Update the ProblemList-fips for JDK17 for FIPS extended.openjdk and s…

[WilburZjh]

…anity.openjdk test

Signed-off-by: Jinhang Zhang [email protected]

[WilburZjh]

There are 4 specific providers in FIPS mode, some tests using other non-FIPS providers, like SunJCE or SunRsaSign, etc. will be failed. Those failed tests should be added to a ProblemList-fips.txt, then they will not be run in the FIPS mode testing. Problem list details can be found from the issue #116

[WilburZjh]

@alon-sh @llxia

[llxia]

@alon-sh could you please review the PR? Thanks

[alon-sh]

Questions:
for these

Non-Approved mode in FIPS mode

com/sun/crypto/provider/Cipher/AEAD/GCMBufferTest.java #116 linux-x64
com/sun/crypto/provider/Cipher/AEAD/GCMShortBuffer.java #116 linux-x64
com/sun/crypto/provider/Cipher/AEAD/OverlapByteBuffer.java #116 linux-x64

even tho. AES-GCM is not FIPS certified - we should still fix any functional issues.

for these

P11Signature Unknown mechanism

java/security/Signature/SignatureLength.java #116 linux-x64
java/security/Provider/NewInstance.java #116 linux-x64

No cipher suites in common

com/sun/jndi/ldap/LdapCBPropertiesTest.java #116 linux-x64

explain what is the problem.

lines 534 - 537 are duplicates.

these:

MessageDigest, Signature Engines are not supported in FIPS mode

java/security/MessageDigest/TestCloneable.java #116 linux-x64
java/security/Signature/TestCloneable.java #116 linux-x64

MessageDigest and Signature are supported in FIPS mode - please explain what is the problem.

these:

Related to CKR_ENCRYPTED_DATA_LEN_RANGE

javax/crypto/CipherSpi/ResetByteBuffer.java.ResetByteBuffer #116 linux-x64

explain what is the problem. I believe Bruce already looked at this issue - just give more info.

@WilburZjh @llxia

[WilburZjh]

java/security/Provider/NewInstance.java 116 linux-x64
This failure is caused by NoSuchAlgorithmException: SHA3-224 MessageDigest not available. Because SunPKCS11 not support SHA3-224 MessageDigest, so this is added to the excludedlist.

com/sun/jndi/ldap/LdapCBPropertiesTest.java 116 linux-x64
This failure is caused by using GSSAPI as SECURITY_AUTHENTICATION. But GSSAPI is supported by JdkSASL which is not supported under FIPS mode. So this is added to the excludedlist.

java/security/MessageDigest/TestCloneable.java 116 linux-x64
java/security/Signature/TestCloneable.java 116 linux-x64
This failure is caused by explicitly initializing the name of provider as Sun, SunEC, SunRsaSign, SunMSCAPI in the tests. MessageDigest and Signature engines are disabled in Sun and SunEC providers when FIPS is enabled. SunRsaSign and SunMSCAPI providers are disabled when FIPS is enabled.

[WilburZjh]

javax/crypto/CipherSpi/ResetByteBuffer.java.ResetByteBuffer 116 linux-x64
Based on this docs, CKR_ENCRYPTED_DATA_LEN_RANGE: The ciphertext input to a decryption operation has been determined to be invalid ciphertext solely on the basis of its length. Depending on the operation’s mechanism, this could mean that the ciphertext is too short, too long, or is not a multiple of some particular block size. For this test case, the ciphertext input is not a multiple of 16 for AES. So, the CKR_ENCRYPTED_DATA_LEN_RANGE will be returned.

[alon-sh]

@taoliult please comment on the issue above, I think you worked on it.

[alon-sh]

@WilburZjh please update the excluded test list with the explanations you have above. Also why is java/security/Signature/SignatureLength.java excluded?

[WilburZjh]

I removed the SignatureLength.java from the excluded list, it needs to be investigated in detail.

[WilburZjh]

The failures for AES-GCM are also removed from this excluded list, and an issue is created for these failures. These failures are related to the P11Cipher. Need to be investigated later in detail.

[taoliult]

@alon-sh @WilburZjh

For the test “javax/crypto/CipherSpi/ResetByteBuffer.java.ResetByteBuffer”

The issue failed at the codes “ c.update(in, out); ”. The exception is

“Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_ENCRYPTED_DATA_LEN_RANGE”

From the P11Cipher code line 191, when the cipher algorithm start with “AES”, then the “blockSize = 16;”. And for the “ c.update(in, out);” method, when the cipher is in the Cipher.DECRYPT_MODE, and if the “in.limit” is not set as multiple of 16, then CKR_ENCRYPTED_DATA_LEN_RANGE exception will be thrown from P11Cipher.

In the “ResetByteBuffer” test, the data length is 1500, then data.length / 2 is 750, which is not the multiple of 16, so the exception happens.

From the latest PKCS#11 Cryptographic Token Interface Base Specification Version 3.0

https://docs.oasis-open.org/pkcs11/pkcs11-base/v3.0/os/pkcs11-base-v3.0-os.html

It explained this error. CKR_ENCRYPTED_DATA_LEN_RANGE: The ciphertext input to a decryption operation has been determined to be invalid ciphertext solely on the basis of its length. Depending on the operation’s mechanism, this could mean that the ciphertext is too short, too long, or is not a multiple of some particular block size.

For this test case, the ciphertext input is not a multiple of some particular block size. So, the CKR_ENCRYPTED_DATA_LEN_RANGE will be returned, from methods C_Decrypt, C_DecryptUpdate, C_DecryptFinal, and other decrypt methods.

The PKCS11 spec defined this ciphertext input check, and the test case is not design for the P11Cipher, so we can add this test into the exclude list.

[alon-sh]

thank you - @WilburZjh please add a two sentence summary of what Bruce mentioned to the test list regarding that one failing test.

Once thats done, looks good it can be merged.

[WilburZjh]

Updated in the ProblemList-fips.txt file.

[pshipton]

Pls fix the trailing whitespace so the check can pass.

17:37:56  test/jdk/ProblemList-fips.txt:541: trailing whitespace.
17:37:56  +# The PKCS11 spec defined this ciphertext input check. 

[WilburZjh]

updated

[pshipton]

Merging after Alon's review.

[pshipton]

sanity.openjdk passsed.
extended.openjdk is still running, but there seems to be quite a few failures. Will update when it's completed.
Update: 1018 failures.

[alon-sh]

looking at extended.openjdk - looks like some of those failures should have been put on the exclusion list - e.g. all the failures the say java.security.KeyStoreException: JKS not found

@WilburZjh are we missing some exclusion lists? see https://hyc-runtimes-jenkins.swg-devops.com/job/Test_openjdk17_j9_extended.openjdk_x86-64_linux_fips/7/consoleText

looks like mostly failures of tests that should be excluded.

fyi @llxia @Mesbah-Alam

[WilburZjh]

An update, here is the PR.

[pshipton]

Running extended.openjdk with the updated exclude list.

[pshipton]

Last grinder has 13 + 91 + 90 = 194 failures.

[alon-sh]

@WilburZjh please look at those additional failures and create another problem exclusion list.

@taoliult FYI please assist @WilburZjh