Skip to content

Commit db1512b

Browse files
committed
Disable specific locales for tests in fips mode
The Bouncy Castle FIPS provider that we use for running our tests in fips mode has an issue with locale sensitive handling of Dates as described in bcgit/bc-java#405 This causes certificate validation to fail if any given test that includes some form of certificate validation happens to run in one of the locales. This manifested earlier in elastic#33081 which was handled insufficiently in elastic#33299 This change ensures that the problematic 3 locales * th-TH * ja-JP-u-ca-japanese-x-lvariant-JP * th-TH-u-nu-thai-x-lvariant-TH will not be used when running our tests in a FIPS 140 JVM. It also reverts elastic#33299
1 parent 3f1125f commit db1512b

File tree

2 files changed

+28
-33
lines changed

2 files changed

+28
-33
lines changed

test/framework/src/main/java/org/elasticsearch/test/ESTestCase.java

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,8 @@ public abstract class ESTestCase extends LuceneTestCase {
193193

194194
private static final Collection<String> nettyLoggedLeaks = new ArrayList<>();
195195

196+
private static Locale restoreLocale;
197+
196198
@AfterClass
197199
public static void resetPortCounter() {
198200
portGenerator.set(0);
@@ -327,6 +329,26 @@ public static void restoreContentType() {
327329
Requests.INDEX_CONTENT_TYPE = XContentType.JSON;
328330
}
329331

332+
@BeforeClass
333+
public static void ensureSupportedLocale() {
334+
if (isUnusableLocale()) {
335+
// See: https://github.com/bcgit/bc-java/issues/405
336+
Logger logger = LogManager.getLogger(ESTestCase.class);
337+
logger.warn("Attempting to run tests in an unusable locale in a FIPS JVM. Certificate expiration validation will fail, " +
338+
"switching to English");
339+
restoreLocale = Locale.getDefault();
340+
Locale.setDefault(Locale.ENGLISH);
341+
}
342+
}
343+
344+
@AfterClass
345+
public static void restoreLocale() {
346+
if (restoreLocale != null) {
347+
Locale.setDefault(restoreLocale);
348+
restoreLocale = null;
349+
}
350+
}
351+
330352
@Before
331353
public final void before() {
332354
logger.info("{}before test", getTestParamsForLogging());
@@ -1419,6 +1441,12 @@ public TestAnalysis(IndexAnalyzers indexAnalyzers,
14191441
}
14201442
}
14211443

1444+
private static boolean isUnusableLocale() {
1445+
return inFipsJvm() && (Locale.getDefault().toLanguageTag().equals("th-TH")
1446+
|| Locale.getDefault().toLanguageTag().equals("ja-JP-u-ca-japanese-x-lvariant-JP")
1447+
|| Locale.getDefault().toLanguageTag().equals("th-TH-u-nu-thai-x-lvariant-TH"));
1448+
}
1449+
14221450
public static boolean inFipsJvm() {
14231451
return Security.getProviders()[0].getName().toLowerCase(Locale.ROOT).contains("fips");
14241452
}

x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/ssl/RestrictedTrustManagerTests.java

Lines changed: 0 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,11 @@
55
*/
66
package org.elasticsearch.xpack.core.ssl;
77

8-
import org.apache.logging.log4j.Logger;
9-
import org.apache.logging.log4j.LogManager;
108
import org.elasticsearch.test.ESTestCase;
119
import org.hamcrest.Description;
1210
import org.hamcrest.TypeSafeMatcher;
13-
import org.junit.AfterClass;
1411
import org.junit.Assert;
1512
import org.junit.Before;
16-
import org.junit.BeforeClass;
1713

1814
import javax.net.ssl.X509ExtendedTrustManager;
1915

@@ -32,7 +28,6 @@
3228
import java.util.Collections;
3329
import java.util.HashMap;
3430
import java.util.List;
35-
import java.util.Locale;
3631
import java.util.Map;
3732
import java.util.Objects;
3833
import java.util.regex.Pattern;
@@ -45,34 +40,6 @@ public class RestrictedTrustManagerTests extends ESTestCase {
4540
private int numberOfClusters;
4641
private int numberOfNodes;
4742

48-
private static Locale restoreLocale;
49-
50-
@BeforeClass
51-
public static void ensureSupportedLocale() throws Exception {
52-
Logger logger = LogManager.getLogger(RestrictedTrustManagerTests.class);
53-
if (isUnusableLocale()) {
54-
// See: https://github.com/elastic/elasticsearch/issues/33081
55-
logger.warn("Attempting to run RestrictedTrustManagerTests tests in an unusable locale in a FIPS JVM. Certificate expiration " +
56-
"validation will fail, switching to English");
57-
restoreLocale = Locale.getDefault();
58-
Locale.setDefault(Locale.ENGLISH);
59-
}
60-
}
61-
62-
private static boolean isUnusableLocale() {
63-
return inFipsJvm() && (Locale.getDefault().toLanguageTag().equals("th-TH")
64-
|| Locale.getDefault().toLanguageTag().equals("ja-JP-u-ca-japanese-x-lvariant-JP")
65-
|| Locale.getDefault().toLanguageTag().equals("th-TH-u-nu-thai-x-lvariant-TH"));
66-
}
67-
68-
@AfterClass
69-
public static void restoreLocale() throws Exception {
70-
if (restoreLocale != null) {
71-
Locale.setDefault(restoreLocale);
72-
restoreLocale = null;
73-
}
74-
}
75-
7643
@Before
7744
public void readCertificates() throws GeneralSecurityException, IOException {
7845

0 commit comments

Comments
 (0)