Blame SOURCES/rh1860986-disable_tlsv1.3_in_fips_mode.patch

fad0a1
diff -r bbc65dfa59d1 src/share/classes/java/security/SystemConfigurator.java
fad0a1
--- openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java	Thu Jan 23 18:22:31 2020 -0300
fad0a1
+++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java	Sat Aug 01 23:16:51 2020 -0300
fad0a1
@@ -1,11 +1,13 @@
fad0a1
 /*
fad0a1
- * Copyright (c) 2019, Red Hat, Inc.
fad0a1
+ * Copyright (c) 2019, 2020, Red Hat, Inc.
fad0a1
  *
fad0a1
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
fad0a1
  *
fad0a1
  * This code is free software; you can redistribute it and/or modify it
fad0a1
  * under the terms of the GNU General Public License version 2 only, as
fad0a1
- * published by the Free Software Foundation.
fad0a1
+ * published by the Free Software Foundation.  Oracle designates this
fad0a1
+ * particular file as subject to the "Classpath" exception as provided
fad0a1
+ * by Oracle in the LICENSE file that accompanied this code.
fad0a1
  *
fad0a1
  * This code is distributed in the hope that it will be useful, but WITHOUT
fad0a1
  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
fad0a1
@@ -34,10 +36,10 @@
fad0a1
 import java.util.Iterator;
fad0a1
 import java.util.Map.Entry;
fad0a1
 import java.util.Properties;
fad0a1
-import java.util.function.Consumer;
fad0a1
-import java.util.regex.Matcher;
fad0a1
 import java.util.regex.Pattern;
fad0a1
 
fad0a1
+import sun.misc.SharedSecrets;
fad0a1
+import sun.misc.JavaSecuritySystemConfiguratorAccess;
fad0a1
 import sun.security.util.Debug;
fad0a1
 
fad0a1
 /**
fad0a1
@@ -47,7 +49,7 @@
fad0a1
  *
fad0a1
  */
fad0a1
 
fad0a1
-class SystemConfigurator {
fad0a1
+final class SystemConfigurator {
fad0a1
 
fad0a1
     private static final Debug sdebug =
fad0a1
             Debug.getInstance("properties");
fad0a1
@@ -61,15 +63,16 @@
fad0a1
     private static final String CRYPTO_POLICIES_CONFIG =
fad0a1
             CRYPTO_POLICIES_BASE_DIR + "/config";
fad0a1
 
fad0a1
-    private static final class SecurityProviderInfo {
fad0a1
-        int number;
fad0a1
-        String key;
fad0a1
-        String value;
fad0a1
-        SecurityProviderInfo(int number, String key, String value) {
fad0a1
-            this.number = number;
fad0a1
-            this.key = key;
fad0a1
-            this.value = value;
fad0a1
-        }
fad0a1
+    private static boolean systemFipsEnabled = false;
fad0a1
+
fad0a1
+    static {
fad0a1
+        SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
fad0a1
+            new JavaSecuritySystemConfiguratorAccess() {
fad0a1
+                @Override
fad0a1
+                public boolean isSystemFipsEnabled() {
fad0a1
+                    return SystemConfigurator.isSystemFipsEnabled();
fad0a1
+                }
fad0a1
+            });
fad0a1
     }
fad0a1
 
fad0a1
     /*
fad0a1
@@ -128,9 +131,9 @@
fad0a1
                     String nonFipsKeystoreType = props.getProperty("keystore.type");
fad0a1
                     props.put("keystore.type", keystoreTypeValue);
fad0a1
                     if (keystoreTypeValue.equals("PKCS11")) {
fad0a1
-                    	// If keystore.type is PKCS11, javax.net.ssl.keyStore
fad0a1
-                    	// must be "NONE". See JDK-8238264.
fad0a1
-                    	System.setProperty("javax.net.ssl.keyStore", "NONE");
fad0a1
+                        // If keystore.type is PKCS11, javax.net.ssl.keyStore
fad0a1
+                        // must be "NONE". See JDK-8238264.
fad0a1
+                        System.setProperty("javax.net.ssl.keyStore", "NONE");
fad0a1
                     }
fad0a1
                     if (System.getProperty("javax.net.ssl.trustStoreType") == null) {
fad0a1
                         // If no trustStoreType has been set, use the
fad0a1
@@ -144,12 +147,13 @@
fad0a1
                         sdebug.println("FIPS mode default keystore.type = " +
fad0a1
                                 keystoreTypeValue);
fad0a1
                         sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
fad0a1
-                        		System.getProperty("javax.net.ssl.keyStore", ""));
fad0a1
+                                System.getProperty("javax.net.ssl.keyStore", ""));
fad0a1
                         sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
fad0a1
                                 System.getProperty("javax.net.ssl.trustStoreType", ""));
fad0a1
                     }
fad0a1
                 }
fad0a1
                 loadedProps = true;
fad0a1
+                systemFipsEnabled = true;
fad0a1
             }
fad0a1
         } catch (Exception e) {
fad0a1
             if (sdebug != null) {
fad0a1
@@ -165,20 +165,37 @@
fad0a1
         return loadedProps;
fad0a1
     }
fad0a1
 
fad0a1
+    /**
fad0a1
+     * Returns whether or not global system FIPS alignment is enabled.
fad0a1
+     *
fad0a1
+     * Value is always 'false' before java.security.Security class is
fad0a1
+     * initialized.
fad0a1
+     *
fad0a1
+     * Call from out of this package through SharedSecrets:
fad0a1
+     *   SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
fad0a1
+     *           .isSystemFipsEnabled();
fad0a1
+     *
fad0a1
+     * @return  a boolean value indicating whether or not global
fad0a1
+     *          system FIPS alignment is enabled.
fad0a1
+     */
fad0a1
+    static boolean isSystemFipsEnabled() {
fad0a1
+        return systemFipsEnabled;
fad0a1
+    }
fad0a1
+
fad0a1
     /*
fad0a1
      * FIPS is enabled only if crypto-policies are set to "FIPS"
fad0a1
      * and the com.redhat.fips property is true.
fad0a1
      */
fad0a1
     private static boolean enableFips() throws Exception {
fad0a1
-	boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
fad0a1
-	if (fipsEnabled) {
fad0a1
-	    Path configPath = FileSystems.getDefault().getPath(CRYPTO_POLICIES_CONFIG);
fad0a1
-	    String cryptoPoliciesConfig = new String(Files.readAllBytes(configPath));
fad0a1
-	    if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); }
fad0a1
-	    Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
fad0a1
-	    return pattern.matcher(cryptoPoliciesConfig).find();
fad0a1
-	} else {
fad0a1
-	    return false;
fad0a1
-	}
fad0a1
+        boolean shouldEnable = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
fad0a1
+        if (shouldEnable) {
fad0a1
+            Path configPath = FileSystems.getDefault().getPath(CRYPTO_POLICIES_CONFIG);
fad0a1
+            String cryptoPoliciesConfig = new String(Files.readAllBytes(configPath));
fad0a1
+            if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); }
fad0a1
+            Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
fad0a1
+            return pattern.matcher(cryptoPoliciesConfig).find();
fad0a1
+        } else {
fad0a1
+            return false;
fad0a1
+        }
fad0a1
     }
fad0a1
 }
fad0a1
diff --git openjdk.orig/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java openjdk/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
fad0a1
new file mode 100644
fad0a1
--- /dev/null
fad0a1
+++ openjdk/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
fad0a1
@@ -0,0 +1,30 @@
fad0a1
+/*
fad0a1
+ * Copyright (c) 2020, Red Hat, Inc.
fad0a1
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
fad0a1
+ *
fad0a1
+ * This code is free software; you can redistribute it and/or modify it
fad0a1
+ * under the terms of the GNU General Public License version 2 only, as
fad0a1
+ * published by the Free Software Foundation.  Oracle designates this
fad0a1
+ * particular file as subject to the "Classpath" exception as provided
fad0a1
+ * by Oracle in the LICENSE file that accompanied this code.
fad0a1
+ *
fad0a1
+ * This code is distributed in the hope that it will be useful, but WITHOUT
fad0a1
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
fad0a1
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
fad0a1
+ * version 2 for more details (a copy is included in the LICENSE file that
fad0a1
+ * accompanied this code).
fad0a1
+ *
fad0a1
+ * You should have received a copy of the GNU General Public License version
fad0a1
+ * 2 along with this work; if not, write to the Free Software Foundation,
fad0a1
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
fad0a1
+ *
fad0a1
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
fad0a1
+ * or visit www.oracle.com if you need additional information or have any
fad0a1
+ * questions.
fad0a1
+ */
fad0a1
+
fad0a1
+package sun.misc;
fad0a1
+
fad0a1
+public interface JavaSecuritySystemConfiguratorAccess {
fad0a1
+    boolean isSystemFipsEnabled();
fad0a1
+}
fad0a1
diff --git openjdk.orig/jdk/src/share/classes/sun/misc/SharedSecrets.java openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java
fad0a1
--- openjdk.orig/jdk/src/share/classes/sun/misc/SharedSecrets.java
fad0a1
+++ openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java
fad0a1
@@ -63,6 +63,7 @@
fad0a1
     private static JavaObjectInputStreamReadString javaObjectInputStreamReadString;
fad0a1
     private static JavaObjectInputStreamAccess javaObjectInputStreamAccess;
fad0a1
     private static JavaSecuritySignatureAccess javaSecuritySignatureAccess;
fad0a1
+    private static JavaSecuritySystemConfiguratorAccess javaSecuritySystemConfiguratorAccess;
fad0a1
 
fad0a1
     public static JavaUtilJarAccess javaUtilJarAccess() {
fad0a1
         if (javaUtilJarAccess == null) {
fad0a1
@@ -248,4 +249,12 @@
fad0a1
         }
fad0a1
         return javaxCryptoSealedObjectAccess;
fad0a1
     }
fad0a1
+
fad0a1
+    public static void setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) {
fad0a1
+        javaSecuritySystemConfiguratorAccess = jssca;
fad0a1
+    }
fad0a1
+
fad0a1
+    public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() {
fad0a1
+        return javaSecuritySystemConfiguratorAccess;
fad0a1
+    }
fad0a1
 }
fad0a1
diff --git openjdk.orig/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java openjdk/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
fad0a1
--- openjdk.orig/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
fad0a1
+++ openjdk/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
fad0a1
@@ -31,6 +31,7 @@
fad0a1
 import java.security.cert.*;
fad0a1
 import java.util.*;
fad0a1
 import javax.net.ssl.*;
fad0a1
+import sun.misc.SharedSecrets;
fad0a1
 import sun.security.action.GetPropertyAction;
fad0a1
 import sun.security.provider.certpath.AlgorithmChecker;
fad0a1
 import sun.security.validator.Validator;
fad0a1
@@ -539,20 +540,38 @@
fad0a1
 
fad0a1
         static {
fad0a1
             if (SunJSSE.isFIPS()) {
fad0a1
-                supportedProtocols = Arrays.asList(
fad0a1
-                    ProtocolVersion.TLS13,
fad0a1
-                    ProtocolVersion.TLS12,
fad0a1
-                    ProtocolVersion.TLS11,
fad0a1
-                    ProtocolVersion.TLS10
fad0a1
-                );
fad0a1
+                if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
fad0a1
+                        .isSystemFipsEnabled()) {
fad0a1
+                    // RH1860986: TLSv1.3 key derivation not supported with
fad0a1
+                    // the Security Providers available in system FIPS mode.
fad0a1
+                    supportedProtocols = Arrays.asList(
fad0a1
+                        ProtocolVersion.TLS12,
fad0a1
+                        ProtocolVersion.TLS11,
fad0a1
+                        ProtocolVersion.TLS10
fad0a1
+                    );
fad0a1
 
fad0a1
-                serverDefaultProtocols = getAvailableProtocols(
fad0a1
-                        new ProtocolVersion[] {
fad0a1
-                    ProtocolVersion.TLS13,
fad0a1
-                    ProtocolVersion.TLS12,
fad0a1
-                    ProtocolVersion.TLS11,
fad0a1
-                    ProtocolVersion.TLS10
fad0a1
-                });
fad0a1
+                    serverDefaultProtocols = getAvailableProtocols(
fad0a1
+                            new ProtocolVersion[] {
fad0a1
+                        ProtocolVersion.TLS12,
fad0a1
+                        ProtocolVersion.TLS11,
fad0a1
+                        ProtocolVersion.TLS10
fad0a1
+                    });
fad0a1
+                } else {
fad0a1
+                    supportedProtocols = Arrays.asList(
fad0a1
+                        ProtocolVersion.TLS13,
fad0a1
+                        ProtocolVersion.TLS12,
fad0a1
+                        ProtocolVersion.TLS11,
fad0a1
+                        ProtocolVersion.TLS10
fad0a1
+                    );
fad0a1
+
fad0a1
+                    serverDefaultProtocols = getAvailableProtocols(
fad0a1
+                            new ProtocolVersion[] {
fad0a1
+                        ProtocolVersion.TLS13,
fad0a1
+                        ProtocolVersion.TLS12,
fad0a1
+                        ProtocolVersion.TLS11,
fad0a1
+                        ProtocolVersion.TLS10
fad0a1
+                    });
fad0a1
+                }
fad0a1
             } else {
fad0a1
                 supportedProtocols = Arrays.asList(
fad0a1
                     ProtocolVersion.TLS13,
fad0a1
@@ -612,6 +631,16 @@
fad0a1
 
fad0a1
         static ProtocolVersion[] getSupportedProtocols() {
fad0a1
             if (SunJSSE.isFIPS()) {
fad0a1
+                if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
fad0a1
+                        .isSystemFipsEnabled()) {
fad0a1
+                    // RH1860986: TLSv1.3 key derivation not supported with
fad0a1
+                    // the Security Providers available in system FIPS mode.
fad0a1
+                    return new ProtocolVersion[] {
fad0a1
+                            ProtocolVersion.TLS12,
fad0a1
+                            ProtocolVersion.TLS11,
fad0a1
+                            ProtocolVersion.TLS10
fad0a1
+                    };
fad0a1
+                }
fad0a1
                 return new ProtocolVersion[] {
fad0a1
                         ProtocolVersion.TLS13,
fad0a1
                         ProtocolVersion.TLS12,
fad0a1
@@ -939,6 +968,16 @@
fad0a1
 
fad0a1
         static ProtocolVersion[] getProtocols() {
fad0a1
             if (SunJSSE.isFIPS()) {
fad0a1
+                if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
fad0a1
+                        .isSystemFipsEnabled()) {
fad0a1
+                    // RH1860986: TLSv1.3 key derivation not supported with
fad0a1
+                    // the Security Providers available in system FIPS mode.
fad0a1
+                    return new ProtocolVersion[] {
fad0a1
+                            ProtocolVersion.TLS12,
fad0a1
+                            ProtocolVersion.TLS11,
fad0a1
+                            ProtocolVersion.TLS10
fad0a1
+                    };
fad0a1
+                }
fad0a1
                 return new ProtocolVersion[]{
fad0a1
                         ProtocolVersion.TLS12,
fad0a1
                         ProtocolVersion.TLS11,
fad0a1
diff --git openjdk.orig/jdk/src/share/classes/sun/security/ssl/SunJSSE.java openjdk/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
fad0a1
--- openjdk.orig/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
fad0a1
+++ openjdk/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
fad0a1
@@ -30,6 +30,8 @@
fad0a1
 
fad0a1
 import java.security.*;
fad0a1
 
fad0a1
+import sun.misc.SharedSecrets;
fad0a1
+
fad0a1
 /**
fad0a1
  * The JSSE provider.
fad0a1
  *
fad0a1
@@ -215,8 +217,13 @@
fad0a1
             "sun.security.ssl.SSLContextImpl$TLS11Context");
fad0a1
         put("SSLContext.TLSv1.2",
fad0a1
             "sun.security.ssl.SSLContextImpl$TLS12Context");
fad0a1
-        put("SSLContext.TLSv1.3",
fad0a1
-            "sun.security.ssl.SSLContextImpl$TLS13Context");
fad0a1
+        if (!SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
fad0a1
+                .isSystemFipsEnabled()) {
fad0a1
+            // RH1860986: TLSv1.3 key derivation not supported with
fad0a1
+            // the Security Providers available in system FIPS mode.
fad0a1
+            put("SSLContext.TLSv1.3",
fad0a1
+                "sun.security.ssl.SSLContextImpl$TLS13Context");
fad0a1
+        }
fad0a1
         put("SSLContext.TLS",
fad0a1
             "sun.security.ssl.SSLContextImpl$TLSContext");
fad0a1
         if (isfips == false) {