search

nayakgi / perl-compiler

Automatically exported from code.google.com/p/perl-compiler
Other
0 stars 0 forks source link

IO::Socket::SSL compile-time Net::SSLeay $dh handle #317

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
$>perlcc -O3 -e 'use Net::SSLeay (); use IO::Socket::SSL (); 
Net::SSLeay::OpenSSL_add_ssl_algorithms(); my $ssl_ctx = 
IO::Socket::SSL::SSL_Context->new(SSL_server     => 1);'; ./a.out 
zsh: segmentation fault  ./a.out

Original issue reported on code.google.com by todd.e.rinaldo on 7 May 2014 at 5:06

GoogleCodeExporter commented 9 years ago 
Neato failure. Use IO::Socket::SSL is still required to make this happen.

$>perlcc -O3 -e 'use Net::SSLeay (); use IO::Socket::SSL (); 
Net::SSLeay::OpenSSL_add_ssl_algorithms(); my $ssl_ctx = bless {}, "foo";'; 
./a.out
Out of memory!
*** glibc detected *** ./a.out: free(): invalid pointer: 0xabababab ***
======= Backtrace: =========
/lib/libc.so.6[0x3f8e31]
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so(Perl_safesysfree+0x22)[0x92c9a2]
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so(+0xae4ad)[0x96d4ad]
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so(Perl_dounwind+0x54)[0x96d512]
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so(+0x2f9fa)[0x8ee9fa]
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so(+0x2faee)[0x8eeaee]
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so(Perl_savesharedpvn+0x0)[0x92c055]
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so(Perl_safesysrealloc+0x5b)[0x92ca79]
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so(Perl_savestack_grow+0x6d)[0x965884]
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so(Perl_save_pushptrptr+0x2e)[0x9662eb]
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so(Perl_save_vptr+0x1f)[0x966424]
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so(+0xc8b1b)[0x987b1b]
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so(Perl_regexec_flags+0xc38)[0x992700]
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so(Perl_pp_subst+0x3d7)[0x9435a8]
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so(Perl_runops_standard+0x1b)[0x940177]
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so(Perl_call_sv+0x225)[0x8f0e77]
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so(Perl_call_method+0x3b)[0x8f1915]
./a.out[0x8111ede]
./a.out(main+0x2b3)[0x81121c6]
/lib/libc.so.6(__libc_start_main+0xe6)[0x39ed26]
./a.out[0x8049ec1]
======= Memory map: ========
001b2000-0020c000 r-xp 00000000 fd:00 1047582    /lib/libfreebl3.so
0020c000-0020d000 r--p 00059000 fd:00 1047582    /lib/libfreebl3.so
0020d000-0020e000 rw-p 0005a000 fd:00 1047582    /lib/libfreebl3.so
0020e000-00212000 rw-p 00000000 00:00 0 
00212000-00215000 r-xp 00000000 fd:00 1732908    
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/auto/mro/m
ro.so
00215000-00216000 rw-p 00002000 fd:00 1732908    
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/auto/mro/m
ro.so
00216000-0021c000 r-xp 00000000 fd:00 1732914    
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/cpanel_lib/i386-linux-64int/auto/S
ocket/Socket.so
0021c000-0021d000 rw-p 00006000 fd:00 1732914    
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/cpanel_lib/i386-linux-64int/auto/S
ocket/Socket.so
0021d000-00260000 r-xp 00000000 fd:00 1703886    
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/cpanel_lib/i386-linux-64int/auto/N
et/SSLeay/SSLeay.so
00260000-00261000 rw-p 00042000 fd:00 1703886    
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/cpanel_lib/i386-linux-64int/auto/N
et/SSLeay/SSLeay.so
00261000-002c1000 r-xp 00000000 fd:00 1213914    /usr/lib/libssl.so.1.0.1e
002c1000-002c2000 ---p 00060000 fd:00 1213914    /usr/lib/libssl.so.1.0.1e
002c2000-002c4000 r--p 00060000 fd:00 1213914    /usr/lib/libssl.so.1.0.1e
002c4000-002c8000 rw-p 00062000 fd:00 1213914    /usr/lib/libssl.so.1.0.1e
002c8000-00306000 r-xp 00000000 fd:00 1047364    /lib/libgssapi_krb5.so.2.2
00306000-00307000 r--p 0003e000 fd:00 1047364    /lib/libgssapi_krb5.so.2.2
00307000-00308000 rw-p 0003f000 fd:00 1047364    /lib/libgssapi_krb5.so.2.2
00308000-00330000 r-xp 00000000 fd:00 1047382    /lib/libk5crypto.so.3.1
00330000-00331000 r--p 00028000 fd:00 1047382    /lib/libk5crypto.so.3.1
00331000-00332000 rw-p 00029000 fd:00 1047382    /lib/libk5crypto.so.3.1
00332000-00333000 rw-p 00000000 00:00 0 
00333000-0033d000 r-xp 00000000 fd:00 1047389    /lib/libkrb5support.so.0.1
0033d000-0033e000 r--p 00009000 fd:00 1047389    /lib/libkrb5support.so.0.1
0033e000-0033f000 rw-p 0000a000 fd:00 1047389    /lib/libkrb5support.so.0.1
00362000-00380000 r-xp 00000000 fd:00 1047428    /lib/ld-2.12.so
00380000-00381000 r--p 0001d000 fd:00 1047428    /lib/ld-2.12.so
00381000-00382000 rw-p 0001e000 fd:00 1047428    /lib/ld-2.12.so
00388000-00519000 r-xp 00000000 fd:00 1056991    /lib/libc-2.12.so
00519000-0051b000 r--p 00191000 fd:00 1056991    /lib/libc-2.12.so
0051b000-0051c000 rw-p 00193000 fd:00 1056991    /lib/libc-2.12.so
0051c000-0051f000 rw-p 00000000 00:00 0 
00521000-00524000 r-xp 00000000 fd:00 1056946    /lib/libdl-2.12.so
00524000-00525000 r--p 00002000 fd:00 1056946    /lib/libdl-2.12.so
00525000-00526000 rw-p 00003000 fd:00 1056946    /lib/libdl-2.12.so
00528000-0053f000 r-xp 00000000 fd:00 1056934    /lib/libpthread-2.12.so
0053f000-00540000 r--p 00016000 fd:00 1056934    /lib/libpthread-2.12.so
00540000-00541000 rw-p 00017000 fd:00 1056934    /lib/libpthread-2.12.so
00541000-00543000 rw-p 00000000 00:00 0 
00545000-0056d000 r-xp 00000000 fd:00 1056994    /lib/libm-2.12.so
0056d000-0056e000 r--p 00027000 fd:00 1056994    /lib/libm-2.12.so
0056e000-0056f000 rw-p 00028000 fd:00 1056994    /lib/libm-2.12.so
00571000-00583000 r-xp 00000000 fd:00 1047915    /lib/libz.so.1.2.3
00583000-00584000 r--p 00011000 fd:00 1047915    /lib/libz.so.1.2.3
00584000-00585000 rw-p 00012000 fd:00 1047915    /lib/libz.so.1.2.3
00587000-0058d000 r-xp 00000000 fd:00 1179829    /usr/lib/libgdbm.so.2.0.0
0058d000-0058e000 rw-p 00005000 fd:00 1179829    /usr/lib/libgdbm.so.2.0.0
00592000-005af000 r-xp 00000000 fd:00 1056996    /lib/libselinux.so.1
005af000-005b0000 r--p 0001c000 fd:00 1056996    /lib/libselinux.so.1
005b0000-005b1000 rw-p 0001d000 fd:00 1056996    /lib/libselinux.so.1
005b3000-005c8000 r-xp 00000000 fd:00 1057003    /lib/libresolv-2.12.so
005c8000-005c9000 ---p 00015000 fd:00 1057003    /lib/libresolv-2.12.so
005c9000-005ca000 r--p 00015000 fd:00 1057003    /lib/libresolv-2.12.so
005ca000-005cb000 rw-p 00016000 fd:00 1057003    /lib/libresolv-2.12.so
005cb000-005cd000 rw-p 00000000 00:00 0 
005cf000-005ec000 r-xp 00000000 fd:00 1056941    
/lib/libgcc_s-4.4.7-20120601.so.1
005ec000-005ed000 rw-p 0001d000 fd:00 1056941    
/lib/libgcc_s-4.4.7-20120601.so.1
00651000-00654000 r-xp 00000000 fd:00 1057006    /lib/libcom_err.so.2.1
00654000-00655000 r--p 00002000 fd:00 1057006    /lib/libcom_err.so.2.1
00655000-00656000 rw-p 00003000 fd:00 1057006    /lib/libcom_err.so.2.1
0067b000-00692000 r-xp 00000000 fd:00 1056957    /lib/libnsl-2.12.so
00692000-00693000 r--p 00016000 fd:00 1056957    /lib/libnsl-2.12.so
00693000-00694000 rw-p 00017000 fd:00 1056957    /lib/libnsl-2.12.so
00694000-00696000 rw-p 00000000 00:00 0 
00766000-0076d000 r-xp 00000000 fd:00 1056999    /lib/libcrypt-2.12.so
0076d000-0076e000 r--p 00007000 fd:00 1056999    /lib/libcrypt-2.12.so
0076e000-0076f000 rw-p 00008000 fd:00 1056999    /lib/libcrypt-2.12.so
0076f000-00796000 rw-p 00000000 00:00 0 
00798000-0079a000 r-xp 00000000 fd:00 1056952    /lib/libkeyutils.so.1.3
0079a000-0079b000 r--p 00001000 fd:00 1056952    /lib/libkeyutils.so.1.3
0079b000-0079c000 rw-p 00002000 fd:00 1056952    /lib/libkeyutils.so.1.3
007ae000-007b0000 r-xp 00000000 fd:00 1047917    /lib/libutil-2.12.so
007b0000-007b1000 r--p 00001000 fd:00 1047917    /lib/libutil-2.12.so
007b1000-007b2000 rw-p 00002000 fd:00 1047917    /lib/libutil-2.12.so
007ca000-007d1000 r-xp 00000000 fd:00 1617774    
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/cpanel_lib/i386-linux-64int/auto/L
ist/Util/Util.so
007d1000-007d2000 rw-p 00007000 fd:00 1617774    
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/cpanel_lib/i386-linux-64int/auto/L
ist/Util/Util.so
00894000-00895000 r-xp 00000000 00:00 0          [vdso]
008bf000-009c5000 r-xp 00000000 fd:00 1728783    
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so
009c5000-009ca000 rw-p 00106000 fd:00 1728783    
/usr/local/cpanel/3rdparty/perl/514/lib/perl5/5.14.4/i386-linux-64int/CORE/libpe
rl.so
009ca000-00b76000 r-xp 00000000 fd:00 1179464    /usr/lib/libcrypto.so.1.0.1e
00b76000-00b86000 r--p 001ab000 fd:00 1179464    /usr/lib/libcrypto.so.1.0.1e
00b86000-00b8d000 rw-p 001bb000 fd:00 1179464    /usr/lib/libcrypto.so.1.0.1e
00b8d000-00b90000 rw-p 00000000 00:00 0 
00c77000-00d4d000 r-xp 00000000 fd:00 1047383    /lib/libkrb5.so.3.3
00d4d000-00d53000 r--p 000d5000 fd:00 1047383    /lib/libkrb5.so.3.3
00d53000-00d54000 rw-p 000db000 fd:00 1047383    /lib/libkrb5.so.3.3
01800000-01821000 rw-p 00000000 00:00 0 
01821000-01900000 ---p 00000000 00:00 0 
01948000-08048000 rw-p 00000000 00:00 0 
08048000-08138000 r-xp 00000000 fd:00 1187951    /usr/local/cpanel/a.out
08138000-081f5000 rw-p 000ef000 fd:00 1187951    /usr/local/cpanel/a.out
081f5000-081f8000 rw-p 00000000 00:00 0 
0826a000-929ff000 rw-p 00000000 00:00 0          [heap]
92a19000-a4c56000 rw-p 00000000 00:00 0 
a4d39000-a5539000 rw-p 00000000 00:00 0 
a5539000-a6c96000 rw-p 00000000 00:00 0 
a6c96000-b3361000 rw-p 00000000 00:00 0 
b33a8000-b56a8000 rw-p 00000000 00:00 0 
b5790000-b7590000 rw-p 00000000 00:00 0 
b7590000-b7790000 r--p 00000000 fd:00 1222216    /usr/lib/locale/locale-archive
b7790000-b7793000 rw-p 00000000 00:00 0 
b77a1000-b77a3000 rw-p 00000000 00:00 0 
bfd5d000-bfd72000 rw-p 00000000 00:00 0          [stack]
zsh: abort      ./a.out

Original comment by todd.e.rinaldo on 7 May 2014 at 5:48

GoogleCodeExporter commented 9 years ago 
Actually the bless isn't necessary.

perlcc -O3 -e 'use Net::SSLeay (); use IO::Socket::SSL (); 
Net::SSLeay::OpenSSL_add_ssl_algorithms();'; ./a.out

Original comment by todd.e.rinaldo on 7 May 2014 at 5:50

GoogleCodeExporter commented 9 years ago 
Looks to be a bug in SSLeay. Reverting to Net-SSLeay-1.48 makes the problem go 
away.

Original comment by todd.e.rinaldo on 7 May 2014 at 6:32

GoogleCodeExporter commented 9 years ago 
This is basically the same issue as in #305 [cpan #94069] with Net::DNS and 
Encode.

IO::Socket::SSL is using a compile-time initialized handle from Net::SSLeay 
(openssl) 
$dh, and stores it in the my %DEFAULT_SSL_SERVER_ARGS.
But with perlcc compiled code this $dh handle will be invalid, so we SEGV in 
the best case.

We need to defer the $dh initialization for servers to run-time.

Patch submitted as [RT #95452], see https://github.com/toddr/Net-SSLeay

Original comment by reini.urban on 7 May 2014 at 9:52

GoogleCodeExporter commented 9 years ago 
Reported here with patch to upstream.

https://rt.cpan.org/Ticket/Display.html?id=95452

Original comment by todd.e.rinaldo on 7 May 2014 at 10:00

GoogleCodeExporter commented 9 years ago 
Fixed with a IO::Socket::SSL patch.
We need to add a warning for the broken IO::Socket::SSL versions, similar to 
Net::DNS

Original comment by reini.urban on 7 May 2014 at 10:03

GoogleCodeExporter commented 9 years ago 
Warning added. Unfortunately it's not easy to see if the user wanted to start a 
server or client. Only servers are affected.

commit 5013a31de057b755046222eedea897f06c175271
Author: Reini Urban <rurban@cpanel.net>
Date:   Wed May 7 17:26:43 2014 -0500

    C: add #317 IO::Socket::SSL::VERSION warning 1.956-1.983

    IO::Socket::SSL stores a $dh handle to a Net::SSLey XS object at compile-time, which
    address varies at run-time. Unfixable for now with perlcc (re-initialize $dh default server args)

Original comment by reini.urban on 7 May 2014 at 10:36

GoogleCodeExporter commented 9 years ago 
re-opening
A similar SEGV reappeared with IO::Socket::SSL 1.994 at 
$rv = Net::SSLeay::CTX_set_tmp_dh( $ctx,$dh ) (SSL.pm:2291)

The static $dh handle from Net::SSLeay::PEM_read_bio_DHparams($bio) initialized 
in %DEFAULT_SSL_SERVER_ARGS is not re-initialized.

Original comment by reini.urban on 11 Jul 2014 at 1:59

GoogleCodeExporter commented 9 years ago 
I see. Upstream decided to reject the ticket, because he didn't understand the 
issue and didn't want to fix it, because he refers to other irrelevant static 
initialization issues.
https://rt.cpan.org/Public/Bug/Display.html?id=95452

"as far as I understand your problem it boils down to using non-perl Code (e.g. 
XS module) and perlcc fails to freeze the state of this code and restore it 
later. In this case I don't think that the issue can be solved for 
IO::Socket::SSL. It could be resolved for the special case of the SSL_dh 
parameter, but there are other initializations in the code which cannot be 
fixed this way:
- when loading IO::Socket::SSL it will run various initialization, e.g. to add 
algorithms, load error strings etc. 
- According to Net::SSLeay (see the part about threading) these kind of 
initializations should be done in the main program, and not in each thread in 
the case of multithreaded programs. Otherwise this might lead to strange 
crashes (and I've seen such crashes when people try to require IO::Socket::SSL 
per thread).
- so just doing these initializations on first use, like you do with the SSL_dh 
parameter, is not an option, because the first use might not be in the main 
thread.

So currently I see no way to solve the problem in a way which does not 
introduce worse problems. And just fixing the SSL_dh case and leaving the other 
problems in also not an option for me, because it only fixes part of the 
problem, but obscures the rest so it might make it even harder too debug.

That's why I will set this bug for now at rejected, but if you have a good 
idea, how the whole issue can be resolved without creating new problems feel 
free to reopen it.

Sorry for not being that helpful,
Steffen"

Looks like we have to maintain now our own Net::SSLeay module now with the 
patch from 
https://github.com/noxxi/p5-io-socket-ssl/pull/13
and prominently warn about this problem and the solution.

Original comment by reini.urban on 11 Jul 2014 at 2:05

GoogleCodeExporter commented 9 years ago 
Oops, IO::Socket::SSL of course, not Net::SSLeay. Only IO::Socket::SSL is to 
blame here.

Original comment by reini.urban on 11 Jul 2014 at 2:07

GoogleCodeExporter commented 9 years ago 
Reini, you mention cPanel::IO::Socket::SSL, however our current policy is to 
patch around the issue in the cPanel perl module's RPM where we cannot convince 
upstream authors to take a patch. cPanel will not need cPanel::IO::Socket::SSL.

Original comment by todd.e.rinaldo on 11 Jul 2014 at 3:36

GoogleCodeExporter commented 9 years ago 
B::C needs to be able to decide when B::C needs to patch it or warn or die or 
not. cPanel internal patches cannot be detected and maintained this way. We 
only have the name and the version number. 
Since you even refuse the up the number to a _01 or such, a name change is much 
better and safer.

In this case IO::Socket::SSL revised its decisions, and 1.49 can use it now.

Original comment by reini.urban on 14 Jul 2014 at 1:44