[
https://issues.apache.org/jira/browse/ZOOKEEPER-5045?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andor Molnar updated ZOOKEEPER-5045:
------------------------------------
Labels: FIPS (was: )
> Unable to start in FIPS mode if Java common truststore is not specified
> -----------------------------------------------------------------------
>
> Key: ZOOKEEPER-5045
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-5045
> Project: ZooKeeper
> Issue Type: Bug
> Components: server
> Reporter: Andor Molnar
> Priority: Major
> Labels: FIPS
>
> ZooKeeper is unable to start in FIPS environment if Java common truststore
> parameters are not specified.
> The error message:
> {noformat}
> java.io.IOException: BCFKS KeyStore corrupted: MAC calculation failed.
> at
> com.safelogic.cryptocomply.fips.core/com.safelogic.cryptocomply.jcajce.provider.ProvBCFKS$CCJKeyStoreSpi.verifyMac(Unknown
> Source)
> at
> com.safelogic.cryptocomply.fips.core/com.safelogic.cryptocomply.jcajce.provider.ProvBCFKS$CCJKeyStoreSpi.engineLoad(Unknown
> Source)
> at java.base/java.security.KeyStore.load(KeyStore.java:1473)
> at
> bctls/org.bouncycastle.jsse.provider.ProvTrustManagerFactorySpi.getDefaultTrustStore(ProvTrustManagerFactorySpi.java:112)
> at
> bctls/org.bouncycastle.jsse.provider.ProvSSLContextSpi.getDefaultTrustManagers(ProvSSLContextSpi.java:554)
> at
> bctls/org.bouncycastle.jsse.provider.DefaultSSLContextSpi$LazyManagers.<clinit>(DefaultSSLContextSpi.java:65)
> at
> bctls/org.bouncycastle.jsse.provider.DefaultSSLContextSpi.<init>(DefaultSSLContextSpi.java:113)
> at
> bctls/org.bouncycastle.jsse.provider.BouncyCastleJsseProvider$8.createInstance(BouncyCastleJsseProvider.java:223)
> at
> bctls/org.bouncycastle.jsse.provider.BouncyCastleJsseProvider$BcJsseService.newInstance(BouncyCastleJsseProvider.java:407)
> at
> java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:236)
> at
> java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:164)
> at java.base/javax.net.ssl.SSLContext.getInstance(SSLContext.java:185)
> at java.base/javax.net.ssl.SSLContext.getDefault(SSLContext.java:110)
> at
> org.apache.zookeeper.common.X509Util.defaultTlsProtocol(X509Util.java:96)
> at org.apache.zookeeper.common.X509Util.<clinit>(X509Util.java:86)
> at
> org.apache.zookeeper.server.quorum.QuorumPeerConfig.configureSSLAuth(QuorumPeerConfig.java:504)
> at
> org.apache.zookeeper.server.quorum.QuorumPeerConfig.parseProperties(QuorumPeerConfig.java:456)
> at
> org.apache.zookeeper.server.quorum.QuorumPeerConfig.parse(QuorumPeerConfig.java:194)
> at
> org.apache.zookeeper.server.quorum.QuorumPeerMain.initializeAndRun(QuorumPeerMain.java:125)
> at
> org.apache.zookeeper.server.quorum.QuorumPeerMain.main(QuorumPeerMain.java:91){noformat}
> The problem is that we're trying to query the supported TLS protocols here in
> order to declare the default TLS protocol:
> {noformat}
> /**
> * Return TLSv1.3 or TLSv1.2 depending on Java runtime version being used.
> * TLSv1.3 was first introduced in JDK11 and back-ported to OpenJDK 8u272.
> */
> private static String defaultTlsProtocol() {
> String defaultProtocol = TLS_1_2;
> List<String> supported = new ArrayList<>();
> try {
> supported =
> Arrays.asList(SSLContext.getDefault().getSupportedSSLParameters().getProtocols());
> if (supported.contains(TLS_1_3)) {
> defaultProtocol = TLS_1_3;
> }
> ...{noformat}
> This is a static initializer. In order to make SSLContext.getDefault() call
> work in FIPS environment, we need to set the following system properties:
> {noformat}
> javax.net.ssl.trustStore (location)
> javax.net.ssl.trustStorePassword
> javax.net.ssl.trustStoreType{noformat}
> As a possible resolution I suggest to take advantage of the existing
> *fips-mode* setting and remove the call of SSLContext.getDefault() in FIPS
> mode. Fall back to TLSv1.2 as the default protocol.
> {noformat}
> if (fips-mode)
> defaultProtocol = TLS_1_2;{noformat}
> We can think about making TLSv1.3 the default protocol in FIPS mode, it might
> make better sense.
>
>
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
