SSLConfigurationReloaderTests.testPEMTrustReloadException fails on Java 8 FIPS #39580
Assignees
Labels
Comments
gwbrown
added
>test-failure
|
Pinging @elastic/es-security |
|
This does reproduce in a FIPS JVM and has to do with the changes introduced in #39408 . We didn't pick this up since we don't run tests in a FIPS JVM in PRs. I will investigate |
|
This has to do with how certificates are read from files in the default java security provider and the security provider offered by BouncyCastle. The former reads the certificate from file in private Collection<? extends java.security.cert.Certificate>
parseX509orPKCS7Cert(InputStream is)
throws CertificateException, IOException
{
int peekByte;
byte[] data;
PushbackInputStream pbis = new PushbackInputStream(is);
Collection<X509CertImpl> coll = new ArrayList<>();
// Test the InputStream for end-of-stream. If the stream's
// initial state is already at end-of-stream then return
// an empty collection. Otherwise, push the byte back into the
// stream and let readOneBlock look for the first certificate.
peekByte = pbis.read();
if (peekByte == -1) {
return new ArrayList<>(0);
} else {
pbis.unread(peekByte);
data = readOneBlock(pbis);
}
// If we end up with a null value after reading the first block
// then we know the end-of-stream has been reached and no certificate
// data has been found.
if (data == null) {
throw new CertificateException("No certificate data found"); // It throws here in our test !
}
try {
PKCS7 pkcs7 = new PKCS7(data);
X509Certificate[] certs = pkcs7.getCertificates();
// certs are optional in PKCS #7
if (certs != null) {
return Arrays.asList(certs);
} else {
// no certificates provided
return new ArrayList<>(0);
}
} catch (ParsingException e) {
while (data != null) {
coll.add(new X509CertImpl(data));
data = readOneBlock(pbis);
}
}
return coll;
}which throws an exception for the malformed file, while the latter reads the certificate from file in public Collection engineGenerateCertificates(InputStream inStream) throws CertificateException {
List certs = new ArrayList();
BufferedInputStream in = new BufferedInputStream(inStream);
Certificate certificate;
while((certificate = this.readCertificate(in)) != null) {
certs.add(certificate);
}
return certs;
}that returns an empty Arraylist and doesn't throw. |
|
In ssl-config we worked around this by failing if the cert parsing returned and empty list: |
|
I'm going to mute this on FIPS. |
tvernum
added a commit
to tvernum/elasticsearch
that referenced
this issue
Mar 4, 2019
tvernum
added a commit
that referenced
this issue
Mar 4, 2019
jkakavas
added a commit
to jkakavas/elasticsearch
that referenced
this issue
Mar 15, 2019
With SUN security provider, a CertificateException is thrown when attempting to parse a Certificate from a PEM file on disk with `sun.security.provider.X509Provider#parseX509orPKCS7Cert` When using the BouncyCastle Security provider (as we do in fips tests) the parsing happens in CertificateFactory#engineGenerateCertificates which doesn't throw an exception but returns an empty list. In order to have a consistent behavior, this change makes it so that we throw a CertificateException when attempting to read a PEM file from disk and failing to do so in either Security Provider Resolves: elastic#39580
jkakavas
added a commit
that referenced
this issue
Mar 18, 2019
With SUN security provider, a CertificateException is thrown when attempting to parse a Certificate from a PEM file on disk with `sun.security.provider.X509Provider#parseX509orPKCS7Cert` When using the BouncyCastle Security provider (as we do in fips tests) the parsing happens in CertificateFactory#engineGenerateCertificates which doesn't throw an exception but returns an empty list. In order to have a consistent behavior, this change makes it so that we throw a CertificateException when attempting to read a PEM file from disk and failing to do so in either Security Provider Resolves: #39580
jkakavas
added a commit
that referenced
this issue
Mar 18, 2019
With SUN security provider, a CertificateException is thrown when attempting to parse a Certificate from a PEM file on disk with `sun.security.provider.X509Provider#parseX509orPKCS7Cert` When using the BouncyCastle Security provider (as we do in fips tests) the parsing happens in CertificateFactory#engineGenerateCertificates which doesn't throw an exception but returns an empty list. In order to have a consistent behavior, this change makes it so that we throw a CertificateException when attempting to read a PEM file from disk and failing to do so in either Security Provider Resolves: #39580
jkakavas
added a commit
that referenced
this issue
Mar 18, 2019
With SUN security provider, a CertificateException is thrown when attempting to parse a Certificate from a PEM file on disk with `sun.security.provider.X509Provider#parseX509orPKCS7Cert` When using the BouncyCastle Security provider (as we do in fips tests) the parsing happens in CertificateFactory#engineGenerateCertificates which doesn't throw an exception but returns an empty list. In order to have a consistent behavior, this change makes it so that we throw a CertificateException when attempting to read a PEM file from disk and failing to do so in either Security Provider Resolves: #39580
jkakavas
added a commit
that referenced
this issue
Mar 18, 2019
With SUN security provider, a CertificateException is thrown when attempting to parse a Certificate from a PEM file on disk with `sun.security.provider.X509Provider#parseX509orPKCS7Cert` When using the BouncyCastle Security provider (as we do in fips tests) the parsing happens in CertificateFactory#engineGenerateCertificates which doesn't throw an exception but returns an empty list. In order to have a consistent behavior, this change makes it so that we throw a CertificateException when attempting to read a PEM file from disk and failing to do so in either Security Provider Resolves: #39580
jkakavas
added a commit
that referenced
this issue
Mar 18, 2019
With SUN security provider, a CertificateException is thrown when attempting to parse a Certificate from a PEM file on disk with `sun.security.provider.X509Provider#parseX509orPKCS7Cert` When using the BouncyCastle Security provider (as we do in fips tests) the parsing happens in CertificateFactory#engineGenerateCertificates which doesn't throw an exception but returns an empty list. In order to have a consistent behavior, this change makes it so that we throw a CertificateException when attempting to read a PEM file from disk and failing to do so in either Security Provider Resolves: #39580
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Example failure: https://elasticsearch-ci.elastic.co/job/elastic+elasticsearch+6.6+matrix-java-periodic/ES_BUILD_JAVA=java11,ES_RUNTIME_JAVA=java8fips,nodes=immutable&&linux&&docker/144/console
This test started failing on Feb. 27, and has failed (at time of writing) 27 times since, on 6.6, 6.7, 7.0, 7.x, and master. It appears to only be failing when running on Java 8 FIPS.
I haven't reproduced this myself since I don't have a FIPS JVM set up.
Reproduce line is:
Stack trace from one of the failures on Master:
Not muting this since it doesn't appear to be impacting PRs.
The text was updated successfully, but these errors were encountered: