Bug ID: JDK-8296631 NSS tests failing on OL9 linux-aarch64 hosts

JDK-8296631 : NSS tests failing on OL9 linux-aarch64 hosts

Type: Bug
Component: security-libs
Sub-Component: java.security
Affected Version: 8,11,17,21,22

Priority: P3
Status: Resolved
Resolution: Fixed

Submitted: 2022-11-09
Updated: 2025-05-19
Resolved: 2023-10-02

Versions (Unresolved/Resolved/Fixed)

The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.

JDK 11	JDK 17	JDK 21	JDK 22
11.0.28Fixed	17.0.11-oracleFixed	21.0.3-oracleFixed	22 b18Fixed

Related Reports

Relates :

JDK-8232153 - sun/security/pkcs11/Secmod/AddTrustedCert.java failed with Linux built-in NSS libs

Sub Tasks

JDK-8296675 :	Exclude linux-aarch64 in NSS tests - Resolved
JDK-8304322 :	ProblemList sun/security/pkcs11 testcases - Resolved

Description

The tests look for NSS libraries on paths described in PKCS11Test.java, i.e.

        osMap.put("Linux-aarch64-64", new String[] {
                "/usr/lib/aarch64-linux-gnu/",
                "/usr/lib/aarch64-linux-gnu/nss/",
                "/usr/lib64/" });

On OL8, not found. It can only pass without doing anything.

On OL9, found. The tests go on and fail with

java.io.IOException: load failed
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.engineLoad(P11KeyStore.java:778)
	at java.base/java.security.KeyStore.load(KeyStore.java:1500)
	at java.base/sun.security.tools.keytool.Main.doCommands(Main.java:1016)
	at java.base/sun.security.tools.keytool.Main.run(Main.java:419)
	at java.base/sun.security.tools.keytool.Main.main(Main.java:412)
	at KeyToolTest.test(KeyToolTest.java:173)
	at KeyToolTest.test(KeyToolTest.java:141)
	at KeyToolTest.testOK(KeyToolTest.java:196)
	at KeyToolTest.testPKCS11(KeyToolTest.java:687)
	at KeyToolTest.main(KeyToolTest.java:1841)
	at NssTest.main(NssTest.java:52)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
	at java.base/java.lang.reflect.Method.invoke(Method.java:578)
	at com.sun.javatest.regtest.agent.MainWrapper$MainThread.run(MainWrapper.java:125)
	at java.base/java.lang.Thread.run(Thread.java:1591)
Caused by: javax.security.auth.login.LoginException
	at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.login(SunPKCS11.java:1541)
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.login(P11KeyStore.java:878)
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.engineLoad(P11KeyStore.java:765)
	... 14 more
Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_USER_TYPE_INVALID
	at jdk.crypto.cryptoki/sun.security.pkcs11.wrapper.PKCS11.C_Login(Native Method)
	at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.login(SunPKCS11.java:1524)
	... 16 more

Comments

[jdk8u-fix-request] Approval Request from Taizo Kurashige Backporting this patch resolves NSS tests failure. Original patch does not apply cleanly because some code does not exist in jdk8. Test-only fix, low risk. Pkcs11 tests on RHEL9 and GHA pass.
15-05-2025
A pull request was submitted for review. Branch: master URL: https://git.openjdk.org/jdk8u-dev/pull/654 Date: 2025-05-14 08:42:55 +0000
14-05-2025
[jdk11u-fix-request] Approval Request from Taizo Kurashige Backporting this patch resolves NSS tests failure. Original patch does not apply cleanly because some code does not exist in jdk11 and some code exists just in jdk11. Test-only fix, low risk. Pkcs11 tests on RHEL9 and GHA pass.
06-11-2024
A pull request was submitted for review. Branch: master URL: https://git.openjdk.org/jdk11u-dev/pull/2955 Date: 2024-10-17 05:35:25 +0000
17-10-2024
Fix request [17u] I backport this for parity with 17.0.11-oracle. No risk, only a test change. Clean backport. Pkcs11 tests pass.
23-01-2024
A pull request was submitted for review. URL: https://git.openjdk.org/jdk17u-dev/pull/2170 Date: 2024-01-23 15:21:27 +0000
23-01-2024
Fix request [21u] I backport this for parity with 21.0.3-oracle. No risk, only a test change. Clean backport. Pkcs11 tests pass.
03-01-2024
A pull request was submitted for review. URL: https://git.openjdk.org/jdk21u-dev/pull/114 Date: 2024-01-03 08:18:23 +0000
03-01-2024
Changeset: 6e1aacdf Author: Mark Powers <mpowers@openjdk.org> Committer: Valerie Peng <valeriep@openjdk.org> Date: 2023-10-02 22:43:48 +0000 URL: https://git.openjdk.org/jdk/commit/6e1aacdfba5a32f7b071eea8039888d275827e83
02-10-2023
A pull request was submitted for review. URL: https://git.openjdk.org/jdk/pull/15644 Date: 2023-09-08 19:41:47 +0000
08-09-2023
It's not your fault. I was tracking this bug since I ran into it during one of my GK sweeps and I misunderstood the solution.
08-09-2023
I plan to create a PR this afternoon. Sorry for the confusion.
08-09-2023
I may have misunderstood. I didn't think there was a code fix. I thought this was resolved by making sure that various test machines had the proper libraries installed. Update: I didn't think there was a code fix because there's no PR link.
08-09-2023
JDK 8u ProblemList will be updated when fix is backported to JDK 8u.
08-09-2023
In the first sub-task, a change was made to open/test/jdk/sun/security/pkcs11/PKCS11Test.java to prevent the test from running. I reverted that change. The second subtask refers, to a ProblemList in jdk8u. I'll ask someone in my group about how to proceed since I'm not familiar with this part of the process.
08-09-2023
Please find the details in the two sub-tasks.
08-09-2023
I don't see this bug in open/test/jdk/ProblemList.txt. Is there anotherProblemsList?
08-09-2023
Are you planning to use this bug to remove tests from the ProblemList?
08-09-2023
Down to 0 failures. My work is done.
08-09-2023
I tested the fix on phoenix-1 - "Oracle Linux Server release 7.9" x86 with NSS version 3.531. JDK-8232153 passes.
28-08-2023
I'll test my fix on x86 and see if it fixes JDK-8232153. I've not seen the CKR_ATTRIBUTE_READ_ONLY failure reported by JDK-8232153. I recall seeing a NSS initialization failure instead.
28-08-2023
[~mpowers] JDK-8232153 looks to be duplicate of this bug. Can you please check so JDK-8232153 can be closed with this fix?
25-08-2023
The default database for Red Hat Linux and its derivatives, which includes Oracle Linux, has been changed to SQLite. The tests need to be modified to use this database instead of the Berkley DB.
23-08-2023
Filed Linux bug: 35729140 - /usr/lib64/libnssdbm3.so is missing from the installation image.
21-08-2023
OL9 is missing libnssdbm3.so. How did that happen?
21-08-2023
The reported issue is observed in Solaris Sparc machine as well with JDK11u hence updating the affected version
11-04-2023