-
Notifications
You must be signed in to change notification settings - Fork 67
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Added validation for useHttp flag to fix the non FIPS compliant TLS usage. #560
Conversation
src/main/java/io/jenkins/plugins/artifact_manager_jclouds/s3/S3BlobStoreConfig.java
Fixed
Show fixed
Hide fixed
src/main/java/io/jenkins/plugins/artifact_manager_jclouds/s3/S3BlobStoreConfig.java
Fixed
Show fixed
Hide fixed
src/main/java/io/jenkins/plugins/artifact_manager_jclouds/s3/S3BlobStoreConfig.java
Outdated
Show resolved
Hide resolved
src/main/java/io/jenkins/plugins/artifact_manager_jclouds/s3/S3BlobStoreConfig.java
Outdated
Show resolved
Hide resolved
src/test/java/io/jenkins/plugins/artifact_manager_jclouds/s3/S3BlobStoreConfigTest.java
Outdated
Show resolved
Hide resolved
...st/java/io/jenkins/plugins/artifact_manager_jclouds/s3/S3BlobStoreConfigTestFipsEnabled.java
Outdated
Show resolved
Hide resolved
…3BlobStoreConfig.java removed "throws IllegalArgumentException" Co-authored-by: Pere <[email protected]>
src/main/java/io/jenkins/plugins/artifact_manager_jclouds/s3/S3BlobStoreConfig.java
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
src/main/java/io/jenkins/plugins/artifact_manager_jclouds/s3/S3BlobStoreConfig.java
Show resolved
Hide resolved
...st/java/io/jenkins/plugins/artifact_manager_jclouds/s3/S3BlobStoreConfigTestFipsEnabled.java
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
a couple of apparent mistakes
src/main/java/io/jenkins/plugins/artifact_manager_jclouds/s3/S3BlobStoreConfig.java
Dismissed
Show dismissed
Hide dismissed
import jenkins.security.FIPS140; | ||
|
||
|
||
public class S3BlobStoreConfigFipsEnabledTest { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fails in BOM with
java.lang.IllegalStateException: The eddsa-api plugin is not FIPS compliant and can not be used in a Jenkins configured to run in FIPS-140 mode
at io.jenkins.plugins.eddsa_api.FIPSComplianceCheck.preventUsageInFipsMode(FIPSComplianceCheck.java:15)
at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
Caused: java.lang.reflect.InvocationTargetException
at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:118)
at java.base/java.lang.reflect.Method.invoke(Method.java:580)
at hudson.init.TaskMethodFinder.invoke(TaskMethodFinder.java:109)
Caused: java.lang.Error
at hudson.init.TaskMethodFinder.invoke(TaskMethodFinder.java:115)
at hudson.init.TaskMethodFinder$TaskImpl.run(TaskMethodFinder.java:185)
at org.jvnet.hudson.reactor.Reactor.runTask(Reactor.java:304)
at jenkins.model.Jenkins$5.runTask(Jenkins.java:1143)
at org.jvnet.hudson.reactor.Reactor$2.run(Reactor.java:221)
at org.jvnet.hudson.reactor.Reactor$Node.run(Reactor.java:120)
at jenkins.security.ImpersonatingExecutorService$1.run(ImpersonatingExecutorService.java:68)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at java.base/java.lang.Thread.run(Thread.java:1583)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This PR is to fix non FIPS compliant TLS usage in artifact-manager-s3 , this is done by ensuring that useHttp flag is not allowed to be true while operating in FIPS mode.
Testing done
Added a dedicated unit test S3BlobStoreConfigTestFipsEnabled to validate that setting the useHttp flag to true while in FIPS mode results in an Error , ensuring compliance.
Did Manual testing to verify my changes to ensure that everything is working properly.
On clicking use insecure Http
On clicking validate button further
On clicking Save
=======================================================
Link to issue -> https://cloudbees.atlassian.net/browse/BEE-52993
Submitter checklist