Draft to allow run in FIPS compliace mode

Author: iigonin

build.gradle

@@ -65,7 +65,6 @@ apply from: 'gradle/ide.gradle'
 apply from: 'gradle/forbidden-dependencies.gradle'
 apply from: 'gradle/formatting.gradle'
 apply from: 'gradle/local-distribution.gradle'
-apply from: 'gradle/fips.gradle'
 apply from: 'gradle/run.gradle'
 apply from: 'gradle/missing-javadoc.gradle'
 apply from: 'gradle/code-coverage.gradle'

buildSrc/build.gradle

@@ -123,6 +123,8 @@ dependencies {
   api 'org.jruby.joni:joni:2.2.1'
   api "com.fasterxml.jackson.core:jackson-databind:${props.getProperty('jackson_databind')}"
   api "org.ajoberstar.grgit:grgit-core:5.2.1"
+  api "org.bouncycastle:bc-fips:1.0.2.5"
+
 
   testFixturesApi "junit:junit:${props.getProperty('junit')}"
   testFixturesApi "com.carrotsearch.randomizedtesting:randomizedtesting-runner:${props.getProperty('randomizedrunner')}"

buildSrc/src/main/java/org/opensearch/gradle/info/BuildParams.java

@@ -52,6 +52,7 @@ public class BuildParams {
     private static JavaVersion gradleJavaVersion;
     private static JavaVersion runtimeJavaVersion;
     private static String runtimeJavaDetails;
+    @Deprecated
     private static Boolean inFipsJvm;
     private static String gitRevision;
     private static String gitOrigin;

buildSrc/src/main/java/org/opensearch/gradle/testclusters/OpenSearchNode.java

@@ -1182,6 +1182,7 @@ private void createConfiguration() {
         baseConfig.put("indices.breaker.total.use_real_memory", "false");
         // Don't wait for state, just start up quickly. This will also allow new and old nodes in the BWC case to become the master
         baseConfig.put("discovery.initial_state_timeout", "0s");
+        baseConfig.put("fips.approved", "true");
 
         // TODO: Remove these once https://github.com/elastic/elasticsearch/issues/46091 is fixed
         baseConfig.put("logger.org.opensearch.action.support.master", "DEBUG");

buildSrc/src/main/resources/cacerts.bcfks

@@ -12,7 +12,6 @@ policy.provider=sun.security.provider.PolicyFile
 policy.expandProperties=true
 policy.allowSystemProperty=true
 policy.ignoreIdentityScope=false
-keystore.type=BCFKS
 keystore.type.compat=true
 package.access=sun.misc.,\
                sun.reflect.
@@ -23,12 +22,9 @@ ssl.KeyManagerFactory.algorithm=PKIX
 ssl.TrustManagerFactory.algorithm=PKIX
 networkaddress.cache.negative.ttl=10
 krb5.kdc.bad.policy = tryLast
-jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1 jdkCA & usage TLSServer, \
-    RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224
-jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, \
-      DSA keySize < 1024
-jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 1024, \
-    EC keySize < 224, DES40_CBC, RC4_40, 3DES_EDE_CBC
+jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1, jdkCA&usageTLSServer, RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224
+jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, DSA keySize < 1024
+jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, MD5withRSA, DH keySize < 1024, EC keySize < 224, DES40_CBC, RC4_40, 3DES_EDE_CBC
 jdk.tls.legacyAlgorithms= \
         K_NULL, C_NULL, M_NULL, \
         DH_anon, ECDH_anon, \