8361711: Add library name configurability to PKCS11Test.java

[fitzsim]

This patch adds configurability to PKCS11Test.java.

Specifically, it adds two new system properties:

• CUSTOM_P11_LIBRARY_NAME: Allow overriding the value assigned to the nss_library field. Prior to this patch, nss_library was set to either "softokn3" or "nss3".

• CUSTOM_P11_CONFIG_VARIANT: Abstract the configuration file type to load. Prior to this patch, test cases that wanted to run NSS in sensitive mode would hard-code p11-nss-sensitive.txt on their command lines.

The patch updates the three p11-nss-sensitive.txt-using test cases to use the new CUSTOM_P11_CONFIG_VARIANT property:

test/jdk/java/security/KeyAgreement/Generic.java
test/jdk/sun/security/pkcs11/Mac/TestLargeSecretKeys.java
test/jdk/sun/security/pkcs11/rsa/TestP11KeyFactoryGetRSAKeySpec.java

I have been using this change to run PKCS11Test.java against the Kryoptic PKCS11 soft token, using this invocation:

make test \
    JTREG="JAVA_OPTIONS=-DCUSTOM_P11_CONFIG=/tmp/kryoptic-configuration/p11-kryoptic.txt \
                        -DCUSTOM_P11_LIBRARY_NAME=kryoptic_pkcs11 \
                        -Djdk.test.lib.artifacts.nsslib-linux_x64=/tmp/kryoptic-configuration \
                        -DCUSTOM_DB_DIR=/tmp/kryoptic-configuration"

/tmp/kryoptic-configuration contains (among other files):

libkryoptic_pkcs11.so
p11-kryoptic.txt
p11-kryoptic-sensitive.txt

With CUSTOM_P11_LIBRARY_NAME set, PKCS11Test.java can find libkryoptic_pkcs11.so.

And setting CUSTOM_P11_CONFIG causes the sensitive tests to use p11-kryoptic-sensitive.txt via the new CUSTOM_P11_CONFIG_VARIANT property.

On my Fedora 42 x86-64 machine, I tested for regressions with:

$ time make test JOBS=4 JTREG="JAVA_OPTIONS=-Djdk.test.lib.artifacts.nsslib-linux_x64=/usr/lib64" TEST="test/jdk/sun/security/pkcs11"

and:

$ time make test JOBS=4 TEST="test/jdk/sun/security/pkcs11"

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• Change must not contain extraneous whitespace
• Commit message must refer to an issue

Issue

• JDK-8361711: Add library name configurability to PKCS11Test.java (Enhancement - P4)

Reviewers

• Valerie Peng (@valeriepeng - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/26325/head:pull/26325
$ git checkout pull/26325

Update a local copy of the PR:
$ git checkout pull/26325
$ git pull https://git.openjdk.org/jdk.git pull/26325/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 26325

View PR using the GUI difftool:
$ git pr show -t 26325

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/26325.diff

Using Webrev

Link to Webrev Comment

[bridgekeeper]

👋 Welcome back fitzsim! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

@fitzsim This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8361711: Add library name configurability to PKCS11Test.java

Reviewed-by: valeriep

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 762 new commits pushed to the master branch:

• 10fea86: 8367371: Remove @requires vm.opt.UseLargePages from InternSharedString.java test
• 02d7281: 8367483: C2 crash in PhaseValues::type: assert(t != nullptr) failed: must set before get - missing notification for CastX2P(SubL(x, y))
• 15dd96f: 8144124: [macosx] The tabs can't be aligned when we pressing the key of 'R','B','L','C' or 'T'.
• ... and 759 more: https://git.openjdk.org/jdk/compare/b65fdf5af0a5e1cf0d66d7551c6df63e8d07c5fa...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

As you do not have Committer status in this project an existing Committer must agree to sponsor your change. Possible candidates are the reviewers of this PR (@valeriepeng) but any other Committer may sponsor as well.

➡️ To flag this PR as ready for integration with the above commit message, type /integrate in a new comment. (Afterwards, your sponsor types /sponsor in a new comment to perform the integration).

[openjdk]

@fitzsim The following label will be automatically applied to this pull request:

• security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

[mlbridge]

Webrevs

• 02: Full - Incremental (423962fe)
• 01: Full - Incremental (621a35f3)
• 00: Full (780a630a)

[rhalade]

Will you also include p11-kryoptic.txt and p11-kryoptic-sensitive.txt configuration files for Kryoptic library so others can also run this interoperability? And do the current P11-NSS tests continue to work as expected?

[fitzsim]

Thank you for taking a look, @rhalade.

Will you also include p11-kryoptic.txt and p11-kryoptic-sensitive.txt configuration files for Kryoptic library so others can also run this interoperability?

I had not planned to yet (i.e., not with this patch). Eventually I think doing so will make sense, once we settle on the Kryoptic configuration that best suits OpenJDK.

For reference in the meantime, the Kryoptic project is running their continuous integration with the following configuration files:

https://github.com/latchset/kryoptic/blob/main/testdata/openjdk/p11-kryoptic.txt
https://github.com/latchset/kryoptic/blob/main/testdata/openjdk/p11-kryoptic-sensitive.txt

And do the current P11-NSS tests continue to work as expected?

Yes, I checked for differences in .jtr files produced by the following invocation:

time make test JOBS=4 JTREG="JAVA_OPTIONS=-Djdk.test.lib.artifacts.nsslib-linux_x64=/usr/lib64 --enable-native-access=ALL-UNNAMED" TEST="test/jdk/sun/security/pkcs11 test/jdk/java/security/KeyAgreement/Generic.java"

on commit b65fdf5 (i.e., without my patch) and on commit 780a630 (i.e., with my patch).

(The --enable-native-access=ALL-UNNAMED argument is not strictly required, but reduces noise in the diffs; without it, both with and without my patch, tests mostly print the following warning, but sometimes do not; which tests do and do not changes from run to run:

WARNING: A restricted method in java.lang.System has been called
WARNING: java.lang.System::load has been called by PKCS11Test in an unnamed module (file:/[...])
WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module
WARNING: Restricted methods will be blocked in a future release unless native access is enabled

I am not sure what's going on there.)

The only differences are the configuration file lines printed in the .jtr files, for example, TestRSAKeyLength.jtr has a new line:

Configuration file: ./nss/p11-nss.txt

[valeriepeng]

Have a short vacay coming up, will resume review next Wed.

[valeriepeng]

For consistency sake, could you please update the description of https://bugs.openjdk.org/browse/JDK-8361711 to match the current PR? It no longer adds the new CUSTOM_P11_CONFIG_VARIANT property.

[fitzsim]

For consistency sake, could you please update the description of https://bugs.openjdk.org/browse/JDK-8361711 to match the current PR? It no longer adds the new CUSTOM_P11_CONFIG_VARIANT property.

Done.

[fitzsim]

/integrate

[openjdk]

@fitzsim
Your change (at version 423962f) is now ready to be sponsored by a Committer.

[franferrax]

/sponsor

[openjdk]

Going to push as commit 1cb1267.
Since your change was applied there have been 781 commits pushed to the master branch:

• 3db3c06: 8366852: java/awt/Choice/ChoiceMouseWheelTest/ChoiceMouseWheelTest.java test is failing
• c16462b: 8367576: JvmtiThreadState::_debuggable is unused
• 9ca7b24: 8367422: Parallel: Refactor local variables names in copy_unmarked_to_survivor_space
• ... and 778 more: https://git.openjdk.org/jdk/compare/b65fdf5af0a5e1cf0d66d7551c6df63e8d07c5fa...master

Your commit was automatically rebased without conflicts.

[openjdk]

@franferrax @fitzsim Pushed as commit 1cb1267.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

[fitzsim]

/backport jdk25u

[openjdk]

@fitzsim the backport was successfully created on the branch backport-fitzsim-1cb1267c-master in my personal fork of openjdk/jdk25u. To create a pull request with this backport targeting openjdk/jdk25u:master, just click the following link:

➡️ Create pull request

The title of the pull request is automatically filled in correctly and below you find a suggestion for the pull request body:

Hi all,

This pull request contains a backport of commit 1cb1267c from the openjdk/jdk repository.

The commit being backported was authored by Thomas Fitzsimmons on 15 Sep 2025 and was reviewed by Valerie Peng.

Thanks!

If you need to update the source branch of the pull then run the following commands in a local clone of your personal fork of openjdk/jdk25u:

$ git fetch https://github.com/openjdk-bots/jdk25u.git backport-fitzsim-1cb1267c-master:backport-fitzsim-1cb1267c-master
$ git checkout backport-fitzsim-1cb1267c-master
# make changes
$ git add paths/to/changed/files
$ git commit --message 'Describe additional changes made'
$ git push https://github.com/openjdk-bots/jdk25u.git backport-fitzsim-1cb1267c-master

⚠️ @fitzsim You are not yet a collaborator in my fork openjdk-bots/jdk25u. An invite will be sent out and you need to accept it before you can proceed.