Skip to content

Commit 2117cd2

Browse files
Mohit-Rajbhar100698Mohit-Rajbhar100698
committed
Support SecureRandom strong algorithms in FIPS mode
This change overrides the default securerandom.strongAlgorithms configuration used by SecureRandom.getInstanceStrong() when it runs in FIPS mode. Signed-off-by: Mohit Rajbhar <mohit.rajbhar@ibm.com>
1 parent 4f1b233 commit 2117cd2

4 files changed

Lines changed: 251 additions & 1 deletion

File tree

‎closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -613,6 +613,7 @@ private static void setProperties(Properties props) {
613613
propsMapping.put("jdk.tls.legacyAlgorithms", restricts.jdkTlsLegacyAlgorithms);
614614
propsMapping.put("jdk.certpath.disabledAlgorithms", restricts.jdkCertpathDisabledAlgorithms);
615615
propsMapping.put("jdk.security.legacyAlgorithms", restricts.jdkSecurityLegacyAlgorithms);
616+
propsMapping.put("securerandom.strongAlgorithms", restricts.jdkSecureRandomStrongAlgorithms);
616617

617618
if (restricts.descIsFIPS) {
618619
if (restricts.jdkFipsMode == null) {
@@ -820,6 +821,7 @@ private static final class RestrictedSecurityProperties {
820821
// For SecureRandom.
821822
final String jdkSecureRandomProvider;
822823
final String jdkSecureRandomAlgorithm;
824+
final String jdkSecureRandomStrongAlgorithms;
823825

824826
final String jdkFipsMode;
825827

@@ -855,6 +857,7 @@ private RestrictedSecurityProperties(String profileID, ProfileParser parser) {
855857
// For SecureRandom.
856858
this.jdkSecureRandomProvider = parser.getProperty("jdkSecureRandomProvider");
857859
this.jdkSecureRandomAlgorithm = parser.getProperty("jdkSecureRandomAlgorithm");
860+
this.jdkSecureRandomStrongAlgorithms = parser.getProperty("jdkSecureRandomStrongAlgorithms");
858861

859862
this.jdkFipsMode = parser.getProperty("jdkFipsMode");
860863

@@ -1150,6 +1153,7 @@ private void listUsedProfile() {
11501153
printProperty(profileID + ".javax.net.ssl.keyStore: ", keyStore);
11511154
printProperty(profileID + ".securerandom.provider: ", jdkSecureRandomProvider);
11521155
printProperty(profileID + ".securerandom.algorithm: ", jdkSecureRandomAlgorithm);
1156+
printProperty(profileID + ".securerandom.strongAlgorithms: ", jdkSecureRandomStrongAlgorithms);
11531157
System.out.println();
11541158
}
11551159

@@ -1556,6 +1560,9 @@ private String getExistingValue(String property) {
15561560
case "jdkTlsLegacyAlgorithms":
15571561
propertyKey = "jdk.tls.legacyAlgorithms";
15581562
break;
1563+
case "jdkSecureRandomStrongAlgorithms":
1564+
propertyKey = "securerandom.strongAlgorithms";
1565+
break;
15591566
default:
15601567
return null;
15611568
}
@@ -1611,6 +1618,8 @@ private void loadProperties(String profileID, List<String> allInfo) {
16111618
profileID + ".securerandom.provider", allInfo);
16121619
setProperty("jdkSecureRandomAlgorithm",
16131620
profileID + ".securerandom.algorithm", allInfo);
1621+
setProperty("jdkSecureRandomStrongAlgorithms",
1622+
profileID + ".securerandom.strongAlgorithms", allInfo);
16141623
setProperty("jdkFipsMode",
16151624
profileID + ".fips.mode", allInfo);
16161625

@@ -1957,6 +1966,7 @@ private static boolean isPropertyAppendable(String property) {
19571966
case "jdkTlsDisabledAlgorithms":
19581967
case "jdkTlsDisabledNamedCurves":
19591968
case "jdkTlsLegacyAlgorithms":
1969+
case "jdkSecureRandomStrongAlgorithms":
19601970
return true;
19611971
default:
19621972
return false;

‎closed/test/jdk/openj9/internal/security/TestProperties.java‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,71 @@ private static Stream<Arguments> patternMatches_propertiesList() {
202202
return tests.build();
203203
}
204204

205+
private static Stream<Arguments> patternMatches_strongAlgorithms() {
206+
Stream.Builder<Arguments> tests = Stream.builder();
207+
208+
if (isProviderPresent("OpenJCEPlusFIPS")) {
209+
// 1 - Test property - base profile with securerandom.strongAlgorithms loads successfully.
210+
tests.add(Arguments.of("Test-Profile-strongAlgorithms",
211+
System.getProperty("test.src") + "/property-java.security",
212+
"(?s)(?=.*OpenJCEPlusFIPS)(?=.*SUN)(?=.*SunJSSE)",
213+
0));
214+
// 2 - Test property - securerandom.strongAlgorithms property with multiple algorithms.
215+
tests.add(Arguments.of("Test-Profile-strongAlgorithms-MultipleEntries",
216+
System.getProperty("test.src") + "/property-java.security",
217+
"securerandom\\.strongAlgorithms: SHA512DRBG:OpenJCEPlusFIPS, SHA256DRBG:OpenJCEPlusFIPS",
218+
0));
219+
// 3 - Test property - securerandom.strongAlgorithms append algorithm in extended profile.
220+
tests.add(Arguments.of("Test-Profile-strongAlgorithms-Extension_1",
221+
System.getProperty("test.src") + "/property-java.security",
222+
"securerandom\\.strongAlgorithms: SHA512DRBG:OpenJCEPlusFIPS, SHA256DRBG:OpenJCEPlusFIPS",
223+
0));
224+
// 4 - Test property - securerandom.strongAlgorithms remove algorithm in extended profile.
225+
tests.add(Arguments.of("Test-Profile-strongAlgorithms-Extension_2",
226+
System.getProperty("test.src") + "/property-java.security",
227+
"securerandom\\.strongAlgorithms: (?=.*NativePRNGBlocking:SUN)(?=.*DRBG:SUN)",
228+
0));
229+
// 5 - Test property - securerandom.strongAlgorithms invalid algorithm.
230+
tests.add(Arguments.of("Test-Profile-strongAlgorithms-InvalidFormat",
231+
System.getProperty("test.src") + "/property-java.security",
232+
"FAILED: No strong SecureRandom impls available: .*",
233+
0));
234+
// 6 - Test property - securerandom.strongAlgorithms missing algorithm.
235+
tests.add(Arguments.of("Test-Profile-strongAlgorithms-MissingAlgo",
236+
System.getProperty("test.src") + "/property-java.security",
237+
"FAILED: No strong SecureRandom impls available: .*",
238+
0));
239+
// 7 - Test property - securerandom.strongAlgorithms missing provider.
240+
tests.add(Arguments.of("Test-Profile-strongAlgorithms-MissingProvider",
241+
System.getProperty("test.src") + "/property-java.security",
242+
"FAILED: missing provider",
243+
0));
244+
// 8 - Test property - set invalid provider.
245+
tests.add(Arguments.of("Test-Profile-strongAlgorithms-InvalidProvider",
246+
System.getProperty("test.src") + "/property-java.security",
247+
"FAILED: No strong SecureRandom impls available: .*",
248+
0));
249+
// 9 - Test property - securerandom.strongAlgorithms when only algorithm is present.
250+
tests.add(Arguments.of("Test-Profile-strongAlgorithms-Specify-Algo-Only",
251+
System.getProperty("test.src") + "/property-java.security",
252+
"securerandom\\.strongAlgorithms: SHA(256|512)DRBG$",
253+
0));
254+
// 10 - Test property - invalid algorithm.
255+
tests.add(Arguments.of("Test-Profile-strongAlgorithms-InvalidAlgorithm",
256+
System.getProperty("test.src") + "/property-java.security",
257+
"FAILED: No strong SecureRandom impls available: .*",
258+
0));
259+
// 11 - Test property - securerandom.strongAlgorithms misspelled property name.
260+
tests.add(Arguments.of("Test-Profile-strongAlgorithms-MisspelledPropertyName",
261+
System.getProperty("test.src") + "/property-java.security",
262+
"The property names: RestrictedSecurity.Test-Profile-strongAlgorithms-MisspelledPropertyName.securerandom.strongAlgorithmsWrong "
263+
+ "in profile RestrictedSecurity.Test-Profile-strongAlgorithms-MisspelledPropertyName \\(or a base profile\\) are not recognized",
264+
1));
265+
}
266+
267+
return tests.build();
268+
}
269+
205270
private static Stream<Arguments> patternMatches_systemProperties() {
206271
return Stream.of(
207272
// 1 - Test property - base profile with javax.net.ssl.keyStore loads successfully.
@@ -256,6 +321,19 @@ public void shouldContain_propertiesList(String customprofile, String securityPr
256321
outputAnalyzer.shouldHaveExitValue(exitValue).shouldMatch(expected);
257322
}
258323

324+
@ParameterizedTest
325+
@MethodSource("patternMatches_strongAlgorithms")
326+
public void shouldContain_strongAlgorithms(String customprofile, String securityPropertyFile, String expected, int exitValue) throws Exception {
327+
OutputAnalyzer outputAnalyzer = ProcessTools.executeTestJava(
328+
"-Dsemeru.fips=true",
329+
"-Dsemeru.customprofile=" + customprofile,
330+
"-Djava.security.properties=" + securityPropertyFile,
331+
"TestProperties"
332+
);
333+
outputAnalyzer.reportDiagnosticSummary();
334+
outputAnalyzer.shouldHaveExitValue(exitValue).shouldMatch(expected);
335+
}
336+
259337
@ParameterizedTest
260338
@MethodSource("patternMatches_systemProperties")
261339
public void shouldContain_systemProperties(String customprofile, String securityPropertyFile, String expected, int exitValue) throws Exception {
@@ -278,6 +356,20 @@ private static boolean isProviderPresent(String providerName) {
278356
return false;
279357
}
280358

359+
private static void testStrongAlgorithms() {
360+
if (isProviderPresent("OpenJCEPlusFIPS")) {
361+
String strongAlgorithms = Security.getProperty("securerandom.strongAlgorithms");
362+
if ((strongAlgorithms != null) && !strongAlgorithms.isEmpty()) {
363+
try {
364+
java.security.SecureRandom.getInstanceStrong();
365+
System.out.println("securerandom.strongAlgorithms: " + strongAlgorithms);
366+
} catch (java.security.NoSuchAlgorithmException | IllegalArgumentException e) {
367+
System.out.println("FAILED: " + e.getMessage());
368+
}
369+
}
370+
}
371+
}
372+
281373
private static void testSystemProperties() {
282374
// Test javax.net.ssl.keyStore system property.
283375
String keyStore = System.getProperty("javax.net.ssl.keyStore");
@@ -299,6 +391,7 @@ public static void main(String[] args) {
299391
System.out.println("Provider Name: " + provider.getName());
300392
System.out.println("Provider Version: " + provider.getVersionStr());
301393
}
394+
testStrongAlgorithms();
302395
testSystemProperties();
303396
} catch (Exception e) {
304397
System.out.println(e);

0 commit comments

Comments
 (0)