You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by ji...@apache.org on 2024/11/13 09:00:54 UTC
(camel-quarkus) 02/03: Adding profile for using SunPKCS11-NSS-FIPS provider (#6773)
This is an automated email from the ASF dual-hosted git repository.
jiriondrusek pushed a commit to branch 3.15.x
in repository https://gitbox.apache.org/repos/asf/camel-quarkus.git
commit 2bb777b323670ae2909c514f846cf232e1bf1db1
Author: JiriOndrusek <on...@gmail.com>
AuthorDate: Tue Nov 12 18:59:02 2024 -0500
Adding profile for using SunPKCS11-NSS-FIPS provider (#6773)
---
integration-tests/crypto/README.adoc | 9 +++++++--
integration-tests/crypto/pom.xml | 21 +++++++++++++++++++--
.../quarkus/component/crypto/it/CryptoRoutes.java | 5 ++++-
.../src/main/resources/application.properties | 3 +--
4 files changed, 31 insertions(+), 7 deletions(-)
diff --git a/integration-tests/crypto/README.adoc b/integration-tests/crypto/README.adoc
index 2822e0a833..70c1f90736 100644
--- a/integration-tests/crypto/README.adoc
+++ b/integration-tests/crypto/README.adoc
@@ -1,8 +1,13 @@
== FIPS
-Please utilize the fips profile when executing tests within a FIPS-enabled environment. The tests must employ the BouncyCastle-FIPS dependency instead of the standard BouncyCastle library.
+Please utilize the fips profile when executing tests within a FIPS-enabled environment.
+There are two profiles:
+
+* Use `bcfips` profile to employ the BouncyCastle-FIPS security provider.
+* Use `fips` profile to employ the SunPKCS11-NSS-FIPS security provider.
+
Example of usage:
```
-mvn clean test -Dfips
+mvn clean test -Dfips or mvn clean test -Dbcfips
```
diff --git a/integration-tests/crypto/pom.xml b/integration-tests/crypto/pom.xml
index f8746b7bd3..0fba83e2a6 100644
--- a/integration-tests/crypto/pom.xml
+++ b/integration-tests/crypto/pom.xml
@@ -90,10 +90,10 @@
<profiles>
<profile>
- <id>fips</id>
+ <id>bcfips</id>
<activation>
<property>
- <name>fips</name>
+ <name>bcfips</name>
</property>
</activation>
<properties>
@@ -110,6 +110,23 @@
</dependency>
</dependencies>
</profile>
+ <profile>
+ <id>fips</id>
+ <activation>
+ <property>
+ <name>fips</name>
+ </property>
+ </activation>
+ <properties>
+ <cq-security-provider>quarkus.security.security-providers=SunPKCS11-NSS-FIPS</cq-security-provider>
+ </properties>
+ <dependencies>
+ <dependency>
+ <groupId>io.quarkus</groupId>
+ <artifactId>quarkus-security</artifactId>
+ </dependency>
+ </dependencies>
+ </profile>
<profile>
<id>native</id>
<activation>
diff --git a/integration-tests/crypto/src/main/java/org/apache/camel/quarkus/component/crypto/it/CryptoRoutes.java b/integration-tests/crypto/src/main/java/org/apache/camel/quarkus/component/crypto/it/CryptoRoutes.java
index acc93990de..56461cb93f 100644
--- a/integration-tests/crypto/src/main/java/org/apache/camel/quarkus/component/crypto/it/CryptoRoutes.java
+++ b/integration-tests/crypto/src/main/java/org/apache/camel/quarkus/component/crypto/it/CryptoRoutes.java
@@ -63,7 +63,10 @@ public class CryptoRoutes extends RouteBuilder {
private CryptoDataFormat getCryptoDataFormat() throws NoSuchAlgorithmException {
KeyGenerator generator = KeyGenerator.getInstance("DES");
- return new CryptoDataFormat("DES", generator.generateKey());
+ CryptoDataFormat cdf = new CryptoDataFormat("DES", generator.generateKey());
+ //workaround for SunPKCS11-NSS-FIPS
+ cdf.setShouldAppendHMAC(false);
+ return cdf;
}
}
diff --git a/integration-tests/crypto/src/main/resources/application.properties b/integration-tests/crypto/src/main/resources/application.properties
index 03d1e5fb7d..6df55e4420 100644
--- a/integration-tests/crypto/src/main/resources/application.properties
+++ b/integration-tests/crypto/src/main/resources/application.properties
@@ -16,6 +16,5 @@
## ---------------------------------------------------------------------------
quarkus.native.resources.includes=*.jks
-#FIPS profile adds BCFIPS provider
+#profile adds SunPKCS11-NSS-FIPS or BCFIPS provider
${cq-security-provider}
-