Skip to content

Commit 657f5b7

Browse files
iigoniniigonin
committed
Draft to allow run in FIPS compliace mode
1 parent 6267e94 commit 657f5b7

55 files changed

Lines changed: 897 additions & 236 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎build.gradle‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ apply from: 'gradle/forbidden-dependencies.gradle'
6666
apply from: 'gradle/formatting.gradle'
6767
apply from: 'gradle/local-distribution.gradle'
6868
apply from: 'gradle/fips.gradle'
69+
apply from: 'gradle/run-with-fips.gradle'
6970
apply from: 'gradle/run.gradle'
7071
apply from: 'gradle/missing-javadoc.gradle'
7172
apply from: 'gradle/code-coverage.gradle'

‎buildSrc/src/main/java/org/opensearch/gradle/info/GlobalBuildInfoPlugin.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ public void apply(Project project) {
129129
params.setIsCi(System.getenv("JENKINS_URL") != null);
130130
params.setIsInternal(isInternal);
131131
params.setDefaultParallel(findDefaultParallel(project));
132-
params.setInFipsJvm(Util.getBooleanProperty("tests.fips.enabled", false));
132+
params.setInFipsJvm(Util.getBooleanProperty("tests.fips.enabled", true));
133133
params.setIsSnapshotBuild(Util.getBooleanProperty("build.snapshot", true));
134134
if (isInternal) {
135135
params.setBwcVersions(resolveBwcVersions(rootDir));

‎buildSrc/src/main/java/org/opensearch/gradle/testclusters/OpenSearchNode.java‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1170,6 +1170,56 @@ private void createConfiguration() {
11701170
baseConfig.put("node.portsfile", "true");
11711171
baseConfig.put("http.port", httpPort);
11721172
baseConfig.put("transport.port", transportPort);
1173+
baseConfig.put("http.host", "192.168.33.46");
1174+
1175+
1176+
// self-signed CA authority
1177+
baseConfig.put("reindex.ssl.certificate_authorities", "/home/iwan/workspace/OpenSearch/certs/centST9/root-ca.pem");
1178+
1179+
// DSA (basically can only be used for signing)
1180+
// baseConfig.put("reindex.ssl.certificate", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-DSA.pem");
1181+
// baseConfig.put("reindex.ssl.key", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-key-DSA.pem");
1182+
1183+
// DSA enc
1184+
// baseConfig.put("reindex.ssl.certificate", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-DSA.pem");
1185+
// baseConfig.put("reindex.ssl.key", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-key-DSA-enc.pem");
1186+
// baseConfig.put("reindex.ssl.key_passphrase", "password");
1187+
1188+
// Elliptic Curve Diffie-Hellman (ECDH) secp256r1 aka prime256v1
1189+
// baseConfig.put("reindex.ssl.certificate", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-EC.pem");
1190+
// baseConfig.put("reindex.ssl.key", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-key-secp256r1.pem");
1191+
1192+
// Elliptic Curve enc
1193+
// baseConfig.put("reindex.ssl.certificate", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-EC.pem");
1194+
// baseConfig.put("reindex.ssl.key", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-key-secp256r1-enc.pem");
1195+
// baseConfig.put("reindex.ssl.key_passphrase", "password");
1196+
1197+
// RSA PKCS#1
1198+
// baseConfig.put("reindex.ssl.certificate", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-PKCS1.pem");
1199+
// baseConfig.put("reindex.ssl.key", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-key-PKCS1.pem");
1200+
1201+
// RSA PKCS#1 enc
1202+
// baseConfig.put("reindex.ssl.certificate", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-PKCS1.pem");
1203+
// baseConfig.put("reindex.ssl.key", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-key-PKCS1-enc.pem");
1204+
// baseConfig.put("reindex.ssl.key_passphrase", "password");
1205+
1206+
// RSA PKCS#8
1207+
// baseConfig.put("reindex.ssl.certificate", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-PKCS8.pem");
1208+
// baseConfig.put("reindex.ssl.key", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-key-PKCS8.pem");
1209+
1210+
// RSA PKCS#8 enc
1211+
baseConfig.put("reindex.ssl.certificate", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-PKCS8-enc.pem");
1212+
baseConfig.put("reindex.ssl.key", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-key-PKCS8-enc.pem");
1213+
baseConfig.put("reindex.ssl.key_passphrase", "rzg9RxrMBDU3jV^^$vNB");
1214+
1215+
// keystore + struststore config
1216+
// baseConfig.put("reindex.ssl.keystore.path", "/home/iwan/workspace/OpenSearch/certs/centST9/keystore.bks");
1217+
// baseConfig.put("reindex.ssl.keystore.password", "password");
1218+
// baseConfig.put("reindex.ssl.truststore.path", "/home/iwan/workspace/OpenSearch/certs/centST9/truststore.bks");
1219+
// baseConfig.put("reindex.ssl.truststore.password", "password");
1220+
1221+
baseConfig.put("reindex.remote.whitelist", "node1.dns.a-record:10200");
1222+
11731223
// Default the watermarks to absurdly low to prevent the tests from failing on nodes without enough disk space
11741224
baseConfig.put("cluster.routing.allocation.disk.watermark.low", "1b");
11751225
baseConfig.put("cluster.routing.allocation.disk.watermark.high", "1b");

‎buildSrc/src/main/resources/cacerts.bcfks‎

85.2 KB
Binary file not shown.

‎buildSrc/src/main/resources/fips_java_bcjsse_11.security‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,9 @@ ssl.KeyManagerFactory.algorithm=PKIX
2323
ssl.TrustManagerFactory.algorithm=PKIX
2424
networkaddress.cache.negative.ttl=10
2525
krb5.kdc.bad.policy = tryLast
26-
jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1 jdkCA & usage TLSServer, \
27-
RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224
28-
jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, \
29-
DSA keySize < 1024
30-
jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 1024, \
31-
EC keySize < 224, DES40_CBC, RC4_40, 3DES_EDE_CBC
26+
jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1, jdkCA&usageTLSServer, RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224
27+
jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, DSA keySize < 1024
28+
jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, MD5withRSA, DH keySize < 1024, EC keySize < 224, DES40_CBC, RC4_40, 3DES_EDE_CBC
3229
jdk.tls.legacyAlgorithms= \
3330
K_NULL, C_NULL, M_NULL, \
3431
DH_anon, ECDH_anon, \

‎certs/centST9/admin-key.pem‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDeI/SbthSyFRu3
3+
9Vm8aQK3svvl3aEhnu5mnVoy9l6qCNhBZu3poe8eQmrI7CByVIT0jh+3+zuQiQMx
4+
c3WiI2scXZ6T637uIP+NTM8aKm5WeRCR4EWLRNrvhl1LQBieDELni0aWIQguwgws
5+
wOS9iWCxg8p3tdrtoWYX7lW+xFQRWLeL5fgntwCLpHpPaPFqOUMdJwdhUvfSndYE
6+
LHKG4up3NBzCXca5TEqUREC8w57nlvrSQOADBN73Y3XVh9jiXU+m+Kcc61MkYR+V
7+
wcRNXRapchj2HfD7tNiGAkfoMOIhO3xwvdNXxj02zj5SILz3cEjjc8o9V8Xa1YDd
8+
Rv3RxzyBAgMBAAECggEAAVikhYQ6odopCTEjEDZSbr3S/cwvEkR+YbAEowyuN7es
9+
CGao6uAExCaOT7PjpQ/1il/waAWisVHfB+4fRe0S8RfUxG+zXOHzuvpQbSs2BgEc
10+
PhyGzSXXjhyJZRGXXJouSDtRAWfj0KcQDGjiznIzmKoJp6E2jsxfZsKWnE4nRI3p
11+
YQBxR3mjrO2u3QbO0b00gxjTmykOz8Y0J6CltzykmShwxAMCo7hmuOIGzQ1wDQWI
12+
AwwvHGen8Av0iqDrhPx4c6g8QHLqNdfxAqnOxvmGPCcVPhRucnNGGB9SjqzEtZ6r
13+
kumq/IBYChYsmBhIWN9kOk5fx1yyLGfBNsMWrAkPYQKBgQDu9V+phMZmHA6Q9TBn
14+
S9kVXBUnEh20WoNfN+Js2+EhCbh8Y59Zv0iDaKHXOnaM59ACexbivQaRxH10kqPI
15+
c/rLWD3tdgOc0Pazi6Z9zW6K0j58ngdwkE8TwsDtmszIGZrMxOOOoCtl+b8ncCFN
16+
0NZFZMH7C626S9nfrts/5KYZ8QKBgQDt+4mgVzRvEIas1gz9LNXXyBEcFxlHn6lI
17+
+V+igDoaRGCT93Bmr9kdNDF9VyRRIL+G+/ywRhS2HF0bpHl1PwtR1aGxBRbJXH5h
18+
ccV7ZyoKUQxOtLx9byY3c24tCKdTOXgm8Fl8zLvI4SnUL+ovCPpTeEp3clBZpOPU
19+
e7koCzg7kQKBgQCZe0U8bqm4ACFi/fle/5qpW4HCnKIzq0diK1Tlsr0BKWszihFZ
20+
5cC/lr8MrOJkUqiKT2E9tUe47MnfzCgiokvdvAnaschUOuuaGwKPHxn3VF8KT75b
21+
kHUaLicY9iq+A6QoDfZTL5FwaF9dB2p8vrxByhvGEZQ+amXAhGESwtvlIQKBgQCS
22+
5GP6uFkBBO5b2HOEAhysaC1HbWqJLx/Kj0Jch1FVzUbfjieu+nPE9uZlO1iLSu9t
23+
XjSGiXtXPQKrgUYG/Lb7+CUpor6B47mOZC9FEFR+sbArFJwTwHuSVol2+pRtZlen
24+
kUtrIOP4BiNPeZPPHHeG9gTg3YqDCqgmC4gqE2LOQQKBgBz4qCiBTG5MBqBIlL9B
25+
W+G2rEmBFzNp3+kSUt2rssDK5bfeR4SZ2cwUifetcz5YhaLJ9J4K4u3a7lSg+i9P
26+
v9TRTBg/Ll8/tWRWkp7qhxTh9/07O47uLI3CQDbvUhgzXi6xxG3NcjIlfdJ+srni
27+
VZD7oYi/k1+21pZdBLDWA2cz
28+
-----END PRIVATE KEY-----

‎certs/centST9/admin.pem‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDhzCCAm+gAwIBAgIUNrNRJu82g8g31rcCgeS9MjPLbDMwDQYJKoZIhvcNAQEL
3+
BQAwXTELMAkGA1UEBhMCQ0ExEDAOBgNVBAgMB09OVEFSSU8xEDAOBgNVBAcMB1RP
4+
Uk9OVE8xDDAKBgNVBAoMA09SRzENMAsGA1UECwwEVU5JVDENMAsGA1UEAwwEUk9P
5+
VDAeFw0yNDA2MDUwODUyMzBaFw0yNjA2MDUwODUyMzBaMFoxCzAJBgNVBAYTAkNB
6+
MRAwDgYDVQQIDAdPTlRBUklPMRAwDgYDVQQHDAdUT1JPTlRPMQwwCgYDVQQKDANP
7+
UkcxDTALBgNVBAsMBFVOSVQxCjAIBgNVBAMMAUEwggEiMA0GCSqGSIb3DQEBAQUA
8+
A4IBDwAwggEKAoIBAQDeI/SbthSyFRu39Vm8aQK3svvl3aEhnu5mnVoy9l6qCNhB
9+
Zu3poe8eQmrI7CByVIT0jh+3+zuQiQMxc3WiI2scXZ6T637uIP+NTM8aKm5WeRCR
10+
4EWLRNrvhl1LQBieDELni0aWIQguwgwswOS9iWCxg8p3tdrtoWYX7lW+xFQRWLeL
11+
5fgntwCLpHpPaPFqOUMdJwdhUvfSndYELHKG4up3NBzCXca5TEqUREC8w57nlvrS
12+
QOADBN73Y3XVh9jiXU+m+Kcc61MkYR+VwcRNXRapchj2HfD7tNiGAkfoMOIhO3xw
13+
vdNXxj02zj5SILz3cEjjc8o9V8Xa1YDdRv3RxzyBAgMBAAGjQjBAMB0GA1UdDgQW
14+
BBQJYEZ00+on+tuuCgwoGZXX3BIj0jAfBgNVHSMEGDAWgBRYhmx56p3xT4JUKXZL
15+
JAKkB2FiAzANBgkqhkiG9w0BAQsFAAOCAQEArltZsjVggx58gbyJyCo22zQaICaQ
16+
dZ91lq3OUq95o1FpjKN2YgKCzdMoxWjK2t2A6fJNVeiyjbQowFsmdQgWn5nkfbOw
17+
vscOZpXm9SJbb8/e2hC3bXX4J3LlE6tKmQd6Zy49ezfQxYfXNgTAoEm6uxLIznFq
18+
qUALt/QYxBPoUu3mT1ldJcHpkHGlrRUiyZhc+/X8YJhciE/0WKmPtHxHIKDaAeBm
19+
FXGRNQ16gCZrH41njMdkdZJpz3MRrVjJGWAfj9WKTQn/W1t2grPZBdMjF0LNYu7u
20+
EJsCGlklFiDeGYAj0g2N5U30A2uk8mETAbTwlpRUM/CHhmJRTw18Wy6KFA==
21+
-----END CERTIFICATE-----

‎certs/centST9/bak/node2-PKCS8-enc.pem‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDtzCCAp+gAwIBAgIUCmDnDYUWfuYCWfdQMy39ZUiSsaMwDQYJKoZIhvcNAQEL
3+
BQAwXTELMAkGA1UEBhMCQ0ExEDAOBgNVBAgMB09OVEFSSU8xEDAOBgNVBAcMB1RP
4+
Uk9OVE8xDDAKBgNVBAoMA09SRzENMAsGA1UECwwEVU5JVDENMAsGA1UEAwwEUk9P
5+
VDAeFw0yNDA2MjExNzM4NTBaFw0yNjA2MjExNzM4NTBaMGsxCzAJBgNVBAYTAkNB
6+
MRAwDgYDVQQIDAdPTlRBUklPMRAwDgYDVQQHDAdUT1JPTlRPMQwwCgYDVQQKDANP
7+
UkcxDTALBgNVBAsMBFVOSVQxGzAZBgNVBAMMEm5vZGUyLmRucy5hLXJlY29yZDCC
8+
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANRdrPpsYfxBvh4+E6FPHE9m
9+
JVnTlQ5tUlUkccG9y/fIT4y3kPVz5+o532StBhpAmP98uCHWQeKA93ZCIyPhBN3I
10+
105qZlPlYNEeBSA2t7I6brBL7FijuqI7yrjviU0+ciZNQghPY06SvK7JAgjcctGs
11+
6s3n6NobMzPBvcz7UyWn0t+7otbsIDsw+VBkn1BkvhbvBiqIJTn9alwTHc8Vfu6c
12+
rE2eh3mYY2n9QtgCmWhGNfUICFvvMJLKO3FK5Q1HJ2gWNCUzF1X+ew3fsS6LLDwB
13+
kwRsOY8rrzXQ0Xdy39WujFCGTPmg7m0amXHTY8hFaLbnkP/cxAaMJx7hslvnFOEC
14+
AwEAAaNhMF8wHQYDVR0RBBYwFIISbm9kZTIuZG5zLmEtcmVjb3JkMB0GA1UdDgQW
15+
BBRI4og+PofIbQ0YVm53nqeXJcprDDAfBgNVHSMEGDAWgBRYhmx56p3xT4JUKXZL
16+
JAKkB2FiAzANBgkqhkiG9w0BAQsFAAOCAQEAjLOr0flDbbfPetH/VWNcGS94grDJ
17+
idYLyCK6GIHVaOmcODUWrJ/jDLnVyEUe+mx1HVkNH8Pl5gSAyZAIdWs+IdY7sk30
18+
PXwmncYfUi5EtjYBjWwt/5C0PF1OKtKNKfqRhc/6xxMIN0UjBfkhs5nl/hVlRmzj
19+
znmwlMekLnZXeZV9UGk+PcaWlOvYHfbBd5z1+1M+bSrpO7XixtLNb5ZYqVWneI7O
20+
9ONxJSs9HjVhdnSjKPUVVPPCDTvYNalgQ0NgBkdrhoW3cYOGgHt/JQyp1WlQ4lrU
21+
sjoDgF9tXgCbACVY80cKxj/KJjL41ZgTjt/VMbFa/zoOzI0Tp9oQ0vmPSw==
22+
-----END CERTIFICATE-----

‎certs/centST9/bak/node2-key-PKCS8-enc.pem‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
-----BEGIN ENCRYPTED PRIVATE KEY-----
2+
MIIFNTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQ9onxteGVoByCMpL3
3+
kabXIQICCAAwDAYIKoZIhvcNAgsFADAdBglghkgBZQMEASoEENS1BQ3Nx2LJPCY6
4+
YpRQhyAEggTQw5HiZ81+A15CZJ+A5ePBnKB5OGkt4KJzh7OnacxYZq/b5UaRfj3t
5+
kMf/kX0WVzftf2dxu07/fnLwIpZzMhQSw6I+OO/iEIdTP0urxPKJPeNNhXAlHKan
6+
UFBBvlQrZJO0WEG4BWFwR9lgLiUwYPMpJrvhWqfaJfEVJF575pmunxRCZhg1xXbv
7+
PcQ8S3v3ezo4mmf8BX0YIql6cVLs0lafl2opDitWlDIA9lVdyxFNFuR0VeyT6J/a
8+
K1LV6JU/S99efXc2sIZzNx6RBIM0idf6jOzcxtgYoyAASH4SPIVKkmst3GosE6HH
9+
ceycJhFcmpMJQV0hMnzt9p68nMIoTQQa1KG5MICVH30S9ShDTPuX2rwjR3+ZQCpG
10+
Tas+z+/lAHRByxn9FVf/X/3i2+rTgrnjQR76bBxsAjOLrIBcG4Sw4mfmEXNz3U+l
11+
iaNmwXozLGQG5NrHdX28zdYSYay8FntnNQb9IIC0dld5grWs3ttPMi4NGgWmyDaB
12+
i5vKWJAbAz1IOhDYN3nFGqtHCUsZ1j7wpSv0u3j8DtdeL6jePKt6vZsaWS/S9jl2
13+
It4ba8Jv2rwe0LnqRlGX+qFfrXrYbye+snr2J3qgG+5pQ416nTY2lL4daIly5rpK
14+
51B+VThoUfAQw8lBWc0tnwcAbFN3P2sGhWQyyg+UhTOKcBh6DZJZCdZdvcJCHcLJ
15+
QuH+te/KWMae0Mb7jOESmzoucZDXUuRTlGeJvjvA6LZAeWvJbkgqN7QpWaAh0G5R
16+
gei+J3v20ouRU+ZbX+e7wdtWXbqc3QHeNLiY2oMYk7FOYkkdoxlhgi0BWCqG1XRY
17+
hc1TNBJ4vXMTVsQ54c+7Hn3rDStST6XVZKx7JX65laldCUHXljabL5gqq+6cIAWK
18+
HMRJrXZTuMbT5JzJpJSsmQ/kJbZaoKZCzh5sIOcEOzfgYebqiIspCsofRtwDBuc1
19+
iZH+TDQyRbiPtDOB5t4CMCRsQwYdN5PKzptCF3AkYCslBj9V3iKtUJzhX/9PLw12
20+
yqQUYpA++0739NKJU+/RuhxgNLBtyEOrtGa+cQ1nyY3C3TmwWxyTNHQvDAlyI9LS
21+
vkEdmbfxm93b4yM6qR+0FHunC+v4UHsfaUeWPCq3h44CKLNIbSG0D8rPYvhr5zDV
22+
OOzpSEgzM3NhOnIgN63LMn1N0gybvmUfLD5UToIKeu6UN0Cc5/QiVga6N6L8EGwl
23+
pqpaenyTrR2+MQH36SW+IeGfwsILwvV5gIDEu5qWxLP8HHoduKShc/8JxJ9mRgrH
24+
WuHqh9B//xDRLSvf1bgsqqU3twrJWJnm5EkMvk/+vDsG9vXCZjvT4RL3DGrx5aO9
25+
n5B7MQ+q2cdANG7jI+R5sqn/DPDjSooJt4wVx9SL1vAqjykZrsFAF10VBfcZZQC0
26+
P5+rnDrtyxIZsHaGstz4tBGqrSo4tZCh6XJV8xD7vnNhQQes+E4pCHJxZMQ1Jwrj
27+
0sYQy3jfRTCm2N2tl4YirQ4H9Ckwl589zzcu2JxDahJy5Cdbqh+A3/GcJlzFq3vR
28+
i6KwLnZbpLJo+IQeSBUi2L1Gvz2rMdyZuGmzeXzp8B6ZlsxfiG7ZPsEJvh2j9ooB
29+
zh8BZAhseufsaPy+jvJC6UY+6zCBQdFwhjQ7elyOx1u4rEZX1Xman6c=
30+
-----END ENCRYPTED PRIVATE KEY-----

‎certs/centST9/keystore.bks‎

3.66 KB
Binary file not shown.

0 commit comments

Comments
 (0)