b267c4cf63
- Update to jdk-17+35, also known as jdk-17-ga. - Remove boot JDKs in favour of OpenJDK 17 build now in the buildroot. - Update buildjdkver to 17 so as to build with itself - Add possibility to disable system crypto policy - Add PR3695 to allow the system crypto policy to be turned off - Re-enable TestSecurityProperties after inclusion of PR3695 - Added gating.yaml - Fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch - Use the "reverse" build loop (debug first) as the main and only build loop to get more diagnostics. - Remove restriction on disabling product build, as debug packages no longer have javadoc packages. - Update to jdk-17+33, including JDWP fix and July 2021 CPU - Support the FIPS mode crypto policy (RH1655466) - Update RH1655466 FIPS patch with changes in OpenJDK 8 version. - SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the name in the config file. - Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with nss.cfg. - No need to substitute path to nss.fips.cfg as java.security file supports a java.home variable. - Disable FIPS mode support unless com.redhat.fips is set to "true". - Use appropriate keystore types when in FIPS mode (RH1818909) - Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to disable). - Disable TLSv1.3 when the FIPS crypto policy and the NSS-FIPS provider are in use (RH1860986) - Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode - Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs (RH1915071) - Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library. - Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled in configure. - Remove unneeded Requires on NSS as it will now be dynamically linked and detected by RPM. - Add patch to disable non-FIPS crypto in the SUN and SunEC security providers. - Add patch to login to the NSS software token when in FIPS mode. - Fix unused function compiler warning found in systemconf.c - Extend the default security policy to accomodate PKCS11 accessing jdk.internal.access. - Add JDK-8272332 fix so we actually link against HarfBuzz. - Update release notes to document the major changes between OpenJDK 11 & 17. - Add FIPS patch to allow plain key import. - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false - Patch syslookup.c so it actually has some code to be compiled into libsyslookup - alternatives creation moved to posttrans - Set LTS designator on RHEL, but not Fedora or EPEL. Related: RHEL-45216
66 lines
2.9 KiB
Diff
66 lines
2.9 KiB
Diff
commit 93c9f6330bf2b4405c789bf893a5256c3f4a4923
|
|
Author: Martin Balao <mbalao@redhat.com>
|
|
Date: Sat Aug 28 00:35:44 2021 +0100
|
|
|
|
RH1996182: Login to the NSS Software Token in FIPS Mode
|
|
|
|
diff --git openjdk.orig/src/java.base/share/classes/module-info.java openjdk/src/java.base/share/classes/module-info.java
|
|
index 39e69362458..aeb5fc2eb46 100644
|
|
--- openjdk.orig/src/java.base/share/classes/module-info.java
|
|
+++ openjdk/src/java.base/share/classes/module-info.java
|
|
@@ -151,6 +151,7 @@ module java.base {
|
|
java.management,
|
|
java.naming,
|
|
java.rmi,
|
|
+ jdk.crypto.cryptoki,
|
|
jdk.crypto.ec,
|
|
jdk.jartool,
|
|
jdk.jlink,
|
|
diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
|
|
index 112b639aa96..5d3963ea893 100644
|
|
--- openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
|
|
+++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
|
|
@@ -42,6 +42,7 @@ import javax.security.auth.callback.PasswordCallback;
|
|
|
|
import com.sun.crypto.provider.ChaCha20Poly1305Parameters;
|
|
|
|
+import jdk.internal.access.SharedSecrets;
|
|
import jdk.internal.misc.InnocuousThread;
|
|
import sun.security.util.Debug;
|
|
import sun.security.util.ResourcesMgr;
|
|
@@ -62,6 +63,9 @@ import static sun.security.pkcs11.wrapper.PKCS11Exception.*;
|
|
*/
|
|
public final class SunPKCS11 extends AuthProvider {
|
|
|
|
+ private static final boolean systemFipsEnabled = SharedSecrets
|
|
+ .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled();
|
|
+
|
|
private static final long serialVersionUID = -1354835039035306505L;
|
|
|
|
static final Debug debug = Debug.getInstance("sunpkcs11");
|
|
@@ -379,6 +383,24 @@ public final class SunPKCS11 extends AuthProvider {
|
|
if (nssModule != null) {
|
|
nssModule.setProvider(this);
|
|
}
|
|
+ if (systemFipsEnabled) {
|
|
+ // The NSS Software Token in FIPS 140-2 mode requires a user
|
|
+ // login for most operations. See sftk_fipsCheck. The NSS DB
|
|
+ // (/etc/pki/nssdb) PIN is empty.
|
|
+ Session session = null;
|
|
+ try {
|
|
+ session = token.getOpSession();
|
|
+ p11.C_Login(session.id(), CKU_USER, new char[] {});
|
|
+ } catch (PKCS11Exception p11e) {
|
|
+ if (debug != null) {
|
|
+ debug.println("Error during token login: " +
|
|
+ p11e.getMessage());
|
|
+ }
|
|
+ throw p11e;
|
|
+ } finally {
|
|
+ token.releaseSession(session);
|
|
+ }
|
|
+ }
|
|
} catch (Exception e) {
|
|
if (config.getHandleStartupErrors() == Config.ERR_IGNORE_ALL) {
|
|
throw new UnsupportedOperationException
|