0e6069cde3
Backport FIPS mode patch to java-1.8.0-openjdk, simplifying provider removal.
nss.fips.cfg needs to be moved to %%{etcjavadir} and symlinked into the JDK, like nss.cfg
SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the name in the config file.
Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with nss.cfg.
Disable FIPS mode support unless com.redhat.fips is set to "true".
Add JDK-8195607/PR3776 to support NSS SQLite databases.
Use appropriate keystore types when in FIPS mode (RH1760838)
Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to disable).
Disable TLSv1.3 when using the NSS-FIPS provider (RH1860986)
Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs (RH1906862)
Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode
126 lines
5.2 KiB
Diff
126 lines
5.2 KiB
Diff
# HG changeset patch
|
|
# User mbalao
|
|
# Date 1529971845 -28800
|
|
# Tue Jun 26 08:10:45 2018 +0800
|
|
# Node ID e9c20b7250cd98d16a67f2a30b34284c2caa01dc
|
|
# Parent 9f1aa2e38d90dd60522237d7414af6bdcf03c4ff
|
|
8195607, PR3776: sun/security/pkcs11/Secmod/TestNssDbSqlite.java failed with "NSS initialization failed" on NSS 3.34.1
|
|
Reviewed-by: valeriep, weijun
|
|
|
|
diff --git openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/Secmod.java openjdk/jdk/src/share/classes/sun/security/pkcs11/Secmod.java
|
|
--- openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/Secmod.java
|
|
+++ openjdk/jdk/src/share/classes/sun/security/pkcs11/Secmod.java
|
|
@@ -197,7 +197,7 @@
|
|
|
|
if (configDir != null) {
|
|
String configDirPath = null;
|
|
- String sqlPrefix = "sql:/";
|
|
+ String sqlPrefix = "sql:";
|
|
if (!configDir.startsWith(sqlPrefix)) {
|
|
configDirPath = configDir;
|
|
} else {
|
|
diff --git openjdk.orig/jdk/src/share/native/sun/security/pkcs11/j2secmod.c openjdk/jdk/src/share/native/sun/security/pkcs11/j2secmod.c
|
|
--- openjdk.orig/jdk/src/share/native/sun/security/pkcs11/j2secmod.c
|
|
+++ openjdk/jdk/src/share/native/sun/security/pkcs11/j2secmod.c
|
|
@@ -69,9 +69,14 @@
|
|
int res = 0;
|
|
FPTR_Initialize initialize =
|
|
(FPTR_Initialize)findFunction(env, jHandle, "NSS_Initialize");
|
|
+ #ifdef SECMOD_DEBUG
|
|
+ FPTR_GetError getError =
|
|
+ (FPTR_GetError)findFunction(env, jHandle, "PORT_GetError");
|
|
+ #endif // SECMOD_DEBUG
|
|
unsigned int flags = 0x00;
|
|
const char *configDir = NULL;
|
|
const char *functionName = NULL;
|
|
+ const char *configFile = NULL;
|
|
|
|
/* If we cannot initialize, exit now */
|
|
if (initialize == NULL) {
|
|
@@ -97,13 +102,18 @@
|
|
flags = 0x20; // NSS_INIT_OPTIMIZESPACE flag
|
|
}
|
|
|
|
+ configFile = "secmod.db";
|
|
+ if (configDir != NULL && strncmp("sql:", configDir, 4U) == 0) {
|
|
+ configFile = "pkcs11.txt";
|
|
+ }
|
|
+
|
|
/*
|
|
* If the NSS_Init function is requested then call NSS_Initialize to
|
|
* open the Cert, Key and Security Module databases, read only.
|
|
*/
|
|
if (strcmp("NSS_Init", functionName) == 0) {
|
|
flags = flags | 0x01; // NSS_INIT_READONLY flag
|
|
- res = initialize(configDir, "", "", "secmod.db", flags);
|
|
+ res = initialize(configDir, "", "", configFile, flags);
|
|
|
|
/*
|
|
* If the NSS_InitReadWrite function is requested then call
|
|
@@ -111,7 +121,7 @@
|
|
* read/write.
|
|
*/
|
|
} else if (strcmp("NSS_InitReadWrite", functionName) == 0) {
|
|
- res = initialize(configDir, "", "", "secmod.db", flags);
|
|
+ res = initialize(configDir, "", "", configFile, flags);
|
|
|
|
/*
|
|
* If the NSS_NoDB_Init function is requested then call
|
|
@@ -137,6 +147,13 @@
|
|
(*env)->ReleaseStringUTFChars(env, jConfigDir, configDir);
|
|
}
|
|
dprintf1("-res: %d\n", res);
|
|
+ #ifdef SECMOD_DEBUG
|
|
+ if (res == -1) {
|
|
+ if (getError != NULL) {
|
|
+ dprintf1("-NSS error: %d\n", getError());
|
|
+ }
|
|
+ }
|
|
+ #endif // SECMOD_DEBUG
|
|
|
|
return (res == 0) ? JNI_TRUE : JNI_FALSE;
|
|
}
|
|
diff --git openjdk.orig/jdk/src/solaris/native/sun/security/pkcs11/j2secmod_md.h openjdk/jdk/src/solaris/native/sun/security/pkcs11/j2secmod_md.h
|
|
--- openjdk.orig/jdk/src/solaris/native/sun/security/pkcs11/j2secmod_md.h
|
|
+++ openjdk/jdk/src/solaris/native/sun/security/pkcs11/j2secmod_md.h
|
|
@@ -34,6 +34,10 @@
|
|
const char *certPrefix, const char *keyPrefix,
|
|
const char *secmodName, unsigned int flags);
|
|
|
|
+#ifdef SECMOD_DEBUG
|
|
+typedef int (*FPTR_GetError)(void);
|
|
+#endif //SECMOD_DEBUG
|
|
+
|
|
// in secmod.h
|
|
//extern SECMODModule *SECMOD_LoadModule(char *moduleSpec,SECMODModule *parent,
|
|
// PRBool recurse);
|
|
diff --git openjdk.orig/jdk/test/sun/security/pkcs11/Secmod/pkcs11.txt openjdk/jdk/test/sun/security/pkcs11/Secmod/pkcs11.txt
|
|
new file mode 100644
|
|
--- /dev/null
|
|
+++ openjdk/jdk/test/sun/security/pkcs11/Secmod/pkcs11.txt
|
|
@@ -0,0 +1,4 @@
|
|
+library=
|
|
+name=NSS Internal PKCS #11 Module
|
|
+parameters=configdir='sql:./tmpdb' certPrefix='' keyPrefix='' secmod='' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription=''
|
|
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
|
|
diff --git openjdk.orig/jdk/test/sun/security/pkcs11/SecmodTest.java openjdk/jdk/test/sun/security/pkcs11/SecmodTest.java
|
|
--- openjdk.orig/jdk/test/sun/security/pkcs11/SecmodTest.java
|
|
+++ openjdk/jdk/test/sun/security/pkcs11/SecmodTest.java
|
|
@@ -55,7 +55,7 @@
|
|
|
|
DBDIR = System.getProperty("test.classes", ".") + SEP + "tmpdb";
|
|
if (useSqlite) {
|
|
- System.setProperty("pkcs11test.nss.db", "sql:/" + DBDIR);
|
|
+ System.setProperty("pkcs11test.nss.db", "sql:" + DBDIR);
|
|
} else {
|
|
System.setProperty("pkcs11test.nss.db", DBDIR);
|
|
}
|
|
@@ -67,6 +67,7 @@
|
|
if (useSqlite) {
|
|
copyFile("key4.db", BASE, DBDIR);
|
|
copyFile("cert9.db", BASE, DBDIR);
|
|
+ copyFile("pkcs11.txt", BASE, DBDIR);
|
|
} else {
|
|
copyFile("secmod.db", BASE, DBDIR);
|
|
copyFile("key3.db", BASE, DBDIR);
|