4 ms·

Two obligatory links. 1. Debian dev on the openssl mailing list if he can remove the code causing errors in Valgrind: http://marc.info/?l=openssl-dev&m=114651

by alrs 13y ago

Two obligatory links. 1. Debian dev on the openssl mailing list if he can remove the code causing errors in Valgrind: http://marc.info/?l=openssl-dev&m=114651085826293&w=2 http://marc.info/?l=openssl-dev&m=114651085826293&w=2 2. Developer with a @openssl.org email address giving him the green light: http://marc.info/?l=openssl-dev&m=114652287210110&w=2 http://marc.info/?l=openssl-dev&m=114652287210110&w=2 Source: http://lwn.net/Articles/282038/ http://lwn.net/Articles/282038/

tlrobinson 13y ago
Also: 1. The commit introducing the bug: "Don't add uninitialised data to the random number generator. This stop valgrind from giving error messages in unrelated code." http://anonscm.debian.org/viewvc/pkg-openssl/openssl/trunk/rand/md_rand.c?annotate=141&sortby=rev&pathrev=141 http://anonscm.debian.org/viewvc/pkg-openssl/openssl/trunk/r... 2. The commit fixing the bug: "ssleay_rand_add() really needs to call MD_Update() for buf." http://anonscm.debian.org/viewvc/pkg-openssl/openssl/trunk/crypto/rand/md_rand.c?annotate=300&sortby=rev&pathrev=300 http://anonscm.debian.org/viewvc/pkg-openssl/openssl/trunk/c... (I'd post the diffs but viewvc is throwing exceptions for them)
kryptiskt 13y ago
Nothing has ever quite degraded my opinion of the Debian project as much as the fact that everybody is quoting that in order to shift blame instead of them trying to debug their process for patching security-essential code.
- DebianUser 13y ago
  The only thing that it means is that the security team does not fully understand the code it maintain, and apparently the same can be said about the openssl team. As a user myself, I don't understand that code, but I rely on people who should. Perhaps it means that the Debian security team should get more knowledgeable people onboard, but knowledge is also made of experience, and requires time to build up. Hopefully this will become a valuable experience for everyone, I know it has for me. By the way, does anyone know of a certified SSL stack (a la compcert)?
makomk 13y ago
Someone replied pointing out the correct solution (build with -DPURIFY) a few hours later [1], but I think the Debian developer in question was too young to understand what Purify is or why that's the correct approach. [1] http://marc.info/?l=openssl-dev&m=114654760312453&w=2 http://marc.info/?l=openssl-dev&m=114654760312453&w=2 Edit: also, the Debian developer didn't actually identify himself as such on the mailing list, or I have a feeling people would've scrutinized what he was suggesting a lot more closely.

by alrs 13y ago

tlrobinson 13y ago

Also: 1. The commit introducing the bug: "Don't add uninitialised data to the random number generator. This stop valgrind from giving error messages in unrelated code." http://anonscm.debian.org/viewvc/pkg-openssl/openssl/trunk/rand/md_rand.c?annotate=141&sortby=rev&pathrev=141 http://anonscm.debian.org/viewvc/pkg-openssl/openssl/trunk/r... 2. The commit fixing the bug: "ssleay_rand_add() really needs to call MD_Update() for buf." http://anonscm.debian.org/viewvc/pkg-openssl/openssl/trunk/crypto/rand/md_rand.c?annotate=300&sortby=rev&pathrev=300 http://anonscm.debian.org/viewvc/pkg-openssl/openssl/trunk/c... (I'd post the diffs but viewvc is throwing exceptions for them)

kryptiskt 13y ago

Nothing has ever quite degraded my opinion of the Debian project as much as the fact that everybody is quoting that in order to shift blame instead of them trying to debug their process for patching security-essential code.

DebianUser 13y ago
The only thing that it means is that the security team does not fully understand the code it maintain, and apparently the same can be said about the openssl team. As a user myself, I don't understand that code, but I rely on people who should. Perhaps it means that the Debian security team should get more knowledgeable people onboard, but knowledge is also made of experience, and requires time to build up. Hopefully this will become a valuable experience for everyone, I know it has for me. By the way, does anyone know of a certified SSL stack (a la compcert)?

makomk 13y ago

Someone replied pointing out the correct solution (build with -DPURIFY) a few hours later [1], but I think the Debian developer in question was too young to understand what Purify is or why that's the correct approach. [1] http://marc.info/?l=openssl-dev&m=114654760312453&w=2 http://marc.info/?l=openssl-dev&m=114654760312453&w=2 Edit: also, the Debian developer didn't actually identify himself as such on the mailing list, or I have a feeling people would've scrutinized what he was suggesting a lot more closely.