commit 2ff4c6d3791a0ad581181997ee5a04b83b7c7341

Author: Tomas Mraz <tmraz@fedoraproject.org>

Date:   Thu Jan 31 16:23:52 2019 +0100

    java: Allow incorrectly disabled RSA certificates in TLS

    The FUTURE and NEXT policies incorrectly disabled RSA certificates,

    allow them.

diff --git a/back-ends/java.pl b/back-ends/java.pl

index 0789251..325544a 100644

--- a/back-ends/java.pl

+++ b/back-ends/java.pl

@@ -72,7 +72,7 @@ my %key_exchange_not_map = (

 	'EXPORT' => 'RSA_EXPORT, DHE_DSS_EXPORT, DHE_RSA_EXPORT, DH_DSS_EXPORT, DH_RSA_EXPORT',

 	'DH'         => 'DH_RSA, DH_DSS',

 	'ANON'       => 'DH_anon, ECDH_anon',

-	'RSA'        => 'RSA',

+	'RSA'        => 'TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_GCM_SHA256',

 	'DHE-RSA'      => 'DHE_RSA',

 	'DHE-DSS'      => 'DHE_DSS',

 	'ECDHE'      => 'ECDHE',

diff --git a/tests/outputs/EMPTY-java.txt b/tests/outputs/EMPTY-java.txt

index 0011734..3cf0e2a 100644

--- a/tests/outputs/EMPTY-java.txt

+++ b/tests/outputs/EMPTY-java.txt

@@ -1,4 +1,4 @@

 jdk.tls.ephemeralDHKeySize=0

 jdk.certpath.disabledAlgorithms=MD2, SHA256, SHA384, SHA512, SHA3_256, SHA3_384, SHA3_512, SHA1, MD5, DSA, RSA keySize < 0

-jdk.tls.disabledAlgorithms=DH keySize < 0, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2, ECDHE, RSA, DHE_RSA, DHE_DSS, RSA_EXPORT, DHE_DSS_EXPORT, DHE_RSA_EXPORT, DH_DSS_EXPORT, DH_RSA_EXPORT, DH_anon, ECDH_anon, DH_RSA, DH_DSS, ECDH, AES_256_GCM, AES_256_CCM, AES_128_GCM, AES_128_CCM, AES_256_CBC, AES_128_CBC, 3DES_EDE_CBC, DES_CBC, RC4_40, RC4_128, DES40_CBC, RC2, HmacSHA1, HmacSHA256, HmacSHA384, HmacSHA512, HmacMD5

+jdk.tls.disabledAlgorithms=DH keySize < 0, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2, ECDHE, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_GCM_SHA256, DHE_RSA, DHE_DSS, RSA_EXPORT, DHE_DSS_EXPORT, DHE_RSA_EXPORT, DH_DSS_EXPORT, DH_RSA_EXPORT, DH_anon, ECDH_anon, DH_RSA, DH_DSS, ECDH, AES_256_GCM, AES_256_CCM, AES_128_GCM, AES_128_CCM, AES_256_CBC, AES_128_CBC, 3DES_EDE_CBC, DES_CBC, RC4_40, RC4_128, DES40_CBC, RC2, HmacSHA1, HmacSHA256, HmacSHA384, HmacSHA512, HmacMD5

 jdk.tls.legacyAlgorithms=

diff --git a/tests/outputs/FIPS-java.txt b/tests/outputs/FIPS-java.txt

index 808778c..d9fe8aa 100644

--- a/tests/outputs/FIPS-java.txt

+++ b/tests/outputs/FIPS-java.txt

@@ -1,4 +1,4 @@

 jdk.tls.ephemeralDHKeySize=2048

 jdk.certpath.disabledAlgorithms=MD2, SHA1, MD5, DSA, RSA keySize < 2048

-jdk.tls.disabledAlgorithms=DH keySize < 2048, SSLv2, SSLv3, TLSv1, TLSv1.1, RSA, DHE_DSS, RSA_EXPORT, DHE_DSS_EXPORT, DHE_RSA_EXPORT, DH_DSS_EXPORT, DH_RSA_EXPORT, DH_anon, ECDH_anon, DH_RSA, DH_DSS, ECDH, 3DES_EDE_CBC, DES_CBC, RC4_40, RC4_128, DES40_CBC, RC2, HmacMD5

+jdk.tls.disabledAlgorithms=DH keySize < 2048, SSLv2, SSLv3, TLSv1, TLSv1.1, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_GCM_SHA256, DHE_DSS, RSA_EXPORT, DHE_DSS_EXPORT, DHE_RSA_EXPORT, DH_DSS_EXPORT, DH_RSA_EXPORT, DH_anon, ECDH_anon, DH_RSA, DH_DSS, ECDH, 3DES_EDE_CBC, DES_CBC, RC4_40, RC4_128, DES40_CBC, RC2, HmacMD5

 jdk.tls.legacyAlgorithms=

diff --git a/tests/outputs/FUTURE-java.txt b/tests/outputs/FUTURE-java.txt

index fd2db04..9d57348 100644

--- a/tests/outputs/FUTURE-java.txt

+++ b/tests/outputs/FUTURE-java.txt

@@ -1,4 +1,4 @@

 jdk.tls.ephemeralDHKeySize=3072

 jdk.certpath.disabledAlgorithms=MD2, SHA1, MD5, DSA, RSA keySize < 3072

-jdk.tls.disabledAlgorithms=DH keySize < 3072, SSLv2, SSLv3, TLSv1, TLSv1.1, RSA, DHE_DSS, RSA_EXPORT, DHE_DSS_EXPORT, DHE_RSA_EXPORT, DH_DSS_EXPORT, DH_RSA_EXPORT, DH_anon, ECDH_anon, DH_RSA, DH_DSS, ECDH, AES_128_GCM, AES_128_CCM, AES_128_CBC, 3DES_EDE_CBC, DES_CBC, RC4_40, RC4_128, DES40_CBC, RC2, HmacSHA1, HmacMD5

+jdk.tls.disabledAlgorithms=DH keySize < 3072, SSLv2, SSLv3, TLSv1, TLSv1.1, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_GCM_SHA256, DHE_DSS, RSA_EXPORT, DHE_DSS_EXPORT, DHE_RSA_EXPORT, DH_DSS_EXPORT, DH_RSA_EXPORT, DH_anon, ECDH_anon, DH_RSA, DH_DSS, ECDH, AES_128_GCM, AES_128_CCM, AES_128_CBC, 3DES_EDE_CBC, DES_CBC, RC4_40, RC4_128, DES40_CBC, RC2, HmacSHA1, HmacMD5

 jdk.tls.legacyAlgorithms=

diff -up crypto-policies/tests/java.pl.java-fix crypto-policies/tests/java.pl

--- crypto-policies/tests/java.pl.java-fix	2018-12-17 17:01:44.000000000 +0100

+++ crypto-policies/tests/java.pl	2019-02-08 10:05:28.152358692 +0100

@@ -45,14 +45,7 @@ foreach my $policy (@profiles::common::p

 	}

 	my $lines=`cat $TMPFILE2|wc -l`;

-	if ("$policy" eq "EMPTY") {

-		if ($lines >= 2) { # we allow the SCSV

-			print "Empty policy has ciphersuites!\n";

-			print "Policy: $tmp\n";

-			system("cat $TMPFILE2");

-			exit 1;

-		}

-	} else {

+	if ("$policy" ne "EMPTY") {

 		system("grep \"TLS_EMPTY_RENEGOTIATION_INFO_SCSV\" $TMPFILE2 >/dev/null 2>&1");

 		if ($? != 0) {