772213 - JSS tests are failing on Fedora 17 OpenJDK 1.7.0

Status: RESOLVED FIXED

(JSS Graveyard :: Library, defect)

Description

[Kai Engert (:KaiE:)]

============= SSL Ciphersuite JSS Server with Bypass Off and JSSE client 
 ./startJssSelfServ.sh /home/tinderbox/mozilla/security/tinderlight/data/buildnss02_trunk_32_DBG/mozilla/dist/Linux3.4_x86_glibc_PTH_DBG.OBJ/../xpclass_dbg.jar /home/tinderbox/mozilla/security/tinderlight/data/buildnss02_trunk_32_DBG/mozilla/tests_results/jss/buildnss02.localdomain.1 localhost 8577 bypassOff /usr/lib/jvm/java-1.7.0-openjdk/jre/bin/java 
/usr/lib/jvm/java-1.7.0-openjdk/jre/bin/java -classpath /home/tinderbox/mozilla/security/tinderlight/data/buildnss02_trunk_32_DBG/mozilla/dist/Linux3.4_x86_glibc_PTH_DBG.OBJ/../xpclass_dbg.jar org.mozilla.jss.tests.JSS_SelfServServer /home/tinderbox/mozilla/security/tinderlight/data/buildnss02_trunk_32_DBG/mozilla/tests_results/jss/buildnss02.localdomain.1 passwords localhost false 8577 bypassOff verboseoff &
main: jss library loaded
***FilePasswordCallback returns m1oZilla
JSS_SelfServServ localhost ready to accept connections on 8577

SSL Server is invoked using port 8577 
/usr/lib/jvm/java-1.7.0-openjdk/jre/bin/java -cp /home/tinderbox/mozilla/security/tinderlight/data/buildnss02_trunk_32_DBG/mozilla/dist/Linux3.4_x86_glibc_PTH_DBG.OBJ/../xpclass_dbg.jar org.mozilla.jss.tests.JSSE_SSLClient /home/tinderbox/mozilla/security/tinderlight/data/buildnss02_trunk_32_DBG/mozilla/tests_results/jss/buildnss02.localdomain.1 8577 localhost JSS 
using port: 8577
Testing Connection:localhost:8577
connect isBound
SSL_RSA_WITH_RC4_128_SHA
SSL_RSA_WITH_DES_CBC_SHA
SSL_RSA_EXPORT_WITH_RC4_40_MD5
SSL_RSA_WITH_NULL_MD5
TLS_RSA_WITH_AES_128_CBC_SHA
SSL_RSA_WITH_NULL_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
SSL_RSA_WITH_RC4_128_MD5
SSL_RSA_WITH_3DES_EDE_CBC_SHA

----------------------------------------------------------

JSSE has 47 ciphersuites and 13 were configured and tested.

----------------------------------------------------------

9 ciphersuites successfully connected to the server

SSL_RSA_WITH_RC4_128_SHA
SSL_RSA_WITH_DES_CBC_SHA
SSL_RSA_EXPORT_WITH_RC4_40_MD5
SSL_RSA_WITH_NULL_MD5
TLS_RSA_WITH_AES_128_CBC_SHA
SSL_RSA_WITH_NULL_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
SSL_RSA_WITH_RC4_128_MD5
SSL_RSA_WITH_3DES_EDE_CBC_SHA

----------------------------------------------------------

4 ciphersuites that did not connect to the server


TLS_RSA_WITH_NULL_SHA256
TLS_EMPTY_RENEGOTIATION_INFO_SCSV
TLS_RSA_WITH_AES_256_CBC_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA256
we should have no failed ciphersuites!
JSSTEST_CASE 25 (SSL Ciphersuite JSS Server with Bypass Off and JSSE client): FAILED return value 1



============= SSL Ciphersuite JSS Server with Bypass On and JSSE client 
 ./startJssSelfServ.sh /home/tinderbox/mozilla/security/tinderlight/data/buildnss02_trunk_32_DBG/mozilla/dist/Linux3.4_x86_glibc_PTH_DBG.OBJ/../xpclass_dbg.jar /home/tinderbox/mozilla/security/tinderlight/data/buildnss02_trunk_32_DBG/mozilla/tests_results/jss/buildnss02.localdomain.1 localhost 8578 bypass /usr/lib/jvm/java-1.7.0-openjdk/jre/bin/java 
/usr/lib/jvm/java-1.7.0-openjdk/jre/bin/java -classpath /home/tinderbox/mozilla/security/tinderlight/data/buildnss02_trunk_32_DBG/mozilla/dist/Linux3.4_x86_glibc_PTH_DBG.OBJ/../xpclass_dbg.jar org.mozilla.jss.tests.JSS_SelfServServer /home/tinderbox/mozilla/security/tinderlight/data/buildnss02_trunk_32_DBG/mozilla/tests_results/jss/buildnss02.localdomain.1 passwords localhost false 8578 bypass verboseoff &
main: jss library loaded
***FilePasswordCallback returns m1oZilla
JSS_SelfServServ localhost ready to accept connections on 8578

SSL Server is invoked using port 8578 
/usr/lib/jvm/java-1.7.0-openjdk/jre/bin/java -cp /home/tinderbox/mozilla/security/tinderlight/data/buildnss02_trunk_32_DBG/mozilla/dist/Linux3.4_x86_glibc_PTH_DBG.OBJ/../xpclass_dbg.jar org.mozilla.jss.tests.JSSE_SSLClient /home/tinderbox/mozilla/security/tinderlight/data/buildnss02_trunk_32_DBG/mozilla/tests_results/jss/buildnss02.localdomain.1 8578 localhost JSS 
using port: 8578
Testing Connection:localhost:8578
connect isBound
SSL_RSA_WITH_RC4_128_SHA
SSL_RSA_WITH_DES_CBC_SHA
SSL_RSA_EXPORT_WITH_RC4_40_MD5
SSL_RSA_WITH_NULL_MD5
TLS_RSA_WITH_AES_128_CBC_SHA
SSL_RSA_WITH_NULL_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
SSL_RSA_WITH_RC4_128_MD5
SSL_RSA_WITH_3DES_EDE_CBC_SHA

----------------------------------------------------------

JSSE has 47 ciphersuites and 13 were configured and tested.

----------------------------------------------------------

9 ciphersuites successfully connected to the server

SSL_RSA_WITH_RC4_128_SHA
SSL_RSA_WITH_DES_CBC_SHA
SSL_RSA_EXPORT_WITH_RC4_40_MD5
SSL_RSA_WITH_NULL_MD5
TLS_RSA_WITH_AES_128_CBC_SHA
SSL_RSA_WITH_NULL_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
SSL_RSA_WITH_RC4_128_MD5
SSL_RSA_WITH_3DES_EDE_CBC_SHA

----------------------------------------------------------

4 ciphersuites that did not connect to the server


TLS_RSA_WITH_NULL_SHA256
TLS_EMPTY_RENEGOTIATION_INFO_SCSV
TLS_RSA_WITH_AES_256_CBC_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA256
we should have no failed ciphersuites!
JSSTEST_CASE 26 (SSL Ciphersuite JSS Server with Bypass On and JSSE client): FAILED return value 1

Comment 1

[Kai Engert (:KaiE:)]

I performed two experiments.

I installed sun/oracle java jdk on the above machine, and reconfigured it to use that java instead of openjdk. Didn't help, still same failures.

In the second experiment I tried to run the Java tests on my local Fedora 17 machine, but not using NSS trunk, but rather NSS 3.13.x. No difference, still same failures.

This probably means, it's not a recent regression in NSS, and it's also not a problem with the JDK.

Comment 2

[Kai Engert (:KaiE:)]

We obviously must filter out (and not test) TLS_EMPTY_RENEGOTIATION_INFO_SCSV

Until bug 776597 can be implemented, in order to suppress tinderbox test failures,
I propose to also temporarily filter out (and not test)
the ciphersuites that involve SHA256.

Comment 3

[Kai Engert (:KaiE:)]

Attachment: Patch v1

With this patch the test suite succeeds.

The change to disable testing of SHA256 should be reverted in bug 776597.

Comment 4

[Robert Relyea]

Comment on attachment 644980 [details] [diff] [review]
Patch v1

r+ rrelyea.

I'm OK with you checking this in now on my review. 
I've left the review open for cfu in case she wants to weigh in.

bob

Comment 5

[Kai Engert (:KaiE:)]

Checking in JSSE_SSLClient.java;
/cvsroot/mozilla/security/jss/org/mozilla/jss/tests/JSSE_SSLClient.java,v  <--  JSSE_SSLClient.java
new revision: 1.14; previous revision: 1.13
done