Skip to content

Commit 0af22dc

Browse files
martinuygnu-andrew
martinuy
authored and
gnu-andrew
committed
RH1860986: Disable TLSv1.3 in FIPS mode
1 parent 76dd306 commit 0af22dc

File tree

5 files changed

+141
-44
lines changed

5 files changed

+141
-44
lines changed

‎src/java.base/share/classes/java/security/SystemConfigurator.java‎

Lines changed: 41 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
/*
2-
* Copyright (c) 2019, Red Hat, Inc.
2+
* Copyright (c) 2019, 2020, Red Hat, Inc.
33
*
44
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
55
*
66
* This code is free software; you can redistribute it and/or modify it
77
* under the terms of the GNU General Public License version 2 only, as
8-
* published by the Free Software Foundation.
8+
* published by the Free Software Foundation. Oracle designates this
9+
* particular file as subject to the "Classpath" exception as provided
10+
* by Oracle in the LICENSE file that accompanied this code.
911
*
1012
* This code is distributed in the hope that it will be useful, but WITHOUT
1113
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
@@ -34,10 +36,10 @@
3436
import java.util.Iterator;
3537
import java.util.Map.Entry;
3638
import java.util.Properties;
37-
import java.util.function.Consumer;
38-
import java.util.regex.Matcher;
3939
import java.util.regex.Pattern;
4040

41+
import jdk.internal.access.JavaSecuritySystemConfiguratorAccess;
42+
import jdk.internal.access.SharedSecrets;
4143
import sun.security.util.Debug;
4244

4345
/**
@@ -47,7 +49,7 @@
4749
*
4850
*/
4951

50-
class SystemConfigurator {
52+
final class SystemConfigurator {
5153

5254
private static final Debug sdebug =
5355
Debug.getInstance("properties");
@@ -61,15 +63,16 @@ class SystemConfigurator {
6163
private static final String CRYPTO_POLICIES_CONFIG =
6264
CRYPTO_POLICIES_BASE_DIR + "/config";
6365

64-
private static final class SecurityProviderInfo {
65-
int number;
66-
String key;
67-
String value;
68-
SecurityProviderInfo(int number, String key, String value) {
69-
this.number = number;
70-
this.key = key;
71-
this.value = value;
72-
}
66+
private static boolean systemFipsEnabled = false;
67+
68+
static {
69+
SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
70+
new JavaSecuritySystemConfiguratorAccess() {
71+
@Override
72+
public boolean isSystemFipsEnabled() {
73+
return SystemConfigurator.isSystemFipsEnabled();
74+
}
75+
});
7376
}
7477

7578
/*
@@ -128,9 +131,9 @@ static boolean configure(Properties props) {
128131
String nonFipsKeystoreType = props.getProperty("keystore.type");
129132
props.put("keystore.type", keystoreTypeValue);
130133
if (keystoreTypeValue.equals("PKCS11")) {
131-
// If keystore.type is PKCS11, javax.net.ssl.keyStore
132-
// must be "NONE". See JDK-8238264.
133-
System.setProperty("javax.net.ssl.keyStore", "NONE");
134+
// If keystore.type is PKCS11, javax.net.ssl.keyStore
135+
// must be "NONE". See JDK-8238264.
136+
System.setProperty("javax.net.ssl.keyStore", "NONE");
134137
}
135138
if (System.getProperty("javax.net.ssl.trustStoreType") == null) {
136139
// If no trustStoreType has been set, use the
@@ -144,12 +147,13 @@ static boolean configure(Properties props) {
144147
sdebug.println("FIPS mode default keystore.type = " +
145148
keystoreTypeValue);
146149
sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
147-
System.getProperty("javax.net.ssl.keyStore", ""));
150+
System.getProperty("javax.net.ssl.keyStore", ""));
148151
sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
149152
System.getProperty("javax.net.ssl.trustStoreType", ""));
150153
}
151154
}
152155
loadedProps = true;
156+
systemFipsEnabled = true;
153157
}
154158
} catch (Exception e) {
155159
if (sdebug != null) {
@@ -160,13 +164,30 @@ static boolean configure(Properties props) {
160164
return loadedProps;
161165
}
162166

167+
/**
168+
* Returns whether or not global system FIPS alignment is enabled.
169+
*
170+
* Value is always 'false' before java.security.Security class is
171+
* initialized.
172+
*
173+
* Call from out of this package through SharedSecrets:
174+
* SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
175+
* .isSystemFipsEnabled();
176+
*
177+
* @return a boolean value indicating whether or not global
178+
* system FIPS alignment is enabled.
179+
*/
180+
static boolean isSystemFipsEnabled() {
181+
return systemFipsEnabled;
182+
}
183+
163184
/*
164185
* FIPS is enabled only if crypto-policies are set to "FIPS"
165186
* and the com.redhat.fips property is true.
166187
*/
167188
private static boolean enableFips() throws Exception {
168-
boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
169-
if (fipsEnabled) {
189+
boolean shouldEnable = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
190+
if (shouldEnable) {
170191
String cryptoPoliciesConfig = new String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG)));
171192
if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); }
172193
Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);

‎src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
/*
2+
* Copyright (c) 2020, Red Hat, Inc.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation. Oracle designates this
8+
* particular file as subject to the "Classpath" exception as provided
9+
* by Oracle in the LICENSE file that accompanied this code.
10+
*
11+
* This code is distributed in the hope that it will be useful, but WITHOUT
12+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+
* version 2 for more details (a copy is included in the LICENSE file that
15+
* accompanied this code).
16+
*
17+
* You should have received a copy of the GNU General Public License version
18+
* 2 along with this work; if not, write to the Free Software Foundation,
19+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+
*
21+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+
* or visit www.oracle.com if you need additional information or have any
23+
* questions.
24+
*/
25+
26+
package jdk.internal.access;
27+
28+
public interface JavaSecuritySystemConfiguratorAccess {
29+
boolean isSystemFipsEnabled();
30+
}

‎src/java.base/share/classes/jdk/internal/access/SharedSecrets.java‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ public class SharedSecrets {
8181
private static JavaSecuritySpecAccess javaSecuritySpecAccess;
8282
private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess;
8383
private static JavaxCryptoSpecAccess javaxCryptoSpecAccess;
84+
private static JavaSecuritySystemConfiguratorAccess javaSecuritySystemConfiguratorAccess;
8485

8586
public static void setJavaUtilCollectionAccess(JavaUtilCollectionAccess juca) {
8687
javaUtilCollectionAccess = juca;
@@ -442,4 +443,12 @@ private static void ensureClassInitialized(Class<?> c) {
442443
MethodHandles.lookup().ensureInitialized(c);
443444
} catch (IllegalAccessException e) {}
444445
}
446+
447+
public static void setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) {
448+
javaSecuritySystemConfiguratorAccess = jssca;
449+
}
450+
451+
public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() {
452+
return javaSecuritySystemConfiguratorAccess;
453+
}
445454
}

‎src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java‎

Lines changed: 52 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
import java.util.*;
3333
import java.util.concurrent.locks.ReentrantLock;
3434
import javax.net.ssl.*;
35+
import jdk.internal.access.SharedSecrets;
3536
import sun.security.action.GetPropertyAction;
3637
import sun.security.provider.certpath.AlgorithmChecker;
3738
import sun.security.validator.Validator;
@@ -536,22 +537,40 @@ private abstract static class AbstractTLSContext extends SSLContextImpl {
536537
private static final List<CipherSuite> serverDefaultCipherSuites;
537538

538539
static {
539-
supportedProtocols = Arrays.asList(
540-
ProtocolVersion.TLS13,
541-
ProtocolVersion.TLS12,
542-
ProtocolVersion.TLS11,
543-
ProtocolVersion.TLS10,
544-
ProtocolVersion.SSL30,
545-
ProtocolVersion.SSL20Hello
546-
);
547-
548-
serverDefaultProtocols = getAvailableProtocols(
549-
new ProtocolVersion[] {
550-
ProtocolVersion.TLS13,
551-
ProtocolVersion.TLS12,
552-
ProtocolVersion.TLS11,
553-
ProtocolVersion.TLS10
554-
});
540+
if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
541+
.isSystemFipsEnabled()) {
542+
// RH1860986: TLSv1.3 key derivation not supported with
543+
// the Security Providers available in system FIPS mode.
544+
supportedProtocols = Arrays.asList(
545+
ProtocolVersion.TLS12,
546+
ProtocolVersion.TLS11,
547+
ProtocolVersion.TLS10
548+
);
549+
550+
serverDefaultProtocols = getAvailableProtocols(
551+
new ProtocolVersion[] {
552+
ProtocolVersion.TLS12,
553+
ProtocolVersion.TLS11,
554+
ProtocolVersion.TLS10
555+
});
556+
} else {
557+
supportedProtocols = Arrays.asList(
558+
ProtocolVersion.TLS13,
559+
ProtocolVersion.TLS12,
560+
ProtocolVersion.TLS11,
561+
ProtocolVersion.TLS10,
562+
ProtocolVersion.SSL30,
563+
ProtocolVersion.SSL20Hello
564+
);
565+
566+
serverDefaultProtocols = getAvailableProtocols(
567+
new ProtocolVersion[] {
568+
ProtocolVersion.TLS13,
569+
ProtocolVersion.TLS12,
570+
ProtocolVersion.TLS11,
571+
ProtocolVersion.TLS10
572+
});
573+
}
555574

556575
supportedCipherSuites = getApplicableSupportedCipherSuites(
557576
supportedProtocols);
@@ -842,12 +861,23 @@ private static List<ProtocolVersion> customizedProtocols(
842861
ProtocolVersion[] candidates;
843862
if (refactored.isEmpty()) {
844863
// Client and server use the same default protocols.
845-
candidates = new ProtocolVersion[] {
846-
ProtocolVersion.TLS13,
847-
ProtocolVersion.TLS12,
848-
ProtocolVersion.TLS11,
849-
ProtocolVersion.TLS10
850-
};
864+
if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
865+
.isSystemFipsEnabled()) {
866+
// RH1860986: TLSv1.3 key derivation not supported with
867+
// the Security Providers available in system FIPS mode.
868+
candidates = new ProtocolVersion[] {
869+
ProtocolVersion.TLS12,
870+
ProtocolVersion.TLS11,
871+
ProtocolVersion.TLS10
872+
};
873+
} else {
874+
candidates = new ProtocolVersion[] {
875+
ProtocolVersion.TLS13,
876+
ProtocolVersion.TLS12,
877+
ProtocolVersion.TLS11,
878+
ProtocolVersion.TLS10
879+
};
880+
}
851881
} else {
852882
// Use the customized TLS protocols.
853883
candidates =

‎src/java.base/share/classes/sun/security/ssl/SunJSSE.java‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@
2727

2828
import java.security.*;
2929
import java.util.*;
30+
31+
import jdk.internal.access.SharedSecrets;
3032
import static sun.security.util.SecurityConstants.PROVIDER_VER;
3133

3234
/**
@@ -102,8 +104,13 @@ private void doRegister() {
102104
"sun.security.ssl.SSLContextImpl$TLS11Context", null, null);
103105
ps("SSLContext", "TLSv1.2",
104106
"sun.security.ssl.SSLContextImpl$TLS12Context", null, null);
105-
ps("SSLContext", "TLSv1.3",
106-
"sun.security.ssl.SSLContextImpl$TLS13Context", null, null);
107+
if (!SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
108+
.isSystemFipsEnabled()) {
109+
// RH1860986: TLSv1.3 key derivation not supported with
110+
// the Security Providers available in system FIPS mode.
111+
ps("SSLContext", "TLSv1.3",
112+
"sun.security.ssl.SSLContextImpl$TLS13Context", null, null);
113+
}
107114
ps("SSLContext", "TLS",
108115
"sun.security.ssl.SSLContextImpl$TLSContext",
109116
List.of("SSL"), null);

0 commit comments

Comments
 (0)