Welcome! Log In Create A New Profile

Advanced

Re: [PATCH] SSL: Add ENGINE_init() calls before using engines.

Anderson Sasaki
May 18, 2018 04:38AM
Hello,

> The patch looks correct to me. Though it causes a segmentation
> faults within pkcs11 engine when using such loaded keys at least
> on Ubuntu 18.04 (OpenSSL 1.1.0g, pkcs11 engine from libp11 0.4.7).
> Segmentation faults can be reproduced with the test you've sent
> earlier.
>
> Using an explitic "init = 1" in openssl.conf resolves this, as
> well as commenting out ENGINE_finish(), so it looks like it cannot
> handle ENGINE_finish() while certificates loaded from the engine
> are still in use.
>
> Possible options might be:
>
> - avoid any changes, and require "init = 1" as we effectively do
> now;
>
> - add explicit lists of engines initialized, and call
> ENGINE_finish() once no longer needed (probably somewhere in
> ngx_ssl_cleanup_ctx());
>
> - avoid calling ENGINE_finish() with appropriate explanation of
> the problem;
>
> - dig further into what goes on in OpenSSL / pkcs11 engine, and
> fix things (might be already resolved in [1]).
>
> [1]
> https://github.com/OpenSC/libp11/commit/da725ab727342083478150a203a3c80c4551feb4

The root of the problem is solved in the patch you pointed out above. The libp11-0.4.7 release is missing this EVP_PKEY_set1_engine() call. Without this, the engine is not properly associated with the EVP_PKEY object, preventing the OpenSSL automatic re-initialization of the engine to take place when the key is used.

With the inclusion of such patch, the ENGINE_finish() can be safely called. As long as the key keeps the structural reference to the engine, it will be re-initialized when needed.

I've tested in Fedora, where the same problem occurs. Since I am currently a co-maintainer of the engine in Fedora, I can fix it there. But I can't fix it on Ubuntu.

Best Regards,
Anderson
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel
Subject Author Views Posted

[PATCH] SSL: Add ENGINE_init() calls before using engines.

Anderson Sasaki 260 April 25, 2018 11:54AM

Re: [PATCH] SSL: Add ENGINE_init() calls before using engines.

Anderson Sasaki 28 April 25, 2018 12:12PM

Re: [PATCH] SSL: Add ENGINE_init() calls before using engines.

Пичулин Дмитрий Николаевич 27 April 25, 2018 12:42PM

Re: [PATCH] SSL: Add ENGINE_init() calls before using engines.

Anderson Sasaki 29 April 25, 2018 01:50PM

Re: [PATCH] SSL: Add ENGINE_init() calls before using engines.

Пичулин Дмитрий Николаевич 27 April 25, 2018 04:00PM

Re: [PATCH] SSL: Add ENGINE_init() calls before using engines.

Anderson Sasaki 20 April 26, 2018 12:40PM

Re: [PATCH] SSL: Add ENGINE_init() calls before using engines.

Пичулин Дмитрий Николаевич 29 April 26, 2018 03:34PM

Re: [PATCH] SSL: Add ENGINE_init() calls before using engines.

Maxim Dounin 34 April 27, 2018 09:42AM

Re: [PATCH] SSL: Add ENGINE_init() calls before using engines.

Anderson Sasaki 45 April 27, 2018 11:30AM

Re: [PATCH] SSL: Add ENGINE_init() calls before using engines.

Maxim Dounin 27 May 03, 2018 10:34AM

Re: [PATCH] SSL: Add ENGINE_init() calls before using engines.

Anderson Sasaki 24 May 10, 2018 12:44PM

Re: [PATCH] SSL: Add ENGINE_init() calls before using engines.

Maxim Dounin 35 May 17, 2018 04:30PM

Re: [PATCH] SSL: Add ENGINE_init() calls before using engines.

Anderson Sasaki 31 May 18, 2018 04:38AM

Re: [PATCH] SSL: Add ENGINE_init() calls before using engines.

Maxim Dounin 41 May 22, 2018 10:20AM

Re: [PATCH] SSL: Add ENGINE_init() calls before using engines.

Maxim Dounin 27 April 26, 2018 09:34AM

Re: [PATCH] SSL: Add ENGINE_init() calls before using engines.

Anderson Sasaki 24 April 26, 2018 12:56PM



Sorry, you do not have permission to post/reply in this forum.

Online Users

Guests: 103
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 254 on July 05, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready