Bug 1675441

Summary: p11-kit version 0.23.15-1.fc28.x86_64 breaks google chrome networking
Product: [Fedora] Fedora Reporter: Andrej Kvasnica <andrej>
Component: p11-kitAssignee: Daiki Ueno <dueno>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: urgent Docs Contact:
Priority: unspecified    
Version: 28CC: andrej, crypto-team, dueno, kengert, mpreisle, stefw, tmraz, tuju
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: p11-kit-0.23.15-2.fc29 p11-kit-0.23.15-2.fc28 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-02-21 02:57:18 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Andrej Kvasnica 2019-02-11 21:06:37 UTC
Description of problem:
after upgrade p11-kit-0.23.15-1.fc28.x86_64 and p11-kit-trust-0.23.15-1.fc28.x86_64 the Google Chrome 73 beta dies and after restart it was unable to load any page showing NET::ERR_CERT_AUTHORITY_INVALID error. Also Chrome 72 stable was dead. Firefox 63.0.3 was ok all the time.

Version-Release number of selected component (if applicable):
p11-kit-0.23.10-1.fc28.x86_64 or p11-kit-trust-0.23.15-1.fc28.x86_64 is broken

How reproducible:
upgrade p11-kit-0.23.10-1.fc28.x86_64, it will ugprade also the p11-kit-trust-0.23.15-1.fc28.x86_64 and the chrome network is broken

Steps to Reproduce:
1. upgrade package
2. start chrome
3. open https://www.google.com/

Actual results:
NET::ERR_CERT_AUTHORITY_INVALID

Expected results:
page loaded

Additional info:
chrome startup:

./chrome --disable-extensions
p11-kit: 'ret >=0' not true at loader_load_directory
...
p11-kit: 'ret >=0' not true at loader_load_directory
[11146:11212:0211/214214.350453:ERROR:cert_verify_proc_nss.cc(974)] CERT_PKIXVerifyCert for www.gstatic.com failed err=-8179
[11146:11159:0211/214214.351127:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202
p11-kit: 'ret >=0' not true at loader_load_directory
[11146:11169:0211/214214.354508:ERROR:cert_verify_proc_nss.cc(974)] CERT_PKIXVerifyCert for clientservices.googleapis.com failed err=-8179
[11146:11159:0211/214214.355135:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202
p11-kit: 'ret >=0' not true at loader_load_directory
[11146:11172:0211/214214.358845:ERROR:cert_verify_proc_nss.cc(974)] CERT_PKIXVerifyCert for accounts.google.com failed err=-8179
[11146:11159:0211/214214.359285:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202
p11-kit: 'ret >=0' not true at loader_load_directory
[11146:11173:0211/214214.363410:ERROR:cert_verify_proc_nss.cc(974)] CERT_PKIXVerifyCert for www.google.com failed err=-8179
[11146:11159:0211/214214.363927:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202
[11146:11159:0211/214214.364163:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202
[11146:11159:0211/214214.364564:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202
[11146:11159:0211/214215.284927:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202
[11146:11159:0211/214217.908678:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202
[11146:11159:0211/214219.123594:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202
p11-kit: 'ret >=0' not true at loader_load_directory
...
p11-kit: 'ret >=0' not true at loader_load_directory
[11146:11169:0211/214224.173239:ERROR:cert_verify_proc_nss.cc(974)] CERT_PKIXVerifyCert for ssl.gstatic.com failed err=-8179
[11146:11159:0211/214224.173529:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202
[11146:11159:0211/214224.173628:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202
[11146:11159:0211/214226.872145:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202
[11146:11159:0211/214232.668509:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202
[11146:11159:0211/214232.669021:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202

Comment 1 Daiki Ueno 2019-02-14 16:45:15 UTC
Could you run chrome under P11_KIT_DEBUG=trust to get more information?

Comment 2 Andrej Kvasnica 2019-02-15 23:59:01 UTC
Hello Daiki,

it seems I was able to find the reason:

after running the chrome as
$ P11_KIT_DEBUG=trust /usr/bin/google-chrome-beta 

the p11-kit was complaining about

(p11-kit:20884) loader_load_file: failed to parse: /usr/share/pki/ca-trust-source/anchors/private-ca.cer

The /usr/share/pki/ca-trust-source/anchors/private-ca.cer was an root-owned certificate with -rw------- access rights.

After changing access rights to -rw-r--r-- everything is ok now.

The older version (p11-kit-0.23.10-1.fc28.x86_64) was fine about unreadable file.

Greetings to Brno!

Best regards,
a.

Comment 3 Daiki Ueno 2019-02-18 10:25:24 UTC
Thank you; this looks like a regression after:
https://github.com/p11-glue/p11-kit/pull/206
in particular this commit:
https://github.com/p11-glue/p11-kit/pull/206/commits/e7deb704f4385fabe50d81bcc7c6478c928ca38e

Comment 4 Daiki Ueno 2019-02-18 13:57:05 UTC
https://github.com/p11-glue/p11-kit/pull/215

Comment 5 Fedora Update System 2019-02-19 06:27:56 UTC
p11-kit-0.23.15-2.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-563a9058ee

Comment 6 Fedora Update System 2019-02-19 07:07:22 UTC
p11-kit-0.23.15-2.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-04bcb2f1b9

Comment 7 Fedora Update System 2019-02-21 02:57:18 UTC
p11-kit-0.23.15-2.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2019-03-06 15:27:44 UTC
p11-kit-0.23.15-2.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.