You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Rainer Jung <ra...@kippdata.de> on 2014/03/11 21:29:59 UTC
Re: [VOTE] Release Apache httpd 2.4.8 as GA
On 11.03.2014 17:34, Jim Jagielski wrote:
> The pre-release test tarballs for Apache httpd 2.4.8 can be found
> at the usual place:
>
> http://httpd.apache.org/dev/dist/
>
> I'm calling a VOTE on releasing these as Apache httpd 2.4.8 GA.
>
> [ ] +1: Good to go
> [ ] +0: meh
> [ ] -1: Danger Will Robinson. And why.
>
> Vote will last the normal 72 hrs.
>
> NOTE: The *-deps are only there for convenience.
I get a segfault during startup init on www.apache.org when using SSL.
This didn't happen for r1570851. Candidate is r1573360.
That server currently uses OpenSSL 1.0.1e.
GDB:
Program terminated with signal 11, Segmentation fault.
#0 0x000000010287a19a in ssl_set_cert_masks () from
/usr/local/lib/libssl.so.8
(gdb) bt full
#0 0x000000010287a19a in ssl_set_cert_masks () from
/usr/local/lib/libssl.so.8
No symbol table info available.
#1 0x000000010287a6f6 in ssl_get_server_send_pkey () from
/usr/local/lib/libssl.so.8
No symbol table info available.
#2 0x000000010287a7a9 in ssl_get_server_send_cert () from
/usr/local/lib/libssl.so.8
No symbol table info available.
#3 0x0000000102616d2a in ssl_init_server_certs (pphrases=0x10226ab58,
mctx=0x10227d938, ptemp=<optimized out>, p=<optimized out>, s=<optimized
out>) at ssl_engine_init.c:959
No locals.
#4 ssl_init_server_ctx (pphrases=<optimized out>, sc=<optimized out>,
ptemp=<optimized out>, p=<optimized out>, s=<optimized out>) at
ssl_engine_init.c:1287
No locals.
#5 ssl_init_ConfigureServer (s=0x102277350, p=0x102023028,
ptemp=0x102051028, sc=0x10227d7d8, pphrases=<optimized out>) at
ssl_engine_init.c:1378
rv = <optimized out>
#6 0x0000000102617cfc in ssl_init_Module (p=0x102023028,
plog=<optimized out>, ptemp=0x102051028, base_server=0x10204dbe8) at
ssl_engine_init.c:228
mc = <optimized out>
sc = <optimized out>
s = 0x102277350
rv = 0
pphrases = 0x10226ab58
#7 0x000000000044965c in ap_run_post_config (pconf=0x102023028,
plog=0x10204f028, ptemp=0x102051028, s=0x10204dbe8) at config.c:103
n = 4
rv = <optimized out>
#8 0x000000000042afd7 in main (argc=9, argv=0x7fffffffd8c0) at main.c:696
c = 68 'D'
showcompile = 0
showdirectives = 0
confname = 0x7fffffffdbb7 "/.../conf/httpd.conf"
def_server_root = 0x4655c0 "/..."
temp_error_log = 0x0
error = <optimized out>
process = 0x102021118
pconf = 0x102023028
plog = 0x10204f028
ptemp = 0x102051028
pcommands = 0x102045028
opt = 0x102045118
rv = <optimized out>
opt_arg = 0x7fffffffdbfa "SSL"
...
#3 0x0000000102616d2a in ssl_init_server_certs (pphrases=0x10226ab58,
mctx=0x10227d938, ptemp=<optimized out>, p=<optimized out>, s=<optimized
out>) at ssl_engine_init.c:959
959 if (!(ssl = SSL_new(mctx->ssl_ctx)) ||
(gdb) print *pphrases
$1 = {pool = 0x102051028, elt_size = 8, nelts = 0, nalloc = 2, elts =
0x10226ab78 ""}
(gdb) print *mctx
$2 = {sc = 0x10227d7d8, ssl_ctx = 0x102185600, pks = 0x10227da20, pkp =
0x0, ticket_key = 0x10227dab0, protocol = 6, pphrase_dialog_type =
SSL_PPTYPE_BUILTIN,
pphrase_dialog_path = 0x0, cert_chain = 0x1022784c0 "/....crt",
crl_path = 0x0, crl_file = 0x0,
crl_check_mode = SSL_CRLCHECK_UNSET, stapling_enabled = 0,
stapling_resptime_skew = -1, stapling_resp_maxage = -1,
stapling_cache_timeout = -1,
stapling_return_errors = 4294967295, stapling_fake_trylater =
4294967295, stapling_errcache_timeout = -1, stapling_responder_timeout =
-1, stapling_force_url = 0x0,
srp_vfile = 0x0, srp_unknown_user_seed = 0x0, srp_vbase = 0x0, auth =
{ca_cert_path = 0x0, ca_cert_file = 0x0,
cipher_suite = 0x102108d18 "...", verify_depth = 1, verify_mode =
SSL_CVERIFY_NONE},
ocsp_enabled = 0, ocsp_force_default = 0, ocsp_responder = 0x0,
ocsp_resptime_skew = -1, ocsp_resp_maxage = -1, ocsp_responder_timeout = -1}
Config structure is roughly:
<VirtualHost _default_:443>
ServerName ...
DocumentRoot ...
SSLEngine on
SSLCACertificateFile ....pem
SSLCertificateFile ....crt
SSLCertificateKeyFile ....key
SSLCertificateChainFile ....pem
</VirtualHost>
<VirtualHost *:443>
SSLEngine on
SSLCertificateFile ....crt
SSLCertificateKeyFile ....key
SSLCertificateChainFile ....crt
DocumentRoot ...
ServerName ...
ServerAlias ...
UseCanonicalName On
non-ssl config items
</VirtualHost>
<VirtualHost *:443>
ServerName ...
UseCanonicalName Off
VirtualDocumentRoot ...
VirtualScriptAlias ...
ServerAlias ...
SSLEngine on
SSLCertificateFile ....crt
SSLCertificateKeyFile ....key
SSLCertificateChainFile ....crt
non-ssl config items
</VirtualHost>
The certificates etc. in the three blocks are three different ones.
I'll have a look what I can find out, just an early heads-up.
Regards,
Rainer
Re: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by Rainer Jung <ra...@kippdata.de>.
On 12.03.2014 18:39, William A. Rowe Jr. wrote:
> On Wed, 12 Mar 2014 00:30:57 +0000
> Dr Stephen Henson <sh...@opensslfoundation.com> wrote:
>
>> On 11/03/2014 21:46, Gregg Smith wrote:
>>> On 3/11/2014 1:29 PM, Rainer Jung wrote:
>>>> On 11.03.2014 17:34, Jim Jagielski wrote:
>>>>> The pre-release test tarballs for Apache httpd 2.4.8 can be found
>>>>> at the usual place:
>>>>>
>>>>> http://httpd.apache.org/dev/dist/
>>>>>
>>>>> I'm calling a VOTE on releasing these as Apache httpd 2.4.8 GA.
>>>>>
>>>>> [ ] +1: Good to go
>>>>> [ ] +0: meh
>>>>> [ ] -1: Danger Will Robinson. And why.
>>>>>
>>>>> Vote will last the normal 72 hrs.
>>>>>
>>>>> NOTE: The *-deps are only there for convenience.
>>>> I get a segfault during startup init on www.apache.org when using
>>>> SSL. This didn't happen for r1570851. Candidate is r1573360.
>>>
>>> I'm seeing this with OpenSSL 0.9.8y on Windows.
>>>
>>
>> Here are some more details of the bug in OpenSSL I *think* triggers
>> this.
>>
>> The function SSL_get_certificate was modified in some versions of
>> OpenSSL to return the certificate the server used instead of the
>> current certificate it had done previously. This was to make OCSP
>> stapling work with multiple configured certificates. Unfortunately a
>> bug in the change mean it would crash if it was called before the
>> server sent the certificate. Later versions of OpenSSL restored the
>> original behaviour unless SSL_get_certificate was called inside the
>> OCSP callback when it would return the certificate actually sent.
>>
>> The fix was applied on Feb 11 2013. That would mean that official
>> releases affected would be 0.9.8y, 1.0.0j and 1.0.1c. Any later
>> official release should include the fix but we weren't planning to
>> make any more 0.9.8 official releases though a 0.9.8 snapshot should
>> include the fix.
>
> Perhaps a typo above? Or are we looking at several bugs? Rainer had
> specifically mentioned 1.0.1e as faulting.
>
> I'm of the same mind as Jim - that a 2.4.9 with some workaround patch
> as described is probably a good idea, but now I'm not clear whether
> the proposed workaround fixes the case you mention with 1.0.1c or also
> the 1.0.1e fault?
I think the problematic code is in 0.9.8y, 1.0.0k, 1.0.1d and 1.0.1e. It
has been fixed in the latest 1.0.0 and 1.0.1 releases and the fix is in
HEAD for 0.9.8 but not released. The problem should not occur with
versions older than the cited ones.
Regards,
Rainer
Re: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by Dr Stephen Henson <sh...@opensslfoundation.com>.
On 12/03/2014 17:39, William A. Rowe Jr. wrote:
>>
>> The fix was applied on Feb 11 2013. That would mean that official
>> releases affected would be 0.9.8y, 1.0.0j and 1.0.1c. Any later
>> official release should include the fix but we weren't planning to
>> make any more 0.9.8 official releases though a 0.9.8 snapshot should
>> include the fix.
>
> Perhaps a typo above? Or are we looking at several bugs? Rainer had
> specifically mentioned 1.0.1e as faulting.
>
Yes sorry. It's all the same single bug. Checking through the versions:
For 0.9.8 branches: 0.9.8y affected, only fixed in 0.9.8 snapshots.
For 1.0.0 branches: 1.0.0k affected fixed in 1.0.0l
For 1.0.1 branches: 1.0.1d, 1.0.1e affected fixed in 1.0.0f
Steve.
--
Dr Stephen Henson. OpenSSL Software Foundation, Inc.
1829 Mount Ephraim Road
Adamstown, MD 21710
+1 877-673-6775
shenson@opensslfoundation.com
Re: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by "William A. Rowe Jr." <wr...@rowe-clan.net>.
On Wed, 12 Mar 2014 00:30:57 +0000
Dr Stephen Henson <sh...@opensslfoundation.com> wrote:
> On 11/03/2014 21:46, Gregg Smith wrote:
> > On 3/11/2014 1:29 PM, Rainer Jung wrote:
> >> On 11.03.2014 17:34, Jim Jagielski wrote:
> >>> The pre-release test tarballs for Apache httpd 2.4.8 can be found
> >>> at the usual place:
> >>>
> >>> http://httpd.apache.org/dev/dist/
> >>>
> >>> I'm calling a VOTE on releasing these as Apache httpd 2.4.8 GA.
> >>>
> >>> [ ] +1: Good to go
> >>> [ ] +0: meh
> >>> [ ] -1: Danger Will Robinson. And why.
> >>>
> >>> Vote will last the normal 72 hrs.
> >>>
> >>> NOTE: The *-deps are only there for convenience.
> >> I get a segfault during startup init on www.apache.org when using
> >> SSL. This didn't happen for r1570851. Candidate is r1573360.
> >
> > I'm seeing this with OpenSSL 0.9.8y on Windows.
> >
>
> Here are some more details of the bug in OpenSSL I *think* triggers
> this.
>
> The function SSL_get_certificate was modified in some versions of
> OpenSSL to return the certificate the server used instead of the
> current certificate it had done previously. This was to make OCSP
> stapling work with multiple configured certificates. Unfortunately a
> bug in the change mean it would crash if it was called before the
> server sent the certificate. Later versions of OpenSSL restored the
> original behaviour unless SSL_get_certificate was called inside the
> OCSP callback when it would return the certificate actually sent.
>
> The fix was applied on Feb 11 2013. That would mean that official
> releases affected would be 0.9.8y, 1.0.0j and 1.0.1c. Any later
> official release should include the fix but we weren't planning to
> make any more 0.9.8 official releases though a 0.9.8 snapshot should
> include the fix.
Perhaps a typo above? Or are we looking at several bugs? Rainer had
specifically mentioned 1.0.1e as faulting.
I'm of the same mind as Jim - that a 2.4.9 with some workaround patch
as described is probably a good idea, but now I'm not clear whether
the proposed workaround fixes the case you mention with 1.0.1c or also
the 1.0.1e fault?
Re: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by Graham Leggett <mi...@sharp.fm>.
On 12 Mar 2014, at 12:37 PM, Jim Jagielski <ji...@jaguNET.com> wrote:
> At the very least, upgrading from 2.4.7 to 2.4.8 should not
> cause this much pain. I will let the vote run a bit more to
> gauge additional feedback, but my sense says that 2.4.8
> will likely be revoked/dropped and 2.4.9 will be proposed
> which either (1) removes r1573360 or (2) fixes this bug.
+1.
Regards,
Graham
--
Re: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by Jim Jagielski <ji...@jaguNET.com>.
On Mar 12, 2014, at 8:29 AM, Rainer Jung <ra...@kippdata.de> wrote:
> On 12.03.2014 11:37, Jim Jagielski wrote:
>> At the very least, upgrading from 2.4.7 to 2.4.8 should not
>> cause this much pain. I will let the vote run a bit more to
>> gauge additional feedback, but my sense says that 2.4.8
>> will likely be revoked/dropped and 2.4.9 will be proposed
>> which either (1) removes r1573360 or (2) fixes this bug.
>
> Agreed, if it were only about 1.0.1e vs. 1.0.1f it would be not that big
> an issue but since all Major versions seem to show the behavior and
> there's no easy workaround for 0.9.8 except upgrading to 1.x, I'd say we
> should implement the workaround suggested by Steve.
>
We'll need to put that into trunk, check that it works w/o
causing a regression, first.
My personal opinion is to pull out the commit in 2.4.x to give it
more time in trunk to ferment and to release 2.4.9 w/o r1573360.
Re: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by Jim Jagielski <ji...@jaguNET.com>.
I have added this is a SHOWSTOPPER patch for 2.4.x...
I will try to find a system where the bug exists to
test.
On Mar 12, 2014, at 11:17 AM, Rainer Jung <ra...@kippdata.de> wrote:
> On 12.03.2014 14:55, Dr Stephen Henson wrote:
>> On 12/03/2014 12:29, Rainer Jung wrote:
>>> On 12.03.2014 11:37, Jim Jagielski wrote:
>>>> At the very least, upgrading from 2.4.7 to 2.4.8 should not
>>>> cause this much pain. I will let the vote run a bit more to
>>>> gauge additional feedback, but my sense says that 2.4.8
>>>> will likely be revoked/dropped and 2.4.9 will be proposed
>>>> which either (1) removes r1573360 or (2) fixes this bug.
>>>
>>> Agreed, if it were only about 1.0.1e vs. 1.0.1f it would be not that big
>>> an issue but since all Major versions seem to show the behavior and
>>> there's no easy workaround for 0.9.8 except upgrading to 1.x, I'd say we
>>> should implement the workaround suggested by Steve.
>>>
>>
>> Applied to trunk as r1576741. I've tried to keep the changes to the absolute
>> minimum.
>>
>> I've tested OpenSSL 0.9.8y without this change and can reproduce the crash. It
>> doesn't crash with this fix.
>
> OK, saw that message to late, functionaly equivalent with what I tried
> (and you proposed). So agreed, this fixes it.
>
> Rainer
Re: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by Rainer Jung <ra...@kippdata.de>.
On 12.03.2014 14:55, Dr Stephen Henson wrote:
> On 12/03/2014 12:29, Rainer Jung wrote:
>> On 12.03.2014 11:37, Jim Jagielski wrote:
>>> At the very least, upgrading from 2.4.7 to 2.4.8 should not
>>> cause this much pain. I will let the vote run a bit more to
>>> gauge additional feedback, but my sense says that 2.4.8
>>> will likely be revoked/dropped and 2.4.9 will be proposed
>>> which either (1) removes r1573360 or (2) fixes this bug.
>>
>> Agreed, if it were only about 1.0.1e vs. 1.0.1f it would be not that big
>> an issue but since all Major versions seem to show the behavior and
>> there's no easy workaround for 0.9.8 except upgrading to 1.x, I'd say we
>> should implement the workaround suggested by Steve.
>>
>
> Applied to trunk as r1576741. I've tried to keep the changes to the absolute
> minimum.
>
> I've tested OpenSSL 0.9.8y without this change and can reproduce the crash. It
> doesn't crash with this fix.
OK, saw that message to late, functionaly equivalent with what I tried
(and you proposed). So agreed, this fixes it.
Rainer
Re: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by Dr Stephen Henson <sh...@opensslfoundation.com>.
On 12/03/2014 12:29, Rainer Jung wrote:
> On 12.03.2014 11:37, Jim Jagielski wrote:
>> At the very least, upgrading from 2.4.7 to 2.4.8 should not
>> cause this much pain. I will let the vote run a bit more to
>> gauge additional feedback, but my sense says that 2.4.8
>> will likely be revoked/dropped and 2.4.9 will be proposed
>> which either (1) removes r1573360 or (2) fixes this bug.
>
> Agreed, if it were only about 1.0.1e vs. 1.0.1f it would be not that big
> an issue but since all Major versions seem to show the behavior and
> there's no easy workaround for 0.9.8 except upgrading to 1.x, I'd say we
> should implement the workaround suggested by Steve.
>
Applied to trunk as r1576741. I've tried to keep the changes to the absolute
minimum.
I've tested OpenSSL 0.9.8y without this change and can reproduce the crash. It
doesn't crash with this fix.
Steve.
--
Dr Stephen Henson. OpenSSL Software Foundation, Inc.
1829 Mount Ephraim Road
Adamstown, MD 21710
+1 877-673-6775
shenson@opensslfoundation.com
RE: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by Plüm,
Rüdiger,
Vodafone Group <ru...@vodafone.com>.
> -----Original Message-----
> From: Rainer Jung [mailto:rainer.jung@kippdata.de]
> Sent: Mittwoch, 12. März 2014 13:30
> To: dev@httpd.apache.org
> Subject: Re: [VOTE] Release Apache httpd 2.4.8 as GA
>
> On 12.03.2014 11:37, Jim Jagielski wrote:
> > At the very least, upgrading from 2.4.7 to 2.4.8 should not
> > cause this much pain. I will let the vote run a bit more to
> > gauge additional feedback, but my sense says that 2.4.8
> > will likely be revoked/dropped and 2.4.9 will be proposed
> > which either (1) removes r1573360 or (2) fixes this bug.
>
> Agreed, if it were only about 1.0.1e vs. 1.0.1f it would be not that big
> an issue but since all Major versions seem to show the behavior and
> there's no easy workaround for 0.9.8 except upgrading to 1.x, I'd say we
> should implement the workaround suggested by Steve.
+1
Regards
Rüdiger
Re: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by Rainer Jung <ra...@kippdata.de>.
On 12.03.2014 11:37, Jim Jagielski wrote:
> At the very least, upgrading from 2.4.7 to 2.4.8 should not
> cause this much pain. I will let the vote run a bit more to
> gauge additional feedback, but my sense says that 2.4.8
> will likely be revoked/dropped and 2.4.9 will be proposed
> which either (1) removes r1573360 or (2) fixes this bug.
Agreed, if it were only about 1.0.1e vs. 1.0.1f it would be not that big
an issue but since all Major versions seem to show the behavior and
there's no easy workaround for 0.9.8 except upgrading to 1.x, I'd say we
should implement the workaround suggested by Steve.
Regards,
Rainer
Re: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by Jim Jagielski <ji...@jaguNET.com>.
At the very least, upgrading from 2.4.7 to 2.4.8 should not
cause this much pain. I will let the vote run a bit more to
gauge additional feedback, but my sense says that 2.4.8
will likely be revoked/dropped and 2.4.9 will be proposed
which either (1) removes r1573360 or (2) fixes this bug.
On Mar 11, 2014, at 8:59 PM, Dr Stephen Henson <sh...@opensslfoundation.com> wrote:
> On 12/03/2014 00:30, Dr Stephen Henson wrote:
>>
>> The fix was applied on Feb 11 2013. That would mean that official releases
>> affected would be 0.9.8y, 1.0.0j and 1.0.1c. Any later official release should
>> include the fix but we weren't planning to make any more 0.9.8 official releases
>> though a 0.9.8 snapshot should include the fix.
>>
>> OS specific versions of OpenSSL might not have included the fix. This is the
>> actual diff:
>>
>> http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=147dbb2fe3bead7a10
>>
>
> It looks like the only case this can happen is ssl_init_server_certs where an
> SSL structure is created, SSL_get_certificate called and then it is freed.
>
> If so then calling SSL_set_connect_state before the SSL_get_certificate
> call is a potential workaround. This works because the faulty code isn't used by
> SSL structures where ssl->server == 0 and SSL_set_connect_state does that,
> among other things.
>
> This is a bit of a hack because it's called on a server SSL structure. This
> would probably fail horribly if an attempt was made to use the SSL structure but
> in this case we're freeing it up immediately so this should hopefully not matter.
>
> Steve.
> --
> Dr Stephen Henson. OpenSSL Software Foundation, Inc.
> 1829 Mount Ephraim Road
> Adamstown, MD 21710
> +1 877-673-6775
> shenson@opensslfoundation.com
>
Re: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by Rainer Jung <ra...@kippdata.de>.
On 12.03.2014 01:59, Dr Stephen Henson wrote:
> On 12/03/2014 00:30, Dr Stephen Henson wrote:
>>
>> The fix was applied on Feb 11 2013. That would mean that official releases
>> affected would be 0.9.8y, 1.0.0j and 1.0.1c. Any later official release should
>> include the fix but we weren't planning to make any more 0.9.8 official releases
>> though a 0.9.8 snapshot should include the fix.
>>
>> OS specific versions of OpenSSL might not have included the fix. This is the
>> actual diff:
>>
>> http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=147dbb2fe3bead7a10
>>
>
> It looks like the only case this can happen is ssl_init_server_certs where an
> SSL structure is created, SSL_get_certificate called and then it is freed.
>
> If so then calling SSL_set_connect_state before the SSL_get_certificate
> call is a potential workaround. This works because the faulty code isn't used by
> SSL structures where ssl->server == 0 and SSL_set_connect_state does that,
> among other things.
>
> This is a bit of a hack because it's called on a server SSL structure. This
> would probably fail horribly if an attempt was made to use the SSL structure but
> in this case we're freeing it up immediately so this should hopefully not matter.
Following your advice I added the following patch:
http://people.apache.org/~rjung/patches/ssl-init-crash.patch
and switched back to using OpenSSL 1.0.1e. Indeed the crash during
startup didn't occur with that patch in place.
I will wait a bit and if I hear no complains apply to trunk (if noone
beats me to it).
Regards,
Rainer
Re: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by Dr Stephen Henson <sh...@opensslfoundation.com>.
On 12/03/2014 00:30, Dr Stephen Henson wrote:
>
> The fix was applied on Feb 11 2013. That would mean that official releases
> affected would be 0.9.8y, 1.0.0j and 1.0.1c. Any later official release should
> include the fix but we weren't planning to make any more 0.9.8 official releases
> though a 0.9.8 snapshot should include the fix.
>
> OS specific versions of OpenSSL might not have included the fix. This is the
> actual diff:
>
> http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=147dbb2fe3bead7a10
>
It looks like the only case this can happen is ssl_init_server_certs where an
SSL structure is created, SSL_get_certificate called and then it is freed.
If so then calling SSL_set_connect_state before the SSL_get_certificate
call is a potential workaround. This works because the faulty code isn't used by
SSL structures where ssl->server == 0 and SSL_set_connect_state does that,
among other things.
This is a bit of a hack because it's called on a server SSL structure. This
would probably fail horribly if an attempt was made to use the SSL structure but
in this case we're freeing it up immediately so this should hopefully not matter.
Steve.
--
Dr Stephen Henson. OpenSSL Software Foundation, Inc.
1829 Mount Ephraim Road
Adamstown, MD 21710
+1 877-673-6775
shenson@opensslfoundation.com
Re: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by Dr Stephen Henson <sh...@opensslfoundation.com>.
On 11/03/2014 21:46, Gregg Smith wrote:
> On 3/11/2014 1:29 PM, Rainer Jung wrote:
>> On 11.03.2014 17:34, Jim Jagielski wrote:
>>> The pre-release test tarballs for Apache httpd 2.4.8 can be found
>>> at the usual place:
>>>
>>> http://httpd.apache.org/dev/dist/
>>>
>>> I'm calling a VOTE on releasing these as Apache httpd 2.4.8 GA.
>>>
>>> [ ] +1: Good to go
>>> [ ] +0: meh
>>> [ ] -1: Danger Will Robinson. And why.
>>>
>>> Vote will last the normal 72 hrs.
>>>
>>> NOTE: The *-deps are only there for convenience.
>> I get a segfault during startup init on www.apache.org when using SSL.
>> This didn't happen for r1570851. Candidate is r1573360.
>
> I'm seeing this with OpenSSL 0.9.8y on Windows.
>
Here are some more details of the bug in OpenSSL I *think* triggers this.
The function SSL_get_certificate was modified in some versions of OpenSSL to
return the certificate the server used instead of the current certificate it had
done previously. This was to make OCSP stapling work with multiple configured
certificates. Unfortunately a bug in the change mean it would crash if it was
called before the server sent the certificate. Later versions of OpenSSL
restored the original behaviour unless SSL_get_certificate was called inside the
OCSP callback when it would return the certificate actually sent.
The fix was applied on Feb 11 2013. That would mean that official releases
affected would be 0.9.8y, 1.0.0j and 1.0.1c. Any later official release should
include the fix but we weren't planning to make any more 0.9.8 official releases
though a 0.9.8 snapshot should include the fix.
OS specific versions of OpenSSL might not have included the fix. This is the
actual diff:
http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=147dbb2fe3bead7a10
Steve.
--
Dr Stephen Henson. OpenSSL Software Foundation, Inc.
1829 Mount Ephraim Road
Adamstown, MD 21710
+1 877-673-6775
shenson@opensslfoundation.com
Re: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by Gregg Smith <gl...@gknw.net>.
On 3/11/2014 1:29 PM, Rainer Jung wrote:
> On 11.03.2014 17:34, Jim Jagielski wrote:
>> The pre-release test tarballs for Apache httpd 2.4.8 can be found
>> at the usual place:
>>
>> http://httpd.apache.org/dev/dist/
>>
>> I'm calling a VOTE on releasing these as Apache httpd 2.4.8 GA.
>>
>> [ ] +1: Good to go
>> [ ] +0: meh
>> [ ] -1: Danger Will Robinson. And why.
>>
>> Vote will last the normal 72 hrs.
>>
>> NOTE: The *-deps are only there for convenience.
> I get a segfault during startup init on www.apache.org when using SSL.
> This didn't happen for r1570851. Candidate is r1573360.
I'm seeing this with OpenSSL 0.9.8y on Windows.
> That server currently uses OpenSSL 1.0.1e.
>
> GDB:
>
> Program terminated with signal 11, Segmentation fault.
> #0 0x000000010287a19a in ssl_set_cert_masks () from
> /usr/local/lib/libssl.so.8
> (gdb) bt full
> #0 0x000000010287a19a in ssl_set_cert_masks () from
> /usr/local/lib/libssl.so.8
> No symbol table info available.
> #1 0x000000010287a6f6 in ssl_get_server_send_pkey () from
> /usr/local/lib/libssl.so.8
> No symbol table info available.
> #2 0x000000010287a7a9 in ssl_get_server_send_cert () from
> /usr/local/lib/libssl.so.8
> No symbol table info available.
> #3 0x0000000102616d2a in ssl_init_server_certs (pphrases=0x10226ab58,
> mctx=0x10227d938, ptemp=<optimized out>, p=<optimized out>, s=<optimized
> out>) at ssl_engine_init.c:959
> No locals.
> #4 ssl_init_server_ctx (pphrases=<optimized out>, sc=<optimized out>,
> ptemp=<optimized out>, p=<optimized out>, s=<optimized out>) at
> ssl_engine_init.c:1287
> No locals.
> #5 ssl_init_ConfigureServer (s=0x102277350, p=0x102023028,
> ptemp=0x102051028, sc=0x10227d7d8, pphrases=<optimized out>) at
> ssl_engine_init.c:1378
> rv =<optimized out>
> #6 0x0000000102617cfc in ssl_init_Module (p=0x102023028,
> plog=<optimized out>, ptemp=0x102051028, base_server=0x10204dbe8) at
> ssl_engine_init.c:228
> mc =<optimized out>
> sc =<optimized out>
> s = 0x102277350
> rv = 0
> pphrases = 0x10226ab58
> #7 0x000000000044965c in ap_run_post_config (pconf=0x102023028,
> plog=0x10204f028, ptemp=0x102051028, s=0x10204dbe8) at config.c:103
> n = 4
> rv =<optimized out>
> #8 0x000000000042afd7 in main (argc=9, argv=0x7fffffffd8c0) at main.c:696
> c = 68 'D'
> showcompile = 0
> showdirectives = 0
> confname = 0x7fffffffdbb7 "/.../conf/httpd.conf"
> def_server_root = 0x4655c0 "/..."
> temp_error_log = 0x0
> error =<optimized out>
> process = 0x102021118
> pconf = 0x102023028
> plog = 0x10204f028
> ptemp = 0x102051028
> pcommands = 0x102045028
> opt = 0x102045118
> rv =<optimized out>
> opt_arg = 0x7fffffffdbfa "SSL"
>
> ...
>
> #3 0x0000000102616d2a in ssl_init_server_certs (pphrases=0x10226ab58,
> mctx=0x10227d938, ptemp=<optimized out>, p=<optimized out>, s=<optimized
> out>) at ssl_engine_init.c:959
> 959 if (!(ssl = SSL_new(mctx->ssl_ctx)) ||
>
> (gdb) print *pphrases
> $1 = {pool = 0x102051028, elt_size = 8, nelts = 0, nalloc = 2, elts =
> 0x10226ab78 ""}
>
> (gdb) print *mctx
> $2 = {sc = 0x10227d7d8, ssl_ctx = 0x102185600, pks = 0x10227da20, pkp =
> 0x0, ticket_key = 0x10227dab0, protocol = 6, pphrase_dialog_type =
> SSL_PPTYPE_BUILTIN,
> pphrase_dialog_path = 0x0, cert_chain = 0x1022784c0 "/....crt",
> crl_path = 0x0, crl_file = 0x0,
> crl_check_mode = SSL_CRLCHECK_UNSET, stapling_enabled = 0,
> stapling_resptime_skew = -1, stapling_resp_maxage = -1,
> stapling_cache_timeout = -1,
> stapling_return_errors = 4294967295, stapling_fake_trylater =
> 4294967295, stapling_errcache_timeout = -1, stapling_responder_timeout =
> -1, stapling_force_url = 0x0,
> srp_vfile = 0x0, srp_unknown_user_seed = 0x0, srp_vbase = 0x0, auth =
> {ca_cert_path = 0x0, ca_cert_file = 0x0,
> cipher_suite = 0x102108d18 "...", verify_depth = 1, verify_mode =
> SSL_CVERIFY_NONE},
> ocsp_enabled = 0, ocsp_force_default = 0, ocsp_responder = 0x0,
> ocsp_resptime_skew = -1, ocsp_resp_maxage = -1, ocsp_responder_timeout = -1}
>
> Config structure is roughly:
>
> <VirtualHost _default_:443>
> ServerName ...
> DocumentRoot ...
> SSLEngine on
> SSLCACertificateFile ....pem
> SSLCertificateFile ....crt
> SSLCertificateKeyFile ....key
> SSLCertificateChainFile ....pem
> </VirtualHost>
>
> <VirtualHost *:443>
> SSLEngine on
> SSLCertificateFile ....crt
> SSLCertificateKeyFile ....key
> SSLCertificateChainFile ....crt
>
> DocumentRoot ...
> ServerName ...
> ServerAlias ...
> UseCanonicalName On
>
> non-ssl config items
> </VirtualHost>
>
> <VirtualHost *:443>
> ServerName ...
> UseCanonicalName Off
> VirtualDocumentRoot ...
> VirtualScriptAlias ...
> ServerAlias ...
>
> SSLEngine on
> SSLCertificateFile ....crt
> SSLCertificateKeyFile ....key
> SSLCertificateChainFile ....crt
>
> non-ssl config items
> </VirtualHost>
>
> The certificates etc. in the three blocks are three different ones.
>
> I'll have a look what I can find out, just an early heads-up.
>
> Regards,
>
> Rainer
Re: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by Rainer Jung <ra...@kippdata.de>.
On 11.03.2014 21:53, Rainer Jung wrote:
> On 11.03.2014 21:41, Dr Stephen Henson wrote:
>> On 11/03/2014 20:29, Rainer Jung wrote:
>>> On 11.03.2014 17:34, Jim Jagielski wrote:
>>>> The pre-release test tarballs for Apache httpd 2.4.8 can be found
>>>> at the usual place:
>>>>
>>>> http://httpd.apache.org/dev/dist/
>>>>
>>>> I'm calling a VOTE on releasing these as Apache httpd 2.4.8 GA.
>>>>
>>>> [ ] +1: Good to go
>>>> [ ] +0: meh
>>>> [ ] -1: Danger Will Robinson. And why.
>>>>
>>>> Vote will last the normal 72 hrs.
>>>>
>>>> NOTE: The *-deps are only there for convenience.
>>>
>>> I get a segfault during startup init on www.apache.org when using SSL.
>>> This didn't happen for r1570851. Candidate is r1573360.
>>>
>>> That server currently uses OpenSSL 1.0.1e.
>>>
>>> GDB:
>>>
>>> Program terminated with signal 11, Segmentation fault.
>>> #0 0x000000010287a19a in ssl_set_cert_masks () from
>>> /usr/local/lib/libssl.so.8
>>> (gdb) bt full
>>> #0 0x000000010287a19a in ssl_set_cert_masks () from
>>> /usr/local/lib/libssl.so.8
>>> No symbol table info available.
>>> #1 0x000000010287a6f6 in ssl_get_server_send_pkey () from
>>> /usr/local/lib/libssl.so.8
>>
>> Could be a known issue in OpenSSL 1.0.1e which is fixed in 1.0.1f.
>
> Thanks Steve. Will try, actually was on my way to update when I noticed
> there was not yet a BSD port for 1.0.1f. Will try nevertheless.
Updating to OpenSSL 1.0.1f fixed it.
Regards,
Rainer
Re: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by Rainer Jung <ra...@kippdata.de>.
On 11.03.2014 21:41, Dr Stephen Henson wrote:
> On 11/03/2014 20:29, Rainer Jung wrote:
>> On 11.03.2014 17:34, Jim Jagielski wrote:
>>> The pre-release test tarballs for Apache httpd 2.4.8 can be found
>>> at the usual place:
>>>
>>> http://httpd.apache.org/dev/dist/
>>>
>>> I'm calling a VOTE on releasing these as Apache httpd 2.4.8 GA.
>>>
>>> [ ] +1: Good to go
>>> [ ] +0: meh
>>> [ ] -1: Danger Will Robinson. And why.
>>>
>>> Vote will last the normal 72 hrs.
>>>
>>> NOTE: The *-deps are only there for convenience.
>>
>> I get a segfault during startup init on www.apache.org when using SSL.
>> This didn't happen for r1570851. Candidate is r1573360.
>>
>> That server currently uses OpenSSL 1.0.1e.
>>
>> GDB:
>>
>> Program terminated with signal 11, Segmentation fault.
>> #0 0x000000010287a19a in ssl_set_cert_masks () from
>> /usr/local/lib/libssl.so.8
>> (gdb) bt full
>> #0 0x000000010287a19a in ssl_set_cert_masks () from
>> /usr/local/lib/libssl.so.8
>> No symbol table info available.
>> #1 0x000000010287a6f6 in ssl_get_server_send_pkey () from
>> /usr/local/lib/libssl.so.8
>
> Could be a known issue in OpenSSL 1.0.1e which is fixed in 1.0.1f.
Thanks Steve. Will try, actually was on my way to update when I noticed
there was not yet a BSD port for 1.0.1f. Will try nevertheless.
Regards,
Rainer
Re: [VOTE] Release Apache httpd 2.4.8 as GA
Posted by Dr Stephen Henson <sh...@opensslfoundation.com>.
On 11/03/2014 20:29, Rainer Jung wrote:
> On 11.03.2014 17:34, Jim Jagielski wrote:
>> The pre-release test tarballs for Apache httpd 2.4.8 can be found
>> at the usual place:
>>
>> http://httpd.apache.org/dev/dist/
>>
>> I'm calling a VOTE on releasing these as Apache httpd 2.4.8 GA.
>>
>> [ ] +1: Good to go
>> [ ] +0: meh
>> [ ] -1: Danger Will Robinson. And why.
>>
>> Vote will last the normal 72 hrs.
>>
>> NOTE: The *-deps are only there for convenience.
>
> I get a segfault during startup init on www.apache.org when using SSL.
> This didn't happen for r1570851. Candidate is r1573360.
>
> That server currently uses OpenSSL 1.0.1e.
>
> GDB:
>
> Program terminated with signal 11, Segmentation fault.
> #0 0x000000010287a19a in ssl_set_cert_masks () from
> /usr/local/lib/libssl.so.8
> (gdb) bt full
> #0 0x000000010287a19a in ssl_set_cert_masks () from
> /usr/local/lib/libssl.so.8
> No symbol table info available.
> #1 0x000000010287a6f6 in ssl_get_server_send_pkey () from
> /usr/local/lib/libssl.so.8
Could be a known issue in OpenSSL 1.0.1e which is fixed in 1.0.1f.
Steve.
--
Dr Stephen Henson. OpenSSL Software Foundation, Inc.
1829 Mount Ephraim Road
Adamstown, MD 21710
+1 877-673-6775
shenson@opensslfoundation.com