Incorporate new FIPS patch for 25u
Resolves: RHEL-133743
This commit is contained in:
Andrew Hughes
parent
b7cd857474
commit
b348c5ceff
92
fips-25u-df044414ef4.patch
Normal file
92
fips-25u-df044414ef4.patch
Normal file
@ -0,0 +1,92 @@
|
||||
diff --git a/src/java.base/share/classes/java/security/Provider.java b/src/java.base/share/classes/java/security/Provider.java
|
||||
index de2845fb550..b1e416b90f4 100644
|
||||
--- a/src/java.base/share/classes/java/security/Provider.java
|
||||
+++ b/src/java.base/share/classes/java/security/Provider.java
|
||||
@@ -1203,6 +1203,39 @@ public Set<Service> getServices() {
|
||||
return serviceSet;
|
||||
}
|
||||
|
||||
+ /* vvvvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvvvv */
|
||||
+ private static final class RedHatFIPSFilter {
|
||||
+ static final boolean IS_ON = Boolean.parseBoolean(
|
||||
+ Security.getProperty("__redhat_fips_filter__"));
|
||||
+ private static final Set<String> ANY_SERVICE_TYPE = Set.of();
|
||||
+ private static final Map<String, Set<String>> ALLOW_LIST = Map.of(
|
||||
+ "SunPKCS11-FIPS", ANY_SERVICE_TYPE,
|
||||
+ "SUN", Set.of(
|
||||
+ "AlgorithmParameterGenerator",
|
||||
+ "AlgorithmParameters", "CertificateFactory",
|
||||
+ "CertPathBuilder", "CertPathValidator", "CertStore",
|
||||
+ "Configuration", "KeyStore"),
|
||||
+ "SunEC", Set.of(
|
||||
+ "AlgorithmParameters", "KeyFactory"),
|
||||
+ "SunJSSE", ANY_SERVICE_TYPE,
|
||||
+ "SunJCE", Set.of(
|
||||
+ "AlgorithmParameters",
|
||||
+ "AlgorithmParameterGenerator", "KeyFactory",
|
||||
+ "SecretKeyFactory"),
|
||||
+ "SunRsaSign", Set.of(
|
||||
+ "KeyFactory", "AlgorithmParameters"),
|
||||
+ "XMLDSig", ANY_SERVICE_TYPE
|
||||
+ );
|
||||
+
|
||||
+ static boolean isAllowed(String provName, String serviceType) {
|
||||
+ Set<String> allowedServiceTypes = ALLOW_LIST.get(provName);
|
||||
+ return allowedServiceTypes != null &&
|
||||
+ (allowedServiceTypes == ANY_SERVICE_TYPE ||
|
||||
+ allowedServiceTypes.contains(serviceType));
|
||||
+ }
|
||||
+ }
|
||||
+ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
|
||||
+
|
||||
/**
|
||||
* Add a service. If a service of the same type with the same algorithm
|
||||
* name exists, and it was added using {@link #putService putService()},
|
||||
@@ -1231,6 +1264,15 @@ protected void putService(Service s) {
|
||||
("service.getProvider() must match this Provider object");
|
||||
}
|
||||
String type = s.getType();
|
||||
+ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
|
||||
+ if (RedHatFIPSFilter.IS_ON && !RedHatFIPSFilter.isAllowed(name, type)) {
|
||||
+ if (debug != null) {
|
||||
+ debug.println("The previous " + name + ".putService() call " +
|
||||
+ "was skipped by " + RedHatFIPSFilter.class.getName());
|
||||
+ }
|
||||
+ return;
|
||||
+ }
|
||||
+ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
|
||||
String algorithm = s.getAlgorithm();
|
||||
ServiceKey key = new ServiceKey(type, algorithm, true);
|
||||
implRemoveService(serviceMap.get(key));
|
||||
diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java
|
||||
index 6969fe8a8e1..4501d5971c4 100644
|
||||
--- a/src/java.base/share/classes/java/security/Security.java
|
||||
+++ b/src/java.base/share/classes/java/security/Security.java
|
||||
@@ -323,7 +323,27 @@ public Properties getInitialProperties() {
|
||||
}
|
||||
|
||||
private static void initialize() {
|
||||
+ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
|
||||
+ /* This 'include'-directives-only magic property is an internal */
|
||||
+ /* implementation detail that could (and probably will!) change. */
|
||||
+ /* Red Hat customers should NOT rely on this for their own use. */
|
||||
+ String fipsKernelFlag = "/proc/sys/crypto/fips_enabled";
|
||||
+ boolean fipsModeOn;
|
||||
+ try (InputStream is = new java.io.FileInputStream(fipsKernelFlag)) {
|
||||
+ fipsModeOn = is.read() == '1';
|
||||
+ } catch (IOException ioe) {
|
||||
+ fipsModeOn = false;
|
||||
+ if (sdebug != null) {
|
||||
+ sdebug.println("Failed to read FIPS kernel file: " + ioe);
|
||||
+ }
|
||||
+ }
|
||||
+ String fipsMagicPropName = "__redhat_fips__";
|
||||
+ System.setProperty(fipsMagicPropName, "" + fipsModeOn);
|
||||
+ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
|
||||
SecPropLoader.loadAll();
|
||||
+ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
|
||||
+ System.clearProperty(fipsMagicPropName);
|
||||
+ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
|
||||
initialSecurityProperties = (Properties) props.clone();
|
||||
if (sdebug != null) {
|
||||
for (String key : props.stringPropertyNames()) {
|
||||
@ -352,7 +352,7 @@
|
||||
# Define IcedTea version used for SystemTap tapsets and desktop file
|
||||
%global icedteaver 6.0.0pre00-c848b93a8598
|
||||
# Define current Git revision for the crypto policy & FIPS support patches
|
||||
%global fipsver 9203d50836c
|
||||
%global fipsver df044414ef4
|
||||
# Define nssadapter variables
|
||||
%global nssadapter_version 0.1.0
|
||||
%global nssadapter_name nssadapter-%{nssadapter_version}
|
||||
@ -381,7 +381,7 @@
|
||||
%global buildver 8
|
||||
%global rpmrelease 2
|
||||
# Settings used by the portable build
|
||||
%global portablerelease 1
|
||||
%global portablerelease 2
|
||||
# Portable suffix differs between RHEL and CentOS
|
||||
%if 0%{?centos} == 0
|
||||
%global portablerhel %{?pkgos:7_9}%{!?pkgos:8}
|
||||
@ -1403,7 +1403,7 @@ Source32: create-redhat-properties-files.bash
|
||||
|
||||
# Crypto policy and FIPS support patches
|
||||
# Patch is generated from the fips-25u tree at https://github.com/rh-openjdk/jdk/tree/fips-25u
|
||||
# as follows: git diff %%{vcstag} src make test > fips-21u-$(git show -s --format=%h HEAD).patch
|
||||
# as follows: git diff %%{vcstag} src make test > fips-25u-$(git show -s --format=%h HEAD).patch
|
||||
# Diff is limited to src and make subdirectories to exclude .github changes
|
||||
# Fixes currently included:
|
||||
# PR3183, RH1340845: Follow system wide crypto policy
|
||||
@ -1437,7 +1437,7 @@ Source32: create-redhat-properties-files.bash
|
||||
# test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
|
||||
# RH1940064: Enable XML Signature provider in FIPS mode
|
||||
# RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream]
|
||||
# Disabled until 25: Patch1001: fips-%{featurever}u-%{fipsver}.patch
|
||||
Patch1001: fips-%{featurever}u-%{fipsver}.patch
|
||||
|
||||
#############################################
|
||||
#
|
||||
@ -1986,8 +1986,7 @@ sh %{SOURCE12} %{top_level_dir_name}
|
||||
# rpmbuild.
|
||||
pushd %{top_level_dir_name}
|
||||
# Add crypto policy and FIPS support
|
||||
# Disabled until 25
|
||||
#%patch -P1001 -p1
|
||||
%patch -P1001 -p1
|
||||
popd # openjdk
|
||||
|
||||
# Patch NSS adapter
|
||||
@ -2662,6 +2661,10 @@ exit 0
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Mon Dec 08 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.1.0.8-2
|
||||
- Incorporate new FIPS patch for 25u
|
||||
- Resolves: RHEL-133743
|
||||
|
||||
* Mon Dec 08 2025 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:25.0.1.0.8-2
|
||||
- Add java-25-openjdk-crypto-adapter subpackage
|
||||
- Update library setting in create-redhat-properties-files.bash
|
||||
|
||||
Loading…
Reference in New Issue
Block a user