File: //opt/OV/lbin/secco/FIPS_tool.tar
FIPS_tool.pl 0000644 0000326 0000024 00000036747 13203261740 012365 0 ustar bldadm users #!/opt/OV/nonOV/perl/a/bin/perl
use strict;
use warnings;
use File::Copy;
use Getopt::Long;
my $total = $#ARGV + 1;
my $enable_FIPS = 0;
my $disable_FIPS = 0;
my $set_FIPS = 0;
my $help = 0;
my $Java_Home = 0;
my $destination = 0;
my $source = 0;
my $ok = 0;
my $result = 0;
my $ov_inst_dir = "/opt/OV";
my $ov_bin_dir = "/opt/OV/bin";
my $ov_java_dir = "/opt/OV/java";
my $ov_lbin_dir = "/opt/OV/lbin/secco";
my $archDir = 0;
our $HKEY_LOCAL_MACHINE;
if ($^O eq "aix") {
$ov_inst_dir = "/usr/lpp/OV";
$ov_bin_dir = "/usr/lpp/OV/bin";
$ov_java_dir="/usr/lpp/OV/java";
$ov_lbin_dir = "/usr/lpp/OV/lbin/secco";
}
elsif ($^O =~ /MSWin/) {
require Win32::Registry;
import Win32::Registry;
my ($rkey);
my ($var);
my ($type);
my ($p) = 'SOFTWARE\Hewlett-Packard\HP OpenView';
$HKEY_LOCAL_MACHINE->Open($p, $rkey);
$rkey->QueryValueEx("InstallDir", $type, $var);
my $OSbit = `set`;
if ( $OSbit =~ m/Files\(x86\)/i )
{
$ov_bin_dir = "\"".$var."bin/win64/"."\"";
}
else
{
$ov_bin_dir = "\"".$var."bin/"."\"";
}
$ov_inst_dir = $var;
$ov_java_dir = $var."java";
$ov_lbin_dir = "\"".$var."lbin/secco/"."\"";
}
sub usage
{
print "Usage: \n";
print " FIPS_tool -enable_FIPS [-Java_Home <jre_dir_path>] \n";
print " -disable_FIPS [-Java_Home <jre_dir_path>] \n";
print " -help \n";
exit;
}
$ok = GetOptions('enable_FIPS' => \$enable_FIPS, 'disable_FIPS' => \$disable_FIPS, 'Java_Home:s' => \$Java_Home, 'help' => \$help);
if ($ok ne "1")
{
usage();
}
if ($total > 0)
{
if ($help eq "1")
{
usage();
}
if ($enable_FIPS eq "1")
{
if ($disable_FIPS eq "1" || $set_FIPS eq "1")
{
usage();
}
}
if ($disable_FIPS eq "1")
{
if ($enable_FIPS eq "1" || $set_FIPS eq "1")
{
usage();
}
}
if ($set_FIPS eq "1")
{
if ($enable_FIPS eq "1" || $disable_FIPS eq "1")
{
usage();
}
}
if ($set_FIPS eq "1")
{
if ($Java_Home eq "0")
{
usage();
}
}
}
else
{
usage();
}
if ($enable_FIPS eq "1")
{
my $cmd = 0;
my $ENABLE_DEF_SYM_KEY_ALGO = 0;
my $HASH_ALGO = 0;
my $HASH_ALGO_AS_SEED = 0;
#check if FIPS mode already enabled
$cmd = "ovconfget sec.core ENABLE_FIPS_MODE";
$result = `$ov_bin_dir/$cmd`;
if ($result eq "TRUE\n")
{
#print "ENABLE_FIPS_MODE is already configured\n";
}
else
{
#printf "Stoping all OV processes"
$cmd = "ovc -kill";
$result = `$ov_bin_dir/$cmd`;
$result = 0;
#check if ENABLE_DEF_SYM_KEY_ALGO is already set
$cmd = "ovconfget sec.core ENABLE_DEF_SYM_KEY_ALGO";
$result = `$ov_bin_dir/$cmd`;
my $sym_alg = 0;
if ($result eq "TRUE\n")
{
$result = 0;
#check if DEF_SYM_KEY_ALGO is already set
$cmd = "ovconfget sec.core DEF_SYM_KEY_ALGO";
$result = `$ov_bin_dir/$cmd`;
if (($result ne "eBlowfish\n") && ($result ne "eDES\n"))
{
$ENABLE_DEF_SYM_KEY_ALGO = 1;
#print "ENABLE_DEF_SYM_KEY_ALGO is configured\n";
}
else
{
$sym_alg = "eAES128";
}
}
else
{
$result = 0;
#check if DEF_SYM_KEY_ALGO is already set
$cmd = "ovconfget sec.core DEF_SYM_KEY_ALGO";
$result = `$ov_bin_dir/$cmd`;
if ($result ne "\n")
{
if ($result eq "eDES3\n")
{
$sym_alg = "eDES3";
}
elsif ($result eq "eAES128\n")
{
$sym_alg = "eAES128";
}
elsif ($result eq "eAES192\n")
{
$sym_alg = "eAES192";
}
elsif ($result eq "eAES256\n")
{
$sym_alg = "eAES256";
}
else
{
$sym_alg = "eAES128";
}
}
else
{
$sym_alg = "eAES128";
}
}
$result = 0;
$cmd = "ovconfget sec.core HASH_ALGO";
$result = `$ov_bin_dir/$cmd`;
my $alg = 0;
if ($result ne "\n")
{
if ($result eq "eSHA1\n")
{
$alg = "eSHA1";
}
elsif ($result eq "eSHA224\n")
{
$alg = "eSHA224";
}
elsif ($result eq "eSHA384\n")
{
$alg = "eSHA384";
}
elsif ($result eq "eSHA512\n")
{
$alg = "eSHA512";
}
else
{
$alg = "eSHA256";
}
}
else
{
$alg = "eSHA256";
}
$result = 0;
$cmd = "ovconfget sec.core HASH_ALGO_AS_SEED";
$result = `$ov_bin_dir/$cmd`;
if ($result eq "TRUE\n")
{
#migration is already done;
$HASH_ALGO_AS_SEED = 1;
my $result1 = 0;
my $cmd1 = "ovconfget sec.core HASH_ALGO";
$result1 = `$ov_bin_dir/$cmd1`;
if ($result1 ne "\n")
{
if ($result1 eq "eMD5\n")
{
$alg = "eSHA256";
$HASH_ALGO_AS_SEED = 0;
}
}
else
{
$alg = "eSHA256";
$HASH_ALGO_AS_SEED = 0;
}
}
if ($ENABLE_DEF_SYM_KEY_ALGO eq "0" && $HASH_ALGO_AS_SEED eq "0")
{
$cmd = "MigrateSymKey -sym_key_algo $sym_alg -hash_algo $alg";
$result = `$ov_lbin_dir/$cmd`;
print "Executing: MigrateSymKey -sym_key_algo $sym_alg -hash_algo $alg\n";
}
elsif ($ENABLE_DEF_SYM_KEY_ALGO eq "0")
{
$cmd = "MigrateSymKey -sym_key_algo $sym_alg";
$result = `$ov_lbin_dir/$cmd`;
print "Executing: MigrateSymKey -sym_key_algo $sym_alg\n";
}
elsif ($HASH_ALGO_AS_SEED eq "0")
{
$cmd = "MigrateSymKey -hash_algo $alg";
$result = `$ov_lbin_dir/$cmd`;
print "Executing: MigrateSymKey -hash_algo $alg\n";
}
$cmd = "ovconfchg -ns sec.core -set ENABLE_FIPS_MODE TRUE";
$result = `$ov_bin_dir/$cmd`;
$cmd = "ovconfchg -ns eaagt -set CRYPT_USING_LCORE TRUE";
$result = `$ov_bin_dir/$cmd`;
#printf "Starting all OV processes"
$cmd = "ovc -start";
$result = `$ov_bin_dir/$cmd`;
#print "please ensure you have RSA 2048 bit certificate installed";
}
#java enablement
if ($Java_Home eq "0")
{
# by default set OVJREB in FIPS_mode
# check if OvJREB is installed
my $ov_jre_dir = "$ov_inst_dir/nonOV/jre";
if (-d $ov_jre_dir)
{
# check if OvJSecCore is installed and file exists
my $ov_jsec_dir = "$ov_inst_dir/java/cryptoj_ext";
if (-d $ov_jsec_dir)
{
$Java_Home = $ov_jre_dir;
}
}
}
if ($Java_Home ne "0")
{
# copy jar files to required location
if (($Java_Home =~ m/nonOV\\jre/) || ($Java_Home =~ m/nonOV\/jre/)) {
$destination = "$Java_Home/b/lib/ext";
}
else {
$destination = "$Java_Home/lib/ext";
}
$source = "$ov_java_dir/cryptoj_ext";
copy( "$source/cryptojcommon.jar", "$destination/cryptojcommon.jar" )
or die "Copy of $source/cryptojcommon.jar failed: $!";
copy( "$source/cryptojce.jar", "$destination/cryptojce.jar" )
or die "Copy of $source/cryptojce.jar failed: $!";
copy( "$source/jcmFIPS.jar", "$destination/jcmFIPS.jar" )
or die "Copy of $source/jcmFIPS.jar failed: $!";
# update java.security file content
my $filename;
if (($Java_Home =~ m/nonOV\\jre/) || ($Java_Home =~ m/nonOV\/jre/)) {
$filename = "$Java_Home/b/lib/security/java.security";
}
else {
$filename = "$Java_Home/lib/security/java.security";
}
my @newlines;
my $JsafeJCE = 0;
my $FIPSSslMode = 0;
open(FILE, $filename) || die "java.security file not found";
my @lines = <FILE>;
close(FILE);
foreach(@lines) {
if ($_ =~ m/security.provider.1=com.rsa.jsafe.provider.JsafeJCE/) {
$JsafeJCE = 1;
}
if ($_ =~ m/com.rsa.cryptoj.fips140initialmode=FIPS140_SSL_MODE/) {
$FIPSSslMode = 1;
}
}
if ($JsafeJCE eq "0")
{
my $noincrement = 0;
foreach(@lines) {
if ($_ =~ m/security.provider/)
{
if ($_ !~ m/#/)
{
if ($JsafeJCE eq "0")
{
push(@newlines, "security.provider.1=com.rsa.jsafe.provider.JsafeJCE\n");
$JsafeJCE = 1;
}
if ($noincrement eq "0")
{
$_ =~ s/(\d+)/$1+1/e;
}
if ($_ =~ m/ssl.internal.ssl.Provider/)
{
chomp($_);
$_ = "$_ JsafeJCE\n";
push(@newlines, "$_");
}
if ($_ =~ m/JCE/) {
if ($_ !~ m/JsafeJCE/)
{
push(@newlines, "#$_");
$noincrement = 1;
}
}
else {
push(@newlines, $_);
}
}
else {
push(@newlines, $_);
}
}
else {
push(@newlines, $_);
}
}
if ($FIPSSslMode eq "0")
{
push(@newlines, "com.rsa.cryptoj.fips140initialmode=FIPS140_SSL_MODE");
}
open(FILE,">$filename") || die "java.security file not found";
print FILE @newlines;
close(FILE);
}
}
print "FIPS mode enabled\n";
}
if ($disable_FIPS eq "1")
{
my $cmd = 0;
$cmd = "ovconfget sec.core ENABLE_FIPS_MODE";
$result = `$ov_bin_dir/$cmd`;
if ($result eq "TRUE\n")
{
$cmd = "ovc -kill";
$result = `$ov_bin_dir/$cmd`;
$cmd = "ovconfchg -ns sec.core -clear ENABLE_FIPS_MODE ";
$result = `$ov_bin_dir/$cmd`;
$cmd = "ovc -start";
$result = `$ov_bin_dir/$cmd`;
}
#java enablement
if ($Java_Home eq "0")
{
# by default set OVJREB in non FIPS_mode
# check if OvJREB is installed
my $ov_jre_dir = "$ov_inst_dir/nonOV/jre";
if (-d $ov_jre_dir)
{
# check if OvJSecCore is installed and file exists
my $ov_jsec_dir = "$ov_inst_dir/java/cryptoj_ext";
if (-d $ov_jsec_dir)
{
$Java_Home = $ov_jre_dir;
}
}
}
if ($Java_Home ne "0")
{
# delete the crypto jar files from java_dir
my $dir;
if (($Java_Home =~ m/nonOV\\jre/) || ($Java_Home =~ m/nonOV\/jre/)) {
$dir = "$Java_Home/b/lib/ext";
}
else {
$dir = "$Java_Home/lib/ext";
}
unlink "$dir/cryptojcommon.jar";
unlink "$dir/cryptojce.jar";
unlink "$dir/jcmFIPS.jar";
my $filename;
if (($Java_Home =~ m/nonOV\\jre/) || ($Java_Home =~ m/nonOV\/jre/)) {
$filename = "$Java_Home/b/lib/security/java.security";
}
else {
$filename = "$Java_Home/lib/security/java.security";
}
my @newlines;
my $JsafeJCE = 0;
my $decrement = 1;
open(FILE, $filename) || die "java.security file not found";
my @lines = <FILE>;
close(FILE);
foreach(@lines) {
if ($_ =~ m/security.provider.1=com.rsa.jsafe.provider.JsafeJCE/) {
$JsafeJCE = 1;
}
}
if ($JsafeJCE eq "1")
{
foreach(@lines) {
if ($_ =~ m/security.provider.1=com.rsa.jsafe.provider.JsafeJCE/) {
;
}
elsif ($_ =~ m/com.rsa.cryptoj.fips140initialmode=FIPS140_SSL_MODE/) {
;
}
else
{
if ($_ =~ m/security.provider/) {
if ($_ !~ m/#/)
{
if ($decrement eq "1")
{
$_ =~ s/(\d+)/$1-1/e;
}
}
}
if ($_ =~ m/JCE/) {
if ($_ =~ m/#security.provider/) {
$_ =~ s/(\#+)//g;
$_ =~ s/(\d+)/$1-1/e;
$decrement = 0;
}
}
if ($_ =~ m/JsafeJCE/)
{
chomp($_);
$/=' JsafeJCE';
chomp($_);
push(@newlines, "$_\n");
}
else {
push(@newlines, $_);
}
}
}
open(FILE,">$filename") || die "java.security file not found";
print FILE @newlines;
close(FILE);
}
}
print "FIPS mode disabled\n";
}
if ($set_FIPS eq "1")
{
if ($Java_Home ne "0")
{
# copy jar files to required location
if (($Java_Home =~ m/nonOV\\jre/) || ($Java_Home =~ m/nonOV\/jre/)) {
$destination = "$Java_Home/b/lib/ext";
}
else {
$destination = "$Java_Home/lib/ext";
}
$source = "$ov_java_dir/cryptoj_ext/";
copy( "$source/cryptojcommon.jar", "$destination/cryptojcommon.jar" )
or die "Copy of $source/cryptojcommon.jar failed: $!";
copy( "$source/cryptojce.jar", "$destination/cryptojce.jar" )
or die "Copy of $source/cryptojce.jar failed: $!";
copy( "$source/jcmFIPS.jar", "$destination/jcmFIPS.jar" )
or die "Copy of $source/jcmFIPS.jar failed: $!";
# update java.security file content
my $filename;
if (($Java_Home =~ m/nonOV\\jre/) || ($Java_Home =~ m/nonOV\/jre/)) {
$filename = "$Java_Home/b/lib/security/java.security";
}
else {
$filename = "$Java_Home/lib/security/java.security";
}
my @newlines;
my $JsafeJCE = 0;
open(FILE, $filename) || die "java.security file not found";
my @lines = <FILE>;
close(FILE);
foreach(@lines) {
if ($_ =~ m/security.provider.1=com.rsa.jsafe.provider.JsafeJCE/) {
$JsafeJCE = 1;
}
}
if ($JsafeJCE eq "0")
{
push(@newlines, "security.provider.1=com.rsa.jsafe.provider.JsafeJCE\n");
foreach(@lines) {
if ($_ =~ m/security.provider/) {
$_ =~ s/(\d+)/$1+1/e;
}
push(@newlines, $_);
}
}
else
{
# -enable_FIPS could be already done
foreach(@lines) {
if ($_ =~ m/JCE/) {
if ($_ =~ m/#security.provider/) {
$_ =~ s/(\#+)//g;
}
push(@newlines, "$_");
}
elsif ($_ =~ m/sun.security.provider.Sun/) {
if ($_ =~ m/#security.provider/) {
$_ =~ s/(\#+)//g;
}
push(@newlines, "$_");
}
else {
push(@newlines, $_);
}
}
}
open(FILE,">$filename") || die "java.security file not found";
print FILE @newlines;
close(FILE);
}
}