Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown
- Fix FIPS issue list to represent the new 25u version Resolves: RHEL-155000
This commit is contained in:
Andrew Hughes
parent
1b0015ae51
commit
b87969b5b6
@ -1,8 +1,8 @@
|
||||
diff --git a/src/java.base/share/classes/java/security/Provider.java b/src/java.base/share/classes/java/security/Provider.java
|
||||
index de2845fb550..b1e416b90f4 100644
|
||||
index de2845fb550..60eeab678ca 100644
|
||||
--- a/src/java.base/share/classes/java/security/Provider.java
|
||||
+++ b/src/java.base/share/classes/java/security/Provider.java
|
||||
@@ -1203,6 +1203,39 @@ public Set<Service> getServices() {
|
||||
@@ -1203,6 +1203,34 @@ public Service getService(String type, String algorithm) {
|
||||
return serviceSet;
|
||||
}
|
||||
|
||||
@ -10,9 +10,7 @@ index de2845fb550..b1e416b90f4 100644
|
||||
+ private static final class RedHatFIPSFilter {
|
||||
+ static final boolean IS_ON = Boolean.parseBoolean(
|
||||
+ Security.getProperty("__redhat_fips_filter__"));
|
||||
+ private static final Set<String> ANY_SERVICE_TYPE = Set.of();
|
||||
+ private static final Map<String, Set<String>> ALLOW_LIST = Map.of(
|
||||
+ "SunPKCS11-FIPS", ANY_SERVICE_TYPE,
|
||||
+ "SUN", Set.of(
|
||||
+ "AlgorithmParameterGenerator",
|
||||
+ "AlgorithmParameters", "CertificateFactory",
|
||||
@ -20,21 +18,18 @@ index de2845fb550..b1e416b90f4 100644
|
||||
+ "Configuration", "KeyStore"),
|
||||
+ "SunEC", Set.of(
|
||||
+ "AlgorithmParameters", "KeyFactory"),
|
||||
+ "SunJSSE", ANY_SERVICE_TYPE,
|
||||
+ "SunJCE", Set.of(
|
||||
+ "AlgorithmParameters",
|
||||
+ "AlgorithmParameterGenerator", "KeyFactory",
|
||||
+ "SecretKeyFactory"),
|
||||
+ "SunRsaSign", Set.of(
|
||||
+ "KeyFactory", "AlgorithmParameters"),
|
||||
+ "XMLDSig", ANY_SERVICE_TYPE
|
||||
+ "KeyFactory", "AlgorithmParameters")
|
||||
+ );
|
||||
+
|
||||
+ static boolean isAllowed(String provName, String serviceType) {
|
||||
+ Set<String> allowedServiceTypes = ALLOW_LIST.get(provName);
|
||||
+ return allowedServiceTypes != null &&
|
||||
+ (allowedServiceTypes == ANY_SERVICE_TYPE ||
|
||||
+ allowedServiceTypes.contains(serviceType));
|
||||
+ return allowedServiceTypes == null ||
|
||||
+ allowedServiceTypes.contains(serviceType);
|
||||
+ }
|
||||
+ }
|
||||
+ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
|
||||
@ -42,7 +37,7 @@ index de2845fb550..b1e416b90f4 100644
|
||||
/**
|
||||
* Add a service. If a service of the same type with the same algorithm
|
||||
* name exists, and it was added using {@link #putService putService()},
|
||||
@@ -1231,6 +1264,15 @@ protected void putService(Service s) {
|
||||
@@ -1231,6 +1259,15 @@ protected void putService(Service s) {
|
||||
("service.getProvider() must match this Provider object");
|
||||
}
|
||||
String type = s.getType();
|
||||
@ -322,7 +322,7 @@
|
||||
# Define IcedTea version used for SystemTap tapsets and desktop file
|
||||
%global icedteaver 6.0.0pre00-c848b93a8598
|
||||
# Define current Git revision for the crypto policy & FIPS support patches
|
||||
%global fipsver df044414ef4
|
||||
%global fipsver e55ada9353e
|
||||
# Define nssadapter variables
|
||||
%global nssadapter_version 0.1.0
|
||||
%global nssadapter_name nssadapter-%{nssadapter_version}
|
||||
@ -349,9 +349,9 @@
|
||||
%global top_level_dir_name %{vcstag}
|
||||
%global top_level_dir_name_backup %{top_level_dir_name}-backup
|
||||
%global buildver 10
|
||||
%global rpmrelease 2
|
||||
%global rpmrelease 3
|
||||
# Settings used by the portable build
|
||||
%global portablerelease 2
|
||||
%global portablerelease 3
|
||||
# Portable suffix differs between RHEL and CentOS
|
||||
%if 0%{?centos} == 0
|
||||
%global portablerhel %{?pkgos:7_9}%{!?pkgos:8}
|
||||
@ -1371,37 +1371,9 @@ Source32: create-redhat-properties-files.bash
|
||||
# as follows: git diff %%{vcstag} src make test > fips-25u-$(git show -s --format=%h HEAD).patch
|
||||
# Diff is limited to src and make subdirectories to exclude .github changes
|
||||
# Fixes currently included:
|
||||
# PR3183, RH1340845: Follow system wide crypto policy
|
||||
# PR3695: Allow use of system crypto policy to be disabled by the user
|
||||
# RH1655466: Support RHEL FIPS mode using SunPKCS11 provider
|
||||
# RH1818909: No ciphersuites availale for SSLSocket in FIPS mode
|
||||
# RH1860986: Disable TLSv1.3 with the NSS-FIPS provider until PKCS#11 v3.0 support is available
|
||||
# RH1915071: Always initialise JavaSecuritySystemConfiguratorAccess
|
||||
# RH1929465: Improve system FIPS detection
|
||||
# RH1995150: Disable non-FIPS crypto in SUN and SunEC security providers
|
||||
# RH1996182: Login to the NSS software token in FIPS mode
|
||||
# RH1991003: Allow plain key import unless com.redhat.fips.plainKeySupport is set to false
|
||||
# RH2021263: Resolve outstanding FIPS issues
|
||||
# RH2052819: Fix FIPS reliance on crypto policies
|
||||
# RH2052829: Detect NSS at Runtime for FIPS detection
|
||||
# RH2052070: Enable AlgorithmParameters and AlgorithmParameterGenerator services in FIPS mode
|
||||
# RH2023467: Enable FIPS keys export
|
||||
# RH2094027: SunEC runtime permission for FIPS
|
||||
# RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
|
||||
# RH2090378: Revert to disabling system security properties and FIPS mode support together
|
||||
# RH2104724: Avoid import/export of DH private keys
|
||||
# RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode
|
||||
# Build the systemconf library on all platforms
|
||||
# RH2048582: Support PKCS#12 keystores [now part of JDK-8301553 upstream]
|
||||
# RH2020290: Support TLS 1.3 in FIPS mode
|
||||
# Add nss.fips.cfg support to OpenJDK tree
|
||||
# RH2117972: Extend the support for NSS DBs (PKCS11) in FIPS mode
|
||||
# Remove forgotten dead code from RH2020290 and RH2104724
|
||||
# OJ1357: Fix issue on FIPS with a SecurityManager in place
|
||||
# RH2134669: Add missing attributes when registering services in FIPS mode.
|
||||
# test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
|
||||
# RH1940064: Enable XML Signature provider in FIPS mode
|
||||
# RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream]
|
||||
# OPENJDK-2108: Internal __redhat_fips__ property
|
||||
# OPENJDK-2123: Algorithms lockdown
|
||||
# OPENJDK-4559: Red Hat Build of OpenJDK 25 should not restrict all the providers in FIPS
|
||||
Patch1001: fips-%{featurever}u-%{fipsver}.patch
|
||||
|
||||
#############################################
|
||||
@ -2629,6 +2601,11 @@ exit 0
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Tue Mar 03 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-3
|
||||
- Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown
|
||||
- Fix FIPS issue list to represent the new 25u version
|
||||
- Resolves: RHEL-155000
|
||||
|
||||
* Wed Feb 18 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-2
|
||||
- Bump rpmrelease for CentOS build
|
||||
- Related: RHEL-139579
|
||||
|
||||
Loading…
Reference in New Issue
Block a user