Bug 2155867 - enabling the legacy provider in openssl.cnf makes squid -k parse die with a SEGV
Summary: enabling the legacy provider in openssl.cnf makes squid -k parse die with a SEGV
Keywords:
Status: NEW
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: squid
Version: 9.1
Hardware: x86_64
OS: Linux
low
low
Target Milestone: rc
: ---
Assignee: Luboš Uhliarik
QA Contact: rhel-cs-infra-services-qe
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-12-22 17:11 UTC by Walter Haidinger
Modified: 2023-08-03 22:59 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openssl openssl issues 20118 0 None open squid crash on exit 2023-01-23 16:35:42 UTC
Red Hat Issue Tracker CRYPTO-9267 0 None None None 2023-01-13 17:08:41 UTC
Red Hat Issue Tracker RHELPLAN-143099 0 None None None 2022-12-22 17:24:07 UTC

Description Walter Haidinger 2022-12-22 17:11:15 UTC 
Description of problem:
Enabling the legacy provider in openssl.cnf makes "squid -k parse" die with a SEGV. 

Version-Release number of selected component (if applicable):
openssl-libs-3.0.1-43.el9_0.x86_64
squid-5.5-3.el9_1.x86_64

How reproducible: always (I think)
Reproduced in a fresh minimal install of RHEL 9.1/x64 in Virtualbox 7 but it was first noticed in a VM hosted by VMware vSphere 7.

Steps to Reproduce:
1. Enable (uncomment) the legacy provider in /etc/pki/tls/openssl.cnf

[provider_sect]
default = default_sect
legacy = legacy_sect
##
[default_sect]
activate = 1

[legacy_sect]
activate = 1

2. Try to parse squid config:
squid -k parse -f /etc/squid/squid.conf.default

Actual results:
...
2022/12/22 18:04:29| Initializing https:// proxy context
2022/12/22 18:04:29| Requiring client certificates.
Segmentation fault (core dumped)

Expected results:
No SEGV by squid -k parse

Additional info:
The actual squid config does not matter. 
Also throws a SEGV with an empty squid.conf.
Comment 1 Dmitry Belyavskiy 2023-01-23 16:35:10 UTC 
Dear Walter,

Does squid introduce any atexit handlers?
Comment 2 Walter Haidinger 2023-01-31 09:56:17 UTC 
No idea. We're just squid users and noticed the bug because we try to test the config before applying it via puppet.
The openssl legacy provider is required for a different software unrelated to squid.
Comment 3 Dmitry Belyavskiy 2023-01-31 09:58:37 UTC 
Changing the component then.
Comment 4 Dustin Marquess 2023-08-03 22:59:04 UTC 
Same happens with nmap when fed a script that uses openssl (eg, ssl-enum-ciphers.nse)
Note You need to log in before you can comment on or make changes to this bug.