Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8057894

During heavy use seeing an error: Unexpected CryptoAPI failure generating seed

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Other
    • Icon: P5 P5
    • None
    • 8u20, 9
    • security-libs

      FULL PRODUCT VERSION :
      java version "1.8.0_20"
      Java(TM) SE Runtime Environment (build 1.8.0_20-b26)
      Java HotSpot(TM) Client VM (build 25.20-b23, mixed mode)


      ADDITIONAL OS VERSION INFORMATION :
      Windows 2008 R2 Enterprise
      Service Pack 1

      EXTRA RELEVANT SYSTEM CONFIGURATION :
      This is actually a simulated OS, running on VMWare.
      Other system details:
      Processor: Intel(R) Xeon(R) CPU E5-2680 0 @ 2.70 GHz 2.70Ghz
      System type: 64-bit Operating System

      Disk FS Capacity Free %Free
      C:/ NTFS 89.90 GB 68.08 GB 76%
      Sys NTFS 100 MB 70 M 70%

      I run this from a cygwin shell.

      A DESCRIPTION OF THE PROBLEM :
      We run the Apache Derby suites.All test 4-6 times a week against Derby 'trunk' builds on this machine. When this is executed, there are 5 JVMs (4 IBM ones and Oracle's jdk 1.8) running the same tests at the same time (using the test framework's derby.tests.basePort property to separate out the network usage).

      Since August 7 we see intermittently the failure described in DERBY-6702 (https://issues.apache.org/jira/browse/DERBY-6702).

      The full stack trace is:
      1) testNetworkServerSecurityMechanism(org.apache.derbyTesting.functionTests.tests.derbynet.NSSecurityMechanismTest)junit.framework.AssertionFailedError: The expected SQL state must be five characters long
      at org.apache.derbyTesting.junit.BaseJDBCTestCase.assertSQLState(BaseJDBCTestCase.java:873)
      at org.apache.derbyTesting.junit.BaseJDBCTestCase.assertSQLState(BaseJDBCTestCase.java:940)
      at org.apache.derbyTesting.functionTests.tests.derbynet.NSSecurityMechanismTest.assertConnectionUsingDriverManager(NSSecurityMechanismTest.java:581)
      at org.apache.derbyTesting.functionTests.tests.derbynet.NSSecurityMechanismTest.assertConnectionsUsingDriverManager(NSSecurityMechanismTest.java:437)
      at org.apache.derbyTesting.functionTests.tests.derbynet.NSSecurityMechanismTest.testNetworkServerSecurityMechanism(NSSecurityMechanismTest.java:291)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at org.apache.derbyTesting.junit.BaseTestCase.runBare(BaseTestCase.java:118)
      at org.apache.derbyTesting.junit.BaseJDBCTestCase.runBareOverridable(BaseJDBCTestCase.java:440)
      at org.apache.derbyTesting.junit.BaseJDBCTestCase.runBare(BaseJDBCTestCase.java:457)
      at junit.extensions.TestDecorator.basicRun(TestDecorator.java:24)
      at junit.extensions.TestSetup$1.protect(TestSetup.java:21)
      at junit.extensions.TestSetup.run(TestSetup.java:25)
      at org.apache.derbyTesting.junit.BaseTestSetup.run(BaseTestSetup.java:57)
      at junit.extensions.TestDecorator.basicRun(TestDecorator.java:24)
      at junit.extensions.TestSetup$1.protect(TestSetup.java:21)
      at junit.extensions.TestSetup.run(TestSetup.java:25)
      Caused by: java.sql.SQLException: Java exception: 'Unexpected CryptoAPI failure generating seed: java.lang.InternalError'.
      at org.apache.derby.client.am.SQLExceptionFactory.getSQLException(Unknown Source)
      at org.apache.derby.client.am.SqlException.getSQLException(Unknown Source)
      at org.apache.derby.jdbc.ClientDriver.connect(Unknown Source)
      at java.sql.DriverManager.getConnection(DriverManager.java:664)
      at java.sql.DriverManager.getConnection(DriverManager.java:270)
      at org.apache.derbyTesting.functionTests.tests.derbynet.NSSecurityMechanismTest.assertConnectionUsingDriverManager(NSSecurityMechanismTest.java:541)
      ... 37 more
      Caused by: ERROR XJ001: Java exception: 'Unexpected CryptoAPI failure generating seed: java.lang.InternalError'.
      at org.apache.derby.client.net.NetConnection.flowConnect(Unknown Source)
      at org.apache.derby.client.net.NetConnection.<init>(Unknown Source)
      at org.apache.derby.client.net.ClientJDBCObjectFactoryImpl.newNetConnection(Unknown Source)
      ... 41 more
      Caused by: java.lang.InternalError: Unexpected CryptoAPI failure generating seed
      at sun.security.provider.NativeSeedGenerator.getSeedBytes(NativeSeedGenerator.java:62)
      at sun.security.provider.SeedGenerator.generateSeed(SeedGenerator.java:144)
      at sun.security.provider.SecureRandom.engineGenerateSeed(SecureRandom.java:128)
      at java.security.SecureRandom.generateSeed(SecureRandom.java:522)
      at org.apache.derby.client.am.EncryptionManager.generateSeed(Unknown Source)
      at org.apache.derby.client.net.NetConnection.initializeClientSeed(Unknown Source)
      at org.apache.derby.client.net.NetConnection.flowUSRSSBPWDconnect(Unknown Source)
      ... 44 more

      One of the commenters suggested there might be a problem in a native windows class:


      A comment in the source of this class [a Windows specific class (NativeSeedGenerator)] states:

          // should never happen if constructor check succeeds
          throw new InternalError
          ("Unexpected CryptoAPI failure generating seed");

      Unfortunately, I've not been able to reproduce this at will, so there is not much more I can do on this.

      As can be read in the JIRA DERBY-6702, the initial report was with the GA Java 8 version, then it stopped occurring after about 2 weeks, but I have now updated to jdk 1.8u20 and the same problem occurred.



      ADDITIONAL REGRESSION INFORMATION:
      I do not run with earlier versions of Oracle JVMs - so I cannot be 100% certain this would not occur in earlier releases.

      STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
      To reproduce:

      - obtain a set of Derby 'trunk' jars (possibly 10.11 or so would do, see: http://db.apache.org/derby/derby_downloads.html#Nightly+Builds).
      The JavaDB folks no doubt have regular builds that can be used.
      - obtain junit.jar version 3.8.
      - add the jars (including derbyTesting.jar) to the environment $CLASSPATH
      - run the following command to run all tests:
         java -Dderby.tests.basePort=4100 -Dderby.tests.trace=true junit.textui.TestRunner org.apache.derbyTesting.functionTests.suites.All > runsuitesall.out 2>&1

      To run *just* the failing test:
         java -Dderby.tests.trace=true junit.textui.TestRunner org.apache.derbyTesting.functionTests.tests.derbynet.NSSecurityMechanismTest

      To start another one at the same time, change the basePort number to something quite a bit higher; I've been using 4100, 4200, 4300 etc.

      EXPECTED VERSUS ACTUAL BEHAVIOR :
      EXPECTED -
      The test should pass.
      ACTUAL -
      odd failure.


      ERROR MESSAGES/STACK TRACES THAT OCCUR :
      Caused by: java.lang.InternalError: Unexpected CryptoAPI failure generating seed
      at sun.security.provider.NativeSeedGenerator.getSeedBytes(NativeSeedGenerator.java:62)
      at sun.security.provider.SeedGenerator.generateSeed(SeedGenerator.java:144)
      at sun.security.provider.SecureRandom.engineGenerateSeed(SecureRandom.java:128)
      at java.security.SecureRandom.generateSeed(SecureRandom.java:522)
      at org.apache.derby.client.am.EncryptionManager.generateSeed(Unknown Source)
      at org.apache.derby.client.net.NetConnection.initializeClientSeed(Unknown Source)
      at org.apache.derby.client.net.NetConnection.flowUSRSSBPWDconnect(Unknown Source)
      ...

      REPRODUCIBILITY :
      This bug can be reproduced often.

      ---------- BEGIN SOURCE ----------
      I have not been able to reproduce it at will, leave alone with a smaller test case.
      The source for the particular test can be viewed here:
      http://svn.apache.org/viewvc/db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/derbynet/NSSecurityMechanismTest.java?revision=1608782&view=markup
      ---------- END SOURCE ----------

      CUSTOMER SUBMITTED WORKAROUND :
      Have not found one. I will modify the test to mask/hide/ignore this failure as it's irritating to see a test fail for a bug/issue not in our product.

            Unassigned Unassigned
            webbuggrp Webbug Group
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: