[ZOOKEEPER-4393] Problem to connect to zookeeper in FIPS mode

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.6.3
• Fix Version/s: 3.9.0, 3.8.2
• Component/s: security
• Labels: FIPS pull-request-available
• Assignee: Andor Molnar
• Reporter: Dipesh Kumar Dutta
• Created: 08/Oct/21 11:17
• Updated: 24/Nov/24 15:50
• Resolved: 15/Jun/23 12:13

Description

In my environment zookeeper is running in fips mode of 3 node cluster. My service is also running in fips mode with security provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider

And from the my service when I am trying to connect to zookeeper I am getting the below error.

2021-10-06 17:14:52,645 [nioEventLoopGroup-5-1] WARN  io.netty.channel.ChannelInitializer - opc.request.id=none - Failed to initialize a channel. Closing: [id: 0xa129ece9] -
org.apache.zookeeper.common.X509Exception$SSLContextException: java.security.KeyManagementException: FIPS mode: only SunJSSE TrustManagers may be used
	at org.apache.zookeeper.common.X509Util.createSSLContextAndOptionsFromConfig(X509Util.java:386)
	at org.apache.zookeeper.common.X509Util.createSSLContextAndOptions(X509Util.java:328)
	at org.apache.zookeeper.common.X509Util.createSSLContext(X509Util.java:256)

The reason is the zookeeper has its own trust manager implementation which is

public class ZKTrustManager extends X509ExtendedTrustManager

and jdk also provide a trust manager implementation as below.

X509TrustManagerImpl extends X509ExtendedTrustManager implements X509TrustManager

Because of this hierarchy in SSLContextImpl::chooseTrustManager() method the below instance check become false and hence it falls to the exception block.

if (SunJSSE.isFIPS() && !(var1[var2] instanceof X509TrustManagerImpl)) {
    throw new KeyManagementException("FIPS mode: only SunJSSE TrustManagers may be used");
}

 

 

Issue Links

• links to: GitHub Pull Request #2008
• links to: GitHub Pull Request #2015
• links to: GitHub Pull Request #2016