in relatation to feature 3595# #3777
Description
Describe the bug
I'm afraid that feature in #3595 is not going to work properly. I tested locally that changed piece of code on my FIPS hardened Java, which means that apart from other stuff I have this in java.security:
security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider C:DEFRND[SHA256];ENABLE{ALL}; security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:BCFIPS
security.provider.3=SUN
So I have 3 providers, nothing more or less (that's a configuration recommended for env compliant with FIPS 140). I used this small code snippet:
`public static void listProviders() {
System.out.println("Kubernetes fix: +++++++++++++++++++++++++++++");
ServiceLoader<Provider> services = ServiceLoader.load(java.security.Provider.class);
for (Provider service : services) {
System.out.println("Found security provider: " + service.getName());
//Security.addProvider(service);
}
System.out.println("Actual providers: +++++++++++++++++++++++++++++++");
for (Provider provider : Security.getProviders()) {
System.out.println("Provider: " + provider.getName() + ", Version: " + provider.getVersion());
}
System.out.println("Just for reference: +++++++++++++++++++++++++++++++");
Provider provider = new org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider();
System.out.println("Provider: " + provider.getName() + ", Version: " + provider.getVersion());
}`
And the result is kind of surprising:
Kubernetes fix: +++++++++++++++++++++++++++++ Found security provider: SunPCSC Found security provider: SunEC Found security provider: SunPKCS11 Found security provider: SunMSCAPI Found security provider: JdkSASL Found security provider: XMLDSig Found security provider: SunJGSS Found security provider: SunSASL Found security provider: JdkLDAP Actual providers: +++++++++++++++++++++++++++++++ Provider: BCFIPS, Version: 2.0 Provider: BCJSSE, Version: 2.0019 Provider: SUN, Version: 11.0 Just for reference: +++++++++++++++++++++++++++++++ Provider: BCFIPS, Version: 2.0
Which makes me think that the fix you made is not going to work because that loop is returning something else than expected, or did I miss something here?
In that context may I interest you in the netty solution to the problem?
https://github.com/netty/netty/blob/4.1/handler/src/main/java/io/netty/handler/ssl/util/BouncyCastleSelfSignedCertGenerator.java#L44
Client Version
actual client wasn't tested, just a part of code from the feature change
Kubernetes Version
not aplicable
Java Version
11
To Reproduce
In description.
Expected behavior
kubernetes client should fall back to org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider in the absence of non-compliant BC library.
KubeConfig
not applicable
Server (please complete the following information):
tested on Windows
Additional context
#3595