Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added validation for useHttp flag to fix the non FIPS compliant TLS usage. #560

Merged
merged 7 commits into from
Nov 6, 2024

Conversation

tejasdrolia
Copy link
Contributor

@tejasdrolia tejasdrolia commented Nov 5, 2024

This PR is to fix non FIPS compliant TLS usage in artifact-manager-s3 , this is done by ensuring that useHttp flag is not allowed to be true while operating in FIPS mode.

Testing done

  • Automated Unit Testing:

Added a dedicated unit test S3BlobStoreConfigTestFipsEnabled to validate that setting the useHttp flag to true while in FIPS mode results in an Error , ensuring compliance.

  • Manual Testing:

Did Manual testing to verify my changes to ensure that everything is working properly.

On clicking use insecure Http

Screenshot 2024-11-05 at 3 51 16 PM

On clicking validate button further

Screenshot 2024-11-05 at 5 34 13 PM

On clicking Save

Screenshot 2024-11-05 at 3 51 41 PM

=======================================================

Link to issue -> https://cloudbees.atlassian.net/browse/BEE-52993

Submitter checklist

  • Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
  • Ensure that the pull request title represents the desired changelog entry
  • Please describe what you did
  • Link to relevant issues in GitHub or Jira
  • Link to relevant pull requests, esp. upstream and downstream changes
  • Ensure you have provided tests - that demonstrates feature works or fixes the issue

@tejasdrolia tejasdrolia requested a review from a team as a code owner November 5, 2024 10:05
…3BlobStoreConfig.java


removed "throws IllegalArgumentException"

Co-authored-by: Pere <[email protected]>
Copy link
Contributor

@PereBueno PereBueno left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link

@pankajy-dev pankajy-dev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@tejasdrolia tejasdrolia changed the title [BEE-52993] - Added validation for useHttp flag to fix the non FIPS compliant TLS usage. Added validation for useHttp flag to fix the non FIPS compliant TLS usage. Nov 5, 2024
Copy link
Member

@jglick jglick left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a couple of apparent mistakes

@jglick jglick added the enhancement New feature or request label Nov 5, 2024
@jglick jglick merged commit 49ae5d7 into jenkinsci:master Nov 6, 2024
17 checks passed
import jenkins.security.FIPS140;


public class S3BlobStoreConfigFipsEnabledTest {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fails in BOM with

java.lang.IllegalStateException: The eddsa-api plugin is not FIPS compliant and can not be used in a Jenkins configured to run in FIPS-140 mode
	at io.jenkins.plugins.eddsa_api.FIPSComplianceCheck.preventUsageInFipsMode(FIPSComplianceCheck.java:15)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
Caused: java.lang.reflect.InvocationTargetException
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:118)
	at java.base/java.lang.reflect.Method.invoke(Method.java:580)
	at hudson.init.TaskMethodFinder.invoke(TaskMethodFinder.java:109)
Caused: java.lang.Error
	at hudson.init.TaskMethodFinder.invoke(TaskMethodFinder.java:115)
	at hudson.init.TaskMethodFinder$TaskImpl.run(TaskMethodFinder.java:185)
	at org.jvnet.hudson.reactor.Reactor.runTask(Reactor.java:304)
	at jenkins.model.Jenkins$5.runTask(Jenkins.java:1143)
	at org.jvnet.hudson.reactor.Reactor$2.run(Reactor.java:221)
	at org.jvnet.hudson.reactor.Reactor$Node.run(Reactor.java:120)
	at jenkins.security.ImpersonatingExecutorService$1.run(ImpersonatingExecutorService.java:68)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
	at java.base/java.lang.Thread.run(Thread.java:1583)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants