OCSP request with --phone-out and with supplied binary when using systemd for host resolution with my*entries segfaults

[multiflexi]

The error is:
testssl.sh/testssl.sh: line 2031: 3055367 Segmentation fault $OPENSSL ocsp -no_nonce ${host_header} -url "$uri" -issuer $TEMPDIR/hostcert_issuer.pem -verify_other $TEMPDIR/intermediatecerts.pem -CAfile <(cat $ADDTL_CA_FILES "$GOOD_CA_BUNDLE") -cert $HOSTCERT -text &> "$tmpfile"

This happens with --phone-out with supplied openssl (the bad version), but when the openssl is compiled from the source, the error does not occur. Also it does not occur with the system provided openssl.

Using the latest 3.2 version
Tested distros: Fedora 40, Ubuntu 22.04 and Slackware 15

[drwetter]

Hi @multiflexi ,
thanks for reporting. Smells like a DNS thing we had before.

• does it only happen using --phone-out?
• would you mind to strace that?

[multiflexi]

Yes, only with --phone-out.
strace.txt

[drwetter]

Ok, thanks! I meant just the command which segfaulted. I'll guess I'll find the segfault in the hay stack later ;-)

[drwetter]

Plan is to compile the binaries on a newer platform , while tackling #2356

[drwetter]

Hi @multiflexi : can you please try his binary: https://testssl.sh/openssl-1.0.2k-bad/openssl.Linux.x86_64.static and let me know whether it works?

[multiflexi]

Hi, sorry for the delay. It still outputs Segmentation fault:
OCSP URI http://GEANT.ocsp.sectigo.com./testssl.sh: line 2044: 72580 Segmentation fault (core dumped) $OPENSSL ocsp -no_nonce ${host_header} -url "$uri" -issuer $TEMPDIR/hostcert_issuer.pem -verify_other $TEMPDIR/intermediatecerts.pem -CAfile <(cat $ADDTL_CA_FILES "$GOOD_CA_BUNDLE") -cert $HOSTCERT -text &> "$tmpfile"

[drwetter]

Sigh. OK, thanks. That was on Fedora 40 only and not on Ubuntu 22.04?

In the above strace I maybe found something fishy but I can't really tell.
I would ease matters if exactly the command above could be "straced". By either copy and pasting the exact command on the command line and putting strace -f -o file.txt before the openssl command. Or doing that by inserting strace -f -o file.txt into that openssl command @ testssl.sh.

Does that happen when checking a specific host or any host?

[multiflexi]

This was on current Manjaro. Today I also tested Fedora 41 with the same error and Ubuntu 22.04 where it worked fine. It happens when checking any host.
I did strace -f -o filename.txt ./testssl.sh -S --phone-out cesnet.cz
Result is in the 7z archive which you have to rename because GitHub does not allow *.7z files.

strace.7z.txt

[drwetter]

Thanks, but it seems I can't correlate your line 2044 (here: line 2091) with the strace output.

As said if it really segfaults there it would help if you could only strace that line.

[multiflexi]

How can I do that?

[drwetter]

• (vi|emacs|...) testssl.sh
• goto the line which causes the segfault ($OPENSSL ocsp -no_nonce ${host_header} -url "$uri" -issuer $TEMPDIR/hostcert_issuer.pem -verify_other $TEMPDIR/intermediatecerts.pem -CAfile <(cat $ADDTL_CA_FILES "$GOOD_CA_BUNDLE") -cert $HOSTCERT -text &> "$tmpfile"
• prepend strace -f -o filename.txt like strace -f -o filename.txt $OPENSSL ocsp -no_nonce ${host_header} ...
• run testssl.sh and send me filename.txt

[multiflexi]

I should have think of that 😄 Here you go.
strace.txt

[drwetter]

Thanks!

Did you supply the -f flag? It doesn't give me a strong hint as I hoped.

It looks more like openssl triggered the problem but is not the problem.

Before the thing segfaulted the loader was mapped into memory. Then some of the memory was protected to read only. Then SEGV_MAPERR indicated that some memory was accessed to which the pointer was wrong or it wasn't possible. Address is likely not 0x1e83c0 .

Wild guess: Do the distros where it segfaults the same /etc/nsswitch.conf and the one which is fine another one?

[multiflexi]

Yes I did use -f:

Manjaro where it segfaults:

Fedora where it segfaults:

Ubuntu where it works fine:

[drwetter]

for testing sakes, can't you try to set the host entries for the first two to hosts: files dns and check whether it still segfaults?

PS: Never heard about myhostname or mymachines before but looking at an Alma Linux test machine here says it's using systemd . Oh well...

[multiflexi]

So I tested it on Fedora and if dns is at the end of hosts line, it segfaults, if I move it to the second place, it works fine. I am able to reproduce it every time.

[drwetter]

Awesome.

Thanks for helping to clarify though! At the moment I'd rather leave it (the cause) like it is -- as I am clueless and this seems to be the either systemd's problem or is somewhere in the middle between systemd and the openssl used. I changed the title. What I could do as a mitigation is trying to catch the segfault and issue a warning I assume "your" segfault didn't stop the whole scan?

If you like , maybe you can try the remove other entries and or move dns in nsswitch around.

[multiflexi]

No, the segfault does not stop the scan. I will try to play with nsswitch in free time.

[drwetter]

NOTFOUND=return looks strange, but maybe I have to rtfm before guessing 😃