|
| 1 | +/* |
| 2 | + * =========================================================================== |
| 3 | + * (c) Copyright IBM Corp. 2022, 2022 All Rights Reserved |
| 4 | + * =========================================================================== |
| 5 | + * |
| 6 | + * This code is free software; you can redistribute it and/or modify it |
| 7 | + * under the terms of the GNU General Public License version 2 only, as |
| 8 | + * published by the Free Software Foundation. |
| 9 | + * |
| 10 | + * IBM designates this particular file as subject to the "Classpath" exception |
| 11 | + * as provided by IBM in the LICENSE file that accompanied this code. |
| 12 | + * |
| 13 | + * This code is distributed in the hope that it will be useful, but WITHOUT |
| 14 | + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| 15 | + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| 16 | + * version 2 for more details (a copy is included in the LICENSE file that |
| 17 | + * accompanied this code). |
| 18 | + * |
| 19 | + * You should have received a copy of the GNU General Public License version |
| 20 | + * 2 along with this work; if not, see <http://www.gnu.org/licenses/>. |
| 21 | + * |
| 22 | + * =========================================================================== |
| 23 | + */ |
| 24 | + |
| 25 | +package openj9.internal.security; |
| 26 | + |
| 27 | +import java.util.Iterator; |
| 28 | +import java.util.Map.Entry; |
| 29 | +import java.util.Properties; |
| 30 | +import java.security.AccessController; |
| 31 | +import java.security.PrivilegedAction; |
| 32 | + |
| 33 | +import sun.security.util.Debug; |
| 34 | + |
| 35 | +/** |
| 36 | + * Configures the security providers when in FIPS mode. |
| 37 | + */ |
| 38 | +public final class FIPSConfigurator { |
| 39 | + |
| 40 | + private static final Debug debug = Debug.getInstance("semerufips"); |
| 41 | + |
| 42 | + // FIPS mode enable check, only supported on Linux x64. |
| 43 | + private static final boolean userEnabledFIPS; |
| 44 | + private static final boolean isFIPSSupported; |
| 45 | + private static final boolean shouldEnableFIPS; |
| 46 | + |
| 47 | + static { |
| 48 | + String[] props = AccessController.doPrivileged( |
| 49 | + new PrivilegedAction<>() { |
| 50 | + @Override |
| 51 | + public String[] run() { |
| 52 | + return new String[] {System.getProperty("semeru.fips"), |
| 53 | + System.getProperty("os.name"), |
| 54 | + System.getProperty("os.arch")}; |
| 55 | + } |
| 56 | + }); |
| 57 | + userEnabledFIPS = Boolean.parseBoolean(props[0]); |
| 58 | + isFIPSSupported = "Linux".equalsIgnoreCase(props[1]) |
| 59 | + && "amd64".equalsIgnoreCase(props[2]); |
| 60 | + shouldEnableFIPS = userEnabledFIPS && isFIPSSupported; |
| 61 | + } |
| 62 | + |
| 63 | + private FIPSConfigurator() { |
| 64 | + super(); |
| 65 | + } |
| 66 | + |
| 67 | + /** |
| 68 | + * FIPS mode will be enabled only if the semeru.fips system |
| 69 | + * property is true (default as false). |
| 70 | + * |
| 71 | + * @return true if FIPS is enabled |
| 72 | + */ |
| 73 | + public static boolean enableFIPS() { |
| 74 | + return shouldEnableFIPS; |
| 75 | + } |
| 76 | + |
| 77 | + /** |
| 78 | + * Remove the security providers and only add the FIPS security providers. |
| 79 | + * |
| 80 | + * @param props the java.security properties |
| 81 | + * @return true if the FIPS properties loaded successfully |
| 82 | + */ |
| 83 | + public static boolean configureFIPS(Properties props) { |
| 84 | + boolean loadedProps = false; |
| 85 | + |
| 86 | + // Check if FIPS is supported on this platform. |
| 87 | + if (userEnabledFIPS && !isFIPSSupported) { |
| 88 | + throw new RuntimeException("FIPS is not supported on this platform."); |
| 89 | + } |
| 90 | + |
| 91 | + try { |
| 92 | + if (shouldEnableFIPS) { |
| 93 | + if (debug != null) { |
| 94 | + debug.println("FIPS mode detected, loading properties"); |
| 95 | + } |
| 96 | + |
| 97 | + // Remove all security providers. |
| 98 | + Iterator<Entry<Object, Object>> i = props.entrySet().iterator(); |
| 99 | + while (i.hasNext()) { |
| 100 | + Entry<Object, Object> e = i.next(); |
| 101 | + if (((String) e.getKey()).startsWith("security.provider")) { |
| 102 | + if (debug != null) { |
| 103 | + debug.println("Removing provider: " + e); |
| 104 | + } |
| 105 | + i.remove(); |
| 106 | + } |
| 107 | + } |
| 108 | + |
| 109 | + // Add FIPS security providers. |
| 110 | + props.put("security.provider.1", "SunPKCS11 ${java.home}/conf/security/nss.fips.cfg"); |
| 111 | + props.put("security.provider.2", "SUN"); |
| 112 | + props.put("security.provider.3", "SunEC"); |
| 113 | + props.put("security.provider.4", "SunJSSE"); |
| 114 | + |
| 115 | + // Add FIPS security properties. |
| 116 | + props.put("keystore.type", "PKCS11"); |
| 117 | + System.setProperty("javax.net.ssl.keyStore", "NONE"); |
| 118 | + |
| 119 | + // Add FIPS disabled algorithms. |
| 120 | + String disabledAlgorithms = props.get("jdk.tls.disabledAlgorithms") |
| 121 | + + ", X25519, X448" |
| 122 | + + ", SSLv3, TLSv1, TLSv1.1" |
| 123 | + + ", TLS_CHACHA20_POLY1305_SHA256" |
| 124 | + + ", TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" |
| 125 | + + ", TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" |
| 126 | + + ", TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" |
| 127 | + + ", TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" |
| 128 | + + ", TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA" |
| 129 | + + ", TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA" |
| 130 | + + ", TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_GCM_SHA256" |
| 131 | + + ", TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256" |
| 132 | + + ", TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA" |
| 133 | + + ", TLS_AES_256_GCM_SHA384, TLS_AES_128_GCM_SHA256" |
| 134 | + + ", TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" |
| 135 | + + ", TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" |
| 136 | + + ", TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" |
| 137 | + + ", TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" |
| 138 | + + ", TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" |
| 139 | + + ", TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" |
| 140 | + + ", TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" |
| 141 | + + ", TLS_EMPTY_RENEGOTIATION_INFO_SCSV"; |
| 142 | + props.put("jdk.tls.disabledAlgorithms", disabledAlgorithms); |
| 143 | + |
| 144 | + if (debug != null) { |
| 145 | + debug.println("FIPS mode properties loaded"); |
| 146 | + debug.println(props.toString()); |
| 147 | + } |
| 148 | + |
| 149 | + loadedProps = true; |
| 150 | + } |
| 151 | + } catch (Exception e) { |
| 152 | + if (debug != null) { |
| 153 | + debug.println("Unable to load FIPS configuration"); |
| 154 | + e.printStackTrace(); |
| 155 | + } |
| 156 | + } |
| 157 | + return loadedProps; |
| 158 | + } |
| 159 | +} |
0 commit comments