From Fedora Project Wiki

< Changes

Revision as of 08:31, 12 December 2016 by Jkurik (talk | contribs) (Release Notes)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Java/OpenJDK enforces the system-wide crypto policy

Summary

As it is now, the System-wide crypto policy in F25 is enforced by the OpenSSL, GnuTLS and NSS TLS libraries. To harmonize crypto across all applications in Fedora, including the Java ones, OpenJDK is enhanced to respect the settings of the system-wide crypto policy as well.

Owner

Current status

Detailed Description

As it is now, the System-wide crypto policy in F25 is enforced by the OpenSSL, GnuTLS and NSS TLS libraries. To harmonize crypto across all applications in Fedora, including the Java ones, OpenJDK is enhanced to respect the settings of the system-wide crypto policy as well.

After that change the administrator should be assured that any Java application will follow a policy that adheres to the configured profile.


Benefit to Fedora

With this change a Fedora system will have a consistent way of setting a default security profile for all java applications. Overall this brings the Java applications in par with the OpenSSL and GnuTLS with respect to system-wide policy adherence.


Scope

  • Proposal owners:

The change requires modifying OpenJDK to read additional security properties from the generated by the crypto policies file (/etc/crypto-policies/back-ends/java.config).

  • Other developers:

There are no required actions by other developers. The change requires only targeted changes to openjdk and crypto-policies.


  • Release engineering:

No actions required.


  • Trademark approval:

N/A (not needed for this Change)

Upgrade/compatibility impact

Connection to legacy systems with Java-applications may no longer be possible. This can be worked around by the administrator by switching from the DEFAULT to LEGACY crypto policy.

How To Test

Testing good operation

Test the good operation of Java applications to connect to various sites on the Internet.

Testing application of settings

  • Setup an HTTPS server with a legacy protocol that is disabled in F25 system wide policy (e.g., RC4, SSL 3.0)
  • Use an java application to connect to that server
  • The connection should fail on F25 (may have succeeded on previous versions - something that depends on the application specific policy).


User Experience

Given that the system wide policy does disable obsolete ciphers and protocols, there should be no user noticeable result.

Dependencies

Several. Use "repoquery --whatrequires java" for the dependency listing.

Contingency Plan

  • Contingency mechanism:

If the changes to NSS are not complete on time then OpenJDK will remain the same without respecting the crypto policies in Fedora 25.

  • Contingency deadline: F26 alpha
  • Blocks release? Yes
  • Blocks product? N/A

Documentation

Release Notes

A proposal of notes is the following.

The release notes originally used in Crypto policies changes should be used, in addition to: "With this change a Fedora system will have a consistent way of setting a default security profile for all Java-depending applications. Overall this brings the Java applications in par with the OpenSSL and GnuTLS with respect to system-wide policy adherence."