current/SOURCES/rh1818909-fips_default_keystore_type.patch

diff -r 6efbd7b35a10 src/share/classes/java/security/SystemConfigurator.java
--- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java      Thu Jan 23 18:22:31 2020 -0300
+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java   Mon Mar 02 19:20:17 2020 -0300
@@ -123,6 +123,33 @@
                     }
                     props.put(fipsProviderKey, fipsProviderValue);
                 }
+                // Add other security properties
+                String keystoreTypeValue = (String) props.get("fips.keystore.type");
+                if (keystoreTypeValue != null) {
+                    String nonFipsKeystoreType = props.getProperty("keystore.type");
+                    props.put("keystore.type", keystoreTypeValue);
+                    if (keystoreTypeValue.equals("PKCS11")) {
+                       // If keystore.type is PKCS11, javax.net.ssl.keyStore
+                       // must be "NONE". See JDK-8238264.
+                       System.setProperty("javax.net.ssl.keyStore", "NONE");
+                    }
+                    if (System.getProperty("javax.net.ssl.trustStoreType") == null) {
+                        // If no trustStoreType has been set, use the
+                        // previous keystore.type under FIPS mode. In
+                        // a default configuration, the Trust Store will
+                        // be 'cacerts' (JKS type).
+                        System.setProperty("javax.net.ssl.trustStoreType",
+                                nonFipsKeystoreType);
+                    }
+                    if (sdebug != null) {
+                        sdebug.println("FIPS mode default keystore.type = " +
+                                keystoreTypeValue);
+                        sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
+                                       System.getProperty("javax.net.ssl.keyStore", ""));
+                        sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
+                                System.getProperty("javax.net.ssl.trustStoreType", ""));
+                    }
+                }
                 loadedProps = true;
             }
         } catch (Exception e) {
diff -r 6efbd7b35a10 src/share/lib/security/java.security-linux
--- openjdk.orig/src/java.base/share/conf/security/java.security        Thu Jan 23 18:22:31 2020 -0300
+++ openjdk/src/java.base/share/conf/security/java.security     Mon Mar 02 19:20:17 2020 -0300
@@ -299,6 +299,11 @@
 keystore.type=pkcs12
 
 #
+# Default keystore type used when global crypto-policies are set to FIPS.
+#
+fips.keystore.type=PKCS11
+
+#
 # Controls compatibility mode for JKS and PKCS12 keystore types.
 #
 # When set to 'true', both JKS and PKCS12 keystore types support loading
1	diff -r 6efbd7b35a10 src/share/classes/java/security/SystemConfigurator.java
2	--- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java Thu Jan 23 18:22:31 2020 -0300
3	+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java Mon Mar 02 19:20:17 2020 -0300
4	@@ -123,6 +123,33 @@
5	}
6	props.put(fipsProviderKey, fipsProviderValue);
7	}
8	+ // Add other security properties
9	+ String keystoreTypeValue = (String) props.get("fips.keystore.type");
10	+ if (keystoreTypeValue != null) {
11	+ String nonFipsKeystoreType = props.getProperty("keystore.type");
12	+ props.put("keystore.type", keystoreTypeValue);
13	+ if (keystoreTypeValue.equals("PKCS11")) {
14	+ // If keystore.type is PKCS11, javax.net.ssl.keyStore
15	+ // must be "NONE". See JDK-8238264.
16	+ System.setProperty("javax.net.ssl.keyStore", "NONE");
17	+ }
18	+ if (System.getProperty("javax.net.ssl.trustStoreType") == null) {
19	+ // If no trustStoreType has been set, use the
20	+ // previous keystore.type under FIPS mode. In
21	+ // a default configuration, the Trust Store will
22	+ // be 'cacerts' (JKS type).
23	+ System.setProperty("javax.net.ssl.trustStoreType",
24	+ nonFipsKeystoreType);
25	+ }
26	+ if (sdebug != null) {
27	+ sdebug.println("FIPS mode default keystore.type = " +
28	+ keystoreTypeValue);
29	+ sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
30	+ System.getProperty("javax.net.ssl.keyStore", ""));
31	+ sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
32	+ System.getProperty("javax.net.ssl.trustStoreType", ""));
33	+ }
34	+ }
35	loadedProps = true;
36	}
37	} catch (Exception e) {
38	diff -r 6efbd7b35a10 src/share/lib/security/java.security-linux
39	--- openjdk.orig/src/java.base/share/conf/security/java.security Thu Jan 23 18:22:31 2020 -0300
40	+++ openjdk/src/java.base/share/conf/security/java.security Mon Mar 02 19:20:17 2020 -0300
41	@@ -299,6 +299,11 @@
42	keystore.type=pkcs12
43
44	#
45	+# Default keystore type used when global crypto-policies are set to FIPS.
46	+#
47	+fips.keystore.type=PKCS11
48	+
49	+#
50	# Controls compatibility mode for JKS and PKCS12 keystore types.
51	#
52	# When set to 'true', both JKS and PKCS12 keystore types support loading