linux-kernel - Re: [PATCH v2 1/1] sign-file: Do not attempt to use the ENGINE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YoDKiAfcFiyFRyQT@google.com>
Date:   Sun, 15 May 2022 10:40:24 +0100
From:   Lee Jones <lee.jones@...aro.org>
To:     Salvatore Bonaccorso <carnil@...ian.org>
Cc:     Kees Cook <keescook@...omium.org>,
        David Howells <dhowells@...hat.com>,
        David Woodhouse <dwmw2@...radead.org>,
        keyrings@...r.kernel.org, Adam Langley <agl@...gle.com>,
        linux-kernel@...r.kernel.org, Eric Biggers <ebiggers@...nel.org>
Subject: Re: [PATCH v2 1/1] sign-file: Do not attempt to use the ENGINE_* API
 if it's not available

On Sun, 15 May 2022, Salvatore Bonaccorso wrote:

> Hi,
> 
> On Thu, Mar 10, 2022 at 08:51:56AM -0800, Kees Cook wrote:
> > On Tue, Mar 08, 2022 at 10:31:11AM +0000, Lee Jones wrote:
> > > OpenSSL's ENGINE API is deprecated in OpenSSL v3.0.
> > >
> > > Use OPENSSL_NO_ENGINE to ensure the ENGINE API is only used if it is
> > > present.  This will safeguard against compile errors when using SSL
> > > implementations which lack support for this deprecated API.
> > 
> > On Fedora rawhide, I'm still seeing a bunch of warnings:
> > 
> > scripts/sign-file.c: In function 'display_openssl_errors':
> > scripts/sign-file.c:89:9: warning: 'ERR_get_error_line' is deprecated: Since OpenSSL 3.0 [-Wdeprecat
> > ed-declarations]
> >    89 |         while ((e = ERR_get_error_line(&file, &line))) {
> >       |         ^~~~~
> > In file included from scripts/sign-file.c:29:
> > /usr/include/openssl/err.h:411:15: note: declared here
> >   411 | unsigned long ERR_get_error_line(const char **file, int *line);
> >       |               ^~~~~~~~~~~~~~~~~~
> > scripts/sign-file.c: In function 'drain_openssl_errors':
> > scripts/sign-file.c:102:9: warning: 'ERR_get_error_line' is deprecated: Since OpenSSL 3.0 [-Wdepreca
> > ted-declarations]
> >   102 |         while (ERR_get_error_line(&file, &line)) {}
> >       |         ^~~~~
> > /usr/include/openssl/err.h:411:15: note: declared here
> >   411 | unsigned long ERR_get_error_line(const char **file, int *line);
> >       |               ^~~~~~~~~~~~~~~~~~
> 
> FWIW, we are seeing the same now on Debian as Debian unstable is
> moving to OpenSSL 3.0.
> 
> https://lists.debian.org/debian-release/2022/05/msg00070.html

Did this patch help?

We've had a few confirmed reports now.

My guess is the maintainers are not currently monitoring.

With some more {Reviewed,Tested}-bys I'd be prepared to submit this
via other means.  Either via my own repository or via Greg's.

-- 
Lee Jones [李琼斯]
Principal Technical Lead - Developer Services
Linaro.org │ Open source software for Arm SoCs
Follow Linaro: Facebook | Twitter | Blog