Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87zkkrp6cc.fsf@mid.deneb.enyo.de>
Date: Wed, 06 Jul 2011 21:16:51 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: Re: The Bind incident

* Mike O'Connor:

> Note that the BIND 9.4 ESV formally EOLed just last month:
>
> http://www.isc.org/softwaresupportpolicy
>
> So, if you are distributing an older rev of BIND and some new security
> issue comes up that you are prone to, it _might_ not be quite as easy to
> backport the fixes.

If you move from 9.4 or 9.5 to 9.6, your users might hit an issue in
the OpenSSL initialization function:

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584911>

We've applied the kludge below to our 9.6 version, which seems to
address the most common cause of a silently dying named process.
(There are others, but those are more difficult to check.)

diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
index 2dc7d7e..80e6e00 100644
--- a/lib/dns/openssl_link.c
+++ b/lib/dns/openssl_link.c
@@ -48,12 +48,16 @@
 #include "dst_internal.h"
 #include "dst_openssl.h"
 
+#include <dns/log.h>
+
 #include <openssl/err.h>
 #include <openssl/rand.h>
 #include <openssl/evp.h>
 #include <openssl/conf.h>
 #include <openssl/crypto.h>
 
+#include <unistd.h>
+
 #if defined(CRYPTO_LOCK_ENGINE) && (OPENSSL_VERSION_NUMBER >= 0x0090707f)
 #define USE_ENGINE 1
 #endif
@@ -188,7 +192,19 @@ dst__openssl_init() {
 	rm->pseudorand = entropy_getpseudo;
 	rm->status = entropy_status;
 #ifdef USE_ENGINE
+	const char *cnf_path = "/usr/lib/ssl/openssl.cnf";
+	if (access(cnf_path, R_OK) == -1 && errno != ENOENT) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_CONFIG, ISC_LOG_CRITICAL,
+			      "The OpenSSL configuration file %s exists, "
+			      "but it is not readable.", cnf_path);
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_CONFIG, ISC_LOG_CRITICAL,
+			      "The process may terminate without further "
+			      "notice.");
+	}
 	OPENSSL_config(NULL);
+
 #ifdef USE_PKCS11
 #ifndef PKCS11_SO_PATH
 #define PKCS11_SO_PATH		"/usr/local/lib/engines/engine_pkcs11.so"

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.