Skip to content

Support SecureRandom strong algorithms in FIPS mode #446

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Mohit-Rajbhar100698 wants to merge 1 commit into
base: openj9
Choose a base branch
from
Open

Support SecureRandom strong algorithms in FIPS mode #446

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -613,6 +613,7 @@ private static void setProperties(Properties props) {
propsMapping.put("jdk.tls.legacyAlgorithms", restricts.jdkTlsLegacyAlgorithms);
propsMapping.put("jdk.certpath.disabledAlgorithms", restricts.jdkCertpathDisabledAlgorithms);
propsMapping.put("jdk.security.legacyAlgorithms", restricts.jdkSecurityLegacyAlgorithms);
propsMapping.put("securerandom.strongAlgorithms", restricts.jdkSecureRandomStrongAlgorithms);

if (restricts.descIsFIPS) {
if (restricts.jdkFipsMode == null) {
Expand Down Expand Up @@ -820,6 +821,7 @@ private static final class RestrictedSecurityProperties {
// For SecureRandom.
final String jdkSecureRandomProvider;
final String jdkSecureRandomAlgorithm;
final String jdkSecureRandomStrongAlgorithms;

final String jdkFipsMode;

Expand Down Expand Up @@ -855,6 +857,7 @@ private RestrictedSecurityProperties(String profileID, ProfileParser parser) {
// For SecureRandom.
this.jdkSecureRandomProvider = parser.getProperty("jdkSecureRandomProvider");
this.jdkSecureRandomAlgorithm = parser.getProperty("jdkSecureRandomAlgorithm");
this.jdkSecureRandomStrongAlgorithms = parser.getProperty("jdkSecureRandomStrongAlgorithms");

this.jdkFipsMode = parser.getProperty("jdkFipsMode");

Expand Down Expand Up @@ -1150,6 +1153,7 @@ private void listUsedProfile() {
printProperty(profileID + ".javax.net.ssl.keyStore: ", keyStore);
printProperty(profileID + ".securerandom.provider: ", jdkSecureRandomProvider);
printProperty(profileID + ".securerandom.algorithm: ", jdkSecureRandomAlgorithm);
printProperty(profileID + ".securerandom.strongAlgorithms: ", jdkSecureRandomStrongAlgorithms);
System.out.println();
}

Expand Down Expand Up @@ -1553,6 +1557,9 @@ private String getExistingValue(String property) {
case "jdkTlsLegacyAlgorithms":
propertyKey = "jdk.tls.legacyAlgorithms";
break;
case "jdkSecureRandomStrongAlgorithms":
propertyKey = "securerandom.strongAlgorithms";
break;
default:
return null;
}
Expand Down Expand Up @@ -1608,6 +1615,8 @@ private void loadProperties(String profileID, List<String> allInfo) {
profileID + ".securerandom.provider", allInfo);
setProperty("jdkSecureRandomAlgorithm",
profileID + ".securerandom.algorithm", allInfo);
setProperty("jdkSecureRandomStrongAlgorithms",
profileID + ".securerandom.strongAlgorithms", allInfo);
setProperty("jdkFipsMode",
profileID + ".fips.mode", allInfo);

Expand Down Expand Up @@ -1953,6 +1962,7 @@ private static boolean isPropertyAppendable(String property) {
case "jdkTlsDisabledAlgorithms":
case "jdkTlsDisabledNamedCurves":
case "jdkTlsLegacyAlgorithms":
case "jdkSecureRandomStrongAlgorithms":
return true;
default:
return false;
Expand Down
89 changes: 89 additions & 0 deletions closed/test/jdk/openj9/internal/security/TestProperties.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -202,6 +202,69 @@ private static Stream<Arguments> patternMatches_propertiesList() {
return tests.build();
}

private static Stream<Arguments> patternMatches_strongAlgorithms() {
Stream.Builder<Arguments> tests = Stream.builder();

// 1 - Test property - base profile with securerandom.strongAlgorithms loads successfully.
tests.add(Arguments.of("Test-Profile-strongAlgorithms",
System.getProperty("test.src") + "/property-java.security",
"(?s)(?=.*OpenJCEPlusFIPS)(?=.*SUN)(?=.*SunJSSE)",
0));
// 2 - Test property - securerandom.strongAlgorithms property with multiple algorithms.
tests.add(Arguments.of("Test-Profile-strongAlgorithms-MultipleEntries",
System.getProperty("test.src") + "/property-java.security",
"securerandom\\.strongAlgorithms: SHA512DRBG:OpenJCEPlusFIPS, SHA256DRBG:OpenJCEPlusFIPS",
0));
// 3 - Test property - securerandom.strongAlgorithms append algorithm in extended profile.
tests.add(Arguments.of("Test-Profile-strongAlgorithms-Extension_1",
System.getProperty("test.src") + "/property-java.security",
"securerandom\\.strongAlgorithms: SHA512DRBG:OpenJCEPlusFIPS, SHA256DRBG:OpenJCEPlusFIPS",
0));
// 4 - Test property - securerandom.strongAlgorithms remove algorithm in extended profile.
tests.add(Arguments.of("Test-Profile-strongAlgorithms-Extension_2",
System.getProperty("test.src") + "/property-java.security",
"securerandom\\.strongAlgorithms: (NativePRNGBlocking:SUN|Windows-PRNG:SunMSCAPI),DRBG:SUN",
0));
// 5 - Test property - securerandom.strongAlgorithms invalid algorithm.
tests.add(Arguments.of("Test-Profile-strongAlgorithms-InvalidFormat",
System.getProperty("test.src") + "/property-java.security",
"FAILED: No strong SecureRandom impls available: .*",
0));
// 6 - Test property - securerandom.strongAlgorithms missing algorithm.
tests.add(Arguments.of("Test-Profile-strongAlgorithms-MissingAlgo",
System.getProperty("test.src") + "/property-java.security",
"FAILED: No strong SecureRandom impls available: .*",
0));
// 7 - Test property - securerandom.strongAlgorithms missing provider.
tests.add(Arguments.of("Test-Profile-strongAlgorithms-MissingProvider",
System.getProperty("test.src") + "/property-java.security",
"FAILED: missing provider",
0));
// 8 - Test property - set invalid provider.
tests.add(Arguments.of("Test-Profile-strongAlgorithms-InvalidProvider",
System.getProperty("test.src") + "/property-java.security",
"FAILED: No strong SecureRandom impls available: .*",
0));
// 9 - Test property - securerandom.strongAlgorithms when only algorithm is present.
tests.add(Arguments.of("Test-Profile-strongAlgorithms-Specify-Algo-Only",
System.getProperty("test.src") + "/property-java.security",
"securerandom\\.strongAlgorithms: SHA(256|512)DRBG$",
0));
// 10 - Test property - invalid algorithm.
tests.add(Arguments.of("Test-Profile-strongAlgorithms-InvalidAlgorithm",
System.getProperty("test.src") + "/property-java.security",
"FAILED: No strong SecureRandom impls available: .*",
0));
// 11 - Test property - securerandom.strongAlgorithms misspelled property name.
tests.add(Arguments.of("Test-Profile-strongAlgorithms-MisspelledPropertyName",
System.getProperty("test.src") + "/property-java.security",
"The property names: RestrictedSecurity.Test-Profile-strongAlgorithms-MisspelledPropertyName.securerandom.strongAlgorithmsWrong "
+ "in profile RestrictedSecurity.Test-Profile-strongAlgorithms-MisspelledPropertyName \\(or a base profile\\) are not recognized",
1));

return tests.build();
}

private static Stream<Arguments> patternMatches_systemProperties() {
return Stream.of(
// 1 - Test property - base profile with javax.net.ssl.keyStore loads successfully.
Expand Down Expand Up @@ -256,6 +319,19 @@ public void shouldContain_propertiesList(String customprofile, String securityPr
outputAnalyzer.shouldHaveExitValue(exitValue).shouldMatch(expected);
}

@ParameterizedTest
@MethodSource("patternMatches_strongAlgorithms")
public void shouldContain_strongAlgorithms(String customprofile, String securityPropertyFile, String expected, int exitValue) throws Exception {
OutputAnalyzer outputAnalyzer = ProcessTools.executeTestJava(
"-Dsemeru.fips=true",
"-Dsemeru.customprofile=" + customprofile,
"-Djava.security.properties=" + securityPropertyFile,
"TestProperties"
);
outputAnalyzer.reportDiagnosticSummary();
outputAnalyzer.shouldHaveExitValue(exitValue).shouldMatch(expected);
}

@ParameterizedTest
@MethodSource("patternMatches_systemProperties")
public void shouldContain_systemProperties(String customprofile, String securityPropertyFile, String expected, int exitValue) throws Exception {
Expand All @@ -278,6 +354,18 @@ private static boolean isProviderPresent(String providerName) {
return false;
}

private static void testStrongAlgorithms() {
String strongAlgorithms = Security.getProperty("securerandom.strongAlgorithms");
if ((strongAlgorithms != null) && !strongAlgorithms.isEmpty()) {
try {
java.security.SecureRandom.getInstanceStrong();
System.out.println("securerandom.strongAlgorithms: " + strongAlgorithms);
} catch (java.security.NoSuchAlgorithmException | IllegalArgumentException e) {
System.out.println("FAILED: " + e.getMessage());
}
}
}

private static void testSystemProperties() {
// Test javax.net.ssl.keyStore system property.
String keyStore = System.getProperty("javax.net.ssl.keyStore");
Expand All @@ -299,6 +387,7 @@ public static void main(String[] args) {
System.out.println("Provider Name: " + provider.getName());
System.out.println("Provider Version: " + provider.getVersionStr());
}
testStrongAlgorithms();
testSystemProperties();
} catch (Exception e) {
System.out.println(e);
Expand Down
Loading