Uploaded image for project: 'WildFly WIP'
  1. WildFly WIP
  2. WFWIP-335

Test SslCiphersTest.testAvailableProtocolsWithTLS13CipherSuites fails on RHEL8

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Major
    • Security
    • None
    • Hide
      1. Download OpenSSL relevant version source code https://www.openssl.org/source/old/1.1.1/
      2. Extract and run in the extracted directory: 
        ./config && make
      3. Checkout branch for following PR https://github.com/wildfly-security/wildfly-openssl/pull/81
      4. Go to the wildfly-openssl project and execute tests in question: 
        mvn install -Dmaven.javadoc.skip=true -Dcheckstyle.skip=true -Dmdep.analyze.skip=true -Dtest=SslCiphersTest* -DfailIfNoTests=false -Dorg.wildfly.openssl.path=<path_to_custom_ssl>
      Show
      Download OpenSSL relevant version source code https://www.openssl.org/source/old/1.1.1/ Extract and run in the extracted directory: ./config && make Checkout branch for following PR https://github.com/wildfly-security/wildfly-openssl/pull/81 Go to the wildfly-openssl project and execute tests in question: mvn install -Dmaven.javadoc.skip= true -Dcheckstyle.skip= true -Dmdep.analyze.skip= true -Dtest=SslCiphersTest* -DfailIfNoTests= false -Dorg.wildfly.openssl.path=<path_to_custom_ssl>

    Description

      There is failing a new test directly in your PR for 'wildfly-openssl' project - org.wildfly.openssl.SslCiphersTest.testAvailableProtocolsWithTLS13CipherSuites. I encountered this failure on RHEL8 with OpenSSL 1.1.1c installed:

      ComparisonFailure
      testAvailableProtocolsWithTLS13CipherSuites(org.wildfly.openssl.SslCiphersTest) Time elapsed: 0.112 sec <<< FAILURE!
org.junit.ComparisonFailure: expected:<TLS_[AES_256_GCM_SHA384]> but was:<TLS_[CHACHA20_POLY1305_SHA256]>
 at org.junit.Assert.assertEquals(Assert.java:123)
 at org.junit.Assert.assertEquals(Assert.java:145)
 at org.wildfly.openssl.SslCiphersTest.testAvailableProtocolsWithTLS13CipherSuites(SslCiphersTest.java:170)
 at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
 at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.base/java.lang.reflect.Method.invoke(Method.java:566)
 at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:44)
 at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:15)
 at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:41)
 at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:20)
 at org.junit.runners.BlockJUnit4ClassRunner.runNotIgnored(BlockJUnit4ClassRunner.java:79)
 at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:71)
 at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:49)
 at org.junit.runners.ParentRunner$3.run(ParentRunner.java:193)
 at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:52)
 at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:191)
 at org.junit.runners.ParentRunner.access$000(ParentRunner.java:42)
 at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:184)
 at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:28)
 at org.junit.runners.ParentRunner.run(ParentRunner.java:236)
 at org.apache.maven.surefire.junit4.JUnit4Provider.execute(JUnit4Provider.java:264)
 at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:153)
 at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:124)
 at org.apache.maven.surefire.booter.ForkedBooter.invokeProviderInSameClassLoader(ForkedBooter.java:200)
 at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:153)
 at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:103)

      After some investigation, it looks like this failure is tied with this version of OpenSSL and does not occur with newer 1.1.1g version. I also saw another failure with combination of OpenJDK 11.0.4 and OpenSSL 1.1.1c:

      different failure - API incompatibility?
      testAvailableProtocolsWithTLS13CipherSuites(org.wildfly.openssl.SslCiphersTest) Time elapsed: 0.031 sec <<< ERROR!
javax.net.ssl.SSLException: error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag
 at org.wildfly.openssl.OpenSSLEngine.handshake(OpenSSLEngine.java:1129)
 at org.wildfly.openssl.OpenSSLEngine.beginHandshakeImplicitly(OpenSSLEngine.java:1071)
 at org.wildfly.openssl.OpenSSLEngine.wrap(OpenSSLEngine.java:435)
 at java.base/javax.net.ssl.SSLEngine.wrap(SSLEngine.java:479)
 at org.wildfly.openssl.OpenSSLSocket.runHandshake(OpenSSLSocket.java:305)
 at org.wildfly.openssl.OpenSSLSocket.write(OpenSSLSocket.java:509)
 at org.wildfly.openssl.OpenSSLSocket.write(OpenSSLSocket.java:555)
 at org.wildfly.openssl.OpenSSLOutputStream.write(OpenSSLOutputStream.java:51)
 at org.wildfly.openssl.SslCiphersTest.testAvailableProtocolsWithTLS13CipherSuites(SslCiphersTest.java:159)
 at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
 at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.base/java.lang.reflect.Method.invoke(Method.java:566)
 at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:44)
 at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:15)
 at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:41)
 at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:20)
 at org.junit.runners.BlockJUnit4ClassRunner.runNotIgnored(BlockJUnit4ClassRunner.java:79)
 at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:71)
 at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:49)
 at org.junit.runners.ParentRunner$3.run(ParentRunner.java:193)
 at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:52)
 at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:191)
 at org.junit.runners.ParentRunner.access$000(ParentRunner.java:42)
 at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:184)
 at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:28)
 at org.junit.runners.ParentRunner.run(ParentRunner.java:236)
 at org.apache.maven.surefire.junit4.JUnit4Provider.execute(JUnit4Provider.java:264)
 at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:153)
 at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:124)
 at org.apache.maven.surefire.booter.ForkedBooter.invokeProviderInSameClassLoader(ForkedBooter.java:200)
 at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:153)
 at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:103)

      Here is a summary, see:

      OpenJDK 11.0.4 + OpenSSL 1.1.1c = fail - different failure - some API incompatibilty???
      OpenJDK 11.0.4 + OpenSSL 1.1.1g = pass
      OpenJDK 11.0.6 + OpenSSL 1.1.1c = ComparisonFailure as mentioned above
      OpenJDK 11.0.6 + OpenSSL 1.1.1g = pass
      OpenJDK 11.0.8 + OpenSSL 1.1.1c = ComparisonFailure as mentioned above
      OpenJDK 11.0.8 + OpenSSL 1.1.1g = pass

      Basically means that newer OpenSSL works okay. Although, this may still be problem for customers of RHEL8 until OpenSSL there is not updated.

      Not sure whether this test failure may have any real bad effect on customers, still I wanted to point this out here

      Attachments

        Issue Links

          is caused by

          Improvement - An improvement or enhancement to an existing feature or task. WFSSL-16 Add support for TLSv1.3

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Resolved

          Activity

            People

              fjuma1@redhat.com Farah Juma
              jstourac@redhat.com Jan Stourac
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: