Hi all,
I’d like to add a community module for FIPS 140-3 support, targeting the 3.x series
Why: some deployments have to run on a FIPS enabled operating system (RHEL and
rebuilds, with the system crypto policy set to FIPS). GeoServer does not start
there. The JCEKS keystore it uses for the security directory does not exist on
such a JVM, and a few code paths pick forbidden algorithms.
The work splits in two parts:
- Mainline preparation. Fixes with no cost for anybody else: no JCEKS
assumptions, no forbidden algorithm where a permitted one does the same job. - The community module, community/fips. It carries the BouncyCastle FIPS provider
wiring, a BCFKS keystore for the security directory, and a status page showing
the FIPS state to the administrator. It also adds a small extension point in
mainline, to choose the crypto provider and the keystore type, plus the
override that uses it. The default is what GeoServer does today, so nothing
changes for anyone who does not install the module.
On the packaging aspect, it’s similar to a regular module, but we need to remove
the standard BouncyCastle jars fist, and then replace them with the FIPS specific
ones (different file name). It’s documented, just a small extra step for a working setup.
Testing: the module ships a set of scripts setting up a Rocky Linux FIPS virtual machine
The scripts help running the build and the CITE suites inside it.
The full reactor passes, besides the two LDAP modules that need
to be skipped because ApacheDS cannot work under FIPS.
The CITE tests pass too.
There is also a build profile applying an emulation of the FIPS restrictions without the VM.
A GitHub Action will use this build to check FIPS mode is working.
Creating up the Rocky Linux VM image would be better, but it would very slow (likely too much for a github action running all the time).
And that would be all, thanks for reading!
Cheers,
Andrea