/!\ Sun java 1.6.0_41 -> Caused by: javax.crypto.BadPaddingException: ciphertext sanity check failed

[jrevillard]

Dear all,

I just found a problem using the Sun java version 1.6.0_41 (Linux version): java version "1.6.0_41" Java(TM) SE Runtime Environment (build 1.6.0_41-b02) Java HotSpot(TM) 64-Bit Server VM (build 20.14-b01, mixed mode)

Using this java version, the Unit tests fails (all the branches are concerned) withthis error message:

Running org.globus.gsi.gssapi.jaas.GlobusSubjectTest Tests run: 4, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.045 sec Running org.globus.gsi.gssapi.test.GlobusGSSNameTest Tests run: 8, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.978 sec Running org.globus.gsi.gssapi.test.GlobusGSSCredentialTest Tests run: 5, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 1.717 sec Running org.globus.gsi.gssapi.test.GlobusGSSContextTest [main] ERROR trustmanager.PKITrustManager - Pathvalidation failed java.security.cert.CertPathValidatorException: Limited proxy not accepted at org.globus.gsi.trustmanager.IdentityChecker.invoke(IdentityChecker.java:52) at org.globus.gsi.trustmanager.X509ProxyCertPathValidator.checkCertificate(X509ProxyCertPathValidator.java:402) at org.globus.gsi.trustmanager.X509ProxyCertPathValidator.validate(X509ProxyCertPathValidator.java:165) at org.globus.gsi.trustmanager.X509ProxyCertPathValidator.engineValidate(X509ProxyCertPathValidator.java:107) at org.globus.gsi.trustmanager.PKITrustManager.checkClientTrusted(PKITrustManager.java:90) at com.sun.net.ssl.internal.ssl.ServerHandshaker.clientCertificate(ServerHandshaker.java:1411) at com.sun.net.ssl.internal.ssl.ServerHandshaker.processMessage(ServerHandshaker.java:160) at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593) at com.sun.net.ssl.internal.ssl.Handshaker$1.run(Handshaker.java:533) at java.security.AccessController.doPrivileged(Native Method) at com.sun.net.ssl.internal.ssl.Handshaker$DelegatedTask.run(Handshaker.java:952) at org.globus.gsi.gssapi.GlobusGSSContextImpl.runDelegatedTasks(GlobusGSSContextImpl.java:343) at org.globus.gsi.gssapi.GlobusGSSContextImpl.sslProcessHandshake(GlobusGSSContextImpl.java:846) at org.globus.gsi.gssapi.GlobusGSSContextImpl.acceptSecContext(GlobusGSSContextImpl.java:473) at org.globus.gsi.gssapi.test.GlobusGSSContextTest.establishContext(GlobusGSSContextTest.java:142) at org.globus.gsi.gssapi.test.GlobusGSSContextTest.testLimitedProxyChecking(GlobusGSSContextTest.java:466) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at junit.framework.TestCase.runTest(TestCase.java:168) at junit.framework.TestCase.runBare(TestCase.java:134) at junit.framework.TestResult$1.protect(TestResult.java:110) at junit.framework.TestResult.runProtected(TestResult.java:128) at junit.framework.TestResult.run(TestResult.java:113) at junit.framework.TestCase.run(TestCase.java:124) at junit.framework.TestSuite.runTest(TestSuite.java:232) at junit.framework.TestSuite.run(TestSuite.java:227) at org.junit.internal.runners.JUnit38ClassRunner.run(JUnit38ClassRunner.java:83) at org.apache.maven.surefire.junit4.JUnit4TestSet.execute(JUnit4TestSet.java:53) at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:123) at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:104) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at org.apache.maven.surefire.util.ReflectionUtils.invokeMethodWithArray(ReflectionUtils.java:164) at org.apache.maven.surefire.booter.ProviderFactory$ProviderProxy.invoke(ProviderFactory.java:110) at org.apache.maven.surefire.booter.SurefireStarter.invokeProvider(SurefireStarter.java:175) at org.apache.maven.surefire.booter.SurefireStarter.runSuitesInProcessWhenForked(SurefireStarter.java:107) at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:68) Failure unspecified at GSS-API level. Caused by javax.net.ssl.SSLException: ciphertext sanity check failed at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:190) at com.sun.net.ssl.internal.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1508) at com.sun.net.ssl.internal.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:921) at com.sun.net.ssl.internal.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:845) at com.sun.net.ssl.internal.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:721) at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:607) at org.globus.gsi.gssapi.GlobusGSSContextImpl.sslDataUnwrap(GlobusGSSContextImpl.java:759) at org.globus.gsi.gssapi.GlobusGSSContextImpl.unwrap(GlobusGSSContextImpl.java:1659) at org.globus.gsi.gssapi.GlobusGSSContextImpl.unwrap(GlobusGSSContextImpl.java:1596) at org.globus.gsi.gssapi.test.GlobusGSSContextTest.testBadUnwrap3(GlobusGSSContextTest.java:1003) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at junit.framework.TestCase.runTest(TestCase.java:168) at junit.framework.TestCase.runBare(TestCase.java:134) at junit.framework.TestResult$1.protect(TestResult.java:110) at junit.framework.TestResult.runProtected(TestResult.java:128) at junit.framework.TestResult.run(TestResult.java:113) at junit.framework.TestCase.run(TestCase.java:124) at junit.framework.TestSuite.runTest(TestSuite.java:232) at junit.framework.TestSuite.run(TestSuite.java:227) at org.junit.internal.runners.JUnit38ClassRunner.run(JUnit38ClassRunner.java:83) at org.apache.maven.surefire.junit4.JUnit4TestSet.execute(JUnit4TestSet.java:53) at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:123) at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:104) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at org.apache.maven.surefire.util.ReflectionUtils.invokeMethodWithArray(ReflectionUtils.java:164) at org.apache.maven.surefire.booter.ProviderFactory$ProviderProxy.invoke(ProviderFactory.java:110) at org.apache.maven.surefire.booter.SurefireStarter.invokeProvider(SurefireStarter.java:175) at org.apache.maven.surefire.booter.SurefireStarter.runSuitesInProcessWhenForked(SurefireStarter.java:107) at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:68) Caused by: javax.crypto.BadPaddingException: ciphertext sanity check failed at com.sun.net.ssl.internal.ssl.EngineInputRecord.decrypt(EngineInputRecord.java:183) at com.sun.net.ssl.internal.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:914) ... 32 more Tests run: 25, Failures: 1, Errors: 0, Skipped: 0, Time elapsed: 22.664 sec <<< FAILURE!

Using OpenJDK 1.6.0_27 it works, also using the Sun version 1.6.0_37 and I did not test other versions.

I do not know if it's a Java bug or a JGlobus one.

Best, Jerome

[kofemann]

Hi Jerome,

could you check this fix which we have integrated into dCache branch:

https://github.com/dCache/JGlobus/commit/da69970196c15c975dd97c93036c8f672ddff405

Tigran.

[jrevillard]

Hi Tigran,

Yes your patch solve the issue and should be integrated into the different branches I think.

Thanks a lot, Best, Jerome

[kofemann]

Hi Jerome,

I have merged the fix into master, v2.0 and v2.0.5 branches.

Tigran.