With the help of some friends in the community I believe we've got this

solved : https://bugzilla.redhat.com/show_bug.cgi?id=1884793



On Fri, 2020-10-02 at 15:57 +0000, Patrick Riehecky wrote:

> Anyone out there seen these types of build issues in the past?

> 

> IKE CLASS_1563 seems to fail self test.  The other key sizes test out

> just fine.

> 

> My attempts to trace down why it is raising an error  of

> SEC_ERROR_INVALID_ARGS haven't been all that helpful...

> 

> It feels like a key sizing issue, but not one I've been able to track

> down.

> 

> 

>         [----------] 66 tests from FipsDhCases/SoftokenFipsDhValidate

>         [ RUN      ] FipsDhCases/SoftokenFipsDhValidate.DhVectors/0

>         Test:IKE 1536

>         param_type: IKE_APPROVED, key_class: CLASS_1536

>         p: [192]

> ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74...

>         g: [1] 02

>         q: [0]

>         pub_key: [0]

>         softoken_gtest.cc:553: Failure

>         Expected: (nullptr) != (priv_key.get()), actual: (nullptr) vs

> NULL

>         PK11_GenerateKeyPair failed: SEC_ERROR_INVALID_ARGS

>         softoken_gtest.cc:555: Failure

>         Expected: (nullptr) != (pub_tmp), actual: (nullptr) vs NULL

>         softoken_gtest.cc:897: Failure

>         Expected equality of these values:

>           SECSuccess

>             Which is: 0

>           rv

>             Which is: -1

>         Test(IKE 1536) failed

> 

>         <snip>

> 

>         [  FAILED  ] FipsDhCases/SoftokenFipsDhValidate.DhVectors/0,

> where GetParam() = 112-byte object <44-CF 45-00 00-00 00-00 00-00 00-

> 00 

> 00-00 00-00 20-4D 46-00 00-00 00-00 C0-00 00-00 00-00 00-00 00-00 00-

> 00 

> 00-00 00-00 A1-D4 45-00 00-00 00-00 01-00 00-00 00-00 00-00 00-00 00-

> 00 

> 00-00 00-00 00-00 00-00 00-00 00-00 00-00 00-00 00-00 00-00 00-00 00-

> 00 

> 00-00 00-00 00-00 00-00 00-00 00-00 00-00 00-00 00-00 00-00 01-00 00-

> 00 

> 00-00 00-00> (189 ms)

>         Test:IKE 1536 with subprime

>         param_type: IKE_APPROVED, key_class: CLASS_1536

>         p: [192]

> ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74...

>         g: [1] 02

>         q: [192]

> 7fffffffffffffffe487ed5110b4611a62633145c06e0e68948127044533e63a...

>         pub_key: [0]

>         softoken_gtest.cc:553: Failure

>         Expected: (nullptr) != (priv_key.get()), actual: (nullptr) vs

> NULL

>         PK11_GenerateKeyPair failed: SEC_ERROR_INVALID_ARGS

>         softoken_gtest.cc:555: Failure

>         Expected: (nullptr) != (pub_tmp), actual: (nullptr) vs NULL

>         softoken_gtest.cc:897: Failure

>         Expected equality of these values:

>           SECSuccess

>             Which is: 0

>           rv

>             Which is: -1

>         Test(IKE 1536 with subprime) failed

>         [  FAILED  ] FipsDhCases/SoftokenFipsDhValidate.DhVectors/11,

> where GetParam() = 112-byte object <28-CD 45-00 00-00 00-00 00-00 00-

> 00 

> 00-00 00-00 20-4D 46-00 00-00 00-00 C0-00 00-00 00-00 00-00 00-00 00-

> 00 

> 00-00 00-00 A1-D4 45-00 00-00 00-00 01-00 00-00 00-00 00-00 00-00 00-

> 00 

> 00-00 00-00 60-10 46-00 00-00 00-00 C0-00 00-00 00-00 00-00 00-00 00-

> 00 

> 00-00 00-00 00-00 00-00 00-00 00-00 00-00 00-00 00-00 00-00 01-00 00-

> 00 

> 00-00 00-00> (204 ms)

> 

> 

> For the curious, I've attached the mock logs.  Note: the extracted

> archive content is over 80Mb.

> 

> Upstream test patch : 

> https://hg.mozilla.org/projects/nss/rev/0be91fa2217a

> 

> The nss-3.53.1-3.el7_9 sources can be pulled down from 

> https://git.centos.org/rpms/nss/tree/c7 with the centos-git-common

> tools.

> 

> Pat