[JENKINS-71971][JEP-237] FIPS-140 compliant version of HudsonPrivateSecurityRealm

core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java

@@ -60,6 +60,7 @@
 import java.util.List;
 import java.util.Random;
 import java.util.Set;
+import java.util.logging.Level;
 import java.util.logging.Logger;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
@@ -539,10 +540,10 @@
     public User createAccountWithHashedPassword(String userName, String hashedPassword) throws IOException {
         if (!PASSWORD_ENCODER.isPasswordHashed(hashedPassword)) {
             final String message;
             if (hashedPassword == null) {
                 message = "The hashed password cannot be null";
             } else if (hashedPassword.startsWith(getPasswordHeader())) {
                 message = "The hashed password was hashed with the correct algorithm, but the format was not correct";
             } else {
                 message = "The hashed password was hashed with an incorrect algorithm. Jenkins is expecting " + getPasswordHeader();
             }
@@ -992,7 +993,7 @@
             // lazy initialisation so that we do not block startup due to entropy
             if (random == null) {
                 synchronized (this) {
                     if (random == null) {
                         random = new SecureRandom();
                     }
                 }
@@ -1078,7 +1079,17 @@
             if (password == null) {
                 return false;
             }
-            return password.startsWith(getPasswordHeader()) && PASSWORD_HASH_ENCODER.isHashValid(password.substring(getPasswordHeader().length()));
+            if (password.startsWith(getPasswordHeader())) {
+                return PASSWORD_HASH_ENCODER.isHashValid(password.substring(getPasswordHeader().length()));
+            }
+            if (password.startsWith(FIPS140.useCompliantAlgorithms() ? JBCRYPT : PBKDF2)) {
+                // switch the header to see if this is using a different encryption
+                LOGGER.log(Level.WARNING, "A password appears to be stored (or is attempting to be stored) that was created with a different"
+                        + " hashing/encryption algorithm, check the FIPS-140 state of the system has not changed inadvertently");
+            } else {
+                LOGGER.log(Level.FINE, "A password appears to be stored (or is attempting to be stored) that is not hashed/encrypted.");
+            }
+            return false;
         }
     }
 

test/src/test/java/hudson/security/HudsonPrivateSecurityRealmFIPSTest.java

@@ -25,11 +25,15 @@
 package hudson.security;
 
 import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.not;
 import static org.hamcrest.Matchers.startsWith;
 import static org.junit.Assert.assertThrows;
 
 import hudson.model.User;
 import hudson.security.HudsonPrivateSecurityRealm.Details;
+import java.util.logging.Level;
+import org.hamcrest.Matcher;
 import org.htmlunit.FailingHttpStatusCodeException;
 import org.junit.ClassRule;
 import org.junit.Rule;
@@ -39,15 +43,22 @@
 import org.jvnet.hudson.test.For;
 import org.jvnet.hudson.test.JenkinsRule;
 import org.jvnet.hudson.test.JenkinsRule.WebClient;
+import org.jvnet.hudson.test.LoggerRule;
 
 
 @For(HudsonPrivateSecurityRealm.class)
 public class HudsonPrivateSecurityRealmFIPSTest {
 
+    // the jbcrypt encoded for of "a" without the quotes
+    private static final String JBCRYPT_ENCODED_PASSWORD = "#jbcrypt:$2a$06$m0CrhHm10qJ3lXRY.5zDGO3rS2KdeeWLuGmsfGlMfOxih58VYVfxe";
+
     @ClassRule
     // do not use the FIPS140 class here as that initializes the field before we set the property!
     public static TestRule flagRule = FlagRule.systemProperty("jenkins.security.FIPS140.COMPLIANCE", "true");
 
+    @Rule
+    public LoggerRule lr = new LoggerRule().record(HudsonPrivateSecurityRealm.class, Level.WARNING).capture(5);
+
     @Rule
     public JenkinsRule j = new JenkinsRule();
 
@@ -83,5 +94,40 @@ public void userCreationWithHashedPasswords() throws Exception {
         wc.login("user_hashed", "password");
 
         assertThrows(FailingHttpStatusCodeException.class, () -> wc.login("user_hashed", "password2"));
+        assertThat(lr, not(hasIncorrectHashingLogEntry()));
+    }
+
+    @Test
+    public void userLoginAfterEnablingFIPS() throws Exception {
+        HudsonPrivateSecurityRealm securityRealm = new HudsonPrivateSecurityRealm(false, false, null);
+        j.jenkins.setSecurityRealm(securityRealm);
+
+        User u1 = securityRealm.createAccount("user", "a");
+        u1.setFullName("A User");
+        // overwrite the password property using an password created using an incorrect algorithm
+        u1.addProperty(Details.fromHashedPassword(JBCRYPT_ENCODED_PASSWORD));
+
+        u1.save();
+        assertThat(u1.getProperty(Details.class).getPassword(), is(JBCRYPT_ENCODED_PASSWORD));
+
+        try (WebClient wc = j.createWebClient()) {
+            assertThrows(FailingHttpStatusCodeException.class, () -> wc.login("user", "a"));
+        }
+        assertThat(lr, hasIncorrectHashingLogEntry());
+    }
+
+    @Test
+    public void userCreationWithJBCryptPasswords() throws Exception {
+        HudsonPrivateSecurityRealm securityRealm = new HudsonPrivateSecurityRealm(false, false, null);
+
+        IllegalArgumentException illegalArgumentException = assertThrows(IllegalArgumentException.class,
+                () -> securityRealm.createAccountWithHashedPassword("user_hashed_incorrect_algorithm", JBCRYPT_ENCODED_PASSWORD));
+        assertThat(illegalArgumentException.getMessage(),
+                is("The hashed password was hashed with an incorrect algorithm. Jenkins is expecting $PBKDF2"));
+    }
+
+    private static Matcher<LoggerRule> hasIncorrectHashingLogEntry() {
+        return LoggerRule.recorded(is(
+                "A password appears to be stored (or is attempting to be stored) that was created with a different hashing/encryption algorithm, check the FIPS-140 state of the system has not changed inadvertently"));
     }
 }

test/src/test/java/hudson/security/HudsonPrivateSecurityRealmTest.java

@@ -41,6 +41,7 @@
 import edu.umd.cs.findbugs.annotations.NonNull;
 import hudson.ExtensionList;
 import hudson.model.User;
+import hudson.security.HudsonPrivateSecurityRealm.Details;
 import hudson.security.pages.SignupPage;
 import java.lang.reflect.Field;
 import java.net.URL;
@@ -50,11 +51,14 @@
 import java.util.Base64;
 import java.util.Collections;
 import java.util.List;
+import java.util.logging.Level;
 import jenkins.security.ApiTokenProperty;
 import jenkins.security.SecurityListener;
 import jenkins.security.apitoken.ApiTokenPropertyConfiguration;
 import jenkins.security.seed.UserSeedProperty;
 import org.apache.commons.lang.StringUtils;
+import org.hamcrest.Matcher;
+import org.htmlunit.FailingHttpStatusCodeException;
 import org.htmlunit.HttpMethod;
 import org.htmlunit.WebRequest;
 import org.htmlunit.html.HtmlForm;
@@ -70,15 +74,23 @@
 import org.jvnet.hudson.test.Issue;
 import org.jvnet.hudson.test.JenkinsRule;
 import org.jvnet.hudson.test.JenkinsRule.WebClient;
+import org.jvnet.hudson.test.LoggerRule;
 import org.jvnet.hudson.test.TestExtension;
 import org.mindrot.jbcrypt.BCrypt;
 
 @For({UserSeedProperty.class, HudsonPrivateSecurityRealm.class})
 public class HudsonPrivateSecurityRealmTest {
 
+    // the PBKDF encoded for of "password" without the quotes
+    private static final String PBKDF_ENDOCED_PASSWORD =
+            "$PBKDF2$HMACSHA512:210000:ffbb207b847010af98cdd2b09c79392c$f67c3b985daf60db83a9088bc2439f7b77016d26c1439a9877c4f863c377272283ce346edda4578a5607ea620a4beb662d853b800f373297e6f596af797743a6";
+
     @Rule
     public JenkinsRule j = new JenkinsRule();
 
+    @Rule
+    public LoggerRule lr = new LoggerRule().record(HudsonPrivateSecurityRealm.class, Level.WARNING).capture(5);
+
     private SpySecurityListenerImpl spySecurityListener;
 
     @Before
@@ -511,6 +523,7 @@ public void createAccountSupportsHashedPasswords() throws Exception {
 
         XmlPage w2 = (XmlPage) wc.goTo("whoAmI/api/xml", "application/xml");
         assertThat(w2, hasXPath("//name", is("user_hashed")));
+        assertThat(lr, not(hasIncorrectHashingLogEntry()));
     }
 
     @Test
@@ -717,6 +730,40 @@ public void changingPassword_withSeedDisable_hasNoImpact() throws Exception {
         }
     }
 
+    @Test
+    public void userLoginAfterDisalbingFIPS() throws Exception {
+        HudsonPrivateSecurityRealm securityRealm = new HudsonPrivateSecurityRealm(false, false, null);
+        j.jenkins.setSecurityRealm(securityRealm);
+
+        User u1 = securityRealm.createAccount("user", "password");
+        u1.setFullName("A User");
+        // overwrite the password property using an password created using an incorrect algorithm
+        u1.addProperty(Details.fromHashedPassword(PBKDF_ENDOCED_PASSWORD));
+
+        u1.save();
+        assertThat(u1.getProperty(Details.class).getPassword(), is(PBKDF_ENDOCED_PASSWORD));
+
+        try (WebClient wc = j.createWebClient()) {
+            assertThrows(FailingHttpStatusCodeException.class, () -> wc.login("user", "password"));
+        }
+        assertThat(lr, hasIncorrectHashingLogEntry());
+    }
+
+    @Test
+    public void userCreationWithPBKDFPasswords() throws Exception {
+        HudsonPrivateSecurityRealm securityRealm = new HudsonPrivateSecurityRealm(false, false, null);
+
+        IllegalArgumentException illegalArgumentException = assertThrows(IllegalArgumentException.class,
+                () -> securityRealm.createAccountWithHashedPassword("user_hashed_incorrect_algorithm", PBKDF_ENDOCED_PASSWORD));
+        assertThat(illegalArgumentException.getMessage(),
+                is("The hashed password was hashed with an incorrect algorithm. Jenkins is expecting #jbcrypt:"));
+    }
+
+    private static Matcher<LoggerRule> hasIncorrectHashingLogEntry() {
+        return LoggerRule.recorded(is(
+                "A password appears to be stored (or is attempting to be stored) that was created with a different hashing/encryption algorithm, check the FIPS-140 state of the system has not changed inadvertently"));
+    }
+
     private User prepareRealmAndAlice() throws Exception {
         j.jenkins.setDisableRememberMe(false);
         HudsonPrivateSecurityRealm securityRealm = new HudsonPrivateSecurityRealm(false, false, null);