Blame SOURCES/rh1996182-login_to_nss_software_token.patch

673b76
commit 53bda6adfacc02b8dddd8f10350c9569bca4eb1e
673b76
Author: Martin Balao <mbalao@redhat.com>
673b76
Date:   Fri Aug 27 19:42:07 2021 +0100
673b76
673b76
    RH1996182: Login to the NSS Software Token in FIPS Mode
673b76
673b76
diff --git openjdk.orig/src/java.base/share/classes/module-info.java openjdk/src/java.base/share/classes/module-info.java
673b76
index 0cf61732d7..2cd851587c 100644
673b76
--- openjdk.orig/src/java.base/share/classes/module-info.java
673b76
+++ openjdk/src/java.base/share/classes/module-info.java
673b76
@@ -182,6 +182,7 @@ module java.base {
673b76
         java.security.jgss,
673b76
         java.sql,
673b76
         java.xml,
673b76
+        jdk.crypto.cryptoki,
673b76
         jdk.jartool,
673b76
         jdk.attach,
673b76
         jdk.charsets,
673b76
diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
673b76
index b00b738b85..1eca1f8f0a 100644
673b76
--- openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
673b76
+++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
673b76
@@ -42,6 +42,8 @@ import javax.security.auth.callback.ConfirmationCallback;
673b76
 import javax.security.auth.callback.PasswordCallback;
673b76
 import javax.security.auth.callback.TextOutputCallback;
673b76
 
673b76
+import jdk.internal.misc.SharedSecrets;
673b76
+
673b76
 import sun.security.util.Debug;
673b76
 import sun.security.util.ResourcesMgr;
673b76
 import static sun.security.util.SecurityConstants.PROVIDER_VER;
673b76
@@ -59,6 +61,9 @@ import static sun.security.pkcs11.wrapper.PKCS11Constants.*;
673b76
  */
673b76
 public final class SunPKCS11 extends AuthProvider {
673b76
 
673b76
+    private static final boolean systemFipsEnabled = SharedSecrets
673b76
+            .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled();
673b76
+
673b76
     private static final long serialVersionUID = -1354835039035306505L;
673b76
 
673b76
     static final Debug debug = Debug.getInstance("sunpkcs11");
673b76
@@ -373,6 +378,24 @@ public final class SunPKCS11 extends AuthProvider {
673b76
             if (nssModule != null) {
673b76
                 nssModule.setProvider(this);
673b76
             }
673b76
+            if (systemFipsEnabled) {
673b76
+                // The NSS Software Token in FIPS 140-2 mode requires a user
673b76
+                // login for most operations. See sftk_fipsCheck. The NSS DB
673b76
+                // (/etc/pki/nssdb) PIN is empty.
673b76
+                Session session = null;
673b76
+                try {
673b76
+                    session = token.getOpSession();
673b76
+                    p11.C_Login(session.id(), CKU_USER, new char[] {});
673b76
+                } catch (PKCS11Exception p11e) {
673b76
+                    if (debug != null) {
673b76
+                        debug.println("Error during token login: " +
673b76
+                                p11e.getMessage());
673b76
+                    }
673b76
+                    throw p11e;
673b76
+                } finally {
673b76
+                    token.releaseSession(session);
673b76
+                }
673b76
+            }
673b76
         } catch (Exception e) {
673b76
             if (config.getHandleStartupErrors() == Config.ERR_IGNORE_ALL) {
673b76
                 throw new UnsupportedOperationException