Skip to content

Make Bookkeeper FIPS compliant by default #2631

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
eolivelli merged 6 commits into from
Mar 4, 2021
Merged

Make Bookkeeper FIPS compliant by default #2631

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
393a50a
Make Bookkeeper FIPS compliant by default
Ghatage Feb 27, 2021
96a630e
Add LICENSE entry
Ghatage Feb 27, 2021
5cd1021
Exclude non-fips BwouncyCastle
Ghatage Mar 2, 2021
dfd79aa
Remove duplicate line
Ghatage Mar 2, 2021
b74f0f6
Add details to LICENSE files
Ghatage Mar 2, 2021
fe45f8f
Package LICENSE for bc fips
Ghatage Mar 2, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions bin/bookkeeper
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,7 @@ GC_OPTS=$(build_bookie_jvm_opts ${BOOKIE_LOG_DIR} "gc_%p.log")
NETTY_OPTS=$(build_netty_opts)
LOGGING_OPTS=$(build_logging_opts ${BOOKIE_LOG_CONF} ${BOOKIE_LOG_DIR} ${BOOKIE_LOG_FILE} ${BOOKIE_ROOT_LOGGER})

BOOKIE_EXTRA_OPTS=$(BOOKIE_EXTRA_OPTS) "-Dorg.bouncycastle.fips.approved_only=true"
OPTS="${OPTS} -cp ${BOOKIE_CLASSPATH} ${BOOKIE_OPTS} ${GC_OPTS} ${NETTY_OPTS} ${LOGGING_OPTS} ${BOOKIE_EXTRA_OPTS}"

# Create log dir if it doesn't exist
Expand Down
2 changes: 1 addition & 1 deletion bookkeeper-dist/src/assemble/bin-all.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@
<include>checker-qual-3.5.0/LICENSE</include>
<include>google-auth-library-credentials-0.20.0/LICENSE</include>
<include>javax.servlet-api-4.0.0/CDDL+GPL-1.1</include>
<include>bouncycastle-1.60/LICENSE.html</include>
<include>bouncycastle-1.0.2/LICENSE.html</include>
<include>jsr-305/LICENSE</include>
<include>netty-4.1.50.Final/*</include>
<include>paranamer-2.8/LICENSE.txt</include>
Expand Down
2 changes: 1 addition & 1 deletion bookkeeper-dist/src/assemble/bin-server.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@
<include>google-auth-library-credentials-0.20.0/LICENSE</include>
<include>javax.servlet-api-4.0.0/CDDL+GPL-1.1</include>
<include>netty-4.1.50.Final/*</include>
<include>bouncycastle-1.60/LICENSE.html</include>
<include>bouncycastle-1.0.2/LICENSE.html</include>
<include>protobuf-3.14.0/LICENSE</include>
<include>protobuf-3.12.0/LICENSE</include>
<include>slf4j-1.7.25/LICENSE.txt</include>
Expand Down
2 changes: 1 addition & 1 deletion bookkeeper-dist/src/assemble/bkctl.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@
<include>checker-qual-3.5.0/LICENSE</include>
<include>google-auth-library-credentials-0.20.0/LICENSE</include>
<include>netty-4.1.50.Final/*</include>
<include>bouncycastle-1.60/LICENSE.html</include>
<include>bouncycastle-1.0.2/LICENSE.html</include>
<include>protobuf-3.14.0/LICENSE</include>
<include>protobuf-3.12.0/LICENSE</include>
<include>slf4j-1.7.25/LICENSE.txt</include>
Expand Down
6 changes: 2 additions & 4 deletions bookkeeper-dist/src/main/resources/LICENSE-all.bin.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -657,12 +657,10 @@ Bundled as
Source available at https://github.com/googleapis/google-auth-library-java/releases/tag/v0.20.0
------------------------------------------------------------------------------------
This product bundles the bouncycastle Library.
For license details, see deps/bouncycastle-1.60/LICENSE.html
For license details, see deps/bouncycastle-1.0.2/LICENSE.html

Bundled as
- lib/org.bouncycastle-bcpkix-jdk15on-1.60.jar
- lib/org.bouncycastle-bcprov-ext-jdk15on-1.60.jar
- lib/org.bouncycastle-bcprov-jdk15on-1.60.jar
- lib/org.bouncycastle-bc-fips-1.0.2.jar
------------------------------------------------------------------------------------
This product uses the annotations from The Checker Framework, which are licensed under
MIT License. For details, see deps/checker-qual-3.5.0/LICENSE
Expand Down
6 changes: 2 additions & 4 deletions bookkeeper-dist/src/main/resources/LICENSE-bkctl.bin.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -585,12 +585,10 @@ Bundled as
Source available at https://github.com/google/google-auth-library-java/tree/0.20.0
------------------------------------------------------------------------------------
This product bundles the bouncycastle Library.
For license details, see deps/bouncycastle-1.60/LICENSE.html
For license details, see deps/bouncycastle-1.0.2/LICENSE.html

Bundled as
- lib/org.bouncycastle-bcpkix-jdk15on-1.60.jar
- lib/org.bouncycastle-bcprov-ext-jdk15on-1.60.jar
- lib/org.bouncycastle-bcprov-jdk15on-1.60.jar
- lib/org.bouncycastle-bc-fips-1.0.2.jar
------------------------------------------------------------------------------------

This product uses the annotations from The Checker Framework, which are licensed under
Expand Down
6 changes: 2 additions & 4 deletions bookkeeper-dist/src/main/resources/LICENSE-server.bin.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -649,12 +649,10 @@ Bundled as
Source available at https://github.com/googleapis/google-auth-library-java/releases/tag/v0.20.0
------------------------------------------------------------------------------------
This product bundles the bouncycastle Library.
For license details, see deps/bouncycastle-1.60/LICENSE.html
For license details, see deps/bouncycastle-1.0.2/LICENSE.html

Bundled as
- lib/org.bouncycastle-bcpkix-jdk15on-1.60.jar
- lib/org.bouncycastle-bcprov-ext-jdk15on-1.60.jar
- lib/org.bouncycastle-bcprov-jdk15on-1.60.jar
- lib/org.bouncycastle-bc-fips-1.0.2.jar
------------------------------------------------------------------------------------
This product uses the annotations from The Checker Framework, which are licensed under
MIT License. For details, see deps/checker-qual-3.5.0/LICENSE
Expand Down
0 ...urces/deps/bouncycastle-1.60/LICENSE.html → ...rces/deps/bouncycastle-1.0.2/LICENSE.html
View file
Open in desktop
File renamed without changes.
6 changes: 1 addition & 5 deletions bookkeeper-server/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,11 +102,7 @@
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk15on</artifactId>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-ext-jdk15on</artifactId>
<artifactId>bc-fips</artifactId>
</dependency>
<dependency>
<groupId>com.beust</groupId>
Expand Down
2 changes: 1 addition & 1 deletion bookkeeper-server/src/main/java/org/apache/bookkeeper/tls/TLSContextFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ public class TLSContextFactory implements SecurityHandlerFactory {

static {
// Fixes loading PKCS8Key file: https://stackoverflow.com/a/18912362
java.security.Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
java.security.Security.addProvider(new org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider());
}

/**
Expand Down
6 changes: 6 additions & 0 deletions metadata-drivers/etcd/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,12 @@
<groupId>io.grpc</groupId>
<artifactId>grpc-all</artifactId>
<version>${grpc.version}</version>
<exclusions>
<exclusion>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk15on</artifactId>
</exclusion>
</exclusions>
</dependency>

<dependency>
Expand Down
9 changes: 2 additions & 7 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,7 @@
<commons-lang.version>2.6</commons-lang.version>
<commons-lang3.version>3.6</commons-lang3.version>
<commons-io.version>2.4</commons-io.version>
<bouncycastle.version>1.60</bouncycastle.version>
<bouncycastle.version>1.0.2</bouncycastle.version>
<curator.version>5.1.0</curator.version>
<dropwizard.version>3.2.5</dropwizard.version>
<etcd.version>0.5.4</etcd.version>
Expand Down Expand Up @@ -302,12 +302,7 @@
<!-- bouncy -->
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk15on</artifactId>
<version>${bouncycastle.version}</version>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-ext-jdk15on</artifactId>
<artifactId>bc-fips</artifactId>
<version>${bouncycastle.version}</version>
</dependency>
<!-- reflection libs -->
Expand Down
4 changes: 4 additions & 0 deletions stream/common/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,10 @@
<groupId>io.grpc</groupId>
<artifactId>grpc-netty-shaded</artifactId>
</exclusion>
<exclusion>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk15on</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand Down
4 changes: 4 additions & 0 deletions stream/tests-common/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,10 @@
<groupId>io.grpc</groupId>
<artifactId>grpc-netty-shaded</artifactId>
</exclusion>
<exclusion>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk15on</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand Down