NSS configuration & plugin interaction

Matthias Klose doko at ubuntu.com
Tue Apr 6 18:44:55 PDT 2010 

this is about 461 and 469; when icedtea is configured with --enable-nss, just an 
additional security provider is added in java.security, the code currently in 
icedtea isn't changed, so the behaviour should be reproducible on systems which 
have the required nss available.

visiting the page mentioned in 461 with the 
security.provider.9=sun.security.pkcs11.SunPKCS11 
${java.home}/lib/security/nss.cfg enabled in java.policy, I get the stack trace 
in [1] after closing the page, the java process icedteanp-appletviewer-to-plugin 
sleeps (ignoring the Unimplemented messages at the end).

with security.provider.9 commented out, I see the stacktrace in [2]. closing the 
page with the applet lets the icedteanp-appletviewer-to-plugin process sleep.

with security.provider.9 commented out and the nss.cfg file missing (that is the 
default when configuring without NSS, and running on a system having NSS) you 
see the stacktrace as in [2], but the icedteanp-appletviewer-to-plugin process 
now uses 100% cpu and doesn't terminate even after closing the page with the applet.

As a minimum patch, we should always install the nss.cfg file, or revert the 
(upstream?) NSS patch when not configuring with --enable-nss.

Would like to hear if this behaviour can be reproduced.

   Matthias


[1]
$ firefox 2>&1 | tee firefox.log2
Looking for 0xb0cf570c 0xab6effb0 0xb5bdcbcc (document)
java version "1.6.0_18"
OpenJDK Runtime Environment (IcedTea6 1.8) (6b18~pre4-1ubuntu3)
OpenJDK Server VM (build 16.0-b13, mixed mode)
java.security.ProviderException: Could not initialize NSS
	at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:201)
	at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:103)
	at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
	at 
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
	at 
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.lang.reflect.Constructor.newInstance(Constructor.java:532)
	at sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:262)
	at sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:244)
	at java.security.AccessController.doPrivileged(Native Method)
	at sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:244)
	at sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:224)
	at sun.security.jca.ProviderList.getProvider(ProviderList.java:232)
	at sun.security.jca.ProviderList.getService(ProviderList.java:330)
	at sun.security.jca.GetInstance.getInstance(GetInstance.java:157)
	at java.security.Security.getImpl(Security.java:696)
	at java.security.AlgorithmParameters.getInstance(AlgorithmParameters.java:130)
	at sun.security.x509.AlgorithmId.decodeParams(AlgorithmId.java:121)
	at sun.security.x509.AlgorithmId.<init>(AlgorithmId.java:114)
	at sun.security.x509.AlgorithmId.parse(AlgorithmId.java:381)
	at sun.security.x509.X509Key.parse(X509Key.java:168)
	at sun.security.x509.CertificateX509Key.<init>(CertificateX509Key.java:75)
	at sun.security.x509.X509CertInfo.parse(X509CertInfo.java:705)
	at sun.security.x509.X509CertInfo.<init>(X509CertInfo.java:169)
	at sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1747)
	at sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:196)
	at 
sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:107)
	at 
java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:322)
	at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:763)
	at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:55)
	at java.security.KeyStore.load(KeyStore.java:1201)
	at 
sun.security.ssl.TrustManagerFactoryImpl.getCacertsKeyStore(TrustManagerFactoryImpl.java:221)
	at 
sun.security.ssl.TrustManagerFactoryImpl.engineInit(TrustManagerFactoryImpl.java:51)
	at javax.net.ssl.TrustManagerFactory.init(TrustManagerFactory.java:247)
	at 
net.sourceforge.jnlp.security.VariableX509TrustManager.<init>(VariableX509TrustManager.java:100)
	at 
net.sourceforge.jnlp.security.VariableX509TrustManager.getInstance(VariableX509TrustManager.java:282)
	at sun.applet.PluginMain.init(PluginMain.java:217)
	at sun.applet.PluginMain.<init>(PluginMain.java:147)
	at sun.applet.PluginMain.main(PluginMain.java:116)
Caused by: java.io.IOException: An incompatible version of NSS is already 
loaded, 3.7 or later required
	at sun.security.pkcs11.Secmod.isInitialized(Secmod.java:130)
	at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:168)
	... 37 more
java.lang.InterruptedException: sleep interrupted
	at java.lang.Thread.sleep(Native Method)
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:629)
	at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:270)
	at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
java.lang.InterruptedException: sleep interrupted
	at java.lang.Thread.sleep(Native Method)
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:674)
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:649)
	at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:270)
	at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
java.lang.InterruptedException: sleep interrupted
	at java.lang.Thread.sleep(Native Method)
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:747)
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:649)
	at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:270)
	at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
java.lang.ArrayIndexOutOfBoundsException: 5
	at sun.applet.PluginProxyInfoRequest.parseReturn(PluginProxyInfoRequest.java:65)
	at sun.applet.PluginStreamHandler.finishCallRequest(PluginStreamHandler.java:338)
	at sun.applet.PluginStreamHandler.handlePluginMessage(PluginStreamHandler.java:287)
	at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:208)
	at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
Download error: 
/home/doko/.icedteaplugin/cache/http/www.slu.edu/classes/maymk/GeoGebra/geogebra_main.jar 
(No such file or directory)
Download error: jarFile not found: 1
java.lang.ArrayIndexOutOfBoundsException: 5
	at sun.applet.PluginProxyInfoRequest.parseReturn(PluginProxyInfoRequest.java:65)
	at sun.applet.PluginStreamHandler.finishCallRequest(PluginStreamHandler.java:338)
	at sun.applet.PluginStreamHandler.handlePluginMessage(PluginStreamHandler.java:287)
	at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:208)
	at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
Exception in thread "Thread-12" java.lang.NoClassDefFoundError: geogebra/e/m
	at geogebra.GeoGebraApplet.a(Unknown Source)
	at geogebra.GeoGebraApplet.a(Unknown Source)
	at geogebra.GeoGebraApplet.a(Unknown Source)
	at geogebra.f.run(Unknown Source)
** Unimplemented: IcedTeaScriptableJavaObject::invalidate 0xa7779fe0
** Unimplemented: IcedTeaScriptableJavaObject::deAllocate 0xa7779fe0


[2]
$ firefox 2>&1 | tee firefox.log3
Looking for 0xa73b348c 0xa6fd09e0 0xb5adcbcc (document)
java version "1.6.0_18"
OpenJDK Runtime Environment (IcedTea6 1.8) (6b18~pre4-1ubuntu3)
OpenJDK Server VM (build 16.0-b13, mixed mode)
java.lang.InterruptedException: sleep interrupted
	at java.lang.Thread.sleep(Native Method)
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:735)
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:649)
	at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:270)
	at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
java.lang.InterruptedException: sleep interrupted
	at java.lang.Thread.sleep(Native Method)
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:674)
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:649)
	at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:270)
	at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
java.lang.InterruptedException: sleep interrupted
	at java.lang.Thread.sleep(Native Method)
	at sun.applet.PluginAppletViewer.handleMessage(PluginAppletViewer.java:629)
	at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:270)
	at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
java.lang.ArrayIndexOutOfBoundsException: 5
	at sun.applet.PluginProxyInfoRequest.parseReturn(PluginProxyInfoRequest.java:65)
	at sun.applet.PluginStreamHandler.finishCallRequest(PluginStreamHandler.java:338)
	at sun.applet.PluginStreamHandler.handlePluginMessage(PluginStreamHandler.java:287)
	at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:208)
	at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
Download error: 
/home/doko/.icedteaplugin/cache/http/www.slu.edu/classes/maymk/GeoGebra/geogebra_main.jar 
(No such file or directory)
Download error: jarFile not found: 1
java.lang.ArrayIndexOutOfBoundsException: 5
	at sun.applet.PluginProxyInfoRequest.parseReturn(PluginProxyInfoRequest.java:65)
	at sun.applet.PluginStreamHandler.finishCallRequest(PluginStreamHandler.java:338)
	at sun.applet.PluginStreamHandler.handlePluginMessage(PluginStreamHandler.java:287)
	at sun.applet.PluginStreamHandler.handleMessage(PluginStreamHandler.java:208)
	at sun.applet.PluginMessageHandlerWorker.run(PluginMessageHandlerWorker.java:82)
Exception in thread "Thread-12" java.lang.NoClassDefFoundError: geogebra/e/m
	at geogebra.GeoGebraApplet.a(Unknown Source)
	at geogebra.GeoGebraApplet.a(Unknown Source)
	at geogebra.GeoGebraApplet.a(Unknown Source)
	at geogebra.f.run(Unknown Source)

More information about the distro-pkg-dev mailing list