Skip to content

Commit 0bee0a8

Browse files
iigoniniigonin
committed
make tests run without BC (not BCFIPS) libraries.
Signed-off-by: Iwan Igonin <[email protected]> # Conflicts: # client/rest/build.gradle # distribution/tools/plugin-cli/build.gradle # server/src/main/resources/org/opensearch/bootstrap/test-framework.policy
1 parent a47f4e6 commit 0bee0a8

File tree

53 files changed

+455
-231
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+455
-231
lines changed

‎buildSrc/build.gradle

+1-1
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ dependencies {
123123
api 'org.jruby.joni:joni:2.2.1'
124124
api "com.fasterxml.jackson.core:jackson-databind:${props.getProperty('jackson_databind')}"
125125
api "org.ajoberstar.grgit:grgit-core:5.2.1"
126-
api "org.bouncycastle:bc-fips:1.0.2.5"
126+
api "org.bouncycastle:bc-fips:${props.getProperty('bouncycastle_jce')}"
127127

128128

129129
testFixturesApi "junit:junit:${props.getProperty('junit')}"

‎buildSrc/src/main/java/org/opensearch/gradle/OpenSearchTestBasePlugin.java

+5
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,11 @@ public void execute(Task t) {
164164
test.systemProperty("tests.seed", BuildParams.getTestSeed());
165165
}
166166

167+
test.systemProperty(
168+
"java.security.properties",
169+
project.getRootProject().getLayout().getProjectDirectory() + "/distribution/src/config/fips_java.security"
170+
);
171+
167172
// don't track these as inputs since they contain absolute paths and break cache relocatability
168173
File gradleHome = project.getGradle().getGradleUserHomeDir();
169174
String gradleVersion = project.getGradle().getGradleVersion();

‎buildSrc/src/main/java/org/opensearch/gradle/info/BuildParams.java

-1
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,6 @@ public class BuildParams {
5252
private static JavaVersion gradleJavaVersion;
5353
private static JavaVersion runtimeJavaVersion;
5454
private static String runtimeJavaDetails;
55-
@Deprecated
5655
private static Boolean inFipsJvm;
5756
private static String gitRevision;
5857
private static String gitOrigin;

‎buildSrc/version.properties

+4-1
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,10 @@ reactivestreams = 1.0.4
5555
# when updating this version, you need to ensure compatibility with:
5656
# - plugins/ingest-attachment (transitive dependency, check the upstream POM)
5757
# - distribution/tools/plugin-cli
58-
bouncycastle=1.78
58+
bouncycastle_jce=1.0.2.4
59+
bouncycastle_tls=1.0.19
60+
bouncycastle_pkix=1.0.7
61+
bouncycastle_pg=1.0.7.1
5962
# test dependencies
6063
randomizedrunner = 2.7.1
6164
junit = 4.13.2

‎client/rest/build.gradle

+18
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,8 @@ dependencies {
5151
api "commons-codec:commons-codec:${versions.commonscodec}"
5252
api "commons-logging:commons-logging:${versions.commonslogging}"
5353
api "org.slf4j:slf4j-api:${versions.slf4j}"
54+
api "org.bouncycastle:bc-fips:${versions.bouncycastle_jce}"
55+
api "org.bouncycastle:bctls-fips:${versions.bouncycastle_tls}"
5456

5557
// reactor
5658
api "io.projectreactor:reactor-core:${versions.reactor}"
@@ -70,6 +72,10 @@ dependencies {
7072
testImplementation "org.apache.logging.log4j:log4j-slf4j-impl:${versions.log4j}"
7173
}
7274

75+
tasks.named("dependencyLicenses").configure {
76+
mapping from: /bc.*/, to: 'bouncycastle'
77+
}
78+
7379
tasks.withType(CheckForbiddenApis).configureEach {
7480
//client does not depend on server, so only jdk and http signatures should be checked
7581
replaceSignatureFiles('jdk-signatures', 'http-signatures')
@@ -141,6 +147,18 @@ thirdPartyAudit {
141147
'reactor.blockhound.integration.BlockHoundIntegration'
142148
)
143149
ignoreViolations(
150+
'org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$CoreSecureRandom',
151+
'org.bouncycastle.jcajce.provider.ProvSunTLSKDF',
152+
'org.bouncycastle.jcajce.provider.ProvSunTLSKDF$BaseTLSKeyGeneratorSpi',
153+
'org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSKeyMaterialGenerator',
154+
'org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSKeyMaterialGenerator$2',
155+
'org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSMasterSecretGenerator',
156+
'org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSMasterSecretGenerator$2',
157+
'org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSPRFKeyGenerator',
158+
'org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSRsaPreMasterSecretGenerator',
159+
'org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSRsaPreMasterSecretGenerator$2',
160+
'org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSExtendedMasterSecretGenerator',
161+
'org.bouncycastle.jcajce.provider.ProvSunTLSKDF$TLSExtendedMasterSecretGenerator$2',
144162
'reactor.core.publisher.Traces$SharedSecretsCallSiteSupplierFactory$TracingException'
145163
)
146164
}

‎client/rest/licenses/bc-fips-1.0.2.4.jar.sha1

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
9008d04fc13da6455e6a792935b93b629757335d

‎client/rest/licenses/bctls-fips-1.0.19.jar.sha1

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
b15d650f6e2a9de08d5569e25a642b6a384dbfd2

‎client/rest/licenses/bouncycastle-LICENSE.txt

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
Copyright (c) 2000 - 2023 The Legion of the Bouncy Castle Inc. (https://www.bouncycastle.org)
2+
3+
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
4+
documentation files (the "Software"), to deal in the Software without restriction, including without limitation
5+
the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software,
6+
and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
7+
8+
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
9+
Software.
10+
11+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
12+
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
13+
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
14+
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

‎client/rest/licenses/bouncycastle-NOTICE.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+

‎client/rest/src/test/java/org/opensearch/client/RestClientBuilderIntegTests.java

+3-4
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@
4343

4444
import javax.net.ssl.KeyManagerFactory;
4545
import javax.net.ssl.SSLContext;
46-
import javax.net.ssl.SSLHandshakeException;
46+
import javax.net.ssl.SSLException;
4747
import javax.net.ssl.TrustManagerFactory;
4848

4949
import java.io.IOException;
@@ -95,15 +95,14 @@ public static void stopHttpServers() throws IOException {
9595
}
9696

9797
public void testBuilderUsesDefaultSSLContext() throws Exception {
98-
assumeFalse("https://github.com/elastic/elasticsearch/issues/49094", inFipsJvm());
9998
final SSLContext defaultSSLContext = SSLContext.getDefault();
10099
try {
101100
try (RestClient client = buildRestClient()) {
102101
try {
103102
client.performRequest(new Request("GET", "/"));
104-
fail("connection should have been rejected due to SSL handshake");
103+
fail("connection should have been rejected due to SSL failure");
105104
} catch (Exception e) {
106-
assertThat(e, instanceOf(SSLHandshakeException.class));
105+
assertThat(e.getCause(), instanceOf(SSLException.class));
107106
}
108107
}
109108

‎distribution/src/config/fips_java.security

+3-3
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ ssl.KeyManagerFactory.algorithm=PKIX
2222
ssl.TrustManagerFactory.algorithm=PKIX
2323
networkaddress.cache.negative.ttl=10
2424
krb5.kdc.bad.policy = tryLast
25-
jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1, jdkCA&usageTLSServer, RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224
26-
jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, DSA keySize < 1024
27-
jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, MD5withRSA, DH keySize < 1024, EC keySize < 224, DES40_CBC, RC4_40, 3DES_EDE_CBC
25+
jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1, jdkCA&usageTLSServer, RSA keySize < 2048, DSA keySize < 2048, EC keySize < 224
26+
jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 2048, DSA keySize < 2048
27+
jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, MD5withRSA, DH keySize < 2048, EC keySize < 224, DES40_CBC, RC4_40, 3DES_EDE_CBC
2828
jdk.tls.legacyAlgorithms= \
2929
K_NULL, C_NULL, M_NULL, \
3030
DH_anon, ECDH_anon, \

‎distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/AddFileKeyStoreCommandTests.java

+7-11
Original file line numberDiff line numberDiff line change
@@ -210,17 +210,13 @@ public void testIncorrectPassword() throws Exception {
210210
terminal.addSecretInput("thewrongkeystorepassword");
211211
UserException e = expectThrows(UserException.class, () -> execute("foo", file.toString()));
212212
assertEquals(e.getMessage(), ExitCodes.DATA_ERROR, e.exitCode);
213-
if (inFipsJvm()) {
214-
assertThat(
215-
e.getMessage(),
216-
anyOf(
217-
containsString("Provided keystore password was incorrect"),
218-
containsString("Keystore has been corrupted or tampered with")
219-
)
220-
);
221-
} else {
222-
assertThat(e.getMessage(), containsString("Provided keystore password was incorrect"));
223-
}
213+
assertThat(
214+
e.getMessage(),
215+
anyOf(
216+
containsString("Provided keystore password was incorrect"),
217+
containsString("Keystore has been corrupted or tampered with")
218+
)
219+
);
224220
}
225221

226222
public void testAddToUnprotectedKeystore() throws Exception {

‎distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/AddStringKeyStoreCommandTests.java

+7-11
Original file line numberDiff line numberDiff line change
@@ -71,17 +71,13 @@ public void testInvalidPassphrease() throws Exception {
7171
terminal.addSecretInput("thewrongpassword");
7272
UserException e = expectThrows(UserException.class, () -> execute("foo2"));
7373
assertEquals(e.getMessage(), ExitCodes.DATA_ERROR, e.exitCode);
74-
if (inFipsJvm()) {
75-
assertThat(
76-
e.getMessage(),
77-
anyOf(
78-
containsString("Provided keystore password was incorrect"),
79-
containsString("Keystore has been corrupted or tampered with")
80-
)
81-
);
82-
} else {
83-
assertThat(e.getMessage(), containsString("Provided keystore password was incorrect"));
84-
}
74+
assertThat(
75+
e.getMessage(),
76+
anyOf(
77+
containsString("Provided keystore password was incorrect"),
78+
containsString("Keystore has been corrupted or tampered with")
79+
)
80+
);
8581

8682
}
8783

‎distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/ChangeKeyStorePasswordCommandTests.java

+7-11
Original file line numberDiff line numberDiff line change
@@ -104,16 +104,12 @@ public void testChangeKeyStorePasswordWrongExistingPassword() throws Exception {
104104
// We'll only be prompted once (for the old password)
105105
UserException e = expectThrows(UserException.class, this::execute);
106106
assertEquals(e.getMessage(), ExitCodes.DATA_ERROR, e.exitCode);
107-
if (inFipsJvm()) {
108-
assertThat(
109-
e.getMessage(),
110-
anyOf(
111-
containsString("Provided keystore password was incorrect"),
112-
containsString("Keystore has been corrupted or tampered with")
113-
)
114-
);
115-
} else {
116-
assertThat(e.getMessage(), containsString("Provided keystore password was incorrect"));
117-
}
107+
assertThat(
108+
e.getMessage(),
109+
anyOf(
110+
containsString("Provided keystore password was incorrect"),
111+
containsString("Keystore has been corrupted or tampered with")
112+
)
113+
);
118114
}
119115
}

‎distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/KeyStoreWrapperTests.java

+11-15
Original file line numberDiff line numberDiff line change
@@ -132,17 +132,13 @@ public void testDecryptKeyStoreWithWrongPassword() throws Exception {
132132
SecurityException.class,
133133
() -> loadedKeystore.decrypt(new char[] { 'i', 'n', 'v', 'a', 'l', 'i', 'd' })
134134
);
135-
if (inFipsJvm()) {
136-
assertThat(
137-
exception.getMessage(),
138-
anyOf(
139-
containsString("Provided keystore password was incorrect"),
140-
containsString("Keystore has been corrupted or tampered with")
141-
)
142-
);
143-
} else {
144-
assertThat(exception.getMessage(), containsString("Provided keystore password was incorrect"));
145-
}
135+
assertThat(
136+
exception.getMessage(),
137+
anyOf(
138+
containsString("Provided keystore password was incorrect"),
139+
containsString("Keystore has been corrupted or tampered with")
140+
)
141+
);
146142
}
147143

148144
public void testCannotReadStringFromClosedKeystore() throws Exception {
@@ -373,8 +369,8 @@ public void testBackcompatV1() throws Exception {
373369
output.writeString("PKCS12");
374370
output.writeString("PBE");
375371

376-
SecretKeyFactory secretFactory = SecretKeyFactory.getInstance("PBE");
377-
KeyStore keystore = KeyStore.getInstance("PKCS12");
372+
SecretKeyFactory secretFactory = SecretKeyFactory.getInstance("PBE", "SunJCE");
373+
KeyStore keystore = KeyStore.getInstance("PKCS12", "SUN");
378374
keystore.load(null, null);
379375
SecretKey secretKey = secretFactory.generateSecret(new PBEKeySpec("stringSecretValue".toCharArray()));
380376
KeyStore.ProtectionParameter protectionParameter = new KeyStore.PasswordProtection(new char[0]);
@@ -414,8 +410,8 @@ public void testBackcompatV2() throws Exception {
414410
output.writeString("file_setting");
415411
output.writeString("FILE");
416412

417-
SecretKeyFactory secretFactory = SecretKeyFactory.getInstance("PBE");
418-
KeyStore keystore = KeyStore.getInstance("PKCS12");
413+
SecretKeyFactory secretFactory = SecretKeyFactory.getInstance("PBE", "SunJCE");
414+
KeyStore keystore = KeyStore.getInstance("PKCS12", "SUN");
419415
keystore.load(null, null);
420416
SecretKey secretKey = secretFactory.generateSecret(new PBEKeySpec("stringSecretValue".toCharArray()));
421417
KeyStore.ProtectionParameter protectionParameter = new KeyStore.PasswordProtection(new char[0]);

‎distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/ListKeyStoreCommandTests.java

+7-11
Original file line numberDiff line numberDiff line change
@@ -90,17 +90,13 @@ public void testListWithIncorrectPassword() throws Exception {
9090
terminal.addSecretInput("thewrongkeystorepassword");
9191
UserException e = expectThrows(UserException.class, this::execute);
9292
assertEquals(e.getMessage(), ExitCodes.DATA_ERROR, e.exitCode);
93-
if (inFipsJvm()) {
94-
assertThat(
95-
e.getMessage(),
96-
anyOf(
97-
containsString("Provided keystore password was incorrect"),
98-
containsString("Keystore has been corrupted or tampered with")
99-
)
100-
);
101-
} else {
102-
assertThat(e.getMessage(), containsString("Provided keystore password was incorrect"));
103-
}
93+
assertThat(
94+
e.getMessage(),
95+
anyOf(
96+
containsString("Provided keystore password was incorrect"),
97+
containsString("Keystore has been corrupted or tampered with")
98+
)
99+
);
104100
}
105101

106102
public void testListWithUnprotectedKeystore() throws Exception {

‎distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/RemoveSettingKeyStoreCommandTests.java

+7-12
Original file line numberDiff line numberDiff line change
@@ -107,18 +107,13 @@ public void testRemoveWithIncorrectPassword() throws Exception {
107107
terminal.addSecretInput("thewrongpassword");
108108
UserException e = expectThrows(UserException.class, () -> execute("foo"));
109109
assertEquals(e.getMessage(), ExitCodes.DATA_ERROR, e.exitCode);
110-
if (inFipsJvm()) {
111-
assertThat(
112-
e.getMessage(),
113-
anyOf(
114-
containsString("Provided keystore password was incorrect"),
115-
containsString("Keystore has been corrupted or tampered with")
116-
)
117-
);
118-
} else {
119-
assertThat(e.getMessage(), containsString("Provided keystore password was incorrect"));
120-
}
121-
110+
assertThat(
111+
e.getMessage(),
112+
anyOf(
113+
containsString("Provided keystore password was incorrect"),
114+
containsString("Keystore has been corrupted or tampered with")
115+
)
116+
);
122117
}
123118

124119
public void testRemoveFromUnprotectedKeystore() throws Exception {

‎distribution/tools/launchers/src/main/java/org/opensearch/tools/launchers/SystemJvmOptions.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -87,8 +87,8 @@ static List<String> systemJvmOptions(final Path config) {
8787
}
8888

8989
private static String loadJavaSecurityProperties(final Path config) {
90-
var securityFile = config.resolve("fips_java.security").toFile();
91-
return "-Djava.security.properties=" + securityFile.getAbsolutePath();
90+
var securityFile = config.resolve("fips_java.security");
91+
return "-Djava.security.properties=" + securityFile.toAbsolutePath();
9292
}
9393

9494
private static String allowSecurityManagerOption() {

‎distribution/tools/plugin-cli/build.gradle

+1-2
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,7 @@ base {
3737
dependencies {
3838
compileOnly project(":server")
3939
compileOnly project(":libs:opensearch-cli")
40-
api "org.bouncycastle:bcpg-fips:2.0.9"
41-
api "org.bouncycastle:bc-fips:2.0.0"
40+
api "org.bouncycastle:bcpg-fips:${versions.bouncycastle_pg}"
4241
testImplementation project(":test:framework")
4342
testImplementation 'com.google.jimfs:jimfs:1.3.0'
4443
testRuntimeOnly("com.google.guava:guava:${versions.guava}") {

‎libs/ssl-config/build.gradle

+2-2
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,8 @@ dependencies {
3636
api project(':libs:opensearch-common')
3737

3838
// bouncyCastle
39-
implementation 'org.bouncycastle:bcpkix-fips:1.0.7'
40-
compileOnly 'org.bouncycastle:bc-fips:1.0.2.5'
39+
implementation "org.bouncycastle:bcpkix-fips:${versions.bouncycastle_pkix}"
40+
compileOnly "org.bouncycastle:bc-fips:${versions.bouncycastle_jce}"
4141

4242
testImplementation(project(":test:framework")) {
4343
exclude group: 'org.opensearch', module: 'opensearch-ssl-config'

‎libs/ssl-config/licenses/bc-fips-1.0.2.5.jar.sha1

-1
This file was deleted.

‎libs/ssl-config/licenses/bouncycastle-LICENSE.txt

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
Copyright (c) 2000 - 2023 The Legion of the Bouncy Castle Inc. (https://www.bouncycastle.org)
2+
3+
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
4+
documentation files (the "Software"), to deal in the Software without restriction, including without limitation
5+
the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software,
6+
and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
7+
8+
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
9+
Software.
10+
11+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
12+
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
13+
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
14+
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

‎libs/ssl-config/licenses/bouncycastle-NOTICE.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+

0 commit comments

Comments
 (0)