search

ibmruntimes / openj9-openjdk-jdk17

Extensions for OpenJDK 17 for Eclipse OpenJ9
GNU General Public License v2.0
23 stars 53 forks source link

Support provider fully-qualified class name in Restricted Security mode #360

Closed taoliult closed 2 months ago

taoliult commented 2 months ago

This is a back port PR from JDKNext PR https://github.com/ibmruntimes/openj9-openjdk-jdk/pull/758

This PR is for updating the codes to only support the fully-qualified class name when setting the providers list in restricted security profiles. For example, the NSS FIPS140-2 provider list will be:

RestrictedSecurity.NSS.140-2.jce.provider.1 = sun.security.pkcs11.SunPKCS11 ${java.home}/conf/security/nss.fips.cfg
RestrictedSecurity.NSS.140-2.jce.provider.2 = sun.security.provider.Sun [ \
    {CertificateFactory, X.509, ImplementedIn=Software}, \
    {CertStore, Collection, ImplementedIn=Software}, \
    {CertStore, com.sun.security.IndexedCollection, ImplementedIn=Software}, \
    {Policy, JavaPolicy, *}, {Configuration, JavaLoginConfig, *}, \
    {CertPathBuilder, PKIX, ValidationAlgorithm=RFC5280:ImplementedIn=Software}, \
    {CertPathValidator, PKIX, ValidationAlgorithm=RFC5280:ImplementedIn=Software}, \
    {KeyStore, PKCS12, *}]
RestrictedSecurity.NSS.140-2.jce.provider.3 = sun.security.ec.SunEC [{KeyFactory, EC, ImplementedIn=Software: \
    SupportedKeyClasses=java.security.interfaces.ECPublicKey|java.security.interfaces.ECPrivateKey: \
    KeySize=256}, {AlgorithmParameters, EC, *}]
RestrictedSecurity.NSS.140-2.jce.provider.4 = sun.security.ssl.SunJSSE
keithc-ca commented 2 months ago

Jenkins test sanity amac jdk17

keithc-ca commented 2 months ago

Please remove commit b7e9ab368e68ed5ebc26301da5b95b085137200b from this change (the copyright date was previously correct; force-push f9d5c866c45e508c6ef53975f7d2ff2d96dc78ff).

For the record, the successful test build: https://openj9-jenkins.osuosl.org/job/PullRequest-OpenJDK17/177.

taoliult commented 2 months ago

@keithc-ca Sorry for this mistake, the commit which update the copyright date is removed.