Uploaded image for project: 'WildFly WIP'
  1. WildFly WIP
  2. WFWIP-335

Test SslCiphersTest.testAvailableProtocolsWithTLS13CipherSuites fails on RHEL8

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Major Major
    • Security
    • None
    • Hide
      1. Download OpenSSL relevant version source code https://www.openssl.org/source/old/1.1.1/
      2. Extract and run in the extracted directory: 
        ./config && make
      3. Checkout branch for following PR https://github.com/wildfly-security/wildfly-openssl/pull/81
      4. Go to the wildfly-openssl project and execute tests in question: 
        mvn install -Dmaven.javadoc.skip=true -Dcheckstyle.skip=true -Dmdep.analyze.skip=true -Dtest=SslCiphersTest* -DfailIfNoTests=false -Dorg.wildfly.openssl.path=<path_to_custom_ssl>
      Show
      Download OpenSSL relevant version source code https://www.openssl.org/source/old/1.1.1/ Extract and run in the extracted directory: ./config && make Checkout branch for following PR https://github.com/wildfly-security/wildfly-openssl/pull/81 Go to the wildfly-openssl project and execute tests in question: mvn install -Dmaven.javadoc.skip= true -Dcheckstyle.skip= true -Dmdep.analyze.skip= true -Dtest=SslCiphersTest* -DfailIfNoTests= false -Dorg.wildfly.openssl.path=<path_to_custom_ssl>

      There is failing a new test directly in your PR for 'wildfly-openssl' project - org.wildfly.openssl.SslCiphersTest.testAvailableProtocolsWithTLS13CipherSuites. I encountered this failure on RHEL8 with OpenSSL 1.1.1c installed:

      ComparisonFailure
      testAvailableProtocolsWithTLS13CipherSuites(org.wildfly.openssl.SslCiphersTest) Time elapsed: 0.112 sec <<< FAILURE!
org.junit.ComparisonFailure: expected:<TLS_[AES_256_GCM_SHA384]> but was:<TLS_[CHACHA20_POLY1305_SHA256]>
 at org.junit.Assert.assertEquals(Assert.java:123)
 at org.junit.Assert.assertEquals(Assert.java:145)
 at org.wildfly.openssl.SslCiphersTest.testAvailableProtocolsWithTLS13CipherSuites(SslCiphersTest.java:170)
 at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
 at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.base/java.lang.reflect.Method.invoke(Method.java:566)
 at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:44)
 at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:15)
 at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:41)
 at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:20)
 at org.junit.runners.BlockJUnit4ClassRunner.runNotIgnored(BlockJUnit4ClassRunner.java:79)
 at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:71)
 at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:49)
 at org.junit.runners.ParentRunner$3.run(ParentRunner.java:193)
 at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:52)
 at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:191)
 at org.junit.runners.ParentRunner.access$000(ParentRunner.java:42)
 at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:184)
 at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:28)
 at org.junit.runners.ParentRunner.run(ParentRunner.java:236)
 at org.apache.maven.surefire.junit4.JUnit4Provider.execute(JUnit4Provider.java:264)
 at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:153)
 at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:124)
 at org.apache.maven.surefire.booter.ForkedBooter.invokeProviderInSameClassLoader(ForkedBooter.java:200)
 at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:153)
 at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:103)

      After some investigation, it looks like this failure is tied with this version of OpenSSL and does not occur with newer 1.1.1g version. I also saw another failure with combination of OpenJDK 11.0.4 and OpenSSL 1.1.1c:

      different failure - API incompatibility?
      testAvailableProtocolsWithTLS13CipherSuites(org.wildfly.openssl.SslCiphersTest) Time elapsed: 0.031 sec <<< ERROR!
javax.net.ssl.SSLException: error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag
 at org.wildfly.openssl.OpenSSLEngine.handshake(OpenSSLEngine.java:1129)
 at org.wildfly.openssl.OpenSSLEngine.beginHandshakeImplicitly(OpenSSLEngine.java:1071)
 at org.wildfly.openssl.OpenSSLEngine.wrap(OpenSSLEngine.java:435)
 at java.base/javax.net.ssl.SSLEngine.wrap(SSLEngine.java:479)
 at org.wildfly.openssl.OpenSSLSocket.runHandshake(OpenSSLSocket.java:305)
 at org.wildfly.openssl.OpenSSLSocket.write(OpenSSLSocket.java:509)
 at org.wildfly.openssl.OpenSSLSocket.write(OpenSSLSocket.java:555)
 at org.wildfly.openssl.OpenSSLOutputStream.write(OpenSSLOutputStream.java:51)
 at org.wildfly.openssl.SslCiphersTest.testAvailableProtocolsWithTLS13CipherSuites(SslCiphersTest.java:159)
 at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
 at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.base/java.lang.reflect.Method.invoke(Method.java:566)
 at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:44)
 at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:15)
 at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:41)
 at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:20)
 at org.junit.runners.BlockJUnit4ClassRunner.runNotIgnored(BlockJUnit4ClassRunner.java:79)
 at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:71)
 at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:49)
 at org.junit.runners.ParentRunner$3.run(ParentRunner.java:193)
 at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:52)
 at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:191)
 at org.junit.runners.ParentRunner.access$000(ParentRunner.java:42)
 at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:184)
 at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:28)
 at org.junit.runners.ParentRunner.run(ParentRunner.java:236)
 at org.apache.maven.surefire.junit4.JUnit4Provider.execute(JUnit4Provider.java:264)
 at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:153)
 at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:124)
 at org.apache.maven.surefire.booter.ForkedBooter.invokeProviderInSameClassLoader(ForkedBooter.java:200)
 at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:153)
 at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:103)

      Here is a summary, see:

      OpenJDK 11.0.4 + OpenSSL 1.1.1c = fail - different failure - some API incompatibilty???
      OpenJDK 11.0.4 + OpenSSL 1.1.1g = pass
      OpenJDK 11.0.6 + OpenSSL 1.1.1c = ComparisonFailure as mentioned above
      OpenJDK 11.0.6 + OpenSSL 1.1.1g = pass
      OpenJDK 11.0.8 + OpenSSL 1.1.1c = ComparisonFailure as mentioned above
      OpenJDK 11.0.8 + OpenSSL 1.1.1g = pass

      Basically means that newer OpenSSL works okay. Although, this may still be problem for customers of RHEL8 until OpenSSL there is not updated.

      Not sure whether this test failure may have any real bad effect on customers, still I wanted to point this out here

              fjuma1@redhat.com Farah Juma
              jstourac@redhat.com Jan Stourac
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: