Skip to content

Commit 7aa2a0d

Browse files
rlm2002rlm2002
authored
Merge pull request #342 from cconlon/skipFIPSCAST
Add wolfjsse.skipFIPSCAST Security property
2 parents bbb0153 + bf7912c commit 7aa2a0d

12 files changed

Lines changed: 748 additions & 113 deletions

‎.github/workflows/fips-ready-dual-provider.yml‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
name: FIPS Ready Dual Provider Test
2+
3+
on:
4+
push:
5+
branches: [ 'master', 'main', 'release/**' ]
6+
pull_request:
7+
branches: [ 'master' ]
8+
9+
jobs:
10+
dual-provider-fips-test:
11+
runs-on: ubuntu-latest
12+
strategy:
13+
fail-fast: false
14+
matrix:
15+
jdk_version: [ '11', '21' ]
16+
name: Dual Provider FIPS (JDK ${{ matrix.jdk_version }})
17+
18+
steps:
19+
- name: Checkout wolfssljni
20+
uses: actions/checkout@v4
21+
with:
22+
path: wolfssljni
23+
24+
- name: Setup Java
25+
uses: actions/setup-java@v4
26+
with:
27+
distribution: zulu
28+
java-version: ${{ matrix.jdk_version }}
29+
30+
- name: Cache JUnit dependencies
31+
uses: actions/cache@v4
32+
id: cache-junit
33+
with:
34+
path: junit
35+
key: junit-jars-v1
36+
37+
- name: Download junit-4.13.2.jar
38+
if: steps.cache-junit.outputs.cache-hit != 'true'
39+
run: |
40+
wget --directory-prefix=$GITHUB_WORKSPACE/junit \
41+
https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar
42+
echo "8e495b634469d64fb8acfa3495a065cbacc8a0fff55ce1e31007be4c16dc57d3 $GITHUB_WORKSPACE/junit/junit-4.13.2.jar" \
43+
| sha256sum -c -
44+
45+
- name: Download hamcrest-all-1.3.jar
46+
if: steps.cache-junit.outputs.cache-hit != 'true'
47+
run: |
48+
wget --directory-prefix=$GITHUB_WORKSPACE/junit \
49+
https://repo1.maven.org/maven2/org/hamcrest/hamcrest-all/1.3/hamcrest-all-1.3.jar
50+
echo "4877670629ab96f34f5f90ab283125fcd9acb7e683e66319a68be6eb2cca60de $GITHUB_WORKSPACE/junit/hamcrest-all-1.3.jar" \
51+
| sha256sum -c -
52+
53+
# Get latest wolfSSL stable version for FIPS Ready download URL
54+
- name: Get latest wolfSSL stable version
55+
id: wolfssl-version
56+
env:
57+
GITHUB_TOKEN: ${{ github.token }}
58+
run: |
59+
LATEST_TAG=$(curl -s \
60+
-H "Authorization: Bearer $GITHUB_TOKEN" \
61+
"https://api.github.com/repos/wolfSSL/wolfssl/tags?per_page=100" | \
62+
jq -r '.[].name | select(endswith("-stable"))' | \
63+
sort -V | tail -n 1)
64+
if [ -z "$LATEST_TAG" ]; then
65+
echo "Error: No stable wolfSSL tags found" >&2
66+
exit 1
67+
fi
68+
VERSION=$(echo "$LATEST_TAG" | sed 's/^v//' | sed 's/-stable$//')
69+
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
70+
echo "Latest wolfSSL stable version: $VERSION"
71+
72+
# Cache only the downloaded zip to avoid reusing stale build
73+
# artifacts across matrix jobs (JDK 11 vs 21)
74+
- name: Cache wolfSSL FIPS Ready zip
75+
uses: actions/cache@v4
76+
id: cache-fips-ready
77+
with:
78+
path: wolfssl-fips-ready.zip
79+
key: wolfssl-fips-ready-${{ steps.wolfssl-version.outputs.version }}
80+
81+
- name: Download wolfSSL FIPS Ready
82+
if: steps.cache-fips-ready.outputs.cache-hit != 'true'
83+
run: |
84+
VERSION=${{ steps.wolfssl-version.outputs.version }}
85+
URL="https://www.wolfssl.com/wolfssl-${VERSION}-gplv3-fips-ready.zip"
86+
echo "Downloading: $URL"
87+
wget -q "$URL" -O wolfssl-fips-ready.zip
88+
89+
- name: Extract wolfSSL FIPS Ready
90+
run: unzip -q wolfssl-fips-ready.zip -d wolfssl-fips-ready
91+
92+
# Build wolfSSL FIPS Ready with JNI support
93+
- name: Build wolfSSL FIPS Ready
94+
working-directory: wolfssl-fips-ready
95+
run: |
96+
# Find the extracted directory (name may vary)
97+
WOLFSSL_DIR=$(find . -maxdepth 1 -type d -name "wolfssl-*" | head -1)
98+
if [ -z "$WOLFSSL_DIR" ]; then
99+
echo "Error: No wolfSSL directory found after unzip" >&2
100+
exit 1
101+
fi
102+
cd "$WOLFSSL_DIR"
103+
./configure --enable-fips=ready --enable-jni \
104+
--prefix=$GITHUB_WORKSPACE/build-dir
105+
make
106+
./fips-hash.sh
107+
make
108+
make install
109+
110+
- name: Set library paths
111+
run: |
112+
echo "LD_LIBRARY_PATH=$GITHUB_WORKSPACE/build-dir/lib:$GITHUB_WORKSPACE/wolfssljni/lib:$GITHUB_WORKSPACE/wolfcryptjni/lib" >> "$GITHUB_ENV"
113+
echo "JUNIT_HOME=$GITHUB_WORKSPACE/junit" >> "$GITHUB_ENV"
114+
115+
# Build wolfssljni (wolfJSSE)
116+
- name: Build wolfssljni JNI library
117+
working-directory: wolfssljni
118+
run: ./java.sh $GITHUB_WORKSPACE/build-dir
119+
120+
- name: Build wolfssljni JAR
121+
working-directory: wolfssljni
122+
run: ant
123+
124+
# Clone and build wolfcryptjni (wolfJCE)
125+
- name: Checkout wolfcryptjni
126+
uses: actions/checkout@v4
127+
with:
128+
repository: wolfSSL/wolfcryptjni
129+
path: wolfcryptjni
130+
131+
- name: Build wolfcryptjni JNI library
132+
working-directory: wolfcryptjni
133+
run: |
134+
cp makefile.linux makefile
135+
PREFIX=$GITHUB_WORKSPACE/build-dir make
136+
137+
- name: Build wolfcryptjni JCE JAR
138+
working-directory: wolfcryptjni
139+
run: ant build-jce-release
140+
141+
# Run standard wolfssljni tests first to verify nothing
142+
# is broken with the FIPS Ready build
143+
- name: Run wolfssljni tests (ant test)
144+
working-directory: wolfssljni
145+
run: ant test
146+
147+
# Compile and run the dual provider FIPS test
148+
- name: Compile DualProviderFIPSTest
149+
working-directory: wolfssljni
150+
run: |
151+
javac -classpath \
152+
lib/wolfssl.jar:lib/wolfssl-jsse.jar:$GITHUB_WORKSPACE/wolfcryptjni/lib/wolfcrypt-jni.jar \
153+
examples/provider/DualProviderFIPSTest.java
154+
155+
- name: Run DualProviderFIPSTest
156+
working-directory: wolfssljni
157+
run: |
158+
java -classpath \
159+
lib/wolfssl.jar:lib/wolfssl-jsse.jar:$GITHUB_WORKSPACE/wolfcryptjni/lib/wolfcrypt-jni.jar:examples/provider \
160+
DualProviderFIPSTest
161+
162+
- name: Show logs on failure
163+
if: failure() || cancelled()
164+
working-directory: wolfssljni
165+
run: |
166+
cat build/reports/*.txt 2>/dev/null || true
167+

‎.github/workflows/jni-patched-ci.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@ jobs:
5454
- name: Evaluate PR statuses
5555
id: eval_prs
5656
if: steps.find_defines.outputs.should_run == 'true'
57+
env:
58+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5759
run: |
5860
set -euo pipefail
5961

‎README.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -571,6 +571,7 @@ and used by wolfSSL JNI/JSSE.
571571
| wolfjsse.keystore.type.required | | String | Restricts KeyStore type |
572572
| wolfjsse.clientSessionCache.disabled | | "true" | Disables client session cache |
573573
| wolfjsse.X509KeyManager.disableCache | "false" | "true" | Disables X509KeyManager KeyStore entry caching |
574+
| wolfjsse.skipFIPSCAST | "false" | "true" | Skips FIPS CAST during wolfJSSE init |
574575

575576
**wolfssl.readWriteByteBufferPool.disabled (String)** - Can be used to disable
576577
the static per-thread ByteBuffer pool used in com.wolfssl.WolfSSLSession
@@ -668,6 +669,20 @@ performance. This should be set to the String "true" to disable caching:
668669
wolfjsse.X509KeyManager.disableCache=true
669670
```
670671

672+
**wolfjsse.skipFIPSCAST (String)** - Can be used to skip FIPS CAST (Conditional
673+
Algorithm Self Test) up front execution during wolfJSSE initialization. This is
674+
useful when using both WolfSSLProvider (wolfJSSE) and WolfCryptProvider
675+
(wolfJCE) together with wolfCrypt FIPS. Both providers run all CASTs during
676+
init, which can cause `FIPS_NOT_ALLOWED_E` errors if done concurrently on
677+
different threads. Setting this to "true" allows the application to run CASTs
678+
once through wolfJCE's `Fips.runAllCast_fips()` before registering providers,
679+
avoiding duplicate CAST execution. Must be set before `WolfSSLProvider` is
680+
constructed:
681+
682+
```
683+
wolfjsse.skipFIPSCAST=true
684+
```
685+
671686
If there are other Security properties you would like to use with wolfJSSE,
672687
please contact support@wolfssl.com.
673688

‎build.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -254,6 +254,7 @@
254254
classpathref="classpath"
255255
includeantruntime="false">
256256
<compilerarg value="-Xlint:-options"/>
257+
<exclude name="**/DualProviderFIPSTest.java"/>
257258
</javac>
258259
</target>
259260

0 commit comments

Comments
 (0)