Skip to content

Commit 06146e4

Browse files
JinhangZhangJinhangZhang
committed
Update TLS tests to be run in FIPS 140-3 mode.
Signed-off-by: Jinhang Zhang <[email protected]>
1 parent cbd1ac7 commit 06146e4

File tree

74 files changed

+1888
-356
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

74 files changed

+1888
-356
lines changed

‎test/jdk/javax/net/ssl/DTLS/CipherSuite.java‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,9 @@
5555
import java.util.Arrays;
5656
import java.util.List;
5757

58+
import jdk.test.lib.Utils;
59+
import jdk.test.lib.security.SecurityUtils;
60+
5861
/**
5962
* Test common DTLS cipher suites.
6063
*/
@@ -65,15 +68,41 @@ public class CipherSuite extends DTLSOverDatagram {
6568
private static boolean reenable;
6669

6770
public static void main(String[] args) throws Exception {
68-
if (args.length > 1 && "re-enable".equals(args[1])) {
71+
if (args.length > 1 && "re-enable".equals(args[1])
72+
&& !(Utils.isFIPS())) {
6973
Security.setProperty("jdk.tls.disabledAlgorithms", "");
7074
reenable = true;
7175
}
7276

7377
cipherSuite = args[0];
7478

7579
CipherSuite testCase = new CipherSuite();
76-
testCase.runTest(testCase);
80+
try {
81+
testCase.runTest(testCase);
82+
} catch (javax.net.ssl.SSLHandshakeException sslhe) {
83+
if (Utils.isFIPS()) {
84+
if(!SecurityUtils.TLS_CIPHERSUITES.containsKey(cipherSuite)) {
85+
if ("No appropriate protocol (protocol is disabled or cipher suites are inappropriate)".equals(sslhe.getMessage())) {
86+
System.out.println("Expected exception msg: <No appropriate protocol (protocol is disabled or cipher suites are inappropriate)> is caught");
87+
return;
88+
} else {
89+
System.out.println("Unexpected exception msg: <" + sslhe.getMessage() + "> is caught");
90+
return;
91+
}
92+
} else {
93+
System.out.println("Unexpected exception is caught");
94+
sslhe.printStackTrace();
95+
return;
96+
}
97+
} else {
98+
System.out.println("Unexpected exception is caught in Non-FIPS mode");
99+
sslhe.printStackTrace();
100+
return;
101+
}
102+
} catch (Exception e) {
103+
e.printStackTrace();
104+
return;
105+
}
77106
}
78107

79108
@Override

‎test/jdk/javax/net/ssl/DTLS/DTLSNamedGroups.java‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,9 @@
3838
import javax.net.ssl.SSLParameters;
3939
import java.security.Security;
4040

41+
import jdk.test.lib.Utils;
42+
import jdk.test.lib.security.SecurityUtils;
43+
4144
/**
4245
* Test DTLS client authentication.
4346
*/
@@ -73,7 +76,9 @@ SSLEngine createSSLEngine(boolean isClient) throws Exception {
7376
}
7477

7578
public static void main(String[] args) throws Exception {
76-
Security.setProperty("jdk.tls.disabledAlgorithms", "");
79+
if (!(Utils.isFIPS())) {
80+
Security.setProperty("jdk.tls.disabledAlgorithms", "");
81+
}
7782

7883
runTest(new String[] {
7984
"x25519",

‎test/jdk/javax/net/ssl/DTLS/DTLSSignatureSchemes.java‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,9 @@
3838
import javax.net.ssl.SSLParameters;
3939
import java.security.Security;
4040

41+
import jdk.test.lib.Utils;
42+
import jdk.test.lib.security.SecurityUtils;
43+
4144
/**
4245
* Test DTLS client authentication.
4346
*/
@@ -67,7 +70,9 @@ SSLEngine createSSLEngine(boolean isClient) throws Exception {
6770
}
6871

6972
public static void main(String[] args) throws Exception {
70-
Security.setProperty("jdk.tls.disabledAlgorithms", "");
73+
if (!(Utils.isFIPS())) {
74+
Security.setProperty("jdk.tls.disabledAlgorithms", "");
75+
}
7176

7277
runTest(new String[] {
7378
"ecdsa_secp256r1_sha256",

‎test/jdk/javax/net/ssl/DTLS/DTLSWontNegotiateV10.java‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,9 @@
3232
import java.util.List;
3333
import java.util.concurrent.atomic.AtomicInteger;
3434

35+
import jdk.test.lib.Utils;
36+
import jdk.test.lib.security.SecurityUtils;
37+
3538
/*
3639
* @test
3740
* @bug 8301381
@@ -51,7 +54,9 @@ public class DTLSWontNegotiateV10 {
5154
private static final int READ_TIMEOUT_SECS = Integer.getInteger("readtimeout", 30);
5255

5356
public static void main(String[] args) throws Exception {
54-
if (args[0].equals(DTLSV_1_0)) {
57+
58+
if (args[0].equals(DTLSV_1_0)
59+
&& !(Utils.isFIPS())) {
5560
SecurityUtils.removeFromDisabledTlsAlgs(DTLSV_1_0);
5661
}
5762

@@ -74,6 +79,26 @@ public static void main(String[] args) throws Exception {
7479
break;
7580
} catch (SocketTimeoutException exc) {
7681
System.out.println("The server timed-out waiting for packets from the client.");
82+
} catch (javax.net.ssl.SSLHandshakeException sslhe) {
83+
if (Utils.isFIPS()) {
84+
if(!SecurityUtils.TLS_PROTOCOLS.contains(args[0])) {
85+
if ("No appropriate protocol (protocol is disabled or cipher suites are inappropriate)".equals(sslhe.getMessage())) {
86+
System.out.println("Expected exception msg: <No appropriate protocol (protocol is disabled or cipher suites are inappropriate)> is caught");
87+
return;
88+
} else {
89+
System.out.println("Unexpected exception msg: <" + sslhe.getMessage() + "> is caught");
90+
return;
91+
}
92+
} else {
93+
System.out.println("Unexpected exception is caught");
94+
sslhe.printStackTrace();
95+
return;
96+
}
97+
} else {
98+
System.out.println("Unexpected exception is caught in Non-FIPS mode");
99+
sslhe.printStackTrace();
100+
return;
101+
}
77102
}
78103
}
79104
if (tries == totalAttempts) {

‎test/jdk/javax/net/ssl/DTLS/WeakCipherSuite.java‎

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,9 @@
4141
import javax.net.ssl.SSLEngine;
4242
import java.security.Security;
4343

44+
import jdk.test.lib.Utils;
45+
import jdk.test.lib.security.SecurityUtils;
46+
4447
/**
4548
* Test common DTLS weak cipher suites.
4649
*/
@@ -52,13 +55,40 @@ public class WeakCipherSuite extends DTLSOverDatagram {
5255
public static void main(String[] args) throws Exception {
5356
// reset security properties to make sure that the algorithms
5457
// and keys used in this test are not disabled.
55-
Security.setProperty("jdk.tls.disabledAlgorithms", "");
56-
Security.setProperty("jdk.certpath.disabledAlgorithms", "");
58+
if (!(Utils.isFIPS())) {
59+
Security.setProperty("jdk.tls.disabledAlgorithms", "");
60+
Security.setProperty("jdk.certpath.disabledAlgorithms", "");
61+
}
5762

5863
cipherSuite = args[0];
5964

6065
WeakCipherSuite testCase = new WeakCipherSuite();
61-
testCase.runTest(testCase);
66+
try {
67+
testCase.runTest(testCase);
68+
} catch (javax.net.ssl.SSLHandshakeException sslhe) {
69+
if (Utils.isFIPS()) {
70+
if(!SecurityUtils.TLS_CIPHERSUITES.containsKey(cipherSuite)) {
71+
if ("No appropriate protocol (protocol is disabled or cipher suites are inappropriate)".equals(sslhe.getMessage())) {
72+
System.out.println("Expected exception msg: <No appropriate protocol (protocol is disabled or cipher suites are inappropriate)> is caught");
73+
return;
74+
} else {
75+
System.out.println("Unexpected exception msg: <" + sslhe.getMessage() + "> is caught");
76+
return;
77+
}
78+
} else {
79+
System.out.println("Unexpected exception is caught");
80+
sslhe.printStackTrace();
81+
return;
82+
}
83+
} else {
84+
System.out.println("Unexpected exception is caught in Non-FIPS mode");
85+
sslhe.printStackTrace();
86+
return;
87+
}
88+
} catch (Exception e) {
89+
e.printStackTrace();
90+
return;
91+
}
6292
}
6393

6494
@Override

‎test/jdk/javax/net/ssl/FixingJavadocs/ImplicitHandshake.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
* @bug 4387882
2727
* @summary Need to revisit the javadocs for JSSE, especially the
2828
* promoted classes.
29+
* @library /test/lib
2930
* @run main/othervm ImplicitHandshake
3031
*
3132
* SunJSSE does not support dynamic system properties, no way to re-use
@@ -37,6 +38,8 @@
3738
import java.net.*;
3839
import javax.net.ssl.*;
3940

41+
import jdk.test.lib.Utils;
42+
4043
public class ImplicitHandshake {
4144

4245
/*
@@ -191,6 +194,10 @@ public static void main(String[] args) throws Exception {
191194
System.getProperty("test.src", "./") + "/" + pathToStores +
192195
"/" + trustStoreFile;
193196

197+
if (Utils.isFIPS()) {
198+
keyFilename = Utils.revertJKSToPKCS12(keyFilename, passwd);
199+
trustFilename = Utils.revertJKSToPKCS12(trustFilename, passwd);
200+
}
194201
System.setProperty("javax.net.ssl.keyStore", keyFilename);
195202
System.setProperty("javax.net.ssl.keyStorePassword", passwd);
196203
System.setProperty("javax.net.ssl.trustStore", trustFilename);

‎test/jdk/javax/net/ssl/HttpsURLConnection/CriticalSubjectAltName.java‎

Lines changed: 37 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
* @bug 6668231
3232
* @summary Presence of a critical subjectAltName causes JSSE's SunX509 to
3333
* fail trusted checks
34+
* @library /test/lib
3435
* @run main/othervm CriticalSubjectAltName
3536
* @author Xuelei Fan
3637
*/
@@ -53,6 +54,8 @@
5354
import java.security.Security;
5455
import java.security.cert.Certificate;
5556

57+
import jdk.test.lib.Utils;
58+
5659
public class CriticalSubjectAltName implements HostnameVerifier {
5760
/*
5861
* =============================================================
@@ -159,10 +162,12 @@ void doClientSide() throws Exception {
159162

160163
public static void main(String[] args) throws Exception {
161164
// MD5 is used in this test case, don't disable MD5 algorithm.
162-
Security.setProperty("jdk.certpath.disabledAlgorithms",
163-
"MD2, RSA keySize < 1024");
164-
Security.setProperty("jdk.tls.disabledAlgorithms",
165-
"SSLv3, RC4, DH keySize < 768");
165+
if (!(Utils.isFIPS())) {
166+
Security.setProperty("jdk.certpath.disabledAlgorithms",
167+
"MD2, RSA keySize < 1024");
168+
Security.setProperty("jdk.tls.disabledAlgorithms",
169+
"SSLv3, RC4, DH keySize < 768");
170+
}
166171

167172
String keyFilename =
168173
System.getProperty("test.src", "./") + "/" + pathToStores +
@@ -171,6 +176,11 @@ public static void main(String[] args) throws Exception {
171176
System.getProperty("test.src", "./") + "/" + pathToStores +
172177
"/" + trustStoreFile;
173178

179+
if (Utils.isFIPS()) {
180+
keyFilename = Utils.revertJKSToPKCS12(keyFilename, passwd);
181+
trustFilename = Utils.revertJKSToPKCS12(trustFilename, passwd);
182+
}
183+
174184
System.setProperty("javax.net.ssl.keyStore", keyFilename);
175185
System.setProperty("javax.net.ssl.keyStorePassword", passwd);
176186
System.setProperty("javax.net.ssl.trustStore", trustFilename);
@@ -182,7 +192,29 @@ public static void main(String[] args) throws Exception {
182192
/*
183193
* Start the tests.
184194
*/
185-
new CriticalSubjectAltName();
195+
try {
196+
new CriticalSubjectAltName();
197+
} catch (Exception e) {
198+
if (Utils.isFIPS()) {
199+
if (e instanceof java.security.cert.CertPathValidatorException) {
200+
if ("Algorithm constraints check failed on signature algorithm: MD5withRSA".equals(e.getMessage())) {
201+
System.out.println("MD5withRSA is not a supported signature algorithm.");
202+
return;
203+
} else {
204+
System.out.println("Unexpected exception msg: <" + e.getMessage() + "> is caught");
205+
return;
206+
}
207+
} else {
208+
System.out.println("Unexpected exception is caught");
209+
e.printStackTrace();
210+
return;
211+
}
212+
} else {
213+
System.out.println("Unexpected exception is caught in Non-FIPS mode");
214+
e.printStackTrace();
215+
return;
216+
}
217+
}
186218
}
187219

188220
Thread clientThread = null;

‎test/jdk/javax/net/ssl/HttpsURLConnection/GetResponseCode.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
* @test
2626
* @bug 4482187
2727
* @summary HttpsClient tests are failing for build 71
28+
* @library /test/lib
2829
* @run main/othervm GetResponseCode
2930
*
3031
* SunJSSE does not support dynamic system properties, no way to re-use
@@ -37,6 +38,8 @@
3738
import javax.net.ssl.*;
3839
import java.security.cert.Certificate;
3940

41+
import jdk.test.lib.Utils;
42+
4043
public class GetResponseCode implements HostnameVerifier {
4144
/*
4245
* =============================================================
@@ -149,6 +152,11 @@ public static void main(String[] args) throws Exception {
149152
System.getProperty("test.src", "./") + "/" + pathToStores +
150153
"/" + trustStoreFile;
151154

155+
if (Utils.isFIPS()) {
156+
keyFilename = Utils.revertJKSToPKCS12(keyFilename, passwd);
157+
trustFilename = Utils.revertJKSToPKCS12(trustFilename, passwd);
158+
}
159+
152160
System.setProperty("javax.net.ssl.keyStore", keyFilename);
153161
System.setProperty("javax.net.ssl.keyStorePassword", passwd);
154162
System.setProperty("javax.net.ssl.trustStore", trustFilename);

‎test/jdk/javax/net/ssl/SSLEngine/ArgCheck.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
* @summary Add scatter/gather APIs for SSLEngine
2828
*
2929
* Check to see if the args are being parsed properly.
30-
*
30+
* @library /test/lib
3131
*/
3232

3333
import javax.net.ssl.*;

0 commit comments

Comments
 (0)