b267c4cf63
- Update to jdk-17+35, also known as jdk-17-ga. - Remove boot JDKs in favour of OpenJDK 17 build now in the buildroot. - Update buildjdkver to 17 so as to build with itself - Add possibility to disable system crypto policy - Add PR3695 to allow the system crypto policy to be turned off - Re-enable TestSecurityProperties after inclusion of PR3695 - Added gating.yaml - Fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch - Use the "reverse" build loop (debug first) as the main and only build loop to get more diagnostics. - Remove restriction on disabling product build, as debug packages no longer have javadoc packages. - Update to jdk-17+33, including JDWP fix and July 2021 CPU - Support the FIPS mode crypto policy (RH1655466) - Update RH1655466 FIPS patch with changes in OpenJDK 8 version. - SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the name in the config file. - Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with nss.cfg. - No need to substitute path to nss.fips.cfg as java.security file supports a java.home variable. - Disable FIPS mode support unless com.redhat.fips is set to "true". - Use appropriate keystore types when in FIPS mode (RH1818909) - Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to disable). - Disable TLSv1.3 when the FIPS crypto policy and the NSS-FIPS provider are in use (RH1860986) - Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode - Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs (RH1915071) - Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library. - Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled in configure. - Remove unneeded Requires on NSS as it will now be dynamically linked and detected by RPM. - Add patch to disable non-FIPS crypto in the SUN and SunEC security providers. - Add patch to login to the NSS software token when in FIPS mode. - Fix unused function compiler warning found in systemconf.c - Extend the default security policy to accomodate PKCS11 accessing jdk.internal.access. - Add JDK-8272332 fix so we actually link against HarfBuzz. - Update release notes to document the major changes between OpenJDK 11 & 17. - Add FIPS patch to allow plain key import. - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false - Patch syslookup.c so it actually has some code to be compiled into libsyslookup - alternatives creation moved to posttrans - Set LTS designator on RHEL, but not Fedora or EPEL. Related: RHEL-45216
319 lines
14 KiB
Diff
319 lines
14 KiB
Diff
diff --git openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
|
|
index f9baf8c9742..60fa75cab45 100644
|
|
--- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
|
|
+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
|
|
@@ -1,11 +1,13 @@
|
|
/*
|
|
- * Copyright (c) 2019, Red Hat, Inc.
|
|
+ * Copyright (c) 2019, 2020, Red Hat, Inc.
|
|
*
|
|
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
*
|
|
* This code is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License version 2 only, as
|
|
- * published by the Free Software Foundation.
|
|
+ * published by the Free Software Foundation. Oracle designates this
|
|
+ * particular file as subject to the "Classpath" exception as provided
|
|
+ * by Oracle in the LICENSE file that accompanied this code.
|
|
*
|
|
* This code is distributed in the hope that it will be useful, but WITHOUT
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
@@ -34,10 +36,10 @@ import java.nio.file.Path;
|
|
import java.util.Iterator;
|
|
import java.util.Map.Entry;
|
|
import java.util.Properties;
|
|
-import java.util.function.Consumer;
|
|
-import java.util.regex.Matcher;
|
|
import java.util.regex.Pattern;
|
|
|
|
+import jdk.internal.access.JavaSecuritySystemConfiguratorAccess;
|
|
+import jdk.internal.access.SharedSecrets;
|
|
import sun.security.util.Debug;
|
|
|
|
/**
|
|
@@ -47,7 +49,7 @@ import sun.security.util.Debug;
|
|
*
|
|
*/
|
|
|
|
-class SystemConfigurator {
|
|
+final class SystemConfigurator {
|
|
|
|
private static final Debug sdebug =
|
|
Debug.getInstance("properties");
|
|
@@ -61,15 +63,16 @@ class SystemConfigurator {
|
|
private static final String CRYPTO_POLICIES_CONFIG =
|
|
CRYPTO_POLICIES_BASE_DIR + "/config";
|
|
|
|
- private static final class SecurityProviderInfo {
|
|
- int number;
|
|
- String key;
|
|
- String value;
|
|
- SecurityProviderInfo(int number, String key, String value) {
|
|
- this.number = number;
|
|
- this.key = key;
|
|
- this.value = value;
|
|
- }
|
|
+ private static boolean systemFipsEnabled = false;
|
|
+
|
|
+ static {
|
|
+ SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
|
|
+ new JavaSecuritySystemConfiguratorAccess() {
|
|
+ @Override
|
|
+ public boolean isSystemFipsEnabled() {
|
|
+ return SystemConfigurator.isSystemFipsEnabled();
|
|
+ }
|
|
+ });
|
|
}
|
|
|
|
/*
|
|
@@ -128,9 +131,9 @@ class SystemConfigurator {
|
|
String nonFipsKeystoreType = props.getProperty("keystore.type");
|
|
props.put("keystore.type", keystoreTypeValue);
|
|
if (keystoreTypeValue.equals("PKCS11")) {
|
|
- // If keystore.type is PKCS11, javax.net.ssl.keyStore
|
|
- // must be "NONE". See JDK-8238264.
|
|
- System.setProperty("javax.net.ssl.keyStore", "NONE");
|
|
+ // If keystore.type is PKCS11, javax.net.ssl.keyStore
|
|
+ // must be "NONE". See JDK-8238264.
|
|
+ System.setProperty("javax.net.ssl.keyStore", "NONE");
|
|
}
|
|
if (System.getProperty("javax.net.ssl.trustStoreType") == null) {
|
|
// If no trustStoreType has been set, use the
|
|
@@ -144,12 +147,13 @@ class SystemConfigurator {
|
|
sdebug.println("FIPS mode default keystore.type = " +
|
|
keystoreTypeValue);
|
|
sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
|
|
- System.getProperty("javax.net.ssl.keyStore", ""));
|
|
+ System.getProperty("javax.net.ssl.keyStore", ""));
|
|
sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
|
|
System.getProperty("javax.net.ssl.trustStoreType", ""));
|
|
}
|
|
}
|
|
loadedProps = true;
|
|
+ systemFipsEnabled = true;
|
|
}
|
|
} catch (Exception e) {
|
|
if (sdebug != null) {
|
|
@@ -160,13 +164,30 @@ class SystemConfigurator {
|
|
return loadedProps;
|
|
}
|
|
|
|
+ /**
|
|
+ * Returns whether or not global system FIPS alignment is enabled.
|
|
+ *
|
|
+ * Value is always 'false' before java.security.Security class is
|
|
+ * initialized.
|
|
+ *
|
|
+ * Call from out of this package through SharedSecrets:
|
|
+ * SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
|
|
+ * .isSystemFipsEnabled();
|
|
+ *
|
|
+ * @return a boolean value indicating whether or not global
|
|
+ * system FIPS alignment is enabled.
|
|
+ */
|
|
+ static boolean isSystemFipsEnabled() {
|
|
+ return systemFipsEnabled;
|
|
+ }
|
|
+
|
|
/*
|
|
* FIPS is enabled only if crypto-policies are set to "FIPS"
|
|
* and the com.redhat.fips property is true.
|
|
*/
|
|
private static boolean enableFips() throws Exception {
|
|
- boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
|
|
- if (fipsEnabled) {
|
|
+ boolean shouldEnable = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
|
|
+ if (shouldEnable) {
|
|
String cryptoPoliciesConfig = new String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG)));
|
|
if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); }
|
|
Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
|
|
diff --git openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java
|
|
new file mode 100644
|
|
index 00000000000..a31e93ec02e
|
|
--- /dev/null
|
|
+++ openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java
|
|
@@ -0,0 +1,30 @@
|
|
+/*
|
|
+ * Copyright (c) 2020, Red Hat, Inc.
|
|
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
+ *
|
|
+ * This code is free software; you can redistribute it and/or modify it
|
|
+ * under the terms of the GNU General Public License version 2 only, as
|
|
+ * published by the Free Software Foundation. Oracle designates this
|
|
+ * particular file as subject to the "Classpath" exception as provided
|
|
+ * by Oracle in the LICENSE file that accompanied this code.
|
|
+ *
|
|
+ * This code is distributed in the hope that it will be useful, but WITHOUT
|
|
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
+ * version 2 for more details (a copy is included in the LICENSE file that
|
|
+ * accompanied this code).
|
|
+ *
|
|
+ * You should have received a copy of the GNU General Public License version
|
|
+ * 2 along with this work; if not, write to the Free Software Foundation,
|
|
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
+ *
|
|
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
|
+ * or visit www.oracle.com if you need additional information or have any
|
|
+ * questions.
|
|
+ */
|
|
+
|
|
+package jdk.internal.access;
|
|
+
|
|
+public interface JavaSecuritySystemConfiguratorAccess {
|
|
+ boolean isSystemFipsEnabled();
|
|
+}
|
|
diff --git openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
|
|
index f6d3638c3dd..5a2c9eb0c46 100644
|
|
--- openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
|
|
+++ openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
|
|
@@ -81,6 +81,7 @@ public class SharedSecrets {
|
|
private static JavaSecuritySpecAccess javaSecuritySpecAccess;
|
|
private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess;
|
|
private static JavaxCryptoSpecAccess javaxCryptoSpecAccess;
|
|
+ private static JavaSecuritySystemConfiguratorAccess javaSecuritySystemConfiguratorAccess;
|
|
|
|
public static void setJavaUtilCollectionAccess(JavaUtilCollectionAccess juca) {
|
|
javaUtilCollectionAccess = juca;
|
|
@@ -442,4 +443,12 @@ public class SharedSecrets {
|
|
MethodHandles.lookup().ensureInitialized(c);
|
|
} catch (IllegalAccessException e) {}
|
|
}
|
|
+
|
|
+ public static void setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) {
|
|
+ javaSecuritySystemConfiguratorAccess = jssca;
|
|
+ }
|
|
+
|
|
+ public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() {
|
|
+ return javaSecuritySystemConfiguratorAccess;
|
|
+ }
|
|
}
|
|
diff --git openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java
|
|
index 6ffdfeda18d..775b185fb06 100644
|
|
--- openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java
|
|
+++ openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java
|
|
@@ -32,6 +32,7 @@ import java.security.cert.*;
|
|
import java.util.*;
|
|
import java.util.concurrent.locks.ReentrantLock;
|
|
import javax.net.ssl.*;
|
|
+import jdk.internal.access.SharedSecrets;
|
|
import sun.security.action.GetPropertyAction;
|
|
import sun.security.provider.certpath.AlgorithmChecker;
|
|
import sun.security.validator.Validator;
|
|
@@ -536,22 +537,40 @@ public abstract class SSLContextImpl extends SSLContextSpi {
|
|
private static final List<CipherSuite> serverDefaultCipherSuites;
|
|
|
|
static {
|
|
- supportedProtocols = Arrays.asList(
|
|
- ProtocolVersion.TLS13,
|
|
- ProtocolVersion.TLS12,
|
|
- ProtocolVersion.TLS11,
|
|
- ProtocolVersion.TLS10,
|
|
- ProtocolVersion.SSL30,
|
|
- ProtocolVersion.SSL20Hello
|
|
- );
|
|
-
|
|
- serverDefaultProtocols = getAvailableProtocols(
|
|
- new ProtocolVersion[] {
|
|
- ProtocolVersion.TLS13,
|
|
- ProtocolVersion.TLS12,
|
|
- ProtocolVersion.TLS11,
|
|
- ProtocolVersion.TLS10
|
|
- });
|
|
+ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
|
|
+ .isSystemFipsEnabled()) {
|
|
+ // RH1860986: TLSv1.3 key derivation not supported with
|
|
+ // the Security Providers available in system FIPS mode.
|
|
+ supportedProtocols = Arrays.asList(
|
|
+ ProtocolVersion.TLS12,
|
|
+ ProtocolVersion.TLS11,
|
|
+ ProtocolVersion.TLS10
|
|
+ );
|
|
+
|
|
+ serverDefaultProtocols = getAvailableProtocols(
|
|
+ new ProtocolVersion[] {
|
|
+ ProtocolVersion.TLS12,
|
|
+ ProtocolVersion.TLS11,
|
|
+ ProtocolVersion.TLS10
|
|
+ });
|
|
+ } else {
|
|
+ supportedProtocols = Arrays.asList(
|
|
+ ProtocolVersion.TLS13,
|
|
+ ProtocolVersion.TLS12,
|
|
+ ProtocolVersion.TLS11,
|
|
+ ProtocolVersion.TLS10,
|
|
+ ProtocolVersion.SSL30,
|
|
+ ProtocolVersion.SSL20Hello
|
|
+ );
|
|
+
|
|
+ serverDefaultProtocols = getAvailableProtocols(
|
|
+ new ProtocolVersion[] {
|
|
+ ProtocolVersion.TLS13,
|
|
+ ProtocolVersion.TLS12,
|
|
+ ProtocolVersion.TLS11,
|
|
+ ProtocolVersion.TLS10
|
|
+ });
|
|
+ }
|
|
|
|
supportedCipherSuites = getApplicableSupportedCipherSuites(
|
|
supportedProtocols);
|
|
@@ -842,12 +861,23 @@ public abstract class SSLContextImpl extends SSLContextSpi {
|
|
ProtocolVersion[] candidates;
|
|
if (refactored.isEmpty()) {
|
|
// Client and server use the same default protocols.
|
|
- candidates = new ProtocolVersion[] {
|
|
- ProtocolVersion.TLS13,
|
|
- ProtocolVersion.TLS12,
|
|
- ProtocolVersion.TLS11,
|
|
- ProtocolVersion.TLS10
|
|
- };
|
|
+ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
|
|
+ .isSystemFipsEnabled()) {
|
|
+ // RH1860986: TLSv1.3 key derivation not supported with
|
|
+ // the Security Providers available in system FIPS mode.
|
|
+ candidates = new ProtocolVersion[] {
|
|
+ ProtocolVersion.TLS12,
|
|
+ ProtocolVersion.TLS11,
|
|
+ ProtocolVersion.TLS10
|
|
+ };
|
|
+ } else {
|
|
+ candidates = new ProtocolVersion[] {
|
|
+ ProtocolVersion.TLS13,
|
|
+ ProtocolVersion.TLS12,
|
|
+ ProtocolVersion.TLS11,
|
|
+ ProtocolVersion.TLS10
|
|
+ };
|
|
+ }
|
|
} else {
|
|
// Use the customized TLS protocols.
|
|
candidates =
|
|
diff --git openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java
|
|
index 894e26dfad8..8b16378b96b 100644
|
|
--- openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java
|
|
+++ openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java
|
|
@@ -27,6 +27,8 @@ package sun.security.ssl;
|
|
|
|
import java.security.*;
|
|
import java.util.*;
|
|
+
|
|
+import jdk.internal.access.SharedSecrets;
|
|
import static sun.security.util.SecurityConstants.PROVIDER_VER;
|
|
|
|
/**
|
|
@@ -102,8 +104,13 @@ public class SunJSSE extends java.security.Provider {
|
|
"sun.security.ssl.SSLContextImpl$TLS11Context", null, null);
|
|
ps("SSLContext", "TLSv1.2",
|
|
"sun.security.ssl.SSLContextImpl$TLS12Context", null, null);
|
|
- ps("SSLContext", "TLSv1.3",
|
|
- "sun.security.ssl.SSLContextImpl$TLS13Context", null, null);
|
|
+ if (!SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
|
|
+ .isSystemFipsEnabled()) {
|
|
+ // RH1860986: TLSv1.3 key derivation not supported with
|
|
+ // the Security Providers available in system FIPS mode.
|
|
+ ps("SSLContext", "TLSv1.3",
|
|
+ "sun.security.ssl.SSLContextImpl$TLS13Context", null, null);
|
|
+ }
|
|
ps("SSLContext", "TLS",
|
|
"sun.security.ssl.SSLContextImpl$TLSContext",
|
|
List.of("SSL"), null);
|