https://bugzilla.suse.com/show_bug.cgi?id=1175219
Bug ID: 1175219 Summary: OpenVPN fails with certificates on smart cards on Leap 15.2 and TW Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team@suse.de Reporter: bjoernv@arcor.de QA Contact: qa-bugs@suse.de Found By: --- Blocker: ---
After upgrading from Leap 15.1 to Leap 15.2 working OpenVPN setups with PKCS11 certificates on Yubikeys are failing. The same applies to openSUSE Tumbleweed. Also other smart card devices may be affected.
OpenVPN does not show many details, even with highest logging level.
# openvpn --cd /etc/openvpn --config openvpn-yubikey-test.ovpn [...] Thu Aug 13 10:21:21 2020 VERIFY OK: depth=1, CN=Test CA Thu Aug 13 10:21:21 2020 VERIFY KU OK Thu Aug 13 10:21:21 2020 Validating certificate extended key usage Thu Aug 13 10:21:21 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication Thu Aug 13 10:21:21 2020 VERIFY EKU OK Thu Aug 13 10:21:21 2020 VERIFY OK: depth=0, CN=host1.example.com Thu Aug 13 10:21:21 2020 OpenSSL: error:141F0006:SSL routines:tls_construct_cert_verify:EVP lib Thu Aug 13 10:21:21 2020 TLS_ERROR: BIO read tls_read_plaintext error Thu Aug 13 10:21:21 2020 TLS Error: TLS object -> incoming plaintext read error Thu Aug 13 10:21:21 2020 TLS Error: TLS handshake failed Thu Aug 13 10:21:21 2020 Fatal TLS error (check_tls_errors_co), restarting Thu Aug 13 10:21:21 2020 SIGUSR1[soft,tls-error] received, process restarting Thu Aug 13 10:21:21 2020 Restart pause, 5 second(s)
The bug can be resolved by upgrading the pkcs11-helper packages from pkcs11-helper-1.25.1 to pkcs11-helper-devel-1.26.0.
# openvpn --cd /etc/openvpn --config openvpn-yubikey-test.ovpn [...] Thu Aug 13 10:32:36 2020 VERIFY OK: depth=1, CN=Test CA Thu Aug 13 10:32:36 2020 VERIFY KU OK Thu Aug 13 10:32:36 2020 Validating certificate extended key usage Thu Aug 13 10:32:36 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication Thu Aug 13 10:32:36 2020 VERIFY EKU OK Thu Aug 13 10:32:36 2020 VERIFY OK: depth=0, CN=host1.example.com Enter user1 token Password: (press TAB for no echo)
There is a problem with inconsistent padding between OpenSSL 1.1.1 and pkcs11-helper-1.25.1. The details are described here: http://openssl.6102.n7.nabble.com/Issue-with-smartcard-authentication-for-op...
The pkcs11-helper-devel-1.26.0 Changelog contains this line: - openssl: support RSA_NO_PADDING padding, thanks to Selva Nair
https://bugzilla.suse.com/show_bug.cgi?id=1175219
Marcus Meissner meissner@suse.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |meissner@suse.com Assignee|security-team@suse.de |jsikes@suse.com
https://bugzilla.suse.com/show_bug.cgi?id=1175219 https://bugzilla.suse.com/show_bug.cgi?id=1175219#c1
--- Comment #1 from Marcus Meissner meissner@suse.com --- (assign to jason for pkcs11-helper currently, not sure if right)
https://bugzilla.suse.com/show_bug.cgi?id=1175219 https://bugzilla.suse.com/show_bug.cgi?id=1175219#c2
--- Comment #2 from Jason Sikes jsikes@suse.com --- Hi. Do we know if this is still an issue that needs to be worked on?
https://bugzilla.suse.com/show_bug.cgi?id=1175219 https://bugzilla.suse.com/show_bug.cgi?id=1175219#c3
Jason Sikes jsikes@suse.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |NORESPONSE
--- Comment #3 from Jason Sikes jsikes@suse.com --- Many of our smart card support packages were updated in Leap 15.3 and Tumbleweed. Also, since I didn't get a response from my query in some time I am going to assume the issue has been fixed by an update.
Please reopen if this is still an problem.
https://bugzilla.suse.com/show_bug.cgi?id=1175219 https://bugzilla.suse.com/show_bug.cgi?id=1175219#c4
Bj�rn Voigt bjoernv@arcor.de changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Version|Leap 15.2 |Leap 15.4 Resolution|NORESPONSE |---
--- Comment #4 from Bj�rn Voigt bjoernv@arcor.de --- Unfortunately there is no update for pkcs11-helper in openSUSE Leap 15.4.
The reported bug is still valid for openSUSE Leap 15.4. The bug could still be fixed with pkcs11-helper >= 1.26.0.
https://bugzilla.suse.com/show_bug.cgi?id=1175219 https://bugzilla.suse.com/show_bug.cgi?id=1175219#c5
--- Comment #5 from Jason Sikes jsikes@suse.com --- Added patch sourced from https://github.com/OpenSC/pkcs11-helper/commit/c192bb48e9170d636e305d03a87c8...
created request id 288440
https://bugzilla.suse.com/show_bug.cgi?id=1175219
Otto Hollmann otto.hollmann@suse.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |otto.hollmann@suse.com Assignee|jsikes@suse.com |otto.hollmann@suse.com
https://bugzilla.suse.com/show_bug.cgi?id=1175219 https://bugzilla.suse.com/show_bug.cgi?id=1175219#c8
--- Comment #8 from Maintenance Automation maint-coord+maintenance-robot@suse.de --- SUSE-RU-2023:1671-1: An update that has one recommended fix can now be installed.
Category: recommended (moderate) Bug References: 1175219 Sources used: openSUSE Leap 15.4 (src): pkcs11-helper-1.25.1-150100.3.3.1 Basesystem Module 15-SP4 (src): pkcs11-helper-1.25.1-150100.3.3.1 SUSE Linux Enterprise Real Time 15 SP3 (src): pkcs11-helper-1.25.1-150100.3.3.1
NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
-
bugzilla_noreply＠suse.com