Closed mouse07410 closed 2 years ago
dengert
commented
5 years ago Is this a mismatch of OpenSSL versions. Do these both used the same libcrypto?
/opt/local/lib/engines-1.1/libpkcs11.so
/Library/OpenSC/lib/opensc-pkcs11.so
ldd (or MacOS equivalent) would show if they are using same libraries.
mouse07410
commented
5 years ago $ otool -L /opt/local/lib/engines-1.1/libpkcs11.dylib
/opt/local/lib/engines-1.1/libpkcs11.dylib:
/opt/local/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
/opt/local/lib/libcrypto.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.250.1)
$ otool -L /Library/OpenSC/lib/opensc-pkcs11.so
/Library/OpenSC/lib/opensc-pkcs11.so:
/Library/OpenSC/lib/libopensc.6.dylib (compatibility version 7.0.0, current version 7.0.0)
/usr/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.11)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.250.1)
$ /Library/OpenSC/lib/opensc-pkcs11.so is statically linked with a different version of OpenSSL (1.0.2-stable).
pkcs11.dylib is linked against OpenSSL-1.1.1c, which is installed system-wide - and all the apps, particularly those installed by Macports, are linked against this version (shared libs) as well. Only Apple-provided apps are linked against LibreSSL that Apple provides.
I just re-built OpenSC against OpenSSL-1.1.1-stable. Same hang-up by apps (git), of course. Commenting out just the line pkcs11 = pkcs11_engine in openssl.cnf resolves this problem - so it's definitely something with loading of the PKCS#11 engine. The only question is - what, and where.
mouse07410
commented
5 years ago Ping...?
dengert
commented
5 years ago I was expecting you to look at the output of otool to see what needs to be fixed. It looks like you have there may be some issues between 1.0.2 and 1.1.1 which are not handled in the linker, or the libs are passing structures that do not match.
mouse07410
commented
5 years ago I was expecting you to look at the output of
otoolto see what needs to be fixed
I don't think there's anything in my config that needs fixing. The problem seems to be with the pkcs11 engine:
$ openssl version
OpenSSL 1.1.1d 10 Sep 2019
$ type openssl
openssl is hashed (/opt/local/bin/openssl)
$ otool -L /opt/local/bin/openssl
/opt/local/bin/openssl:
/opt/local/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
/opt/local/lib/libcrypto.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
/opt/local/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.11)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.250.1)
$ otool -L /opt/local/lib/libssl.1.1.dylib
/opt/local/lib/libssl.1.1.dylib:
/opt/local/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
/opt/local/lib/libcrypto.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
/opt/local/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.11)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.250.1)
$ otool -L /opt/local/lib/libcrypto.1.1.dylib
/opt/local/lib/libcrypto.1.1.dylib:
/opt/local/lib/libcrypto.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
/opt/local/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.11)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.250.1)
$ otool -L /opt/local/lib/engines-1.1/pkcs11.dylib
/opt/local/lib/engines-1.1/pkcs11.dylib:
/opt/local/lib/libssl.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
/opt/local/lib/libcrypto.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.250.1)
$ otool -L /Library/OpenSC/lib/opensc-pkcs11.dylib
/Library/OpenSC/lib/opensc-pkcs11.dylib:
/Library/OpenSC/lib/libopensc.6.dylib (compatibility version 7.0.0, current version 7.0.0)
/opt/local/lib/libcrypto.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
/opt/local/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.11)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1252.250.1)
$ otool -L /opt/local/lib/engines-1.1/gost.1.1.dylib
/opt/local/lib/engines-1.1/gost.1.1.dylib:
@rpath/gost.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
/opt/local/lib/libcrypto.1.1.dylib (compatibility version 1.1.0, current version 1.1.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1281.0.0)
$
$ tail -35 /opt/local/etc/openssl/openssl.cnf
engines = engine_section
[engine_section]
#pkcs11 = pkcs11_section
#softhsm = softhsm_section
gost = gost_section
[pkcs11_section]
engine_id = pkcs11
dynamic_path = /opt/local/lib/engines-1.1/pkcs11.dylib
MODULE_PATH = /Library/OpenSC/lib/opensc-pkcs11.dylib
init = 0
#[softhsm_section]
#engine_id =softhsm2
#dynamic_path = /opt/local/lib/engines-1.1/libpkcs11.dylib
#MODULE_PATH = /opt/local/lib.dylibfthsm/libsofthsm2.dylib
#init = 0
[gost_section]
engine_id = gost
dynamic_path = /opt/local/lib/engines-1.1/gost.dylib
default_algorithms = ALL
CRYPT_PARAMS = id_Gost28147-89-CryptoPro-A-ParamSet
PBE_PARAMS = "gost12_512"
init = 0
####################################################################...may be some issues between 1.0.2 and 1.1.1...
I no longer have 1.0.2 on my machine(s). Everything is 1.1.1, and there's 3.0 in a special directory that's not in any PATH.
dengert
commented
5 years ago But you said: "/Library/OpenSC/lib/opensc-pkcs11.so is statically linked with a different version of OpenSSL (1.0.2-stable)."
mouse07410
commented
5 years ago you said: "/Library/OpenSC/lib/opensc-pkcs11.so is statically linked with a different version of OpenSSL (1.0.2-stable)"
Yes it was. It isn't any more. I've moved to the whole system to 1.1.1.
pboguslawski
commented
5 years ago Hello,
Similar problem in updated Debian 10; if /etc/ssl/openssl.cnf contains
[default_conf]
ssl_conf = ssl_sect
engines = engine_section
[engine_section]
pkcs11 = pkcs11_section
[pkcs11_section]
engine_id = pkcs11
dynamic_path = /usr/lib/x86_64-linux-gnu/engines-1.1/pkcs11.so
MODULE_PATH = /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so
init = 0then trying to run "puppet agent --test" (which uses TLS for communication to puppetmaster server) throws error
Error: Could not retrieve catalog from remote server: SSL_read: module initialization error
and sometimes also:
free(): double free detected in tcache 2
or
double free or corruption (!prev)
Commenting out line
engines = engine_section
or line
dynamic_path = /usr/lib/x86_64-linux-gnu/engines-1.1/pkcs11.so
in /etc/ssl/openssl.cnf resolves problem with "puppet agent --test" - no problems with connection.
Versions used:
root@d10:/etc/ssl# dpkg -s opensc-pkcs11 | grep Version
Version: 0.19.0-1
root@d10:/etc/ssl# dpkg -s libengine-pkcs11-openssl | grep Version
Version: 0.4.9-4
root@d10:/etc/ssl# dpkg -s openssl | grep Version
Version: 1.1.1d-0+deb10u1
root@d10:/etc/ssl# ldd /usr/lib/x86_64-linux-gnu/engines-1.1/pkcs11.so
linux-vdso.so.1 (0x00007ffcb10ff000)
libcrypto.so.1.1 => /lib/x86_64-linux-gnu/libcrypto.so.1.1 (0x00007fb9bf4c7000)
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fb9bf4c2000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fb9bf301000)
libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fb9bf2e0000)
/lib64/ld-linux-x86-64.so.2 (0x00007fb9bf7cb000)
root@d10:/etc/ssl# ldd /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so
linux-vdso.so.1 (0x00007ffd5abf3000)
libopensc.so.6 => /lib/x86_64-linux-gnu/libopensc.so.6 (0x00007f9e634d8000)
libcrypto.so.1.1 => /lib/x86_64-linux-gnu/libcrypto.so.1.1 (0x00007f9e631f2000)
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f9e631ed000)
libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f9e631cc000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f9e6300b000)
libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f9e62ded000)
libgio-2.0.so.0 => /lib/x86_64-linux-gnu/libgio-2.0.so.0 (0x00007f9e62c2d000)
libgobject-2.0.so.0 => /lib/x86_64-linux-gnu/libgobject-2.0.so.0 (0x00007f9e62bd8000)
libglib-2.0.so.0 => /lib/x86_64-linux-gnu/libglib-2.0.so.0 (0x00007f9e62ab9000)
/lib64/ld-linux-x86-64.so.2 (0x00007f9e636f0000)
libgmodule-2.0.so.0 => /lib/x86_64-linux-gnu/libgmodule-2.0.so.0 (0x00007f9e62ab3000)
libmount.so.1 => /lib/x86_64-linux-gnu/libmount.so.1 (0x00007f9e62a54000)
libselinux.so.1 => /lib/x86_64-linux-gnu/libselinux.so.1 (0x00007f9e6282c000)
libresolv.so.2 => /lib/x86_64-linux-gnu/libresolv.so.2 (0x00007f9e62810000)
libffi.so.6 => /lib/x86_64-linux-gnu/libffi.so.6 (0x00007f9e62806000)
libpcre.so.3 => /lib/x86_64-linux-gnu/libpcre.so.3 (0x00007f9e62792000)
libblkid.so.1 => /lib/x86_64-linux-gnu/libblkid.so.1 (0x00007f9e6273d000)
librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007f9e62733000)
libuuid.so.1 => /lib/x86_64-linux-gnu/libuuid.so.1 (0x00007f9e62728000)Regars, Paweł
lkraav
commented
4 years ago I'm getting the same double free tcache 2 crash on Linux, openssl-1.1.1d + libp11-0.4.10
$ [-] openssl-req-esteid-slot1 -x509 -new -days 3650 -sha256 -out CA-2020-v1.crt
engine "pkcs11" set.
Error configuring OpenSSL modules
139938993235776:error:26078067:engine routines:engine_list_add:conflicting engine id:crypto/engine/eng_list.c:63:
139938993235776:error:2606906E:engine routines:ENGINE_add:internal list error:crypto/engine/eng_list.c:223:
139938993235776:error:260B6067:engine routines:dynamic_load:conflicting engine id:crypto/engine/eng_dyn.c:502:
139938993235776:error:260BC066:engine routines:int_engine_configure:engine configuration error:crypto/engine/eng_cnf.c:141:section=pkcs11_section, name=dynamic_path, value=/usr/lib64/engines-1
.1/pkcs11.so
139938993235776:error:0E07606D:configuration file routines:module_run:module initialization error:crypto/conf/conf_mod.c:177:module=engines, value=engine_section, retcode=-1
free(): double free detected in tcache 2
Aborted (core dumped)EDIT things improved after I migrated from using -config parameter -> OPENSSL_CONFIG= env variable.
mtrojnar
commented
4 years ago Can you still reproduce it with the current master?
pboguslawski
commented
3 years ago Problem described in https://github.com/OpenSC/libp11/issues/294#issuecomment-539051670 does not exist in Debian 11 with
root@d11:~# dpkg -s opensc-pkcs11 | grep Version
Version: 0.21.0-1
root@d11:~# dpkg -s libengine-pkcs11-openssl | grep Version
Version: 0.4.11-1
root@d11:~# dpkg -s openssl | grep Version
Version: 1.1.1k-1+deb11u1
It is weird. MacOS 10.14.6, Xcode-10.3, OpenSSL-1.1.1c (Macports-installed), current master of libp11.
Symptoms: when PKCS#11 engine is defined,
githangs upon HTTPS retrieval. If I comment the engine out inopenssl.cnf, or tellgitto not loadopenssl.cnf- it works fine:Here's the openssl.cnf file with the middle cut off (to save space and make reading easier):
Note: commenting out "gost" engine had no effect. Commenting out "pkcs11" engine completely resolved this problem, but caused a different problem with an app that uses OpenSSL and libp11 to access smartcards.
Here's the hanging process snap, in case it can help figuring what's wrong: