Bug 2006366

Summary:	java-17-openjdk / rhel-8.5: NullPointerException thrown when NSSDB contains DSA key
Product:	Red Hat Enterprise Linux 8	Reporter:	zzambers
Component:	java-17-openjdk	Assignee:	Martin Balao <mbalao>
Status:	CLOSED WONTFIX	QA Contact:	OpenJDK QA <java-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.5	CC:	mbalao, sgehwolf
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-03-21 07:27:50 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description zzambers 2021-09-21 14:30:56 UTC

NullPointerException is thrown by java-17-openjdk package in FIPS mode if NSSDB contains DSA key.

Steps to reproduce using ssl-tests[1]:
cd ssl-tests
git checkout 446e6f8801b80d65499abe32ce7e77614b14e926
make clean && make TEST_PKCS11_FIPS=1 SSLTESTS_CUSTOM_JAVA_PARAMS=-Djdk.tls.ephemeralDHKeySize=2048
...
Exception in thread "main" java.lang.NullPointerException: Cannot invoke "java.security.interfaces.DSAParams.getP()" because "params" is null
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11DSAKeyFactory.implTranslatePublicKey(P11DSAKeyFactory.java:57)
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11DSAKeyFactory.engineGeneratePublic(P11DSAKeyFactory.java:109)
	at java.base/java.security.KeyFactory.generatePublic(KeyFactory.java:351)
	at java.base/sun.security.x509.X509Key.buildX509Key(X509Key.java:224)
	at java.base/sun.security.x509.X509Key.parse(X509Key.java:171)
	at java.base/sun.security.x509.CertificateX509Key.<init>(CertificateX509Key.java:75)
	at java.base/sun.security.x509.X509CertInfo.parse(X509CertInfo.java:674)
	at java.base/sun.security.x509.X509CertInfo.<init>(X509CertInfo.java:169)
	at java.base/sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1791)
	at java.base/sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:183)
	at java.base/sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:105)
	at java.base/java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:355)
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.loadCert(P11KeyStore.java:1195)
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.mapLabels(P11KeyStore.java:2359)
	at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.engineLoad(P11KeyStore.java:771)
	at java.base/java.security.KeyStore.load(KeyStore.java:1473)
	at SSLSocketTester.loadKeystore(SSLSocketTester.java:151)
	at SSLSocketTester.getKeyManagers(SSLSocketTester.java:123)
	at SSLSocketTester.init(SSLSocketTester.java:89)
	at Main.main(Main.java:29)

Openjdk build:
java-17-openjdk-devel-17.0.0.0.33-0.5.ea.el8


Additional info:
This was introduced by patch, which disables non-fips crypto from SUN and SunEC providers [2].

[1] https://github.com/zzambers/ssl-tests
[2] http://pkgs.devel.redhat.com/cgit/rpms/java-17-openjdk/commit/?h=rhel-8.5.0&id=526f27daaeed6c737f91315386efa5ab368696a6

Comment 6 RHEL Program Management 2023-03-21 07:27:50 UTC

After evaluating this issue, there are no plans to address it further or fix it in an upcoming release.  Therefore, it is being closed.  If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.