[JENKINS-74907] Add validations when Jenkins is in FIPS mode #1010
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,177 @@ | ||
| package hudson.plugins.ec2.util; | ||
|
|
||
| import edu.umd.cs.findbugs.annotations.NonNull; | ||
| import hudson.plugins.ec2.Messages; | ||
| import java.io.IOException; | ||
| import java.net.URL; | ||
| import java.security.Key; | ||
| import java.security.UnrecoverableKeyException; | ||
| import java.security.interfaces.DSAKey; | ||
| import java.security.interfaces.ECKey; | ||
| import java.security.interfaces.RSAKey; | ||
| import jenkins.bouncycastle.api.PEMEncodable; | ||
| import jenkins.security.FIPS140; | ||
| import org.apache.commons.lang.StringUtils; | ||
| import org.bouncycastle.crypto.params.AsymmetricKeyParameter; | ||
| import org.bouncycastle.crypto.params.DSAPublicKeyParameters; | ||
| import org.bouncycastle.crypto.params.ECPublicKeyParameters; | ||
| import org.bouncycastle.crypto.params.RSAKeyParameters; | ||
| import org.bouncycastle.crypto.util.OpenSSHPublicKeyUtil; | ||
|
|
||
| /** | ||
| * FIPS related utility methods (check Private and Public keys, ...) | ||
| */ | ||
| public class FIPS140Utils { | ||
|
|
||
| /** | ||
| * Checks if the key is allowed when FIPS mode is requested. | ||
| * Allowed key with the following algorithms and sizes: | ||
| * <ul> | ||
| * <li>DSA with key size >= 2048</li> | ||
| * <li>RSA with key size >= 2048</li> | ||
| * <li>Elliptic curve (ED25519) with field size >= 224</li> | ||
| * </ul> | ||
| * If the key is valid and allowed or not in FIPS mode method will just exit. | ||
| * If not it will throw an {@link IllegalArgumentException}. | ||
| * @param key The key to check. | ||
| */ | ||
| public static void ensureKeyInFipsMode(Key key) { | ||
| if (!FIPS140.useCompliantAlgorithms()) { | ||
| return; | ||
| } | ||
| if (key instanceof RSAKey) { | ||
| if (((RSAKey) key).getModulus().bitLength() < 2048) { | ||
| throw new IllegalArgumentException(Messages.EC2Cloud_invalidKeySizeInFIPSMode()); | ||
| } | ||
| } else if (key instanceof DSAKey) { | ||
| if (((DSAKey) key).getParams().getP().bitLength() < 2048) { | ||
| throw new IllegalArgumentException(Messages.EC2Cloud_invalidKeySizeInFIPSMode()); | ||
| } | ||
| } else if (key instanceof ECKey) { | ||
| if (((ECKey) key).getParams().getCurve().getField().getFieldSize() < 224) { | ||
| throw new IllegalArgumentException(Messages.EC2Cloud_invalidKeySizeECInFIPSMode()); | ||
| } | ||
| } else { | ||
| throw new IllegalArgumentException(Messages.EC2Cloud_keyIsNotApprovedInFIPSMode(key.getAlgorithm())); | ||
| } | ||
| } | ||
|
|
||
| /** | ||
| * Password leak prevention when FIPS mode is requested. If FIPS mode is not requested, this method does nothing. | ||
| * Otherwise, ensure that no password can be leaked | ||
| * @param url the requested URL | ||
| * @param password the password used | ||
| * @throws IllegalArgumentException if there is a risk that the password will leak | ||
| */ | ||
| public static void ensureNoPasswordLeak(URL url, String password) { | ||
| ensureNoPasswordLeak("https".equals(url.getProtocol()), password); | ||
| } | ||
|
|
||
| /** | ||
| * Password leak prevention when FIPS mode is requested. If FIPS mode is not requested, this method does nothing. | ||
| * Otherwise, ensure that no password can be leaked. | ||
| * @param useHTTPS is TLS used or not | ||
| * @param password the password used | ||
| * @throws IllegalArgumentException if there is a risk that the password will leak | ||
| */ | ||
| public static void ensureNoPasswordLeak(boolean useHTTPS, String password) { | ||
| ensureNoPasswordLeak(useHTTPS, !StringUtils.isEmpty(password)); | ||
| } | ||
|
|
||
| /** | ||
| * Password leak prevention when FIPS mode is requested. If FIPS mode is not requested, this method does nothing. | ||
| * Otherwise, ensure that no password can be leaked. | ||
| * @param useHTTPS is TLS used or not | ||
| * @param usePassword is a password used | ||
| * @throws IllegalArgumentException if there is a risk that the password will leak | ||
| */ | ||
| public static void ensureNoPasswordLeak(boolean useHTTPS, boolean usePassword) { | ||
| if (FIPS140.useCompliantAlgorithms()) { | ||
| if (!useHTTPS && usePassword) { | ||
| throw new IllegalArgumentException(Messages.EC2Cloud_tlsIsRequiredInFIPSMode()); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| /** | ||
| * Password length check chen FIPS mode is requested. If FIPS mode is not requested, this method does nothing. | ||
| * Otherwise, ensure that the password length is at least 14 char long. | ||
| * @param password the password to check | ||
| * @throws IllegalArgumentException if FIPS mode is requested and the password is too short | ||
| */ | ||
| public static void ensurePasswordLength(String password) { | ||
| if (FIPS140.useCompliantAlgorithms()) { | ||
| if (StringUtils.isBlank(password) || password.length() < 14) { | ||
| throw new IllegalArgumentException(Messages.EC2Cloud_passwordLengthInFIPSMode()); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| /** | ||
| * Password leak prevention when FIPS mode is requested. If FIPS mode is not requested, this method does nothing. | ||
| * Otherwise, ensure that no password can be leaked. | ||
| * @param allowSelfSignedCertificate is self-signed certificate allowed | ||
| * @throws IllegalArgumentException if FIPS mode is requested and a self-signed certificate is allowed | ||
| */ | ||
| public static void ensureNoSelfSignedCertificate(boolean allowSelfSignedCertificate) { | ||
| if (FIPS140.useCompliantAlgorithms()) { | ||
| if (allowSelfSignedCertificate) { | ||
| throw new IllegalArgumentException(Messages.EC2Cloud_selfSignedCertificateNotAllowedInFIPSMode()); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| /** | ||
| * Checks if the private key is allowed when FIPS mode is requested. | ||
| * Allowed private key with the following algorithms and sizes: | ||
| * <ul> | ||
| * <li>DSA with key size >= 2048</li> | ||
| * <li>RSA with key size >= 2048</li> | ||
| * <li>Elliptic curve (ED25519) with field size >= 224</li> | ||
| * </ul> | ||
| * If the private key is valid and allowed or not in FIPS mode method will just exit. | ||
| * If not it will throw an {@link IllegalArgumentException}. | ||
| * @param privateKeyString String containing the private key PEM. | ||
| */ | ||
| public static void ensurePrivateKeyInFipsMode(String privateKeyString) { | ||
| if (!FIPS140.useCompliantAlgorithms()) { | ||
| return; | ||
| } | ||
| if (StringUtils.isBlank(privateKeyString)) { | ||
| throw new IllegalArgumentException(Messages.EC2Cloud_keyIsMandatoryInFIPSMode()); | ||
| } | ||
| try { | ||
| Key privateKey = PEMEncodable.decode(privateKeyString).toPrivateKey(); | ||
| ensureKeyInFipsMode(privateKey); | ||
| } catch (RuntimeException | UnrecoverableKeyException | IOException e) { | ||
| throw new IllegalArgumentException(e.getMessage(), e); | ||
| } | ||
| } | ||
|
|
||
| public static void ensurePublicKeyInFipsMode(@NonNull String algorithm, @NonNull byte[] key) { | ||
| if (!FIPS140.useCompliantAlgorithms()) { | ||
| return; | ||
| } | ||
|
|
||
| AsymmetricKeyParameter asymmetricKeyParameter = OpenSSHPublicKeyUtil.parsePublicKey(key); | ||
|
|
||
| if (asymmetricKeyParameter instanceof RSAKeyParameters) { | ||
| RSAKeyParameters rsaKeyParameters = (RSAKeyParameters) asymmetricKeyParameter; | ||
| if (rsaKeyParameters.getModulus().bitLength() < 2048) { | ||
| throw new IllegalArgumentException(Messages.EC2Cloud_invalidKeySizeInFIPSMode()); | ||
| } | ||
| } else if (asymmetricKeyParameter instanceof DSAPublicKeyParameters) { | ||
| DSAPublicKeyParameters dsaPublicKeyParameters = (DSAPublicKeyParameters) asymmetricKeyParameter; | ||
| if (dsaPublicKeyParameters.getParameters().getP().bitLength() < 2048) { | ||
| throw new IllegalArgumentException(Messages.EC2Cloud_invalidKeySizeInFIPSMode()); | ||
| } | ||
| } else if (asymmetricKeyParameter instanceof ECPublicKeyParameters) { | ||
| ECPublicKeyParameters ecPublicKeyParameters = (ECPublicKeyParameters) asymmetricKeyParameter; | ||
| if (ecPublicKeyParameters.getParameters().getCurve().getFieldSize() < 224) { | ||
| throw new IllegalArgumentException(Messages.EC2Cloud_invalidKeySizeECInFIPSMode()); | ||
| } | ||
| } else { | ||
| throw new IllegalArgumentException(Messages.EC2Cloud_keyIsNotApprovedInFIPSMode(algorithm)); | ||
| } | ||
| } | ||
| } | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There appears to be no check on the password length here if a password is in used? Also should the checks only take place if
specifyPasswordis true?