make fips configurable

Author: iigonin

buildSrc/build.gradle

@@ -123,6 +123,8 @@ dependencies {
   api 'org.jruby.joni:joni:2.2.1'
   api "com.fasterxml.jackson.core:jackson-databind:${props.getProperty('jackson_databind')}"
   api "org.ajoberstar.grgit:grgit-core:5.2.1"
+  api "org.bouncycastle:bc-fips:1.0.2.5"
+
 
   testFixturesApi "junit:junit:${props.getProperty('junit')}"
   testFixturesApi "com.carrotsearch.randomizedtesting:randomizedtesting-runner:${props.getProperty('randomizedrunner')}"

buildSrc/src/main/java/org/opensearch/gradle/info/BuildParams.java

@@ -52,6 +52,7 @@ public class BuildParams {
     private static JavaVersion gradleJavaVersion;
     private static JavaVersion runtimeJavaVersion;
     private static String runtimeJavaDetails;
+    @Deprecated
     private static Boolean inFipsJvm;
     private static String gitRevision;
     private static String gitOrigin;

buildSrc/src/main/java/org/opensearch/gradle/info/GlobalBuildInfoPlugin.java

@@ -129,7 +129,7 @@ public void apply(Project project) {
             params.setIsCi(System.getenv("JENKINS_URL") != null);
             params.setIsInternal(isInternal);
             params.setDefaultParallel(findDefaultParallel(project));
-            params.setInFipsJvm(Util.getBooleanProperty("tests.fips.enabled", true));
+            params.setInFipsJvm(Util.getBooleanProperty("tests.fips.enabled", false));
             params.setIsSnapshotBuild(Util.getBooleanProperty("build.snapshot", true));
             if (isInternal) {
                 params.setBwcVersions(resolveBwcVersions(rootDir));

buildSrc/src/main/java/org/opensearch/gradle/testclusters/OpenSearchNode.java

@@ -1170,56 +1170,6 @@ private void createConfiguration() {
         baseConfig.put("node.portsfile", "true");
         baseConfig.put("http.port", httpPort);
         baseConfig.put("transport.port", transportPort);
-        baseConfig.put("http.host", "192.168.33.46");
-
-
-        // self-signed CA authority
-        baseConfig.put("reindex.ssl.certificate_authorities", "/home/iwan/workspace/OpenSearch/certs/centST9/root-ca.pem");
-
-        // DSA (basically can only be used for signing)
-        //        baseConfig.put("reindex.ssl.certificate", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-DSA.pem");
-        //        baseConfig.put("reindex.ssl.key", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-key-DSA.pem");
-
-        // DSA enc
-        //        baseConfig.put("reindex.ssl.certificate", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-DSA.pem");
-        //        baseConfig.put("reindex.ssl.key", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-key-DSA-enc.pem");
-        //        baseConfig.put("reindex.ssl.key_passphrase", "password");
-
-        // Elliptic Curve Diffie-Hellman (ECDH) secp256r1 aka prime256v1
-        //        baseConfig.put("reindex.ssl.certificate", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-EC.pem");
-        //        baseConfig.put("reindex.ssl.key", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-key-secp256r1.pem");
-
-        // Elliptic Curve enc
-        //        baseConfig.put("reindex.ssl.certificate", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-EC.pem");
-        //        baseConfig.put("reindex.ssl.key", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-key-secp256r1-enc.pem");
-        //        baseConfig.put("reindex.ssl.key_passphrase", "password");
-
-        // RSA PKCS#1
-        //        baseConfig.put("reindex.ssl.certificate", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-PKCS1.pem");
-        //        baseConfig.put("reindex.ssl.key", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-key-PKCS1.pem");
-
-        // RSA PKCS#1 enc
-        //                baseConfig.put("reindex.ssl.certificate", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-PKCS1.pem");
-        //                baseConfig.put("reindex.ssl.key", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-key-PKCS1-enc.pem");
-        //                baseConfig.put("reindex.ssl.key_passphrase", "password");
-
-        // RSA PKCS#8
-        //        baseConfig.put("reindex.ssl.certificate", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-PKCS8.pem");
-        //        baseConfig.put("reindex.ssl.key", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-key-PKCS8.pem");
-
-        // RSA PKCS#8 enc
-        baseConfig.put("reindex.ssl.certificate", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-PKCS8-enc.pem");
-        baseConfig.put("reindex.ssl.key", "/home/iwan/workspace/OpenSearch/certs/centST9/node2-key-PKCS8-enc.pem");
-        baseConfig.put("reindex.ssl.key_passphrase", "rzg9RxrMBDU3jV^^$vNB");
-
-        // keystore + struststore config
-        //        baseConfig.put("reindex.ssl.keystore.path", "/home/iwan/workspace/OpenSearch/certs/centST9/keystore.bks");
-        //        baseConfig.put("reindex.ssl.keystore.password", "password");
-        //        baseConfig.put("reindex.ssl.truststore.path", "/home/iwan/workspace/OpenSearch/certs/centST9/truststore.bks");
-        //        baseConfig.put("reindex.ssl.truststore.password", "password");
-
-        baseConfig.put("reindex.remote.whitelist", "node1.dns.a-record:10200");
-
         // Default the watermarks to absurdly low to prevent the tests from failing on nodes without enough disk space
         baseConfig.put("cluster.routing.allocation.disk.watermark.low", "1b");
         baseConfig.put("cluster.routing.allocation.disk.watermark.high", "1b");
@@ -1232,6 +1182,7 @@ private void createConfiguration() {
         baseConfig.put("indices.breaker.total.use_real_memory", "false");
         // Don't wait for state, just start up quickly. This will also allow new and old nodes in the BWC case to become the master
         baseConfig.put("discovery.initial_state_timeout", "0s");
+        baseConfig.put("fips.approved", "true");
 
         // TODO: Remove these once https://github.com/elastic/elasticsearch/issues/46091 is fixed
         baseConfig.put("logger.org.opensearch.action.support.master", "DEBUG");

buildSrc/src/main/resources/cacerts.bcfks

@@ -12,6 +12,7 @@
 // Security Policy for JDK 11 and higher, with BouncyCastle FIPS provider and BouncyCastleJsseProvider in FIPS mode
 
 grant {
+     permission org.bouncycastle.crypto.CryptoServicesPermission “changeToApprovedModeEnabled”;
      permission java.security.SecurityPermission "putProviderProperty.BCFIPS";
      permission java.security.SecurityPermission "putProviderProperty.BCJSSE";
      permission java.lang.RuntimePermission "getProtectionDomain";

buildSrc/src/main/resources/fips_java_bcjsse_11.policy

@@ -12,7 +12,6 @@ policy.provider=sun.security.provider.PolicyFile
 policy.expandProperties=true
 policy.allowSystemProperty=true
 policy.ignoreIdentityScope=false
-keystore.type=BCFKS
 keystore.type.compat=true
 package.access=sun.misc.,\
                sun.reflect.