From dfe05b037ab9cae6d371accc204afa5eed5966c7 Mon Sep 17 00:00:00 2001 From: Tao Liu Date: Thu, 30 Nov 2023 14:36:52 -0500 Subject: [PATCH] Add Redhat NSS FIPS support on p/z linux platforms The Redhat NSS FIPS module is certified on ppc64le and s390x linux platforms. Adding the Redhat NSS FIPS support for the Semeru OpenJDK on these two platforms. Signed-off-by: Tao Liu --- closed/custom/copy/Copy-java.base.gmk | 4 ++-- .../internal/security/RestrictedSecurity.java | 2 +- .../makejavasecurity/MakeJavaSecurity.java | 21 ++++++++++++++++++- .../share/conf/security/java.security | 2 +- 4 files changed, 24 insertions(+), 5 deletions(-) diff --git a/closed/custom/copy/Copy-java.base.gmk b/closed/custom/copy/Copy-java.base.gmk index 0ae7ba7f69b..44d185f1ef7 100644 --- a/closed/custom/copy/Copy-java.base.gmk +++ b/closed/custom/copy/Copy-java.base.gmk @@ -238,9 +238,9 @@ ifneq ($(OPENSSL_BUNDLE_LIB_PATH), ) endif # OPENSSL_BUNDLE_LIB_PATH ################################################################################ -# Copy the nss.fips.cfg only on x86 linux +# Copy the nss.fips.cfg only on x86/p/z linux -ifeq ($(OPENJDK_TARGET_OS)-$(OPENJDK_TARGET_CPU_ARCH), linux-x86) +ifneq ($(filter linux-x86_64 linux-ppc64le linux-s390x, $(OPENJDK_TARGET_OS)-$(OPENJDK_TARGET_CPU)), ) NSS_FIPS_CFG_SRC := $(TOPDIR)/closed/src/java.base/share/conf/security/nss.fips.cfg NSS_FIPS_CFG_DST := $(CONF_DST_DIR)/security/nss.fips.cfg diff --git a/closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java b/closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java index 9bacf62f094..a41ffd84d1d 100644 --- a/closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java +++ b/closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java @@ -64,7 +64,7 @@ public final class RestrictedSecurity { private static RestrictedSecurityProperties restricts; - private static final List supportPlatforms = List.of("amd64"); + private static final List supportPlatforms = List.of("amd64", "ppc64le", "s390x"); static { @SuppressWarnings("removal") diff --git a/make/jdk/src/classes/build/tools/makejavasecurity/MakeJavaSecurity.java b/make/jdk/src/classes/build/tools/makejavasecurity/MakeJavaSecurity.java index 963db0b593e..bb796be4335 100644 --- a/make/jdk/src/classes/build/tools/makejavasecurity/MakeJavaSecurity.java +++ b/make/jdk/src/classes/build/tools/makejavasecurity/MakeJavaSecurity.java @@ -23,6 +23,12 @@ * questions. */ +/* + * =========================================================================== + * (c) Copyright IBM Corp. 2023, 2023 All Rights Reserved + * =========================================================================== + */ + package build.tools.makejavasecurity; import java.io.*; @@ -91,7 +97,8 @@ public static void main(String[] args) throws Exception { } // Filter out platform-unrelated ones. We only support - // #ifdef, #ifndef, #else, and #endif. Nesting not supported (yet). + // #ifdef, #ifndef, #else, #endif and #if defined A || B. + // Other Nesting not supported (yet). int mode = 0; // 0: out of block, 1: in match, 2: in non-match Iterator iter = lines.iterator(); while (iter.hasNext()) { @@ -113,6 +120,18 @@ public static void main(String[] args) throws Exception { mode = line.endsWith(args[2]) ? 2 : 1; } iter.remove(); + } else if (line.startsWith("#if defined ")) { + for (String l : line.split("\\|\\|")) { + if (l.indexOf('-') > 0) { + mode = l.trim().endsWith(args[2] + "-" + args[3]) ? 1 : 2; + } else { + mode = l.trim().endsWith(args[2]) ? 1 : 2; + } + if (mode == 1) { + break; + } + } + iter.remove(); } else if (line.startsWith("#else")) { if (mode == 0) { throw new IllegalStateException("#else not in #if block"); diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security index e5d19a6bdc5..b57e817fbc0 100644 --- a/src/java.base/share/conf/security/java.security +++ b/src/java.base/share/conf/security/java.security @@ -88,7 +88,7 @@ security.provider.tbd=Apple security.provider.tbd=SunPKCS11 #endif -#ifdef linux-x86 +#if defined linux-x86 || defined linux-ppc || defined linux-s390 # # Java Restricted Security Mode #