[rfc][icedtea-web] run on any open/oracle jdk (and ibm jdk!)

Jiri Vanek jvanek at redhat.com
Thu May 15 10:55:06 UTC 2014 

Please threat this as regular review request :)

On 05/13/2014 08:43 PM, Jiri Vanek wrote:
>   Hi!
>
> This patch allows ITW to run on any openjdk or oracle jdk(I have not yet tested with IBM, but will do)
>
> This is probably not final version of the patch - as it break all tests using PluginAppletMocks -
> Its easy - tests do not run on bootclassapth, so the Ancestor of my Access class is in different
> classlaoder.
> Moving tests to bootclassapth[2] do not help, as then even worse things happens. But it should be
> solution-able. Anyway I think that removing those 9 tests is small cost for get rid of dependence on
> icedtea (plugin-hole patch)
>
> There is nasty override of run method. Inside is copypasted code and it is vulnerable.  I will try
> to propose the change
>
>
> -  private runLoader()
> +          runLoader()
>
> to upstream. If they accept,  then actually no hacking will be needed and the hook will be pretty
> clear (except refelction based getters and setter, which is quite ok...)
>
> Opened to RFC,
>
> J
>
> (yah it really worked on plain upstream oraclejdk7 or openjdk7 :) )


Oh! It even worked on IBM JDk!

Well we do not compile against it -
checking if sun.security.provider.X509Factory is available... no
configure: error: sun.security.provider.X509Factory not found.
...
checking if sun.security.x509.X500Name is available... no
configure: error: sun.security.x509.X500Name not found.
...
and same for ValidatorException


but, those are an week dependencies, and ITW is trying to work without it. So if we compile by 
Oracle or Open JDK, and then change JVM to IBM in itw-settingd - Then  it works on simple appelts!

Well, continue. If those checks are removed, then
IT_CHECK_FOR_CLASS(JAVA_NET_COOKIEHANDLER, [java.net.CookieHandler])
#IT_CHECK_FOR_CLASS(SUN_SECURITY_PROVIDER_X509FACTORY, [sun.security.provider.X509Factory])
IT_CHECK_FOR_CLASS(SUN_SECURITY_UTIL_SECURITYCONSTANTS, [sun.security.util.SecurityConstants])
IT_CHECK_FOR_CLASS(SUN_SECURITY_UTIL_HOSTNAMECHECKER, [sun.security.util.HostnameChecker])
#IT_CHECK_FOR_CLASS(SUN_SECURITY_X509_X500NAME, [sun.security.x509.X500Name])
IT_CHECK_FOR_CLASS(SUN_MISC_HEXDUMPENCODER, [sun.misc.HexDumpEncoder])
#IT_CHECK_FOR_CLASS(SUN_SECURITY_VALIDATOR_VALIDATOREXCEPTION, 
[sun.security.validator.ValidatorException])
IT_CHECK_FOR_CLASS(COM_SUN_NET_SSL_INTERNAL_SSL_X509EXTENDEDTRUSTMANAGER,
	[com.sun.net.ssl.internal.ssl.X509ExtendedTrustManager])

then compilation fails, because  classes like String or so are missing.
This is quite clear because IBM java is split to much more parts then oracle/open JDK.
To make compilation work, we have to extend our bootstrap JDK. (which is a bit broken, it still 
calls itself like jdk-1.6 - but should call itself jdk-1.7) OR maybe we can get rid of it?

Anyway - the above missing security classes are inside IBM jdk to:

[jvanek at jvanek jre]$ grep -r X509Factory *
Binary file lib/ext/ibmjcefips.jar matches
Binary file lib/ext/ibmjceprovider.jar matches
Binary file lib/ext/ibmpkcs11impl.jar matches
Binary file lib/ibmcertpathprovider.jar matches
[jvanek at jvanek jre]$ grep -r ValidatorException  *
Binary file lib/ibmcertpathfw.jar matches
Binary file lib/ibmcertpathprovider.jar matches
Binary file lib/ibmpkcs.jar matches
[jvanek at jvanek jre]$ grep -r X500Name *
Binary file lib/ibmcertpathfw.jar matches
Binary file lib/ibmcertpathprovider.jar matches
Binary file lib/ibmpkcs.jar match

But we have to change javwas and plugin luncher  bootclassapth a bit...

How worthy is IBM java support?
Well - if we agrred on IBM support or at least "support" then I'mnotsure if we should try to push also
 > -  private runLoader()
 > +          runLoader()
ps: some ibm archs needs  both javaws and pugin, some just plugin O:)  - 
http://www.ibm.com/developerworks/java/jdk/linux/download.html

path to Openjdk. Well insome time it will bubble to Oracle bits, but when to Ibm bits? maybe never....


The patch itself is only a modified a bit
  - added configure check
  - changed boot classpath for tests

  Well the tests are still broken in same way as without this (test bootclassapth) change. And I do 
not understand why. However i think this change is (according to rest of chnageset) better then no 
change.

Well whats wrong with the tests. It seems that my "test bootclasspath change" have no efect. In both 
cases (changed/not changed tests bootclasspath) all tests using PluginMocks are failing:

....
FAILED: testJavascriptFinalize(sun.applet.PluginAppletViewerTest) null
Exception in thread "Thread-2" java.lang.IllegalAccessError: class 
*sun.applet.AppletViewerPanelAccess cannot access its superclass sun.applet.AppletViewerPanel*
	at java.lang.ClassLoader.defineClass1(Native Method)
	at java.lang.ClassLoader.defineClass(ClassLoader.java:800)
	at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142)
	at java.net.URLClassLoader.defineClass(URLClassLoader.java:449)
	at java.net.URLClassLoader.access$100(URLClassLoader.java:71)
	at java.net.URLClassLoader$1.run(URLClassLoader.java:361)
	at java.net.URLClassLoader$1.run(URLClassLoader.java:355)
	at java.security.AccessController.doPrivileged(Native Method)
	at java.net.URLClassLoader.findClass(URLClassLoader.java:354)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:425)
	at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:358)
	at java.lang.ClassLoader.defineClass1(Native Method)
	at java.lang.ClassLoader.defineClass(ClassLoader.java:800)
	at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142)
	at java.net.URLClassLoader.defineClass(URLClassLoader.java:449)
	at java.net.URLClassLoader.access$100(URLClassLoader.java:71)
	at java.net.URLClassLoader$1.run(URLClassLoader.java:361)
	at java.net.URLClassLoader$1.run(URLClassLoader.java:355)
	at java.security.AccessController.doPrivileged(Native Method)
	at java.net.URLClassLoader.findClass(URLClassLoader.java:354)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:425)
	at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:358)
	at sun.applet.PluginAppletViewerTest$3.call(PluginAppletViewerTest.java:127)
	at sun.applet.PluginAppletViewerTest$3.call(PluginAppletViewerTest.java:125)
	at net.sourceforge.jnlp.AsyncCall$HandlerThread$1.run(AsyncCall.java:74)
FAILED: testJavascriptCall(sun.applet.PluginAppletViewerTest) null
....

Which is quit clear, (When non public Ancestor have different classlaoder then it can not be 
ancestor), but changed tests bootclasspath should fix ti...

Now, when I run the same from commandline (after its compiled)
jvanek at jvanek unit]$ pwd
/home/jvanek/Desktop/icedtea-web/tests.build/netx/unit
jvanek at jvanek unit]$ class_names=`cat /home/jvanek/Desktop/icedtea-web/unit_class_names` ;
[jvanek at jvanek unit]$ 
CLASSPATH=/home/jvanek/Desktop/icedtea-web/netx.build/lib/classes.jar:/home/jvanek/Desktop/icedtea-web/liveconnect/lib/classes.jar:/usr/share/java/junit4.jar:/home/jvanek/Desktop/icedtea-web/junit-runner.jar:/home/jvanek/Desktop/icedtea-web/tests.build/test-extensions:.:/home/jvanek/Desktop/icedtea-web/tests/test-extensions:/usr/share/java/tagsoup.jar

then:[jvanek at jvanek unit]$ /home/jvanek/Desktop/icedtea-web/bootstrap/jdk1.6.0/bin/java 
-Xbootclasspath:/home/jvanek/Desktop/icedtea-web/bootstrap/jdk1.6.0/jre/lib/rt.jar:/home/jvanek/Desktop/icedtea-web/bootstrap/jdk1.6.0/jresr/share/java/js.jar:/home/jvanek/Desktop/icedtea-web/bootstrap/jdk1.6.0/jre/lib/resources.jar 
-cp $CLASSPATH CommandLine $class_names

is reproducing the same "cannot access its superclass " error

but
[jvanek at jvanek unit]$ /home/jvanek/Desktop/icedtea-web/bootstrap/jdk1.6.0/bin/java 
-Xbootclasspath:/home/jvanek/Desktop/icedtea-web/bootstrap/jdk1.6.0/jre/lib/rt.jar:/home/jvanek/Desktop/icedtea-web/bootstrap/jdk1.6.0/jre/lib/jsse.jar:/usr/share/java/js.jar:/home/jvanek/Desktop/icedtea-web/bootstrap/jdk1.6.0/jre/lib/resources.jar:$CLASSPATH 
  CommandLine $class_names
or
[jvanek at jvanek unit]$  /home/jvanek/Desktop/icedtea-web/bootstrap/jdk1.6.0/bin/java 
-Xbootclasspath:/home/jvanek/Desktop/icedtea-web/bootstrap/jdk1.6.0/jre/lib/rt.jar:/home/jvanek/Desktop/icedtea-web/bootstrap/jdk1.6.0/jre/lib/jsse.jar:/usr/share/java/js.jar:/home/jvanek/Desktop/icedtea-web/bootstrap/jdk1.6.0/jre/lib/resources.jar:$CLASSPATH 
-cp $CLASSPATH CommandLine $class_names

have the "cannot access its superclass" *FIXED* but add those strange failures:
FAILED: testApplicationExtraChild(net.sourceforge.jnlp.JNLPMatcherTest) null
FAILED: testTemplateDifferentFile(net.sourceforge.jnlp.JNLPMatcherTest) null
FAILED: testApplicationComments(net.sourceforge.jnlp.JNLPMatcherTest) null
FAILED: testTemplateComments(net.sourceforge.jnlp.JNLPMatcherTest) null
FAILED: testApplicationDifferentOrder(net.sourceforge.jnlp.JNLPMatcherTest) null
FAILED: testApplicationDifferentFile(net.sourceforge.jnlp.JNLPMatcherTest) null
FAILED: testApplicationCDATA(net.sourceforge.jnlp.JNLPMatcherTest) null
  - This test is known to fail
FAILED: testApplicationDuplicate(net.sourceforge.jnlp.JNLPMatcherTest) null
FAILED: testTemplateDifferentOrder(net.sourceforge.jnlp.JNLPMatcherTest) null
FAILED: testTemplateWildCharsAsAllValues(net.sourceforge.jnlp.JNLPMatcherTest) null
Passed: net.sourceforge.jnlp.JNLPMatcherTest.testIsMatchDoesNotHangOnLargeData
FAILED: testApplicationWildCharsRandom(net.sourceforge.jnlp.JNLPMatcherTest) null
FAILED: testTemplateFewerChild(net.sourceforge.jnlp.JNLPMatcherTest) null
FAILED: testTemplateWildCharsRandom(net.sourceforge.jnlp.JNLPMatcherTest) null
FAILED: testTemplateDifferentValues(net.sourceforge.jnlp.JNLPMatcherTest) null
FAILED: testApplicationDifferentCodebaseValue(net.sourceforge.jnlp.JNLPMatcherTest) null
FAILED: testNullJNLPFiles(net.sourceforge.jnlp.JNLPMatcherTest) null
FAILED: testCallingMatchMultiple(net.sourceforge.jnlp.JNLPMatcherTest) null
FAILED: testApplicationFewerChild(net.sourceforge.jnlp.JNLPMatcherTest) null
FAILED: testTemplateDuplicate(net.sourceforge.jnlp.JNLPMatcherTest) null
FAILED: testTemplateExtraChild(net.sourceforge.jnlp.JNLPMatcherTest) null


Any ideas welcomed :(



J.

ps: sorry for short story long...
-------------- next part --------------
A non-text attachment was scrubbed...
Name: allJdks2.patch
Type: text/x-patch
Size: 20952 bytes
Desc: not available
URL: <http://mail.openjdk.java.net/pipermail/distro-pkg-dev/attachments/20140515/2833cd91/allJdks2-0001.patch>

More information about the distro-pkg-dev mailing list