Bug 2155867

Summary:	enabling the legacy provider in openssl.cnf makes squid -k parse die with a SEGV
Product:	Red Hat Enterprise Linux 9	Reporter:	Walter Haidinger <whaidinger>
Component:	squid	Assignee:	Luboš Uhliarik <luhliari>
Status:	NEW ---	QA Contact:	rhel-cs-infra-services-qe <rhel-cs-infra-services-qe>
Severity:	low	Docs Contact:
Priority:	low
Version:	9.1	CC:	cllang, ddm
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Walter Haidinger 2022-12-22 17:11:15 UTC

Description of problem:
Enabling the legacy provider in openssl.cnf makes "squid -k parse" die with a SEGV. 

Version-Release number of selected component (if applicable):
openssl-libs-3.0.1-43.el9_0.x86_64
squid-5.5-3.el9_1.x86_64

How reproducible: always (I think)
Reproduced in a fresh minimal install of RHEL 9.1/x64 in Virtualbox 7 but it was first noticed in a VM hosted by VMware vSphere 7.

Steps to Reproduce:
1. Enable (uncomment) the legacy provider in /etc/pki/tls/openssl.cnf

[provider_sect]
default = default_sect
legacy = legacy_sect
##
[default_sect]
activate = 1

[legacy_sect]
activate = 1

2. Try to parse squid config:
squid -k parse -f /etc/squid/squid.conf.default

Actual results:
...
2022/12/22 18:04:29| Initializing https:// proxy context
2022/12/22 18:04:29| Requiring client certificates.
Segmentation fault (core dumped)

Expected results:
No SEGV by squid -k parse

Additional info:
The actual squid config does not matter. 
Also throws a SEGV with an empty squid.conf.

Comment 1 Dmitry Belyavskiy 2023-01-23 16:35:10 UTC

Dear Walter,

Does squid introduce any atexit handlers?

Comment 2 Walter Haidinger 2023-01-31 09:56:17 UTC

No idea. We're just squid users and noticed the bug because we try to test the config before applying it via puppet.
The openssl legacy provider is required for a different software unrelated to squid.

Comment 3 Dmitry Belyavskiy 2023-01-31 09:58:37 UTC

Changing the component then.

Comment 4 Dustin Marquess 2023-08-03 22:59:04 UTC

Same happens with nmap when fed a script that uses openssl (eg, ssl-enum-ciphers.nse)