BouncyCastle BCFIPS provider fails with OpenJDK 17 and RHEL8 in FIPS-enabled environment

[michalvavrik]

Describe the bug

Described in here bcgit/bc-java#1285. When BCFIPS provider is used with OpenJDK 17 on RHEL8, app fails to start as (citing) securerandom.strongAlgorithms needs to point at something that can be used to generate seed material.

I tested it with OpenJDK Runtime Environment (Red_Hat-21.0.1.0.12-2) and it works, however it doesn't work OpenJDK Runtime Environment (Red_Hat-17.0.10.0.7-1.el7openjdkportable).

Expected behavior

Keycloak works around this issue like this https://github.com/keycloak/keycloak/blob/main/crypto/fips1402/src/main/java/org/keycloak/crypto/fips/FIPS1402Provider.java#L327 it would be nice if we could do something about it.

Actual behavior

App fails to start and an exception is thrown

java.lang.RuntimeException: java.lang.RuntimeException: Failed to start quarkus
	at io.quarkus.test.junit.QuarkusTestExtension.throwBootFailureException(QuarkusTestExtension.java:642)
	at io.quarkus.test.junit.QuarkusTestExtension.interceptTestClassConstructor(QuarkusTestExtension.java:726)
	at java.base/java.util.Optional.orElseGet(Optional.java:364)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
Caused by: java.lang.RuntimeException: Failed to start quarkus
	at io.quarkus.runner.ApplicationImpl.doStart(Unknown Source)
	at io.quarkus.runtime.Application.start(Application.java:101)
	at java.base/java.lang.reflect.Method.invoke(Method.java:568)
	at io.quarkus.runner.bootstrap.StartupActionImpl.run(StartupActionImpl.java:285)
	at io.quarkus.test.junit.QuarkusTestExtension.doJavaStart(QuarkusTestExtension.java:251)
	at io.quarkus.test.junit.QuarkusTestExtension.ensureStarted(QuarkusTestExtension.java:609)
	at io.quarkus.test.junit.QuarkusTestExtension.beforeAll(QuarkusTestExtension.java:659)
	... 1 more
Caused by: java.lang.RuntimeException: Unable to start HTTP server
	at io.quarkus.vertx.http.runtime.VertxHttpRecorder.doServerStart(VertxHttpRecorder.java:886)
	at io.quarkus.vertx.http.runtime.VertxHttpRecorder.startServer(VertxHttpRecorder.java:339)
	at io.quarkus.deployment.steps.VertxHttpProcessor$openSocket189362710.deploy_0(Unknown Source)
	at io.quarkus.deployment.steps.VertxHttpProcessor$openSocket189362710.deploy(Unknown Source)
	... 8 more
Caused by: java.util.concurrent.ExecutionException: java.lang.IllegalAccessError: class org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$CoreSecureRandom (in unnamed module @0x5383bf08) cannot access class sun.security.provider.SecureRandom (in module java.base) because module java.base does not export sun.security.provider to unnamed module @0x5383bf08
	at java.base/java.util.concurrent.CompletableFuture.reportGet(CompletableFuture.java:396)
	at java.base/java.util.concurrent.CompletableFuture.get(CompletableFuture.java:2073)
	at io.quarkus.vertx.http.runtime.VertxHttpRecorder.doServerStart(VertxHttpRecorder.java:803)
	... 11 more
Caused by: java.lang.IllegalAccessError: class org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$CoreSecureRandom (in unnamed module @0x5383bf08) cannot access class sun.security.provider.SecureRandom (in module java.base) because module java.base does not export sun.security.provider to unnamed module @0x5383bf08
	at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$CoreSecureRandom.<init>(Unknown Source)
	at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$4.run(Unknown Source)
	at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$4.run(Unknown Source)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:318)
	at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider.getCoreSecureRandom(Unknown Source)
	at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider.access$600(Unknown Source)
	at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$2.run(Unknown Source)
	at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$2.run(Unknown Source)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:318)
	at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider.getEntropySourceProvider(Unknown Source)
	at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$PooledSecureRandomProvider.get(Unknown Source)
	at org.bouncycastle.crypto.CryptoServicesRegistrar.getSecureRandomIfSet(Unknown Source)
	at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider.getDefaultSecureRandom(Unknown Source)
	at org.bouncycastle.jcajce.provider.ProvPKCS12$PKCS12KeyStoreSpi.<init>(Unknown Source)
	at org.bouncycastle.jcajce.provider.ProvPKCS12$BCPKCS12KeyStore3DES.<init>(Unknown Source)
	at org.bouncycastle.jcajce.provider.ProvPKCS12$1.createInstance(Unknown Source)
	at org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$BcService.newInstance(Unknown Source)
	at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:236)
	at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:164)
	at java.base/java.security.Security.getImpl(Security.java:749)
	at java.base/java.security.KeyStore.getInstance(KeyStore.java:868)
	at io.vertx.core.net.impl.KeyStoreHelper.toKeyManagerFactory(KeyStoreHelper.java:164)
	at io.vertx.core.net.impl.KeyStoreHelper.<init>(KeyStoreHelper.java:144)
	at io.vertx.core.net.KeyStoreOptionsBase.getHelper(KeyStoreOptionsBase.java:188)
	at io.vertx.core.net.KeyStoreOptionsBase.getKeyManagerFactory(KeyStoreOptionsBase.java:206)
	at io.vertx.core.net.impl.SSLHelper.lambda$build$6(SSLHelper.java:259)
	at io.vertx.core.impl.ContextImpl.lambda$executeBlocking$1(ContextImpl.java:191)
	at io.vertx.core.impl.ContextInternal.dispatch(ContextInternal.java:279)
	at io.vertx.core.impl.ContextImpl.lambda$internalExecuteBlocking$2(ContextImpl.java:210)
	at io.vertx.core.impl.TaskQueue.run(TaskQueue.java:76)
	at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
	at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2516)
	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2495)
	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1495)
	at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:11)
	at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:11)
	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
	at java.base/java.lang.Thread.run(Thread.java:840)

How to Reproduce?

In FIPS-enabled environment, run:

1. git clone https://github.com/quarkus-qe/quarkus-test-suite
2. cd quarkus-test-suite/security/bouncycastle-fips/bcFipsJsse
3. mvn clean verify -Dreruns=0

Output of uname -a or ver

Fedora 38

Output of java -version

openjdk version "17.0.7"

Quarkus version or git rev

999-SNAPSHOT, 3.8.4 etc.

Build tool (ie. output of mvnw --version or gradlew --version)

Apache Maven 3.9.4

Additional information

I'd like to try and look into the workaround as I'm in hurry.

[quarkus-bot]

/cc @Karm (securepipeline), @jerboaa (securepipeline)

[michalvavrik]

I'll give it a try.