Skip to content

Commit e55ada9

Browse files
authored
OPENJDK-4559: Red Hat Build of OpenJDK 25 should not restrict all the providers in FIPS (#45)
OPENJDK-4559: relax RedHatFIPSFilter constrains Only restrict the SUN, SunEC, SunJCE and SunRsaSign services. This makes the fips-25u patch behave as the fips-21u patch, but with fewer changes.
1 parent 1005020 commit e55ada9

1 file changed

Lines changed: 3 additions & 8 deletions

File tree

src/java.base/share/classes/java/security/Provider.java

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1207,31 +1207,26 @@ public Set<Service> getServices() {
12071207
private static final class RedHatFIPSFilter {
12081208
static final boolean IS_ON = Boolean.parseBoolean(
12091209
Security.getProperty("__redhat_fips_filter__"));
1210-
private static final Set<String> ANY_SERVICE_TYPE = Set.of();
12111210
private static final Map<String, Set<String>> ALLOW_LIST = Map.of(
1212-
"SunPKCS11-FIPS", ANY_SERVICE_TYPE,
12131211
"SUN", Set.of(
12141212
"AlgorithmParameterGenerator",
12151213
"AlgorithmParameters", "CertificateFactory",
12161214
"CertPathBuilder", "CertPathValidator", "CertStore",
12171215
"Configuration", "KeyStore"),
12181216
"SunEC", Set.of(
12191217
"AlgorithmParameters", "KeyFactory"),
1220-
"SunJSSE", ANY_SERVICE_TYPE,
12211218
"SunJCE", Set.of(
12221219
"AlgorithmParameters",
12231220
"AlgorithmParameterGenerator", "KeyFactory",
12241221
"SecretKeyFactory"),
12251222
"SunRsaSign", Set.of(
1226-
"KeyFactory", "AlgorithmParameters"),
1227-
"XMLDSig", ANY_SERVICE_TYPE
1223+
"KeyFactory", "AlgorithmParameters")
12281224
);
12291225

12301226
static boolean isAllowed(String provName, String serviceType) {
12311227
Set<String> allowedServiceTypes = ALLOW_LIST.get(provName);
1232-
return allowedServiceTypes != null &&
1233-
(allowedServiceTypes == ANY_SERVICE_TYPE ||
1234-
allowedServiceTypes.contains(serviceType));
1228+
return allowedServiceTypes == null ||
1229+
allowedServiceTypes.contains(serviceType);
12351230
}
12361231
}
12371232
/* ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ */

0 commit comments

Comments
 (0)