RH2134669: Add missing attributes when registering services in FIPS mode. #19
Conversation
franferrax
left a comment
franferrax
left a comment
There was a problem hiding this comment.
Hi @martinuy,
This looks good to me, I've also checked similar systemFipsEnabled lock-down usages in other providers but everything seems fine.
I left a comment in the test, but it doesn't block the approval, it's up to you if you want to simplify the code or not.
Just for reference, here is the comment where we identified this issue: rh-openjdk/jdk11u#5 (comment)
…I, instead of the Map one.
|
@franferrax please have a look again. Thanks. |
gnu-andrew
left a comment
gnu-andrew
left a comment
There was a problem hiding this comment.
Looks good to me too. We only need to block provider additions that would allow non-FIPS crypto to take place.
|
Test failures seem to be just a download issue on Windows and the known issue due to debugging output that was since resolved when we merged 17.0.5. Merging this. |
…ode. (#19) Reviewed-by: @franferrax, @gnu-andrew
3 participants
Search this PR in Red Hat Jira
As described in RH2134669 [1], I'd like to propose a fix for this issue that keeps the attributes for registered services and algorithms aligned between FIPS and non-FIPS modes. According to my assessment, the only security providers affected by this issue were SUN (SunEntries.java) and SunRsaSign (SunRsaSignEntries.java).
--
[1] - https://bugzilla.redhat.com/show_bug.cgi?id=2134669