commit 2ff4c6d3791a0ad581181997ee5a04b83b7c7341
Author: Tomas Mraz <tmraz@fedoraproject.org>
Date: Thu Jan 31 16:23:52 2019 +0100
java: Allow incorrectly disabled RSA certificates in TLS
The FUTURE and NEXT policies incorrectly disabled RSA certificates,
allow them.
diff --git a/back-ends/java.pl b/back-ends/java.pl
index 0789251..325544a 100644
--- a/back-ends/java.pl
+++ b/back-ends/java.pl
@@ -72,7 +72,7 @@ my %key_exchange_not_map = (
'EXPORT' => 'RSA_EXPORT, DHE_DSS_EXPORT, DHE_RSA_EXPORT, DH_DSS_EXPORT, DH_RSA_EXPORT',
'DH' => 'DH_RSA, DH_DSS',
'ANON' => 'DH_anon, ECDH_anon',
- 'RSA' => 'RSA',
+ 'RSA' => 'TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_GCM_SHA256',
'DHE-RSA' => 'DHE_RSA',
'DHE-DSS' => 'DHE_DSS',
'ECDHE' => 'ECDHE',
diff --git a/tests/outputs/EMPTY-java.txt b/tests/outputs/EMPTY-java.txt
index 0011734..3cf0e2a 100644
--- a/tests/outputs/EMPTY-java.txt
+++ b/tests/outputs/EMPTY-java.txt
@@ -1,4 +1,4 @@
jdk.tls.ephemeralDHKeySize=0
jdk.certpath.disabledAlgorithms=MD2, SHA256, SHA384, SHA512, SHA3_256, SHA3_384, SHA3_512, SHA1, MD5, DSA, RSA keySize < 0
-jdk.tls.disabledAlgorithms=DH keySize < 0, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2, ECDHE, RSA, DHE_RSA, DHE_DSS, RSA_EXPORT, DHE_DSS_EXPORT, DHE_RSA_EXPORT, DH_DSS_EXPORT, DH_RSA_EXPORT, DH_anon, ECDH_anon, DH_RSA, DH_DSS, ECDH, AES_256_GCM, AES_256_CCM, AES_128_GCM, AES_128_CCM, AES_256_CBC, AES_128_CBC, 3DES_EDE_CBC, DES_CBC, RC4_40, RC4_128, DES40_CBC, RC2, HmacSHA1, HmacSHA256, HmacSHA384, HmacSHA512, HmacMD5
+jdk.tls.disabledAlgorithms=DH keySize < 0, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2, ECDHE, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_GCM_SHA256, DHE_RSA, DHE_DSS, RSA_EXPORT, DHE_DSS_EXPORT, DHE_RSA_EXPORT, DH_DSS_EXPORT, DH_RSA_EXPORT, DH_anon, ECDH_anon, DH_RSA, DH_DSS, ECDH, AES_256_GCM, AES_256_CCM, AES_128_GCM, AES_128_CCM, AES_256_CBC, AES_128_CBC, 3DES_EDE_CBC, DES_CBC, RC4_40, RC4_128, DES40_CBC, RC2, HmacSHA1, HmacSHA256, HmacSHA384, HmacSHA512, HmacMD5
jdk.tls.legacyAlgorithms=
diff --git a/tests/outputs/FIPS-java.txt b/tests/outputs/FIPS-java.txt
index 808778c..d9fe8aa 100644
--- a/tests/outputs/FIPS-java.txt
+++ b/tests/outputs/FIPS-java.txt
@@ -1,4 +1,4 @@
jdk.tls.ephemeralDHKeySize=2048
jdk.certpath.disabledAlgorithms=MD2, SHA1, MD5, DSA, RSA keySize < 2048
-jdk.tls.disabledAlgorithms=DH keySize < 2048, SSLv2, SSLv3, TLSv1, TLSv1.1, RSA, DHE_DSS, RSA_EXPORT, DHE_DSS_EXPORT, DHE_RSA_EXPORT, DH_DSS_EXPORT, DH_RSA_EXPORT, DH_anon, ECDH_anon, DH_RSA, DH_DSS, ECDH, 3DES_EDE_CBC, DES_CBC, RC4_40, RC4_128, DES40_CBC, RC2, HmacMD5
+jdk.tls.disabledAlgorithms=DH keySize < 2048, SSLv2, SSLv3, TLSv1, TLSv1.1, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_GCM_SHA256, DHE_DSS, RSA_EXPORT, DHE_DSS_EXPORT, DHE_RSA_EXPORT, DH_DSS_EXPORT, DH_RSA_EXPORT, DH_anon, ECDH_anon, DH_RSA, DH_DSS, ECDH, 3DES_EDE_CBC, DES_CBC, RC4_40, RC4_128, DES40_CBC, RC2, HmacMD5
jdk.tls.legacyAlgorithms=
diff --git a/tests/outputs/FUTURE-java.txt b/tests/outputs/FUTURE-java.txt
index fd2db04..9d57348 100644
--- a/tests/outputs/FUTURE-java.txt
+++ b/tests/outputs/FUTURE-java.txt
@@ -1,4 +1,4 @@
jdk.tls.ephemeralDHKeySize=3072
jdk.certpath.disabledAlgorithms=MD2, SHA1, MD5, DSA, RSA keySize < 3072
-jdk.tls.disabledAlgorithms=DH keySize < 3072, SSLv2, SSLv3, TLSv1, TLSv1.1, RSA, DHE_DSS, RSA_EXPORT, DHE_DSS_EXPORT, DHE_RSA_EXPORT, DH_DSS_EXPORT, DH_RSA_EXPORT, DH_anon, ECDH_anon, DH_RSA, DH_DSS, ECDH, AES_128_GCM, AES_128_CCM, AES_128_CBC, 3DES_EDE_CBC, DES_CBC, RC4_40, RC4_128, DES40_CBC, RC2, HmacSHA1, HmacMD5
+jdk.tls.disabledAlgorithms=DH keySize < 3072, SSLv2, SSLv3, TLSv1, TLSv1.1, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_GCM_SHA256, DHE_DSS, RSA_EXPORT, DHE_DSS_EXPORT, DHE_RSA_EXPORT, DH_DSS_EXPORT, DH_RSA_EXPORT, DH_anon, ECDH_anon, DH_RSA, DH_DSS, ECDH, AES_128_GCM, AES_128_CCM, AES_128_CBC, 3DES_EDE_CBC, DES_CBC, RC4_40, RC4_128, DES40_CBC, RC2, HmacSHA1, HmacMD5
jdk.tls.legacyAlgorithms=
diff -up crypto-policies/tests/java.pl.java-fix crypto-policies/tests/java.pl
--- crypto-policies/tests/java.pl.java-fix 2018-12-17 17:01:44.000000000 +0100
+++ crypto-policies/tests/java.pl 2019-02-08 10:05:28.152358692 +0100
@@ -45,14 +45,7 @@ foreach my $policy (@profiles::common::p
}
my $lines=`cat $TMPFILE2|wc -l`;
- if ("$policy" eq "EMPTY") {
- if ($lines >= 2) { # we allow the SCSV
- print "Empty policy has ciphersuites!\n";
- print "Policy: $tmp\n";
- system("cat $TMPFILE2");
- exit 1;
- }
- } else {
+ if ("$policy" ne "EMPTY") {
system("grep \"TLS_EMPTY_RENEGOTIATION_INFO_SCSV\" $TMPFILE2 >/dev/null 2>&1");
if ($? != 0) {