diff --git openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java index f9baf8c9742..60fa75cab45 100644 --- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java @@ -1,11 +1,13 @@ /* - * Copyright (c) 2019, Red Hat, Inc. + * Copyright (c) 2019, 2020, Red Hat, Inc. * * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License version 2 only, as - * published by the Free Software Foundation. + * published by the Free Software Foundation. Oracle designates this + * particular file as subject to the "Classpath" exception as provided + * by Oracle in the LICENSE file that accompanied this code. * * This code is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or @@ -34,10 +36,10 @@ import java.nio.file.Path; import java.util.Iterator; import java.util.Map.Entry; import java.util.Properties; -import java.util.function.Consumer; -import java.util.regex.Matcher; import java.util.regex.Pattern; +import jdk.internal.access.JavaSecuritySystemConfiguratorAccess; +import jdk.internal.access.SharedSecrets; import sun.security.util.Debug; /** @@ -47,7 +49,7 @@ import sun.security.util.Debug; * */ -class SystemConfigurator { +final class SystemConfigurator { private static final Debug sdebug = Debug.getInstance("properties"); @@ -61,15 +63,16 @@ class SystemConfigurator { private static final String CRYPTO_POLICIES_CONFIG = CRYPTO_POLICIES_BASE_DIR + "/config"; - private static final class SecurityProviderInfo { - int number; - String key; - String value; - SecurityProviderInfo(int number, String key, String value) { - this.number = number; - this.key = key; - this.value = value; - } + private static boolean systemFipsEnabled = false; + + static { + SharedSecrets.setJavaSecuritySystemConfiguratorAccess( + new JavaSecuritySystemConfiguratorAccess() { + @Override + public boolean isSystemFipsEnabled() { + return SystemConfigurator.isSystemFipsEnabled(); + } + }); } /* @@ -128,9 +131,9 @@ class SystemConfigurator { String nonFipsKeystoreType = props.getProperty("keystore.type"); props.put("keystore.type", keystoreTypeValue); if (keystoreTypeValue.equals("PKCS11")) { - // If keystore.type is PKCS11, javax.net.ssl.keyStore - // must be "NONE". See JDK-8238264. - System.setProperty("javax.net.ssl.keyStore", "NONE"); + // If keystore.type is PKCS11, javax.net.ssl.keyStore + // must be "NONE". See JDK-8238264. + System.setProperty("javax.net.ssl.keyStore", "NONE"); } if (System.getProperty("javax.net.ssl.trustStoreType") == null) { // If no trustStoreType has been set, use the @@ -144,12 +147,13 @@ class SystemConfigurator { sdebug.println("FIPS mode default keystore.type = " + keystoreTypeValue); sdebug.println("FIPS mode javax.net.ssl.keyStore = " + - System.getProperty("javax.net.ssl.keyStore", "")); + System.getProperty("javax.net.ssl.keyStore", "")); sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " + System.getProperty("javax.net.ssl.trustStoreType", "")); } } loadedProps = true; + systemFipsEnabled = true; } } catch (Exception e) { if (sdebug != null) { @@ -160,13 +164,30 @@ class SystemConfigurator { return loadedProps; } + /** + * Returns whether or not global system FIPS alignment is enabled. + * + * Value is always 'false' before java.security.Security class is + * initialized. + * + * Call from out of this package through SharedSecrets: + * SharedSecrets.getJavaSecuritySystemConfiguratorAccess() + * .isSystemFipsEnabled(); + * + * @return a boolean value indicating whether or not global + * system FIPS alignment is enabled. + */ + static boolean isSystemFipsEnabled() { + return systemFipsEnabled; + } + /* * FIPS is enabled only if crypto-policies are set to "FIPS" * and the com.redhat.fips property is true. */ private static boolean enableFips() throws Exception { - boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips", "true")); - if (fipsEnabled) { + boolean shouldEnable = Boolean.valueOf(System.getProperty("com.redhat.fips", "true")); + if (shouldEnable) { String cryptoPoliciesConfig = new String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG))); if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); } Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE); diff --git openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java new file mode 100644 index 00000000000..a31e93ec02e --- /dev/null +++ openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java @@ -0,0 +1,30 @@ +/* + * Copyright (c) 2020, Red Hat, Inc. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. Oracle designates this + * particular file as subject to the "Classpath" exception as provided + * by Oracle in the LICENSE file that accompanied this code. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +package jdk.internal.access; + +public interface JavaSecuritySystemConfiguratorAccess { + boolean isSystemFipsEnabled(); +} diff --git openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java index f6d3638c3dd..5a2c9eb0c46 100644 --- openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java +++ openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java @@ -81,6 +81,7 @@ public class SharedSecrets { private static JavaSecuritySpecAccess javaSecuritySpecAccess; private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess; private static JavaxCryptoSpecAccess javaxCryptoSpecAccess; + private static JavaSecuritySystemConfiguratorAccess javaSecuritySystemConfiguratorAccess; public static void setJavaUtilCollectionAccess(JavaUtilCollectionAccess juca) { javaUtilCollectionAccess = juca; @@ -442,4 +443,12 @@ public class SharedSecrets { MethodHandles.lookup().ensureInitialized(c); } catch (IllegalAccessException e) {} } + + public static void setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) { + javaSecuritySystemConfiguratorAccess = jssca; + } + + public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() { + return javaSecuritySystemConfiguratorAccess; + } } diff --git openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java index 6ffdfeda18d..775b185fb06 100644 --- openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java +++ openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java @@ -32,6 +32,7 @@ import java.security.cert.*; import java.util.*; import java.util.concurrent.locks.ReentrantLock; import javax.net.ssl.*; +import jdk.internal.access.SharedSecrets; import sun.security.action.GetPropertyAction; import sun.security.provider.certpath.AlgorithmChecker; import sun.security.validator.Validator; @@ -536,22 +537,40 @@ public abstract class SSLContextImpl extends SSLContextSpi { private static final List serverDefaultCipherSuites; static { - supportedProtocols = Arrays.asList( - ProtocolVersion.TLS13, - ProtocolVersion.TLS12, - ProtocolVersion.TLS11, - ProtocolVersion.TLS10, - ProtocolVersion.SSL30, - ProtocolVersion.SSL20Hello - ); - - serverDefaultProtocols = getAvailableProtocols( - new ProtocolVersion[] { - ProtocolVersion.TLS13, - ProtocolVersion.TLS12, - ProtocolVersion.TLS11, - ProtocolVersion.TLS10 - }); + if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess() + .isSystemFipsEnabled()) { + // RH1860986: TLSv1.3 key derivation not supported with + // the Security Providers available in system FIPS mode. + supportedProtocols = Arrays.asList( + ProtocolVersion.TLS12, + ProtocolVersion.TLS11, + ProtocolVersion.TLS10 + ); + + serverDefaultProtocols = getAvailableProtocols( + new ProtocolVersion[] { + ProtocolVersion.TLS12, + ProtocolVersion.TLS11, + ProtocolVersion.TLS10 + }); + } else { + supportedProtocols = Arrays.asList( + ProtocolVersion.TLS13, + ProtocolVersion.TLS12, + ProtocolVersion.TLS11, + ProtocolVersion.TLS10, + ProtocolVersion.SSL30, + ProtocolVersion.SSL20Hello + ); + + serverDefaultProtocols = getAvailableProtocols( + new ProtocolVersion[] { + ProtocolVersion.TLS13, + ProtocolVersion.TLS12, + ProtocolVersion.TLS11, + ProtocolVersion.TLS10 + }); + } supportedCipherSuites = getApplicableSupportedCipherSuites( supportedProtocols); @@ -842,12 +861,23 @@ public abstract class SSLContextImpl extends SSLContextSpi { ProtocolVersion[] candidates; if (refactored.isEmpty()) { // Client and server use the same default protocols. - candidates = new ProtocolVersion[] { - ProtocolVersion.TLS13, - ProtocolVersion.TLS12, - ProtocolVersion.TLS11, - ProtocolVersion.TLS10 - }; + if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess() + .isSystemFipsEnabled()) { + // RH1860986: TLSv1.3 key derivation not supported with + // the Security Providers available in system FIPS mode. + candidates = new ProtocolVersion[] { + ProtocolVersion.TLS12, + ProtocolVersion.TLS11, + ProtocolVersion.TLS10 + }; + } else { + candidates = new ProtocolVersion[] { + ProtocolVersion.TLS13, + ProtocolVersion.TLS12, + ProtocolVersion.TLS11, + ProtocolVersion.TLS10 + }; + } } else { // Use the customized TLS protocols. candidates = diff --git openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java index 894e26dfad8..8b16378b96b 100644 --- openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java +++ openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java @@ -27,6 +27,8 @@ package sun.security.ssl; import java.security.*; import java.util.*; + +import jdk.internal.access.SharedSecrets; import static sun.security.util.SecurityConstants.PROVIDER_VER; /** @@ -102,8 +104,13 @@ public class SunJSSE extends java.security.Provider { "sun.security.ssl.SSLContextImpl$TLS11Context", null, null); ps("SSLContext", "TLSv1.2", "sun.security.ssl.SSLContextImpl$TLS12Context", null, null); - ps("SSLContext", "TLSv1.3", - "sun.security.ssl.SSLContextImpl$TLS13Context", null, null); + if (!SharedSecrets.getJavaSecuritySystemConfiguratorAccess() + .isSystemFipsEnabled()) { + // RH1860986: TLSv1.3 key derivation not supported with + // the Security Providers available in system FIPS mode. + ps("SSLContext", "TLSv1.3", + "sun.security.ssl.SSLContextImpl$TLS13Context", null, null); + } ps("SSLContext", "TLS", "sun.security.ssl.SSLContextImpl$TLSContext", List.of("SSL"), null);