Closed mouse07410 closed 2 years ago
mouse07410
commented
3 years ago On another machine, tests with OpenSSL-3 pass (except pkcs11-uri-without-token.softhsm and search-all-matching-tokens.softhsm).
Any recommendation how to track this problem down?
Jakuje
commented
3 years ago Do you have master version or latest release? There are were couple of issues that surfaced with 3.0, for example https://github.com/OpenSC/libp11/pull/406
With the above change, libp11 works fine for us in Fedora with OpenSSL 3.0.
Invalid command '--version'; type "help" for a list.
This sounds like some command/tool is missing on your machine. Running the script with "set -x" or something to log what is actually being called might give you some more information.
mouse07410
commented
3 years ago Do you have master version or latest release?
Master version. Compiled and installed from the source.
invalid command '--version'; type "help" for a list.This sounds like some command/tool is missing on your machine
That was caused by my silly mistake - I added openssl --version to the tests/rsa-evp-sign.softhsm script, forgetting that it should be openssl version.
And, to my surprise, the tests with OpenSSL-3.0.0 all pass.
However, with OpenSSL-3.1.dev 13 out of 15 still fail.
ossl3-build.txt test-suite.log
Crash reports for some tests:
Process: evp-sign [63899]
Path: /Users/USER/*/evp-sign
Identifier: evp-sign
Version: 0
Code Type: X86-64 (Native)
Parent Process: bash [63869]
Responsible: Terminal [813]
User ID: 501
Date/Time: 2021-11-16 12:16:53.505 -0500
OS Version: macOS 11.6.1 (20G224)
Report Version: 12
Bridge OS Version: 6.0 (19P548)
Anonymous UUID: BD844EB9-9C6F-867E-78EB-1ACDA55970A0
Time Awake Since Boot: 530000 seconds
System Integrity Protection: enabled
Crashed Thread: 0 Dispatch queue: com.apple.main-thread
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000
Exception Note: EXC_CORPSE_NOTIFY
Termination Signal: Segmentation fault: 11
Termination Reason: Namespace SIGNAL, Code 0xb
Terminating Process: exc handler [63899]
VM Regions Near 0:
-->
__TEXT 10f53e000-10f542000 [ 16K] r-x/r-x SM=COW /Users/*
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 libsystem_pthread.dylib 0x00007fff20511b7b pthread_rwlock_wrlock + 0
1 libcrypto.3.dylib 0x000000010fe999ac CRYPTO_THREAD_write_lock + 9
2 libcrypto.3.dylib 0x000000010fe4e773 ENGINE_finish + 30
3 libsofthsm2.so 0x000000010fce2b58 OSSLCryptoFactory::~OSSLCryptoFactory() + 28
4 libsofthsm2.so 0x000000010fce2bf4 OSSLCryptoFactory::~OSSLCryptoFactory() + 14
5 libsystem_c.dylib 0x00007fff20443d25 __cxa_finalize_ranges + 316
6 libsystem_c.dylib 0x00007fff20444010 exit + 53
7 libdyld.dylib 0x00007fff2052ff44 start + 8Process: rsa-oaep [64054]
Path: /Users/USER/*/rsa-oaep
Identifier: rsa-oaep
Version: 0
Code Type: X86-64 (Native)
Parent Process: bash [64041]
Responsible: Terminal [813]
User ID: 501
Date/Time: 2021-11-16 12:16:59.916 -0500
OS Version: macOS 11.6.1 (20G224)
Report Version: 12
Bridge OS Version: 6.0 (19P548)
Anonymous UUID: BD844EB9-9C6F-867E-78EB-1ACDA55970A0
Time Awake Since Boot: 530000 seconds
System Integrity Protection: enabled
Crashed Thread: 0 Dispatch queue: com.apple.main-thread
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000
Exception Note: EXC_CORPSE_NOTIFY
Termination Signal: Segmentation fault: 11
Termination Reason: Namespace SIGNAL, Code 0xb
Terminating Process: exc handler [64054]
VM Regions Near 0:
-->
__TEXT 1086fe000-108702000 [ 16K] r-x/r-x SM=COW /Users/*
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 libsystem_pthread.dylib 0x00007fff20511b7b pthread_rwlock_wrlock + 0
1 libcrypto.3.dylib 0x000000010905a9ac CRYPTO_THREAD_write_lock + 9
2 libcrypto.3.dylib 0x000000010900f773 ENGINE_finish + 30
3 libsofthsm2.so 0x0000000108ea3b58 OSSLCryptoFactory::~OSSLCryptoFactory() + 28
4 libsofthsm2.so 0x0000000108ea3bf4 OSSLCryptoFactory::~OSSLCryptoFactory() + 14
5 libsystem_c.dylib 0x00007fff20443d25 __cxa_finalize_ranges + 316
6 libsystem_c.dylib 0x00007fff20444010 exit + 53
7 libdyld.dylib 0x00007fff2052ff44 start + 8It looks like all the crashes are related to pthread locking???
mouse07410
commented
2 years ago Here's a bit more details. It looks like the problem comes when the engine finishes:
OpenSSL crypto demo completed.
AddressSanitizer:DEADLYSIGNAL
=================================================================
==18400==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fff2035db7b bp 0x7ffeea264ae0 sp 0x7ffeea264ad8 T0)
==18400==The signal is caused by a READ memory access.
==18400==Hint: address points to the zero page.
#0 0x7fff2035db7b in pthread_rwlock_wrlock+0x0 (libsystem_pthread.dylib:x86_64+0x3b7b)
#1 0x109ad3772 in ENGINE_finish+0x1d (libcrypto.3.dylib:x86_64+0xe3772)
#2 0x109967b57 in OSSLCryptoFactory::~OSSLCryptoFactory()+0x1b (libsofthsm2.so:x86_64+0x3bb57)
#3 0x109967bf3 in OSSLCryptoFactory::~OSSLCryptoFactory()+0xd (libsofthsm2.so:x86_64+0x3bbf3)
#4 0x7fff2028fd24 in __cxa_finalize_ranges+0x13b (libsystem_c.dylib:x86_64+0x5ad24)
#5 0x7fff2029000f in exit+0x34 (libsystem_c.dylib:x86_64+0x5b00f)
#6 0x7fff2037bf43 in start+0x7 (libdyld.dylib:x86_64+0x15f43)
==18400==Register values:
rax = 0x00000001099aed50 rbx = 0x0000611000020340 rcx = 0x00007fff80657238 rdx = 0x0000000000000000
rdi = 0x0000000000000000 rsi = 0x00000001059c6030 rbp = 0x00007ffeea264ae0 rsp = 0x00007ffeea264ad8
r8 = 0x000000000073cf3a r9 = 0xffffffff00000000 r10 = 0x00007fff80657230 r11 = 0x00000fffffffffff
r12 = 0x0000000000000002 r13 = 0x0000000000000000 r14 = 0x0000000109ca8808 r15 = 0x000000000000000d
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (libsystem_pthread.dylib:x86_64+0x3b7b) in pthread_rwlock_wrlock+0x0
==18400==ABORTING
Abort trap: 6Somewhere between libp11 and OpenSSL there's double-free during cleanup when engine finishes.
Any help, please?
Jakuje
commented
2 years ago I would assume there are already some unstable stuff in the 3.1 branch. I would suggest you to stick to the 3.0 branch if you want to be up to date. 3.1 branch is not even in alpha as far as I know so I would bet on some issue/incompatibility on the openssl side.
mouse07410
commented
2 years ago Understood, but I observe the same issue with OpenSSL-1.1.1.
Somehow, 3.0.0 doesn't exhibit it.
mouse07410
commented
2 years ago I found the problem.
$ openssl11 pkeyutl -engine pkcs11 -keyform engine -decrypt -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha384 -pkeyopt rsa_mgf1_md:sha384 -inkey "pkcs11:model=YubiHSM;manufacturer=Yubico%20%28www.yubico.com%29;token=YubiHSM;id=%04%02;object=RSA-OAEP;type=private" -in /tmp/oaep.oaep
engine "pkcs11" set.
Enter PKCS#11 token PIN for YubiHSM:
6e6a8f11eddcec5c2c4761b5d5a4389afab878c48e790cf3
$ openssl3 version
OpenSSL 3.1.0-dev (Library: OpenSSL 3.1.0-dev )
$ openssl3 pkeyutl -engine pkcs11 -keyform engine -decrypt -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha384 -pkeyopt rsa_mgf1_md:sha384 -inkey "pkcs11:model=YubiHSM;manufacturer=Yubico%20%28www.yubico.com%29;token=YubiHSM;id=%04%02;object=RSA-OAEP;type=private" -in /tmp/oaep.oaep
Engine "pkcs11" set.
Enter PKCS#11 token PIN for YubiHSM:
6e6a8f11eddcec5c2c4761b5d5a4389afab878c48e790cf3
$ 
mtrojnar
commented
2 years ago Does your Macports-built SoftHSMv2 include this commit? https://github.com/opendnssec/SoftHSMv2/commit/2793f3cafb3ea22fe61ad4fc1c626c8121cd4124 Otherwise, we're fighting the non-reentrant OpenSSL's engine initialization/finalization again.
Config
MacOS Big Sur 11.6.1, Xcode-13.1, OpenSSL-3.0.0 (Macports-installed to
/opt/local) and 3.1.dev (locally installed into$HOME/openssl-3).Problem
Majority of the tests are failing now, like this:
Crash report:
engine.cnf:Same results/errors from my fork and your master. test-conf-out.txt test-check-out.txt test-suite.log ec-cert-store.softhsm.log search-all-matching-tokens.softhsm.log ec-check-privkey.softhsm.log rsa-oaep.softhsm.log rsa-evp-sign.softhsm.log