FS#48480 - [prosody] [lua51-sec] luasec TLS support broken after rebuild
Attached to Project:
Community Packages
Opened by Hermann Zahnweh (eigengrau) - Sunday, 06 March 2016, 14:37 GMT
Last edited by Sergej Pupykin (sergej) - Wednesday, 09 March 2016, 22:13 GMT
Opened by Hermann Zahnweh (eigengrau) - Sunday, 06 March 2016, 14:37 GMT
Last edited by Sergej Pupykin (sergej) - Wednesday, 09 March 2016, 22:13 GMT
|
Details
Description:
After the recent openssl rebuild, prosody TLS support has ceased to function, with prosody reporting that luasec cannot be found. Cf. log messages below. Accordingly, client authentication and s2s communication don’t work anymore, since these rely on TLS encryption. Additional info: - prosody 0.9.10-1 - lua51-sec 1:0.5-5 - openssl 1.0.2.g-3 Mär 06 14:18:31 eigengrau prosodyctl[354]: ************************** Mär 06 14:18:31 eigengrau prosodyctl[354]: Prosody was unable to find LuaSec Mär 06 14:18:31 eigengrau prosodyctl[354]: This package can be obtained in the following ways: Mär 06 14:18:31 eigengrau prosodyctl[354]: Source: http://www.inf.puc-rio.br/~brunoos/luasec/ Mär 06 14:18:31 eigengrau prosodyctl[354]: Debian/Ubuntu: http://prosody.im/download/start#debian_and_ubuntu Mär 06 14:18:31 eigengrau prosodyctl[354]: luarocks: luarocks install luasec Mär 06 14:18:31 eigengrau prosodyctl[354]: SSL/TLS support will not be available Mär 06 14:18:31 eigengrau prosodyctl[354]: More help can be found on our website, at http://prosody.im/doc/depends Mär 06 14:18:31 eigengrau prosodyctl[354]: ************************** Mär 06 14:18:30 eigengrau systemd[1]: Started XMPP (Jabber) Server. Mär 06 14:18:30 eigengrau prosody[458]: mod_posix: Successfully daemonized to PID 458 Mär 06 14:18:31 eigengrau prosodyctl[354]: ************************** Mär 06 14:18:31 eigengrau prosodyctl[354]: Prosody was unable to find LuaSec Mär 06 14:18:31 eigengrau prosodyctl[354]: This package can be obtained in the following ways: Mär 06 14:18:31 eigengrau prosodyctl[354]: Source: http://www.inf.puc-rio.br/~brunoos/luasec/ Mär 06 14:18:31 eigengrau prosodyctl[354]: Debian/Ubuntu: http://prosody.im/download/start#debian_and_ubuntu Mär 06 14:18:31 eigengrau prosodyctl[354]: luarocks: luarocks install luasec Mär 06 14:18:31 eigengrau prosodyctl[354]: SSL/TLS support will not be available Mär 06 14:18:31 eigengrau prosodyctl[354]: More help can be found on our website, at http://prosody.im/doc/depends Mär 06 14:18:31 eigengrau prosodyctl[354]: ************************** Mär 06 14:18:31 eigengrau prosodyctl[354]: Started Mär 06 14:18:31 eigengrau prosody[458]: localhost:tls: Unable to initialize TLS: LuaSec (required for encryption) was not found Mär 06 14:18:31 eigengrau prosody[458]: localhost:tls: Unable to initialize TLS: LuaSec (required for encryption) was not found |
This task depends upon
~> lua5.1
Lua 5.1.5 Copyright (C) 1994-2012 Lua.org, PUC-Rio
> ssl = require('ssl')
error loading module 'ssl.core' from file '/usr/lib/lua/5.1/ssl.so':
/usr/lib/lua/5.1/ssl.so: undefined symbol: SSLv3_method
stack traceback:
[C]: ?
[C]: in function 'require'
/usr/share/lua/5.1/ssl.lua:7: in main chunk
[C]: in function 'require'
stdin:1: in main chunk
[C]: ?
I managed to work around that by building the package from source and commenting out the line in src/context.c
if (!strcmp(method, "sslv3")) return SSLv3_method();
https://github.com/brunoos/luasec/pull/55
https://lists.archlinux.org/pipermail/arch-security/2016-March/000567.html
~> lua5.1
Lua 5.1.5 Copyright (C) 1994-2012 Lua.org, PUC-Rio
> ssl = require('ssl')
>
but prosody still fails to establish ssl connections (even though the module is loaded!).
I tried setting protocol with both 0.5-5 and 0.6 and neither worked.
Also, unlike what Benjamin said, I still can't import the ssl module, even not with 0.6.
Are you sure 0.6 is broken with prosody? Has anyone reported that upstream?
Edit: managed to get 0.5.1 and can confirm it works when setting "protocol".
it doesn’t only patch out the sslv3 method, but also sslv23. Unless I’m
mistaken, we don’t want to disable sslv23, since that protocol specifier is
actually unproblematic even when openssl doesn’t ship with ssl2 or ssl3. The
Prosody handbook states that sslv23 includes TLS (all versions).
When you leave sslv23 enabled, it seems you can actually run prosody/luasec
without hard-coding it to protocol tlsv1_2. This would be preferable, since many
servers only support tlsv1 or tlsv1_1 and s2s communications will fail
otherwise.
The handbook also states that one could also set protocol = "tlsv1+", but this
doesn’t seem to work. Do you agree that the following version of the patch might
be preferable?
https://ptpb.pw/3BzG.patch
The sslv23 option provides the greatest range of compatibility, one may assume from the name that it is only ssl2 and ssl3, however that is not the case. ssl23 is still exposed in openssl and should include all available options including tlsv1, tlsv1_1, tlsv1_2.
The same also applies to the lua-sec package (not lua51-sec)
I'd rather not downgrade the protocol for all clients so one of them continues to work ;)
it supports
protocol = "tlsv1+"
tlsv1_1+, tlsv1_2+, etc
did not check which protocol version actually used.