From 3b20faae34218cdbb72008a3695f748b34cdff4a Mon Sep 17 00:00:00 2001
From: Maxim Thomas <maxim.thomas@gmail.com>
Date: Tue, 20 Oct 2026 06:45:08 +0000
Subject: [PATCH] [#1056] Add the RSASVE/KDF-SHA256/AESKWP key wrapping transformation for runtimes without RSA-OAEP (#1194)
---
opendj-server-legacy/src/test/java/org/opends/server/TestCaseUtils.java | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 files changed, 58 insertions(+), 0 deletions(-)
diff --git a/opendj-server-legacy/src/test/java/org/opends/server/TestCaseUtils.java b/opendj-server-legacy/src/test/java/org/opends/server/TestCaseUtils.java
index 52a49da..46f6011 100644
--- a/opendj-server-legacy/src/test/java/org/opends/server/TestCaseUtils.java
+++ b/opendj-server-legacy/src/test/java/org/opends/server/TestCaseUtils.java
@@ -83,6 +83,7 @@
import java.util.logging.Logger;
import com.forgerock.opendj.ldap.tools.LDAPSearch;
+import org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider;
import org.forgerock.i18n.LocalizableMessage;
import org.forgerock.opendj.config.dsconfig.DSConfig;
import org.forgerock.opendj.config.server.ConfigException;
@@ -386,6 +387,63 @@
}
}
+ /**
+ * Runs {@code action} on a runtime which offers raw RSA and SHA-256 but no AES-KWP, as Java 11
+ * does without Bouncy Castle FIPS. Where a provider offers {@code AES/KWP/NoPadding}, it is
+ * withdrawn with {@link #withoutJceService}, and its {@code AESWrapPad} alias with it; since that
+ * provider is SunJCE, a stand-in gives back the raw RSA cipher of SunJCE for the duration.
+ *
+ * @param action
+ * What to run without AES-KWP.
+ * @throws Exception
+ * If the action fails.
+ */
+ public static void withoutKeyWrap(final Callable<Void> action) throws Exception
+ {
+ if (Security.getProviders("Cipher.AES/KWP/NoPadding") == null)
+ {
+ action.call();
+ }
+ else
+ {
+ final Provider rawRsa = new Provider("RawRsaOfSunJce", "1.0", "RSA cipher of SunJCE") {};
+ rawRsa.put("Cipher.RSA", "com.sun.crypto.provider.RSACipher");
+ withoutJceService("Cipher", "AES/KWP/NoPadding", action, rawRsa);
+ }
+ }
+
+ /**
+ * Runs {@code action} with the Bouncy Castle FIPS provider installed first, in its default mode,
+ * and puts the providers back as they were afterwards.
+ *
+ * @param <T>
+ * The type of what the action returns.
+ * @param action
+ * What to run.
+ * @return What the action returns.
+ * @throws Exception
+ * If the action fails.
+ */
+ public static <T> T withBcFipsFirst(final Callable<T> action) throws Exception
+ {
+ final List<Provider> installed = Arrays.asList(Security.getProviders());
+ final Provider previous = Security.getProvider(BouncyCastleFipsProvider.PROVIDER_NAME);
+ Security.removeProvider(BouncyCastleFipsProvider.PROVIDER_NAME);
+ Security.insertProviderAt(previous != null ? previous : new BouncyCastleFipsProvider(), 1);
+ try
+ {
+ return action.call();
+ }
+ finally
+ {
+ Security.removeProvider(BouncyCastleFipsProvider.PROVIDER_NAME);
+ if (previous != null)
+ {
+ Security.insertProviderAt(previous, installed.indexOf(previous) + 1);
+ }
+ }
+ }
+
public static void startServer() throws Exception
{
System.setProperty(PROPERTY_RUNNING_UNIT_TESTS, "true");
--
Gitblit v1.10.0