Skip to content

Commit e8b5bf9

Browse files
martinuygnu-andrew
martinuy
authored and
gnu-andrew
committed
RH1860986: Disable TLSv1.3 in FIPS mode
1 parent 8971cb5 commit e8b5bf9

File tree

5 files changed

+141
-35
lines changed

5 files changed

+141
-35
lines changed

‎src/java.base/share/classes/java/security/SystemConfigurator.java‎

Lines changed: 41 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
/*
2-
* Copyright (c) 2019, Red Hat, Inc.
2+
* Copyright (c) 2019, 2020, Red Hat, Inc.
33
*
44
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
55
*
66
* This code is free software; you can redistribute it and/or modify it
77
* under the terms of the GNU General Public License version 2 only, as
8-
* published by the Free Software Foundation.
8+
* published by the Free Software Foundation. Oracle designates this
9+
* particular file as subject to the "Classpath" exception as provided
10+
* by Oracle in the LICENSE file that accompanied this code.
911
*
1012
* This code is distributed in the hope that it will be useful, but WITHOUT
1113
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
@@ -34,10 +36,10 @@
3436
import java.util.Iterator;
3537
import java.util.Map.Entry;
3638
import java.util.Properties;
37-
import java.util.function.Consumer;
38-
import java.util.regex.Matcher;
3939
import java.util.regex.Pattern;
4040

41+
import jdk.internal.misc.SharedSecrets;
42+
import jdk.internal.misc.JavaSecuritySystemConfiguratorAccess;
4143
import sun.security.util.Debug;
4244

4345
/**
@@ -47,7 +49,7 @@
4749
*
4850
*/
4951

50-
class SystemConfigurator {
52+
final class SystemConfigurator {
5153

5254
private static final Debug sdebug =
5355
Debug.getInstance("properties");
@@ -61,15 +63,16 @@ class SystemConfigurator {
6163
private static final String CRYPTO_POLICIES_CONFIG =
6264
CRYPTO_POLICIES_BASE_DIR + "/config";
6365

64-
private static final class SecurityProviderInfo {
65-
int number;
66-
String key;
67-
String value;
68-
SecurityProviderInfo(int number, String key, String value) {
69-
this.number = number;
70-
this.key = key;
71-
this.value = value;
72-
}
66+
private static boolean systemFipsEnabled = false;
67+
68+
static {
69+
SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
70+
new JavaSecuritySystemConfiguratorAccess() {
71+
@Override
72+
public boolean isSystemFipsEnabled() {
73+
return SystemConfigurator.isSystemFipsEnabled();
74+
}
75+
});
7376
}
7477

7578
/*
@@ -128,9 +131,9 @@ static boolean configure(Properties props) {
128131
String nonFipsKeystoreType = props.getProperty("keystore.type");
129132
props.put("keystore.type", keystoreTypeValue);
130133
if (keystoreTypeValue.equals("PKCS11")) {
131-
// If keystore.type is PKCS11, javax.net.ssl.keyStore
132-
// must be "NONE". See JDK-8238264.
133-
System.setProperty("javax.net.ssl.keyStore", "NONE");
134+
// If keystore.type is PKCS11, javax.net.ssl.keyStore
135+
// must be "NONE". See JDK-8238264.
136+
System.setProperty("javax.net.ssl.keyStore", "NONE");
134137
}
135138
if (System.getProperty("javax.net.ssl.trustStoreType") == null) {
136139
// If no trustStoreType has been set, use the
@@ -144,12 +147,13 @@ static boolean configure(Properties props) {
144147
sdebug.println("FIPS mode default keystore.type = " +
145148
keystoreTypeValue);
146149
sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
147-
System.getProperty("javax.net.ssl.keyStore", ""));
150+
System.getProperty("javax.net.ssl.keyStore", ""));
148151
sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
149152
System.getProperty("javax.net.ssl.trustStoreType", ""));
150153
}
151154
}
152155
loadedProps = true;
156+
systemFipsEnabled = true;
153157
}
154158
} catch (Exception e) {
155159
if (sdebug != null) {
@@ -160,13 +164,30 @@ static boolean configure(Properties props) {
160164
return loadedProps;
161165
}
162166

167+
/**
168+
* Returns whether or not global system FIPS alignment is enabled.
169+
*
170+
* Value is always 'false' before java.security.Security class is
171+
* initialized.
172+
*
173+
* Call from out of this package through SharedSecrets:
174+
* SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
175+
* .isSystemFipsEnabled();
176+
*
177+
* @return a boolean value indicating whether or not global
178+
* system FIPS alignment is enabled.
179+
*/
180+
static boolean isSystemFipsEnabled() {
181+
return systemFipsEnabled;
182+
}
183+
163184
/*
164185
* FIPS is enabled only if crypto-policies are set to "FIPS"
165186
* and the com.redhat.fips property is true.
166187
*/
167188
private static boolean enableFips() throws Exception {
168-
boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
169-
if (fipsEnabled) {
189+
boolean shouldEnable = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
190+
if (shouldEnable) {
170191
String cryptoPoliciesConfig = new String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG)));
171192
if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); }
172193
Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);

‎src/java.base/share/classes/jdk/internal/misc/JavaSecuritySystemConfiguratorAccess.java‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
/*
2+
* Copyright (c) 2020, Red Hat, Inc.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation. Oracle designates this
8+
* particular file as subject to the "Classpath" exception as provided
9+
* by Oracle in the LICENSE file that accompanied this code.
10+
*
11+
* This code is distributed in the hope that it will be useful, but WITHOUT
12+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+
* version 2 for more details (a copy is included in the LICENSE file that
15+
* accompanied this code).
16+
*
17+
* You should have received a copy of the GNU General Public License version
18+
* 2 along with this work; if not, write to the Free Software Foundation,
19+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+
*
21+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+
* or visit www.oracle.com if you need additional information or have any
23+
* questions.
24+
*/
25+
26+
package jdk.internal.misc;
27+
28+
public interface JavaSecuritySystemConfiguratorAccess {
29+
boolean isSystemFipsEnabled();
30+
}

‎src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ public class SharedSecrets {
7676
private static JavaIORandomAccessFileAccess javaIORandomAccessFileAccess;
7777
private static JavaSecuritySignatureAccess javaSecuritySignatureAccess;
7878
private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess;
79+
private static JavaSecuritySystemConfiguratorAccess javaSecuritySystemConfiguratorAccess;
7980

8081
public static JavaUtilJarAccess javaUtilJarAccess() {
8182
if (javaUtilJarAccess == null) {
@@ -361,4 +362,12 @@ public static JavaxCryptoSealedObjectAccess getJavaxCryptoSealedObjectAccess() {
361362
}
362363
return javaxCryptoSealedObjectAccess;
363364
}
365+
366+
public static void setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) {
367+
javaSecuritySystemConfiguratorAccess = jssca;
368+
}
369+
370+
public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() {
371+
return javaSecuritySystemConfiguratorAccess;
372+
}
364373
}

‎src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java‎

Lines changed: 52 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
import java.security.cert.*;
3232
import java.util.*;
3333
import javax.net.ssl.*;
34+
import jdk.internal.misc.SharedSecrets;
3435
import sun.security.action.GetPropertyAction;
3536
import sun.security.provider.certpath.AlgorithmChecker;
3637
import sun.security.validator.Validator;
@@ -542,20 +543,38 @@ private abstract static class AbstractTLSContext extends SSLContextImpl {
542543

543544
static {
544545
if (SunJSSE.isFIPS()) {
545-
supportedProtocols = Arrays.asList(
546-
ProtocolVersion.TLS13,
547-
ProtocolVersion.TLS12,
548-
ProtocolVersion.TLS11,
549-
ProtocolVersion.TLS10
550-
);
546+
if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
547+
.isSystemFipsEnabled()) {
548+
// RH1860986: TLSv1.3 key derivation not supported with
549+
// the Security Providers available in system FIPS mode.
550+
supportedProtocols = Arrays.asList(
551+
ProtocolVersion.TLS12,
552+
ProtocolVersion.TLS11,
553+
ProtocolVersion.TLS10
554+
);
551555

552-
serverDefaultProtocols = getAvailableProtocols(
553-
new ProtocolVersion[] {
554-
ProtocolVersion.TLS13,
555-
ProtocolVersion.TLS12,
556-
ProtocolVersion.TLS11,
557-
ProtocolVersion.TLS10
558-
});
556+
serverDefaultProtocols = getAvailableProtocols(
557+
new ProtocolVersion[] {
558+
ProtocolVersion.TLS12,
559+
ProtocolVersion.TLS11,
560+
ProtocolVersion.TLS10
561+
});
562+
} else {
563+
supportedProtocols = Arrays.asList(
564+
ProtocolVersion.TLS13,
565+
ProtocolVersion.TLS12,
566+
ProtocolVersion.TLS11,
567+
ProtocolVersion.TLS10
568+
);
569+
570+
serverDefaultProtocols = getAvailableProtocols(
571+
new ProtocolVersion[] {
572+
ProtocolVersion.TLS13,
573+
ProtocolVersion.TLS12,
574+
ProtocolVersion.TLS11,
575+
ProtocolVersion.TLS10
576+
});
577+
}
559578
} else {
560579
supportedProtocols = Arrays.asList(
561580
ProtocolVersion.TLS13,
@@ -620,6 +639,16 @@ boolean isDTLS() {
620639

621640
static ProtocolVersion[] getSupportedProtocols() {
622641
if (SunJSSE.isFIPS()) {
642+
if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
643+
.isSystemFipsEnabled()) {
644+
// RH1860986: TLSv1.3 key derivation not supported with
645+
// the Security Providers available in system FIPS mode.
646+
return new ProtocolVersion[] {
647+
ProtocolVersion.TLS12,
648+
ProtocolVersion.TLS11,
649+
ProtocolVersion.TLS10
650+
};
651+
}
623652
return new ProtocolVersion[] {
624653
ProtocolVersion.TLS13,
625654
ProtocolVersion.TLS12,
@@ -949,6 +978,16 @@ private static List<ProtocolVersion> customizedProtocols(
949978

950979
static ProtocolVersion[] getProtocols() {
951980
if (SunJSSE.isFIPS()) {
981+
if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
982+
.isSystemFipsEnabled()) {
983+
// RH1860986: TLSv1.3 key derivation not supported with
984+
// the Security Providers available in system FIPS mode.
985+
return new ProtocolVersion[] {
986+
ProtocolVersion.TLS12,
987+
ProtocolVersion.TLS11,
988+
ProtocolVersion.TLS10
989+
};
990+
}
952991
return new ProtocolVersion[]{
953992
ProtocolVersion.TLS13,
954993
ProtocolVersion.TLS12,

‎src/java.base/share/classes/sun/security/ssl/SunJSSE.java‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@
2727

2828
import java.security.*;
2929
import java.util.*;
30+
31+
import jdk.internal.misc.SharedSecrets;
3032
import sun.security.rsa.SunRsaSignEntries;
3133
import static sun.security.util.SecurityConstants.PROVIDER_VER;
3234
import static sun.security.provider.SunEntries.createAliases;
@@ -195,8 +197,13 @@ private void doRegister(boolean isfips) {
195197
"sun.security.ssl.SSLContextImpl$TLS11Context", null, null);
196198
ps("SSLContext", "TLSv1.2",
197199
"sun.security.ssl.SSLContextImpl$TLS12Context", null, null);
198-
ps("SSLContext", "TLSv1.3",
199-
"sun.security.ssl.SSLContextImpl$TLS13Context", null, null);
200+
if (!SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
201+
.isSystemFipsEnabled()) {
202+
// RH1860986: TLSv1.3 key derivation not supported with
203+
// the Security Providers available in system FIPS mode.
204+
ps("SSLContext", "TLSv1.3",
205+
"sun.security.ssl.SSLContextImpl$TLS13Context", null, null);
206+
}
200207
ps("SSLContext", "TLS",
201208
"sun.security.ssl.SSLContextImpl$TLSContext",
202209
(isfips? null : createAliases("SSL")), null);

0 commit comments

Comments
 (0)