Bug ID: JDK-8280158 New test from JDK-8274736 failed with/without patch in JDK11u

JDK-8280158 : New test from JDK-8274736 failed with/without patch in JDK11u

Type: Bug
Component: security-libs
Sub-Component: java.security
Affected Version: 11,11.0.15

Priority: P3
Status: Resolved
Resolution: Fixed

Submitted: 2022-01-18
Updated: 2023-01-11
Resolved: 2022-10-29

Versions (Unresolved/Resolved/Fixed)

The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.

JDK 11
11.0.18 b01Fixed

Related Reports

Relates :	JDK-8274736 - Concurrent read/close of SSLSockets causes SSLSessions to be invalidated unnecessarily
Relates :	JDK-8277970 - Test jdk/sun/security/ssl/SSLSessionImpl/NoInvalidateSocketException.java fails with "tag mismatch"

Sub Tasks

JDK-8287739 :

[11u] ProblemList sun/security/ssl/SSLSessionImpl/NoInvalidateSocketException.java - Resolved

Description

The new test NoInvalidateSocketException.java from JDK-8274736 failed with and without the fix in TransportContext.java.

SAP reported the problem with the backport. Apparently, it is JDK11u specific.

Logs:

335262374876357: Main Client Thread: *** OPENED NEW SESSION ***: Session(1640081713614|TLS_AES_256_GCM_SHA384)
335262376364735: Client Reader Thread: Started reading from SSLSocket@4e5adc37
335262388254500: Main Client Thread: Closing SSLSocket@4e5adc37
335262393544543: Main Client Thread: Closed SSLSocket@4e5adc37
335262393794628: Server Reader Thread: Received: -1 bytes of data

335262395736985: Client Reader Thread: Exception reading from SSLSocket@4e5adc37: java.net.SocketException: Socket closed
java.net.SocketException: Socket closed
         at java.base/java.net.SocketInputStream.socketRead0(Native Method)
         at java.base/java.net.SocketInputStream.socketRead(SocketInputStream.java:115)
         at java.base/java.net.SocketInputStream.read(SocketInputStream.java:168)
         at java.base/java.net.SocketInputStream.read(SocketInputStream.java:140)
         at java.base/sun.security.ssl.SSLSocketInputRecord.read(SSLSocketInputRecord.java:478)
         at java.base/sun.security.ssl.SSLSocketInputRecord.readHeader(SSLSocketInputRecord.java:472)
         at java.base/sun.security.ssl.SSLSocketInputRecord.bytesInCompletePacket(SSLSocketInputRecord.java:70)
         at java.base/sun.security.ssl.SSLSocketImpl.readApplicationRecord(SSLSocketImpl.java:1449)
         at java.base/sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:1060)
         at java.base/sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:967)
         at NoInvalidateSocketException.readFromSSLSocket(NoInvalidateSocketException.java:249)
         at NoInvalidateSocketException$ReaderThread.run(NoInvalidateSocketException.java:180)
335262888066936: Main Client Thread: *** Session(1640081713614|TLS_AES_256_GCM_SHA384) IS VALID ***

335263891069822: Main Client Thread: Opened SSLSocket@15cf8e42
335263891241055: Main Client Thread: Started handshake on SSLSocket@15cf8e42

...

javax.net.ssl|ALL|1A|Server Reader Thread|2021-12-21 10:15:26.646 GMT|SSLSessionImpl.java:242|Session initialized:  Session(1640081713614|TLS_AES_256_GCM_SHA384)
javax.net.ssl|ALL|10|Client Reader Thread|2021-12-21 10:15:26.661 GMT|SSLSessionImpl.java:242|Session initialized:  Session(1640081713614|TLS_AES_256_GCM_SHA384)
java.lang.RuntimeException: One or more sessions were improperly invalidated.
         at NoInvalidateSocketException.main(NoInvalidateSocketException.java:88)
         at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
         at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
         at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
         at java.base/java.lang.reflect.Method.invoke(Method.java:566)
         at com.sun.javatest.regtest.agent.MainWrapper$MainThread.run(MainWrapper.java:127)
         at java.base/java.lang.Thread.run(Thread.java:829)

JavaTest Message: Test threw exception: java.lang.RuntimeException: One or more sessions were improperly invalidated.
JavaTest Message: shutting down test

Comments

Changeset: 18631ef9 Author: Christoph Langer <clanger@openjdk.org> Date: 2022-10-29 12:16:51 +0000 URL: https://git.openjdk.org/jdk11u/commit/18631ef9928fe781ad5a6459642062d5f40d04cb
02-11-2022
Changeset: 18631ef9 Author: Christoph Langer <clanger@openjdk.org> Date: 2022-10-29 12:16:51 +0000 URL: https://git.openjdk.org/jdk11u-dev/commit/18631ef9928fe781ad5a6459642062d5f40d04cb
29-10-2022
Fix request (11u) The proposed fix repairs an issue that was unveiled by the backport of JDK-8274736. Suggested and reviewed by Daniel Jelinski. Tested in SAP nightlies. Risk is moderate.
26-10-2022
A pull request was submitted for review. URL: https://git.openjdk.org/jdk11u-dev/pull/1465 Date: 2022-10-19 09:48:55 +0000
19-10-2022
The SSLSessionImpl.isRejoinable (used by session.isValid) method has a TLS1.3 - related bug that was fixed in JDK-8211018; in short, TLS 1.3 sessions don't need a sessionID. Compare: https://github.com/openjdk/jdk11u-dev/blob/c1411113b396f468963a1deacc3b57ed366e735a/src/java.base/share/classes/sun/security/ssl/SSLSessionImpl.java#L385 https://github.com/openjdk/jdk/blob/4cec141a90bc5d3b8ec17c024291d9c74a112cd4/src/java.base/share/classes/sun/security/ssl/SSLSessionImpl.java#L853 Also, TLS 1.3 sessions generated by Java should have session ID. That was fixed in JDK-8277881.
11-10-2022
I do not observe any failure with Oracle JDK8u331, I tried with latest versions as well and couldn't reproduce the issue even after 100's of re-run
16-08-2022
We see the same problems in 8u331.
15-06-2022
Thanks, [~jnimeh], for looking.
02-06-2022
Hmmm, never seen this one before. It doesn't appear to be the same as JDK-8277970. There would need to be an AEADBadTagException that underlies the failure and there are parts of the stack trace that look different than what we're already tracking.
02-06-2022
Is it maybe the same issue as JDK-8277970?
02-06-2022
Re-opening. The duplicate bug was internal, this public bug can be used to track the fix instead
16-03-2022
[~pkumaraswamy] Could you please link the bug this duplicates? Otherwise closing this as a duplicate doesn't seem appropriate.
16-03-2022
Thanks!
16-03-2022
Further debugging pointing to TLS v13 handshake problem: Failed case: T13FinishedProducer.onProduceFinished(ClientHandshakeContext chc, HandshakeMessage message) { .... chc.conContext.conSession = chc.handshakeSession.finish(); <=== returns invalid session Id == [] chc.conContext.protocolVersion = chc.negotiatedProtocol; ... This is pretty much how far I can go, I will try to find a expert in this area to takeover. }
19-01-2022
java.net.SocketException: Socket closed exception is expected and intentional: The test verifies that java.net.SocketException should not invalidate SSL session. The failure case in jdk11u, I found, is due to a newly created session is INVALIDATE (sessionId == [])
18-01-2022