OPENJDK-2123: Algorithms lockdown

Introduce RedHatFIPSFilter, a lightweight Security Providers Filter that
uses an allow-list approach to enable non-cryptographic utilities from
the providers that also implement uncertified cryptographic primitives,
which should be avoided in a FIPS setup. RedHatFIPSFilter is enabled
through the __redhat_fips_filter__ boolean security property.

Author: franferrax

src/java.base/share/classes/java/security/Provider.java

@@ -1203,6 +1203,39 @@ public Set<Service> getServices() {
         return serviceSet;
     }
 
+    /* vvvvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvvvv */
+    private static final class RedHatFIPSFilter {
+        static final boolean IS_ON = Boolean.parseBoolean(
+                Security.getProperty("__redhat_fips_filter__"));
+        private static final Set<String> ANY_SERVICE_TYPE = Set.of();
+        private static final Map<String, Set<String>> ALLOW_LIST = Map.of(
+                "SunPKCS11-FIPS", ANY_SERVICE_TYPE,
+                "SUN", Set.of(
+                        "AlgorithmParameterGenerator",
+                        "AlgorithmParameters", "CertificateFactory",
+                        "CertPathBuilder", "CertPathValidator", "CertStore",
+                        "Configuration", "KeyStore"),
+                "SunEC", Set.of(
+                        "AlgorithmParameters", "KeyFactory"),
+                "SunJSSE", ANY_SERVICE_TYPE,
+                "SunJCE", Set.of(
+                        "AlgorithmParameters",
+                        "AlgorithmParameterGenerator", "KeyFactory",
+                        "SecretKeyFactory"),
+                "SunRsaSign", Set.of(
+                        "KeyFactory", "AlgorithmParameters"),
+                "XMLDSig", ANY_SERVICE_TYPE
+        );
+
+        static boolean isAllowed(String provName, String serviceType) {
+            Set<String> allowedServiceTypes = ALLOW_LIST.get(provName);
+            return allowedServiceTypes != null &&
+                    (allowedServiceTypes == ANY_SERVICE_TYPE ||
+                            allowedServiceTypes.contains(serviceType));
+        }
+    }
+    /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
+
     /**
      * Add a service. If a service of the same type with the same algorithm
      * name exists, and it was added using {@link #putService putService()},
@@ -1231,6 +1264,15 @@ protected void putService(Service s) {
                     ("service.getProvider() must match this Provider object");
         }
         String type = s.getType();
+        /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
+        if (RedHatFIPSFilter.IS_ON && !RedHatFIPSFilter.isAllowed(name, type)) {
+            if (debug != null) {
+                debug.println("The previous " + name + ".putService() call " +
+                        "was skipped by " + RedHatFIPSFilter.class.getName());
+            }
+            return;
+        }
+        /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
         String algorithm = s.getAlgorithm();
         ServiceKey key = new ServiceKey(type, algorithm, true);
         implRemoveService(serviceMap.get(key));