[JENKINS-73408] Ensure keys are FIPS compliant when running in FIPS mode, core requirement bump to 2.426.3 #210

PereBueno · 2024-07-08T12:03:15Z

https://issues.jenkins.io/browse/JENKINS-73408
Added checks to make sure provided SSH keys are accepted for FIPS 140.2.
Change should be transparent if not running in FIPS mode.
When provided key is not compliant an exception will be logged and thrown. Checks are done in the constructor and in readResolve, so invalid new keys won't be added and existing ones will be removed on startup. This also covers jcasc scenario.
Also, had to bump jenkins version to 2.426.3 as this needs FIPS140.

Form validation has been added, but as https://issues.jenkins.io/browse/JENKINS-73404 is needed for it to work in secretTextArea.

This has an unwanted side effect: creating a credential with an invalid key in FIPS mode will show an angry jenkins (and obviously, credential won't be saved). Validation was added to at least inform the user saving won't be right.

Testing done

Added 3 unit tests.
Also, tested manually, behaviour is the expected.
Attaching snapshots of form validation (won't be appearing after moving back to secretTextArea). Updated just one snapshot, when there's an original exception (normally raised by bouncycastle) we're attaching the original exception to formvalidation results.

Submitter checklist

Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
Ensure that the pull request title represents the desired changelog entry
Please describe what you did
Link to relevant issues in GitHub or Jira
Link to relevant pull requests, esp. upstream and downstream changes
Ensure you have provided tests - that demonstrates feature works or fixes the issue

src/main/java/com/cloudbees/jenkins/plugins/sshcredentials/impl/BasicSSHUserPrivateKey.java

jtnord · 2024-07-09T15:04:14Z

Form validation was not added as https://issues.jenkins.io/browse/JENKINS-73404 is needed for that

Can you add the FormValidation as if it did work (ie the upstream bugs where not present). You can test the basis of this by temproarily swapping the secretTextarea to a Textarea.

This means the validation would then "Just work" when run on a core with fixes and no extra work would be needed.

jtnord

testing and the bc-fips dependency are conflicting. the BouncyCastleProvider would not be available at all in FIPS mode.

src/main/java/com/cloudbees/jenkins/plugins/sshcredentials/impl/BasicSSHUserPrivateKey.java

pom.xml

...t/java/com/cloudbees/jenkins/plugins/sshcredentials/impl/BasicSSHUserPrivateKeyFIPSTest.java

PereBueno · 2024-07-10T16:08:46Z

testing and the bc-fips dependency are conflicting. the BouncyCastleProvider would not be available at all in FIPS mode.

Removed the test dependency, now using bouncycastle-api only

src/main/java/com/cloudbees/jenkins/plugins/sshcredentials/impl/BasicSSHUserPrivateKey.java

…l/BasicSSHUserPrivateKey.java Co-authored-by: Francisco Javier Fernandez <31063239+fcojfernandez@users.noreply.github.com>

src/main/java/com/cloudbees/jenkins/plugins/sshcredentials/impl/BasicSSHUserPrivateKey.java

.../plugins/sshcredentials/impl/BasicSSHUserPrivateKey/DirectEntryPrivateKeySource/config.jelly

src/main/resources/com/cloudbees/jenkins/plugins/sshcredentials/impl/Messages.properties

…l/BasicSSHUserPrivateKey.java Co-authored-by: James Nord <jtnord@users.noreply.github.com>

…entials-plugin into JENKINS-73408

src/main/java/com/cloudbees/jenkins/plugins/sshcredentials/impl/BasicSSHUserPrivateKey.java

…l/BasicSSHUserPrivateKey.java Co-authored-by: James Nord <jtnord@users.noreply.github.com>

src/main/java/com/cloudbees/jenkins/plugins/sshcredentials/impl/BasicSSHUserPrivateKey.java

…entials-plugin into JENKINS-73408

basil · 2024-07-23T20:31:26Z

diff --git a/pom.xml b/pom.xml
index 831b562..7d58ca5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -92,8 +92,8 @@
     <dependencies>
       <dependency>
         <groupId>io.jenkins.tools.bom</groupId>
-        <artifactId>bom-2.387.x</artifactId>
-        <version>2543.vfb_1a_5fb_9496d</version>
+        <artifactId>bom-2.426.x</artifactId>
+        <version>3208.vb_21177d4b_cd9</version>
         <scope>import</scope>
         <type>pom</type>
       </dependency>

[ERROR] com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKeyFIPSTest.nonCompliantKeysLaunchExceptionTest -- Time elapsed: 2.746 s <<< ERROR!
org.jvnet.hudson.reactor.ReactorException: java.lang.Error: java.lang.reflect.InvocationTargetException
        at org.jvnet.hudson.reactor.Reactor.execute(Reactor.java:290)
        at jenkins.InitReactorRunner.run(InitReactorRunner.java:49)
        at jenkins.model.Jenkins.executeReactor(Jenkins.java:1205)
        at jenkins.model.Jenkins.<init>(Jenkins.java:992)
        at hudson.model.Hudson.<init>(Hudson.java:86)
        at org.jvnet.hudson.test.JenkinsRule.newHudson(JenkinsRule.java:746)
        at org.jvnet.hudson.test.JenkinsRule.before(JenkinsRule.java:408)
        at org.jvnet.hudson.test.JenkinsRule$1.evaluate(JenkinsRule.java:649)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at java.base/java.lang.Thread.run(Thread.java:840)
Caused by: java.lang.Error: java.lang.reflect.InvocationTargetException
        at hudson.init.TaskMethodFinder.invoke(TaskMethodFinder.java:115)
        at hudson.init.TaskMethodFinder$TaskImpl.run(TaskMethodFinder.java:185)
        at org.jvnet.hudson.reactor.Reactor.runTask(Reactor.java:305)
        at jenkins.model.Jenkins$5.runTask(Jenkins.java:1170)
        at org.jvnet.hudson.reactor.Reactor$2.run(Reactor.java:221)
        at org.jvnet.hudson.reactor.Reactor$Node.run(Reactor.java:120)
        at jenkins.security.ImpersonatingExecutorService$1.run(ImpersonatingExecutorService.java:68)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
        ... 1 more
Caused by: java.lang.reflect.InvocationTargetException
        at java.base/java.lang.reflect.Method.invoke(Method.java:568)
        at hudson.init.TaskMethodFinder.invoke(TaskMethodFinder.java:109)
        ... 9 more
Caused by: java.lang.IllegalStateException: The eddsa-api plugin is not FIPS compliant and can not be used in a Jenkins configured to run in FIPS-140 mode
        at io.jenkins.plugins.eddsa_api.FIPSComplianceCheck.preventUsageInFipsMode(FIPSComplianceCheck.java:15)
        ... 11 more
[ERROR] com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKeyFIPSTest.formValidationTest -- Time elapsed: 0.025 s <<< ERROR!
org.jvnet.hudson.reactor.ReactorException: java.lang.Error: java.lang.reflect.InvocationTargetException
        at org.jvnet.hudson.reactor.Reactor.execute(Reactor.java:290)
        at jenkins.InitReactorRunner.run(InitReactorRunner.java:49)
        at jenkins.model.Jenkins.executeReactor(Jenkins.java:1205)
        at jenkins.model.Jenkins.<init>(Jenkins.java:992)
        at hudson.model.Hudson.<init>(Hudson.java:86)
        at org.jvnet.hudson.test.JenkinsRule.newHudson(JenkinsRule.java:746)
        at org.jvnet.hudson.test.JenkinsRule.before(JenkinsRule.java:408)
        at org.jvnet.hudson.test.JenkinsRule$1.evaluate(JenkinsRule.java:649)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at java.base/java.lang.Thread.run(Thread.java:840)
Caused by: java.lang.Error: java.lang.reflect.InvocationTargetException
        at hudson.init.TaskMethodFinder.invoke(TaskMethodFinder.java:115)
        at hudson.init.TaskMethodFinder$TaskImpl.run(TaskMethodFinder.java:185)
        at org.jvnet.hudson.reactor.Reactor.runTask(Reactor.java:305)
        at jenkins.model.Jenkins$5.runTask(Jenkins.java:1170)
        at org.jvnet.hudson.reactor.Reactor$2.run(Reactor.java:221)
        at org.jvnet.hudson.reactor.Reactor$Node.run(Reactor.java:120)
        at jenkins.security.ImpersonatingExecutorService$1.run(ImpersonatingExecutorService.java:68)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
        ... 1 more
Caused by: java.lang.reflect.InvocationTargetException
        at java.base/java.lang.reflect.Method.invoke(Method.java:568)
        at hudson.init.TaskMethodFinder.invoke(TaskMethodFinder.java:109)
        ... 9 more
Caused by: java.lang.IllegalStateException: The eddsa-api plugin is not FIPS compliant and can not be used in a Jenkins configured to run in FIPS-140 mode
        at io.jenkins.plugins.eddsa_api.FIPSComplianceCheck.preventUsageInFipsMode(FIPSComplianceCheck.java:15)
        ... 11 more
[ERROR] com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKeyFIPSTest.invalidKeysAreRemovedOnStartupTest -- Time elapsed: 0.039 s <<< ERROR!
org.jvnet.hudson.reactor.ReactorException: java.lang.Error: java.lang.reflect.InvocationTargetException
        at org.jvnet.hudson.reactor.Reactor.execute(Reactor.java:290)
        at jenkins.InitReactorRunner.run(InitReactorRunner.java:49)
        at jenkins.model.Jenkins.executeReactor(Jenkins.java:1205)
        at jenkins.model.Jenkins.<init>(Jenkins.java:992)
        at hudson.model.Hudson.<init>(Hudson.java:86)
        at org.jvnet.hudson.test.JenkinsRule.newHudson(JenkinsRule.java:746)
        at org.jvnet.hudson.test.JenkinsRule.before(JenkinsRule.java:408)
        at org.jvnet.hudson.test.JenkinsRule$1.evaluate(JenkinsRule.java:649)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at java.base/java.lang.Thread.run(Thread.java:840)
Caused by: java.lang.Error: java.lang.reflect.InvocationTargetException
        at hudson.init.TaskMethodFinder.invoke(TaskMethodFinder.java:115)
        at hudson.init.TaskMethodFinder$TaskImpl.run(TaskMethodFinder.java:185)
        at org.jvnet.hudson.reactor.Reactor.runTask(Reactor.java:305)
        at jenkins.model.Jenkins$5.runTask(Jenkins.java:1170)
        at org.jvnet.hudson.reactor.Reactor$2.run(Reactor.java:221)
        at org.jvnet.hudson.reactor.Reactor$Node.run(Reactor.java:120)
        at jenkins.security.ImpersonatingExecutorService$1.run(ImpersonatingExecutorService.java:68)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
        ... 1 more
Caused by: java.lang.reflect.InvocationTargetException
        at java.base/java.lang.reflect.Method.invoke(Method.java:568)
        at hudson.init.TaskMethodFinder.invoke(TaskMethodFinder.java:109)
        ... 9 more
Caused by: java.lang.IllegalStateException: The eddsa-api plugin is not FIPS compliant and can not be used in a Jenkins configured to run in FIPS-140 mode
        at io.jenkins.plugins.eddsa_api.FIPSComplianceCheck.preventUsageInFipsMode(FIPSComplianceCheck.java:15)
        ... 11 more
[ERROR] com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKeyFIPSTest.invalidKeyIsNotSavedInFIPSModeTest -- Time elapsed: 0.022 s <<< ERROR!
org.jvnet.hudson.reactor.ReactorException: java.lang.Error: java.lang.reflect.InvocationTargetException
        at org.jvnet.hudson.reactor.Reactor.execute(Reactor.java:290)
        at jenkins.InitReactorRunner.run(InitReactorRunner.java:49)
        at jenkins.model.Jenkins.executeReactor(Jenkins.java:1205)
        at jenkins.model.Jenkins.<init>(Jenkins.java:992)
        at hudson.model.Hudson.<init>(Hudson.java:86)
        at org.jvnet.hudson.test.JenkinsRule.newHudson(JenkinsRule.java:746)
        at org.jvnet.hudson.test.JenkinsRule.before(JenkinsRule.java:408)
        at org.jvnet.hudson.test.JenkinsRule$1.evaluate(JenkinsRule.java:649)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at java.base/java.lang.Thread.run(Thread.java:840)
Caused by: java.lang.Error: java.lang.reflect.InvocationTargetException
        at hudson.init.TaskMethodFinder.invoke(TaskMethodFinder.java:115)
        at hudson.init.TaskMethodFinder$TaskImpl.run(TaskMethodFinder.java:185)
        at org.jvnet.hudson.reactor.Reactor.runTask(Reactor.java:305)
        at jenkins.model.Jenkins$5.runTask(Jenkins.java:1170)
        at org.jvnet.hudson.reactor.Reactor$2.run(Reactor.java:221)
        at org.jvnet.hudson.reactor.Reactor$Node.run(Reactor.java:120)
        at jenkins.security.ImpersonatingExecutorService$1.run(ImpersonatingExecutorService.java:68)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
        ... 1 more
Caused by: java.lang.reflect.InvocationTargetException
        at java.base/java.lang.reflect.Method.invoke(Method.java:568)
        at hudson.init.TaskMethodFinder.invoke(TaskMethodFinder.java:109)
        ... 9 more
Caused by: java.lang.IllegalStateException: The eddsa-api plugin is not FIPS compliant and can not be used in a Jenkins configured to run in FIPS-140 mode
        at io.jenkins.plugins.eddsa_api.FIPSComplianceCheck.preventUsageInFipsMode(FIPSComplianceCheck.java:15)
        ... 11 more

basil · 2024-07-23T20:36:30Z

pom.xml

@@ -71,7 +71,7 @@

  <properties>
    <changelist>999999-SNAPSHOT</changelist>
-    <jenkins.version>2.387.3</jenkins.version>
+    <jenkins.version>2.426.3</jenkins.version>


Core bumps should also update the BOM artifactId: #210 (comment)

ah right. we might need something to check this automatically rather than relying on human check. maybe an enforcer rule could do the job here

easiest way that is done in a few plugins is to use variables, e.g.:
https://github.com/jenkinsci/junit-plugin/blob/85201a38881e5811c8632b610d8d655f161db103/pom.xml#L18

https://github.com/jenkinsci/junit-plugin/blob/85201a38881e5811c8632b610d8d655f161db103/pom.xml#L194

timja · 2024-07-24T08:51:21Z

...s/com/cloudbees/jenkins/plugins/sshcredentials/impl/BasicSSHUserPrivateKey/credentials.jelly

  </f:entry>
+  <script><![CDATA[


new script blocks shouldn't be introduced: https://www.jenkins.io/doc/developer/security/csp/

PereBueno added 4 commits July 8, 2024 13:29

Adding bc-api dependency

30318f8

Added FIPS compliance check

878d63e

Testing

a79d5b7

testing form validation

a5de758

PereBueno commented Jul 9, 2024

View reviewed changes

src/main/java/com/cloudbees/jenkins/plugins/sshcredentials/impl/BasicSSHUserPrivateKey.java Outdated Show resolved Hide resolved

PereBueno added 2 commits July 9, 2024 12:24

using textarea

b0082f0

removing form validation

9c7386c

PereBueno marked this pull request as ready for review July 9, 2024 15:00

PereBueno requested a review from a team as a code owner July 9, 2024 15:00

jtnord reviewed Jul 9, 2024

View reviewed changes

PereBueno added 5 commits July 10, 2024 09:28

removing bc-fips test dependency

fc6daf7

Form validation for secret key

eff0a48

using resources messages instead of hardcoded ones

c55e803

Adding passphrase length validation

2521e5b

form validation working - to move back to secretTextArea

f3ef2e0

PereBueno added 2 commits July 10, 2024 18:09

using secretTextArea again

dab1db9

Added TODO related to JENKINS-65616

aab327b

fcojfernandez reviewed Jul 10, 2024

View reviewed changes

src/main/java/com/cloudbees/jenkins/plugins/sshcredentials/impl/BasicSSHUserPrivateKey.java Outdated Show resolved Hide resolved

fcojfernandez approved these changes Jul 11, 2024

View reviewed changes

Update src/main/java/com/cloudbees/jenkins/plugins/sshcredentials/imp…

ad8fbec

…l/BasicSSHUserPrivateKey.java Co-authored-by: Francisco Javier Fernandez <31063239+fcojfernandez@users.noreply.github.com>

olamy added the enhancement label Jul 11, 2024

PereBueno requested a review from jtnord July 11, 2024 12:20

jtnord reviewed Jul 12, 2024

View reviewed changes

src/main/java/com/cloudbees/jenkins/plugins/sshcredentials/impl/BasicSSHUserPrivateKey.java Outdated Show resolved Hide resolved

jtnord reviewed Jul 12, 2024

View reviewed changes

PereBueno and others added 4 commits July 15, 2024 10:41

Update src/main/java/com/cloudbees/jenkins/plugins/sshcredentials/imp…

ede9354

…l/BasicSSHUserPrivateKey.java Co-authored-by: James Nord <jtnord@users.noreply.github.com>

removing extra logs

b6da84d

Merge branch 'JENKINS-73408' of https://github.com/PereBueno/ssh-cred…

15e8d67

…entials-plugin into JENKINS-73408

support for unencrypted openssh keys

1c506bc

PereBueno added 3 commits July 16, 2024 11:36

testing openssh keys

04f7947

generating ids dinamically

07b5701

back to secretTextArea after checking validations

c75d0af

jtnord reviewed Jul 16, 2024

View reviewed changes

src/main/java/com/cloudbees/jenkins/plugins/sshcredentials/impl/BasicSSHUserPrivateKey.java Show resolved Hide resolved

Update src/main/java/com/cloudbees/jenkins/plugins/sshcredentials/imp…

bdce55b

…l/BasicSSHUserPrivateKey.java Co-authored-by: James Nord <jtnord@users.noreply.github.com>

jtnord reviewed Jul 16, 2024

View reviewed changes

src/main/java/com/cloudbees/jenkins/plugins/sshcredentials/impl/BasicSSHUserPrivateKey.java Outdated Show resolved Hide resolved

src/main/java/com/cloudbees/jenkins/plugins/sshcredentials/impl/BasicSSHUserPrivateKey.java Outdated Show resolved Hide resolved

PereBueno added 3 commits July 17, 2024 09:40

accepting rsa >= 2048 only

0cd9f12

Merge branch 'JENKINS-73408' of https://github.com/PereBueno/ssh-cred…

0cc1c42

…entials-plugin into JENKINS-73408

openssh keys simply propagate exception

227550e

PereBueno requested a review from jtnord July 17, 2024 13:56

PereBueno added 2 commits July 18, 2024 09:18

updated message literal

d4e934a

Testing form validation too

139f9e1

fcojfernandez approved these changes Jul 23, 2024

View reviewed changes

olamy approved these changes Jul 23, 2024

View reviewed changes

olamy changed the title ~~[JENKINS-73408] Ensure keys are FIPS compliant when running in FIPS mode~~ [JENKINS-73408] Ensure keys are FIPS compliant when running in FIPS mode, core requirement bump to 2.426.3 Jul 23, 2024

olamy merged commit b5a52ed into jenkinsci:master Jul 23, 2024
15 checks passed

basil mentioned this pull request Jul 23, 2024

Revert "Bump org.jenkins-ci.plugins:ssh-credentials from 337.v395d2403ccd4 to 341.vf31377f30378 in /bom-weekly" jenkinsci/bom#3398

Merged

basil reviewed Jul 23, 2024

View reviewed changes

basil mentioned this pull request Jul 23, 2024

Bump org.jenkins-ci.plugins:ssh-credentials from 337.v395d2403ccd4 to 341.vf31377f30378 in /bom-weekly jenkinsci/bom#3399

Closed

timja reviewed Jul 24, 2024

View reviewed changes

PereBueno mentioned this pull request Jul 24, 2024

[JENKINS-73408] bom update to bom-2.426.x in order to align with core requirement #211

Merged

6 tasks

timja mentioned this pull request Jul 24, 2024

Add jenkins.baseline variable to reduce manual bom update mistakes jenkinsci/archetypes#737

Merged

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[JENKINS-73408] Ensure keys are FIPS compliant when running in FIPS mode, core requirement bump to 2.426.3 #210

[JENKINS-73408] Ensure keys are FIPS compliant when running in FIPS mode, core requirement bump to 2.426.3 #210

PereBueno commented Jul 8, 2024 •

edited

Loading

jtnord commented Jul 9, 2024

jtnord left a comment

PereBueno commented Jul 10, 2024

basil commented Jul 23, 2024

basil Jul 23, 2024 •

edited

Loading

olamy Jul 24, 2024

timja Jul 24, 2024

PereBueno Jul 24, 2024

timja Jul 24, 2024

PereBueno Jul 24, 2024

[JENKINS-73408] Ensure keys are FIPS compliant when running in FIPS mode, core requirement bump to 2.426.3 #210

[JENKINS-73408] Ensure keys are FIPS compliant when running in FIPS mode, core requirement bump to 2.426.3 #210

Conversation

PereBueno commented Jul 8, 2024 • edited Loading

Testing done

Submitter checklist

jtnord commented Jul 9, 2024

jtnord left a comment

Choose a reason for hiding this comment

PereBueno commented Jul 10, 2024

basil commented Jul 23, 2024

basil Jul 23, 2024 • edited Loading

Choose a reason for hiding this comment

olamy Jul 24, 2024

Choose a reason for hiding this comment

timja Jul 24, 2024

Choose a reason for hiding this comment

PereBueno Jul 24, 2024

Choose a reason for hiding this comment

timja Jul 24, 2024

Choose a reason for hiding this comment

PereBueno Jul 24, 2024

Choose a reason for hiding this comment

PereBueno commented Jul 8, 2024 •

edited

Loading

basil Jul 23, 2024 •

edited

Loading