[Bug 1951279] Re: OpenSSL 1.1.1f raise a segmentation faults on Arm64 builds

2021-12-27 Thread David Hess 
If anybody needs a workaround, disable the CHACHA20 cipher suites which
use Poly1305:

$ openssl s_client -debug -showcerts -connect graph.facebook.com:443
-ciphersuites TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256 -cipher
'ALL:!CHACHA20'

Unfortunately, it appears this can't be done system wide from
/etc/ssl/openssl.conf - it needs to be done in a tool specific way for
each tool using openssl (such as curl: https://curl.se/docs/ssl-
ciphers.html).

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1951279

Title:
  OpenSSL 1.1.1f raise a segmentation faults on Arm64 builds

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1951279/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1953301] Re: Segfault on AArch64 caused by OpenSSL affecting numerous packages

2021-12-25 Thread David Hess 
I confirmed https://github.com/openssl/openssl/pull/13256 does indeed
appear to be the source of the problem for me. I added all of the
details to 1951279 here:

https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1951279/comments/15

and

https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1951279/comments/16

Regarding reproducibility, the bug both trashes the stack (which makes
it difficult to narrow down) and only happens on v8.3 64 bit ARM
processors (which is why some Arm 64 bit folks get false negatives).

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1953301

Title:
  Segfault on AArch64 caused by OpenSSL affecting numerous packages

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1953301/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1951279] Re: OpenSSL 1.1.1f raise a segmentation faults on Arm64 builds

2021-12-25 Thread David Hess 
To reproduce, be on an Arm v8.3 processor and do the following:

$ gdb $(which openssl)
GNU gdb (Ubuntu 9.2-0ubuntu1~20.04) 9.2
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "aarch64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
.
Find the GDB manual and other documentation resources online at:
.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/bin/openssl...
Reading symbols from 
/usr/lib/debug/.build-id/8c/c0ad363ae4508d48a68d9f9dafdbadf7bd264a.debug...
(gdb) break main
Breakpoint 1 at 0x32840: file ../apps/openssl.c, line 120.
(gdb) run s_client -showcerts -connect graph.facebook.com:443
Starting program: /usr/bin/openssl s_client -showcerts -connect 
graph.facebook.com:443
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/aarch64-linux-gnu/libthread_db.so.1".

Breakpoint 1, main (argc=5, argv=0xf478) at ../apps/openssl.c:120
120 ../apps/openssl.c: No such file or directory.
(gdb) break ../crypto/poly1305/poly1305.c:502
Breakpoint 2 at 0xf7e082c8: file ../crypto/poly1305/poly1305.c, line 502.
(gdb) c
Continuing.
CONNECTED(0003)

Breakpoint 2, Poly1305_Update (ctx=ctx@entry=0xaaba97f0, inp=, inp@entry=0xaab9e098 "\362Hd\025\245\223\351f\027\265 
b䓁\207, 
len=992, len@entry=1001)
at ../crypto/poly1305/poly1305.c:502
502 ../crypto/poly1305/poly1305.c: No such file or directory.
(gdb) s
poly1305_blocks_neon () at crypto/poly1305/poly1305-armv8.S:223
223 crypto/poly1305/poly1305-armv8.S: No such file or directory.
(gdb) bt
#0  poly1305_blocks_neon () at crypto/poly1305/poly1305-armv8.S:223
#1  0xf7e082dc in Poly1305_Update (ctx=ctx@entry=0xaaba97f0, 
inp=, inp@entry=0xaab9e098 "\362Hd\025\245\223\351f\027\265 
b䓁\207, 
len=, len@entry=1001) at ../crypto/poly1305/poly1305.c:502
#2  0xf7dd7834 in chacha20_poly1305_cipher (ctx=0xaaba95b0, 
out=0xaab9e098 "\362Hd\025\245\223\351f\027\265 
b䓁\207, 
in=0xaab9e098 "\362Hd\025\245\223\351f\027\265 
b䓁\207, 
len=1001) at ../crypto/evp/e_chacha20_poly1305.c:419
#3  0xf7ddc214 in EVP_DecryptUpdate (inl=1001, in=0xaab9e098 
"\362Hd\025\245\223\351f\027\265 
b䓁\207, 
outl=0xe360, 
out=0xaab9e098 "\362Hd\025\245\223\351f\027\265 
b䓁\207, 
ctx=0xaaba95b0) at ../crypto/evp/evp_enc.c:498
#4  EVP_DecryptUpdate (ctx=0xaaba95b0, out=0xaab9e098 
"\362Hd\025\245\223\351f\027\265 
b䓁\207, 
outl=0xe360, 
in=0xaab9e098 "\362Hd\025\245\223\351f\027\265 
b䓁\207, 
inl=1001) at ../crypto/evp/evp_enc.c:464
#5  0xf7f59d8c in tls13_enc (s=0xaab94ca0, recs=0xaab95a28, 
n_recs=, sending=0) at ../ssl/record/ssl3_record_tls13.c:173
#6  0xf7f58748 in ssl3_get_record (s=s@entry=0xaab94ca0) at 
../ssl/record/ssl3_record.c:529
#7  0xf7f55fc0 in ssl3_read_bytes (s=0xaab94ca0, type=22, 
recvd_type=0xe5ec, buf=0xaab98b30 "\002", len=4, peek=0, 
readbytes=0xe5f0) at ../ssl/record/rec_layer_s3.c:1323
#8  0xf7f84800 in tls_get_message_header (s=s@entry=0xaab94ca0, 
mt=mt@entry=0xe68c) at ../ssl/statem/statem_lib.c:1160
#9  0xf7f7af74 in read_state_machine (s=0xaab94ca0) at 
../ssl/statem/statem.c:579
#10 state_machine (s=0xaab94ca0, server=0) at ../ssl/statem/statem.c:434
#11 0xf7f55ce4 in ssl3_write_bytes (s=0xaab94ca0, type=23, 
buf_=0xaab89d90, len=0, written=0xe8e0) at 
../ssl/record/rec_layer_s3.c:390
#12 0xf7f66b74 in ssl_write_internal (s=s@entry=0xaab94ca0, 
buf=buf@entry=0xaab89d90, num=num@entry=0, 
written=written@entry=0xe8e0) at ../ssl/ssl_lib.c:1958
#13 0xf7f66ca0 in SSL_write (s=s@entry=0xaab94ca0, 
buf=buf@entry=0xaab89d90, num=num@entry=0) at ../ssl/ssl_lib.c:1972
#14 0xaab00250 in s_client_main (argc=, argv=) at ../apps/s_client.c:2859
#15 0xaaaeffd4 in do_cmd (prog=0xaab84740, argc=4, 
argv=0xf480) at ../apps/openssl.c:570
#16 0xaaadcc04 in main (argc=4, argv=0xf480) at 
../apps/openssl.c:189
(gdb) finish
Run till exit from #0  poly1305_blocks_neon () at 
crypto/poly1305/poly1305-armv8.S:223

Program received signal SIGSEGV, Segmentation fault.
0x0020f7e082dc in ?? ()
(gdb) bt
#0  0x0020f7e082dc in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.

[Bug 1951279] Re: OpenSSL 1.1.1f raise a segmentation faults on Arm64 builds

2021-12-25 Thread David Hess 
After a lot of sleuthing with gdb, I'm pretty confident this is the
source of (and fix for) the crash we are seeing with libssl1.1:arm64
1.1.1f-1ubuntu2.10:

https://github.com/openssl/openssl/commit/fcf6e9d056162d5af64c6f7209388a5c3be2ce57

It's a bug fix for some pointer authentication assembly instructions for
the Poly1305 arm64 assembly code. These instructions only execute (and
crash) on Arm v8.3 64 bit processors - they NOOP on other processors
that don't understand them.

Note, I have no idea why that code would not also be a problem and crash
under valgrind, but I've definitely narrowed this particular crash
outside of valgrind down to that location. Maybe it disables pointer
authentication?

It appears the commit above was landed in OpenSSL 1.1.1i:

https://github.com/openssl/openssl/blob/OpenSSL_1_1_1i/crypto/poly1305/asm/poly1305-armv8.pl

Bottom line, in order to prevent crashes on Arm v8.3 processors I
believe addressing this requires an upgrade of libssl1.1 to OpenSSL
1.1.1i.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1951279

Title:
  OpenSSL 1.1.1f raise a segmentation faults on Arm64 builds

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1951279/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1951279] Re: OpenSSL 1.1.1f raise a segmentation faults on Arm64 builds

2021-12-25 Thread David Hess 
More info about my environment:

Running under Parallels 17.1.1 (51537) on macOS Monterey 12.1 on an
Apple Silicon M1 Max. Ubuntu Ubuntu 20.04.3 LTS w/ libssl1.1:arm64
1.1.1f-1ubuntu2.10.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1951279

Title:
  OpenSSL 1.1.1f raise a segmentation faults on Arm64 builds

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1951279/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1951279] Re: OpenSSL 1.1.1f raise a segmentation faults on Arm64 builds

2021-12-25 Thread David Hess 
Here's an interesting data point. If I run this under valgrind:

$ valgrind openssl s_client -showcerts -connect graph.facebook.com:443
==36982== Memcheck, a memory error detector
==36982== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==36982== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==36982== Command: openssl s_client -showcerts -connect graph.facebook.com:443
==36982== 
CONNECTED(0003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High 
Assurance EV Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 
High Assurance Server CA
verify return:1
depth=0 C = US, ST = California, L = Menlo Park, O = "Facebook, Inc.", CN = 
*.facebook.com
verify return:1
---
Certificate chain
 0 s:C = US, ST = California, L = Menlo Park, O = "Facebook, Inc.", CN = 
*.facebook.com
   i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 High 
Assurance Server CA
-BEGIN CERTIFICATE-
MIIGkTCCBXmgAwIBAgIQCivCRFoplTX8XaBRF4f4wDANBgkqhkiG9w0BAQsFADBw
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMS8wLQYDVQQDEyZEaWdpQ2VydCBTSEEyIEhpZ2ggQXNz
dXJhbmNlIFNlcnZlciBDQTAeFw0yMTEwMDMwMDAwMDBaFw0yMjAxMDEyMzU5NTla
MGkxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpN
ZW5sbyBQYXJrMRcwFQYDVQQKEw5GYWNlYm9vaywgSW5jLjEXMBUGA1UEAwwOKi5m
YWNlYm9vay5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQ9cpj/+XqZgH6d
qstfu/ZUoA+jNBS8A2pE9naG2+/1fDQbFhAK/4N1wNQ69xh2o1KbUId1Qi9sDCWk
Fu6s9XAqo4ID9zCCA/MwHwYDVR0jBBgwFoAUUWj/kK8CB3U8zNllZGKiErhZcjsw
HQYDVR0OBBYEFLARiFqEkLy4TD1U7suyuVQuqD6/MIG1BgNVHREEga0wgaqCDiou
ZmFjZWJvb2suY29tgg4qLmZhY2Vib29rLm5ldIILKi5mYmNkbi5uZXSCCyouZmJz
YnguY29tghAqLm0uZmFjZWJvb2suY29tgg8qLm1lc3Nlbmdlci5jb22CDioueHgu
ZmJjZG4ubmV0gg4qLnh5LmZiY2RuLm5ldIIOKi54ei5mYmNkbi5uZXSCDGZhY2Vi
b29rLmNvbYINbWVzc2VuZ2VyLmNvbTAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYw
FAYIKwYBBQUHAwEGCCsGAQUFBwMCMHUGA1UdHwRuMGwwNKAyoDCGLmh0dHA6Ly9j
cmwzLmRpZ2ljZXJ0LmNvbS9zaGEyLWhhLXNlcnZlci1nNi5jcmwwNKAyoDCGLmh0
dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9zaGEyLWhhLXNlcnZlci1nNi5jcmwwPgYD
VR0gBDcwNTAzBgZngQwBAgIwKTAnBggrBgEFBQcCARYbaHR0cDovL3d3dy5kaWdp
Y2VydC5jb20vQ1BTMIGDBggrBgEFBQcBAQR3MHUwJAYIKwYBBQUHMAh0dHA6
Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBNBggrBgEFBQcwAoZBaHR0cDovL2NhY2VydHMu
ZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkhpZ2hBc3N1cmFuY2VTZXJ2ZXJDQS5j
cnQwDAYDVR0TAQH/BAIwADCCAX0GCisGAQQB1nkCBAIEggFtBIIBaQFnAHYAKXm+
8J45OSHwVnOfY6V35b5XfZxgCvj5TV0mXCVdx4QAAAF8Q4ALtQAABAMARzBFAiAB
3r54JbfoFtjAqiLdaY6fXb/o1jjaT9u4XCdN5xu7NAIhAKGf3c1Jzs2cXQcAu422
KlF9P2lXrpZyMmP4rJYTuev2AHYAUaOw9f0BeZxWbbg3eI8MpHrMGyfL956IQpoN
/tSLBeUAAAF8Q4AL8AAABAMARzBFAiEAq7yuxzQO7e+txL6xITlC/qIHDYvapOTh
Tl4NHC+rOj0CIFHm8wXHI/F0gsWQVv5Ot8Ij4RuEZEVMMau/AEMroZ2aAHUAQcjK
sd8iRkoQxqE6CUKHXk4xixsD6+tLx2jwkGKWBvYAAAF8Q4ALyAAABAMARjBEAiAB
b4Q1lYSN7rcuXUxkIzbum5dVe0caAHuVTYgU00HYkQIgFtebuk3zr+NVZ520RCGZ
fetkFZv08wHf7TJK+JBMnBwwDQYJKoZIhvcNAQELBQADggEBAIcfi8CHi/+QH4cW
BjjDEZnQtPaOG77WtdFW2UK3xt2GKk4qY5rfVKLFGT9vAZRx4ZHFfK6c1IADkNMe
42lwc0+gTBrqrx1Uu+11vAIektX3Lx5xfeCTY604NK1qCC6ISYB/U2NVy2l0skT/
1xKLH87I+P7IwgQtE2en7yt9bu03GPIU0DVkYzqvBxGCq599ae2gYIVZVRSe2Xhp
WVeBB03fhf+NNcbR4LZK7n1ohrUBs7rurc0z6iv8V6qRU+aj8tS8606iQhcjEm9h
SN8G9/0JXXR5oWD/pAScLRtBwvkmDJEyw9lwxiErjgnfFHL0iDUZvqk0gXiQq54v
IK957WY=
-END CERTIFICATE-
 1 s:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 High 
Assurance Server CA
   i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High 
Assurance EV Root CA
-BEGIN CERTIFICATE-
MIIEsTCCA5mgAwIBAgIQBOHnpNxc8vNtwCtCuF0VnzANBgkqhkiG9w0BAQsFADBs
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
ZSBFViBSb290IENBMB4XDTEzMTAyMjEyMDAwMFoXDTI4MTAyMjEyMDAwMFowcDEL
MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3
LmRpZ2ljZXJ0LmNvbTEvMC0GA1UEAxMmRGlnaUNlcnQgU0hBMiBIaWdoIEFzc3Vy
YW5jZSBTZXJ2ZXIgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2
4C/CJAbIbQRf1+8KZAayfSImZRauQkCbztyfn3YHPsMwVYcZuU+UDlqUH1VWtMIC
Kq/QmO4LQNfE0DtyyBSe75CxEamu0si4QzrZCwvV1ZX1QK/IHe1NnF9Xt4ZQaJn1
itrSxwUfqJfJ3KSxgoQtxq2lnMcZgqaFD15EWCo3j/018QsIJzJa9buLnqS9UdAn
4t07QjOjBSjEuyjMmqwrIw14xnvmXnG3Sj4I+4G3FhahnSMSTeXXkgisdaScus0X
sh5ENWV/UyU50RwKmmMbGZJ0aAo3wsJSSMs5WqK24V3B3aAguCGikyZvFEohQcft
bZvySC/zA/WiaJJTL17jAgMBAAGjggFJMIIBRTASBgNVHRMBAf8ECDAGAQH/AgEA
MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIw
NAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2Vy
dC5jb20wSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybDQuZGlnaWNlcnQuY29t
L0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUVWUm9vdENBLmNybDA9BgNVHSAENjA0MDIG
BFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQ
UzAdBgNVHQ4EFgQUUWj/kK8CB3U8zNllZGKiErhZcjswHwYDVR0jBBgwFoAUsT7D
aQP4v0cB1JgmGggC72NkK8MwDQYJKoZIhvcNAQELBQADggEBABiKlYkD5m3fXPwd
aOpKj4PWUS+Na0QWnqxj9dJubISZi6qBcYRb7TROsLd5kinMLYBq8I4g4Xmk/gNH
E+r1hspZcX30BJZr01lYPf7TMSVcGDiEo+afgv2MW5gxTs14nhr9hctJqvIni5ly

[Bug 920749] Re: pam configuration for SSH prevents LANG override

2016-09-08 Thread David Hess 
It seems that commenting out this line:

sessionrequired pam_env.so user_readenv=1
envfile=/etc/default/locale

in /etc/pam.d/sshd is the simplest resolution to this problem.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/920749

Title:
  pam configuration for SSH prevents LANG override

To manage notifications about this bug go to:
https://bugs.launchpad.net/openssh/+bug/920749/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 559364] Re: kpackagekit refuses to obey users settings

2010-06-15 Thread David Hess 
*** This bug is a duplicate of bug 477250 ***
https://bugs.launchpad.net/bugs/477250

The issue reported here is not the same as the one reported in bug
#477250.  Checking for updates without permission is one thing, but
downloading and installing them without permission is a lot different.
This really needs to be addressed.

I'm using the same system profile as v1t03k: Ubuntu 10.04 LTS with
Kernel 2.6.32-22-generic

kpackagekit is set to only notify if new updates are available, but it
is automatically downloading and installing updates without permission.

-- 
kpackagekit refuses to obey users settings
https://bugs.launchpad.net/bugs/559364
You received this bug notification because you are a member of Kubuntu
Bugs, which is subscribed to kpackagekit in ubuntu.

-- 
kubuntu-bugs mailing list
kubuntu-b...@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kubuntu-bugs