Skip to content

Commit 78fddee

Browse files
author
Igonin
committed
downgrade bc versions
Signed-off-by: Igonin <[email protected]>
1 parent 64bf6c5 commit 78fddee

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+104
-134
lines changed

‎client/rest/licenses/bc-fips-2.0.0.jar.sha1

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ee9ac432cf08f9a9ebee35d7cf8a45f94959a7ab

‎client/rest/licenses/bc-fips-2.1.0.jar.sha1

-1
This file was deleted.

‎client/rest/licenses/bctls-fips-2.0.19.jar.sha1

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
9cc33650ede63bc1a8281ed5c8e1da314d50bc76

‎client/rest/licenses/bctls-fips-2.1.20.jar.sha1

-1
This file was deleted.

‎client/rest/licenses/bcutil-fips-2.0.3.jar.sha1

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
a1857cd639295b10cc90e6d31ecbc523cdafcc19

‎client/rest/licenses/bcutil-fips-2.1.4.jar.sha1

-1
This file was deleted.

‎client/rest/src/test/java/org/opensearch/client/BCDisposalDaemonFilter.java

-19
This file was deleted.

‎client/rest/src/test/java/org/opensearch/client/RestClientBuilderIntegTests.java

-3
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,6 @@
3232

3333
package org.opensearch.client;
3434

35-
import com.carrotsearch.randomizedtesting.annotations.ThreadLeakFilters;
36-
3735
import com.sun.net.httpserver.HttpExchange;
3836
import com.sun.net.httpserver.HttpHandler;
3937
import com.sun.net.httpserver.HttpsConfigurator;
@@ -66,7 +64,6 @@
6664
/**
6765
* Integration test to validate the builder builds a client with the correct configuration
6866
*/
69-
@ThreadLeakFilters(filters = { BCDisposalDaemonFilter.class })
7067
public class RestClientBuilderIntegTests extends RestClientTestCase {
7168

7269
private static HttpsServer httpsServer;

‎distribution/src/config/java.security

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
# Security properties for non-approved mode 'org.bouncycastle.fips.approved_only=false'. Intended to be used complementary e.g.
1+
# Security properties for non-approved mode 'org.bouncycastle.fips.approved_only=false'.
2+
# Intended to be used complementary with a single equal sign e.g. 'java.security.properties=java.security'
23

34
security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
45
security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider

‎distribution/tools/keystore-cli/src/test/java/org/opensearch/tools/cli/keystore/AddStringKeyStoreCommandTests.java

+7-12
Original file line numberDiff line numberDiff line change
@@ -72,18 +72,13 @@ public void testInvalidPassphrease() throws Exception {
7272
terminal.addSecretInput("thewrongpassword");
7373
UserException e = expectThrows(UserException.class, () -> execute("foo2"));
7474
assertEquals(e.getMessage(), ExitCodes.DATA_ERROR, e.exitCode);
75-
if (inFipsJvm()) {
76-
assertThat(
77-
e.getMessage(),
78-
anyOf(
79-
containsString("Provided keystore password was incorrect"),
80-
containsString("Keystore has been corrupted or tampered with")
81-
)
82-
);
83-
} else {
84-
assertThat(e.getMessage(), containsString("Provided keystore password was incorrect"));
85-
}
86-
75+
assertThat(
76+
e.getMessage(),
77+
anyOf(
78+
containsString("Provided keystore password was incorrect"),
79+
containsString("Keystore has been corrupted or tampered with")
80+
)
81+
);
8782
}
8883

8984
public void testMissingPromptCreateWithoutPasswordWhenPrompted() throws Exception {

‎distribution/tools/keystore-cli/src/test/java/org/opensearch/tools/cli/keystore/ChangeKeyStorePasswordCommandTests.java

+7-11
Original file line numberDiff line numberDiff line change
@@ -104,16 +104,12 @@ public void testChangeKeyStorePasswordWrongExistingPassword() throws Exception {
104104
// We'll only be prompted once (for the old password)
105105
UserException e = expectThrows(UserException.class, this::execute);
106106
assertEquals(e.getMessage(), ExitCodes.DATA_ERROR, e.exitCode);
107-
if (inFipsJvm()) {
108-
assertThat(
109-
e.getMessage(),
110-
anyOf(
111-
containsString("Provided keystore password was incorrect"),
112-
containsString("Keystore has been corrupted or tampered with")
113-
)
114-
);
115-
} else {
116-
assertThat(e.getMessage(), containsString("Provided keystore password was incorrect"));
117-
}
107+
assertThat(
108+
e.getMessage(),
109+
anyOf(
110+
containsString("Provided keystore password was incorrect"),
111+
containsString("Keystore has been corrupted or tampered with")
112+
)
113+
);
118114
}
119115
}

‎distribution/tools/keystore-cli/src/test/java/org/opensearch/tools/cli/keystore/KeyStoreWrapperTests.java

+7-11
Original file line numberDiff line numberDiff line change
@@ -138,17 +138,13 @@ public void testDecryptKeyStoreWithWrongPassword() throws Exception {
138138
SecurityException.class,
139139
() -> loadedKeystore.decrypt(new char[] { 'i', 'n', 'v', 'a', 'l', 'i', 'd' })
140140
);
141-
if (inFipsJvm()) {
142-
assertThat(
143-
exception.getMessage(),
144-
anyOf(
145-
containsString("Provided keystore password was incorrect"),
146-
containsString("Keystore has been corrupted or tampered with")
147-
)
148-
);
149-
} else {
150-
assertThat(exception.getMessage(), containsString("Provided keystore password was incorrect"));
151-
}
141+
assertThat(
142+
exception.getMessage(),
143+
anyOf(
144+
containsString("Provided keystore password was incorrect"),
145+
containsString("Keystore has been corrupted or tampered with")
146+
)
147+
);
152148
}
153149

154150
public void testCannotReadStringFromClosedKeystore() throws Exception {

‎distribution/tools/keystore-cli/src/test/java/org/opensearch/tools/cli/keystore/ListKeyStoreCommandTests.java

+7-11
Original file line numberDiff line numberDiff line change
@@ -90,17 +90,13 @@ public void testListWithIncorrectPassword() throws Exception {
9090
terminal.addSecretInput("thewrongkeystorepassword");
9191
UserException e = expectThrows(UserException.class, this::execute);
9292
assertEquals(e.getMessage(), ExitCodes.DATA_ERROR, e.exitCode);
93-
if (inFipsJvm()) {
94-
assertThat(
95-
e.getMessage(),
96-
anyOf(
97-
containsString("Provided keystore password was incorrect"),
98-
containsString("Keystore has been corrupted or tampered with")
99-
)
100-
);
101-
} else {
102-
assertThat(e.getMessage(), containsString("Provided keystore password was incorrect"));
103-
}
93+
assertThat(
94+
e.getMessage(),
95+
anyOf(
96+
containsString("Provided keystore password was incorrect"),
97+
containsString("Keystore has been corrupted or tampered with")
98+
)
99+
);
104100
}
105101

106102
public void testListWithUnprotectedKeystore() throws Exception {

‎distribution/tools/keystore-cli/src/test/java/org/opensearch/tools/cli/keystore/RemoveSettingKeyStoreCommandTests.java

+7-12
Original file line numberDiff line numberDiff line change
@@ -107,18 +107,13 @@ public void testRemoveWithIncorrectPassword() throws Exception {
107107
terminal.addSecretInput("thewrongpassword");
108108
UserException e = expectThrows(UserException.class, () -> execute("foo"));
109109
assertEquals(e.getMessage(), ExitCodes.DATA_ERROR, e.exitCode);
110-
if (inFipsJvm()) {
111-
assertThat(
112-
e.getMessage(),
113-
anyOf(
114-
containsString("Provided keystore password was incorrect"),
115-
containsString("Keystore has been corrupted or tampered with")
116-
)
117-
);
118-
} else {
119-
assertThat(e.getMessage(), containsString("Provided keystore password was incorrect"));
120-
}
121-
110+
assertThat(
111+
e.getMessage(),
112+
anyOf(
113+
containsString("Provided keystore password was incorrect"),
114+
containsString("Keystore has been corrupted or tampered with")
115+
)
116+
);
122117
}
123118

124119
public void testRemoveFromUnprotectedKeystore() throws Exception {

‎distribution/tools/plugin-cli/build.gradle

-1
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@ dependencies {
3838
compileOnly project(":server")
3939
compileOnly project(":libs:opensearch-cli")
4040
api "org.bouncycastle:bcpg-fips:${versions.bouncycastle_pg}"
41-
api "org.bouncycastle:bc-fips:${versions.bouncycastle_jce}"
4241
testImplementation(project(":test:framework"))
4342
testImplementation 'com.google.jimfs:jimfs:1.3.0'
4443
testRuntimeOnly("com.google.guava:guava:${versions.guava}") {

‎distribution/tools/plugin-cli/licenses/bc-fips-2.1.0.jar.sha1

-1
This file was deleted.

‎distribution/tools/plugin-cli/licenses/bcpg-fips-2.0.8.jar.sha1

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
51c2f633e0c32d10de1ebab4c86f93310ff820f8

‎distribution/tools/plugin-cli/licenses/bcpg-fips-2.1.11.jar.sha1

-1
This file was deleted.

‎gradle/fips.gradle

+2-2
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,8 @@ if (BuildParams.inFipsJvm) {
3636
fipsPolicy = new File(fipsResourcesDir, "fips_java_bcjsse_11.policy")
3737
}
3838
File fipsTrustStore = new File(fipsResourcesDir, 'cacerts.bcfks')
39-
def bcFips = dependencies.create('org.bouncycastle:bc-fips:2.1.0')
40-
def bcTlsFips = dependencies.create('org.bouncycastle:bctls-fips:2.1.20')
39+
def bcFips = dependencies.create('org.bouncycastle:bc-fips:2.0.0')
40+
def bcTlsFips = dependencies.create('org.bouncycastle:bctls-fips:2.0.19')
4141

4242
pluginManager.withPlugin('java') {
4343
TaskProvider<ExportOpenSearchBuildResourcesTask> fipsResourcesTask = project.tasks.register('fipsResources', ExportOpenSearchBuildResourcesTask)

‎gradle/libs.versions.toml

+8-5
Original file line numberDiff line numberDiff line change
@@ -58,11 +58,11 @@ reactivestreams = "1.0.4"
5858
# when updating this version, you need to ensure compatibility with:
5959
# - plugins/ingest-attachment (transitive dependency, check the upstream POM)
6060
# - distribution/tools/plugin-cli
61-
bouncycastle_jce = "2.1.0"
62-
bouncycastle_tls = "2.1.20"
63-
bouncycastle_pkix = "2.1.9"
64-
bouncycastle_pg = "2.1.11"
65-
bouncycastle_util = "2.1.4"
61+
bouncycastle_jce = "2.0.0"
62+
bouncycastle_tls = "2.0.19"
63+
bouncycastle_pkix = "2.0.7"
64+
bouncycastle_pg = "2.0.8"
65+
bouncycastle_util = "2.0.3"
6666
password4j = "1.8.2"
6767
# test dependencies
6868
randomizedrunner = "2.7.1"
@@ -91,6 +91,9 @@ arrow = "18.1.0"
9191
flatbuffers = "2.0.0"
9292

9393
[libraries]
94+
bcjce = { group = "org.bouncycastle", name = "bc-fips", version.ref = "bouncycastle_jce" }
95+
bctls = { group = "org.bouncycastle", name = "bctls-fips", version.ref = "bouncycastle_tls" }
96+
bcutil = { group = "org.bouncycastle", name = "bcutil-fips", version.ref = "bouncycastle_util" }
9497
hdrhistogram = { group = "org.hdrhistogram", name = "HdrHistogram", version.ref = "hdrhistogram" }
9598
jakartaannotation = { group = "jakarta.annotation", name = "jakarta.annotation-api", version.ref = "jakarta_annotation" }
9699
jodatime = { group = "joda-time", name = "joda-time", version.ref = "joda" }

‎libs/ssl-config/licenses/bc-fips-2.0.0.jar.sha1

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ee9ac432cf08f9a9ebee35d7cf8a45f94959a7ab

‎libs/ssl-config/licenses/bc-fips-2.1.0.jar.sha1

-1
This file was deleted.

‎libs/ssl-config/licenses/bcpkix-fips-2.0.7.jar.sha1

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
01eea0f325315ca6295b0a6926ff862d8001cdf9

‎libs/ssl-config/licenses/bcpkix-fips-2.1.9.jar.sha1

-1
This file was deleted.

‎libs/ssl-config/licenses/bctls-fips-2.0.19.jar.sha1

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
9cc33650ede63bc1a8281ed5c8e1da314d50bc76

‎libs/ssl-config/licenses/bctls-fips-2.1.20.jar.sha1

-1
This file was deleted.

‎libs/ssl-config/licenses/bcutil-fips-2.0.3.jar.sha1

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
a1857cd639295b10cc90e6d31ecbc523cdafcc19

‎libs/ssl-config/licenses/bcutil-fips-2.1.4.jar.sha1

-1
This file was deleted.

‎libs/ssl-config/src/test/java/org/opensearch/common/ssl/BCDisposalDaemonFilter.java

-19
This file was deleted.

‎libs/ssl-config/src/test/java/org/opensearch/common/ssl/PemKeyConfigTests.java

-3
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,6 @@
3232

3333
package org.opensearch.common.ssl;
3434

35-
import com.carrotsearch.randomizedtesting.annotations.ThreadLeakFilters;
36-
3735
import org.opensearch.test.OpenSearchTestCase;
3836
import org.hamcrest.Matchers;
3937

@@ -57,7 +55,6 @@
5755
import static org.hamcrest.Matchers.iterableWithSize;
5856
import static org.hamcrest.Matchers.notNullValue;
5957

60-
@ThreadLeakFilters(filters = { BCDisposalDaemonFilter.class })
6158
public class PemKeyConfigTests extends OpenSearchTestCase {
6259
private static final int IP_NAME = 7;
6360
private static final int DNS_NAME = 2;

‎libs/ssl-config/src/test/java/org/opensearch/common/ssl/PemUtilsTests.java

-3
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,6 @@
3232

3333
package org.opensearch.common.ssl;
3434

35-
import com.carrotsearch.randomizedtesting.annotations.ThreadLeakFilters;
36-
3735
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
3836
import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
3937
import org.opensearch.test.OpenSearchTestCase;
@@ -57,7 +55,6 @@
5755
import static org.hamcrest.Matchers.notNullValue;
5856
import static org.hamcrest.core.StringContains.containsString;
5957

60-
@ThreadLeakFilters(filters = { BCDisposalDaemonFilter.class })
6158
public class PemUtilsTests extends OpenSearchTestCase {
6259

6360
private static final Supplier<char[]> EMPTY_PASSWORD = () -> new char[0];

‎libs/ssl-config/src/test/java/org/opensearch/common/ssl/SslConfigurationLoaderTests.java

-3
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,6 @@
3232

3333
package org.opensearch.common.ssl;
3434

35-
import com.carrotsearch.randomizedtesting.annotations.ThreadLeakFilters;
36-
3735
import org.opensearch.common.settings.MockSecureSettings;
3836
import org.opensearch.common.settings.Settings;
3937
import org.opensearch.core.common.settings.SecureString;
@@ -53,7 +51,6 @@
5351
import static org.hamcrest.Matchers.is;
5452
import static org.hamcrest.Matchers.notNullValue;
5553

56-
@ThreadLeakFilters(filters = { BCDisposalDaemonFilter.class })
5754
public class SslConfigurationLoaderTests extends OpenSearchTestCase {
5855

5956
private final String STRONG_PRIVATE_SECRET = "6!6428DQXwPpi7@$ggeg/=";

‎libs/ssl-config/src/test/java/org/opensearch/common/ssl/StoreKeyConfigTests.java

-3
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,6 @@
3232

3333
package org.opensearch.common.ssl;
3434

35-
import com.carrotsearch.randomizedtesting.annotations.ThreadLeakFilters;
36-
3735
import org.opensearch.test.OpenSearchTestCase;
3836
import org.hamcrest.Matchers;
3937

@@ -60,7 +58,6 @@
6058
import static org.hamcrest.Matchers.notNullValue;
6159
import static org.hamcrest.Matchers.nullValue;
6260

63-
@ThreadLeakFilters(filters = { BCDisposalDaemonFilter.class })
6461
public class StoreKeyConfigTests extends OpenSearchTestCase {
6562

6663
private static final int IP_NAME = 7;

‎libs/ssl-config/src/test/java/org/opensearch/common/ssl/StoreTrustConfigTests.java

-3
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,6 @@
3232

3333
package org.opensearch.common.ssl;
3434

35-
import com.carrotsearch.randomizedtesting.annotations.ThreadLeakFilters;
36-
3735
import org.opensearch.test.OpenSearchTestCase;
3836
import org.hamcrest.Matchers;
3937

@@ -54,7 +52,6 @@
5452
import static org.hamcrest.Matchers.containsString;
5553
import static org.hamcrest.Matchers.nullValue;
5654

57-
@ThreadLeakFilters(filters = { BCDisposalDaemonFilter.class })
5855
public class StoreTrustConfigTests extends OpenSearchTestCase {
5956

6057
private static final char[] P12_PASS = "p12-pass".toCharArray();

‎server/build.gradle

+10
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,12 @@ dependencies {
114114

115115
// https://mvnrepository.com/artifact/org.roaringbitmap/RoaringBitmap
116116
api libs.roaringbitmap
117+
118+
// BC security provider
119+
api libs.bcjce
120+
api libs.bctls
121+
api libs.bcutil
122+
117123
testImplementation 'org.awaitility:awaitility:4.3.0'
118124
testImplementation(project(":test:framework")) {
119125
// tests use the locally compiled version of server
@@ -163,6 +169,10 @@ tasks.named("testingConventions").configure {
163169
}
164170
}
165171

172+
tasks.named("dependencyLicenses").configure {
173+
mapping from: /bc.*/, to: 'bouncycastle'
174+
}
175+
166176
// Set to current version by default
167177
def japicmpCompareTarget = System.getProperty("japicmp.compare.version")
168178
if (japicmpCompareTarget == null) { /* use latest released version */

‎server/licenses/bc-fips-2.0.0.jar.sha1

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ee9ac432cf08f9a9ebee35d7cf8a45f94959a7ab

0 commit comments

Comments
 (0)