SynchronizedPKCS11.class,
++ "C_GetAttributeValue", MethodType.methodType(
++ void.class, long.class, long.class,
++ CK_ATTRIBUTE[].class),
++ SynchronizedFIPSPKCS11.class), 0, this);
++ } catch (Throwable t) {
++ throw new RuntimeException(
++ "sun.security.pkcs11.wrapper.SynchronizedPKCS11" +
++ "::C_GetAttributeValue method not found.", t);
++ }
++ }
++
++ public synchronized long C_CreateObject(long hSession,
++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
++ // See FIPSPKCS11::C_CreateObject.
++ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) {
++ try {
++ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate))
++ .longValue();
++ } catch (Throwable t) {
++ if (t instanceof PKCS11Exception) {
++ throw (PKCS11Exception)t;
++ }
++ throw new PKCS11Exception(CKR_GENERAL_ERROR,
++ t.getMessage());
++ }
++ }
++ return super.C_CreateObject(hSession, pTemplate);
++ }
++
++ public synchronized void C_GetAttributeValue(long hSession, long hObject,
++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
++ FIPSPKCS11Helper.C_GetAttributeValue(hC_GetAttributeValue,
++ fipsKeyExporter, hSession, hObject, pTemplate);
++ }
++}
++
++private static class FIPSPKCS11Helper {
++ static boolean isSensitiveObject(CK_ATTRIBUTE[] pTemplate) {
++ for (CK_ATTRIBUTE attr : pTemplate) {
++ if (attr.type == CKA_CLASS &&
++ (attr.getLong() == CKO_PRIVATE_KEY ||
++ attr.getLong() == CKO_SECRET_KEY)) {
++ return true;
++ }
++ }
++ return false;
++ }
++ static void C_GetAttributeValue(MethodHandle hC_GetAttributeValue,
++ MethodHandle fipsKeyExporter, long hSession, long hObject,
++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
++ Map sensitiveAttrs = new HashMap<>();
++ List nonSensitiveAttrs = new LinkedList<>();
++ FIPSPKCS11Helper.getAttributesBySensitivity(pTemplate,
++ sensitiveAttrs, nonSensitiveAttrs);
++ try {
++ if (sensitiveAttrs.size() > 0) {
++ long keyClass = -1L;
++ long keyType = -1L;
++ try {
++ // Secret and private keys have both class and type
++ // attributes, so we can query them at once.
++ CK_ATTRIBUTE[] queryAttrs = new CK_ATTRIBUTE[]{
++ new CK_ATTRIBUTE(CKA_CLASS),
++ new CK_ATTRIBUTE(CKA_KEY_TYPE),
++ };
++ hC_GetAttributeValue.invoke(hSession, hObject, queryAttrs);
++ keyClass = queryAttrs[0].getLong();
++ keyType = queryAttrs[1].getLong();
++ } catch (PKCS11Exception e) {
++ // If the query fails, the object is neither a secret nor a
++ // private key. As this case won't be handled with the FIPS
++ // Key Exporter, we keep keyClass initialized to -1L.
++ }
++ if (keyClass == CKO_SECRET_KEY || keyClass == CKO_PRIVATE_KEY) {
++ fipsKeyExporter.invoke(hSession, hObject, keyClass, keyType,
++ sensitiveAttrs);
++ if (nonSensitiveAttrs.size() > 0) {
++ CK_ATTRIBUTE[] pNonSensitiveAttrs =
++ new CK_ATTRIBUTE[nonSensitiveAttrs.size()];
++ int i = 0;
++ for (CK_ATTRIBUTE nonSensAttr : nonSensitiveAttrs) {
++ pNonSensitiveAttrs[i++] = nonSensAttr;
++ }
++ hC_GetAttributeValue.invoke(hSession, hObject,
++ pNonSensitiveAttrs);
++ // libj2pkcs11 allocates new CK_ATTRIBUTE objects, so we
++ // update the reference on the previous CK_ATTRIBUTEs
++ i = 0;
++ for (CK_ATTRIBUTE nonSensAttr : nonSensitiveAttrs) {
++ nonSensAttr.pValue = pNonSensitiveAttrs[i++].pValue;
++ }
++ }
++ return;
++ }
++ }
++ hC_GetAttributeValue.invoke(hSession, hObject, pTemplate);
++ } catch (Throwable t) {
++ if (t instanceof PKCS11Exception) {
++ throw (PKCS11Exception)t;
++ }
++ throw new PKCS11Exception(CKR_GENERAL_ERROR,
++ t.getMessage());
++ }
++ }
++ private static void getAttributesBySensitivity(CK_ATTRIBUTE[] pTemplate,
++ Map sensitiveAttrs,
++ List nonSensitiveAttrs) {
++ for (CK_ATTRIBUTE attr : pTemplate) {
++ long type = attr.type;
++ // Aligned with NSS' sftk_isSensitive in lib/softoken/pkcs11u.c
++ if (type == CKA_VALUE || type == CKA_PRIVATE_EXPONENT ||
++ type == CKA_PRIME_1 || type == CKA_PRIME_2 ||
++ type == CKA_EXPONENT_1 || type == CKA_EXPONENT_2 ||
++ type == CKA_COEFFICIENT) {
++ sensitiveAttrs.put(type, attr);
++ } else {
++ nonSensitiveAttrs.add(attr);
++ }
++ }
++ }
++}
+ }
+diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Constants.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Constants.java
+index d22844cfba8..9e02958b4b0 100644
+--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Constants.java
++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Constants.java
+@@ -1104,17 +1104,6 @@ public interface PKCS11Constants {
+ public static final long CKD_BLAKE2B_384_KDF = 0x00000019L;
+ public static final long CKD_BLAKE2B_512_KDF = 0x0000001aL;
+
+- public static final long CKP_PKCS5_PBKD2_HMAC_SHA1 = 0x00000001L;
+- public static final long CKP_PKCS5_PBKD2_HMAC_GOSTR3411 = 0x00000002L;
+- public static final long CKP_PKCS5_PBKD2_HMAC_SHA224 = 0x00000003L;
+- public static final long CKP_PKCS5_PBKD2_HMAC_SHA256 = 0x00000004L;
+- public static final long CKP_PKCS5_PBKD2_HMAC_SHA384 = 0x00000005L;
+- public static final long CKP_PKCS5_PBKD2_HMAC_SHA512 = 0x00000006L;
+- public static final long CKP_PKCS5_PBKD2_HMAC_SHA512_224 = 0x00000007L;
+- public static final long CKP_PKCS5_PBKD2_HMAC_SHA512_256 = 0x00000008L;
+-
+- public static final long CKZ_SALT_SPECIFIED = 0x00000001L;
+-
+ public static final long CK_OTP_VALUE = 0x00000000L;
+ public static final long CK_OTP_PIN = 0x00000001L;
+ public static final long CK_OTP_CHALLENGE = 0x00000002L;
+@@ -1150,12 +1139,23 @@ public interface PKCS11Constants {
+ public static final long CKF_HKDF_SALT_KEY = 0x00000004L;
+ */
+
++ // PBKDF2 support, used in P11Util
++ public static final long CKZ_SALT_SPECIFIED = 0x00000001L;
++ public static final long CKP_PKCS5_PBKD2_HMAC_SHA1 = 0x00000001L;
++ public static final long CKP_PKCS5_PBKD2_HMAC_GOSTR3411 = 0x00000002L;
++ public static final long CKP_PKCS5_PBKD2_HMAC_SHA224 = 0x00000003L;
++ public static final long CKP_PKCS5_PBKD2_HMAC_SHA256 = 0x00000004L;
++ public static final long CKP_PKCS5_PBKD2_HMAC_SHA384 = 0x00000005L;
++ public static final long CKP_PKCS5_PBKD2_HMAC_SHA512 = 0x00000006L;
++ public static final long CKP_PKCS5_PBKD2_HMAC_SHA512_224 = 0x00000007L;
++ public static final long CKP_PKCS5_PBKD2_HMAC_SHA512_256 = 0x00000008L;
++
+ // private NSS attribute (for DSA and DH private keys)
+ public static final long CKA_NETSCAPE_DB = 0xD5A0DB00L;
+
+ // base number of NSS private attributes
+ public static final long CKA_NETSCAPE_BASE /*0x80000000L + 0x4E534350L*/
+- = 0xCE534350L;
++ /* now known as CKM_NSS ^ */ = 0xCE534350L;
+
+ // object type for NSS trust
+ public static final long CKO_NETSCAPE_TRUST = 0xCE534353L;
+@@ -1180,4 +1180,14 @@ public interface PKCS11Constants {
+ = 0xCE534355L;
+ public static final long CKT_NETSCAPE_VALID = 0xCE53435AL;
+ public static final long CKT_NETSCAPE_VALID_DELEGATOR = 0xCE53435BL;
++
++ // Additional PKCS #12 PBE key derivation algorithms defined in NSS v3.29
++ public static final long CKM_NSS_PKCS12_PBE_SHA224_HMAC_KEY_GEN
++ /* (CKM_NSS + 29) */ = 0xCE53436DL;
++ public static final long CKM_NSS_PKCS12_PBE_SHA256_HMAC_KEY_GEN
++ /* (CKM_NSS + 30) */ = 0xCE53436EL;
++ public static final long CKM_NSS_PKCS12_PBE_SHA384_HMAC_KEY_GEN
++ /* (CKM_NSS + 31) */ = 0xCE53436FL;
++ public static final long CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN
++ /* (CKM_NSS + 32) */ = 0xCE534370L;
+ }
+diff --git a/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c b/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c
+index 666c5eb9b3b..5523dafcdb4 100644
+--- a/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c
++++ b/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c
+@@ -1515,6 +1515,10 @@ CK_VOID_PTR jMechParamToCKMechParamPtrSlow(JNIEnv *env, jobject jParam,
+ case CKM_PBE_SHA1_DES3_EDE_CBC:
+ case CKM_PBE_SHA1_DES2_EDE_CBC:
+ case CKM_PBA_SHA1_WITH_SHA1_HMAC:
++ case CKM_NSS_PKCS12_PBE_SHA224_HMAC_KEY_GEN:
++ case CKM_NSS_PKCS12_PBE_SHA256_HMAC_KEY_GEN:
++ case CKM_NSS_PKCS12_PBE_SHA384_HMAC_KEY_GEN:
++ case CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN:
+ ckpParamPtr = jPbeParamToCKPbeParamPtr(env, jParam, ckpLength);
+ break;
+ case CKM_PKCS5_PBKD2:
+@@ -1658,13 +1662,13 @@ jPbeParamToCKPbeParamPtr(JNIEnv *env, jobject jParam, CK_ULONG *pLength)
+ // retrieve java values
+ jPbeParamsClass = (*env)->FindClass(env, CLASS_PBE_PARAMS);
+ if (jPbeParamsClass == NULL) { return NULL; }
+- fieldID = (*env)->GetFieldID(env, jPbeParamsClass, "pInitVector", "[C");
++ fieldID = (*env)->GetFieldID(env, jPbeParamsClass, "pInitVector", "[B");
+ if (fieldID == NULL) { return NULL; }
+ jInitVector = (*env)->GetObjectField(env, jParam, fieldID);
+ fieldID = (*env)->GetFieldID(env, jPbeParamsClass, "pPassword", "[C");
+ if (fieldID == NULL) { return NULL; }
+ jPassword = (*env)->GetObjectField(env, jParam, fieldID);
+- fieldID = (*env)->GetFieldID(env, jPbeParamsClass, "pSalt", "[C");
++ fieldID = (*env)->GetFieldID(env, jPbeParamsClass, "pSalt", "[B");
+ if (fieldID == NULL) { return NULL; }
+ jSalt = (*env)->GetObjectField(env, jParam, fieldID);
+ fieldID = (*env)->GetFieldID(env, jPbeParamsClass, "ulIteration", "J");
+@@ -1680,15 +1684,15 @@ jPbeParamToCKPbeParamPtr(JNIEnv *env, jobject jParam, CK_ULONG *pLength)
+
+ // populate using java values
+ ckParamPtr->ulIteration = jLongToCKULong(jIteration);
+- jCharArrayToCKCharArray(env, jInitVector, &(ckParamPtr->pInitVector), &ckTemp);
++ jByteArrayToCKByteArray(env, jInitVector, &(ckParamPtr->pInitVector), &ckTemp);
+ if ((*env)->ExceptionCheck(env)) {
+ goto cleanup;
+ }
+- jCharArrayToCKCharArray(env, jPassword, &(ckParamPtr->pPassword), &(ckParamPtr->ulPasswordLen));
++ jCharArrayToCKUTF8CharArray(env, jPassword, &(ckParamPtr->pPassword), &(ckParamPtr->ulPasswordLen));
+ if ((*env)->ExceptionCheck(env)) {
+ goto cleanup;
+ }
+- jCharArrayToCKCharArray(env, jSalt, &(ckParamPtr->pSalt), &(ckParamPtr->ulSaltLen));
++ jByteArrayToCKByteArray(env, jSalt, &(ckParamPtr->pSalt), &(ckParamPtr->ulSaltLen));
+ if ((*env)->ExceptionCheck(env)) {
+ goto cleanup;
+ }
+@@ -1767,31 +1771,59 @@ void copyBackPBEInitializationVector(JNIEnv *env, CK_MECHANISM *ckMechanism, job
+ }
+ }
+
++#define PBKD2_PARAM_SET(member, value) \
++ do { \
++ if(ckParamPtr->version == PARAMS) { \
++ ckParamPtr->params.v1.member = value; \
++ } else { \
++ ckParamPtr->params.v2.member = value; \
++ } \
++ } while(0)
++
++#define PBKD2_PARAM_ADDR(member) \
++ ( \
++ (ckParamPtr->version == PARAMS) ? \
++ (void*) &ckParamPtr->params.v1.member : \
++ (void*) &ckParamPtr->params.v2.member \
++ )
++
+ /*
+- * converts the Java CK_PKCS5_PBKD2_PARAMS object to a CK_PKCS5_PBKD2_PARAMS
++ * converts a Java CK_PKCS5_PBKD2_PARAMS object to a CK_PKCS5_PBKD2_PARAMS
++ * pointer, or a Java CK_PKCS5_PBKD2_PARAMS2 object to a CK_PKCS5_PBKD2_PARAMS2
+ * pointer
+ *
+- * @param env - used to call JNI funktions to get the Java classes and objects
+- * @param jParam - the Java CK_PKCS5_PBKD2_PARAMS object to convert
++ * @param env - used to call JNI functions to get the Java classes and objects
++ * @param jParam - the Java object to convert
+ * @param pLength - length of the allocated memory of the returned pointer
+- * @return pointer to the new CK_PKCS5_PBKD2_PARAMS structure
++ * @return pointer to the new structure
+ */
+-CK_PKCS5_PBKD2_PARAMS_PTR
++CK_VOID_PTR
+ jPkcs5Pbkd2ParamToCKPkcs5Pbkd2ParamPtr(JNIEnv *env, jobject jParam, CK_ULONG *pLength)
+ {
+- CK_PKCS5_PBKD2_PARAMS_PTR ckParamPtr;
++ VersionedPbkd2ParamsPtr ckParamPtr;
++ ParamVersion paramVersion;
++ CK_ULONG_PTR pUlPasswordLen;
+ jclass jPkcs5Pbkd2ParamsClass;
+ jfieldID fieldID;
+ jlong jSaltSource, jIteration, jPrf;
+- jobject jSaltSourceData, jPrfData;
++ jobject jSaltSourceData, jPrfData, jPassword;
+
+ if (pLength != NULL) {
+ *pLength = 0L;
+ }
+
+ // retrieve java values
+- jPkcs5Pbkd2ParamsClass = (*env)->FindClass(env, CLASS_PKCS5_PBKD2_PARAMS);
+- if (jPkcs5Pbkd2ParamsClass == NULL) { return NULL; }
++ if ((jPkcs5Pbkd2ParamsClass =
++ (*env)->FindClass(env, CLASS_PKCS5_PBKD2_PARAMS)) != NULL
++ && (*env)->IsInstanceOf(env, jParam, jPkcs5Pbkd2ParamsClass)) {
++ paramVersion = PARAMS;
++ } else if ((jPkcs5Pbkd2ParamsClass =
++ (*env)->FindClass(env, CLASS_PKCS5_PBKD2_PARAMS2)) != NULL
++ && (*env)->IsInstanceOf(env, jParam, jPkcs5Pbkd2ParamsClass)) {
++ paramVersion = PARAMS2;
++ } else {
++ return NULL;
++ }
+ fieldID = (*env)->GetFieldID(env, jPkcs5Pbkd2ParamsClass, "saltSource", "J");
+ if (fieldID == NULL) { return NULL; }
+ jSaltSource = (*env)->GetLongField(env, jParam, fieldID);
+@@ -1807,36 +1839,60 @@ jPkcs5Pbkd2ParamToCKPkcs5Pbkd2ParamPtr(JNIEnv *env, jobject jParam, CK_ULONG *pL
+ fieldID = (*env)->GetFieldID(env, jPkcs5Pbkd2ParamsClass, "pPrfData", "[B");
+ if (fieldID == NULL) { return NULL; }
+ jPrfData = (*env)->GetObjectField(env, jParam, fieldID);
++ fieldID = (*env)->GetFieldID(env, jPkcs5Pbkd2ParamsClass, "pPassword", "[C");
++ if (fieldID == NULL) { return NULL; }
++ jPassword = (*env)->GetObjectField(env, jParam, fieldID);
+
+- // allocate memory for CK_PKCS5_PBKD2_PARAMS pointer
+- ckParamPtr = calloc(1, sizeof(CK_PKCS5_PBKD2_PARAMS));
++ // allocate memory for VersionedPbkd2Params and store the structure version
++ ckParamPtr = calloc(1, sizeof(VersionedPbkd2Params));
+ if (ckParamPtr == NULL) {
+ throwOutOfMemoryError(env, 0);
+ return NULL;
+ }
++ ckParamPtr->version = paramVersion;
+
+ // populate using java values
+- ckParamPtr->saltSource = jLongToCKULong(jSaltSource);
+- jByteArrayToCKByteArray(env, jSaltSourceData, (CK_BYTE_PTR *)
+- &(ckParamPtr->pSaltSourceData), &(ckParamPtr->ulSaltSourceDataLen));
++ PBKD2_PARAM_SET(saltSource, jLongToCKULong(jSaltSource));
++ jByteArrayToCKByteArray(env, jSaltSourceData,
++ (CK_BYTE_PTR *) PBKD2_PARAM_ADDR(pSaltSourceData),
++ PBKD2_PARAM_ADDR(ulSaltSourceDataLen));
+ if ((*env)->ExceptionCheck(env)) {
+ goto cleanup;
+ }
+- ckParamPtr->iterations = jLongToCKULong(jIteration);
+- ckParamPtr->prf = jLongToCKULong(jPrf);
+- jByteArrayToCKByteArray(env, jPrfData, (CK_BYTE_PTR *)
+- &(ckParamPtr->pPrfData), &(ckParamPtr->ulPrfDataLen));
++ PBKD2_PARAM_SET(iterations, jLongToCKULong(jIteration));
++ PBKD2_PARAM_SET(prf, jLongToCKULong(jPrf));
++ jByteArrayToCKByteArray(env, jPrfData,
++ (CK_BYTE_PTR *) PBKD2_PARAM_ADDR(pPrfData),
++ PBKD2_PARAM_ADDR(ulPrfDataLen));
++ if ((*env)->ExceptionCheck(env)) {
++ goto cleanup;
++ }
++ if (ckParamPtr->version == PARAMS) {
++ pUlPasswordLen = calloc(1, sizeof(CK_ULONG));
++ if (pUlPasswordLen == NULL) {
++ throwOutOfMemoryError(env, 0);
++ goto cleanup;
++ }
++ ckParamPtr->params.v1.ulPasswordLen = pUlPasswordLen;
++ } else {
++ pUlPasswordLen = &ckParamPtr->params.v2.ulPasswordLen;
++ }
++ jCharArrayToCKUTF8CharArray(env, jPassword,
++ (CK_CHAR_PTR *) PBKD2_PARAM_ADDR(pPassword),
++ pUlPasswordLen);
+ if ((*env)->ExceptionCheck(env)) {
+ goto cleanup;
+ }
+
+ if (pLength != NULL) {
+- *pLength = sizeof(CK_PKCS5_PBKD2_PARAMS);
++ *pLength = (ckParamPtr->version == PARAMS ?
++ sizeof(ckParamPtr->params.v1) :
++ sizeof(ckParamPtr->params.v2));
+ }
++ // VersionedPbkd2ParamsPtr is equivalent to CK_PKCS5_PBKD2_PARAMS[2]_PTR
+ return ckParamPtr;
+ cleanup:
+- free(ckParamPtr->pSaltSourceData);
+- free(ckParamPtr->pPrfData);
++ FREE_VERSIONED_PBKD2_MEMBERS(ckParamPtr);
+ free(ckParamPtr);
+ return NULL;
+
+diff --git a/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_util.c b/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_util.c
+index 520bd52a2cd..aa76945283d 100644
+--- a/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_util.c
++++ b/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_util.c
+@@ -410,11 +410,27 @@ void freeCKMechanismPtr(CK_MECHANISM_PTR mechPtr) {
+ case CKM_CAMELLIA_CTR:
+ // params do not contain pointers
+ break;
++ case CKM_PKCS5_PBKD2:
++ // get the versioned structure from behind memory
++ TRACE0(((VersionedPbkd2ParamsPtr)tmp)->version == PARAMS ?
++ "[ CK_PKCS5_PBKD2_PARAMS ]\n" :
++ "[ CK_PKCS5_PBKD2_PARAMS2 ]\n");
++ FREE_VERSIONED_PBKD2_MEMBERS((VersionedPbkd2ParamsPtr)tmp);
++ break;
++ case CKM_PBA_SHA1_WITH_SHA1_HMAC:
++ case CKM_NSS_PKCS12_PBE_SHA224_HMAC_KEY_GEN:
++ case CKM_NSS_PKCS12_PBE_SHA256_HMAC_KEY_GEN:
++ case CKM_NSS_PKCS12_PBE_SHA384_HMAC_KEY_GEN:
++ case CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN:
++ free(((CK_PBE_PARAMS_PTR)tmp)->pInitVector);
++ free(((CK_PBE_PARAMS_PTR)tmp)->pPassword);
++ free(((CK_PBE_PARAMS_PTR)tmp)->pSalt);
++ break;
+ default:
+ // currently unsupported mechs by SunPKCS11 provider
+ // CKM_RSA_PKCS_OAEP, CKM_ECMQV_DERIVE,
+ // CKM_X9_42_*, CKM_KEA_DERIVE, CKM_RC2_*, CKM_RC5_*,
+- // CKM_SKIPJACK_*, CKM_KEY_WRAP_SET_OAEP, CKM_PKCS5_PBKD2,
++ // CKM_SKIPJACK_*, CKM_KEY_WRAP_SET_OAEP,
+ // PBE mechs, WTLS mechs, CMS mechs,
+ // CKM_EXTRACT_KEY_FROM_KEY, CKM_OTP, CKM_KIP,
+ // CKM_DSA_PARAMETER_GEN?, CKM_GOSTR3410_*
+@@ -517,12 +533,11 @@ void jBooleanArrayToCKBBoolArray(JNIEnv *env, const jbooleanArray jArray, CK_BBO
+ jboolean* jpTemp;
+ CK_ULONG i;
+
+- if(jArray == NULL) {
++ *ckpLength = jArray == NULL ? 0L : (*env)->GetArrayLength(env, jArray);
++ if(*ckpLength == 0L) {
+ *ckpArray = NULL_PTR;
+- *ckpLength = 0L;
+ return;
+ }
+- *ckpLength = (*env)->GetArrayLength(env, jArray);
+ jpTemp = (jboolean*) calloc(*ckpLength, sizeof(jboolean));
+ if (jpTemp == NULL) {
+ throwOutOfMemoryError(env, 0);
+@@ -559,12 +574,11 @@ void jByteArrayToCKByteArray(JNIEnv *env, const jbyteArray jArray, CK_BYTE_PTR *
+ jbyte* jpTemp;
+ CK_ULONG i;
+
+- if(jArray == NULL) {
++ *ckpLength = jArray == NULL ? 0L : (*env)->GetArrayLength(env, jArray);
++ if(*ckpLength == 0L) {
+ *ckpArray = NULL_PTR;
+- *ckpLength = 0L;
+ return;
+ }
+- *ckpLength = (*env)->GetArrayLength(env, jArray);
+ jpTemp = (jbyte*) calloc(*ckpLength, sizeof(jbyte));
+ if (jpTemp == NULL) {
+ throwOutOfMemoryError(env, 0);
+@@ -606,12 +620,11 @@ void jLongArrayToCKULongArray(JNIEnv *env, const jlongArray jArray, CK_ULONG_PTR
+ jlong* jTemp;
+ CK_ULONG i;
+
+- if(jArray == NULL) {
++ *ckpLength = jArray == NULL ? 0L : (*env)->GetArrayLength(env, jArray);
++ if(*ckpLength == 0L) {
+ *ckpArray = NULL_PTR;
+- *ckpLength = 0L;
+ return;
+ }
+- *ckpLength = (*env)->GetArrayLength(env, jArray);
+ jTemp = (jlong*) calloc(*ckpLength, sizeof(jlong));
+ if (jTemp == NULL) {
+ throwOutOfMemoryError(env, 0);
+@@ -648,12 +661,11 @@ void jCharArrayToCKCharArray(JNIEnv *env, const jcharArray jArray, CK_CHAR_PTR *
+ jchar* jpTemp;
+ CK_ULONG i;
+
+- if(jArray == NULL) {
++ *ckpLength = jArray == NULL ? 0L : (*env)->GetArrayLength(env, jArray);
++ if(*ckpLength == 0L) {
+ *ckpArray = NULL_PTR;
+- *ckpLength = 0L;
+ return;
+ }
+- *ckpLength = (*env)->GetArrayLength(env, jArray);
+ jpTemp = (jchar*) calloc(*ckpLength, sizeof(jchar));
+ if (jpTemp == NULL) {
+ throwOutOfMemoryError(env, 0);
+@@ -690,12 +702,11 @@ void jCharArrayToCKUTF8CharArray(JNIEnv *env, const jcharArray jArray, CK_UTF8CH
+ jchar* jTemp;
+ CK_ULONG i;
+
+- if(jArray == NULL) {
++ *ckpLength = jArray == NULL ? 0L : (*env)->GetArrayLength(env, jArray);
++ if(*ckpLength == 0L) {
+ *ckpArray = NULL_PTR;
+- *ckpLength = 0L;
+ return;
+ }
+- *ckpLength = (*env)->GetArrayLength(env, jArray);
+ jTemp = (jchar*) calloc(*ckpLength, sizeof(jchar));
+ if (jTemp == NULL) {
+ throwOutOfMemoryError(env, 0);
+diff --git a/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11wrapper.h b/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11wrapper.h
+index eb6d01b9e47..450e4d27d62 100644
+--- a/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11wrapper.h
++++ b/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11wrapper.h
+@@ -68,6 +68,7 @@
+ /* extra PKCS#11 constants not in the standard include files */
+
+ #define CKA_NETSCAPE_BASE (0x80000000 + 0x4E534350)
++/* ^ now known as CKM_NSS (CKM_VENDOR_DEFINED | NSSCK_VENDOR_NSS) */
+ #define CKA_NETSCAPE_TRUST_BASE (CKA_NETSCAPE_BASE + 0x2000)
+ #define CKA_NETSCAPE_TRUST_SERVER_AUTH (CKA_NETSCAPE_TRUST_BASE + 8)
+ #define CKA_NETSCAPE_TRUST_CLIENT_AUTH (CKA_NETSCAPE_TRUST_BASE + 9)
+@@ -76,6 +77,12 @@
+ #define CKA_NETSCAPE_DB 0xD5A0DB00
+ #define CKM_NSS_TLS_PRF_GENERAL 0x80000373
+
++/* additional PKCS #12 PBE key derivation algorithms defined in NSS v3.29 */
++#define CKM_NSS_PKCS12_PBE_SHA224_HMAC_KEY_GEN (CKA_NETSCAPE_BASE + 29)
++#define CKM_NSS_PKCS12_PBE_SHA256_HMAC_KEY_GEN (CKA_NETSCAPE_BASE + 30)
++#define CKM_NSS_PKCS12_PBE_SHA384_HMAC_KEY_GEN (CKA_NETSCAPE_BASE + 31)
++#define CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN (CKA_NETSCAPE_BASE + 32)
++
+ /*
+
+ Define the PKCS#11 functions to include and exclude. Reduces the size
+@@ -265,6 +272,7 @@ void printDebug(const char *format, ...);
+ #define CLASS_PBE_PARAMS "sun/security/pkcs11/wrapper/CK_PBE_PARAMS"
+ #define PBE_INIT_VECTOR_SIZE 8
+ #define CLASS_PKCS5_PBKD2_PARAMS "sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS"
++#define CLASS_PKCS5_PBKD2_PARAMS2 "sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS2"
+ #define CLASS_EXTRACT_PARAMS "sun/security/pkcs11/wrapper/CK_EXTRACT_PARAMS"
+
+ #define CLASS_ECDH1_DERIVE_PARAMS "sun/security/pkcs11/wrapper/CK_ECDH1_DERIVE_PARAMS"
+@@ -378,7 +386,7 @@ CK_VOID_PTR jMechParamToCKMechParamPtr(JNIEnv *env, jobject jParam, CK_MECHANISM
+ CK_RSA_PKCS_OAEP_PARAMS_PTR jRsaPkcsOaepParamToCKRsaPkcsOaepParamPtr(JNIEnv *env,
+ jobject jParam, CK_ULONG* pLength);
+ CK_PBE_PARAMS_PTR jPbeParamToCKPbeParamPtr(JNIEnv *env, jobject jParam, CK_ULONG* pLength);
+-CK_PKCS5_PBKD2_PARAMS_PTR jPkcs5Pbkd2ParamToCKPkcs5Pbkd2ParamPtr(JNIEnv *env, jobject jParam, CK_ULONG* pLength);
++CK_VOID_PTR jPkcs5Pbkd2ParamToCKPkcs5Pbkd2ParamPtr(JNIEnv *env, jobject jParam, CK_ULONG* pLength);
+ CK_SSL3_MASTER_KEY_DERIVE_PARAMS_PTR jSsl3MasterKeyDeriveParamToCKSsl3MasterKeyDeriveParamPtr(JNIEnv *env, jobject jParam, CK_ULONG* pLength);
+ CK_SSL3_KEY_MAT_PARAMS_PTR jSsl3KeyMatParamToCKSsl3KeyMatParamPtr(JNIEnv *env, jobject jParam, CK_ULONG* pLength);
+ CK_KEY_DERIVATION_STRING_DATA jKeyDerivationStringDataToCKKeyDerivationStringData(JNIEnv *env, jobject jParam);
+@@ -388,6 +396,31 @@ CK_ECDH2_DERIVE_PARAMS_PTR jEcdh2DeriveParamToCKEcdh2DeriveParamPtr(JNIEnv *env,
+ CK_X9_42_DH1_DERIVE_PARAMS_PTR jX942Dh1DeriveParamToCKX942Dh1DeriveParamPtr(JNIEnv *env, jobject jParam, CK_ULONG* pLength);
+ CK_X9_42_DH2_DERIVE_PARAMS_PTR jX942Dh2DeriveParamToCKX942Dh2DeriveParamPtr(JNIEnv *env, jobject jParam, CK_ULONG* pLength);
+
++/* handling of CK_PKCS5_PBKD2_PARAMS and CK_PKCS5_PBKD2_PARAMS2 */
++typedef enum {PARAMS=0, PARAMS2} ParamVersion;
++
++typedef struct {
++ union {
++ CK_PKCS5_PBKD2_PARAMS v1;
++ CK_PKCS5_PBKD2_PARAMS2 v2;
++ } params;
++ ParamVersion version;
++} VersionedPbkd2Params, *VersionedPbkd2ParamsPtr;
++
++#define FREE_VERSIONED_PBKD2_MEMBERS(verParamsPtr) \
++ do { \
++ if ((verParamsPtr)->version == PARAMS) { \
++ free((verParamsPtr)->params.v1.pSaltSourceData); \
++ free((verParamsPtr)->params.v1.pPrfData); \
++ free((verParamsPtr)->params.v1.pPassword); \
++ free((verParamsPtr)->params.v1.ulPasswordLen); \
++ } else { \
++ free((verParamsPtr)->params.v2.pSaltSourceData); \
++ free((verParamsPtr)->params.v2.pPrfData); \
++ free((verParamsPtr)->params.v2.pPassword); \
++ } \
++ } while(0)
++
+ /* functions to copy the returned values inside CK-mechanism back to Java object */
+
+ void copyBackPBEInitializationVector(JNIEnv *env, CK_MECHANISM *ckMechanism, jobject jMechanism);
+diff --git a/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java b/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
+index 8c9e4f9dbe6..883dc04758e 100644
+--- a/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
++++ b/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
+@@ -38,6 +38,7 @@ import java.util.HashMap;
+ import java.util.Iterator;
+ import java.util.List;
+
++import jdk.internal.access.SharedSecrets;
+ import sun.security.ec.ed.EdDSAAlgorithmParameters;
+ import sun.security.ec.ed.EdDSAKeyFactory;
+ import sun.security.ec.ed.EdDSAKeyPairGenerator;
+@@ -56,6 +57,10 @@ public final class SunEC extends Provider {
+
+ private static final long serialVersionUID = -2279741672933606418L;
+
++ private static final boolean systemFipsEnabled =
++ SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
++ .isSystemFipsEnabled();
++
+ private static class ProviderServiceA extends ProviderService {
+ ProviderServiceA(Provider p, String type, String algo, String cn,
+ HashMap attrs) {
+@@ -249,85 +254,86 @@ public final class SunEC extends Provider {
+
+ putXDHEntries();
+ putEdDSAEntries();
+-
+- /*
+- * Signature engines
+- */
+- putService(new ProviderService(this, "Signature",
+- "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw",
+- null, ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1",
+- ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224",
+- ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256",
+- ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384",
+- ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512",
+- ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224",
+- ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256",
+- ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384",
+- ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512",
+- ATTRS));
+-
+- putService(new ProviderService(this, "Signature",
+- "NONEwithECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$RawinP1363Format"));
+- putService(new ProviderService(this, "Signature",
+- "SHA1withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA1inP1363Format"));
+- putService(new ProviderService(this, "Signature",
+- "SHA224withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA224inP1363Format"));
+- putService(new ProviderService(this, "Signature",
+- "SHA256withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA256inP1363Format"));
+- putService(new ProviderService(this, "Signature",
+- "SHA384withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA384inP1363Format"));
+- putService(new ProviderService(this, "Signature",
+- "SHA512withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA512inP1363Format"));
+-
+- putService(new ProviderService(this, "Signature",
+- "SHA3-224withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA3_224inP1363Format"));
+- putService(new ProviderService(this, "Signature",
+- "SHA3-256withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA3_256inP1363Format"));
+- putService(new ProviderService(this, "Signature",
+- "SHA3-384withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA3_384inP1363Format"));
+- putService(new ProviderService(this, "Signature",
+- "SHA3-512withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA3_512inP1363Format"));
+-
+- /*
+- * Key Pair Generator engine
+- */
+- putService(new ProviderService(this, "KeyPairGenerator",
+- "EC", "sun.security.ec.ECKeyPairGenerator",
+- List.of("EllipticCurve"), ATTRS));
+-
+- /*
+- * Key Agreement engine
+- */
+- putService(new ProviderService(this, "KeyAgreement",
+- "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS));
++ if (!systemFipsEnabled) {
++ /*
++ * Signature engines
++ */
++ putService(new ProviderService(this, "Signature",
++ "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw",
++ null, ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1",
++ ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224",
++ ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256",
++ ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384",
++ ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512",
++ ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224",
++ ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256",
++ ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384",
++ ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512",
++ ATTRS));
++
++ putService(new ProviderService(this, "Signature",
++ "NONEwithECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$RawinP1363Format"));
++ putService(new ProviderService(this, "Signature",
++ "SHA1withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA1inP1363Format"));
++ putService(new ProviderService(this, "Signature",
++ "SHA224withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA224inP1363Format"));
++ putService(new ProviderService(this, "Signature",
++ "SHA256withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA256inP1363Format"));
++ putService(new ProviderService(this, "Signature",
++ "SHA384withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA384inP1363Format"));
++ putService(new ProviderService(this, "Signature",
++ "SHA512withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA512inP1363Format"));
++
++ putService(new ProviderService(this, "Signature",
++ "SHA3-224withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA3_224inP1363Format"));
++ putService(new ProviderService(this, "Signature",
++ "SHA3-256withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA3_256inP1363Format"));
++ putService(new ProviderService(this, "Signature",
++ "SHA3-384withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA3_384inP1363Format"));
++ putService(new ProviderService(this, "Signature",
++ "SHA3-512withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA3_512inP1363Format"));
++
++ /*
++ * Key Pair Generator engine
++ */
++ putService(new ProviderService(this, "KeyPairGenerator",
++ "EC", "sun.security.ec.ECKeyPairGenerator",
++ List.of("EllipticCurve"), ATTRS));
++
++ /*
++ * Key Agreement engine
++ */
++ putService(new ProviderService(this, "KeyAgreement",
++ "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS));
++ }
+ }
+
+ private void putXDHEntries() {
+@@ -344,23 +350,25 @@ public final class SunEC extends Provider {
+ "X448", "sun.security.ec.XDHKeyFactory.X448",
+ ATTRS));
+
+- putService(new ProviderService(this, "KeyPairGenerator",
+- "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS));
+- putService(new ProviderServiceA(this, "KeyPairGenerator",
+- "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519",
+- ATTRS));
+- putService(new ProviderServiceA(this, "KeyPairGenerator",
+- "X448", "sun.security.ec.XDHKeyPairGenerator.X448",
+- ATTRS));
+-
+- putService(new ProviderService(this, "KeyAgreement",
+- "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS));
+- putService(new ProviderServiceA(this, "KeyAgreement",
+- "X25519", "sun.security.ec.XDHKeyAgreement.X25519",
+- ATTRS));
+- putService(new ProviderServiceA(this, "KeyAgreement",
+- "X448", "sun.security.ec.XDHKeyAgreement.X448",
+- ATTRS));
++ if (!systemFipsEnabled) {
++ putService(new ProviderService(this, "KeyPairGenerator",
++ "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS));
++ putService(new ProviderServiceA(this, "KeyPairGenerator",
++ "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519",
++ ATTRS));
++ putService(new ProviderServiceA(this, "KeyPairGenerator",
++ "X448", "sun.security.ec.XDHKeyPairGenerator.X448",
++ ATTRS));
++
++ putService(new ProviderService(this, "KeyAgreement",
++ "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS));
++ putService(new ProviderServiceA(this, "KeyAgreement",
++ "X25519", "sun.security.ec.XDHKeyAgreement.X25519",
++ ATTRS));
++ putService(new ProviderServiceA(this, "KeyAgreement",
++ "X448", "sun.security.ec.XDHKeyAgreement.X448",
++ ATTRS));
++ }
+ }
+
+ private void putEdDSAEntries() {
+@@ -375,21 +383,23 @@ public final class SunEC extends Provider {
+ putService(new ProviderServiceA(this, "KeyFactory",
+ "Ed448", "sun.security.ec.ed.EdDSAKeyFactory.Ed448", ATTRS));
+
+- putService(new ProviderService(this, "KeyPairGenerator",
+- "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS));
+- putService(new ProviderServiceA(this, "KeyPairGenerator",
+- "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519",
+- ATTRS));
+- putService(new ProviderServiceA(this, "KeyPairGenerator",
+- "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448",
+- ATTRS));
+-
+- putService(new ProviderService(this, "Signature",
+- "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS));
++ if (!systemFipsEnabled) {
++ putService(new ProviderService(this, "KeyPairGenerator",
++ "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS));
++ putService(new ProviderServiceA(this, "KeyPairGenerator",
++ "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519",
++ ATTRS));
++ putService(new ProviderServiceA(this, "KeyPairGenerator",
++ "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448",
++ ATTRS));
++
++ putService(new ProviderService(this, "Signature",
++ "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS));
++ }
+
+ }
+ }
diff --git a/SOURCES/jdk8293834-kyiv_cldr_update.patch b/SOURCES/jdk8293834-kyiv_cldr_update.patch
new file mode 100644
index 0000000..b8dda24
--- /dev/null
+++ b/SOURCES/jdk8293834-kyiv_cldr_update.patch
@@ -0,0 +1,51 @@
+diff --git a/make/data/cldr/common/bcp47/timezone.xml b/make/data/cldr/common/bcp47/timezone.xml
+index 41ff6d236c8..e703020dcdd 100644
+--- a/make/data/cldr/common/bcp47/timezone.xml
++++ b/make/data/cldr/common/bcp47/timezone.xml
+@@ -393,7 +393,7 @@ For terms of use, see http://www.unicode.org/copyright.html
+
+Date: Wed Oct 5 07:13:43 2022 +0000
+
+ 8294357: (tz) Update Timezone Data to 2022d
+
+ Backport-of: f01573368f905f27d26f1d07d9cfd26dcc736a54
+
+diff --git a/make/data/tzdata/VERSION b/make/data/tzdata/VERSION
+index decb8716b22..889d0e6dad7 100644
+--- a/make/data/tzdata/VERSION
++++ b/make/data/tzdata/VERSION
+@@ -21,4 +21,4 @@
+ # or visit www.oracle.com if you need additional information or have any
+ # questions.
+ #
+-tzdata2022c
++tzdata2022d
+diff --git a/make/data/tzdata/asia b/make/data/tzdata/asia
+index 3a150b0f36b..f9df7432947 100644
+--- a/make/data/tzdata/asia
++++ b/make/data/tzdata/asia
+@@ -3398,10 +3398,6 @@ Zone Asia/Karachi 4:28:12 - LMT 1907
+ # The winter time in 2015 started on October 23 at 01:00.
+ # https://wafa.ps/ar_page.aspx?id=CgpCdYa670694628582aCgpCdY
+ # http://www.palestinecabinet.gov.ps/portal/meeting/details/27583
+-#
+-# From Paul Eggert (2019-04-10):
+-# For now, guess spring-ahead transitions are at 00:00 on the Saturday
+-# preceding March's last Sunday (i.e., Sat>=24).
+
+ # From P Chan (2021-10-18):
+ # http://wafa.ps/Pages/Details/34701
+@@ -3418,6 +3414,18 @@ Zone Asia/Karachi 4:28:12 - LMT 1907
+ # From Heba Hamad (2022-03-10):
+ # summer time will begin in Palestine from Sunday 03-27-2022, 00:00 AM.
+
++# From Heba Hamad (2022-08-30):
++# winter time will begin in Palestine from Saturday 10-29, 02:00 AM by
++# 60 minutes backwards. Also the state of Palestine adopted the summer
++# and winter time for the years: 2023,2024,2025,2026 ...
++# https://mm.icann.org/pipermail/tz/attachments/20220830/9f024566/Time-0001.pdf
++# (2022-08-31): ... the Saturday before the last Sunday in March and October
++# at 2:00 AM ,for the years from 2023 to 2026.
++# (2022-09-05): https://mtit.pna.ps/Site/New/1453
++#
++# From Paul Eggert (2022-08-31):
++# For now, assume that this rule will also be used after 2026.
++
+ # Rule NAME FROM TO - IN ON AT SAVE LETTER/S
+ Rule EgyptAsia 1957 only - May 10 0:00 1:00 S
+ Rule EgyptAsia 1957 1958 - Oct 1 0:00 0 -
+@@ -3448,14 +3456,16 @@ Rule Palestine 2013 only - Sep 27 0:00 0 -
+ Rule Palestine 2014 only - Oct 24 0:00 0 -
+ Rule Palestine 2015 only - Mar 28 0:00 1:00 S
+ Rule Palestine 2015 only - Oct 23 1:00 0 -
+-Rule Palestine 2016 2018 - Mar Sat>=24 1:00 1:00 S
+-Rule Palestine 2016 2018 - Oct Sat>=24 1:00 0 -
++Rule Palestine 2016 2018 - Mar Sat<=30 1:00 1:00 S
++Rule Palestine 2016 2018 - Oct Sat<=30 1:00 0 -
+ Rule Palestine 2019 only - Mar 29 0:00 1:00 S
+-Rule Palestine 2019 only - Oct Sat>=24 0:00 0 -
+-Rule Palestine 2020 2021 - Mar Sat>=24 0:00 1:00 S
++Rule Palestine 2019 only - Oct Sat<=30 0:00 0 -
++Rule Palestine 2020 2021 - Mar Sat<=30 0:00 1:00 S
+ Rule Palestine 2020 only - Oct 24 1:00 0 -
+-Rule Palestine 2021 max - Oct Fri>=23 1:00 0 -
+-Rule Palestine 2022 max - Mar Sun>=25 0:00 1:00 S
++Rule Palestine 2021 only - Oct 29 1:00 0 -
++Rule Palestine 2022 only - Mar 27 0:00 1:00 S
++Rule Palestine 2022 max - Oct Sat<=30 2:00 0 -
++Rule Palestine 2023 max - Mar Sat<=30 2:00 1:00 S
+
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+ Zone Asia/Gaza 2:17:52 - LMT 1900 Oct
+diff --git a/make/data/tzdata/backward b/make/data/tzdata/backward
+index d4a29e8cf29..7765d99aedf 100644
+--- a/make/data/tzdata/backward
++++ b/make/data/tzdata/backward
+@@ -113,6 +113,8 @@ Link Etc/UTC Etc/UCT
+ Link Europe/London Europe/Belfast
+ Link Europe/Kyiv Europe/Kiev
+ Link Europe/Chisinau Europe/Tiraspol
++Link Europe/Kyiv Europe/Uzhgorod
++Link Europe/Kyiv Europe/Zaporozhye
+ Link Europe/London GB
+ Link Europe/London GB-Eire
+ Link Etc/GMT GMT+0
+diff --git a/make/data/tzdata/europe b/make/data/tzdata/europe
+index 879b5337536..accc845dbaf 100644
+--- a/make/data/tzdata/europe
++++ b/make/data/tzdata/europe
+@@ -2638,10 +2638,14 @@ Zone Europe/Simferopol 2:16:24 - LMT 1880
+ # From Alexander Krivenyshev (2014-03-17):
+ # time change at 2:00 (2am) on March 30, 2014
+ # https://vz.ru/news/2014/3/17/677464.html
+-# From Paul Eggert (2014-03-30):
+-# Simferopol and Sevastopol reportedly changed their central town clocks
+-# late the previous day, but this appears to have been ceremonial
+-# and the discrepancies are small enough to not worry about.
++# From Tim Parenti (2022-07-01), per Paul Eggert (2014-03-30):
++# The clocks at the railway station in Simferopol were put forward from 22:00
++# to 24:00 the previous day in a "symbolic ceremony"; however, per
++# contemporaneous news reports, "ordinary Crimeans [made] the daylight savings
++# time switch at 2am" on Sunday.
++# https://www.business-standard.com/article/pti-stories/crimea-to-set-clocks-to-russia-time-114033000014_1.html
++# https://www.reuters.com/article/us-ukraine-crisis-crimea-time/crimea-switches-to-moscow-time-amid-incorporation-frenzy-idUKBREA2S0LT20140329
++# https://www.bbc.com/news/av/world-europe-26806583
+ 2:00 EU EE%sT 2014 Mar 30 2:00
+ 4:00 - MSK 2014 Oct 26 2:00s
+ 3:00 - MSK
+@@ -3774,8 +3778,8 @@ Link Europe/Istanbul Asia/Istanbul # Istanbul is in both continents.
+ # US colleague David Cochrane) are still trying to get more
+ # information upon these local deviations from Kiev rules.
+ #
+-# From Paul Eggert (2022-02-08):
+-# For now, assume that Ukraine's other three zones followed the same rules,
++# From Paul Eggert (2022-08-27):
++# For now, assume that Ukraine's zones all followed the same rules,
+ # except that Crimea switched to Moscow time in 1994 as described elsewhere.
+
+ # From Igor Karpov, who works for the Ukrainian Ministry of Justice,
+@@ -3845,21 +3849,7 @@ Link Europe/Istanbul Asia/Istanbul # Istanbul is in both continents.
+ # * Ukrainian Government's Resolution of 20.03.1992, No. 139.
+ # http://www.uazakon.com/documents/date_8u/pg_grcasa.htm
+
+-# From Paul Eggert (2022-04-12):
+-# As is usual in tzdb, Ukrainian zones use the most common English spellings.
+-# In particular, tzdb's name Europe/Kyiv uses the most common spelling in
+-# English for Ukraine's capital. Although tzdb's former name was Europe/Kiev,
+-# "Kyiv" is now more common due to widespread reporting of the current conflict.
+-# Conversely, tzdb continues to use the names Europe/Uzhgorod and
+-# Europe/Zaporozhye; this is similar to tzdb's use of Europe/Prague, which is
+-# certainly wrong as a transliteration of the Czech "Praha".
+-# English-language spelling of Ukrainian names is in flux, and
+-# some day "Uzhhorod" or "Zaporizhzhia" may become substantially more
+-# common in English; in the meantime, do not change these
+-# English spellings as that means less disruption for our users.
+-
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+-# This represents most of Ukraine. See above for the spelling of "Kyiv".
+ Zone Europe/Kyiv 2:02:04 - LMT 1880
+ 2:02:04 - KMT 1924 May 2 # Kyiv Mean Time
+ 2:00 - EET 1930 Jun 21
+@@ -3869,34 +3859,6 @@ Zone Europe/Kyiv 2:02:04 - LMT 1880
+ 2:00 1:00 EEST 1991 Sep 29 3:00
+ 2:00 C-Eur EE%sT 1996 May 13
+ 2:00 EU EE%sT
+-# Transcarpathia used CET 1990/1991.
+-# "Uzhhorod" is the transliteration of the Rusyn/Ukrainian pronunciation, but
+-# "Uzhgorod" is more common in English.
+-Zone Europe/Uzhgorod 1:29:12 - LMT 1890 Oct
+- 1:00 - CET 1940
+- 1:00 C-Eur CE%sT 1944 Oct
+- 1:00 1:00 CEST 1944 Oct 26
+- 1:00 - CET 1945 Jun 29
+- 3:00 Russia MSK/MSD 1990
+- 3:00 - MSK 1990 Jul 1 2:00
+- 1:00 - CET 1991 Mar 31 3:00
+- 2:00 - EET 1992 Mar 20
+- 2:00 C-Eur EE%sT 1996 May 13
+- 2:00 EU EE%sT
+-# Zaporozh'ye and eastern Lugansk oblasts observed DST 1990/1991.
+-# "Zaporizhzhia" is the transliteration of the Ukrainian name, but
+-# "Zaporozh'ye" is more common in English. Use the common English
+-# spelling, except omit the apostrophe as it is not allowed in
+-# portable Posix file names.
+-Zone Europe/Zaporozhye 2:20:40 - LMT 1880
+- 2:20 - +0220 1924 May 2
+- 2:00 - EET 1930 Jun 21
+- 3:00 - MSK 1941 Aug 25
+- 1:00 C-Eur CE%sT 1943 Oct 25
+- 3:00 Russia MSK/MSD 1991 Mar 31 2:00
+- 2:00 E-Eur EE%sT 1992 Mar 20
+- 2:00 C-Eur EE%sT 1996 May 13
+- 2:00 EU EE%sT
+
+ # Vatican City
+ # See Europe/Rome.
+diff --git a/make/data/tzdata/southamerica b/make/data/tzdata/southamerica
+index 13ec081c7e0..3c0e0e2061c 100644
+--- a/make/data/tzdata/southamerica
++++ b/make/data/tzdata/southamerica
+@@ -1332,8 +1332,14 @@ Zone America/Rio_Branco -4:31:12 - LMT 1914
+ # for America/Santiago will start on midnight of September 11th;
+ # and will end on April 1st, 2023. Magallanes region (America/Punta_Arenas)
+ # will keep UTC -3 "indefinitely"... This is because on September 4th
+-# we will have a voting whether to approve a new Constitution....
+-# https://www.interior.gob.cl/noticias/2022/08/09/comunicado-el-proximo-sabado-10-de-septiembre-los-relojes-se-deben-adelantar-una-hora/
++# we will have a voting whether to approve a new Constitution.
++#
++# From Eduardo Romero Urra (2022-08-17):
++# https://www.diariooficial.interior.gob.cl/publicaciones/2022/08/13/43327/01/2172567.pdf
++#
++# From Paul Eggert (2022-08-17):
++# Although the presidential decree stops at fall 2026, assume that
++# similar DST rules will continue thereafter.
+
+ # Rule NAME FROM TO - IN ON AT SAVE LETTER/S
+ Rule Chile 1927 1931 - Sep 1 0:00 1:00 -
+diff --git a/make/data/tzdata/zone.tab b/make/data/tzdata/zone.tab
+index 51b65fa273c..ee025196e50 100644
+--- a/make/data/tzdata/zone.tab
++++ b/make/data/tzdata/zone.tab
+@@ -424,8 +424,6 @@ TV -0831+17913 Pacific/Funafuti
+ TW +2503+12130 Asia/Taipei
+ TZ -0648+03917 Africa/Dar_es_Salaam
+ UA +5026+03031 Europe/Kyiv Ukraine (most areas)
+-UA +4837+02218 Europe/Uzhgorod Transcarpathia
+-UA +4750+03510 Europe/Zaporozhye Zaporozhye and east Lugansk
+ UG +0019+03225 Africa/Kampala
+ UM +2813-17722 Pacific/Midway Midway Islands
+ UM +1917+16637 Pacific/Wake Wake Island
+diff --git a/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java b/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
+index 15c2f0d1275..6f6e190efcd 100644
+--- a/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
++++ b/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
+@@ -574,12 +574,8 @@ public final class ZoneInfoFile {
+ // we can then pass in the dom = -1, dow > 0 into ZoneInfo
+ //
+ // hacking, assume the >=24 is the result of ZRB optimization for
+- // "last", it works for now. From tzdata2020d this hacking
+- // will not work for Asia/Gaza and Asia/Hebron which follow
+- // Palestine DST rules.
+- if (dom < 0 || dom >= 24 &&
+- !(zoneId.equals("Asia/Gaza") ||
+- zoneId.equals("Asia/Hebron"))) {
++ // "last", it works for now.
++ if (dom < 0 || dom >= 24) {
+ params[1] = -1;
+ params[2] = toCalendarDOW[dow];
+ } else {
+@@ -601,7 +597,6 @@ public final class ZoneInfoFile {
+ params[7] = 0;
+ } else {
+ // hacking: see comment above
+- // No need of hacking for Asia/Gaza and Asia/Hebron from tz2021e
+ if (dom < 0 || dom >= 24) {
+ params[6] = -1;
+ params[7] = toCalendarDOW[dow];
+diff --git a/test/jdk/java/util/TimeZone/TimeZoneData/VERSION b/test/jdk/java/util/TimeZone/TimeZoneData/VERSION
+index c32bee39fba..71470168456 100644
+--- a/test/jdk/java/util/TimeZone/TimeZoneData/VERSION
++++ b/test/jdk/java/util/TimeZone/TimeZoneData/VERSION
+@@ -1 +1 @@
+-tzdata2022c
++tzdata2022d
+diff --git a/test/jdk/java/util/TimeZone/TimeZoneData/aliases.txt b/test/jdk/java/util/TimeZone/TimeZoneData/aliases.txt
+index a5e6428a3f5..e3ce742f887 100644
+--- a/test/jdk/java/util/TimeZone/TimeZoneData/aliases.txt
++++ b/test/jdk/java/util/TimeZone/TimeZoneData/aliases.txt
+@@ -183,6 +183,8 @@ Link Etc/UTC Etc/UCT
+ Link Europe/London Europe/Belfast
+ Link Europe/Kyiv Europe/Kiev
+ Link Europe/Chisinau Europe/Tiraspol
++Link Europe/Kyiv Europe/Uzhgorod
++Link Europe/Kyiv Europe/Zaporozhye
+ Link Europe/London GB
+ Link Europe/London GB-Eire
+ Link Etc/GMT GMT+0
+diff --git a/test/jdk/java/util/TimeZone/TimeZoneData/displaynames.txt b/test/jdk/java/util/TimeZone/TimeZoneData/displaynames.txt
+index fc148537f1f..b3823958ae4 100644
+--- a/test/jdk/java/util/TimeZone/TimeZoneData/displaynames.txt
++++ b/test/jdk/java/util/TimeZone/TimeZoneData/displaynames.txt
+@@ -163,11 +163,9 @@ Europe/Simferopol MSK
+ Europe/Sofia EET EEST
+ Europe/Tallinn EET EEST
+ Europe/Tirane CET CEST
+-Europe/Uzhgorod EET EEST
+ Europe/Vienna CET CEST
+ Europe/Vilnius EET EEST
+ Europe/Warsaw CET CEST
+-Europe/Zaporozhye EET EEST
+ Europe/Zurich CET CEST
+ HST HST
+ MET MET MEST
+diff --git a/test/jdk/sun/util/calendar/zi/TestZoneInfo310.java b/test/jdk/sun/util/calendar/zi/TestZoneInfo310.java
+index 7b50c342a0d..a7d14f1aa21 100644
+--- a/test/jdk/sun/util/calendar/zi/TestZoneInfo310.java
++++ b/test/jdk/sun/util/calendar/zi/TestZoneInfo310.java
+@@ -176,11 +176,12 @@ public class TestZoneInfo310 {
+ * save time in IANA tzdata. This bug is tracked via JDK-8223388.
+ *
+ * These are the zones/rules that employ negative DST in vanguard
+- * format (as of 2019a):
++ * format (as of 2019a), Palestine added in 2022d:
+ *
+ * - Rule "Eire"
+ * - Rule "Morocco"
+ * - Rule "Namibia"
++ * - Rule "Palestine"
+ * - Zone "Europe/Prague"
+ *
+ * Tehran/Iran rule has rules beyond 2037, in which javazic assumes
+@@ -196,6 +197,8 @@ public class TestZoneInfo310 {
+ zid.equals("Europe/Dublin") || // uses "Eire" rule
+ zid.equals("Europe/Prague") ||
+ zid.equals("Asia/Tehran") || // last rule mismatch
++ zid.equals("Asia/Gaza") || // uses "Palestine" rule
++ zid.equals("Asia/Hebron") || // uses "Palestine" rule
+ zid.equals("Iran")) { // last rule mismatch
+ continue;
+ }
diff --git a/SOURCES/jdk8295173-tzdata2022e.patch b/SOURCES/jdk8295173-tzdata2022e.patch
new file mode 100644
index 0000000..8ffd2ee
--- /dev/null
+++ b/SOURCES/jdk8295173-tzdata2022e.patch
@@ -0,0 +1,420 @@
+commit d159a377e0243bd2c80593689fd7cd20b2b578f7
+Author: duke
+Date: Fri Oct 14 03:37:19 2022 +0000
+
+ Backport 21407dec0156301871a83328615e4d975c4287c4
+
+diff --git a/make/data/tzdata/VERSION b/make/data/tzdata/VERSION
+index 889d0e6dad7..b8cb36e69f4 100644
+--- a/make/data/tzdata/VERSION
++++ b/make/data/tzdata/VERSION
+@@ -21,4 +21,4 @@
+ # or visit www.oracle.com if you need additional information or have any
+ # questions.
+ #
+-tzdata2022d
++tzdata2022e
+diff --git a/make/data/tzdata/asia b/make/data/tzdata/asia
+index f9df7432947..5b2337fd0b6 100644
+--- a/make/data/tzdata/asia
++++ b/make/data/tzdata/asia
+@@ -2254,6 +2254,17 @@ Zone Asia/Tokyo 9:18:59 - LMT 1887 Dec 31 15:00u
+ # From the Arabic version, it seems to say it would be at midnight
+ # (assume 24:00) on the last Thursday in February, starting from 2022.
+
++# From Issam Al-Zuwairi (2022-10-05):
++# The Council of Ministers in Jordan decided Wednesday 5th October 2022,
++# that daylight saving time (DST) will be throughout the year....
++#
++# From Brian Inglis (2022-10-06):
++# https://petra.gov.jo/Include/InnerPage.jsp?ID=45567&lang=en&name=en_news
++#
++# From Paul Eggert (2022-10-05):
++# Like Syria, model this as a transition from EEST +03 (DST) to plain +03
++# (non-DST) at the point where DST would otherwise have ended.
++
+ # Rule NAME FROM TO - IN ON AT SAVE LETTER/S
+ Rule Jordan 1973 only - Jun 6 0:00 1:00 S
+ Rule Jordan 1973 1975 - Oct 1 0:00 0 -
+@@ -2285,11 +2296,12 @@ Rule Jordan 2005 only - Sep lastFri 0:00s 0 -
+ Rule Jordan 2006 2011 - Oct lastFri 0:00s 0 -
+ Rule Jordan 2013 only - Dec 20 0:00 0 -
+ Rule Jordan 2014 2021 - Mar lastThu 24:00 1:00 S
+-Rule Jordan 2014 max - Oct lastFri 0:00s 0 -
+-Rule Jordan 2022 max - Feb lastThu 24:00 1:00 S
++Rule Jordan 2014 2022 - Oct lastFri 0:00s 0 -
++Rule Jordan 2022 only - Feb lastThu 24:00 1:00 S
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+ Zone Asia/Amman 2:23:44 - LMT 1931
+- 2:00 Jordan EE%sT
++ 2:00 Jordan EE%sT 2022 Oct 28 0:00s
++ 3:00 - +03
+
+
+ # Kazakhstan
+@@ -3838,19 +3850,27 @@ Rule Syria 2007 only - Nov Fri>=1 0:00 0 -
+ # Our brief summary:
+ # https://www.timeanddate.com/news/time/syria-dst-2012.html
+
+-# From Arthur David Olson (2012-03-27):
+-# Assume last Friday in March going forward XXX.
++# From Steffen Thorsen (2022-10-05):
++# Syria is adopting year-round DST, starting this autumn....
++# From https://www.enabbaladi.net/archives/607812
++# "This [the decision] came after the weekly government meeting today,
++# Tuesday 4 October ..."
++#
++# From Paul Eggert (2022-10-05):
++# Like Jordan, model this as a transition from EEST +03 (DST) to plain +03
++# (non-DST) at the point where DST would otherwise have ended.
+
+ Rule Syria 2008 only - Apr Fri>=1 0:00 1:00 S
+ Rule Syria 2008 only - Nov 1 0:00 0 -
+ Rule Syria 2009 only - Mar lastFri 0:00 1:00 S
+ Rule Syria 2010 2011 - Apr Fri>=1 0:00 1:00 S
+-Rule Syria 2012 max - Mar lastFri 0:00 1:00 S
+-Rule Syria 2009 max - Oct lastFri 0:00 0 -
++Rule Syria 2012 2022 - Mar lastFri 0:00 1:00 S
++Rule Syria 2009 2022 - Oct lastFri 0:00 0 -
+
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+ Zone Asia/Damascus 2:25:12 - LMT 1920 # Dimashq
+- 2:00 Syria EE%sT
++ 2:00 Syria EE%sT 2022 Oct 28 0:00
++ 3:00 - +03
+
+ # Tajikistan
+ # From Shanks & Pottenger.
+diff --git a/make/data/tzdata/europe b/make/data/tzdata/europe
+index accc845dbaf..2832c4b9763 100644
+--- a/make/data/tzdata/europe
++++ b/make/data/tzdata/europe
+@@ -3417,7 +3417,7 @@ Zone Europe/Madrid -0:14:44 - LMT 1901 Jan 1 0:00u
+ 0:00 Spain WE%sT 1940 Mar 16 23:00
+ 1:00 Spain CE%sT 1979
+ 1:00 EU CE%sT
+-Zone Africa/Ceuta -0:21:16 - LMT 1900 Dec 31 23:38:44
++Zone Africa/Ceuta -0:21:16 - LMT 1901 Jan 1 0:00u
+ 0:00 - WET 1918 May 6 23:00
+ 0:00 1:00 WEST 1918 Oct 7 23:00
+ 0:00 - WET 1924
+diff --git a/make/data/tzdata/northamerica b/make/data/tzdata/northamerica
+index 114cef14cce..ce4ee74582c 100644
+--- a/make/data/tzdata/northamerica
++++ b/make/data/tzdata/northamerica
+@@ -462,7 +462,7 @@ Rule Chicago 1922 1966 - Apr lastSun 2:00 1:00 D
+ Rule Chicago 1922 1954 - Sep lastSun 2:00 0 S
+ Rule Chicago 1955 1966 - Oct lastSun 2:00 0 S
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+-Zone America/Chicago -5:50:36 - LMT 1883 Nov 18 12:09:24
++Zone America/Chicago -5:50:36 - LMT 1883 Nov 18 18:00u
+ -6:00 US C%sT 1920
+ -6:00 Chicago C%sT 1936 Mar 1 2:00
+ -5:00 - EST 1936 Nov 15 2:00
+@@ -471,7 +471,7 @@ Zone America/Chicago -5:50:36 - LMT 1883 Nov 18 12:09:24
+ -6:00 Chicago C%sT 1967
+ -6:00 US C%sT
+ # Oliver County, ND switched from mountain to central time on 1992-10-25.
+-Zone America/North_Dakota/Center -6:45:12 - LMT 1883 Nov 18 12:14:48
++Zone America/North_Dakota/Center -6:45:12 - LMT 1883 Nov 18 19:00u
+ -7:00 US M%sT 1992 Oct 25 2:00
+ -6:00 US C%sT
+ # Morton County, ND, switched from mountain to central time on
+@@ -481,7 +481,7 @@ Zone America/North_Dakota/Center -6:45:12 - LMT 1883 Nov 18 12:14:48
+ # Jones, Mellette, and Todd Counties in South Dakota;
+ # but in practice these other counties were already observing central time.
+ # See .
+-Zone America/North_Dakota/New_Salem -6:45:39 - LMT 1883 Nov 18 12:14:21
++Zone America/North_Dakota/New_Salem -6:45:39 - LMT 1883 Nov 18 19:00u
+ -7:00 US M%sT 2003 Oct 26 2:00
+ -6:00 US C%sT
+
+@@ -498,7 +498,7 @@ Zone America/North_Dakota/New_Salem -6:45:39 - LMT 1883 Nov 18 12:14:21
+ # largest city in Mercer County). Google Maps places Beulah's city hall
+ # at 47° 15' 51" N, 101° 46' 40" W, which yields an offset of 6h47'07".
+
+-Zone America/North_Dakota/Beulah -6:47:07 - LMT 1883 Nov 18 12:12:53
++Zone America/North_Dakota/Beulah -6:47:07 - LMT 1883 Nov 18 19:00u
+ -7:00 US M%sT 2010 Nov 7 2:00
+ -6:00 US C%sT
+
+@@ -530,7 +530,7 @@ Rule Denver 1921 only - May 22 2:00 0 S
+ Rule Denver 1965 1966 - Apr lastSun 2:00 1:00 D
+ Rule Denver 1965 1966 - Oct lastSun 2:00 0 S
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+-Zone America/Denver -6:59:56 - LMT 1883 Nov 18 12:00:04
++Zone America/Denver -6:59:56 - LMT 1883 Nov 18 19:00u
+ -7:00 US M%sT 1920
+ -7:00 Denver M%sT 1942
+ -7:00 US M%sT 1946
+@@ -583,7 +583,7 @@ Rule CA 1950 1966 - Apr lastSun 1:00 1:00 D
+ Rule CA 1950 1961 - Sep lastSun 2:00 0 S
+ Rule CA 1962 1966 - Oct lastSun 2:00 0 S
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+-Zone America/Los_Angeles -7:52:58 - LMT 1883 Nov 18 12:07:02
++Zone America/Los_Angeles -7:52:58 - LMT 1883 Nov 18 20:00u
+ -8:00 US P%sT 1946
+ -8:00 CA P%sT 1967
+ -8:00 US P%sT
+@@ -845,7 +845,7 @@ Zone Pacific/Honolulu -10:31:26 - LMT 1896 Jan 13 12:00
+ # Go with the Arizona State Library instead.
+
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+-Zone America/Phoenix -7:28:18 - LMT 1883 Nov 18 11:31:42
++Zone America/Phoenix -7:28:18 - LMT 1883 Nov 18 19:00u
+ -7:00 US M%sT 1944 Jan 1 0:01
+ -7:00 - MST 1944 Apr 1 0:01
+ -7:00 US M%sT 1944 Oct 1 0:01
+@@ -873,7 +873,7 @@ Link America/Phoenix America/Creston
+ # switched four weeks late in 1974.
+ #
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+-Zone America/Boise -7:44:49 - LMT 1883 Nov 18 12:15:11
++Zone America/Boise -7:44:49 - LMT 1883 Nov 18 20:00u
+ -8:00 US P%sT 1923 May 13 2:00
+ -7:00 US M%sT 1974
+ -7:00 - MST 1974 Feb 3 2:00
+@@ -945,7 +945,7 @@ Rule Indianapolis 1941 only - Jun 22 2:00 1:00 D
+ Rule Indianapolis 1941 1954 - Sep lastSun 2:00 0 S
+ Rule Indianapolis 1946 1954 - Apr lastSun 2:00 1:00 D
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+-Zone America/Indiana/Indianapolis -5:44:38 - LMT 1883 Nov 18 12:15:22
++Zone America/Indiana/Indianapolis -5:44:38 - LMT 1883 Nov 18 18:00u
+ -6:00 US C%sT 1920
+ -6:00 Indianapolis C%sT 1942
+ -6:00 US C%sT 1946
+@@ -965,7 +965,7 @@ Rule Marengo 1951 only - Sep lastSun 2:00 0 S
+ Rule Marengo 1954 1960 - Apr lastSun 2:00 1:00 D
+ Rule Marengo 1954 1960 - Sep lastSun 2:00 0 S
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+-Zone America/Indiana/Marengo -5:45:23 - LMT 1883 Nov 18 12:14:37
++Zone America/Indiana/Marengo -5:45:23 - LMT 1883 Nov 18 18:00u
+ -6:00 US C%sT 1951
+ -6:00 Marengo C%sT 1961 Apr 30 2:00
+ -5:00 - EST 1969
+@@ -989,7 +989,7 @@ Rule Vincennes 1960 only - Oct lastSun 2:00 0 S
+ Rule Vincennes 1961 only - Sep lastSun 2:00 0 S
+ Rule Vincennes 1962 1963 - Oct lastSun 2:00 0 S
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+-Zone America/Indiana/Vincennes -5:50:07 - LMT 1883 Nov 18 12:09:53
++Zone America/Indiana/Vincennes -5:50:07 - LMT 1883 Nov 18 18:00u
+ -6:00 US C%sT 1946
+ -6:00 Vincennes C%sT 1964 Apr 26 2:00
+ -5:00 - EST 1969
+@@ -1009,7 +1009,7 @@ Rule Perry 1955 1960 - Sep lastSun 2:00 0 S
+ Rule Perry 1956 1963 - Apr lastSun 2:00 1:00 D
+ Rule Perry 1961 1963 - Oct lastSun 2:00 0 S
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+-Zone America/Indiana/Tell_City -5:47:03 - LMT 1883 Nov 18 12:12:57
++Zone America/Indiana/Tell_City -5:47:03 - LMT 1883 Nov 18 18:00u
+ -6:00 US C%sT 1946
+ -6:00 Perry C%sT 1964 Apr 26 2:00
+ -5:00 - EST 1967 Oct 29 2:00
+@@ -1026,7 +1026,7 @@ Rule Pike 1955 1960 - Sep lastSun 2:00 0 S
+ Rule Pike 1956 1964 - Apr lastSun 2:00 1:00 D
+ Rule Pike 1961 1964 - Oct lastSun 2:00 0 S
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+-Zone America/Indiana/Petersburg -5:49:07 - LMT 1883 Nov 18 12:10:53
++Zone America/Indiana/Petersburg -5:49:07 - LMT 1883 Nov 18 18:00u
+ -6:00 US C%sT 1955
+ -6:00 Pike C%sT 1965 Apr 25 2:00
+ -5:00 - EST 1966 Oct 30 2:00
+@@ -1048,7 +1048,7 @@ Rule Starke 1955 1956 - Oct lastSun 2:00 0 S
+ Rule Starke 1957 1958 - Sep lastSun 2:00 0 S
+ Rule Starke 1959 1961 - Oct lastSun 2:00 0 S
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+-Zone America/Indiana/Knox -5:46:30 - LMT 1883 Nov 18 12:13:30
++Zone America/Indiana/Knox -5:46:30 - LMT 1883 Nov 18 18:00u
+ -6:00 US C%sT 1947
+ -6:00 Starke C%sT 1962 Apr 29 2:00
+ -5:00 - EST 1963 Oct 27 2:00
+@@ -1064,7 +1064,7 @@ Rule Pulaski 1946 1954 - Sep lastSun 2:00 0 S
+ Rule Pulaski 1955 1956 - Oct lastSun 2:00 0 S
+ Rule Pulaski 1957 1960 - Sep lastSun 2:00 0 S
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+-Zone America/Indiana/Winamac -5:46:25 - LMT 1883 Nov 18 12:13:35
++Zone America/Indiana/Winamac -5:46:25 - LMT 1883 Nov 18 18:00u
+ -6:00 US C%sT 1946
+ -6:00 Pulaski C%sT 1961 Apr 30 2:00
+ -5:00 - EST 1969
+@@ -1075,7 +1075,7 @@ Zone America/Indiana/Winamac -5:46:25 - LMT 1883 Nov 18 12:13:35
+ #
+ # Switzerland County, Indiana, did not observe DST from 1973 through 2005.
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+-Zone America/Indiana/Vevay -5:40:16 - LMT 1883 Nov 18 12:19:44
++Zone America/Indiana/Vevay -5:40:16 - LMT 1883 Nov 18 18:00u
+ -6:00 US C%sT 1954 Apr 25 2:00
+ -5:00 - EST 1969
+ -5:00 US E%sT 1973
+@@ -1111,7 +1111,7 @@ Rule Louisville 1950 1961 - Apr lastSun 2:00 1:00 D
+ Rule Louisville 1950 1955 - Sep lastSun 2:00 0 S
+ Rule Louisville 1956 1961 - Oct lastSun 2:00 0 S
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+-Zone America/Kentucky/Louisville -5:43:02 - LMT 1883 Nov 18 12:16:58
++Zone America/Kentucky/Louisville -5:43:02 - LMT 1883 Nov 18 18:00u
+ -6:00 US C%sT 1921
+ -6:00 Louisville C%sT 1942
+ -6:00 US C%sT 1946
+@@ -1145,7 +1145,7 @@ Zone America/Kentucky/Louisville -5:43:02 - LMT 1883 Nov 18 12:16:58
+ # Federal Register 65, 160 (2000-08-17), pp 50154-50158.
+ # https://www.gpo.gov/fdsys/pkg/FR-2000-08-17/html/00-20854.htm
+ #
+-Zone America/Kentucky/Monticello -5:39:24 - LMT 1883 Nov 18 12:20:36
++Zone America/Kentucky/Monticello -5:39:24 - LMT 1883 Nov 18 18:00u
+ -6:00 US C%sT 1946
+ -6:00 - CST 1968
+ -6:00 US C%sT 2000 Oct 29 2:00
+@@ -2640,6 +2640,8 @@ Zone America/Dawson -9:17:40 - LMT 1900 Aug 20
+ # longitude they are located at.
+
+ # Rule NAME FROM TO - IN ON AT SAVE LETTER/S
++Rule Mexico 1931 only - May 1 23:00 1:00 D
++Rule Mexico 1931 only - Oct 1 0:00 0 S
+ Rule Mexico 1939 only - Feb 5 0:00 1:00 D
+ Rule Mexico 1939 only - Jun 25 0:00 0 S
+ Rule Mexico 1940 only - Dec 9 0:00 1:00 D
+@@ -2656,13 +2658,13 @@ Rule Mexico 2002 max - Apr Sun>=1 2:00 1:00 D
+ Rule Mexico 2002 max - Oct lastSun 2:00 0 S
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+ # Quintana Roo; represented by Cancún
+-Zone America/Cancun -5:47:04 - LMT 1922 Jan 1 0:12:56
++Zone America/Cancun -5:47:04 - LMT 1922 Jan 1 6:00u
+ -6:00 - CST 1981 Dec 23
+ -5:00 Mexico E%sT 1998 Aug 2 2:00
+ -6:00 Mexico C%sT 2015 Feb 1 2:00
+ -5:00 - EST
+ # Campeche, Yucatán; represented by Mérida
+-Zone America/Merida -5:58:28 - LMT 1922 Jan 1 0:01:32
++Zone America/Merida -5:58:28 - LMT 1922 Jan 1 6:00u
+ -6:00 - CST 1981 Dec 23
+ -5:00 - EST 1982 Dec 2
+ -6:00 Mexico C%sT
+@@ -2676,23 +2678,21 @@ Zone America/Merida -5:58:28 - LMT 1922 Jan 1 0:01:32
+ # See: Inicia mañana Horario de Verano en zona fronteriza, El Universal,
+ # 2016-03-12
+ # http://www.eluniversal.com.mx/articulo/estados/2016/03/12/inicia-manana-horario-de-verano-en-zona-fronteriza
+-Zone America/Matamoros -6:40:00 - LMT 1921 Dec 31 23:20:00
++Zone America/Matamoros -6:30:00 - LMT 1922 Jan 1 6:00u
+ -6:00 - CST 1988
+ -6:00 US C%sT 1989
+ -6:00 Mexico C%sT 2010
+ -6:00 US C%sT
+ # Durango; Coahuila, Nuevo León, Tamaulipas (away from US border)
+-Zone America/Monterrey -6:41:16 - LMT 1921 Dec 31 23:18:44
++Zone America/Monterrey -6:41:16 - LMT 1922 Jan 1 6:00u
+ -6:00 - CST 1988
+ -6:00 US C%sT 1989
+ -6:00 Mexico C%sT
+ # Central Mexico
+-Zone America/Mexico_City -6:36:36 - LMT 1922 Jan 1 0:23:24
++Zone America/Mexico_City -6:36:36 - LMT 1922 Jan 1 7:00u
+ -7:00 - MST 1927 Jun 10 23:00
+ -6:00 - CST 1930 Nov 15
+- -7:00 - MST 1931 May 1 23:00
+- -6:00 - CST 1931 Oct
+- -7:00 - MST 1932 Apr 1
++ -7:00 Mexico M%sT 1932 Apr 1
+ -6:00 Mexico C%sT 2001 Sep 30 2:00
+ -6:00 - CST 2002 Feb 20
+ -6:00 Mexico C%sT
+@@ -2700,35 +2700,29 @@ Zone America/Mexico_City -6:36:36 - LMT 1922 Jan 1 0:23:24
+ # This includes the municipalities of Janos, Ascensión, Juárez, Guadalupe,
+ # Práxedis G Guerrero, Coyame del Sotol, Ojinaga, and Manuel Benavides.
+ # (See the 2016-03-12 El Universal source mentioned above.)
+-Zone America/Ojinaga -6:57:40 - LMT 1922 Jan 1 0:02:20
++Zone America/Ojinaga -6:57:40 - LMT 1922 Jan 1 7:00u
+ -7:00 - MST 1927 Jun 10 23:00
+ -6:00 - CST 1930 Nov 15
+- -7:00 - MST 1931 May 1 23:00
+- -6:00 - CST 1931 Oct
+- -7:00 - MST 1932 Apr 1
++ -7:00 Mexico M%sT 1932 Apr 1
+ -6:00 - CST 1996
+ -6:00 Mexico C%sT 1998
+ -6:00 - CST 1998 Apr Sun>=1 3:00
+ -7:00 Mexico M%sT 2010
+ -7:00 US M%sT
+ # Chihuahua (away from US border)
+-Zone America/Chihuahua -7:04:20 - LMT 1921 Dec 31 23:55:40
++Zone America/Chihuahua -7:04:20 - LMT 1922 Jan 1 7:00u
+ -7:00 - MST 1927 Jun 10 23:00
+ -6:00 - CST 1930 Nov 15
+- -7:00 - MST 1931 May 1 23:00
+- -6:00 - CST 1931 Oct
+- -7:00 - MST 1932 Apr 1
++ -7:00 Mexico M%sT 1932 Apr 1
+ -6:00 - CST 1996
+ -6:00 Mexico C%sT 1998
+ -6:00 - CST 1998 Apr Sun>=1 3:00
+ -7:00 Mexico M%sT
+ # Sonora
+-Zone America/Hermosillo -7:23:52 - LMT 1921 Dec 31 23:36:08
++Zone America/Hermosillo -7:23:52 - LMT 1922 Jan 1 7:00u
+ -7:00 - MST 1927 Jun 10 23:00
+ -6:00 - CST 1930 Nov 15
+- -7:00 - MST 1931 May 1 23:00
+- -6:00 - CST 1931 Oct
+- -7:00 - MST 1932 Apr 1
++ -7:00 Mexico M%sT 1932 Apr 1
+ -6:00 - CST 1942 Apr 24
+ -7:00 - MST 1949 Jan 14
+ -8:00 - PST 1970
+@@ -2763,24 +2757,20 @@ Zone America/Hermosillo -7:23:52 - LMT 1921 Dec 31 23:36:08
+ # Use "Bahia_Banderas" to keep the name to fourteen characters.
+
+ # Mazatlán
+-Zone America/Mazatlan -7:05:40 - LMT 1921 Dec 31 23:54:20
++Zone America/Mazatlan -7:05:40 - LMT 1922 Jan 1 7:00u
+ -7:00 - MST 1927 Jun 10 23:00
+ -6:00 - CST 1930 Nov 15
+- -7:00 - MST 1931 May 1 23:00
+- -6:00 - CST 1931 Oct
+- -7:00 - MST 1932 Apr 1
++ -7:00 Mexico M%sT 1932 Apr 1
+ -6:00 - CST 1942 Apr 24
+ -7:00 - MST 1949 Jan 14
+ -8:00 - PST 1970
+ -7:00 Mexico M%sT
+
+ # Bahía de Banderas
+-Zone America/Bahia_Banderas -7:01:00 - LMT 1921 Dec 31 23:59:00
++Zone America/Bahia_Banderas -7:01:00 - LMT 1922 Jan 1 7:00u
+ -7:00 - MST 1927 Jun 10 23:00
+ -6:00 - CST 1930 Nov 15
+- -7:00 - MST 1931 May 1 23:00
+- -6:00 - CST 1931 Oct
+- -7:00 - MST 1932 Apr 1
++ -7:00 Mexico M%sT 1932 Apr 1
+ -6:00 - CST 1942 Apr 24
+ -7:00 - MST 1949 Jan 14
+ -8:00 - PST 1970
+@@ -2788,7 +2778,7 @@ Zone America/Bahia_Banderas -7:01:00 - LMT 1921 Dec 31 23:59:00
+ -6:00 Mexico C%sT
+
+ # Baja California
+-Zone America/Tijuana -7:48:04 - LMT 1922 Jan 1 0:11:56
++Zone America/Tijuana -7:48:04 - LMT 1922 Jan 1 7:00u
+ -7:00 - MST 1924
+ -8:00 - PST 1927 Jun 10 23:00
+ -7:00 - MST 1930 Nov 15
+diff --git a/test/jdk/java/util/TimeZone/TimeZoneData/VERSION b/test/jdk/java/util/TimeZone/TimeZoneData/VERSION
+index 71470168456..0cad939008f 100644
+--- a/test/jdk/java/util/TimeZone/TimeZoneData/VERSION
++++ b/test/jdk/java/util/TimeZone/TimeZoneData/VERSION
+@@ -1 +1 @@
+-tzdata2022d
++tzdata2022e
+diff --git a/test/jdk/java/util/TimeZone/TimeZoneData/displaynames.txt b/test/jdk/java/util/TimeZone/TimeZoneData/displaynames.txt
+index b3823958ae4..2f2786f1c69 100644
+--- a/test/jdk/java/util/TimeZone/TimeZoneData/displaynames.txt
++++ b/test/jdk/java/util/TimeZone/TimeZoneData/displaynames.txt
+@@ -97,9 +97,7 @@ America/Winnipeg CST CDT
+ America/Yakutat AKST AKDT
+ America/Yellowknife MST MDT
+ Antarctica/Macquarie AEST AEDT
+-Asia/Amman EET EEST
+ Asia/Beirut EET EEST
+-Asia/Damascus EET EEST
+ Asia/Famagusta EET EEST
+ Asia/Gaza EET EEST
+ Asia/Hebron EET EEST
diff --git a/SOURCES/nss.fips.cfg.in b/SOURCES/nss.fips.cfg.in
index 1aff153..2d9ec35 100644
--- a/SOURCES/nss.fips.cfg.in
+++ b/SOURCES/nss.fips.cfg.in
@@ -4,3 +4,5 @@ nssSecmodDirectory = sql:/etc/pki/nssdb
nssDbMode = readOnly
nssModule = fips
+attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true }
+
diff --git a/SOURCES/pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch b/SOURCES/pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
deleted file mode 100644
index 4efbe9a..0000000
--- a/SOURCES/pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-
-# HG changeset patch
-# User andrew
-# Date 1478057514 0
-# Node ID 1c4d5cb2096ae55106111da200b0bcad304f650c
-# Parent 3d53f19b48384e5252f4ec8891f7a3a82d77af2a
-PR3183: Support Fedora/RHEL system crypto policy
-diff -r 3d53f19b4838 -r 1c4d5cb2096a src/java.base/share/classes/java/security/Security.java
---- a/src/java.base/share/classes/java/security/Security.java Wed Oct 26 03:51:39 2016 +0100
-+++ b/src/java.base/share/classes/java/security/Security.java Wed Nov 02 03:31:54 2016 +0000
-@@ -43,6 +43,9 @@
- * implementation-specific location, which is typically the properties file
- * {@code conf/security/java.security} in the Java installation directory.
- *
-+ * Additional default values of security properties are read from a
-+ * system-specific location, if available.
-+ *
- * @author Benjamin Renaud
- * @since 1.1
- */
-@@ -52,6 +55,10 @@
- private static final Debug sdebug =
- Debug.getInstance("properties");
-
-+ /* System property file*/
-+ private static final String SYSTEM_PROPERTIES =
-+ "/etc/crypto-policies/back-ends/java.config";
-+
- /* The java.security properties */
- private static Properties props;
-
-@@ -93,6 +100,7 @@
- if (sdebug != null) {
- sdebug.println("reading security properties file: " +
- propFile);
-+ sdebug.println(props.toString());
- }
- } catch (IOException e) {
- if (sdebug != null) {
-@@ -114,6 +122,31 @@
- }
-
- if ("true".equalsIgnoreCase(props.getProperty
-+ ("security.useSystemPropertiesFile"))) {
-+
-+ // now load the system file, if it exists, so its values
-+ // will win if they conflict with the earlier values
-+ try (BufferedInputStream bis =
-+ new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
-+ props.load(bis);
-+ loadedProps = true;
-+
-+ if (sdebug != null) {
-+ sdebug.println("reading system security properties file " +
-+ SYSTEM_PROPERTIES);
-+ sdebug.println(props.toString());
-+ }
-+ } catch (IOException e) {
-+ if (sdebug != null) {
-+ sdebug.println
-+ ("unable to load security properties from " +
-+ SYSTEM_PROPERTIES);
-+ e.printStackTrace();
-+ }
-+ }
-+ }
-+
-+ if ("true".equalsIgnoreCase(props.getProperty
- ("security.overridePropertiesFile"))) {
-
- String extraPropFile = System.getProperty
-diff -r 3d53f19b4838 -r 1c4d5cb2096a src/java.base/share/conf/security/java.security
---- a/src/java.base/share/conf/security/java.security Wed Oct 26 03:51:39 2016 +0100
-+++ b/src/java.base/share/conf/security/java.security Wed Nov 02 03:31:54 2016 +0000
-@@ -276,6 +276,13 @@
- security.overridePropertiesFile=true
-
- #
-+# Determines whether this properties file will be appended to
-+# using the system properties file stored at
-+# /etc/crypto-policies/back-ends/java.config
-+#
-+security.useSystemPropertiesFile=true
-+
-+#
- # Determines the default key and trust manager factory algorithms for
- # the javax.net.ssl package.
- #
diff --git a/SOURCES/pr3695-toggle_system_crypto_policy.patch b/SOURCES/pr3695-toggle_system_crypto_policy.patch
deleted file mode 100644
index 3799237..0000000
--- a/SOURCES/pr3695-toggle_system_crypto_policy.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-# HG changeset patch
-# User andrew
-# Date 1545198926 0
-# Wed Dec 19 05:55:26 2018 +0000
-# Node ID f2cbd688824c128db7fa848c8732fb0ab3507776
-# Parent 81f07f6d1f8b7b51b136d3974c61bc8bb513770c
-PR3695: Allow use of system crypto policy to be disabled by the user
-Summary: Read user overrides first so security.useSystemPropertiesFile can be disabled and add -Djava.security.disableSystemPropertiesFile
-
-diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java
---- a/src/java.base/share/classes/java/security/Security.java
-+++ b/src/java.base/share/classes/java/security/Security.java
-@@ -125,31 +125,6 @@
- }
-
- if ("true".equalsIgnoreCase(props.getProperty
-- ("security.useSystemPropertiesFile"))) {
--
-- // now load the system file, if it exists, so its values
-- // will win if they conflict with the earlier values
-- try (BufferedInputStream bis =
-- new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
-- props.load(bis);
-- loadedProps = true;
--
-- if (sdebug != null) {
-- sdebug.println("reading system security properties file " +
-- SYSTEM_PROPERTIES);
-- sdebug.println(props.toString());
-- }
-- } catch (IOException e) {
-- if (sdebug != null) {
-- sdebug.println
-- ("unable to load security properties from " +
-- SYSTEM_PROPERTIES);
-- e.printStackTrace();
-- }
-- }
-- }
--
-- if ("true".equalsIgnoreCase(props.getProperty
- ("security.overridePropertiesFile"))) {
-
- String extraPropFile = System.getProperty
-@@ -215,6 +190,33 @@
- }
- }
-
-+ String disableSystemProps = System.getProperty("java.security.disableSystemPropertiesFile");
-+ if (disableSystemProps == null &&
-+ "true".equalsIgnoreCase(props.getProperty
-+ ("security.useSystemPropertiesFile"))) {
-+
-+ // now load the system file, if it exists, so its values
-+ // will win if they conflict with the earlier values
-+ try (BufferedInputStream bis =
-+ new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
-+ props.load(bis);
-+ loadedProps = true;
-+
-+ if (sdebug != null) {
-+ sdebug.println("reading system security properties file " +
-+ SYSTEM_PROPERTIES);
-+ sdebug.println(props.toString());
-+ }
-+ } catch (IOException e) {
-+ if (sdebug != null) {
-+ sdebug.println
-+ ("unable to load security properties from " +
-+ SYSTEM_PROPERTIES);
-+ e.printStackTrace();
-+ }
-+ }
-+ }
-+
- if (!loadedProps) {
- initializeStatic();
- if (sdebug != null) {
diff --git a/SOURCES/remove-intree-libraries.sh b/SOURCES/remove-intree-libraries.sh
index e999c7e..25c2fc8 100644
--- a/SOURCES/remove-intree-libraries.sh
+++ b/SOURCES/remove-intree-libraries.sh
@@ -5,6 +5,7 @@ TREE=${1}
TYPE=${2}
ZIP_SRC=src/java.base/share/native/libzip/zlib/
+FREETYPE_SRC=src/java.desktop/share/native/libfreetype/
JPEG_SRC=src/java.desktop/share/native/libjavajpeg/
GIF_SRC=src/java.desktop/share/native/libsplashscreen/giflib/
PNG_SRC=src/java.desktop/share/native/libsplashscreen/libpng/
@@ -31,15 +32,21 @@ cd ${TREE}
echo "Removing built-in libs (they will be linked)"
-# On full runs, allow for zlib having already been deleted by minimal
+# On full runs, allow for zlib & freetype having already been deleted by minimal
echo "Removing zlib"
if [ "x${TYPE}" = "xminimal" -a ! -d ${ZIP_SRC} ]; then
echo "${ZIP_SRC} does not exist. Refusing to proceed."
exit 1
fi
rm -rvf ${ZIP_SRC}
+echo "Removing freetype"
+if [ "x${TYPE}" = "xminimal" -a ! -d ${FREETYPE_SRC} ]; then
+ echo "${FREETYPE_SRC} does not exist. Refusing to proceed."
+ exit 1
+fi
+rm -rvf ${FREETYPE_SRC}
-# Minimal is limited to just zlib so finish here
+# Minimal is limited to just zlib and freetype so finish here
if test "x${TYPE}" = "xminimal"; then
echo "Finished.";
exit 0;
diff --git a/SOURCES/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch b/SOURCES/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
index 7be1fae..6d2342a 100644
--- a/SOURCES/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
+++ b/SOURCES/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
@@ -1,7 +1,7 @@
-diff --git openjdk/src/java.base/share/conf/security/java.security openjdk/src/java.base/share/conf/security/java.security
-index 534bdae5a16..2df2b59cbf6 100644
---- openjdk/src/java.base/share/conf/security/java.security
-+++ openjdk/src/java.base/share/conf/security/java.security
+diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security
+index adfaf57d29e..abf89bbf327 100644
+--- a/src/java.base/share/conf/security/java.security
++++ b/src/java.base/share/conf/security/java.security
@@ -78,6 +78,7 @@ security.provider.tbd=SunMSCAPI
security.provider.tbd=Apple
#endif
@@ -9,4 +9,4 @@ index 534bdae5a16..2df2b59cbf6 100644
+#security.provider.tbd=SunPKCS11 ${java.home}/lib/security/nss.cfg
#
- # A list of preferred providers for specific algorithms. These providers will
+ # Security providers used when FIPS mode support is active
diff --git a/SOURCES/rh1655466-global_crypto_and_fips.patch b/SOURCES/rh1655466-global_crypto_and_fips.patch
deleted file mode 100644
index 80cd91c..0000000
--- a/SOURCES/rh1655466-global_crypto_and_fips.patch
+++ /dev/null
@@ -1,205 +0,0 @@
-diff --git a/src/java.base/share/classes/javopenjdk.orig///security/Security.java openjdk///src/java.base/share/classes/java/security/Security.java
---- openjdk.orig/src/java.base/share/classes/java/security/Security.java
-+++ openjdk/src/java.base/share/classes/java/security/Security.java
-@@ -196,26 +196,8 @@
- if (disableSystemProps == null &&
- "true".equalsIgnoreCase(props.getProperty
- ("security.useSystemPropertiesFile"))) {
--
-- // now load the system file, if it exists, so its values
-- // will win if they conflict with the earlier values
-- try (BufferedInputStream bis =
-- new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
-- props.load(bis);
-+ if (SystemConfigurator.configure(props)) {
- loadedProps = true;
--
-- if (sdebug != null) {
-- sdebug.println("reading system security properties file " +
-- SYSTEM_PROPERTIES);
-- sdebug.println(props.toString());
-- }
-- } catch (IOException e) {
-- if (sdebug != null) {
-- sdebug.println
-- ("unable to load security properties from " +
-- SYSTEM_PROPERTIES);
-- e.printStackTrace();
-- }
- }
- }
-
-diff --git a/src/java.base/share/classes/javopenjdk.orig///security/SystemConfigurator.java openjdk///src/java.base/share/classes/java/security/SystemConfigurator.java
-new file mode 100644
---- /dev/null
-+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
-@@ -0,0 +1,151 @@
-+/*
-+ * Copyright (c) 2019, Red Hat, Inc.
-+ *
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+package java.security;
-+
-+import java.io.BufferedInputStream;
-+import java.io.FileInputStream;
-+import java.io.IOException;
-+
-+import java.nio.file.Files;
-+import java.nio.file.Path;
-+
-+import java.util.Iterator;
-+import java.util.Map.Entry;
-+import java.util.Properties;
-+import java.util.function.Consumer;
-+import java.util.regex.Matcher;
-+import java.util.regex.Pattern;
-+
-+import sun.security.util.Debug;
-+
-+/**
-+ * Internal class to align OpenJDK with global crypto-policies.
-+ * Called from java.security.Security class initialization,
-+ * during startup.
-+ *
-+ */
-+
-+class SystemConfigurator {
-+
-+ private static final Debug sdebug =
-+ Debug.getInstance("properties");
-+
-+ private static final String CRYPTO_POLICIES_BASE_DIR =
-+ "/etc/crypto-policies";
-+
-+ private static final String CRYPTO_POLICIES_JAVA_CONFIG =
-+ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config";
-+
-+ private static final String CRYPTO_POLICIES_CONFIG =
-+ CRYPTO_POLICIES_BASE_DIR + "/config";
-+
-+ private static final class SecurityProviderInfo {
-+ int number;
-+ String key;
-+ String value;
-+ SecurityProviderInfo(int number, String key, String value) {
-+ this.number = number;
-+ this.key = key;
-+ this.value = value;
-+ }
-+ }
-+
-+ /*
-+ * Invoked when java.security.Security class is initialized, if
-+ * java.security.disableSystemPropertiesFile property is not set and
-+ * security.useSystemPropertiesFile is true.
-+ */
-+ static boolean configure(Properties props) {
-+ boolean loadedProps = false;
-+
-+ try (BufferedInputStream bis =
-+ new BufferedInputStream(
-+ new FileInputStream(CRYPTO_POLICIES_JAVA_CONFIG))) {
-+ props.load(bis);
-+ loadedProps = true;
-+ if (sdebug != null) {
-+ sdebug.println("reading system security properties file " +
-+ CRYPTO_POLICIES_JAVA_CONFIG);
-+ sdebug.println(props.toString());
-+ }
-+ } catch (IOException e) {
-+ if (sdebug != null) {
-+ sdebug.println("unable to load security properties from " +
-+ CRYPTO_POLICIES_JAVA_CONFIG);
-+ e.printStackTrace();
-+ }
-+ }
-+
-+ try {
-+ if (enableFips()) {
-+ if (sdebug != null) { sdebug.println("FIPS mode detected"); }
-+ loadedProps = false;
-+ // Remove all security providers
-+ Iterator> i = props.entrySet().iterator();
-+ while (i.hasNext()) {
-+ Entry e = i.next();
-+ if (((String) e.getKey()).startsWith("security.provider")) {
-+ if (sdebug != null) { sdebug.println("Removing provider: " + e); }
-+ i.remove();
-+ }
-+ }
-+ // Add FIPS security providers
-+ String fipsProviderValue = null;
-+ for (int n = 1;
-+ (fipsProviderValue = (String) props.get("fips.provider." + n)) != null; n++) {
-+ String fipsProviderKey = "security.provider." + n;
-+ if (sdebug != null) {
-+ sdebug.println("Adding provider " + n + ": " +
-+ fipsProviderKey + "=" + fipsProviderValue);
-+ }
-+ props.put(fipsProviderKey, fipsProviderValue);
-+ }
-+ loadedProps = true;
-+ }
-+ } catch (Exception e) {
-+ if (sdebug != null) {
-+ sdebug.println("unable to load FIPS configuration");
-+ e.printStackTrace();
-+ }
-+ }
-+ return loadedProps;
-+ }
-+
-+ /*
-+ * FIPS is enabled only if crypto-policies are set to "FIPS"
-+ * and the com.redhat.fips property is true.
-+ */
-+ private static boolean enableFips() throws Exception {
-+ boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
-+ if (fipsEnabled) {
-+ String cryptoPoliciesConfig = new String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG)));
-+ if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); }
-+ Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
-+ return pattern.matcher(cryptoPoliciesConfig).find();
-+ } else {
-+ return false;
-+ }
-+ }
-+}
-diff --git openjdk.orig///src/java.base/share/conf/security/java.security openjdk///src/java.base/share/conf/security/java.security
---- openjdk.orig/src/java.base/share/conf/security/java.security
-+++ openjdk/src/java.base/share/conf/security/java.security
-@@ -87,6 +87,14 @@
- #security.provider.tbd=SunPKCS11 ${java.home}/lib/security/nss.cfg
-
- #
-+# Security providers used when global crypto-policies are set to FIPS.
-+#
-+fips.provider.1=SunPKCS11 ${java.home}/conf/security/nss.fips.cfg
-+fips.provider.2=SUN
-+fips.provider.3=SunEC
-+fips.provider.4=SunJSSE
-+
-+#
- # A list of preferred providers for specific algorithms. These providers will
- # be searched for matching algorithms before the list of registered providers.
- # Entries containing errors (parsing, etc) will be ignored. Use the
diff --git a/SOURCES/rh1818909-fips_default_keystore_type.patch b/SOURCES/rh1818909-fips_default_keystore_type.patch
deleted file mode 100644
index ff34f3e..0000000
--- a/SOURCES/rh1818909-fips_default_keystore_type.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-diff -r 6efbd7b35a10 src/share/classes/java/security/SystemConfigurator.java
---- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java Thu Jan 23 18:22:31 2020 -0300
-+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java Mon Mar 02 19:20:17 2020 -0300
-@@ -123,6 +123,33 @@
- }
- props.put(fipsProviderKey, fipsProviderValue);
- }
-+ // Add other security properties
-+ String keystoreTypeValue = (String) props.get("fips.keystore.type");
-+ if (keystoreTypeValue != null) {
-+ String nonFipsKeystoreType = props.getProperty("keystore.type");
-+ props.put("keystore.type", keystoreTypeValue);
-+ if (keystoreTypeValue.equals("PKCS11")) {
-+ // If keystore.type is PKCS11, javax.net.ssl.keyStore
-+ // must be "NONE". See JDK-8238264.
-+ System.setProperty("javax.net.ssl.keyStore", "NONE");
-+ }
-+ if (System.getProperty("javax.net.ssl.trustStoreType") == null) {
-+ // If no trustStoreType has been set, use the
-+ // previous keystore.type under FIPS mode. In
-+ // a default configuration, the Trust Store will
-+ // be 'cacerts' (JKS type).
-+ System.setProperty("javax.net.ssl.trustStoreType",
-+ nonFipsKeystoreType);
-+ }
-+ if (sdebug != null) {
-+ sdebug.println("FIPS mode default keystore.type = " +
-+ keystoreTypeValue);
-+ sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
-+ System.getProperty("javax.net.ssl.keyStore", ""));
-+ sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
-+ System.getProperty("javax.net.ssl.trustStoreType", ""));
-+ }
-+ }
- loadedProps = true;
- }
- } catch (Exception e) {
-diff -r 6efbd7b35a10 src/share/lib/security/java.security-linux
---- openjdk.orig/src/java.base/share/conf/security/java.security Thu Jan 23 18:22:31 2020 -0300
-+++ openjdk/src/java.base/share/conf/security/java.security Mon Mar 02 19:20:17 2020 -0300
-@@ -299,6 +299,11 @@
- keystore.type=pkcs12
-
- #
-+# Default keystore type used when global crypto-policies are set to FIPS.
-+#
-+fips.keystore.type=PKCS11
-+
-+#
- # Controls compatibility mode for JKS and PKCS12 keystore types.
- #
- # When set to 'true', both JKS and PKCS12 keystore types support loading
diff --git a/SOURCES/rh1860986-disable_tlsv1.3_in_fips_mode.patch b/SOURCES/rh1860986-disable_tlsv1.3_in_fips_mode.patch
deleted file mode 100644
index 8dcd9a8..0000000
--- a/SOURCES/rh1860986-disable_tlsv1.3_in_fips_mode.patch
+++ /dev/null
@@ -1,318 +0,0 @@
-diff --git openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
-index f9baf8c9742..60fa75cab45 100644
---- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
-+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
-@@ -1,11 +1,13 @@
- /*
-- * Copyright (c) 2019, Red Hat, Inc.
-+ * Copyright (c) 2019, 2020, Red Hat, Inc.
- *
- * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
- *
- * This code is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 only, as
-- * published by the Free Software Foundation.
-+ * published by the Free Software Foundation. Oracle designates this
-+ * particular file as subject to the "Classpath" exception as provided
-+ * by Oracle in the LICENSE file that accompanied this code.
- *
- * This code is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-@@ -34,10 +36,10 @@ import java.nio.file.Path;
- import java.util.Iterator;
- import java.util.Map.Entry;
- import java.util.Properties;
--import java.util.function.Consumer;
--import java.util.regex.Matcher;
- import java.util.regex.Pattern;
-
-+import jdk.internal.access.JavaSecuritySystemConfiguratorAccess;
-+import jdk.internal.access.SharedSecrets;
- import sun.security.util.Debug;
-
- /**
-@@ -47,7 +49,7 @@ import sun.security.util.Debug;
- *
- */
-
--class SystemConfigurator {
-+final class SystemConfigurator {
-
- private static final Debug sdebug =
- Debug.getInstance("properties");
-@@ -61,15 +63,16 @@ class SystemConfigurator {
- private static final String CRYPTO_POLICIES_CONFIG =
- CRYPTO_POLICIES_BASE_DIR + "/config";
-
-- private static final class SecurityProviderInfo {
-- int number;
-- String key;
-- String value;
-- SecurityProviderInfo(int number, String key, String value) {
-- this.number = number;
-- this.key = key;
-- this.value = value;
-- }
-+ private static boolean systemFipsEnabled = false;
-+
-+ static {
-+ SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
-+ new JavaSecuritySystemConfiguratorAccess() {
-+ @Override
-+ public boolean isSystemFipsEnabled() {
-+ return SystemConfigurator.isSystemFipsEnabled();
-+ }
-+ });
- }
-
- /*
-@@ -128,9 +131,9 @@ class SystemConfigurator {
- String nonFipsKeystoreType = props.getProperty("keystore.type");
- props.put("keystore.type", keystoreTypeValue);
- if (keystoreTypeValue.equals("PKCS11")) {
-- // If keystore.type is PKCS11, javax.net.ssl.keyStore
-- // must be "NONE". See JDK-8238264.
-- System.setProperty("javax.net.ssl.keyStore", "NONE");
-+ // If keystore.type is PKCS11, javax.net.ssl.keyStore
-+ // must be "NONE". See JDK-8238264.
-+ System.setProperty("javax.net.ssl.keyStore", "NONE");
- }
- if (System.getProperty("javax.net.ssl.trustStoreType") == null) {
- // If no trustStoreType has been set, use the
-@@ -144,12 +147,13 @@ class SystemConfigurator {
- sdebug.println("FIPS mode default keystore.type = " +
- keystoreTypeValue);
- sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
-- System.getProperty("javax.net.ssl.keyStore", ""));
-+ System.getProperty("javax.net.ssl.keyStore", ""));
- sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
- System.getProperty("javax.net.ssl.trustStoreType", ""));
- }
- }
- loadedProps = true;
-+ systemFipsEnabled = true;
- }
- } catch (Exception e) {
- if (sdebug != null) {
-@@ -160,13 +164,30 @@ class SystemConfigurator {
- return loadedProps;
- }
-
-+ /**
-+ * Returns whether or not global system FIPS alignment is enabled.
-+ *
-+ * Value is always 'false' before java.security.Security class is
-+ * initialized.
-+ *
-+ * Call from out of this package through SharedSecrets:
-+ * SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+ * .isSystemFipsEnabled();
-+ *
-+ * @return a boolean value indicating whether or not global
-+ * system FIPS alignment is enabled.
-+ */
-+ static boolean isSystemFipsEnabled() {
-+ return systemFipsEnabled;
-+ }
-+
- /*
- * FIPS is enabled only if crypto-policies are set to "FIPS"
- * and the com.redhat.fips property is true.
- */
- private static boolean enableFips() throws Exception {
-- boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
-- if (fipsEnabled) {
-+ boolean shouldEnable = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
-+ if (shouldEnable) {
- String cryptoPoliciesConfig = new String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG)));
- if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); }
- Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
-diff --git openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java
-new file mode 100644
-index 00000000000..a31e93ec02e
---- /dev/null
-+++ openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java
-@@ -0,0 +1,30 @@
-+/*
-+ * Copyright (c) 2020, Red Hat, Inc.
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation. Oracle designates this
-+ * particular file as subject to the "Classpath" exception as provided
-+ * by Oracle in the LICENSE file that accompanied this code.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+package jdk.internal.access;
-+
-+public interface JavaSecuritySystemConfiguratorAccess {
-+ boolean isSystemFipsEnabled();
-+}
-diff --git openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
-index f6d3638c3dd..5a2c9eb0c46 100644
---- openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
-+++ openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
-@@ -81,6 +81,7 @@ public class SharedSecrets {
- private static JavaSecuritySpecAccess javaSecuritySpecAccess;
- private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess;
- private static JavaxCryptoSpecAccess javaxCryptoSpecAccess;
-+ private static JavaSecuritySystemConfiguratorAccess javaSecuritySystemConfiguratorAccess;
-
- public static void setJavaUtilCollectionAccess(JavaUtilCollectionAccess juca) {
- javaUtilCollectionAccess = juca;
-@@ -442,4 +443,12 @@ public class SharedSecrets {
- MethodHandles.lookup().ensureInitialized(c);
- } catch (IllegalAccessException e) {}
- }
-+
-+ public static void setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) {
-+ javaSecuritySystemConfiguratorAccess = jssca;
-+ }
-+
-+ public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() {
-+ return javaSecuritySystemConfiguratorAccess;
-+ }
- }
-diff --git openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java
-index 6ffdfeda18d..775b185fb06 100644
---- openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java
-+++ openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java
-@@ -32,6 +32,7 @@ import java.security.cert.*;
- import java.util.*;
- import java.util.concurrent.locks.ReentrantLock;
- import javax.net.ssl.*;
-+import jdk.internal.access.SharedSecrets;
- import sun.security.action.GetPropertyAction;
- import sun.security.provider.certpath.AlgorithmChecker;
- import sun.security.validator.Validator;
-@@ -536,22 +537,40 @@ public abstract class SSLContextImpl extends SSLContextSpi {
- private static final List serverDefaultCipherSuites;
-
- static {
-- supportedProtocols = Arrays.asList(
-- ProtocolVersion.TLS13,
-- ProtocolVersion.TLS12,
-- ProtocolVersion.TLS11,
-- ProtocolVersion.TLS10,
-- ProtocolVersion.SSL30,
-- ProtocolVersion.SSL20Hello
-- );
--
-- serverDefaultProtocols = getAvailableProtocols(
-- new ProtocolVersion[] {
-- ProtocolVersion.TLS13,
-- ProtocolVersion.TLS12,
-- ProtocolVersion.TLS11,
-- ProtocolVersion.TLS10
-- });
-+ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+ .isSystemFipsEnabled()) {
-+ // RH1860986: TLSv1.3 key derivation not supported with
-+ // the Security Providers available in system FIPS mode.
-+ supportedProtocols = Arrays.asList(
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10
-+ );
-+
-+ serverDefaultProtocols = getAvailableProtocols(
-+ new ProtocolVersion[] {
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10
-+ });
-+ } else {
-+ supportedProtocols = Arrays.asList(
-+ ProtocolVersion.TLS13,
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10,
-+ ProtocolVersion.SSL30,
-+ ProtocolVersion.SSL20Hello
-+ );
-+
-+ serverDefaultProtocols = getAvailableProtocols(
-+ new ProtocolVersion[] {
-+ ProtocolVersion.TLS13,
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10
-+ });
-+ }
-
- supportedCipherSuites = getApplicableSupportedCipherSuites(
- supportedProtocols);
-@@ -842,12 +861,23 @@ public abstract class SSLContextImpl extends SSLContextSpi {
- ProtocolVersion[] candidates;
- if (refactored.isEmpty()) {
- // Client and server use the same default protocols.
-- candidates = new ProtocolVersion[] {
-- ProtocolVersion.TLS13,
-- ProtocolVersion.TLS12,
-- ProtocolVersion.TLS11,
-- ProtocolVersion.TLS10
-- };
-+ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+ .isSystemFipsEnabled()) {
-+ // RH1860986: TLSv1.3 key derivation not supported with
-+ // the Security Providers available in system FIPS mode.
-+ candidates = new ProtocolVersion[] {
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10
-+ };
-+ } else {
-+ candidates = new ProtocolVersion[] {
-+ ProtocolVersion.TLS13,
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10
-+ };
-+ }
- } else {
- // Use the customized TLS protocols.
- candidates =
-diff --git openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java
-index 894e26dfad8..8b16378b96b 100644
---- openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java
-+++ openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java
-@@ -27,6 +27,8 @@ package sun.security.ssl;
-
- import java.security.*;
- import java.util.*;
-+
-+import jdk.internal.access.SharedSecrets;
- import static sun.security.util.SecurityConstants.PROVIDER_VER;
-
- /**
-@@ -102,8 +104,13 @@ public class SunJSSE extends java.security.Provider {
- "sun.security.ssl.SSLContextImpl$TLS11Context", null, null);
- ps("SSLContext", "TLSv1.2",
- "sun.security.ssl.SSLContextImpl$TLS12Context", null, null);
-- ps("SSLContext", "TLSv1.3",
-- "sun.security.ssl.SSLContextImpl$TLS13Context", null, null);
-+ if (!SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+ .isSystemFipsEnabled()) {
-+ // RH1860986: TLSv1.3 key derivation not supported with
-+ // the Security Providers available in system FIPS mode.
-+ ps("SSLContext", "TLSv1.3",
-+ "sun.security.ssl.SSLContextImpl$TLS13Context", null, null);
-+ }
- ps("SSLContext", "TLS",
- "sun.security.ssl.SSLContextImpl$TLSContext",
- List.of("SSL"), null);
diff --git a/SOURCES/rh1915071-always_initialise_configurator_access.patch b/SOURCES/rh1915071-always_initialise_configurator_access.patch
deleted file mode 100644
index 513fbbf..0000000
--- a/SOURCES/rh1915071-always_initialise_configurator_access.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-diff --git openjdk/src/java.base/share/classes/java/security/Security.java openjdk/src/java.base/share/classes/java/security/Security.java
-index f1633afb627..ce32c939253 100644
---- openjdk/src/java.base/share/classes/java/security/Security.java
-+++ openjdk/src/java.base/share/classes/java/security/Security.java
-@@ -32,6 +32,7 @@ import java.net.URL;
-
- import jdk.internal.event.EventHelper;
- import jdk.internal.event.SecurityPropertyModificationEvent;
-+import jdk.internal.access.JavaSecuritySystemConfiguratorAccess;
- import jdk.internal.access.SharedSecrets;
- import jdk.internal.util.StaticProperty;
- import sun.security.util.Debug;
-@@ -74,6 +75,15 @@ public final class Security {
- }
-
- static {
-+ // Initialise here as used by code with system properties disabled
-+ SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
-+ new JavaSecuritySystemConfiguratorAccess() {
-+ @Override
-+ public boolean isSystemFipsEnabled() {
-+ return SystemConfigurator.isSystemFipsEnabled();
-+ }
-+ });
-+
- // doPrivileged here because there are multiple
- // things in initialize that might require privs.
- // (the FileInputStream call and the File.exists call,
-@@ -194,9 +204,8 @@ public final class Security {
- }
-
- String disableSystemProps = System.getProperty("java.security.disableSystemPropertiesFile");
-- if (disableSystemProps == null &&
-- "true".equalsIgnoreCase(props.getProperty
-- ("security.useSystemPropertiesFile"))) {
-+ if ((disableSystemProps == null || "false".equalsIgnoreCase(disableSystemProps)) &&
-+ "true".equalsIgnoreCase(props.getProperty("security.useSystemPropertiesFile"))) {
- if (SystemConfigurator.configure(props)) {
- loadedProps = true;
- }
-diff --git openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
-index 60fa75cab45..10b54aa4ce4 100644
---- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
-+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
-@@ -38,8 +38,6 @@ import java.util.Map.Entry;
- import java.util.Properties;
- import java.util.regex.Pattern;
-
--import jdk.internal.access.JavaSecuritySystemConfiguratorAccess;
--import jdk.internal.access.SharedSecrets;
- import sun.security.util.Debug;
-
- /**
-@@ -65,16 +63,6 @@ final class SystemConfigurator {
-
- private static boolean systemFipsEnabled = false;
-
-- static {
-- SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
-- new JavaSecuritySystemConfiguratorAccess() {
-- @Override
-- public boolean isSystemFipsEnabled() {
-- return SystemConfigurator.isSystemFipsEnabled();
-- }
-- });
-- }
--
- /*
- * Invoked when java.security.Security class is initialized, if
- * java.security.disableSystemPropertiesFile property is not set and
diff --git a/SOURCES/rh1929465-dont_define_unused_throwioexception.patch b/SOURCES/rh1929465-dont_define_unused_throwioexception.patch
deleted file mode 100644
index eba090f..0000000
--- a/SOURCES/rh1929465-dont_define_unused_throwioexception.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-commit 90e344e7d4987af610fa0054c92d18fe1c2edd41
-Author: Andrew Hughes
-Date: Sat Aug 28 01:15:28 2021 +0100
-
- RH1929465: Don't define unused throwIOException function when using NSS detection
-
-diff --git openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c openjdk/src/java.base/linux/native/libsystemconf/systemconf.c
-index 6f4656bfcb6..38919d6bb0f 100644
---- openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c
-+++ openjdk/src/java.base/linux/native/libsystemconf/systemconf.c
-@@ -34,14 +34,34 @@
-
- #include "java_security_SystemConfigurator.h"
-
--#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled"
- #define MSG_MAX_SIZE 96
-
- static jmethodID debugPrintlnMethodID = NULL;
- static jobject debugObj = NULL;
-
--static void throwIOException(JNIEnv *env, const char *msg);
--static void dbgPrint(JNIEnv *env, const char* msg);
-+// Only used when NSS is unavailable and FIPS_ENABLED_PATH is read
-+#ifndef SYSCONF_NSS
-+
-+#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled"
-+
-+static void throwIOException(JNIEnv *env, const char *msg)
-+{
-+ jclass cls = (*env)->FindClass(env, "java/io/IOException");
-+ if (cls != 0)
-+ (*env)->ThrowNew(env, cls, msg);
-+}
-+
-+#endif
-+
-+static void dbgPrint(JNIEnv *env, const char* msg)
-+{
-+ jstring jMsg;
-+ if (debugObj != NULL) {
-+ jMsg = (*env)->NewStringUTF(env, msg);
-+ CHECK_NULL(jMsg);
-+ (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg);
-+ }
-+}
-
- /*
- * Class: java_security_SystemConfigurator
-@@ -149,20 +169,3 @@ JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEn
-
- #endif // SYSCONF_NSS
- }
--
--static void throwIOException(JNIEnv *env, const char *msg)
--{
-- jclass cls = (*env)->FindClass(env, "java/io/IOException");
-- if (cls != 0)
-- (*env)->ThrowNew(env, cls, msg);
--}
--
--static void dbgPrint(JNIEnv *env, const char* msg)
--{
-- jstring jMsg;
-- if (debugObj != NULL) {
-- jMsg = (*env)->NewStringUTF(env, msg);
-- CHECK_NULL(jMsg);
-- (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg);
-- }
--}
diff --git a/SOURCES/rh1929465-improve_system_FIPS_detection.patch b/SOURCES/rh1929465-improve_system_FIPS_detection.patch
deleted file mode 100644
index 4dfd1d4..0000000
--- a/SOURCES/rh1929465-improve_system_FIPS_detection.patch
+++ /dev/null
@@ -1,428 +0,0 @@
-diff --git openjdk/make/autoconf/lib-sysconf.m4 openjdk/make/autoconf/lib-sysconf.m4
-new file mode 100644
-index 00000000000..b2b1c1787da
---- /dev/null
-+++ openjdk/make/autoconf/lib-sysconf.m4
-@@ -0,0 +1,84 @@
-+#
-+# Copyright (c) 2021, Red Hat, Inc.
-+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+#
-+# This code is free software; you can redistribute it and/or modify it
-+# under the terms of the GNU General Public License version 2 only, as
-+# published by the Free Software Foundation. Oracle designates this
-+# particular file as subject to the "Classpath" exception as provided
-+# by Oracle in the LICENSE file that accompanied this code.
-+#
-+# This code is distributed in the hope that it will be useful, but WITHOUT
-+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-+# version 2 for more details (a copy is included in the LICENSE file that
-+# accompanied this code).
-+#
-+# You should have received a copy of the GNU General Public License version
-+# 2 along with this work; if not, write to the Free Software Foundation,
-+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+#
-+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+# or visit www.oracle.com if you need additional information or have any
-+# questions.
-+#
-+
-+################################################################################
-+# Setup system configuration libraries
-+################################################################################
-+AC_DEFUN_ONCE([LIB_SETUP_SYSCONF_LIBS],
-+[
-+ ###############################################################################
-+ #
-+ # Check for the NSS library
-+ #
-+
-+ AC_MSG_CHECKING([whether to use the system NSS library with the System Configurator (libsysconf)])
-+
-+ # default is not available
-+ DEFAULT_SYSCONF_NSS=no
-+
-+ AC_ARG_ENABLE([sysconf-nss], [AS_HELP_STRING([--enable-sysconf-nss],
-+ [build the System Configurator (libsysconf) using the system NSS library if available @<:@disabled@:>@])],
-+ [
-+ case "${enableval}" in
-+ yes)
-+ sysconf_nss=yes
-+ ;;
-+ *)
-+ sysconf_nss=no
-+ ;;
-+ esac
-+ ],
-+ [
-+ sysconf_nss=${DEFAULT_SYSCONF_NSS}
-+ ])
-+ AC_MSG_RESULT([$sysconf_nss])
-+
-+ USE_SYSCONF_NSS=false
-+ if test "x${sysconf_nss}" = "xyes"; then
-+ PKG_CHECK_MODULES(NSS, nss >= 3.53, [NSS_FOUND=yes], [NSS_FOUND=no])
-+ if test "x${NSS_FOUND}" = "xyes"; then
-+ AC_MSG_CHECKING([for system FIPS support in NSS])
-+ saved_libs="${LIBS}"
-+ saved_cflags="${CFLAGS}"
-+ CFLAGS="${CFLAGS} ${NSS_CFLAGS}"
-+ LIBS="${LIBS} ${NSS_LIBS}"
-+ AC_LANG_PUSH([C])
-+ AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include ]],
-+ [[SECMOD_GetSystemFIPSEnabled()]])],
-+ [AC_MSG_RESULT([yes])],
-+ [AC_MSG_RESULT([no])
-+ AC_MSG_ERROR([System NSS FIPS detection unavailable])])
-+ AC_LANG_POP([C])
-+ CFLAGS="${saved_cflags}"
-+ LIBS="${saved_libs}"
-+ USE_SYSCONF_NSS=true
-+ else
-+ dnl NSS 3.53 is the one that introduces the SECMOD_GetSystemFIPSEnabled API
-+ dnl in nss3/pk11pub.h.
-+ AC_MSG_ERROR([--enable-sysconf-nss specified, but NSS 3.53 or above not found.])
-+ fi
-+ fi
-+ AC_SUBST(USE_SYSCONF_NSS)
-+])
-diff --git openjdk/make/autoconf/libraries.m4 openjdk/make/autoconf/libraries.m4
-index a65d91ee974..a8f054c1397 100644
---- openjdk/make/autoconf/libraries.m4
-+++ openjdk/make/autoconf/libraries.m4
-@@ -33,6 +33,7 @@ m4_include([lib-std.m4])
- m4_include([lib-x11.m4])
- m4_include([lib-fontconfig.m4])
- m4_include([lib-tests.m4])
-+m4_include([lib-sysconf.m4])
-
- ################################################################################
- # Determine which libraries are needed for this configuration
-@@ -104,6 +105,7 @@ AC_DEFUN_ONCE([LIB_SETUP_LIBRARIES],
- LIB_SETUP_BUNDLED_LIBS
- LIB_SETUP_MISC_LIBS
- LIB_TESTS_SETUP_GTEST
-+ LIB_SETUP_SYSCONF_LIBS
-
- BASIC_JDKLIB_LIBS=""
- if test "x$TOOLCHAIN_TYPE" != xmicrosoft; then
-diff --git openjdk/make/autoconf/spec.gmk.in openjdk/make/autoconf/spec.gmk.in
-index 29445c8c24f..9b1b512a34a 100644
---- openjdk/make/autoconf/spec.gmk.in
-+++ openjdk/make/autoconf/spec.gmk.in
-@@ -834,6 +834,10 @@ INSTALL_SYSCONFDIR=@sysconfdir@
- # Libraries
- #
-
-+USE_SYSCONF_NSS:=@USE_SYSCONF_NSS@
-+NSS_LIBS:=@NSS_LIBS@
-+NSS_CFLAGS:=@NSS_CFLAGS@
-+
- USE_EXTERNAL_LCMS:=@USE_EXTERNAL_LCMS@
- LCMS_CFLAGS:=@LCMS_CFLAGS@
- LCMS_LIBS:=@LCMS_LIBS@
-diff --git openjdk/make/modules/java.base/Lib.gmk openjdk/make/modules/java.base/Lib.gmk
-index 5658ff342e5..cb7a56852f7 100644
---- openjdk/make/modules/java.base/Lib.gmk
-+++ openjdk/make/modules/java.base/Lib.gmk
-@@ -167,6 +167,31 @@ ifeq ($(call isTargetOsType, unix), true)
- endif
- endif
-
-+################################################################################
-+# Create the systemconf library
-+
-+LIBSYSTEMCONF_CFLAGS :=
-+LIBSYSTEMCONF_CXXFLAGS :=
-+
-+ifeq ($(USE_SYSCONF_NSS), true)
-+ LIBSYSTEMCONF_CFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS
-+ LIBSYSTEMCONF_CXXFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS
-+endif
-+
-+ifeq ($(OPENJDK_BUILD_OS), linux)
-+ $(eval $(call SetupJdkLibrary, BUILD_LIBSYSTEMCONF, \
-+ NAME := systemconf, \
-+ OPTIMIZATION := LOW, \
-+ CFLAGS := $(CFLAGS_JDKLIB) $(LIBSYSTEMCONF_CFLAGS), \
-+ CXXFLAGS := $(CXXFLAGS_JDKLIB) $(LIBSYSTEMCONF_CXXFLAGS), \
-+ LDFLAGS := $(LDFLAGS_JDKLIB) \
-+ $(call SET_SHARED_LIBRARY_ORIGIN), \
-+ LIBS_unix := $(LIBDL) $(NSS_LIBS), \
-+ ))
-+
-+ TARGETS += $(BUILD_LIBSYSTEMCONF)
-+endif
-+
- ################################################################################
- # Create the symbols file for static builds.
-
-diff --git openjdk/src/java.base/linux/native/libsystemconf/systemconf.c openjdk/src/java.base/linux/native/libsystemconf/systemconf.c
-new file mode 100644
-index 00000000000..6f4656bfcb6
---- /dev/null
-+++ openjdk/src/java.base/linux/native/libsystemconf/systemconf.c
-@@ -0,0 +1,168 @@
-+/*
-+ * Copyright (c) 2021, Red Hat, Inc.
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation. Oracle designates this
-+ * particular file as subject to the "Classpath" exception as provided
-+ * by Oracle in the LICENSE file that accompanied this code.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+#include
-+#include
-+#include
-+#include
-+
-+#ifdef SYSCONF_NSS
-+#include
-+#endif //SYSCONF_NSS
-+
-+#include "java_security_SystemConfigurator.h"
-+
-+#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled"
-+#define MSG_MAX_SIZE 96
-+
-+static jmethodID debugPrintlnMethodID = NULL;
-+static jobject debugObj = NULL;
-+
-+static void throwIOException(JNIEnv *env, const char *msg);
-+static void dbgPrint(JNIEnv *env, const char* msg);
-+
-+/*
-+ * Class: java_security_SystemConfigurator
-+ * Method: JNI_OnLoad
-+ */
-+JNIEXPORT jint JNICALL DEF_JNI_OnLoad(JavaVM *vm, void *reserved)
-+{
-+ JNIEnv *env;
-+ jclass sysConfCls, debugCls;
-+ jfieldID sdebugFld;
-+
-+ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) {
-+ return JNI_EVERSION; /* JNI version not supported */
-+ }
-+
-+ sysConfCls = (*env)->FindClass(env,"java/security/SystemConfigurator");
-+ if (sysConfCls == NULL) {
-+ printf("libsystemconf: SystemConfigurator class not found\n");
-+ return JNI_ERR;
-+ }
-+ sdebugFld = (*env)->GetStaticFieldID(env, sysConfCls,
-+ "sdebug", "Lsun/security/util/Debug;");
-+ if (sdebugFld == NULL) {
-+ printf("libsystemconf: SystemConfigurator::sdebug field not found\n");
-+ return JNI_ERR;
-+ }
-+ debugObj = (*env)->GetStaticObjectField(env, sysConfCls, sdebugFld);
-+ if (debugObj != NULL) {
-+ debugCls = (*env)->FindClass(env,"sun/security/util/Debug");
-+ if (debugCls == NULL) {
-+ printf("libsystemconf: Debug class not found\n");
-+ return JNI_ERR;
-+ }
-+ debugPrintlnMethodID = (*env)->GetMethodID(env, debugCls,
-+ "println", "(Ljava/lang/String;)V");
-+ if (debugPrintlnMethodID == NULL) {
-+ printf("libsystemconf: Debug::println(String) method not found\n");
-+ return JNI_ERR;
-+ }
-+ debugObj = (*env)->NewGlobalRef(env, debugObj);
-+ }
-+
-+ return (*env)->GetVersion(env);
-+}
-+
-+/*
-+ * Class: java_security_SystemConfigurator
-+ * Method: JNI_OnUnload
-+ */
-+JNIEXPORT void JNICALL DEF_JNI_OnUnload(JavaVM *vm, void *reserved)
-+{
-+ JNIEnv *env;
-+
-+ if (debugObj != NULL) {
-+ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) {
-+ return; /* Should not happen */
-+ }
-+ (*env)->DeleteGlobalRef(env, debugObj);
-+ }
-+}
-+
-+JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEnabled
-+ (JNIEnv *env, jclass cls)
-+{
-+ int fips_enabled;
-+ char msg[MSG_MAX_SIZE];
-+ int msg_bytes;
-+
-+#ifdef SYSCONF_NSS
-+
-+ dbgPrint(env, "getSystemFIPSEnabled: calling SECMOD_GetSystemFIPSEnabled");
-+ fips_enabled = SECMOD_GetSystemFIPSEnabled();
-+ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
-+ " SECMOD_GetSystemFIPSEnabled returned 0x%x", fips_enabled);
-+ if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) {
-+ dbgPrint(env, msg);
-+ } else {
-+ dbgPrint(env, "getSystemFIPSEnabled: cannot render" \
-+ " SECMOD_GetSystemFIPSEnabled return value");
-+ }
-+ return (fips_enabled == 1 ? JNI_TRUE : JNI_FALSE);
-+
-+#else // SYSCONF_NSS
-+
-+ FILE *fe;
-+
-+ dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH);
-+ if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) {
-+ throwIOException(env, "Cannot open " FIPS_ENABLED_PATH);
-+ }
-+ fips_enabled = fgetc(fe);
-+ fclose(fe);
-+ if (fips_enabled == EOF) {
-+ throwIOException(env, "Cannot read " FIPS_ENABLED_PATH);
-+ }
-+ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
-+ " read character is '%c'", fips_enabled);
-+ if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) {
-+ dbgPrint(env, msg);
-+ } else {
-+ dbgPrint(env, "getSystemFIPSEnabled: cannot render" \
-+ " read character");
-+ }
-+ return (fips_enabled == '1' ? JNI_TRUE : JNI_FALSE);
-+
-+#endif // SYSCONF_NSS
-+}
-+
-+static void throwIOException(JNIEnv *env, const char *msg)
-+{
-+ jclass cls = (*env)->FindClass(env, "java/io/IOException");
-+ if (cls != 0)
-+ (*env)->ThrowNew(env, cls, msg);
-+}
-+
-+static void dbgPrint(JNIEnv *env, const char* msg)
-+{
-+ jstring jMsg;
-+ if (debugObj != NULL) {
-+ jMsg = (*env)->NewStringUTF(env, msg);
-+ CHECK_NULL(jMsg);
-+ (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg);
-+ }
-+}
-diff --git openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
-index 10b54aa4ce4..6aa1419dfd0 100644
---- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
-+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
-@@ -1,5 +1,5 @@
- /*
-- * Copyright (c) 2019, 2020, Red Hat, Inc.
-+ * Copyright (c) 2019, 2021, Red Hat, Inc.
- *
- * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
- *
-@@ -30,13 +30,9 @@ import java.io.BufferedInputStream;
- import java.io.FileInputStream;
- import java.io.IOException;
-
--import java.nio.file.Files;
--import java.nio.file.Path;
--
- import java.util.Iterator;
- import java.util.Map.Entry;
- import java.util.Properties;
--import java.util.regex.Pattern;
-
- import sun.security.util.Debug;
-
-@@ -58,11 +54,23 @@ final class SystemConfigurator {
- private static final String CRYPTO_POLICIES_JAVA_CONFIG =
- CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config";
-
-- private static final String CRYPTO_POLICIES_CONFIG =
-- CRYPTO_POLICIES_BASE_DIR + "/config";
--
- private static boolean systemFipsEnabled = false;
-
-+ private static final String SYSTEMCONF_NATIVE_LIB = "systemconf";
-+
-+ private static native boolean getSystemFIPSEnabled()
-+ throws IOException;
-+
-+ static {
-+ @SuppressWarnings("removal")
-+ var dummy = AccessController.doPrivileged(new PrivilegedAction() {
-+ public Void run() {
-+ System.loadLibrary(SYSTEMCONF_NATIVE_LIB);
-+ return null;
-+ }
-+ });
-+ }
-+
- /*
- * Invoked when java.security.Security class is initialized, if
- * java.security.disableSystemPropertiesFile property is not set and
-@@ -170,16 +178,34 @@ final class SystemConfigurator {
- }
-
- /*
-- * FIPS is enabled only if crypto-policies are set to "FIPS"
-- * and the com.redhat.fips property is true.
-+ * OpenJDK FIPS mode will be enabled only if the com.redhat.fips
-+ * system property is true (default) and the system is in FIPS mode.
-+ *
-+ * There are 2 possible ways in which OpenJDK detects that the system
-+ * is in FIPS mode: 1) if the NSS SECMOD_GetSystemFIPSEnabled API is
-+ * available at OpenJDK's built-time, it is called; 2) otherwise, the
-+ * /proc/sys/crypto/fips_enabled file is read.
- */
- private static boolean enableFips() throws Exception {
- boolean shouldEnable = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
- if (shouldEnable) {
-- String cryptoPoliciesConfig = new String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG)));
-- if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); }
-- Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
-- return pattern.matcher(cryptoPoliciesConfig).find();
-+ if (sdebug != null) {
-+ sdebug.println("Calling getSystemFIPSEnabled (libsystemconf)...");
-+ }
-+ try {
-+ shouldEnable = getSystemFIPSEnabled();
-+ if (sdebug != null) {
-+ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf) returned: "
-+ + shouldEnable);
-+ }
-+ return shouldEnable;
-+ } catch (IOException e) {
-+ if (sdebug != null) {
-+ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf) failed:");
-+ sdebug.println(e.getMessage());
-+ }
-+ throw e;
-+ }
- } else {
- return false;
- }
diff --git a/SOURCES/rh1991003-enable_fips_keys_import.patch b/SOURCES/rh1991003-enable_fips_keys_import.patch
deleted file mode 100644
index 79d2743..0000000
--- a/SOURCES/rh1991003-enable_fips_keys_import.patch
+++ /dev/null
@@ -1,579 +0,0 @@
-commit abcd0954643eddbf826d96291d44a143038ab750
-Author: Martin Balao
-Date: Sun Oct 10 18:14:01 2021 +0100
-
- RH1991003: Enable the import of plain keys into the NSS software token.
-
- This can be individually disabled using -Dcom.redhat.fips.plainKeySupport=false
-
-diff --git openjdk.orig/src/java.base/share/classes/java/security/Security.java openjdk/src/java.base/share/classes/java/security/Security.java
-index ce32c939253..dc7020ce668 100644
---- openjdk.orig/src/java.base/share/classes/java/security/Security.java
-+++ openjdk/src/java.base/share/classes/java/security/Security.java
-@@ -82,6 +82,10 @@ public final class Security {
- public boolean isSystemFipsEnabled() {
- return SystemConfigurator.isSystemFipsEnabled();
- }
-+ @Override
-+ public boolean isPlainKeySupportEnabled() {
-+ return SystemConfigurator.isPlainKeySupportEnabled();
-+ }
- });
-
- // doPrivileged here because there are multiple
-diff --git openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
-index 6aa1419dfd0..ecab722848e 100644
---- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java
-+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
-@@ -55,6 +55,7 @@ final class SystemConfigurator {
- CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config";
-
- private static boolean systemFipsEnabled = false;
-+ private static boolean plainKeySupportEnabled = false;
-
- private static final String SYSTEMCONF_NATIVE_LIB = "systemconf";
-
-@@ -150,6 +151,16 @@ final class SystemConfigurator {
- }
- loadedProps = true;
- systemFipsEnabled = true;
-+ String plainKeySupport = System.getProperty("com.redhat.fips.plainKeySupport",
-+ "true");
-+ plainKeySupportEnabled = !"false".equals(plainKeySupport);
-+ if (sdebug != null) {
-+ if (plainKeySupportEnabled) {
-+ sdebug.println("FIPS support enabled with plain key support");
-+ } else {
-+ sdebug.println("FIPS support enabled without plain key support");
-+ }
-+ }
- }
- } catch (Exception e) {
- if (sdebug != null) {
-@@ -177,6 +188,19 @@ final class SystemConfigurator {
- return systemFipsEnabled;
- }
-
-+ /**
-+ * Returns {@code true} if system FIPS alignment is enabled
-+ * and plain key support is allowed. Plain key support is
-+ * enabled by default but can be disabled with
-+ * {@code -Dcom.redhat.fips.plainKeySupport=false}.
-+ *
-+ * @return a boolean indicating whether plain key support
-+ * should be enabled.
-+ */
-+ static boolean isPlainKeySupportEnabled() {
-+ return plainKeySupportEnabled;
-+ }
-+
- /*
- * OpenJDK FIPS mode will be enabled only if the com.redhat.fips
- * system property is true (default) and the system is in FIPS mode.
-diff --git openjdk.orig/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java
-index a31e93ec02e..3f3caac64dc 100644
---- openjdk.orig/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java
-+++ openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java
-@@ -27,4 +27,5 @@ package jdk.internal.access;
-
- public interface JavaSecuritySystemConfiguratorAccess {
- boolean isSystemFipsEnabled();
-+ boolean isPlainKeySupportEnabled();
- }
-diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
-new file mode 100644
-index 00000000000..bee3a1e1537
---- /dev/null
-+++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
-@@ -0,0 +1,291 @@
-+/*
-+ * Copyright (c) 2021, Red Hat, Inc.
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation. Oracle designates this
-+ * particular file as subject to the "Classpath" exception as provided
-+ * by Oracle in the LICENSE file that accompanied this code.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+package sun.security.pkcs11;
-+
-+import java.math.BigInteger;
-+import java.security.KeyFactory;
-+import java.security.Provider;
-+import java.security.Security;
-+import java.util.HashMap;
-+import java.util.Map;
-+import java.util.concurrent.locks.ReentrantLock;
-+
-+import javax.crypto.Cipher;
-+import javax.crypto.spec.DHPrivateKeySpec;
-+import javax.crypto.spec.IvParameterSpec;
-+
-+import sun.security.jca.JCAUtil;
-+import sun.security.pkcs11.TemplateManager;
-+import sun.security.pkcs11.wrapper.CK_ATTRIBUTE;
-+import sun.security.pkcs11.wrapper.CK_MECHANISM;
-+import static sun.security.pkcs11.wrapper.PKCS11Constants.*;
-+import static sun.security.pkcs11.wrapper.PKCS11Exception.*;
-+import sun.security.pkcs11.wrapper.PKCS11Exception;
-+import sun.security.rsa.RSAUtil.KeyType;
-+import sun.security.util.Debug;
-+import sun.security.util.ECUtil;
-+
-+final class FIPSKeyImporter {
-+
-+ private static final Debug debug =
-+ Debug.getInstance("sunpkcs11");
-+
-+ private static P11Key importerKey = null;
-+ private static final ReentrantLock importerKeyLock = new ReentrantLock();
-+ private static CK_MECHANISM importerKeyMechanism = null;
-+ private static Cipher importerCipher = null;
-+
-+ private static Provider sunECProvider = null;
-+ private static final ReentrantLock sunECProviderLock = new ReentrantLock();
-+
-+ private static KeyFactory DHKF = null;
-+ private static final ReentrantLock DHKFLock = new ReentrantLock();
-+
-+ static Long importKey(SunPKCS11 sunPKCS11, long hSession, CK_ATTRIBUTE[] attributes)
-+ throws PKCS11Exception {
-+ long keyID = -1;
-+ Token token = sunPKCS11.getToken();
-+ if (debug != null) {
-+ debug.println("Private or Secret key will be imported in" +
-+ " system FIPS mode.");
-+ }
-+ if (importerKey == null) {
-+ importerKeyLock.lock();
-+ try {
-+ if (importerKey == null) {
-+ if (importerKeyMechanism == null) {
-+ // Importer Key creation has not been tried yet. Try it.
-+ createImporterKey(token);
-+ }
-+ if (importerKey == null || importerCipher == null) {
-+ if (debug != null) {
-+ debug.println("Importer Key could not be" +
-+ " generated.");
-+ }
-+ throw new PKCS11Exception(CKR_GENERAL_ERROR);
-+ }
-+ if (debug != null) {
-+ debug.println("Importer Key successfully" +
-+ " generated.");
-+ }
-+ }
-+ } finally {
-+ importerKeyLock.unlock();
-+ }
-+ }
-+ long importerKeyID = importerKey.getKeyID();
-+ try {
-+ byte[] keyBytes = null;
-+ byte[] encKeyBytes = null;
-+ long keyClass = 0L;
-+ long keyType = 0L;
-+ Map attrsMap = new HashMap<>();
-+ for (CK_ATTRIBUTE attr : attributes) {
-+ if (attr.type == CKA_CLASS) {
-+ keyClass = attr.getLong();
-+ } else if (attr.type == CKA_KEY_TYPE) {
-+ keyType = attr.getLong();
-+ }
-+ attrsMap.put(attr.type, attr);
-+ }
-+ BigInteger v = null;
-+ if (keyClass == CKO_PRIVATE_KEY) {
-+ if (keyType == CKK_RSA) {
-+ if (debug != null) {
-+ debug.println("Importing an RSA private key...");
-+ }
-+ keyBytes = sun.security.rsa.RSAPrivateCrtKeyImpl.newKey(
-+ KeyType.RSA,
-+ null,
-+ ((v = attrsMap.get(CKA_MODULUS).getBigInteger()) != null)
-+ ? v : BigInteger.ZERO,
-+ ((v = attrsMap.get(CKA_PUBLIC_EXPONENT).getBigInteger()) != null)
-+ ? v : BigInteger.ZERO,
-+ ((v = attrsMap.get(CKA_PRIVATE_EXPONENT).getBigInteger()) != null)
-+ ? v : BigInteger.ZERO,
-+ ((v = attrsMap.get(CKA_PRIME_1).getBigInteger()) != null)
-+ ? v : BigInteger.ZERO,
-+ ((v = attrsMap.get(CKA_PRIME_2).getBigInteger()) != null)
-+ ? v : BigInteger.ZERO,
-+ ((v = attrsMap.get(CKA_EXPONENT_1).getBigInteger()) != null)
-+ ? v : BigInteger.ZERO,
-+ ((v = attrsMap.get(CKA_EXPONENT_2).getBigInteger()) != null)
-+ ? v : BigInteger.ZERO,
-+ ((v = attrsMap.get(CKA_COEFFICIENT).getBigInteger()) != null)
-+ ? v : BigInteger.ZERO
-+ ).getEncoded();
-+ } else if (keyType == CKK_DSA) {
-+ if (debug != null) {
-+ debug.println("Importing a DSA private key...");
-+ }
-+ keyBytes = new sun.security.provider.DSAPrivateKey(
-+ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null)
-+ ? v : BigInteger.ZERO,
-+ ((v = attrsMap.get(CKA_PRIME).getBigInteger()) != null)
-+ ? v : BigInteger.ZERO,
-+ ((v = attrsMap.get(CKA_SUBPRIME).getBigInteger()) != null)
-+ ? v : BigInteger.ZERO,
-+ ((v = attrsMap.get(CKA_BASE).getBigInteger()) != null)
-+ ? v : BigInteger.ZERO
-+ ).getEncoded();
-+ if (token.config.getNssNetscapeDbWorkaround() &&
-+ attrsMap.get(CKA_NETSCAPE_DB) == null) {
-+ attrsMap.put(CKA_NETSCAPE_DB,
-+ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO));
-+ }
-+ } else if (keyType == CKK_EC) {
-+ if (debug != null) {
-+ debug.println("Importing an EC private key...");
-+ }
-+ if (sunECProvider == null) {
-+ sunECProviderLock.lock();
-+ try {
-+ if (sunECProvider == null) {
-+ sunECProvider = Security.getProvider("SunEC");
-+ }
-+ } finally {
-+ sunECProviderLock.unlock();
-+ }
-+ }
-+ keyBytes = ECUtil.generateECPrivateKey(
-+ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null)
-+ ? v : BigInteger.ZERO,
-+ ECUtil.getECParameterSpec(sunECProvider,
-+ attrsMap.get(CKA_EC_PARAMS).getByteArray()))
-+ .getEncoded();
-+ if (token.config.getNssNetscapeDbWorkaround() &&
-+ attrsMap.get(CKA_NETSCAPE_DB) == null) {
-+ attrsMap.put(CKA_NETSCAPE_DB,
-+ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO));
-+ }
-+ } else if (keyType == CKK_DH) {
-+ if (debug != null) {
-+ debug.println("Importing a Diffie-Hellman private key...");
-+ }
-+ if (DHKF == null) {
-+ DHKFLock.lock();
-+ try {
-+ if (DHKF == null) {
-+ DHKF = KeyFactory.getInstance(
-+ "DH", P11Util.getSunJceProvider());
-+ }
-+ } finally {
-+ DHKFLock.unlock();
-+ }
-+ }
-+ DHPrivateKeySpec spec = new DHPrivateKeySpec
-+ (((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null)
-+ ? v : BigInteger.ZERO,
-+ ((v = attrsMap.get(CKA_PRIME).getBigInteger()) != null)
-+ ? v : BigInteger.ZERO,
-+ ((v = attrsMap.get(CKA_BASE).getBigInteger()) != null)
-+ ? v : BigInteger.ZERO);
-+ keyBytes = DHKF.generatePrivate(spec).getEncoded();
-+ if (token.config.getNssNetscapeDbWorkaround() &&
-+ attrsMap.get(CKA_NETSCAPE_DB) == null) {
-+ attrsMap.put(CKA_NETSCAPE_DB,
-+ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO));
-+ }
-+ } else {
-+ if (debug != null) {
-+ debug.println("Unrecognized private key type.");
-+ }
-+ throw new PKCS11Exception(CKR_GENERAL_ERROR);
-+ }
-+ } else if (keyClass == CKO_SECRET_KEY) {
-+ if (debug != null) {
-+ debug.println("Importing a secret key...");
-+ }
-+ keyBytes = attrsMap.get(CKA_VALUE).getByteArray();
-+ }
-+ if (keyBytes == null || keyBytes.length == 0) {
-+ if (debug != null) {
-+ debug.println("Private or secret key plain bytes could" +
-+ " not be obtained. Import failed.");
-+ }
-+ throw new PKCS11Exception(CKR_GENERAL_ERROR);
-+ }
-+ importerCipher.init(Cipher.ENCRYPT_MODE, importerKey,
-+ new IvParameterSpec((byte[])importerKeyMechanism.pParameter),
-+ null);
-+ attributes = new CK_ATTRIBUTE[attrsMap.size()];
-+ attrsMap.values().toArray(attributes);
-+ encKeyBytes = importerCipher.doFinal(keyBytes);
-+ attributes = token.getAttributes(TemplateManager.O_IMPORT,
-+ keyClass, keyType, attributes);
-+ keyID = token.p11.C_UnwrapKey(hSession,
-+ importerKeyMechanism, importerKeyID, encKeyBytes, attributes);
-+ if (debug != null) {
-+ debug.println("Imported key ID: " + keyID);
-+ }
-+ } catch (Throwable t) {
-+ throw new PKCS11Exception(CKR_GENERAL_ERROR);
-+ } finally {
-+ importerKey.releaseKeyID();
-+ }
-+ return Long.valueOf(keyID);
-+ }
-+
-+ private static void createImporterKey(Token token) {
-+ if (debug != null) {
-+ debug.println("Generating Importer Key...");
-+ }
-+ byte[] iv = new byte[16];
-+ JCAUtil.getSecureRandom().nextBytes(iv);
-+ importerKeyMechanism = new CK_MECHANISM(CKM_AES_CBC_PAD, iv);
-+ try {
-+ CK_ATTRIBUTE[] attributes = token.getAttributes(TemplateManager.O_GENERATE,
-+ CKO_SECRET_KEY, CKK_AES, new CK_ATTRIBUTE[] {
-+ new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
-+ new CK_ATTRIBUTE(CKA_VALUE_LEN, 256 >> 3)});
-+ Session s = null;
-+ try {
-+ s = token.getObjSession();
-+ long keyID = token.p11.C_GenerateKey(
-+ s.id(), new CK_MECHANISM(CKM_AES_KEY_GEN),
-+ attributes);
-+ if (debug != null) {
-+ debug.println("Importer Key ID: " + keyID);
-+ }
-+ importerKey = (P11Key)P11Key.secretKey(s, keyID, "AES",
-+ 256 >> 3, null);
-+ } catch (PKCS11Exception e) {
-+ // best effort
-+ } finally {
-+ token.releaseSession(s);
-+ }
-+ if (importerKey != null) {
-+ importerCipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
-+ }
-+ } catch (Throwable t) {
-+ // best effort
-+ importerKey = null;
-+ importerCipher = null;
-+ // importerKeyMechanism value is kept initialized to indicate that
-+ // Importer Key creation has been tried and failed.
-+ }
-+ }
-+}
-diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
-index 5d3963ea893..42c72b393fd 100644
---- openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
-+++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
-@@ -26,6 +26,9 @@
- package sun.security.pkcs11;
-
- import java.io.*;
-+import java.lang.invoke.MethodHandle;
-+import java.lang.invoke.MethodHandles;
-+import java.lang.invoke.MethodType;
- import java.util.*;
-
- import java.security.*;
-@@ -66,6 +69,26 @@ public final class SunPKCS11 extends AuthProvider {
- private static final boolean systemFipsEnabled = SharedSecrets
- .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled();
-
-+ private static final boolean plainKeySupportEnabled = SharedSecrets
-+ .getJavaSecuritySystemConfiguratorAccess().isPlainKeySupportEnabled();
-+
-+ private static final MethodHandle fipsImportKey;
-+ static {
-+ MethodHandle fipsImportKeyTmp = null;
-+ if (plainKeySupportEnabled) {
-+ try {
-+ fipsImportKeyTmp = MethodHandles.lookup().findStatic(
-+ FIPSKeyImporter.class, "importKey",
-+ MethodType.methodType(Long.class, SunPKCS11.class,
-+ long.class, CK_ATTRIBUTE[].class));
-+ } catch (Throwable t) {
-+ throw new SecurityException("FIPS key importer initialization" +
-+ " failed", t);
-+ }
-+ }
-+ fipsImportKey = fipsImportKeyTmp;
-+ }
-+
- private static final long serialVersionUID = -1354835039035306505L;
-
- static final Debug debug = Debug.getInstance("sunpkcs11");
-@@ -324,10 +347,15 @@ public final class SunPKCS11 extends AuthProvider {
- // request multithreaded access first
- initArgs.flags = CKF_OS_LOCKING_OK;
- PKCS11 tmpPKCS11;
-+ MethodHandle fipsKeyImporter = null;
-+ if (plainKeySupportEnabled) {
-+ fipsKeyImporter = MethodHandles.insertArguments(
-+ fipsImportKey, 0, this);
-+ }
- try {
- tmpPKCS11 = PKCS11.getInstance(
- library, functionList, initArgs,
-- config.getOmitInitialize());
-+ config.getOmitInitialize(), fipsKeyImporter);
- } catch (PKCS11Exception e) {
- if (debug != null) {
- debug.println("Multi-threaded initialization failed: " + e);
-@@ -343,7 +371,7 @@ public final class SunPKCS11 extends AuthProvider {
- initArgs.flags = 0;
- }
- tmpPKCS11 = PKCS11.getInstance(library,
-- functionList, initArgs, config.getOmitInitialize());
-+ functionList, initArgs, config.getOmitInitialize(), fipsKeyImporter);
- }
- p11 = tmpPKCS11;
-
-diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
-index 5c0aacd1a67..4d80145cb91 100644
---- openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
-+++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
-@@ -49,6 +49,7 @@ package sun.security.pkcs11.wrapper;
-
- import java.io.File;
- import java.io.IOException;
-+import java.lang.invoke.MethodHandle;
- import java.util.*;
-
- import java.security.AccessController;
-@@ -152,16 +153,28 @@ public class PKCS11 {
-
- public static synchronized PKCS11 getInstance(String pkcs11ModulePath,
- String functionList, CK_C_INITIALIZE_ARGS pInitArgs,
-- boolean omitInitialize) throws IOException, PKCS11Exception {
-+ boolean omitInitialize, MethodHandle fipsKeyImporter)
-+ throws IOException, PKCS11Exception {
- // we may only call C_Initialize once per native .so/.dll
- // so keep a cache using the (non-canonicalized!) path
- PKCS11 pkcs11 = moduleMap.get(pkcs11ModulePath);
- if (pkcs11 == null) {
-+ boolean nssFipsMode = fipsKeyImporter != null;
- if ((pInitArgs != null)
- && ((pInitArgs.flags & CKF_OS_LOCKING_OK) != 0)) {
-- pkcs11 = new PKCS11(pkcs11ModulePath, functionList);
-+ if (nssFipsMode) {
-+ pkcs11 = new FIPSPKCS11(pkcs11ModulePath, functionList,
-+ fipsKeyImporter);
-+ } else {
-+ pkcs11 = new PKCS11(pkcs11ModulePath, functionList);
-+ }
- } else {
-- pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList);
-+ if (nssFipsMode) {
-+ pkcs11 = new SynchronizedFIPSPKCS11(pkcs11ModulePath,
-+ functionList, fipsKeyImporter);
-+ } else {
-+ pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList);
-+ }
- }
- if (omitInitialize == false) {
- try {
-@@ -1911,4 +1924,69 @@ static class SynchronizedPKCS11 extends PKCS11 {
- super.C_GenerateRandom(hSession, randomData);
- }
- }
-+
-+// PKCS11 subclass that allows using plain private or secret keys in
-+// FIPS-configured NSS Software Tokens. Only used when System FIPS
-+// is enabled.
-+static class FIPSPKCS11 extends PKCS11 {
-+ private MethodHandle fipsKeyImporter;
-+ FIPSPKCS11(String pkcs11ModulePath, String functionListName,
-+ MethodHandle fipsKeyImporter) throws IOException {
-+ super(pkcs11ModulePath, functionListName);
-+ this.fipsKeyImporter = fipsKeyImporter;
-+ }
-+
-+ public synchronized long C_CreateObject(long hSession,
-+ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
-+ // Creating sensitive key objects from plain key material in a
-+ // FIPS-configured NSS Software Token is not allowed. We apply
-+ // a key-unwrapping scheme to achieve so.
-+ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) {
-+ try {
-+ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate))
-+ .longValue();
-+ } catch (Throwable t) {
-+ throw new PKCS11Exception(CKR_GENERAL_ERROR);
-+ }
-+ }
-+ return super.C_CreateObject(hSession, pTemplate);
-+ }
-+}
-+
-+// FIPSPKCS11 synchronized counterpart.
-+static class SynchronizedFIPSPKCS11 extends SynchronizedPKCS11 {
-+ private MethodHandle fipsKeyImporter;
-+ SynchronizedFIPSPKCS11(String pkcs11ModulePath, String functionListName,
-+ MethodHandle fipsKeyImporter) throws IOException {
-+ super(pkcs11ModulePath, functionListName);
-+ this.fipsKeyImporter = fipsKeyImporter;
-+ }
-+
-+ public synchronized long C_CreateObject(long hSession,
-+ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
-+ // See FIPSPKCS11::C_CreateObject.
-+ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) {
-+ try {
-+ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate))
-+ .longValue();
-+ } catch (Throwable t) {
-+ throw new PKCS11Exception(CKR_GENERAL_ERROR);
-+ }
-+ }
-+ return super.C_CreateObject(hSession, pTemplate);
-+ }
-+}
-+
-+private static class FIPSPKCS11Helper {
-+ static boolean isSensitiveObject(CK_ATTRIBUTE[] pTemplate) {
-+ for (CK_ATTRIBUTE attr : pTemplate) {
-+ if (attr.type == CKA_CLASS &&
-+ (attr.getLong() == CKO_PRIVATE_KEY ||
-+ attr.getLong() == CKO_SECRET_KEY)) {
-+ return true;
-+ }
-+ }
-+ return false;
-+ }
-+}
- }
-diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java
-index e2d6d371bec..dc5e7eefdd3 100644
---- openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java
-+++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java
-@@ -219,6 +219,14 @@ public class PKCS11Exception extends Exception {
- return "0x" + Functions.toFullHexString((int)errorCode);
- }
-
-+ /**
-+ * Constructor taking the error code (the CKR_* constants in PKCS#11) with
-+ * no extra info for the error message.
-+ */
-+ public PKCS11Exception(long errorCode) {
-+ this(errorCode, null);
-+ }
-+
- /**
- * Constructor taking the error code (the CKR_* constants in PKCS#11) and
- * extra info for error message.
diff --git a/SOURCES/rh1995150-disable_non-fips_crypto.patch b/SOURCES/rh1995150-disable_non-fips_crypto.patch
deleted file mode 100644
index de06552..0000000
--- a/SOURCES/rh1995150-disable_non-fips_crypto.patch
+++ /dev/null
@@ -1,591 +0,0 @@
-diff --git openjdk.orig/src/java.base/share/classes/module-info.java openjdk/src/java.base/share/classes/module-info.java
-index 63bb580eb3a..238735c0c8c 100644
---- openjdk.orig/src/java.base/share/classes/module-info.java
-+++ openjdk/src/java.base/share/classes/module-info.java
-@@ -152,6 +152,7 @@ module java.base {
- java.naming,
- java.rmi,
- jdk.charsets,
-+ jdk.crypto.ec,
- jdk.jartool,
- jdk.jlink,
- jdk.net,
-diff --git openjdk.orig/src/java.base/share/classes/sun/security/provider/SunEntries.java openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java
-index 912cad59714..7cb5ebcde51 100644
---- openjdk.orig/src/java.base/share/classes/sun/security/provider/SunEntries.java
-+++ openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java
-@@ -30,6 +30,7 @@ import java.net.*;
- import java.util.*;
- import java.security.*;
-
-+import jdk.internal.access.SharedSecrets;
- import jdk.internal.util.StaticProperty;
- import sun.security.action.GetPropertyAction;
- import sun.security.util.SecurityProviderConstants;
-@@ -83,6 +84,10 @@ import static sun.security.util.SecurityProviderConstants.getAliases;
-
- public final class SunEntries {
-
-+ private static final boolean systemFipsEnabled =
-+ SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+ .isSystemFipsEnabled();
-+
- // the default algo used by SecureRandom class for new SecureRandom() calls
- public static final String DEF_SECURE_RANDOM_ALGO;
-
-@@ -94,147 +99,149 @@ public final class SunEntries {
- // common attribute map
- HashMap attrs = new HashMap<>(3);
-
-- /*
-- * SecureRandom engines
-- */
-- attrs.put("ThreadSafe", "true");
-- if (NativePRNG.isAvailable()) {
-- add(p, "SecureRandom", "NativePRNG",
-- "sun.security.provider.NativePRNG", attrs);
-- }
-- if (NativePRNG.Blocking.isAvailable()) {
-- add(p, "SecureRandom", "NativePRNGBlocking",
-- "sun.security.provider.NativePRNG$Blocking", attrs);
-- }
-- if (NativePRNG.NonBlocking.isAvailable()) {
-- add(p, "SecureRandom", "NativePRNGNonBlocking",
-- "sun.security.provider.NativePRNG$NonBlocking", attrs);
-- }
-- attrs.put("ImplementedIn", "Software");
-- add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", attrs);
-- add(p, "SecureRandom", "SHA1PRNG",
-- "sun.security.provider.SecureRandom", attrs);
--
-- /*
-- * Signature engines
-- */
-- attrs.clear();
-- String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" +
-- "|java.security.interfaces.DSAPrivateKey";
-- attrs.put("SupportedKeyClasses", dsaKeyClasses);
-- attrs.put("ImplementedIn", "Software");
--
-- attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures
--
-- addWithAlias(p, "Signature", "SHA1withDSA",
-- "sun.security.provider.DSA$SHA1withDSA", attrs);
-- addWithAlias(p, "Signature", "NONEwithDSA",
-- "sun.security.provider.DSA$RawDSA", attrs);
--
-- // for DSA signatures with 224/256-bit digests
-- attrs.put("KeySize", "2048");
--
-- addWithAlias(p, "Signature", "SHA224withDSA",
-- "sun.security.provider.DSA$SHA224withDSA", attrs);
-- addWithAlias(p, "Signature", "SHA256withDSA",
-- "sun.security.provider.DSA$SHA256withDSA", attrs);
--
-- addWithAlias(p, "Signature", "SHA3-224withDSA",
-- "sun.security.provider.DSA$SHA3_224withDSA", attrs);
-- addWithAlias(p, "Signature", "SHA3-256withDSA",
-- "sun.security.provider.DSA$SHA3_256withDSA", attrs);
--
-- attrs.put("KeySize", "3072"); // for DSA sig using 384/512-bit digests
--
-- addWithAlias(p, "Signature", "SHA384withDSA",
-- "sun.security.provider.DSA$SHA384withDSA", attrs);
-- addWithAlias(p, "Signature", "SHA512withDSA",
-- "sun.security.provider.DSA$SHA512withDSA", attrs);
-- addWithAlias(p, "Signature", "SHA3-384withDSA",
-- "sun.security.provider.DSA$SHA3_384withDSA", attrs);
-- addWithAlias(p, "Signature", "SHA3-512withDSA",
-- "sun.security.provider.DSA$SHA3_512withDSA", attrs);
--
-- attrs.remove("KeySize");
--
-- add(p, "Signature", "SHA1withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA1withDSAinP1363Format");
-- add(p, "Signature", "NONEwithDSAinP1363Format",
-- "sun.security.provider.DSA$RawDSAinP1363Format");
-- add(p, "Signature", "SHA224withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA224withDSAinP1363Format");
-- add(p, "Signature", "SHA256withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA256withDSAinP1363Format");
-- add(p, "Signature", "SHA384withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA384withDSAinP1363Format");
-- add(p, "Signature", "SHA512withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA512withDSAinP1363Format");
-- add(p, "Signature", "SHA3-224withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA3_224withDSAinP1363Format");
-- add(p, "Signature", "SHA3-256withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA3_256withDSAinP1363Format");
-- add(p, "Signature", "SHA3-384withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA3_384withDSAinP1363Format");
-- add(p, "Signature", "SHA3-512withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA3_512withDSAinP1363Format");
-- /*
-- * Key Pair Generator engines
-- */
-- attrs.clear();
-- attrs.put("ImplementedIn", "Software");
-- attrs.put("KeySize", "2048"); // for DSA KPG and APG only
-+ if (!systemFipsEnabled) {
-+ /*
-+ * SecureRandom engines
-+ */
-+ attrs.put("ThreadSafe", "true");
-+ if (NativePRNG.isAvailable()) {
-+ add(p, "SecureRandom", "NativePRNG",
-+ "sun.security.provider.NativePRNG", attrs);
-+ }
-+ if (NativePRNG.Blocking.isAvailable()) {
-+ add(p, "SecureRandom", "NativePRNGBlocking",
-+ "sun.security.provider.NativePRNG$Blocking", attrs);
-+ }
-+ if (NativePRNG.NonBlocking.isAvailable()) {
-+ add(p, "SecureRandom", "NativePRNGNonBlocking",
-+ "sun.security.provider.NativePRNG$NonBlocking", attrs);
-+ }
-+ attrs.put("ImplementedIn", "Software");
-+ add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", attrs);
-+ add(p, "SecureRandom", "SHA1PRNG",
-+ "sun.security.provider.SecureRandom", attrs);
-
-- String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$";
-- dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current");
-- addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs);
-+ /*
-+ * Signature engines
-+ */
-+ attrs.clear();
-+ String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" +
-+ "|java.security.interfaces.DSAPrivateKey";
-+ attrs.put("SupportedKeyClasses", dsaKeyClasses);
-+ attrs.put("ImplementedIn", "Software");
-+
-+ attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures
-+
-+ addWithAlias(p, "Signature", "SHA1withDSA",
-+ "sun.security.provider.DSA$SHA1withDSA", attrs);
-+ addWithAlias(p, "Signature", "NONEwithDSA",
-+ "sun.security.provider.DSA$RawDSA", attrs);
-+
-+ // for DSA signatures with 224/256-bit digests
-+ attrs.put("KeySize", "2048");
-+
-+ addWithAlias(p, "Signature", "SHA224withDSA",
-+ "sun.security.provider.DSA$SHA224withDSA", attrs);
-+ addWithAlias(p, "Signature", "SHA256withDSA",
-+ "sun.security.provider.DSA$SHA256withDSA", attrs);
-+
-+ addWithAlias(p, "Signature", "SHA3-224withDSA",
-+ "sun.security.provider.DSA$SHA3_224withDSA", attrs);
-+ addWithAlias(p, "Signature", "SHA3-256withDSA",
-+ "sun.security.provider.DSA$SHA3_256withDSA", attrs);
-+
-+ attrs.put("KeySize", "3072"); // for DSA sig using 384/512-bit digests
-+
-+ addWithAlias(p, "Signature", "SHA384withDSA",
-+ "sun.security.provider.DSA$SHA384withDSA", attrs);
-+ addWithAlias(p, "Signature", "SHA512withDSA",
-+ "sun.security.provider.DSA$SHA512withDSA", attrs);
-+ addWithAlias(p, "Signature", "SHA3-384withDSA",
-+ "sun.security.provider.DSA$SHA3_384withDSA", attrs);
-+ addWithAlias(p, "Signature", "SHA3-512withDSA",
-+ "sun.security.provider.DSA$SHA3_512withDSA", attrs);
-+
-+ attrs.remove("KeySize");
-+
-+ add(p, "Signature", "SHA1withDSAinP1363Format",
-+ "sun.security.provider.DSA$SHA1withDSAinP1363Format");
-+ add(p, "Signature", "NONEwithDSAinP1363Format",
-+ "sun.security.provider.DSA$RawDSAinP1363Format");
-+ add(p, "Signature", "SHA224withDSAinP1363Format",
-+ "sun.security.provider.DSA$SHA224withDSAinP1363Format");
-+ add(p, "Signature", "SHA256withDSAinP1363Format",
-+ "sun.security.provider.DSA$SHA256withDSAinP1363Format");
-+ add(p, "Signature", "SHA384withDSAinP1363Format",
-+ "sun.security.provider.DSA$SHA384withDSAinP1363Format");
-+ add(p, "Signature", "SHA512withDSAinP1363Format",
-+ "sun.security.provider.DSA$SHA512withDSAinP1363Format");
-+ add(p, "Signature", "SHA3-224withDSAinP1363Format",
-+ "sun.security.provider.DSA$SHA3_224withDSAinP1363Format");
-+ add(p, "Signature", "SHA3-256withDSAinP1363Format",
-+ "sun.security.provider.DSA$SHA3_256withDSAinP1363Format");
-+ add(p, "Signature", "SHA3-384withDSAinP1363Format",
-+ "sun.security.provider.DSA$SHA3_384withDSAinP1363Format");
-+ add(p, "Signature", "SHA3-512withDSAinP1363Format",
-+ "sun.security.provider.DSA$SHA3_512withDSAinP1363Format");
-+ /*
-+ * Key Pair Generator engines
-+ */
-+ attrs.clear();
-+ attrs.put("ImplementedIn", "Software");
-+ attrs.put("KeySize", "2048"); // for DSA KPG and APG only
-
-- /*
-- * Algorithm Parameter Generator engines
-- */
-- addWithAlias(p, "AlgorithmParameterGenerator", "DSA",
-- "sun.security.provider.DSAParameterGenerator", attrs);
-- attrs.remove("KeySize");
-+ String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$";
-+ dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current");
-+ addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs);
-
-- /*
-- * Algorithm Parameter engines
-- */
-- addWithAlias(p, "AlgorithmParameters", "DSA",
-- "sun.security.provider.DSAParameters", attrs);
-+ /*
-+ * Algorithm Parameter Generator engines
-+ */
-+ addWithAlias(p, "AlgorithmParameterGenerator", "DSA",
-+ "sun.security.provider.DSAParameterGenerator", attrs);
-+ attrs.remove("KeySize");
-
-- /*
-- * Key factories
-- */
-- addWithAlias(p, "KeyFactory", "DSA",
-- "sun.security.provider.DSAKeyFactory", attrs);
-+ /*
-+ * Algorithm Parameter engines
-+ */
-+ addWithAlias(p, "AlgorithmParameters", "DSA",
-+ "sun.security.provider.DSAParameters", attrs);
-
-- /*
-- * Digest engines
-- */
-- add(p, "MessageDigest", "MD2", "sun.security.provider.MD2", attrs);
-- add(p, "MessageDigest", "MD5", "sun.security.provider.MD5", attrs);
-- addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA",
-- attrs);
-+ /*
-+ * Key factories
-+ */
-+ addWithAlias(p, "KeyFactory", "DSA",
-+ "sun.security.provider.DSAKeyFactory", attrs);
-
-- addWithAlias(p, "MessageDigest", "SHA-224",
-- "sun.security.provider.SHA2$SHA224", attrs);
-- addWithAlias(p, "MessageDigest", "SHA-256",
-- "sun.security.provider.SHA2$SHA256", attrs);
-- addWithAlias(p, "MessageDigest", "SHA-384",
-- "sun.security.provider.SHA5$SHA384", attrs);
-- addWithAlias(p, "MessageDigest", "SHA-512",
-- "sun.security.provider.SHA5$SHA512", attrs);
-- addWithAlias(p, "MessageDigest", "SHA-512/224",
-- "sun.security.provider.SHA5$SHA512_224", attrs);
-- addWithAlias(p, "MessageDigest", "SHA-512/256",
-- "sun.security.provider.SHA5$SHA512_256", attrs);
-- addWithAlias(p, "MessageDigest", "SHA3-224",
-- "sun.security.provider.SHA3$SHA224", attrs);
-- addWithAlias(p, "MessageDigest", "SHA3-256",
-- "sun.security.provider.SHA3$SHA256", attrs);
-- addWithAlias(p, "MessageDigest", "SHA3-384",
-- "sun.security.provider.SHA3$SHA384", attrs);
-- addWithAlias(p, "MessageDigest", "SHA3-512",
-- "sun.security.provider.SHA3$SHA512", attrs);
-+ /*
-+ * Digest engines
-+ */
-+ add(p, "MessageDigest", "MD2", "sun.security.provider.MD2", attrs);
-+ add(p, "MessageDigest", "MD5", "sun.security.provider.MD5", attrs);
-+ addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA",
-+ attrs);
-+
-+ addWithAlias(p, "MessageDigest", "SHA-224",
-+ "sun.security.provider.SHA2$SHA224", attrs);
-+ addWithAlias(p, "MessageDigest", "SHA-256",
-+ "sun.security.provider.SHA2$SHA256", attrs);
-+ addWithAlias(p, "MessageDigest", "SHA-384",
-+ "sun.security.provider.SHA5$SHA384", attrs);
-+ addWithAlias(p, "MessageDigest", "SHA-512",
-+ "sun.security.provider.SHA5$SHA512", attrs);
-+ addWithAlias(p, "MessageDigest", "SHA-512/224",
-+ "sun.security.provider.SHA5$SHA512_224", attrs);
-+ addWithAlias(p, "MessageDigest", "SHA-512/256",
-+ "sun.security.provider.SHA5$SHA512_256", attrs);
-+ addWithAlias(p, "MessageDigest", "SHA3-224",
-+ "sun.security.provider.SHA3$SHA224", attrs);
-+ addWithAlias(p, "MessageDigest", "SHA3-256",
-+ "sun.security.provider.SHA3$SHA256", attrs);
-+ addWithAlias(p, "MessageDigest", "SHA3-384",
-+ "sun.security.provider.SHA3$SHA384", attrs);
-+ addWithAlias(p, "MessageDigest", "SHA3-512",
-+ "sun.security.provider.SHA3$SHA512", attrs);
-+ }
-
- /*
- * Certificates
-diff --git openjdk.orig/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
-index 8c9e4f9dbe6..883dc04758e 100644
---- openjdk.orig/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
-+++ openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
-@@ -38,6 +38,7 @@ import java.util.HashMap;
- import java.util.Iterator;
- import java.util.List;
-
-+import jdk.internal.access.SharedSecrets;
- import sun.security.ec.ed.EdDSAAlgorithmParameters;
- import sun.security.ec.ed.EdDSAKeyFactory;
- import sun.security.ec.ed.EdDSAKeyPairGenerator;
-@@ -56,6 +57,10 @@ public final class SunEC extends Provider {
-
- private static final long serialVersionUID = -2279741672933606418L;
-
-+ private static final boolean systemFipsEnabled =
-+ SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+ .isSystemFipsEnabled();
-+
- private static class ProviderServiceA extends ProviderService {
- ProviderServiceA(Provider p, String type, String algo, String cn,
- HashMap attrs) {
-@@ -249,85 +254,86 @@ public final class SunEC extends Provider {
-
- putXDHEntries();
- putEdDSAEntries();
--
-- /*
-- * Signature engines
-- */
-- putService(new ProviderService(this, "Signature",
-- "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw",
-- null, ATTRS));
-- putService(new ProviderServiceA(this, "Signature",
-- "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1",
-- ATTRS));
-- putService(new ProviderServiceA(this, "Signature",
-- "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224",
-- ATTRS));
-- putService(new ProviderServiceA(this, "Signature",
-- "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256",
-- ATTRS));
-- putService(new ProviderServiceA(this, "Signature",
-- "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384",
-- ATTRS));
-- putService(new ProviderServiceA(this, "Signature",
-- "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512",
-- ATTRS));
-- putService(new ProviderServiceA(this, "Signature",
-- "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224",
-- ATTRS));
-- putService(new ProviderServiceA(this, "Signature",
-- "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256",
-- ATTRS));
-- putService(new ProviderServiceA(this, "Signature",
-- "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384",
-- ATTRS));
-- putService(new ProviderServiceA(this, "Signature",
-- "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512",
-- ATTRS));
--
-- putService(new ProviderService(this, "Signature",
-- "NONEwithECDSAinP1363Format",
-- "sun.security.ec.ECDSASignature$RawinP1363Format"));
-- putService(new ProviderService(this, "Signature",
-- "SHA1withECDSAinP1363Format",
-- "sun.security.ec.ECDSASignature$SHA1inP1363Format"));
-- putService(new ProviderService(this, "Signature",
-- "SHA224withECDSAinP1363Format",
-- "sun.security.ec.ECDSASignature$SHA224inP1363Format"));
-- putService(new ProviderService(this, "Signature",
-- "SHA256withECDSAinP1363Format",
-- "sun.security.ec.ECDSASignature$SHA256inP1363Format"));
-- putService(new ProviderService(this, "Signature",
-- "SHA384withECDSAinP1363Format",
-- "sun.security.ec.ECDSASignature$SHA384inP1363Format"));
-- putService(new ProviderService(this, "Signature",
-- "SHA512withECDSAinP1363Format",
-- "sun.security.ec.ECDSASignature$SHA512inP1363Format"));
--
-- putService(new ProviderService(this, "Signature",
-- "SHA3-224withECDSAinP1363Format",
-- "sun.security.ec.ECDSASignature$SHA3_224inP1363Format"));
-- putService(new ProviderService(this, "Signature",
-- "SHA3-256withECDSAinP1363Format",
-- "sun.security.ec.ECDSASignature$SHA3_256inP1363Format"));
-- putService(new ProviderService(this, "Signature",
-- "SHA3-384withECDSAinP1363Format",
-- "sun.security.ec.ECDSASignature$SHA3_384inP1363Format"));
-- putService(new ProviderService(this, "Signature",
-- "SHA3-512withECDSAinP1363Format",
-- "sun.security.ec.ECDSASignature$SHA3_512inP1363Format"));
--
-- /*
-- * Key Pair Generator engine
-- */
-- putService(new ProviderService(this, "KeyPairGenerator",
-- "EC", "sun.security.ec.ECKeyPairGenerator",
-- List.of("EllipticCurve"), ATTRS));
--
-- /*
-- * Key Agreement engine
-- */
-- putService(new ProviderService(this, "KeyAgreement",
-- "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS));
-+ if (!systemFipsEnabled) {
-+ /*
-+ * Signature engines
-+ */
-+ putService(new ProviderService(this, "Signature",
-+ "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw",
-+ null, ATTRS));
-+ putService(new ProviderServiceA(this, "Signature",
-+ "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1",
-+ ATTRS));
-+ putService(new ProviderServiceA(this, "Signature",
-+ "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224",
-+ ATTRS));
-+ putService(new ProviderServiceA(this, "Signature",
-+ "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256",
-+ ATTRS));
-+ putService(new ProviderServiceA(this, "Signature",
-+ "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384",
-+ ATTRS));
-+ putService(new ProviderServiceA(this, "Signature",
-+ "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512",
-+ ATTRS));
-+ putService(new ProviderServiceA(this, "Signature",
-+ "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224",
-+ ATTRS));
-+ putService(new ProviderServiceA(this, "Signature",
-+ "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256",
-+ ATTRS));
-+ putService(new ProviderServiceA(this, "Signature",
-+ "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384",
-+ ATTRS));
-+ putService(new ProviderServiceA(this, "Signature",
-+ "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512",
-+ ATTRS));
-+
-+ putService(new ProviderService(this, "Signature",
-+ "NONEwithECDSAinP1363Format",
-+ "sun.security.ec.ECDSASignature$RawinP1363Format"));
-+ putService(new ProviderService(this, "Signature",
-+ "SHA1withECDSAinP1363Format",
-+ "sun.security.ec.ECDSASignature$SHA1inP1363Format"));
-+ putService(new ProviderService(this, "Signature",
-+ "SHA224withECDSAinP1363Format",
-+ "sun.security.ec.ECDSASignature$SHA224inP1363Format"));
-+ putService(new ProviderService(this, "Signature",
-+ "SHA256withECDSAinP1363Format",
-+ "sun.security.ec.ECDSASignature$SHA256inP1363Format"));
-+ putService(new ProviderService(this, "Signature",
-+ "SHA384withECDSAinP1363Format",
-+ "sun.security.ec.ECDSASignature$SHA384inP1363Format"));
-+ putService(new ProviderService(this, "Signature",
-+ "SHA512withECDSAinP1363Format",
-+ "sun.security.ec.ECDSASignature$SHA512inP1363Format"));
-+
-+ putService(new ProviderService(this, "Signature",
-+ "SHA3-224withECDSAinP1363Format",
-+ "sun.security.ec.ECDSASignature$SHA3_224inP1363Format"));
-+ putService(new ProviderService(this, "Signature",
-+ "SHA3-256withECDSAinP1363Format",
-+ "sun.security.ec.ECDSASignature$SHA3_256inP1363Format"));
-+ putService(new ProviderService(this, "Signature",
-+ "SHA3-384withECDSAinP1363Format",
-+ "sun.security.ec.ECDSASignature$SHA3_384inP1363Format"));
-+ putService(new ProviderService(this, "Signature",
-+ "SHA3-512withECDSAinP1363Format",
-+ "sun.security.ec.ECDSASignature$SHA3_512inP1363Format"));
-+
-+ /*
-+ * Key Pair Generator engine
-+ */
-+ putService(new ProviderService(this, "KeyPairGenerator",
-+ "EC", "sun.security.ec.ECKeyPairGenerator",
-+ List.of("EllipticCurve"), ATTRS));
-+
-+ /*
-+ * Key Agreement engine
-+ */
-+ putService(new ProviderService(this, "KeyAgreement",
-+ "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS));
-+ }
- }
-
- private void putXDHEntries() {
-@@ -344,23 +350,25 @@ public final class SunEC extends Provider {
- "X448", "sun.security.ec.XDHKeyFactory.X448",
- ATTRS));
-
-- putService(new ProviderService(this, "KeyPairGenerator",
-- "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS));
-- putService(new ProviderServiceA(this, "KeyPairGenerator",
-- "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519",
-- ATTRS));
-- putService(new ProviderServiceA(this, "KeyPairGenerator",
-- "X448", "sun.security.ec.XDHKeyPairGenerator.X448",
-- ATTRS));
--
-- putService(new ProviderService(this, "KeyAgreement",
-- "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS));
-- putService(new ProviderServiceA(this, "KeyAgreement",
-- "X25519", "sun.security.ec.XDHKeyAgreement.X25519",
-- ATTRS));
-- putService(new ProviderServiceA(this, "KeyAgreement",
-- "X448", "sun.security.ec.XDHKeyAgreement.X448",
-- ATTRS));
-+ if (!systemFipsEnabled) {
-+ putService(new ProviderService(this, "KeyPairGenerator",
-+ "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS));
-+ putService(new ProviderServiceA(this, "KeyPairGenerator",
-+ "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519",
-+ ATTRS));
-+ putService(new ProviderServiceA(this, "KeyPairGenerator",
-+ "X448", "sun.security.ec.XDHKeyPairGenerator.X448",
-+ ATTRS));
-+
-+ putService(new ProviderService(this, "KeyAgreement",
-+ "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS));
-+ putService(new ProviderServiceA(this, "KeyAgreement",
-+ "X25519", "sun.security.ec.XDHKeyAgreement.X25519",
-+ ATTRS));
-+ putService(new ProviderServiceA(this, "KeyAgreement",
-+ "X448", "sun.security.ec.XDHKeyAgreement.X448",
-+ ATTRS));
-+ }
- }
-
- private void putEdDSAEntries() {
-@@ -375,21 +383,23 @@ public final class SunEC extends Provider {
- putService(new ProviderServiceA(this, "KeyFactory",
- "Ed448", "sun.security.ec.ed.EdDSAKeyFactory.Ed448", ATTRS));
-
-- putService(new ProviderService(this, "KeyPairGenerator",
-- "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS));
-- putService(new ProviderServiceA(this, "KeyPairGenerator",
-- "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519",
-- ATTRS));
-- putService(new ProviderServiceA(this, "KeyPairGenerator",
-- "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448",
-- ATTRS));
--
-- putService(new ProviderService(this, "Signature",
-- "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS));
-- putService(new ProviderServiceA(this, "Signature",
-- "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS));
-- putService(new ProviderServiceA(this, "Signature",
-- "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS));
-+ if (!systemFipsEnabled) {
-+ putService(new ProviderService(this, "KeyPairGenerator",
-+ "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS));
-+ putService(new ProviderServiceA(this, "KeyPairGenerator",
-+ "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519",
-+ ATTRS));
-+ putService(new ProviderServiceA(this, "KeyPairGenerator",
-+ "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448",
-+ ATTRS));
-+
-+ putService(new ProviderService(this, "Signature",
-+ "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS));
-+ putService(new ProviderServiceA(this, "Signature",
-+ "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS));
-+ putService(new ProviderServiceA(this, "Signature",
-+ "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS));
-+ }
-
- }
- }
diff --git a/SOURCES/rh1996182-extend_security_policy.patch b/SOURCES/rh1996182-extend_security_policy.patch
deleted file mode 100644
index 7622622..0000000
--- a/SOURCES/rh1996182-extend_security_policy.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-commit bfd7c5dae9c15266799cb885b8c60199217b65b9
-Author: Andrew Hughes
-Date: Mon Aug 30 16:14:14 2021 +0100
-
- RH1996182: Extend default security policy to allow SunPKCS11 access to jdk.internal.access
-
-diff --git openjdk.orig/src/java.base/share/lib/security/default.policy openjdk/src/java.base/share/lib/security/default.policy
-index 8356e56367b..23925f048be 100644
---- openjdk.orig/src/java.base/share/lib/security/default.policy
-+++ openjdk/src/java.base/share/lib/security/default.policy
-@@ -128,6 +128,7 @@ grant codeBase "jrt:/jdk.crypto.ec" {
- grant codeBase "jrt:/jdk.crypto.cryptoki" {
- permission java.lang.RuntimePermission
- "accessClassInPackage.com.sun.crypto.provider";
-+ permission java.lang.RuntimePermission "accessClassInPackage.jdk.internal.access";
- permission java.lang.RuntimePermission "accessClassInPackage.jdk.internal.misc";
- permission java.lang.RuntimePermission
- "accessClassInPackage.sun.security.*";
diff --git a/SOURCES/rh1996182-login_to_nss_software_token.patch b/SOURCES/rh1996182-login_to_nss_software_token.patch
deleted file mode 100644
index 96a8204..0000000
--- a/SOURCES/rh1996182-login_to_nss_software_token.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-commit 93c9f6330bf2b4405c789bf893a5256c3f4a4923
-Author: Martin Balao
-Date: Sat Aug 28 00:35:44 2021 +0100
-
- RH1996182: Login to the NSS Software Token in FIPS Mode
-
-diff --git openjdk.orig/src/java.base/share/classes/module-info.java openjdk/src/java.base/share/classes/module-info.java
-index 238735c0c8c..dbbf11bbb22 100644
---- openjdk.orig/src/java.base/share/classes/module-info.java
-+++ openjdk/src/java.base/share/classes/module-info.java
-@@ -152,6 +152,7 @@ module java.base {
- java.naming,
- java.rmi,
- jdk.charsets,
-+ jdk.crypto.cryptoki,
- jdk.crypto.ec,
- jdk.jartool,
- jdk.jlink,
-diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
-index 112b639aa96..5d3963ea893 100644
---- openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
-+++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
-@@ -42,6 +42,7 @@ import javax.security.auth.callback.PasswordCallback;
-
- import com.sun.crypto.provider.ChaCha20Poly1305Parameters;
-
-+import jdk.internal.access.SharedSecrets;
- import jdk.internal.misc.InnocuousThread;
- import sun.security.util.Debug;
- import sun.security.util.ResourcesMgr;
-@@ -62,6 +63,9 @@ import static sun.security.pkcs11.wrapper.PKCS11Exception.*;
- */
- public final class SunPKCS11 extends AuthProvider {
-
-+ private static final boolean systemFipsEnabled = SharedSecrets
-+ .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled();
-+
- private static final long serialVersionUID = -1354835039035306505L;
-
- static final Debug debug = Debug.getInstance("sunpkcs11");
-@@ -379,6 +383,24 @@ public final class SunPKCS11 extends AuthProvider {
- if (nssModule != null) {
- nssModule.setProvider(this);
- }
-+ if (systemFipsEnabled) {
-+ // The NSS Software Token in FIPS 140-2 mode requires a user
-+ // login for most operations. See sftk_fipsCheck. The NSS DB
-+ // (/etc/pki/nssdb) PIN is empty.
-+ Session session = null;
-+ try {
-+ session = token.getOpSession();
-+ p11.C_Login(session.id(), CKU_USER, new char[] {});
-+ } catch (PKCS11Exception p11e) {
-+ if (debug != null) {
-+ debug.println("Error during token login: " +
-+ p11e.getMessage());
-+ }
-+ throw p11e;
-+ } finally {
-+ token.releaseSession(session);
-+ }
-+ }
- } catch (Exception e) {
- if (config.getHandleStartupErrors() == Config.ERR_IGNORE_ALL) {
- throw new UnsupportedOperationException
diff --git a/SOURCES/rh2021263-fips_ensure_security_initialised.patch b/SOURCES/rh2021263-fips_ensure_security_initialised.patch
deleted file mode 100644
index 8dc0122..0000000
--- a/SOURCES/rh2021263-fips_ensure_security_initialised.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-commit 4ac1a03b3ec73358988553fe9e200130847ea3b4
-Author: Andrew Hughes
-Date: Mon Jan 10 20:19:40 2022 +0000
-
- RH2021263: Make sure java.security.Security is initialised when retrieving JavaSecuritySystemConfiguratorAccess instance
-
-diff --git openjdk.orig/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
-index 5a2c9eb0c46..a1ee182d913 100644
---- openjdk.orig/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
-+++ openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
-@@ -39,6 +39,7 @@ import java.io.FilePermission;
- import java.io.ObjectInputStream;
- import java.io.RandomAccessFile;
- import java.security.ProtectionDomain;
-+import java.security.Security;
- import java.security.Signature;
-
- /** A repository of "shared secrets", which are a mechanism for
-@@ -449,6 +450,9 @@ public class SharedSecrets {
- }
-
- public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() {
-+ if (javaSecuritySystemConfiguratorAccess == null) {
-+ ensureClassInitialized(Security.class);
-+ }
- return javaSecuritySystemConfiguratorAccess;
- }
- }
diff --git a/SOURCES/rh2021263-fips_missing_native_returns.patch b/SOURCES/rh2021263-fips_missing_native_returns.patch
deleted file mode 100644
index 5a056ce..0000000
--- a/SOURCES/rh2021263-fips_missing_native_returns.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-commit 8f6e35dc9e9289aed290b36e260beeda76986bb5
-Author: Fridrich Strba
-Date: Mon Jan 10 19:32:01 2022 +0000
-
- RH2021263: Return in C code after having generated Java exception
-
-diff --git openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c openjdk/src/java.base/linux/native/libsystemconf/systemconf.c
-index 38919d6bb0f..caf678a7dd6 100644
---- openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c
-+++ openjdk/src/java.base/linux/native/libsystemconf/systemconf.c
-@@ -151,11 +151,13 @@ JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEn
- dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH);
- if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) {
- throwIOException(env, "Cannot open " FIPS_ENABLED_PATH);
-+ return JNI_FALSE;
- }
- fips_enabled = fgetc(fe);
- fclose(fe);
- if (fips_enabled == EOF) {
- throwIOException(env, "Cannot read " FIPS_ENABLED_PATH);
-+ return JNI_FALSE;
- }
- msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
- " read character is '%c'", fips_enabled);
diff --git a/SOURCES/rh2021263-fips_separate_policy_and_fips_init.patch b/SOURCES/rh2021263-fips_separate_policy_and_fips_init.patch
deleted file mode 100644
index b5351a8..0000000
--- a/SOURCES/rh2021263-fips_separate_policy_and_fips_init.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-commit 0cd8cee94fe0f867b0b39890e00be620af1d9b07
-Author: Andrew Hughes
-Date: Tue Jan 18 02:09:27 2022 +0000
-
- RH2021263: Improve Security initialisation, now FIPS support no longer relies on crypto policy support
-
-diff --git openjdk.orig/src/java.base/share/classes/java/security/Security.java openjdk/src/java.base/share/classes/java/security/Security.java
-index 28ab1846173..f9726741afd 100644
---- openjdk.orig/src/java.base/share/classes/java/security/Security.java
-+++ openjdk/src/java.base/share/classes/java/security/Security.java
-@@ -61,10 +61,6 @@ public final class Security {
- private static final Debug sdebug =
- Debug.getInstance("properties");
-
-- /* System property file*/
-- private static final String SYSTEM_PROPERTIES =
-- "/etc/crypto-policies/back-ends/java.config";
--
- /* The java.security properties */
- private static Properties props;
-
-@@ -206,22 +202,36 @@ public final class Security {
- }
- }
-
-+ if (!loadedProps) {
-+ initializeStatic();
-+ if (sdebug != null) {
-+ sdebug.println("unable to load security properties " +
-+ "-- using defaults");
-+ }
-+ }
-+
- String disableSystemProps = System.getProperty("java.security.disableSystemPropertiesFile");
- if ((disableSystemProps == null || "false".equalsIgnoreCase(disableSystemProps)) &&
- "true".equalsIgnoreCase(props.getProperty("security.useSystemPropertiesFile"))) {
-- if (SystemConfigurator.configure(props)) {
-- loadedProps = true;
-+ if (!SystemConfigurator.configureSysProps(props)) {
-+ if (sdebug != null) {
-+ sdebug.println("WARNING: System properties could not be loaded.");
-+ }
- }
- }
-
-- if (!loadedProps) {
-- initializeStatic();
-+ // FIPS support depends on the contents of java.security so
-+ // ensure it has loaded first
-+ if (loadedProps) {
-+ boolean fipsEnabled = SystemConfigurator.configureFIPS(props);
- if (sdebug != null) {
-- sdebug.println("unable to load security properties " +
-- "-- using defaults");
-+ if (fipsEnabled) {
-+ sdebug.println("FIPS support enabled.");
-+ } else {
-+ sdebug.println("FIPS support disabled.");
-+ }
- }
- }
--
- }
-
- /*
-diff --git openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
-index 874c6221ebe..b7ed41acf0f 100644
---- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java
-+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
-@@ -76,7 +76,7 @@ final class SystemConfigurator {
- * java.security.disableSystemPropertiesFile property is not set and
- * security.useSystemPropertiesFile is true.
- */
-- static boolean configure(Properties props) {
-+ static boolean configureSysProps(Properties props) {
- boolean loadedProps = false;
-
- try (BufferedInputStream bis =
-@@ -96,11 +96,19 @@ final class SystemConfigurator {
- e.printStackTrace();
- }
- }
-+ return loadedProps;
-+ }
-+
-+ /*
-+ * Invoked at the end of java.security.Security initialisation
-+ * if java.security properties have been loaded
-+ */
-+ static boolean configureFIPS(Properties props) {
-+ boolean loadedProps = false;
-
- try {
- if (enableFips()) {
- if (sdebug != null) { sdebug.println("FIPS mode detected"); }
-- loadedProps = false;
- // Remove all security providers
- Iterator> i = props.entrySet().iterator();
- while (i.hasNext()) {
diff --git a/SOURCES/rh2052070-enable_algorithmparameters_in_fips_mode.patch b/SOURCES/rh2052070-enable_algorithmparameters_in_fips_mode.patch
deleted file mode 100644
index 7488ea5..0000000
--- a/SOURCES/rh2052070-enable_algorithmparameters_in_fips_mode.patch
+++ /dev/null
@@ -1,1182 +0,0 @@
-commit 6e74f283739af0d867df01d20f82865f559a45ea
-Author: Martin Balao
-Date: Mon Feb 28 04:58:05 2022 +0000
-
- RH2052070: Enable AlgorithmParameters and AlgorithmParameterGenerator services in FIPS mode
-
-diff --git openjdk.orig/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java openjdk/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java
-index a020e1c15d8..6d459fdec01 100644
---- openjdk.orig/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java
-+++ openjdk/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java
-@@ -31,6 +31,7 @@ import java.security.SecureRandom;
- import java.security.PrivilegedAction;
- import java.util.HashMap;
- import java.util.List;
-+import jdk.internal.access.SharedSecrets;
- import static sun.security.util.SecurityConstants.PROVIDER_VER;
- import static sun.security.util.SecurityProviderConstants.*;
-
-@@ -78,6 +79,10 @@ import static sun.security.util.SecurityProviderConstants.*;
-
- public final class SunJCE extends Provider {
-
-+ private static final boolean systemFipsEnabled =
-+ SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+ .isSystemFipsEnabled();
-+
- @java.io.Serial
- private static final long serialVersionUID = 6812507587804302833L;
-
-@@ -143,285 +148,287 @@ public final class SunJCE extends Provider {
- void putEntries() {
- // reuse attribute map and reset before each reuse
- HashMap attrs = new HashMap<>(3);
-- attrs.put("SupportedModes", "ECB");
-- attrs.put("SupportedPaddings", "NOPADDING|PKCS1PADDING|OAEPPADDING"
-- + "|OAEPWITHMD5ANDMGF1PADDING"
-- + "|OAEPWITHSHA1ANDMGF1PADDING"
-- + "|OAEPWITHSHA-1ANDMGF1PADDING"
-- + "|OAEPWITHSHA-224ANDMGF1PADDING"
-- + "|OAEPWITHSHA-256ANDMGF1PADDING"
-- + "|OAEPWITHSHA-384ANDMGF1PADDING"
-- + "|OAEPWITHSHA-512ANDMGF1PADDING"
-- + "|OAEPWITHSHA-512/224ANDMGF1PADDING"
-- + "|OAEPWITHSHA-512/256ANDMGF1PADDING");
-- attrs.put("SupportedKeyClasses",
-- "java.security.interfaces.RSAPublicKey" +
-- "|java.security.interfaces.RSAPrivateKey");
-- ps("Cipher", "RSA",
-- "com.sun.crypto.provider.RSACipher", null, attrs);
--
-- // common block cipher modes, pads
-- final String BLOCK_MODES = "ECB|CBC|PCBC|CTR|CTS|CFB|OFB" +
-- "|CFB8|CFB16|CFB24|CFB32|CFB40|CFB48|CFB56|CFB64" +
-- "|OFB8|OFB16|OFB24|OFB32|OFB40|OFB48|OFB56|OFB64";
-- final String BLOCK_MODES128 = BLOCK_MODES +
-- "|CFB72|CFB80|CFB88|CFB96|CFB104|CFB112|CFB120|CFB128" +
-- "|OFB72|OFB80|OFB88|OFB96|OFB104|OFB112|OFB120|OFB128";
-- final String BLOCK_PADS = "NOPADDING|PKCS5PADDING|ISO10126PADDING";
--
-- attrs.clear();
-- attrs.put("SupportedModes", BLOCK_MODES);
-- attrs.put("SupportedPaddings", BLOCK_PADS);
-- attrs.put("SupportedKeyFormats", "RAW");
-- ps("Cipher", "DES",
-- "com.sun.crypto.provider.DESCipher", null, attrs);
-- psA("Cipher", "DESede", "com.sun.crypto.provider.DESedeCipher",
-- attrs);
-- ps("Cipher", "Blowfish",
-- "com.sun.crypto.provider.BlowfishCipher", null, attrs);
--
-- ps("Cipher", "RC2",
-- "com.sun.crypto.provider.RC2Cipher", null, attrs);
--
-- attrs.clear();
-- attrs.put("SupportedModes", BLOCK_MODES128);
-- attrs.put("SupportedPaddings", BLOCK_PADS);
-- attrs.put("SupportedKeyFormats", "RAW");
-- psA("Cipher", "AES",
-- "com.sun.crypto.provider.AESCipher$General", attrs);
--
-- attrs.clear();
-- attrs.put("SupportedKeyFormats", "RAW");
-- psA("Cipher", "AES/KW/NoPadding",
-- "com.sun.crypto.provider.KeyWrapCipher$AES_KW_NoPadding",
-- attrs);
-- ps("Cipher", "AES/KW/PKCS5Padding",
-- "com.sun.crypto.provider.KeyWrapCipher$AES_KW_PKCS5Padding",
-- null, attrs);
-- psA("Cipher", "AES/KWP/NoPadding",
-- "com.sun.crypto.provider.KeyWrapCipher$AES_KWP_NoPadding",
-- attrs);
--
-- psA("Cipher", "AES_128/ECB/NoPadding",
-- "com.sun.crypto.provider.AESCipher$AES128_ECB_NoPadding",
-- attrs);
-- psA("Cipher", "AES_128/CBC/NoPadding",
-- "com.sun.crypto.provider.AESCipher$AES128_CBC_NoPadding",
-- attrs);
-- psA("Cipher", "AES_128/OFB/NoPadding",
-- "com.sun.crypto.provider.AESCipher$AES128_OFB_NoPadding",
-- attrs);
-- psA("Cipher", "AES_128/CFB/NoPadding",
-- "com.sun.crypto.provider.AESCipher$AES128_CFB_NoPadding",
-- attrs);
-- psA("Cipher", "AES_128/KW/NoPadding",
-- "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_NoPadding",
-- attrs);
-- ps("Cipher", "AES_128/KW/PKCS5Padding",
-- "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_PKCS5Padding",
-- null, attrs);
-- psA("Cipher", "AES_128/KWP/NoPadding",
-- "com.sun.crypto.provider.KeyWrapCipher$AES128_KWP_NoPadding",
-- attrs);
--
-- psA("Cipher", "AES_192/ECB/NoPadding",
-- "com.sun.crypto.provider.AESCipher$AES192_ECB_NoPadding",
-- attrs);
-- psA("Cipher", "AES_192/CBC/NoPadding",
-- "com.sun.crypto.provider.AESCipher$AES192_CBC_NoPadding",
-- attrs);
-- psA("Cipher", "AES_192/OFB/NoPadding",
-- "com.sun.crypto.provider.AESCipher$AES192_OFB_NoPadding",
-- attrs);
-- psA("Cipher", "AES_192/CFB/NoPadding",
-- "com.sun.crypto.provider.AESCipher$AES192_CFB_NoPadding",
-- attrs);
-- psA("Cipher", "AES_192/KW/NoPadding",
-- "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_NoPadding",
-- attrs);
-- ps("Cipher", "AES_192/KW/PKCS5Padding",
-- "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_PKCS5Padding",
-- null, attrs);
-- psA("Cipher", "AES_192/KWP/NoPadding",
-- "com.sun.crypto.provider.KeyWrapCipher$AES192_KWP_NoPadding",
-- attrs);
--
-- psA("Cipher", "AES_256/ECB/NoPadding",
-- "com.sun.crypto.provider.AESCipher$AES256_ECB_NoPadding",
-- attrs);
-- psA("Cipher", "AES_256/CBC/NoPadding",
-- "com.sun.crypto.provider.AESCipher$AES256_CBC_NoPadding",
-- attrs);
-- psA("Cipher", "AES_256/OFB/NoPadding",
-- "com.sun.crypto.provider.AESCipher$AES256_OFB_NoPadding",
-- attrs);
-- psA("Cipher", "AES_256/CFB/NoPadding",
-- "com.sun.crypto.provider.AESCipher$AES256_CFB_NoPadding",
-- attrs);
-- psA("Cipher", "AES_256/KW/NoPadding",
-- "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_NoPadding",
-- attrs);
-- ps("Cipher", "AES_256/KW/PKCS5Padding",
-- "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_PKCS5Padding",
-- null, attrs);
-- psA("Cipher", "AES_256/KWP/NoPadding",
-- "com.sun.crypto.provider.KeyWrapCipher$AES256_KWP_NoPadding",
-- attrs);
--
-- attrs.clear();
-- attrs.put("SupportedModes", "GCM");
-- attrs.put("SupportedKeyFormats", "RAW");
--
-- ps("Cipher", "AES/GCM/NoPadding",
-- "com.sun.crypto.provider.GaloisCounterMode$AESGCM", null,
-- attrs);
-- psA("Cipher", "AES_128/GCM/NoPadding",
-- "com.sun.crypto.provider.GaloisCounterMode$AES128",
-- attrs);
-- psA("Cipher", "AES_192/GCM/NoPadding",
-- "com.sun.crypto.provider.GaloisCounterMode$AES192",
-- attrs);
-- psA("Cipher", "AES_256/GCM/NoPadding",
-- "com.sun.crypto.provider.GaloisCounterMode$AES256",
-- attrs);
--
-- attrs.clear();
-- attrs.put("SupportedModes", "CBC");
-- attrs.put("SupportedPaddings", "NOPADDING");
-- attrs.put("SupportedKeyFormats", "RAW");
-- ps("Cipher", "DESedeWrap",
-- "com.sun.crypto.provider.DESedeWrapCipher", null, attrs);
--
-- attrs.clear();
-- attrs.put("SupportedModes", "ECB");
-- attrs.put("SupportedPaddings", "NOPADDING");
-- attrs.put("SupportedKeyFormats", "RAW");
-- psA("Cipher", "ARCFOUR",
-- "com.sun.crypto.provider.ARCFOURCipher", attrs);
--
-- attrs.clear();
-- attrs.put("SupportedKeyFormats", "RAW");
-- ps("Cipher", "ChaCha20",
-- "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Only",
-- null, attrs);
-- psA("Cipher", "ChaCha20-Poly1305",
-- "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Poly1305",
-- attrs);
--
-- // PBES1
-- psA("Cipher", "PBEWithMD5AndDES",
-- "com.sun.crypto.provider.PBEWithMD5AndDESCipher",
-- null);
-- ps("Cipher", "PBEWithMD5AndTripleDES",
-- "com.sun.crypto.provider.PBEWithMD5AndTripleDESCipher");
-- psA("Cipher", "PBEWithSHA1AndDESede",
-- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndDESede",
-- null);
-- psA("Cipher", "PBEWithSHA1AndRC2_40",
-- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_40",
-- null);
-- psA("Cipher", "PBEWithSHA1AndRC2_128",
-- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_128",
-- null);
-- psA("Cipher", "PBEWithSHA1AndRC4_40",
-- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_40",
-- null);
--
-- psA("Cipher", "PBEWithSHA1AndRC4_128",
-- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_128",
-- null);
--
-- // PBES2
-- ps("Cipher", "PBEWithHmacSHA1AndAES_128",
-- "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_128");
--
-- ps("Cipher", "PBEWithHmacSHA224AndAES_128",
-- "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_128");
--
-- ps("Cipher", "PBEWithHmacSHA256AndAES_128",
-- "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_128");
--
-- ps("Cipher", "PBEWithHmacSHA384AndAES_128",
-- "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_128");
--
-- ps("Cipher", "PBEWithHmacSHA512AndAES_128",
-- "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_128");
--
-- ps("Cipher", "PBEWithHmacSHA1AndAES_256",
-- "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_256");
--
-- ps("Cipher", "PBEWithHmacSHA224AndAES_256",
-- "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_256");
--
-- ps("Cipher", "PBEWithHmacSHA256AndAES_256",
-- "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_256");
--
-- ps("Cipher", "PBEWithHmacSHA384AndAES_256",
-- "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_256");
--
-- ps("Cipher", "PBEWithHmacSHA512AndAES_256",
-- "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_256");
--
-- /*
-- * Key(pair) Generator engines
-- */
-- ps("KeyGenerator", "DES",
-- "com.sun.crypto.provider.DESKeyGenerator");
-- psA("KeyGenerator", "DESede",
-- "com.sun.crypto.provider.DESedeKeyGenerator",
-- null);
-- ps("KeyGenerator", "Blowfish",
-- "com.sun.crypto.provider.BlowfishKeyGenerator");
-- psA("KeyGenerator", "AES",
-- "com.sun.crypto.provider.AESKeyGenerator",
-- null);
-- ps("KeyGenerator", "RC2",
-- "com.sun.crypto.provider.KeyGeneratorCore$RC2KeyGenerator");
-- psA("KeyGenerator", "ARCFOUR",
-- "com.sun.crypto.provider.KeyGeneratorCore$ARCFOURKeyGenerator",
-- null);
-- ps("KeyGenerator", "ChaCha20",
-- "com.sun.crypto.provider.KeyGeneratorCore$ChaCha20KeyGenerator");
-- ps("KeyGenerator", "HmacMD5",
-- "com.sun.crypto.provider.HmacMD5KeyGenerator");
--
-- psA("KeyGenerator", "HmacSHA1",
-- "com.sun.crypto.provider.HmacSHA1KeyGenerator", null);
-- psA("KeyGenerator", "HmacSHA224",
-- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA224",
-- null);
-- psA("KeyGenerator", "HmacSHA256",
-- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA256",
-- null);
-- psA("KeyGenerator", "HmacSHA384",
-- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA384",
-- null);
-- psA("KeyGenerator", "HmacSHA512",
-- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512",
-- null);
-- psA("KeyGenerator", "HmacSHA512/224",
-- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_224",
-- null);
-- psA("KeyGenerator", "HmacSHA512/256",
-- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_256",
-- null);
--
-- psA("KeyGenerator", "HmacSHA3-224",
-- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_224",
-- null);
-- psA("KeyGenerator", "HmacSHA3-256",
-- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_256",
-- null);
-- psA("KeyGenerator", "HmacSHA3-384",
-- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_384",
-- null);
-- psA("KeyGenerator", "HmacSHA3-512",
-- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_512",
-- null);
--
-- psA("KeyPairGenerator", "DiffieHellman",
-- "com.sun.crypto.provider.DHKeyPairGenerator",
-- null);
-+ if (!systemFipsEnabled) {
-+ attrs.put("SupportedModes", "ECB");
-+ attrs.put("SupportedPaddings", "NOPADDING|PKCS1PADDING|OAEPPADDING"
-+ + "|OAEPWITHMD5ANDMGF1PADDING"
-+ + "|OAEPWITHSHA1ANDMGF1PADDING"
-+ + "|OAEPWITHSHA-1ANDMGF1PADDING"
-+ + "|OAEPWITHSHA-224ANDMGF1PADDING"
-+ + "|OAEPWITHSHA-256ANDMGF1PADDING"
-+ + "|OAEPWITHSHA-384ANDMGF1PADDING"
-+ + "|OAEPWITHSHA-512ANDMGF1PADDING"
-+ + "|OAEPWITHSHA-512/224ANDMGF1PADDING"
-+ + "|OAEPWITHSHA-512/256ANDMGF1PADDING");
-+ attrs.put("SupportedKeyClasses",
-+ "java.security.interfaces.RSAPublicKey" +
-+ "|java.security.interfaces.RSAPrivateKey");
-+ ps("Cipher", "RSA",
-+ "com.sun.crypto.provider.RSACipher", null, attrs);
-+
-+ // common block cipher modes, pads
-+ final String BLOCK_MODES = "ECB|CBC|PCBC|CTR|CTS|CFB|OFB" +
-+ "|CFB8|CFB16|CFB24|CFB32|CFB40|CFB48|CFB56|CFB64" +
-+ "|OFB8|OFB16|OFB24|OFB32|OFB40|OFB48|OFB56|OFB64";
-+ final String BLOCK_MODES128 = BLOCK_MODES +
-+ "|CFB72|CFB80|CFB88|CFB96|CFB104|CFB112|CFB120|CFB128" +
-+ "|OFB72|OFB80|OFB88|OFB96|OFB104|OFB112|OFB120|OFB128";
-+ final String BLOCK_PADS = "NOPADDING|PKCS5PADDING|ISO10126PADDING";
-+
-+ attrs.clear();
-+ attrs.put("SupportedModes", BLOCK_MODES);
-+ attrs.put("SupportedPaddings", BLOCK_PADS);
-+ attrs.put("SupportedKeyFormats", "RAW");
-+ ps("Cipher", "DES",
-+ "com.sun.crypto.provider.DESCipher", null, attrs);
-+ psA("Cipher", "DESede", "com.sun.crypto.provider.DESedeCipher",
-+ attrs);
-+ ps("Cipher", "Blowfish",
-+ "com.sun.crypto.provider.BlowfishCipher", null, attrs);
-+
-+ ps("Cipher", "RC2",
-+ "com.sun.crypto.provider.RC2Cipher", null, attrs);
-+
-+ attrs.clear();
-+ attrs.put("SupportedModes", BLOCK_MODES128);
-+ attrs.put("SupportedPaddings", BLOCK_PADS);
-+ attrs.put("SupportedKeyFormats", "RAW");
-+ psA("Cipher", "AES",
-+ "com.sun.crypto.provider.AESCipher$General", attrs);
-+
-+ attrs.clear();
-+ attrs.put("SupportedKeyFormats", "RAW");
-+ psA("Cipher", "AES/KW/NoPadding",
-+ "com.sun.crypto.provider.KeyWrapCipher$AES_KW_NoPadding",
-+ attrs);
-+ ps("Cipher", "AES/KW/PKCS5Padding",
-+ "com.sun.crypto.provider.KeyWrapCipher$AES_KW_PKCS5Padding",
-+ null, attrs);
-+ psA("Cipher", "AES/KWP/NoPadding",
-+ "com.sun.crypto.provider.KeyWrapCipher$AES_KWP_NoPadding",
-+ attrs);
-+
-+ psA("Cipher", "AES_128/ECB/NoPadding",
-+ "com.sun.crypto.provider.AESCipher$AES128_ECB_NoPadding",
-+ attrs);
-+ psA("Cipher", "AES_128/CBC/NoPadding",
-+ "com.sun.crypto.provider.AESCipher$AES128_CBC_NoPadding",
-+ attrs);
-+ psA("Cipher", "AES_128/OFB/NoPadding",
-+ "com.sun.crypto.provider.AESCipher$AES128_OFB_NoPadding",
-+ attrs);
-+ psA("Cipher", "AES_128/CFB/NoPadding",
-+ "com.sun.crypto.provider.AESCipher$AES128_CFB_NoPadding",
-+ attrs);
-+ psA("Cipher", "AES_128/KW/NoPadding",
-+ "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_NoPadding",
-+ attrs);
-+ ps("Cipher", "AES_128/KW/PKCS5Padding",
-+ "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_PKCS5Padding",
-+ null, attrs);
-+ psA("Cipher", "AES_128/KWP/NoPadding",
-+ "com.sun.crypto.provider.KeyWrapCipher$AES128_KWP_NoPadding",
-+ attrs);
-+
-+ psA("Cipher", "AES_192/ECB/NoPadding",
-+ "com.sun.crypto.provider.AESCipher$AES192_ECB_NoPadding",
-+ attrs);
-+ psA("Cipher", "AES_192/CBC/NoPadding",
-+ "com.sun.crypto.provider.AESCipher$AES192_CBC_NoPadding",
-+ attrs);
-+ psA("Cipher", "AES_192/OFB/NoPadding",
-+ "com.sun.crypto.provider.AESCipher$AES192_OFB_NoPadding",
-+ attrs);
-+ psA("Cipher", "AES_192/CFB/NoPadding",
-+ "com.sun.crypto.provider.AESCipher$AES192_CFB_NoPadding",
-+ attrs);
-+ psA("Cipher", "AES_192/KW/NoPadding",
-+ "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_NoPadding",
-+ attrs);
-+ ps("Cipher", "AES_192/KW/PKCS5Padding",
-+ "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_PKCS5Padding",
-+ null, attrs);
-+ psA("Cipher", "AES_192/KWP/NoPadding",
-+ "com.sun.crypto.provider.KeyWrapCipher$AES192_KWP_NoPadding",
-+ attrs);
-+
-+ psA("Cipher", "AES_256/ECB/NoPadding",
-+ "com.sun.crypto.provider.AESCipher$AES256_ECB_NoPadding",
-+ attrs);
-+ psA("Cipher", "AES_256/CBC/NoPadding",
-+ "com.sun.crypto.provider.AESCipher$AES256_CBC_NoPadding",
-+ attrs);
-+ psA("Cipher", "AES_256/OFB/NoPadding",
-+ "com.sun.crypto.provider.AESCipher$AES256_OFB_NoPadding",
-+ attrs);
-+ psA("Cipher", "AES_256/CFB/NoPadding",
-+ "com.sun.crypto.provider.AESCipher$AES256_CFB_NoPadding",
-+ attrs);
-+ psA("Cipher", "AES_256/KW/NoPadding",
-+ "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_NoPadding",
-+ attrs);
-+ ps("Cipher", "AES_256/KW/PKCS5Padding",
-+ "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_PKCS5Padding",
-+ null, attrs);
-+ psA("Cipher", "AES_256/KWP/NoPadding",
-+ "com.sun.crypto.provider.KeyWrapCipher$AES256_KWP_NoPadding",
-+ attrs);
-+
-+ attrs.clear();
-+ attrs.put("SupportedModes", "GCM");
-+ attrs.put("SupportedKeyFormats", "RAW");
-+
-+ ps("Cipher", "AES/GCM/NoPadding",
-+ "com.sun.crypto.provider.GaloisCounterMode$AESGCM", null,
-+ attrs);
-+ psA("Cipher", "AES_128/GCM/NoPadding",
-+ "com.sun.crypto.provider.GaloisCounterMode$AES128",
-+ attrs);
-+ psA("Cipher", "AES_192/GCM/NoPadding",
-+ "com.sun.crypto.provider.GaloisCounterMode$AES192",
-+ attrs);
-+ psA("Cipher", "AES_256/GCM/NoPadding",
-+ "com.sun.crypto.provider.GaloisCounterMode$AES256",
-+ attrs);
-+
-+ attrs.clear();
-+ attrs.put("SupportedModes", "CBC");
-+ attrs.put("SupportedPaddings", "NOPADDING");
-+ attrs.put("SupportedKeyFormats", "RAW");
-+ ps("Cipher", "DESedeWrap",
-+ "com.sun.crypto.provider.DESedeWrapCipher", null, attrs);
-+
-+ attrs.clear();
-+ attrs.put("SupportedModes", "ECB");
-+ attrs.put("SupportedPaddings", "NOPADDING");
-+ attrs.put("SupportedKeyFormats", "RAW");
-+ psA("Cipher", "ARCFOUR",
-+ "com.sun.crypto.provider.ARCFOURCipher", attrs);
-+
-+ attrs.clear();
-+ attrs.put("SupportedKeyFormats", "RAW");
-+ ps("Cipher", "ChaCha20",
-+ "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Only",
-+ null, attrs);
-+ psA("Cipher", "ChaCha20-Poly1305",
-+ "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Poly1305",
-+ attrs);
-+
-+ // PBES1
-+ psA("Cipher", "PBEWithMD5AndDES",
-+ "com.sun.crypto.provider.PBEWithMD5AndDESCipher",
-+ null);
-+ ps("Cipher", "PBEWithMD5AndTripleDES",
-+ "com.sun.crypto.provider.PBEWithMD5AndTripleDESCipher");
-+ psA("Cipher", "PBEWithSHA1AndDESede",
-+ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndDESede",
-+ null);
-+ psA("Cipher", "PBEWithSHA1AndRC2_40",
-+ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_40",
-+ null);
-+ psA("Cipher", "PBEWithSHA1AndRC2_128",
-+ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_128",
-+ null);
-+ psA("Cipher", "PBEWithSHA1AndRC4_40",
-+ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_40",
-+ null);
-+
-+ psA("Cipher", "PBEWithSHA1AndRC4_128",
-+ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_128",
-+ null);
-+
-+ // PBES2
-+ ps("Cipher", "PBEWithHmacSHA1AndAES_128",
-+ "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_128");
-+
-+ ps("Cipher", "PBEWithHmacSHA224AndAES_128",
-+ "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_128");
-+
-+ ps("Cipher", "PBEWithHmacSHA256AndAES_128",
-+ "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_128");
-+
-+ ps("Cipher", "PBEWithHmacSHA384AndAES_128",
-+ "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_128");
-+
-+ ps("Cipher", "PBEWithHmacSHA512AndAES_128",
-+ "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_128");
-+
-+ ps("Cipher", "PBEWithHmacSHA1AndAES_256",
-+ "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_256");
-+
-+ ps("Cipher", "PBEWithHmacSHA224AndAES_256",
-+ "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_256");
-+
-+ ps("Cipher", "PBEWithHmacSHA256AndAES_256",
-+ "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_256");
-+
-+ ps("Cipher", "PBEWithHmacSHA384AndAES_256",
-+ "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_256");
-+
-+ ps("Cipher", "PBEWithHmacSHA512AndAES_256",
-+ "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_256");
-+
-+ /*
-+ * Key(pair) Generator engines
-+ */
-+ ps("KeyGenerator", "DES",
-+ "com.sun.crypto.provider.DESKeyGenerator");
-+ psA("KeyGenerator", "DESede",
-+ "com.sun.crypto.provider.DESedeKeyGenerator",
-+ null);
-+ ps("KeyGenerator", "Blowfish",
-+ "com.sun.crypto.provider.BlowfishKeyGenerator");
-+ psA("KeyGenerator", "AES",
-+ "com.sun.crypto.provider.AESKeyGenerator",
-+ null);
-+ ps("KeyGenerator", "RC2",
-+ "com.sun.crypto.provider.KeyGeneratorCore$RC2KeyGenerator");
-+ psA("KeyGenerator", "ARCFOUR",
-+ "com.sun.crypto.provider.KeyGeneratorCore$ARCFOURKeyGenerator",
-+ null);
-+ ps("KeyGenerator", "ChaCha20",
-+ "com.sun.crypto.provider.KeyGeneratorCore$ChaCha20KeyGenerator");
-+ ps("KeyGenerator", "HmacMD5",
-+ "com.sun.crypto.provider.HmacMD5KeyGenerator");
-+
-+ psA("KeyGenerator", "HmacSHA1",
-+ "com.sun.crypto.provider.HmacSHA1KeyGenerator", null);
-+ psA("KeyGenerator", "HmacSHA224",
-+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA224",
-+ null);
-+ psA("KeyGenerator", "HmacSHA256",
-+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA256",
-+ null);
-+ psA("KeyGenerator", "HmacSHA384",
-+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA384",
-+ null);
-+ psA("KeyGenerator", "HmacSHA512",
-+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512",
-+ null);
-+ psA("KeyGenerator", "HmacSHA512/224",
-+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_224",
-+ null);
-+ psA("KeyGenerator", "HmacSHA512/256",
-+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_256",
-+ null);
-+
-+ psA("KeyGenerator", "HmacSHA3-224",
-+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_224",
-+ null);
-+ psA("KeyGenerator", "HmacSHA3-256",
-+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_256",
-+ null);
-+ psA("KeyGenerator", "HmacSHA3-384",
-+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_384",
-+ null);
-+ psA("KeyGenerator", "HmacSHA3-512",
-+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_512",
-+ null);
-+
-+ psA("KeyPairGenerator", "DiffieHellman",
-+ "com.sun.crypto.provider.DHKeyPairGenerator",
-+ null);
-+ }
-
- /*
- * Algorithm parameter generation engines
-@@ -430,15 +437,17 @@ public final class SunJCE extends Provider {
- "DiffieHellman", "com.sun.crypto.provider.DHParameterGenerator",
- null);
-
-- /*
-- * Key Agreement engines
-- */
-- attrs.clear();
-- attrs.put("SupportedKeyClasses", "javax.crypto.interfaces.DHPublicKey" +
-- "|javax.crypto.interfaces.DHPrivateKey");
-- psA("KeyAgreement", "DiffieHellman",
-- "com.sun.crypto.provider.DHKeyAgreement",
-- attrs);
-+ if (!systemFipsEnabled) {
-+ /*
-+ * Key Agreement engines
-+ */
-+ attrs.clear();
-+ attrs.put("SupportedKeyClasses", "javax.crypto.interfaces.DHPublicKey" +
-+ "|javax.crypto.interfaces.DHPrivateKey");
-+ psA("KeyAgreement", "DiffieHellman",
-+ "com.sun.crypto.provider.DHKeyAgreement",
-+ attrs);
-+ }
-
- /*
- * Algorithm Parameter engines
-@@ -531,197 +540,199 @@ public final class SunJCE extends Provider {
- psA("AlgorithmParameters", "ChaCha20-Poly1305",
- "com.sun.crypto.provider.ChaCha20Poly1305Parameters", null);
-
-- /*
-- * Key factories
-- */
-- psA("KeyFactory", "DiffieHellman",
-- "com.sun.crypto.provider.DHKeyFactory",
-- null);
--
-- /*
-- * Secret-key factories
-- */
-- ps("SecretKeyFactory", "DES",
-- "com.sun.crypto.provider.DESKeyFactory");
--
-- psA("SecretKeyFactory", "DESede",
-- "com.sun.crypto.provider.DESedeKeyFactory", null);
--
-- psA("SecretKeyFactory", "PBEWithMD5AndDES",
-- "com.sun.crypto.provider.PBEKeyFactory$PBEWithMD5AndDES",
-- null);
--
-- /*
-- * Internal in-house crypto algorithm used for
-- * the JCEKS keystore type. Since this was developed
-- * internally, there isn't an OID corresponding to this
-- * algorithm.
-- */
-- ps("SecretKeyFactory", "PBEWithMD5AndTripleDES",
-- "com.sun.crypto.provider.PBEKeyFactory$PBEWithMD5AndTripleDES");
--
-- psA("SecretKeyFactory", "PBEWithSHA1AndDESede",
-- "com.sun.crypto.provider.PBEKeyFactory$PBEWithSHA1AndDESede",
-- null);
--
-- psA("SecretKeyFactory", "PBEWithSHA1AndRC2_40",
-- "com.sun.crypto.provider.PBEKeyFactory$PBEWithSHA1AndRC2_40",
-- null);
--
-- psA("SecretKeyFactory", "PBEWithSHA1AndRC2_128",
-- "com.sun.crypto.provider.PBEKeyFactory$PBEWithSHA1AndRC2_128",
-- null);
--
-- psA("SecretKeyFactory", "PBEWithSHA1AndRC4_40",
-- "com.sun.crypto.provider.PBEKeyFactory$PBEWithSHA1AndRC4_40",
-- null);
--
-- psA("SecretKeyFactory", "PBEWithSHA1AndRC4_128",
-- "com.sun.crypto.provider.PBEKeyFactory$PBEWithSHA1AndRC4_128",
-- null);
--
-- ps("SecretKeyFactory", "PBEWithHmacSHA1AndAES_128",
-- "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA1AndAES_128");
--
-- ps("SecretKeyFactory", "PBEWithHmacSHA224AndAES_128",
-- "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA224AndAES_128");
--
-- ps("SecretKeyFactory", "PBEWithHmacSHA256AndAES_128",
-- "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA256AndAES_128");
--
-- ps("SecretKeyFactory", "PBEWithHmacSHA384AndAES_128",
-- "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA384AndAES_128");
--
-- ps("SecretKeyFactory", "PBEWithHmacSHA512AndAES_128",
-- "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512AndAES_128");
--
-- ps("SecretKeyFactory", "PBEWithHmacSHA1AndAES_256",
-- "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA1AndAES_256");
--
-- ps("SecretKeyFactory", "PBEWithHmacSHA224AndAES_256",
-- "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA224AndAES_256");
--
-- ps("SecretKeyFactory", "PBEWithHmacSHA256AndAES_256",
-- "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA256AndAES_256");
--
-- ps("SecretKeyFactory", "PBEWithHmacSHA384AndAES_256",
-- "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA384AndAES_256");
--
-- ps("SecretKeyFactory", "PBEWithHmacSHA512AndAES_256",
-- "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512AndAES_256");
--
-- // PBKDF2
-- psA("SecretKeyFactory", "PBKDF2WithHmacSHA1",
-- "com.sun.crypto.provider.PBKDF2Core$HmacSHA1",
-- null);
-- ps("SecretKeyFactory", "PBKDF2WithHmacSHA224",
-- "com.sun.crypto.provider.PBKDF2Core$HmacSHA224");
-- ps("SecretKeyFactory", "PBKDF2WithHmacSHA256",
-- "com.sun.crypto.provider.PBKDF2Core$HmacSHA256");
-- ps("SecretKeyFactory", "PBKDF2WithHmacSHA384",
-- "com.sun.crypto.provider.PBKDF2Core$HmacSHA384");
-- ps("SecretKeyFactory", "PBKDF2WithHmacSHA512",
-- "com.sun.crypto.provider.PBKDF2Core$HmacSHA512");
--
-- /*
-- * MAC
-- */
-- attrs.clear();
-- attrs.put("SupportedKeyFormats", "RAW");
-- ps("Mac", "HmacMD5", "com.sun.crypto.provider.HmacMD5", null, attrs);
-- psA("Mac", "HmacSHA1", "com.sun.crypto.provider.HmacSHA1",
-- attrs);
-- psA("Mac", "HmacSHA224",
-- "com.sun.crypto.provider.HmacCore$HmacSHA224", attrs);
-- psA("Mac", "HmacSHA256",
-- "com.sun.crypto.provider.HmacCore$HmacSHA256", attrs);
-- psA("Mac", "HmacSHA384",
-- "com.sun.crypto.provider.HmacCore$HmacSHA384", attrs);
-- psA("Mac", "HmacSHA512",
-- "com.sun.crypto.provider.HmacCore$HmacSHA512", attrs);
-- psA("Mac", "HmacSHA512/224",
-- "com.sun.crypto.provider.HmacCore$HmacSHA512_224", attrs);
-- psA("Mac", "HmacSHA512/256",
-- "com.sun.crypto.provider.HmacCore$HmacSHA512_256", attrs);
-- psA("Mac", "HmacSHA3-224",
-- "com.sun.crypto.provider.HmacCore$HmacSHA3_224", attrs);
-- psA("Mac", "HmacSHA3-256",
-- "com.sun.crypto.provider.HmacCore$HmacSHA3_256", attrs);
-- psA("Mac", "HmacSHA3-384",
-- "com.sun.crypto.provider.HmacCore$HmacSHA3_384", attrs);
-- psA("Mac", "HmacSHA3-512",
-- "com.sun.crypto.provider.HmacCore$HmacSHA3_512", attrs);
--
-- ps("Mac", "HmacPBESHA1",
-- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA1",
-- null, attrs);
-- ps("Mac", "HmacPBESHA224",
-- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA224",
-- null, attrs);
-- ps("Mac", "HmacPBESHA256",
-- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA256",
-- null, attrs);
-- ps("Mac", "HmacPBESHA384",
-- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA384",
-- null, attrs);
-- ps("Mac", "HmacPBESHA512",
-- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512",
-- null, attrs);
-- ps("Mac", "HmacPBESHA512/224",
-- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_224",
-- null, attrs);
-- ps("Mac", "HmacPBESHA512/256",
-- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_256",
-- null, attrs);
--
--
-- // PBMAC1
-- ps("Mac", "PBEWithHmacSHA1",
-- "com.sun.crypto.provider.PBMAC1Core$HmacSHA1", null, attrs);
-- ps("Mac", "PBEWithHmacSHA224",
-- "com.sun.crypto.provider.PBMAC1Core$HmacSHA224", null, attrs);
-- ps("Mac", "PBEWithHmacSHA256",
-- "com.sun.crypto.provider.PBMAC1Core$HmacSHA256", null, attrs);
-- ps("Mac", "PBEWithHmacSHA384",
-- "com.sun.crypto.provider.PBMAC1Core$HmacSHA384", null, attrs);
-- ps("Mac", "PBEWithHmacSHA512",
-- "com.sun.crypto.provider.PBMAC1Core$HmacSHA512", null, attrs);
-- ps("Mac", "SslMacMD5",
-- "com.sun.crypto.provider.SslMacCore$SslMacMD5", null, attrs);
-- ps("Mac", "SslMacSHA1",
-- "com.sun.crypto.provider.SslMacCore$SslMacSHA1", null, attrs);
--
-- /*
-- * KeyStore
-- */
-- ps("KeyStore", "JCEKS",
-- "com.sun.crypto.provider.JceKeyStore");
--
-- /*
-- * SSL/TLS mechanisms
-- *
-- * These are strictly internal implementations and may
-- * be changed at any time. These names were chosen
-- * because PKCS11/SunPKCS11 does not yet have TLS1.2
-- * mechanisms, and it will cause calls to come here.
-- */
-- ps("KeyGenerator", "SunTlsPrf",
-- "com.sun.crypto.provider.TlsPrfGenerator$V10");
-- ps("KeyGenerator", "SunTls12Prf",
-- "com.sun.crypto.provider.TlsPrfGenerator$V12");
--
-- ps("KeyGenerator", "SunTlsMasterSecret",
-- "com.sun.crypto.provider.TlsMasterSecretGenerator",
-- List.of("SunTls12MasterSecret", "SunTlsExtendedMasterSecret"),
-- null);
--
-- ps("KeyGenerator", "SunTlsKeyMaterial",
-- "com.sun.crypto.provider.TlsKeyMaterialGenerator",
-- List.of("SunTls12KeyMaterial"), null);
--
-- ps("KeyGenerator", "SunTlsRsaPremasterSecret",
-- "com.sun.crypto.provider.TlsRsaPremasterSecretGenerator",
-- List.of("SunTls12RsaPremasterSecret"), null);
-+ if (!systemFipsEnabled) {
-+ /*
-+ * Key factories
-+ */
-+ psA("KeyFactory", "DiffieHellman",
-+ "com.sun.crypto.provider.DHKeyFactory",
-+ null);
-+
-+ /*
-+ * Secret-key factories
-+ */
-+ ps("SecretKeyFactory", "DES",
-+ "com.sun.crypto.provider.DESKeyFactory");
-+
-+ psA("SecretKeyFactory", "DESede",
-+ "com.sun.crypto.provider.DESedeKeyFactory", null);
-+
-+ psA("SecretKeyFactory", "PBEWithMD5AndDES",
-+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithMD5AndDES",
-+ null);
-+
-+ /*
-+ * Internal in-house crypto algorithm used for
-+ * the JCEKS keystore type. Since this was developed
-+ * internally, there isn't an OID corresponding to this
-+ * algorithm.
-+ */
-+ ps("SecretKeyFactory", "PBEWithMD5AndTripleDES",
-+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithMD5AndTripleDES");
-+
-+ psA("SecretKeyFactory", "PBEWithSHA1AndDESede",
-+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithSHA1AndDESede",
-+ null);
-+
-+ psA("SecretKeyFactory", "PBEWithSHA1AndRC2_40",
-+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithSHA1AndRC2_40",
-+ null);
-+
-+ psA("SecretKeyFactory", "PBEWithSHA1AndRC2_128",
-+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithSHA1AndRC2_128",
-+ null);
-+
-+ psA("SecretKeyFactory", "PBEWithSHA1AndRC4_40",
-+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithSHA1AndRC4_40",
-+ null);
-+
-+ psA("SecretKeyFactory", "PBEWithSHA1AndRC4_128",
-+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithSHA1AndRC4_128",
-+ null);
-+
-+ ps("SecretKeyFactory", "PBEWithHmacSHA1AndAES_128",
-+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA1AndAES_128");
-+
-+ ps("SecretKeyFactory", "PBEWithHmacSHA224AndAES_128",
-+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA224AndAES_128");
-+
-+ ps("SecretKeyFactory", "PBEWithHmacSHA256AndAES_128",
-+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA256AndAES_128");
-+
-+ ps("SecretKeyFactory", "PBEWithHmacSHA384AndAES_128",
-+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA384AndAES_128");
-+
-+ ps("SecretKeyFactory", "PBEWithHmacSHA512AndAES_128",
-+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512AndAES_128");
-+
-+ ps("SecretKeyFactory", "PBEWithHmacSHA1AndAES_256",
-+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA1AndAES_256");
-+
-+ ps("SecretKeyFactory", "PBEWithHmacSHA224AndAES_256",
-+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA224AndAES_256");
-+
-+ ps("SecretKeyFactory", "PBEWithHmacSHA256AndAES_256",
-+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA256AndAES_256");
-+
-+ ps("SecretKeyFactory", "PBEWithHmacSHA384AndAES_256",
-+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA384AndAES_256");
-+
-+ ps("SecretKeyFactory", "PBEWithHmacSHA512AndAES_256",
-+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512AndAES_256");
-+
-+ // PBKDF2
-+ psA("SecretKeyFactory", "PBKDF2WithHmacSHA1",
-+ "com.sun.crypto.provider.PBKDF2Core$HmacSHA1",
-+ null);
-+ ps("SecretKeyFactory", "PBKDF2WithHmacSHA224",
-+ "com.sun.crypto.provider.PBKDF2Core$HmacSHA224");
-+ ps("SecretKeyFactory", "PBKDF2WithHmacSHA256",
-+ "com.sun.crypto.provider.PBKDF2Core$HmacSHA256");
-+ ps("SecretKeyFactory", "PBKDF2WithHmacSHA384",
-+ "com.sun.crypto.provider.PBKDF2Core$HmacSHA384");
-+ ps("SecretKeyFactory", "PBKDF2WithHmacSHA512",
-+ "com.sun.crypto.provider.PBKDF2Core$HmacSHA512");
-+
-+ /*
-+ * MAC
-+ */
-+ attrs.clear();
-+ attrs.put("SupportedKeyFormats", "RAW");
-+ ps("Mac", "HmacMD5", "com.sun.crypto.provider.HmacMD5", null, attrs);
-+ psA("Mac", "HmacSHA1", "com.sun.crypto.provider.HmacSHA1",
-+ attrs);
-+ psA("Mac", "HmacSHA224",
-+ "com.sun.crypto.provider.HmacCore$HmacSHA224", attrs);
-+ psA("Mac", "HmacSHA256",
-+ "com.sun.crypto.provider.HmacCore$HmacSHA256", attrs);
-+ psA("Mac", "HmacSHA384",
-+ "com.sun.crypto.provider.HmacCore$HmacSHA384", attrs);
-+ psA("Mac", "HmacSHA512",
-+ "com.sun.crypto.provider.HmacCore$HmacSHA512", attrs);
-+ psA("Mac", "HmacSHA512/224",
-+ "com.sun.crypto.provider.HmacCore$HmacSHA512_224", attrs);
-+ psA("Mac", "HmacSHA512/256",
-+ "com.sun.crypto.provider.HmacCore$HmacSHA512_256", attrs);
-+ psA("Mac", "HmacSHA3-224",
-+ "com.sun.crypto.provider.HmacCore$HmacSHA3_224", attrs);
-+ psA("Mac", "HmacSHA3-256",
-+ "com.sun.crypto.provider.HmacCore$HmacSHA3_256", attrs);
-+ psA("Mac", "HmacSHA3-384",
-+ "com.sun.crypto.provider.HmacCore$HmacSHA3_384", attrs);
-+ psA("Mac", "HmacSHA3-512",
-+ "com.sun.crypto.provider.HmacCore$HmacSHA3_512", attrs);
-+
-+ ps("Mac", "HmacPBESHA1",
-+ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA1",
-+ null, attrs);
-+ ps("Mac", "HmacPBESHA224",
-+ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA224",
-+ null, attrs);
-+ ps("Mac", "HmacPBESHA256",
-+ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA256",
-+ null, attrs);
-+ ps("Mac", "HmacPBESHA384",
-+ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA384",
-+ null, attrs);
-+ ps("Mac", "HmacPBESHA512",
-+ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512",
-+ null, attrs);
-+ ps("Mac", "HmacPBESHA512/224",
-+ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_224",
-+ null, attrs);
-+ ps("Mac", "HmacPBESHA512/256",
-+ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_256",
-+ null, attrs);
-+
-+
-+ // PBMAC1
-+ ps("Mac", "PBEWithHmacSHA1",
-+ "com.sun.crypto.provider.PBMAC1Core$HmacSHA1", null, attrs);
-+ ps("Mac", "PBEWithHmacSHA224",
-+ "com.sun.crypto.provider.PBMAC1Core$HmacSHA224", null, attrs);
-+ ps("Mac", "PBEWithHmacSHA256",
-+ "com.sun.crypto.provider.PBMAC1Core$HmacSHA256", null, attrs);
-+ ps("Mac", "PBEWithHmacSHA384",
-+ "com.sun.crypto.provider.PBMAC1Core$HmacSHA384", null, attrs);
-+ ps("Mac", "PBEWithHmacSHA512",
-+ "com.sun.crypto.provider.PBMAC1Core$HmacSHA512", null, attrs);
-+ ps("Mac", "SslMacMD5",
-+ "com.sun.crypto.provider.SslMacCore$SslMacMD5", null, attrs);
-+ ps("Mac", "SslMacSHA1",
-+ "com.sun.crypto.provider.SslMacCore$SslMacSHA1", null, attrs);
-+
-+ /*
-+ * KeyStore
-+ */
-+ ps("KeyStore", "JCEKS",
-+ "com.sun.crypto.provider.JceKeyStore");
-+
-+ /*
-+ * SSL/TLS mechanisms
-+ *
-+ * These are strictly internal implementations and may
-+ * be changed at any time. These names were chosen
-+ * because PKCS11/SunPKCS11 does not yet have TLS1.2
-+ * mechanisms, and it will cause calls to come here.
-+ */
-+ ps("KeyGenerator", "SunTlsPrf",
-+ "com.sun.crypto.provider.TlsPrfGenerator$V10");
-+ ps("KeyGenerator", "SunTls12Prf",
-+ "com.sun.crypto.provider.TlsPrfGenerator$V12");
-+
-+ ps("KeyGenerator", "SunTlsMasterSecret",
-+ "com.sun.crypto.provider.TlsMasterSecretGenerator",
-+ List.of("SunTls12MasterSecret", "SunTlsExtendedMasterSecret"),
-+ null);
-+
-+ ps("KeyGenerator", "SunTlsKeyMaterial",
-+ "com.sun.crypto.provider.TlsKeyMaterialGenerator",
-+ List.of("SunTls12KeyMaterial"), null);
-+
-+ ps("KeyGenerator", "SunTlsRsaPremasterSecret",
-+ "com.sun.crypto.provider.TlsRsaPremasterSecretGenerator",
-+ List.of("SunTls12RsaPremasterSecret"), null);
-+ }
- }
-
- // Return the instance of this class or create one if needed.
-diff --git openjdk.orig/src/java.base/share/classes/sun/security/provider/SunEntries.java openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java
-index 7cb5ebcde51..709d32912ca 100644
---- openjdk.orig/src/java.base/share/classes/sun/security/provider/SunEntries.java
-+++ openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java
-@@ -193,20 +193,22 @@ public final class SunEntries {
- String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$";
- dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current");
- addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs);
-+ }
-
-- /*
-- * Algorithm Parameter Generator engines
-- */
-- addWithAlias(p, "AlgorithmParameterGenerator", "DSA",
-- "sun.security.provider.DSAParameterGenerator", attrs);
-- attrs.remove("KeySize");
-+ /*
-+ * Algorithm Parameter Generator engines
-+ */
-+ addWithAlias(p, "AlgorithmParameterGenerator", "DSA",
-+ "sun.security.provider.DSAParameterGenerator", attrs);
-+ attrs.remove("KeySize");
-
-- /*
-- * Algorithm Parameter engines
-- */
-- addWithAlias(p, "AlgorithmParameters", "DSA",
-- "sun.security.provider.DSAParameters", attrs);
-+ /*
-+ * Algorithm Parameter engines
-+ */
-+ addWithAlias(p, "AlgorithmParameters", "DSA",
-+ "sun.security.provider.DSAParameters", attrs);
-
-+ if (!systemFipsEnabled) {
- /*
- * Key factories
- */
-diff --git openjdk.orig/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java openjdk/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java
-index ca79f25cc44..16c5ad2e227 100644
---- openjdk.orig/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java
-+++ openjdk/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java
-@@ -27,6 +27,7 @@ package sun.security.rsa;
-
- import java.util.*;
- import java.security.Provider;
-+import jdk.internal.access.SharedSecrets;
- import static sun.security.util.SecurityProviderConstants.getAliases;
-
- /**
-@@ -36,6 +37,10 @@ import static sun.security.util.SecurityProviderConstants.getAliases;
- */
- public final class SunRsaSignEntries {
-
-+ private static final boolean systemFipsEnabled =
-+ SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+ .isSystemFipsEnabled();
-+
- private void add(Provider p, String type, String algo, String cn,
- List aliases, HashMap attrs) {
- services.add(new Provider.Service(p, type, algo, cn,
-@@ -56,49 +61,52 @@ public final class SunRsaSignEntries {
- // start populating content using the specified provider
- // common attribute map
- HashMap attrs = new HashMap<>(3);
-- attrs.put("SupportedKeyClasses",
-- "java.security.interfaces.RSAPublicKey" +
-- "|java.security.interfaces.RSAPrivateKey");
-+ if (!systemFipsEnabled) {
-+ attrs.put("SupportedKeyClasses",
-+ "java.security.interfaces.RSAPublicKey" +
-+ "|java.security.interfaces.RSAPrivateKey");
-+
-+ add(p, "KeyFactory", "RSA",
-+ "sun.security.rsa.RSAKeyFactory$Legacy",
-+ getAliases("PKCS1"), null);
-+ add(p, "KeyPairGenerator", "RSA",
-+ "sun.security.rsa.RSAKeyPairGenerator$Legacy",
-+ getAliases("PKCS1"), null);
-+ addA(p, "Signature", "MD2withRSA",
-+ "sun.security.rsa.RSASignature$MD2withRSA", attrs);
-+ addA(p, "Signature", "MD5withRSA",
-+ "sun.security.rsa.RSASignature$MD5withRSA", attrs);
-+ addA(p, "Signature", "SHA1withRSA",
-+ "sun.security.rsa.RSASignature$SHA1withRSA", attrs);
-+ addA(p, "Signature", "SHA224withRSA",
-+ "sun.security.rsa.RSASignature$SHA224withRSA", attrs);
-+ addA(p, "Signature", "SHA256withRSA",
-+ "sun.security.rsa.RSASignature$SHA256withRSA", attrs);
-+ addA(p, "Signature", "SHA384withRSA",
-+ "sun.security.rsa.RSASignature$SHA384withRSA", attrs);
-+ addA(p, "Signature", "SHA512withRSA",
-+ "sun.security.rsa.RSASignature$SHA512withRSA", attrs);
-+ addA(p, "Signature", "SHA512/224withRSA",
-+ "sun.security.rsa.RSASignature$SHA512_224withRSA", attrs);
-+ addA(p, "Signature", "SHA512/256withRSA",
-+ "sun.security.rsa.RSASignature$SHA512_256withRSA", attrs);
-+ addA(p, "Signature", "SHA3-224withRSA",
-+ "sun.security.rsa.RSASignature$SHA3_224withRSA", attrs);
-+ addA(p, "Signature", "SHA3-256withRSA",
-+ "sun.security.rsa.RSASignature$SHA3_256withRSA", attrs);
-+ addA(p, "Signature", "SHA3-384withRSA",
-+ "sun.security.rsa.RSASignature$SHA3_384withRSA", attrs);
-+ addA(p, "Signature", "SHA3-512withRSA",
-+ "sun.security.rsa.RSASignature$SHA3_512withRSA", attrs);
-
-- add(p, "KeyFactory", "RSA",
-- "sun.security.rsa.RSAKeyFactory$Legacy",
-- getAliases("PKCS1"), null);
-- add(p, "KeyPairGenerator", "RSA",
-- "sun.security.rsa.RSAKeyPairGenerator$Legacy",
-- getAliases("PKCS1"), null);
-- addA(p, "Signature", "MD2withRSA",
-- "sun.security.rsa.RSASignature$MD2withRSA", attrs);
-- addA(p, "Signature", "MD5withRSA",
-- "sun.security.rsa.RSASignature$MD5withRSA", attrs);
-- addA(p, "Signature", "SHA1withRSA",
-- "sun.security.rsa.RSASignature$SHA1withRSA", attrs);
-- addA(p, "Signature", "SHA224withRSA",
-- "sun.security.rsa.RSASignature$SHA224withRSA", attrs);
-- addA(p, "Signature", "SHA256withRSA",
-- "sun.security.rsa.RSASignature$SHA256withRSA", attrs);
-- addA(p, "Signature", "SHA384withRSA",
-- "sun.security.rsa.RSASignature$SHA384withRSA", attrs);
-- addA(p, "Signature", "SHA512withRSA",
-- "sun.security.rsa.RSASignature$SHA512withRSA", attrs);
-- addA(p, "Signature", "SHA512/224withRSA",
-- "sun.security.rsa.RSASignature$SHA512_224withRSA", attrs);
-- addA(p, "Signature", "SHA512/256withRSA",
-- "sun.security.rsa.RSASignature$SHA512_256withRSA", attrs);
-- addA(p, "Signature", "SHA3-224withRSA",
-- "sun.security.rsa.RSASignature$SHA3_224withRSA", attrs);
-- addA(p, "Signature", "SHA3-256withRSA",
-- "sun.security.rsa.RSASignature$SHA3_256withRSA", attrs);
-- addA(p, "Signature", "SHA3-384withRSA",
-- "sun.security.rsa.RSASignature$SHA3_384withRSA", attrs);
-- addA(p, "Signature", "SHA3-512withRSA",
-- "sun.security.rsa.RSASignature$SHA3_512withRSA", attrs);
-+ addA(p, "KeyFactory", "RSASSA-PSS",
-+ "sun.security.rsa.RSAKeyFactory$PSS", attrs);
-+ addA(p, "KeyPairGenerator", "RSASSA-PSS",
-+ "sun.security.rsa.RSAKeyPairGenerator$PSS", attrs);
-+ addA(p, "Signature", "RSASSA-PSS",
-+ "sun.security.rsa.RSAPSSSignature", attrs);
-+ }
-
-- addA(p, "KeyFactory", "RSASSA-PSS",
-- "sun.security.rsa.RSAKeyFactory$PSS", attrs);
-- addA(p, "KeyPairGenerator", "RSASSA-PSS",
-- "sun.security.rsa.RSAKeyPairGenerator$PSS", attrs);
-- addA(p, "Signature", "RSASSA-PSS",
-- "sun.security.rsa.RSAPSSSignature", attrs);
- addA(p, "AlgorithmParameters", "RSASSA-PSS",
- "sun.security.rsa.PSSParameters", null);
- }
-diff --git openjdk.orig/src/java.base/share/conf/security/java.security openjdk/src/java.base/share/conf/security/java.security
-index 3a322854204..5a355e70cae 100644
---- openjdk.orig/src/java.base/share/conf/security/java.security
-+++ openjdk/src/java.base/share/conf/security/java.security
-@@ -86,6 +86,8 @@ fips.provider.1=SunPKCS11 ${java.home}/conf/security/nss.fips.cfg
- fips.provider.2=SUN
- fips.provider.3=SunEC
- fips.provider.4=SunJSSE
-+fips.provider.5=SunJCE
-+fips.provider.6=SunRsaSign
-
- #
- # A list of preferred providers for specific algorithms. These providers will
diff --git a/SOURCES/rh2052829-fips_runtime_nss_detection.patch b/SOURCES/rh2052829-fips_runtime_nss_detection.patch
deleted file mode 100644
index c609fce..0000000
--- a/SOURCES/rh2052829-fips_runtime_nss_detection.patch
+++ /dev/null
@@ -1,213 +0,0 @@
-commit 090ea0389db5c2e0c8ee13652bccd544b17872c2
-Author: Andrew Hughes
-Date: Mon Feb 7 15:33:27 2022 +0000
-
- RH2051605: Detect NSS at Runtime for FIPS detection
-
-diff --git openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c openjdk/src/java.base/linux/native/libsystemconf/systemconf.c
-index caf678a7dd6..8dcb7d9073f 100644
---- openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c
-+++ openjdk/src/java.base/linux/native/libsystemconf/systemconf.c
-@@ -23,26 +23,37 @@
- * questions.
- */
-
--#include
- #include
- #include
-+#include "jvm_md.h"
- #include
-
- #ifdef SYSCONF_NSS
- #include
-+#else
-+#include
- #endif //SYSCONF_NSS
-
- #include "java_security_SystemConfigurator.h"
-
--#define MSG_MAX_SIZE 96
-+#define MSG_MAX_SIZE 256
-+#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled"
-+
-+typedef int (SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE)(void);
-
-+static SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE *getSystemFIPSEnabled;
- static jmethodID debugPrintlnMethodID = NULL;
- static jobject debugObj = NULL;
-
--// Only used when NSS is unavailable and FIPS_ENABLED_PATH is read
--#ifndef SYSCONF_NSS
--
--#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled"
-+static void dbgPrint(JNIEnv *env, const char* msg)
-+{
-+ jstring jMsg;
-+ if (debugObj != NULL) {
-+ jMsg = (*env)->NewStringUTF(env, msg);
-+ CHECK_NULL(jMsg);
-+ (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg);
-+ }
-+}
-
- static void throwIOException(JNIEnv *env, const char *msg)
- {
-@@ -51,18 +62,61 @@ static void throwIOException(JNIEnv *env, const char *msg)
- (*env)->ThrowNew(env, cls, msg);
- }
-
--#endif
-+static void handle_msg(JNIEnv *env, const char* msg, int msg_bytes)
-+{
-+ if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) {
-+ dbgPrint(env, msg);
-+ } else {
-+ dbgPrint(env, "systemconf: cannot render message");
-+ }
-+}
-
--static void dbgPrint(JNIEnv *env, const char* msg)
-+// Only used when NSS is not linked at build time
-+#ifndef SYSCONF_NSS
-+
-+static void *nss_handle;
-+
-+static jboolean loadNSS(JNIEnv *env)
- {
-- jstring jMsg;
-- if (debugObj != NULL) {
-- jMsg = (*env)->NewStringUTF(env, msg);
-- CHECK_NULL(jMsg);
-- (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg);
-- }
-+ char msg[MSG_MAX_SIZE];
-+ int msg_bytes;
-+ const char* errmsg;
-+
-+ nss_handle = dlopen(JNI_LIB_NAME("nss3"), RTLD_LAZY);
-+ if (nss_handle == NULL) {
-+ errmsg = dlerror();
-+ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "loadNSS: dlopen: %s\n",
-+ errmsg);
-+ handle_msg(env, msg, msg_bytes);
-+ return JNI_FALSE;
-+ }
-+ dlerror(); /* Clear errors */
-+ getSystemFIPSEnabled = (SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE*)dlsym(nss_handle, "SECMOD_GetSystemFIPSEnabled");
-+ if ((errmsg = dlerror()) != NULL) {
-+ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "loadNSS: dlsym: %s\n",
-+ errmsg);
-+ handle_msg(env, msg, msg_bytes);
-+ return JNI_FALSE;
-+ }
-+ return JNI_TRUE;
-+}
-+
-+static void closeNSS(JNIEnv *env)
-+{
-+ char msg[MSG_MAX_SIZE];
-+ int msg_bytes;
-+ const char* errmsg;
-+
-+ if (dlclose(nss_handle) != 0) {
-+ errmsg = dlerror();
-+ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "closeNSS: dlclose: %s\n",
-+ errmsg);
-+ handle_msg(env, msg, msg_bytes);
-+ }
- }
-
-+#endif
-+
- /*
- * Class: java_security_SystemConfigurator
- * Method: JNI_OnLoad
-@@ -104,6 +158,14 @@ JNIEXPORT jint JNICALL DEF_JNI_OnLoad(JavaVM *vm, void *reserved)
- debugObj = (*env)->NewGlobalRef(env, debugObj);
- }
-
-+#ifdef SYSCONF_NSS
-+ getSystemFIPSEnabled = *SECMOD_GetSystemFIPSEnabled;
-+#else
-+ if (loadNSS(env) == JNI_FALSE) {
-+ dbgPrint(env, "libsystemconf: Failed to load NSS library.");
-+ }
-+#endif
-+
- return (*env)->GetVersion(env);
- }
-
-@@ -119,6 +181,9 @@ JNIEXPORT void JNICALL DEF_JNI_OnUnload(JavaVM *vm, void *reserved)
- if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) {
- return; /* Should not happen */
- }
-+#ifndef SYSCONF_NSS
-+ closeNSS(env);
-+#endif
- (*env)->DeleteGlobalRef(env, debugObj);
- }
- }
-@@ -130,44 +195,30 @@ JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEn
- char msg[MSG_MAX_SIZE];
- int msg_bytes;
-
--#ifdef SYSCONF_NSS
--
-- dbgPrint(env, "getSystemFIPSEnabled: calling SECMOD_GetSystemFIPSEnabled");
-- fips_enabled = SECMOD_GetSystemFIPSEnabled();
-- msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
-- " SECMOD_GetSystemFIPSEnabled returned 0x%x", fips_enabled);
-- if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) {
-- dbgPrint(env, msg);
-+ if (getSystemFIPSEnabled != NULL) {
-+ dbgPrint(env, "getSystemFIPSEnabled: calling SECMOD_GetSystemFIPSEnabled");
-+ fips_enabled = (*getSystemFIPSEnabled)();
-+ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
-+ " SECMOD_GetSystemFIPSEnabled returned 0x%x", fips_enabled);
-+ handle_msg(env, msg, msg_bytes);
-+ return (fips_enabled == 1 ? JNI_TRUE : JNI_FALSE);
- } else {
-- dbgPrint(env, "getSystemFIPSEnabled: cannot render" \
-- " SECMOD_GetSystemFIPSEnabled return value");
-- }
-- return (fips_enabled == 1 ? JNI_TRUE : JNI_FALSE);
-+ FILE *fe;
-
--#else // SYSCONF_NSS
--
-- FILE *fe;
--
-- dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH);
-- if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) {
-+ dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH);
-+ if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) {
- throwIOException(env, "Cannot open " FIPS_ENABLED_PATH);
- return JNI_FALSE;
-- }
-- fips_enabled = fgetc(fe);
-- fclose(fe);
-- if (fips_enabled == EOF) {
-+ }
-+ fips_enabled = fgetc(fe);
-+ fclose(fe);
-+ if (fips_enabled == EOF) {
- throwIOException(env, "Cannot read " FIPS_ENABLED_PATH);
- return JNI_FALSE;
-+ }
-+ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
-+ " read character is '%c'", fips_enabled);
-+ handle_msg(env, msg, msg_bytes);
-+ return (fips_enabled == '1' ? JNI_TRUE : JNI_FALSE);
- }
-- msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
-- " read character is '%c'", fips_enabled);
-- if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) {
-- dbgPrint(env, msg);
-- } else {
-- dbgPrint(env, "getSystemFIPSEnabled: cannot render" \
-- " read character");
-- }
-- return (fips_enabled == '1' ? JNI_TRUE : JNI_FALSE);
--
--#endif // SYSCONF_NSS
- }
diff --git a/SPECS/java-17-openjdk.spec b/SPECS/java-17-openjdk.spec
index 41a34f0..2b6c729 100644
--- a/SPECS/java-17-openjdk.spec
+++ b/SPECS/java-17-openjdk.spec
@@ -23,6 +23,8 @@
%bcond_without staticlibs
# Build a fresh libjvm.so for use in a copy of the bootstrap JDK
%bcond_without fresh_libjvm
+# Build with system libraries
+%bcond_with system_libs
# Workaround for stripping of debug symbols from static libraries
%if %{with staticlibs}
@@ -39,6 +41,16 @@
%global build_hotspot_first 0
%endif
+%if %{with system_libs}
+%global system_libs 1
+%global link_type system
+%global freetype_lib %{nil}
+%else
+%global system_libs 0
+%global link_type bundled
+%global freetype_lib |libfreetype[.]so.*
+%endif
+
# The -g flag says to use strip -g instead of full strip on DSOs or EXEs.
# This fixes detailed NMT and other tools which need minimal debug info.
# See: https://bugzilla.redhat.com/show_bug.cgi?id=1520879
@@ -190,11 +202,15 @@
%global staticlibs_loop %{nil}
%endif
+%if 0%{?flatpak}
+%global bootstrap_build false
+%else
%ifarch %{bootstrap_arches}
%global bootstrap_build true
%else
%global bootstrap_build false
%endif
+%endif
%if %{include_staticlibs}
# Extra target for producing the static-libraries. Separate from
@@ -305,12 +321,8 @@
# New Version-String scheme-style defines
%global featurever 17
%global interimver 0
-%global updatever 3
+%global updatever 5
%global patchver 0
-# If you bump featurever, you must also bump vendor_version_string
-# Used via new version scheme. JDK 17 was
-# GA'ed in September 2021 => 21.9
-%global vendor_version_string 21.9
# buildjdkver is usually same as %%{featurever},
# but in time of bootstrap of next jdk, it is featurever-1,
# and this it is better to change it here, on single place
@@ -325,16 +337,39 @@
%global lts_designator_zip ""
%endif
+# Define vendor information used by OpenJDK
+%global oj_vendor Red Hat, Inc.
+%global oj_vendor_url https://www.redhat.com/
+# Define what url should JVM offer in case of a crash report
+# order may be important, epel may have rhel declared
+%if 0%{?epel}
+%global oj_vendor_bug_url https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora%20EPEL&component=%{name}&version=epel%{epel}
+%else
+%if 0%{?fedora}
+# Does not work for rawhide, keeps the version field empty
+%global oj_vendor_bug_url https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{name}&version=%{fedora}
+%else
+%if 0%{?rhel}
+%global oj_vendor_bug_url https://bugzilla.redhat.com/enter_bug.cgi?product=Red%20Hat%20Enterprise%20Linux%20%{rhel}&component=%{name}
+%else
+%global oj_vendor_bug_url https://bugzilla.redhat.com/enter_bug.cgi
+%endif
+%endif
+%endif
+%global oj_vendor_version (Red_Hat-%{version}-%{release})
+
# Define IcedTea version used for SystemTap tapsets and desktop file
%global icedteaver 6.0.0pre00-c848b93a8598
+# Define current Git revision for the FIPS support patches
+%global fipsver 0bd5ca9ccc5
# Standard JPackage naming and versioning defines
%global origin openjdk
%global origin_nice OpenJDK
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver 7
-%global rpmrelease 1
+%global buildver 8
+%global rpmrelease 2
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and build versions
@@ -363,35 +398,18 @@
%global is_ga 1
%if %{is_ga}
%global build_type GA
-%global expected_ea_designator ""
+%global ea_designator ""
%global ea_designator_zip ""
%global extraver %{nil}
%global eaprefix %{nil}
%else
%global build_type EA
-%global expected_ea_designator ea
-%global ea_designator_zip -%{expected_ea_designator}
-%global extraver .%{expected_ea_designator}
+%global ea_designator ea
+%global ea_designator_zip -%{ea_designator}
+%global extraver .%{ea_designator}
%global eaprefix 0.
%endif
-# Define what url should JVM offer in case of a crash report
-# order may be important, epel may have rhel declared
-%if 0%{?epel}
-%global bugs https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora%20EPEL&component=%{name}&version=epel%{epel}
-%else
-%if 0%{?fedora}
-# Does not work for rawhide, keeps the version field empty
-%global bugs https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{name}&version=%{fedora}
-%else
-%if 0%{?rhel}
-%global bugs https://bugzilla.redhat.com/enter_bug.cgi?product=Red%20Hat%20Enterprise%20Linux%20%{rhel}&component=%{name}
-%else
-%global bugs https://bugzilla.redhat.com/enter_bug.cgi
-%endif
-%endif
-%endif
-
# parametrized macros are order-sensitive
%global compatiblename java-%{featurever}-%{origin}
%global fullversion %{compatiblename}-%{version}-%{release}
@@ -409,7 +427,7 @@
# fix for https://bugzilla.redhat.com/show_bug.cgi?id=1111349
# https://bugzilla.redhat.com/show_bug.cgi?id=1590796#c14
# https://bugzilla.redhat.com/show_bug.cgi?id=1655938
-%global _privatelibs libsplashscreen[.]so.*|libawt_xawt[.]so.*|libjli[.]so.*|libattach[.]so.*|libawt[.]so.*|libextnet[.]so.*|libawt_headless[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjimage[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmanagement_agent[.]so.*|libmanagement_ext[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libprefs[.]so.*|librmi[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsystemconf[.]so.*|libzip[.]so.*
+%global _privatelibs libsplashscreen[.]so.*|libawt_xawt[.]so.*|libjli[.]so.*|libattach[.]so.*|libawt[.]so.*|libextnet[.]so.*|libawt_headless[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjimage[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmanagement_agent[.]so.*|libmanagement_ext[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libprefs[.]so.*|librmi[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsystemconf[.]so.*|libzip[.]so.*%{freetype_lib}
%global _publiclibs libjawt[.]so.*|libjava[.]so.*|libjvm[.]so.*|libverify[.]so.*|libjsig[.]so.*
%if %is_system_jdk
%global __provides_exclude ^(%{_privatelibs})$
@@ -813,6 +831,9 @@ exit 0
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libawt_headless.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libdt_socket.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libfontmanager.so
+%if ! %{system_libs}
+%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libfreetype.so
+%endif
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libinstrument.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libj2gss.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libj2pcsc.so
@@ -931,7 +952,7 @@ exit 0
%ifarch %{sa_arches}
%ifnarch %{zero_arches}
%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jhsdb
-%{_mandir}/man1/jhsdb-%{uniquesuffix -- %{?1}}.1.gz
+%{_mandir}/man1/jhsdb-%{uniquesuffix -- %{?1}}.1*
%endif
%endif
%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jinfo
@@ -970,11 +991,11 @@ exit 0
%{_mandir}/man1/jstat-%{uniquesuffix -- %{?1}}.1*
%{_mandir}/man1/jstatd-%{uniquesuffix -- %{?1}}.1*
%{_mandir}/man1/serialver-%{uniquesuffix -- %{?1}}.1*
-%{_mandir}/man1/jdeprscan-%{uniquesuffix -- %{?1}}.1.gz
-%{_mandir}/man1/jlink-%{uniquesuffix -- %{?1}}.1.gz
-%{_mandir}/man1/jmod-%{uniquesuffix -- %{?1}}.1.gz
-%{_mandir}/man1/jshell-%{uniquesuffix -- %{?1}}.1.gz
-%{_mandir}/man1/jfr-%{uniquesuffix -- %{?1}}.1.gz
+%{_mandir}/man1/jdeprscan-%{uniquesuffix -- %{?1}}.1*
+%{_mandir}/man1/jlink-%{uniquesuffix -- %{?1}}.1*
+%{_mandir}/man1/jmod-%{uniquesuffix -- %{?1}}.1*
+%{_mandir}/man1/jshell-%{uniquesuffix -- %{?1}}.1*
+%{_mandir}/man1/jfr-%{uniquesuffix -- %{?1}}.1*
%if %{with_systemtap}
%dir %{tapsetroot}
@@ -1097,7 +1118,9 @@ Requires: ca-certificates
# Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
Requires: javapackages-filesystem
# Require zone-info data provided by tzdata-java sub-package
-Requires: tzdata-java >= 2015d
+# 2022d required as of JDK-8294357
+# Should be bumped to 2022e once available (JDK-8295173)
+Requires: tzdata-java >= 2022d
# for support of kernel stream control
# libsctp.so.1 is being `dlopen`ed on demand
Requires: lksctp-tools%{?_isa}
@@ -1110,6 +1133,8 @@ OrderWithRequires: copy-jdk-configs
%endif
# for printing support
Requires: cups-libs
+# for system security properties
+Requires: crypto-policies
# for FIPS PKCS11 provider
Requires: nss
# Post requires alternatives to install tool alternatives
@@ -1284,9 +1309,15 @@ Source14: TestECDSA.java
# Verify system crypto (policy) can be disabled via a property
Source15: TestSecurityProperties.java
+# Ensure vendor settings are correct
+Source16: CheckVendor.java
+
# nss fips configuration file
Source17: nss.fips.cfg.in
+# Ensure translations are available for new timezones
+Source18: TestTranslations.java
+
############################################
#
# RPM/distribution specific patches
@@ -1304,41 +1335,38 @@ Patch1: rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
# Restrict access to java-atk-wrapper classes
Patch2: rh1648644-java_access_bridge_privileged_security.patch
Patch3: rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
-# Follow system wide crypto policy RHBZ#1249083
-Patch4: pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
-# PR3695: Allow use of system crypto policy to be disabled by the user
-Patch5: pr3695-toggle_system_crypto_policy.patch
-# Depend on pcs-lite-libs instead of pcs-lite-devel as this is only in optional repo
+# Depend on pcsc-lite-libs instead of pcsc-lite-devel as this is only in optional repo
Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
-# FIPS support patches
+# Crypto policy and FIPS support patches
+# Patch is generated from the fips-17u tree at https://github.com/rh-openjdk/jdk/tree/fips-17u
+# as follows: git diff %%{vcstag} src make > fips-17u-$(git show -s --format=%h HEAD).patch
+# Diff is limited to src and make subdirectories to exclude .github changes
+# Fixes currently included:
+# PR3183, RH1340845: Follow system wide crypto policy
+# PR3695: Allow use of system crypto policy to be disabled by the user
# RH1655466: Support RHEL FIPS mode using SunPKCS11 provider
-Patch1001: rh1655466-global_crypto_and_fips.patch
# RH1818909: No ciphersuites availale for SSLSocket in FIPS mode
-Patch1002: rh1818909-fips_default_keystore_type.patch
# RH1860986: Disable TLSv1.3 with the NSS-FIPS provider until PKCS#11 v3.0 support is available
-Patch1004: rh1860986-disable_tlsv1.3_in_fips_mode.patch
# RH1915071: Always initialise JavaSecuritySystemConfiguratorAccess
-Patch1007: rh1915071-always_initialise_configurator_access.patch
# RH1929465: Improve system FIPS detection
-Patch1008: rh1929465-improve_system_FIPS_detection.patch
-Patch1011: rh1929465-dont_define_unused_throwioexception.patch
# RH1995150: Disable non-FIPS crypto in SUN and SunEC security providers
-Patch1009: rh1995150-disable_non-fips_crypto.patch
# RH1996182: Login to the NSS software token in FIPS mode
-Patch1010: rh1996182-login_to_nss_software_token.patch
-Patch1012: rh1996182-extend_security_policy.patch
# RH1991003: Allow plain key import unless com.redhat.fips.plainKeySupport is set to false
-Patch1013: rh1991003-enable_fips_keys_import.patch
# RH2021263: Resolve outstanding FIPS issues
-Patch1014: rh2021263-fips_ensure_security_initialised.patch
-Patch1015: rh2021263-fips_missing_native_returns.patch
# RH2052819: Fix FIPS reliance on crypto policies
-Patch1016: rh2021263-fips_separate_policy_and_fips_init.patch
# RH2052829: Detect NSS at Runtime for FIPS detection
-Patch1017: rh2052829-fips_runtime_nss_detection.patch
# RH2052070: Enable AlgorithmParameters and AlgorithmParameterGenerator services in FIPS mode
-Patch1018: rh2052070-enable_algorithmparameters_in_fips_mode.patch
+# RH2023467: Enable FIPS keys export
+# RH2094027: SunEC runtime permission for FIPS
+# RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
+# RH2090378: Revert to disabling system security properties and FIPS mode support together
+# RH2104724: Avoid import/export of DH private keys
+# RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode
+# Build the systemconf library on all platforms
+# RH2048582: Support PKCS#12 keystores
+# RH2020290: Support TLS 1.3 in FIPS mode
+Patch1001: fips-17u-%{fipsver}.patch
#############################################
#
@@ -1350,10 +1378,22 @@ Patch2000: jdk8275535-rh2053256-ldap_auth.patch
#############################################
#
-# OpenJDK patches appearing in 17.0.3
+# OpenJDK patches appearing in 17.0.5
#
#############################################
+#############################################
+#
+# OpenJDK patches targetted for 17.0.6
+#
+#############################################
+# JDK-8293834: Update CLDR data following tzdata 2022c update
+Patch2001: jdk8293834-kyiv_cldr_update.patch
+# JDK-8294357: (tz) Update Timezone Data to 2022d
+Patch2002: jdk8294357-tzdata2022d.patch
+# JDK-8295173: (tz) Update Timezone Data to 2022e
+Patch2003: jdk8295173-tzdata2022e.patch
+
BuildRequires: autoconf
BuildRequires: automake
BuildRequires: alsa-lib-devel
@@ -1363,14 +1403,8 @@ BuildRequires: desktop-file-utils
# elfutils only are OK for build without AOT
BuildRequires: elfutils-devel
BuildRequires: fontconfig-devel
-BuildRequires: freetype-devel
-BuildRequires: giflib-devel
BuildRequires: gcc-c++
BuildRequires: gdb
-BuildRequires: harfbuzz-devel
-BuildRequires: lcms2-devel
-BuildRequires: libjpeg-devel
-BuildRequires: libpng-devel
BuildRequires: libxslt
BuildRequires: libX11-devel
BuildRequires: libXi-devel
@@ -1381,6 +1415,8 @@ BuildRequires: libXt-devel
BuildRequires: libXtst-devel
# Requirement for setting up nss.cfg and nss.fips.cfg
BuildRequires: nss-devel
+# Requirement for system security property test
+BuildRequires: crypto-policies
BuildRequires: pkgconfig
BuildRequires: xorg-x11-proto-devel
BuildRequires: zip
@@ -1390,7 +1426,9 @@ BuildRequires: java-17-openjdk-devel
%ifarch %{zero_arches}
BuildRequires: libffi-devel
%endif
-BuildRequires: tzdata-java >= 2015d
+# 2022d required as of JDK-8294357
+# Should be bumped to 2022e once available (JDK-8295173)
+BuildRequires: tzdata-java >= 2022d
# Earlier versions have a bug in tree vectorization on PPC
BuildRequires: gcc >= 4.8.3-8
@@ -1399,6 +1437,30 @@ BuildRequires: systemtap-sdt-devel
%endif
BuildRequires: make
+%if %{system_libs}
+BuildRequires: freetype-devel
+BuildRequires: giflib-devel
+BuildRequires: harfbuzz-devel
+BuildRequires: lcms2-devel
+BuildRequires: libjpeg-devel
+BuildRequires: libpng-devel
+%else
+# Version in src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
+Provides: bundled(freetype) = 2.12.1
+# Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
+Provides: bundled(giflib) = 5.2.1
+# Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
+Provides: bundled(harfbuzz) = 4.4.1
+# Version in src/java.desktop/share/native/liblcms/lcms2.h
+Provides: bundled(lcms2) = 2.12.0
+# Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
+Provides: bundled(libjpeg) = 6b
+# Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
+Provides: bundled(libpng) = 1.6.37
+# We link statically against libstdc++ to increase portability
+BuildRequires: libstdc++-static
+%endif
+
# this is always built, also during debug-only build
# when it is built in debug-only this package is just placeholder
%{java_rpo %{nil}}
@@ -1708,6 +1770,8 @@ The %{origin_nice} %{featurever} API documentation compressed in a single archiv
%prep
+echo "Preparing %{oj_vendor_version}"
+
# Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-(
%if 0%{?stapinstall:1}
echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{stapinstall}"
@@ -1746,39 +1810,53 @@ if [ $prioritylength -ne 8 ] ; then
fi
# OpenJDK patches
+
+%if %{system_libs}
# Remove libraries that are linked by both static and dynamic builds
sh %{SOURCE12} %{top_level_dir_name}
+%endif
# Patch the JDK
pushd %{top_level_dir_name}
%patch1 -p1
%patch2 -p1
%patch3 -p1
-%patch4 -p1
-%patch5 -p1
%patch6 -p1
+# Add crypto policy and FIPS support
+%patch1001 -p1
+# nss.cfg PKCS11 support; must come last as it also alters java.security
+%patch1000 -p1
+# tzdata updates targetted for 17.0.6
+%patch2001 -p1
+%patch2002 -p1
+%patch2003 -p1
popd # openjdk
-%patch1000
%patch600
-%patch1001
-%patch1002
-%patch1004
-%patch1007
-%patch1008
-%patch1009
-%patch1010
-%patch1011
-%patch1012
-%patch1013
-%patch1014
-%patch1015
-%patch1016
-%patch1017
-%patch1018
%patch2000
+# The OpenJDK version file includes the current
+# upstream version information. For some reason,
+# configure does not automatically use the
+# default pre-version supplied there (despite
+# what the file claims), so we pass it manually
+# to configure
+VERSION_FILE=$(pwd)/%{top_level_dir_name}/make/conf/version-numbers.conf
+if [ -f ${VERSION_FILE} ] ; then
+ UPSTREAM_EA_DESIGNATOR=$(grep '^DEFAULT_PROMOTED_VERSION_PRE' ${VERSION_FILE} | cut -d '=' -f 2)
+else
+ echo "Could not find OpenJDK version file.";
+ exit 16
+fi
+if [ "x${UPSTREAM_EA_DESIGNATOR}" != "x%{ea_designator}" ] ; then
+ echo "WARNING: Designator mismatch";
+ echo "Spec file is configured for a %{build_type} build with designator '%{ea_designator}'"
+ echo "Upstream version-pre setting is '${UPSTREAM_EA_DESIGNATOR}'";
+ # Don't fail at present as upstream are not maintaining the value correctly
+ #exit 17
+fi
+
# Extract systemtap tapsets
%if %{with_systemtap}
tar --strip-components=1 -x -I xz -f %{SOURCE8}
@@ -1874,22 +1952,12 @@ function buildjdk() {
local top_dir_abs_src_path=$(pwd)/%{top_level_dir_name}
local top_dir_abs_build_path=$(pwd)/${outputdir}
- # The OpenJDK version file includes the current
- # upstream version information. For some reason,
- # configure does not automatically use the
- # default pre-version supplied there (despite
- # what the file claims), so we pass it manually
- # to configure
- VERSION_FILE=${top_dir_abs_src_path}/make/conf/version-numbers.conf
- if [ -f ${VERSION_FILE} ] ; then
- EA_DESIGNATOR=$(grep '^DEFAULT_PROMOTED_VERSION_PRE' ${VERSION_FILE} | cut -d '=' -f 2)
+ # This must be set using the global, so that the
+ # static libraries still use a dynamic stdc++lib
+ if [ "x%{link_type}" = "xbundled" ] ; then
+ libc_link_opt="static";
else
- echo "Could not find OpenJDK version file.";
- exit 16
- fi
- if [ "x${EA_DESIGNATOR}" != "x%{expected_ea_designator}" ] ; then
- echo "Spec file is configured for a %{build_type} build, but upstream version-pre setting is ${EA_DESIGNATOR}";
- exit 17
+ libc_link_opt="dynamic";
fi
echo "Using output directory: ${outputdir}";
@@ -1898,11 +1966,15 @@ function buildjdk() {
echo "Using make targets: ${maketargets}"
echo "Using debuglevel: ${debuglevel}"
echo "Using link_opt: ${link_opt}"
- echo "Building %{newjavaver}-%{buildver}, pre=${EA_DESIGNATOR}, opt=%{lts_designator}"
+ echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"
mkdir -p ${outputdir}
pushd ${outputdir}
+ # Note: zlib and freetype use %{link_type}
+ # rather than ${link_opt} as the system versions
+ # are always used in a system_libs build, even
+ # for the static library build
bash ${top_dir_abs_src_path}/configure \
%ifarch %{zero_arches}
--with-jvm-variants=zero \
@@ -1911,25 +1983,26 @@ function buildjdk() {
--with-jobs=1 \
%endif
--with-version-build=%{buildver} \
- --with-version-pre="${EA_DESIGNATOR}" \
+ --with-version-pre="%{ea_designator}" \
--with-version-opt=%{lts_designator} \
- --with-vendor-version-string="%{vendor_version_string}" \
- --with-vendor-name="Red Hat, Inc." \
- --with-vendor-url="https://www.redhat.com/" \
- --with-vendor-bug-url="%{bugs}" \
- --with-vendor-vm-bug-url="%{bugs}" \
+ --with-vendor-version-string="%{oj_vendor_version}" \
+ --with-vendor-name="%{oj_vendor}" \
+ --with-vendor-url="%{oj_vendor_url}" \
+ --with-vendor-bug-url="%{oj_vendor_bug_url}" \
+ --with-vendor-vm-bug-url="%{oj_vendor_bug_url}" \
--with-boot-jdk=${buildjdk} \
--with-debug-level=${debuglevel} \
--with-native-debug-symbols="%{debug_symbols}" \
--disable-sysconf-nss \
--enable-unlimited-crypto \
- --with-zlib=system \
+ --with-zlib=%{link_type} \
+ --with-freetype=%{link_type} \
--with-libjpeg=${link_opt} \
--with-giflib=${link_opt} \
--with-libpng=${link_opt} \
--with-lcms=${link_opt} \
--with-harfbuzz=${link_opt} \
- --with-stdc++lib=dynamic \
+ --with-stdc++lib=${libc_link_opt} \
--with-extra-cxxflags="$EXTRA_CPP_FLAGS" \
--with-extra-cflags="$EXTRA_CFLAGS" \
--with-extra-ldflags="%{ourldflags}" \
@@ -1972,6 +2045,10 @@ function installjdk() {
# Install nss.fips.cfg: NSS configuration for global FIPS mode (crypto-policies)
install -m 644 nss.fips.cfg ${imagepath}/conf/security/
+ # Turn on system security properties
+ sed -i -e "s:^security.useSystemPropertiesFile=.*:security.useSystemPropertiesFile=true:" \
+ ${imagepath}/conf/security/java.security
+
# Use system-wide tzdata
rm ${imagepath}/lib/tzdb.dat
ln -s %{_datadir}/javazi-1.8/tzdb.dat ${imagepath}/lib/tzdb.dat
@@ -2011,12 +2088,13 @@ for suffix in %{build_loop} ; do
bootbuilddir=boot${builddir}
if test "x${loop}" = "x%{main_suffix}" ; then
+ link_opt="%{link_type}"
+%if %{system_libs}
# Copy the source tree so we can remove all in-tree libraries
cp -a %{top_level_dir_name} %{top_level_dir_name_backup}
# Remove all libraries that are linked
sh %{SOURCE12} %{top_level_dir_name} full
- # Use system libraries
- link_opt="system"
+%endif
# Debug builds don't need same targets as release for
# build speed-up. We also avoid bootstrapping these
# slower builds.
@@ -2034,9 +2112,11 @@ for suffix in %{build_loop} ; do
else
buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt}
fi
+%if %{system_libs}
# Restore original source tree we modified by removing full in-tree sources
rm -rf %{top_level_dir_name}
mv %{top_level_dir_name_backup} %{top_level_dir_name}
+%endif
else
# Use bundled libraries for building statically
link_opt="bundled"
@@ -2052,6 +2132,9 @@ for suffix in %{build_loop} ; do
top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}}
installjdk ${top_dir_abs_main_build_path}/images/%{jdkimage}
+ # Print release information
+ cat ${top_dir_abs_main_build_path}/images/%{jdkimage}/release
+
# build cycles
done # end of release / debug cycle loop
@@ -2067,6 +2150,8 @@ top_dir_abs_staticlibs_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{staticli
export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
+# Pre-test setup
+
#check Shenandoah is enabled
%if %{use_shenandoah_hotspot}
$JAVA_HOME//bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -version
@@ -2080,9 +2165,14 @@ $JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED TestCryptoLev
$JAVA_HOME/bin/javac -d . %{SOURCE14}
$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||")
-# Check system crypto (policy) can be disabled
+# Check system crypto (policy) is active and can be disabled
+# Test takes a single argument - true or false - to state whether system
+# security properties are enabled or not.
$JAVA_HOME/bin/javac -d . %{SOURCE15}
-$JAVA_HOME/bin/java -Djava.security.disableSystemPropertiesFile=true $(echo $(basename %{SOURCE15})|sed "s|\.java||")
+export PROG=$(echo $(basename %{SOURCE15})|sed "s|\.java||")
+export SEC_DEBUG="-Djava.security.debug=properties"
+$JAVA_HOME/bin/java ${SEC_DEBUG} ${PROG} true
+$JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=true ${PROG} false
# Check java launcher has no SSB mitigation
if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
@@ -2094,6 +2184,11 @@ nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation
if ! nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation ; then true ; else false; fi
%endif
+# Check translations are available for new timezones
+$JAVA_HOME/bin/javac -d . %{SOURCE18}
+$JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE
+$JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR
+
%if %{include_staticlibs}
# Check debug symbols in static libraries (smoke test)
export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}
@@ -2110,14 +2205,6 @@ do
# All these tests rely on RPM failing the build if the exit code of any set
# of piped commands is non-zero.
- # If this is the empty library, libsyslookup.so, of the foreign function and memory
- # API incubation module (JEP 412), skip the debuginfo check as this seems unreliable
- # on s390x. It's not very useful for other arches either, so skip unconditionally.
- if [ "`basename $lib`" = "libsyslookup.so" ]; then
- echo "Skipping debuginfo check for empty library 'libsyslookup.so'"
- continue
- fi
-
# Test for .debug_* sections in the shared object. This is the main test
# Stripped objects will not contain these
eu-readelf -S "$lib" | grep "] .debug_"
@@ -2132,7 +2219,7 @@ do
do
# We expect to see .cpp files, except for architectures like aarch64 and
# s390 where we expect .o and .oS files
- echo "$line" | grep -E "ABS ((.*/)?[-_a-zA-Z0-9]+\.(c|cc|cpp|cxx|o|oS))?$"
+ echo "$line" | grep -E "ABS ((.*/)?[-_a-zA-Z0-9]+\.(c|cc|cpp|cxx|o|S|oS))?$"
done
IFS="$old_IFS"
@@ -2557,6 +2644,154 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Wed Oct 26 2022 Andrew Hughes - 1:17.0.5.0.8-2
+- Update to jdk-17.0.5+8 (GA)
+- Update release notes to 17.0.5+8 (GA)
+- Switch to GA mode for final release.
+- Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
+- Update CLDR data with Europe/Kyiv (JDK-8293834)
+- Drop JDK-8292223 patch which we found to be unnecessary
+- Update TestTranslations.java to use public API based on TimeZoneNamesTest upstream
+- The stdc++lib, zlib & freetype options should always be set from the global, so they are not altered for staticlibs builds
+- Remove freetype sources along with zlib sources
+- Resolves: rhbz#2133695
+
+* Tue Oct 04 2022 Andrew Hughes - 1:17.0.5.0.7-0.2.ea
+- Update to jdk-17.0.5+7
+- Update release notes to 17.0.5+7
+- Drop JDK-8288985 patch that is now upstream
+- Resolves: rhbz#2130617
+
+* Mon Oct 03 2022 Andrew Hughes - 1:17.0.5.0.1-0.2.ea
+- Update to jdk-17.0.5+1
+- Update release notes to 17.0.5+1
+- Switch to EA mode for 17.0.5 pre-release builds.
+- Bump HarfBuzz bundled version to 4.4.1 following JDK-8289853
+- Bump FreeType bundled version to 2.12.1 following JDK-8290334
+- Related: rhbz#2130617
+
+* Tue Aug 30 2022 Andrew Hughes - 1:17.0.4.1.1-6
+- Backport JDK-8288985 to enable use of ChaCha20-Poly1305 with the PKCS11 provider
+- Upstream backport in progress: https://github.com/openjdk/jdk17u-dev/pull/650
+- Resolves: rhbz#2006351
+
+* Tue Aug 30 2022 Andrew Hughes - 1:17.0.4.1.1-5
+- Switch to static builds, reducing system dependencies and making build more portable
+- Resolves: rhbz#2121263
+
+* Mon Aug 29 2022 Stephan Bergmann - 1:17.0.4.1.1-4
+- Fix flatpak builds (catering for their uncompressed manual pages)
+- Fix flatpak builds by exempting them from bootstrap
+- Resolves: rhbz#2102734
+
+* Mon Aug 29 2022 Andrew Hughes - 1:17.0.4.1.1-3
+- Update FIPS support to bring in latest changes
+- * RH2104724: Avoid import/export of DH private keys
+- * RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode
+- * Build the systemconf library on all platforms
+- * RH2048582: Support PKCS#12 keystores
+- * RH2020290: Support TLS 1.3 in FIPS mode
+- Resolves: rhbz#2104724
+- Resolves: rhbz#2092507
+- Resolves: rhbz#2048582
+- Resolves: rhbz#2020290
+
+* Sun Aug 21 2022 Andrew Hughes - 1:17.0.4.1.1-2
+- Update to jdk-17.0.4.1+1
+- Update release notes to 17.0.4.1+1
+- Add patch to provide translations for Europe/Kyiv added in tzdata2022b
+- Add test to ensure timezones can be translated
+- Resolves: rhbz#2119531
+
+* Fri Jul 22 2022 Andrew Hughes - 1:17.0.4.0.8-3
+- Update to jdk-17.0.4.0+8
+- Update release notes to 17.0.4.0+8
+- Switch to GA mode for release
+- Resolves: rhbz#2106522
+
+* Wed Jul 20 2022 Andrew Hughes - 1:17.0.4.0.7-0.2.ea
+- Revert the following changes until copy-java-configs has adapted to relative symlinks:
+- * Move cacerts replacement to install section and retain original of this and tzdb.dat
+- * Run tests on the installed image, rather than the build image
+- * Introduce variables to refer to the static library installation directories
+- * Use relative symlinks so they work within the image
+- * Run debug symbols check during build stage, before the install strips them
+- The move of turning on system security properties is retained so we don't ship with them off
+- Related: rhbz#2100674
+
+* Wed Jul 20 2022 Jiri Vanek - 1:17.0.4.0.7-0.2.ea
+- retutrned absolute symlinks
+- relative symlinks are breaking cjc, and deeper investigations are necessary
+-- why cjc intentionally skips relative symllinks
+- images have to be workarounded differently
+- Related: rhbz#2100674
+
+* Sat Jul 16 2022 Andrew Hughes - 1:17.0.4.0.7-0.1.ea
+- Update to jdk-17.0.4.0+7
+- Update release notes to 17.0.4.0+7
+- Switch to EA mode for 17.0.4 pre-release builds.
+- Need to include the '.S' suffix in debuginfo checks after JDK-8284661
+- Print release file during build, which should now include a correct SOURCE value from .src-rev
+- Update tarball script with IcedTea GitHub URL and .src-rev generation
+- Include script to generate bug list for release notes
+- Update tzdata requirement to 2022a to match JDK-8283350
+- Move EA designator check to prep so failures can be caught earlier
+- Make EA designator check non-fatal while upstream is not maintaining it
+- Explicitly require crypto-policies during build and runtime for system security properties
+- Make use of the vendor version string to store our version & release rather than an upstream release date
+- Include a test in the RPM to check the build has the correct vendor information.
+- Resolves: rhbz#2083316
+
+* Thu Jul 14 2022 Jayashree Huttanagoudar - 1:17.0.4.0.1-0.2.ea
+- Fix issue where CheckVendor.java test erroneously passes when it should fail.
+- Add proper quoting so '&' is not treated as a special character by the shell.
+- Related: rhbz#2083316
+
+* Fri Jul 08 2022 Andrew Hughes - 1:17.0.3.0.7-6
+- Fix whitespace in spec file
+- Related: rhbz#2100674
+
+* Fri Jul 08 2022 Andrew Hughes - 1:17.0.3.0.7-6
+- Sequence spec file sections as they are run by rpmbuild (build, install then test)
+- Related: rhbz#2100674
+
+* Fri Jul 08 2022 Andrew Hughes - 1:17.0.3.0.7-6
+- Turn on system security properties as part of the build's install section
+- Move cacerts replacement to install section and retain original of this and tzdb.dat
+- Run tests on the installed image, rather than the build image
+- Introduce variables to refer to the static library installation directories
+- Use relative symlinks so they work within the image
+- Run debug symbols check during build stage, before the install strips them
+- Related: rhbz#2100674
+
+* Thu Jun 30 2022 Francisco Ferrari Bihurriet - 1:17.0.3.0.7-5
+- RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode
+- Resolves: rhbz#2007331
+
+* Tue Jun 28 2022 Andrew Hughes - 1:17.0.3.0.7-4
+- Update FIPS support to bring in latest changes
+- * RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
+- * RH2090378: Revert to disabling system security properties and FIPS mode support together
+- Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
+- Enable system security properties in the RPM (now disabled by default in the FIPS repo)
+- Improve security properties test to check both enabled and disabled behaviour
+- Run security properties test with property debugging on
+- Resolves: rhbz#2099840
+- Resolves: rhbz#2100674
+
+* Tue Jun 28 2022 Andrew Hughes - 1:17.0.3.0.7-3
+- Add rpminspect.yaml to turn off Java bytecode inspections
+- java-17-openjdk deliberately produces Java 17 bytecode, not the default Java 11 bytecode
+- Resolves: rhbz#2101524
+
+* Sun Jun 12 2022 Andrew Hughes - 1:17.0.3.0.7-2
+- Rebase FIPS patches from fips-17u branch and simplify by using a single patch from that repository
+- Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
+- RH2023467: Enable FIPS keys export
+- RH2094027: SunEC runtime permission for FIPS
+- Resolves: rhbz#2023467
+- Resolves: rhbz#2094027
+
* Wed Apr 20 2022 Andrew Hughes - 1:17.0.3.0.7-1
- April 2022 security update to jdk 17.0.3+7
- Update to jdk-17.0.3.0+7 release tarball