Merge master jdk-11.0.24+2 into openj9-staging

Signed-off-by: J9 Build <j9build@ca.ibm.com>

doc/testing.html

@@ -5,7 +5,7 @@
  <meta name="generator" content="pandoc" />
  <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
  <title>Testing the JDK</title>
- <style type="text/css">
+ <style>
  code{white-space: pre-wrap;}
  span.smallcaps{font-variant: small-caps;}
  span.underline{text-decoration: underline;}
@@ -21,7 +21,7 @@
 <header id="title-block-header">
 <h1 class="title">Testing the JDK</h1>
 </header>
-<nav id="TOC">
+<nav id="TOC" role="doc-toc">
 <ul>
 <li><a href="#using-the-run-test-framework">Using the run-test framework</a><ul>
 <li><a href="#configuration">Configuration</a></li>
@@ -40,6 +40,7 @@ <h1 class="title">Testing the JDK</h1>
 <li><a href="#notes-for-specific-tests">Notes for Specific Tests</a><ul>
 <li><a href="#docker-tests">Docker Tests</a></li>
 <li><a href="#client-ui-tests">Client UI Tests</a></li>
+<li><a href="#pkcs11-tests">PKCS11 Tests</a></li>
 </ul></li>
 </ul>
 </nav>
@@ -58,7 +59,7 @@ <h3 id="configuration">Configuration</h3>
 <p>To be able to run JTReg tests, <code>configure</code> needs to know where to find the JTReg test framework. If it is not picked up automatically by configure, use the <code>--with-jtreg=&lt;path to jtreg home&gt;</code> option to point to the JTReg framework. Note that this option should point to the JTReg home, i.e. the top directory, containing <code>lib/jtreg.jar</code> etc. (An alternative is to set the <code>JT_HOME</code> environment variable to point to the JTReg home before running <code>configure</code>.)</p>
 <h2 id="test-selection">Test selection</h2>
 <p>All functionality is available using the run-test make target. In this use case, the test or tests to be executed is controlled using the <code>TEST</code> variable. To speed up subsequent test runs with no source code changes, run-test-only can be used instead, which do not depend on the source and test image build.</p>
-<p>For some common top-level tests, direct make targets have been generated. This includes all JTReg test groups, the hotspot gtest, and custom tests (if present). This means that <code>make run-test-tier1</code> is equivalent to <code>make run-test TEST=&quot;tier1&quot;</code>, but the latter is more tab-completion friendly. For more complex test runs, the <code>run-test TEST=&quot;x&quot;</code> solution needs to be used.</p>
+<p>For some common top-level tests, direct make targets have been generated. This includes all JTReg test groups, the hotspot gtest, and custom tests (if present). This means that <code>make run-test-tier1</code> is equivalent to <code>make run-test TEST="tier1"</code>, but the latter is more tab-completion friendly. For more complex test runs, the <code>run-test TEST="x"</code> solution needs to be used.</p>
 <p>The test specifications given in <code>TEST</code> is parsed into fully qualified test descriptors, which clearly and unambigously show which tests will be run. As an example, <code>:tier1</code> will expand to <code>jtreg:$(TOPDIR)/test/hotspot/jtreg:tier1 jtreg:$(TOPDIR)/test/jdk:tier1 jtreg:$(TOPDIR)/test/langtools:tier1 jtreg:$(TOPDIR)/test/nashorn:tier1 jtreg:$(TOPDIR)/test/jaxp:tier1</code>. You can always submit a list of fully qualified test descriptors in the <code>TEST</code> variable if you want to shortcut the parser.</p>
 <h3 id="common-test-groups">Common Test Groups</h3>
 <p>Ideally, all tests are run for every change but this may not be practical due to the limited testing resources, the scope of the change, etc.</p>
@@ -101,8 +102,8 @@ <h2 id="test-results-and-summary">Test results and summary</h2>
 <p>Additional work data is stored in <code>build/$BUILD/test-support/$TEST_ID</code>. For some frameworks, this directory might contain information that is useful in determining the cause of a failed test.</p>
 <h2 id="test-suite-control">Test suite control</h2>
 <p>It is possible to control various aspects of the test suites using make control variables.</p>
-<p>These variables use a keyword=value approach to allow multiple values to be set. So, for instance, <code>JTREG=&quot;JOBS=1;TIMEOUT=8&quot;</code> will set the JTReg concurrency level to 1 and the timeout factor to 8. This is equivalent to setting <code>JTREG_JOBS=1 JTREG_TIMEOUT=8</code>, but using the keyword format means that the <code>JTREG</code> variable is parsed and verified for correctness, so <code>JTREG=&quot;TMIEOUT=8&quot;</code> would give an error, while <code>JTREG_TMIEOUT=8</code> would just pass unnoticed.</p>
-<p>To separate multiple keyword=value pairs, use <code>;</code> (semicolon). Since the shell normally eats <code>;</code>, the recommended usage is to write the assignment inside qoutes, e.g. <code>JTREG=&quot;...;...&quot;</code>. This will also make sure spaces are preserved, as in <code>JTREG=&quot;VM_OPTIONS=-XshowSettings -Xlog:gc+ref=debug&quot;</code>.</p>
+<p>These variables use a keyword=value approach to allow multiple values to be set. So, for instance, <code>JTREG="JOBS=1;TIMEOUT=8"</code> will set the JTReg concurrency level to 1 and the timeout factor to 8. This is equivalent to setting <code>JTREG_JOBS=1 JTREG_TIMEOUT=8</code>, but using the keyword format means that the <code>JTREG</code> variable is parsed and verified for correctness, so <code>JTREG="TMIEOUT=8"</code> would give an error, while <code>JTREG_TMIEOUT=8</code> would just pass unnoticed.</p>
+<p>To separate multiple keyword=value pairs, use <code>;</code> (semicolon). Since the shell normally eats <code>;</code>, the recommended usage is to write the assignment inside qoutes, e.g. <code>JTREG="...;..."</code>. This will also make sure spaces are preserved, as in <code>JTREG="VM_OPTIONS=-XshowSettings -Xlog:gc+ref=debug"</code>.</p>
 <p>(Other ways are possible, e.g. using backslash: <code>JTREG=JOBS=1\;TIMEOUT=8</code>. Also, as a special technique, the string <code>%20</code> will be replaced with space for certain options, e.g. <code>JTREG=VM_OPTIONS=-XshowSettings%20-Xlog:gc+ref=debug</code>. This can be useful if you have layers of scripts and have trouble getting proper quoting of command line arguments through.)</p>
 <p>As far as possible, the names of the keywords have been standardized between test suites.</p>
 <h3 id="general-keywords-test_opts">General keywords (TEST_OPTS)</h3>
@@ -152,7 +153,7 @@ <h4 id="run_problem_lists">RUN_PROBLEM_LISTS</h4>
 <p>Set to <code>true</code> or <code>false</code>. If <code>true</code>, JTReg will use <code>-match:</code> option, otherwise <code>-exclude:</code> will be used. Default is <code>false</code>.</p>
 <h4 id="options">OPTIONS</h4>
 <p>Additional options to the JTReg test framework.</p>
-<p>Use <code>JTREG=&quot;OPTIONS=--help all&quot;</code> to see all available JTReg options.</p>
+<p>Use <code>JTREG="OPTIONS=--help all"</code> to see all available JTReg options.</p>
 <h4 id="java_options-1">JAVA_OPTIONS</h4>
 <p>Additional Java options to JTReg (<code>-javaoption</code>).</p>
 <h4 id="vm_options-1">VM_OPTIONS</h4>
@@ -169,7 +170,7 @@ <h4 id="repeat">REPEAT</h4>
 <p>Default is 1. Set to -1 to repeat indefinitely. This can be especially useful combined with <code>OPTIONS=--gtest_break_on_failure</code> to reproduce an intermittent problem.</p>
 <h4 id="options-1">OPTIONS</h4>
 <p>Additional options to the Gtest test framework.</p>
-<p>Use <code>GTEST=&quot;OPTIONS=--help&quot;</code> to see all available Gtest options.</p>
+<p>Use <code>GTEST="OPTIONS=--help"</code> to see all available Gtest options.</p>
 <h4 id="aot_modules-2">AOT_MODULES</h4>
 <p>Generate AOT modules before testing for the specified module, or set of modules. If multiple modules are specified, they should be separated by space (or, to help avoid quoting issues, the special value <code>%20</code>).</p>
 <h2 id="notes-for-specific-tests">Notes for Specific Tests</h2>
@@ -178,6 +179,11 @@ <h3 id="docker-tests">Docker Tests</h3>
 <pre><code>$ make run-test TEST=&quot;jtreg:test/hotspot/jtreg/containers/docker&quot;</code></pre>
 <p>To run these tests correctly, additional parameters for the correct docker image are required on Ubuntu 18.04 by using <code>JAVA_OPTIONS</code>.</p>
 <pre><code>$ make run-test TEST=&quot;jtreg:test/hotspot/jtreg/containers/docker&quot; JTREG=&quot;JAVA_OPTIONS=-Djdk.test.docker.image.name=ubuntu -Djdk.test.docker.image.version=latest&quot;</code></pre>
+<h3 id="pkcs11-tests">PKCS11 Tests</h3>
+<p>It is highly recommended to use the latest NSS version when running PKCS11 tests. Improper NSS version may lead to unexpected failures which are hard to diagnose. For example, sun/security/pkcs11/Secmod/AddTrustedCert.java may fail on Ubuntu 18.04 with the default NSS version in the system. To run these tests correctly, the system property <<code>jdk.test.lib.artifacts.&lt;NAME&gt;</code> is required on Ubuntu 18.04 to specify the alternative NSS lib directories.The<code>&lt;NAME&gt;</code> component should be replaced with the name element of the appropriate <code>@Artifact</code> class. (See<code>test/jdk/sun/security/pkcs11/PKCS11Test.java</code>)</p>
+<p>For example:</p>
+<pre><code>$ make test TEST=&quot;jtreg:sun/security/pkcs11/Secmod/AddTrustedCert.java&quot; JTREG=&quot;JAVA_OPTIONS=-Djdk.test.lib.artifacts.nsslib-linux_aarch64=/path/to/NSS-libs&quot</code></pre>
+<p>For more notes about the PKCS11 tests, please refer to test/jdk/sun/security/pkcs11/README.</p>
 <h3 id="client-ui-tests">Client UI Tests</h3>
 <p>Some Client UI tests use key sequences which may be reserved by the operating system. Usually that causes the test failure. So it is highly recommended to disable system key shortcuts prior testing. The steps to access and disable system key shortcuts for various platforms are provided below.</p>
 <h4 id="macos">MacOS</h4>

doc/testing.md

@@ -370,6 +370,22 @@ required on Ubuntu 18.04 by using `JAVA_OPTIONS`.
 
  $ make run-test TEST="jtreg:test/hotspot/jtreg/containers/docker" JTREG="JAVA_OPTIONS=-Djdk.test.docker.image.name=ubuntu -Djdk.test.docker.image.version=latest"
 
+### PKCS11 Tests
+
+It is highly recommended to use the latest NSS version when running PKCS11 tests.
+Improper NSS version may lead to unexpected failures which are hard to diagnose.
+For example, sun/security/pkcs11/Secmod/AddTrustedCert.java may fail on Ubuntu
+18.04 with the default NSS version in the system.
+To run these tests correctly, the system property `jdk.test.lib.artifacts.<NAME>` is required on
+Ubuntu 18.04 to specify the alternative NSS lib directory. The `<NAME>`
+component should be replaced with the name element of the appropriate
+`@Artifact` class. (See `test/jdk/sun/security/pkcs11/PKCS11Test.java`)
+For example:
+
+ $ make test TEST="jtreg:sun/security/pkcs11/Secmod/AddTrustedCert.java" JTREG="JAVA_OPTIONS=-Djdk.test.lib.artifacts.nsslib-linux_aarch64=/path/to/NSS-libs"
+
+For more notes about the PKCS11 tests, please refer to test/jdk/sun/security/pkcs11/README.
+
 ### Client UI Tests
 
 Some Client UI tests use key sequences which may be reserved by the operating

make/conf/github-actions.conf

@@ -29,13 +29,13 @@ GTEST_VERSION=1.8.1
 JTREG_VERSION=7.3.1+1
 
 LINUX_X64_BOOT_JDK_EXT=tar.gz
-LINUX_X64_BOOT_JDK_URL=https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.18%2B10/OpenJDK11U-jdk_x64_linux_hotspot_11.0.18_10.tar.gz
-LINUX_X64_BOOT_JDK_SHA256=4a29efda1d702b8ff38e554cf932051f40ec70006caed5c4857a8cbc7a0b7db7
+LINUX_X64_BOOT_JDK_URL=https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_x64_linux_hotspot_11.0.23_9.tar.gz
+LINUX_X64_BOOT_JDK_SHA256=23e47ea7a3015be3240f21185fd902adebdcf76530757c9b482c7eb5bd3417c2
 
 WINDOWS_X64_BOOT_JDK_EXT=zip
-WINDOWS_X64_BOOT_JDK_URL=https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.18%2B10/OpenJDK11U-jdk_x64_windows_hotspot_11.0.18_10.zip
-WINDOWS_X64_BOOT_JDK_SHA256=0cfa5991a8e372b3f8eacacbb2a336663ead0cc6ec9c9ab6cd53206602fb0062
+WINDOWS_X64_BOOT_JDK_URL=https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_x64_windows_hotspot_11.0.23_9.zip
+WINDOWS_X64_BOOT_JDK_SHA256=d7a9f8ceee9a5785dcbbcbec20a07b1366efec59ba652ef7e03f6f7d10f52b85
 
 MACOS_X64_BOOT_JDK_EXT=tar.gz
-MACOS_X64_BOOT_JDK_URL=https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.18%2B10/OpenJDK11U-jdk_x64_mac_hotspot_11.0.18_10.tar.gz
-MACOS_X64_BOOT_JDK_SHA256=75d79315d7265cc4b89fd9e844161ff90798bc6482ace8c1ac75f862a5b3b565
+MACOS_X64_BOOT_JDK_URL=https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.23%2B9/OpenJDK11U-jdk_x64_mac_hotspot_11.0.23_9.tar.gz
+MACOS_X64_BOOT_JDK_SHA256=4dbd21d9a0311d321f5886eda50c3086026ed61d02e1a85f7b8c2e9ad557bf03

src/java.naming/share/classes/com/sun/jndi/ldap/Connection.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1999, 2023, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1999, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -120,17 +120,15 @@
 public final class Connection implements Runnable {
 
  private static final boolean debug = false;
- private static final int dump = 0; // > 0 r, > 1 rw
-
 
  final private Thread worker; // Initialized in constructor
 
- private boolean v3 = true;  // Set in setV3()
+ private boolean v3 = true; // Set in setV3()
 
- final public String host; // used by LdapClient for generating exception messages
- // used by StartTlsResponse when creating an SSL socket
- final public int port; // used by LdapClient for generating exception messages
- // used by StartTlsResponse when creating an SSL socket
+ public final String host; // used by LdapClient for generating exception messages
+  // used by StartTlsResponse when creating an SSL socket
+ public final int port; // used by LdapClient for generating exception messages
+  // used by StartTlsResponse when creating an SSL socket
 
  private boolean bound = false; // Set in setBound()
 
@@ -319,30 +317,37 @@ private SocketFactory getSocketFactory(String socketFactoryName) throws Exceptio
  }
 
  private Socket createConnectionSocket(String host, int port, SocketFactory factory,
- int connectTimeout) throws Exception {
+ int connectTimeout) throws IOException {
  Socket socket = null;
 
+ // if timeout is supplied, try to use unconnected socket for connecting with timeout
  if (connectTimeout > 0) {
- // create unconnected socket and then connect it if timeout
- // is supplied
- InetSocketAddress endpoint =
- createInetSocketAddress(host, port);
- // unconnected socket
- socket = factory.createSocket();
- // connect socket with a timeout
- socket.connect(endpoint, connectTimeout);
  if (debug) {
- System.err.println("Connection: creating socket with " +
- "a connect timeout");
+ System.err.println("Connection: creating socket with a connect timeout");
+ }
+ try {
+ // unconnected socket
+ socket = factory.createSocket();
+ } catch (IOException e) {
+ // unconnected socket is likely not supported by the SocketFactory
+ if (debug) {
+ System.err.println("Connection: unconnected socket not supported by SocketFactory");
+ }
+ }
+ if (socket != null) {
+ InetSocketAddress endpoint = createInetSocketAddress(host, port);
+ // connect socket with a timeout
+ socket.connect(endpoint, connectTimeout);
  }
  }
+
+ // either no timeout was supplied or unconnected socket did not work
  if (socket == null) {
  // create connected socket
- socket = factory.createSocket(host, port);
  if (debug) {
- System.err.println("Connection: creating connected socket with" +
- " no connect timeout");
+ System.err.println("Connection: creating connected socket with no connect timeout");
  }
+ socket = factory.createSocket(host, port);
  }
  return socket;
  }
@@ -351,7 +356,7 @@ private Socket createConnectionSocket(String host, int port, SocketFactory facto
  // the SSL handshake following socket connection as part of the timeout.
  // So explicitly set a socket read timeout, trigger the SSL handshake,
  // then reset the timeout.
- private void initialSSLHandshake(SSLSocket sslSocket , int connectTimeout) throws Exception {
+ private void initialSSLHandshake(SSLSocket sslSocket, int connectTimeout) throws Exception {
 
  if (!IS_HOSTNAME_VERIFICATION_DISABLED) {
  SSLParameters param = sslSocket.getSSLParameters();

src/java.naming/share/classes/module-info.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2014, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -36,21 +36,33 @@
  * The following implementation specific properties are supported by the
  * default LDAP Naming Service Provider implementation in the JDK:
  * <ul>
+ * <li>{@code java.naming.ldap.factory.socket}:
+ * <br>The value of this environment property specifies the fully
+ * qualified class name of the socket factory used by the LDAP provider.
+ * This class must implement the {@link javax.net.SocketFactory} abstract class
+ * and provide an implementation of the static "getDefault()" method that
+ * returns an instance of the socket factory. By default the environment
+ * property is not set.
+ * </li>
  * <li>{@code com.sun.jndi.ldap.connect.timeout}:
- * <br>The value of this property is the string representation
- * of an integer representing the connection timeout in
- * milliseconds. If the LDAP provider cannot establish a
- * connection within that period, it aborts the connection attempt.
+ * <br>The value of this environment property is the string representation
+ * of an integer specifying the connection timeout in milliseconds.
+ * If the LDAP provider cannot establish a connection within that period,
+ * it aborts the connection attempt.
  * The integer should be greater than zero. An integer less than
  * or equal to zero means to use the network protocol's (i.e., TCP's)
  * timeout value.
  * <br> If this property is not specified, the default is to wait
  * for the connection to be established or until the underlying
  * network times out.
+ * <br> If a custom socket factory is provided via environment property
+ * {@code java.naming.ldap.factory.socket} and unconnected sockets
+ * are not supported, the specified timeout is ignored
+ * and the provider behaves as if no connection timeout was set.
  * </li>
  * <li>{@code com.sun.jndi.ldap.read.timeout}:
  * <br>The value of this property is the string representation
- * of an integer representing the read timeout in milliseconds
+ * of an integer specifying the read timeout in milliseconds
  * for LDAP operations. If the LDAP provider cannot get a LDAP
  * response within that period, it aborts the read attempt. The
  * integer should be greater than zero. An integer less than or