Re: Issues with test framework against OpenSSL 3.2

David Anes <david.anes@xxxxxxxxxxxxxxxxxxxx> · Fri, 26 Jan 2024 11:17:33 +0100

Hello everyone,

After fighting the tests, I can confirm that the issue is certificates are not being verified correctly.

For example, for t/protocol/echo.t, I was able to make it pass by updating vhost_socket in TestRequest.pm by bypassing cert verification:

    Index: httpd-2.4.58/httpd-framework/Apache-Test/lib/Apache/TestRequest.pm
    ===================================================================
    --- httpd-2.4.58.orig/httpd-framework/Apache-Test/lib/Apache/TestRequest.pm
    +++ httpd-2.4.58/httpd-framework/Apache-Test/lib/Apache/TestRequest.pm
    @@ -34,6 +34,8 @@ use constant UA_TIMEOUT => 60 * 10; #lon

    my $have_lwp = 0;

    +use IO::Socket::SSL;
    +
    # APACHE_TEST_PRETEND_NO_LWP=1 pretends that LWP is not available so
    # one can test whether the test suite survives if the user doesn't
    # have lwp installed
    @@ -296,7 +298,15 @@ sub vhost_socket {
            require IO::Socket::SSL;
            # Add all conn_opts to args
            map {$args{$_} = $conn_opts->{$_}} keys %{$conn_opts};
    -        return IO::Socket::SSL->new(%args, Timeout => UA_TIMEOUT);
    +
    +        my $sock = IO::Socket::SSL->new(
    +            %args,
    +            Timeout => UA_TIMEOUT,
    +            SSL_verify_mode => SSL_VERIFY_NONE,
    +        ) or die "failed connect or ssl handshake: $!, $SSL_ERROR";
    +
    +        return $sock
    +
        }
        else {
            require IO::Socket;

Of course, this is not the way to move forward, as I understand all cert verification should work.

My guess is that in TestSSLCA.pm, when all certificates are generated, we are missing some option and/or tweaks. Unfortunately I'm not a security expert and I would like someone with more knowledge to look into this, if possible.

Basically, all tests fail with a similar trace as this one:

    ssl_engine_kernel.c(2213): [client 127.0.0.1:33114] OpenSSL: Loop: SSLv3/TLS write finished
    ssl_engine_kernel.c(2213): [client 127.0.0.1:33114] OpenSSL: Loop: TLSv1.3 early data
    ssl_engine_io.c(2401): [client 127.0.0.1:33114] OpenSSL: read 5/5 bytes from BIO#7fb2a40045c0 [mem: 7fb2a401c523] (BIO dump follows)
    ssl_engine_io.c(2331): [client 127.0.0.1:33114] +-------------------------------------------------------------------------+
    ssl_engine_io.c(2368): [client 127.0.0.1:33114] | 0000: 15 03 03 00 02                                   .....            |
    ssl_engine_io.c(2373): [client 127.0.0.1:33114] +-------------------------------------------------------------------------+
    ssl_engine_io.c(2401): [client 127.0.0.1:33114] OpenSSL: read 2/2 bytes from BIO#7fb2a40045c0 [mem: 7fb2a401c528] (BIO dump follows)
    ssl_engine_io.c(2331): [client 127.0.0.1:33114] +-------------------------------------------------------------------------+
    ssl_engine_io.c(2368): [client 127.0.0.1:33114] | 0000: 02 30                                            .0               |
    ssl_engine_io.c(2373): [client 127.0.0.1:33114] +-------------------------------------------------------------------------+
    ssl_engine_kernel.c(2218): [client 127.0.0.1:33114] OpenSSL: Read: TLSv1.3 early data
    ssl_engine_kernel.c(2242): [client 127.0.0.1:33114] OpenSSL: Exit: error in error
    [client 127.0.0.1:33114] AH02008: SSL library error 1 in handshake (server laptop:8532)
    SSL Library Error: error:0A000418:SSL routines::tlsv1 alert unknown ca (SSL alert number 48)
    [client 127.0.0.1:33114] AH01998: Connection closed to child 9 with abortive shutdown (server laptop:8532)

The key here is the "unknown ca", failing the handshake, either because the trust chain is broken somehow or the certs need to be generated now in a different way with OpenSSL 3.2.

Any idea to move forward?

Cheers,
David.

On 25/01/2024 13:54, David Anes wrote: