Ubuntu
lighttpd package

lighttpd broken by OpenSSL update

Bug #1832295 reported by Jim Tittsler
76
This bug affects 18 people
Affects Status Importance Assigned to Milestone
lighttpd (Debian)
Fix Released
Unknown
lighttpd (Ubuntu)
Fix Released
Critical
Unassigned
Bionic
Fix Released
Critical
Unassigned
Cosmic
Fix Released
Critical
Unassigned

Bug Description

[Impact]

 * TLSv1.3 (which is enabled by default) connections are getting killed instead of succeeding negotiation.

[Test Case]

 * Create lighttpd server, attempt to connect via tlsv1.3
 * Connection should succeed.

Sample lighttpd.conf:

server.port = 443
ssl.engine = "enable"
ssl.pemfile = "/etc/lighttpd/server.pem"

Where server.pem is concat of snakeoil cert + private key.

Attempting curl to lighttpd results in:

# curl --cacert /etc/ssl/certs/ssl-cert-snakeoil.pem https://apt-kitten.lxd
curl: (52) Empty reply from server

# grep 'killing' /var/log/lighttpd/error.log
2019-06-25 09:40:15: (connections-glue.c.126) SSL: renegotiation initiated by client, killing connection

Upgrade to new lighttpd, repeat curl, and now get the download of the home-page:

# curl --cacert /etc/ssl/certs/ssl-cert-snakeoil.pem https://apt-kitten.lxd
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
...

[Regression Potential]

 * TLSv1.3 connections attempt client renegotiation when they should not, as that's not supported anymore. Currently, connections are getting killed instead of succeeding. This change is a backport from a later v1.4 series point release, hence the file paths don't match the original and variables are renamed, however, the affected codepath appears to still be the same-ish. Hence the patch should be review for rebase correctness as there is room for error in handling client renegotiation with prior tls versions.

[Upstream Link]
https://redmine.lighttpd.net/projects/lighttpd/repository/revisions/7a7f4f987aa8443aa3898f484539f707e213bcba/diff

[Original Bugreport]

After installing today's bionic OpenSSL update (1.1.0g-2ubuntu4.3 -> 1.1.1-1ubuntu2.1~18.04.1 and associated libraries) SSL is broken in lighttpd 1.4.45-1ubuntu3. The logs are full of messages of the form:

2019-06-11 12:02:20: (connections-glue.c.126) SSL: renegotiation initiated by client, killing connection

Perhaps problem with TLS v1.3 negotiation? (And the version of lighttpd is too old to have the ssl.openssl.ssl-conf-cmd directive to try to disable it.)

Description: Ubuntu 18.04.2 LTS
Release: 18.04

ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: lighttpd 1.4.45-1ubuntu3
ProcVersionSignature: Ubuntu 4.15.0-51.55-generic 4.15.18
Uname: Linux 4.15.0-51-generic x86_64
ApportVersion: 2.20.9-0ubuntu7.6
Architecture: amd64
Date: Tue Jun 11 14:18:55 2019
SourcePackage: lighttpd
UpgradeStatus: Upgraded to bionic on 2018-06-10 (365 days ago)
modified.conffile..etc.lighttpd.conf-available.10-cgi.conf: [modified]
modified.conffile..etc.lighttpd.lighttpd.conf: [modified]
mtime.conffile..etc.lighttpd.conf-available.10-cgi.conf: 2015-07-16T10:18:19.857892
mtime.conffile..etc.lighttpd.lighttpd.conf: 2019-06-11T12:01:59.493213

See original description
Revision history for this message
Jim Tittsler (jwt) wrote :
Revision history for this message
Jim Tittsler (jwt) wrote :

A Debian bug suggests that lighttpd < 1.4.51 is broken by libssl 1.1
  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=913558

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in lighttpd (Ubuntu):
status: New → Confirmed
Revision history for this message
Jim Tittsler (jwt) wrote :

Simply rebuilding the source deb against the new libraries isn't enough to make it work.

Revision history for this message
Jim Tittsler (jwt) wrote :

To eliminate further downtime, I built/installed lighttpd 1.4.54 which resolved the problem.

Revision history for this message
Jeremy (j0k3r) wrote :

Got that issue too.
All site using https were down.

Temporary solution is to define `ssl.disable-client-renegotiation = "disable"`
But it's not safe.

Andres Rodriguez (andreserl)
Changed in lighttpd (Ubuntu):
importance: Undecided → Critical
Robie Basak (racb)
tags: added: regression-update
Revision history for this message
Dimitri John Ledkov (xnox) wrote :

> Temporary solution is to define `ssl.disable-client-renegotiation = "disable"`
> But it's not safe.

Actually that should be the new default. Client-renegotiation is no longer supported at all, and shouldn't be neither offered or accepted.

Revision history for this message
Dimitri John Ledkov (xnox) wrote :

Fix released in Disco and Eoan.

Affected series are Bionic and Cosmic.

Changed in lighttpd (Ubuntu Bionic):
importance: Undecided → Critical
Changed in lighttpd (Ubuntu Cosmic):
importance: Undecided → Critical
Changed in lighttpd (Ubuntu Bionic):
status: New → In Progress
Changed in lighttpd (Ubuntu Cosmic):
status: New → In Progress
Changed in lighttpd (Ubuntu):
status: Confirmed → Fix Released
Dimitri John Ledkov (xnox)
description: updated
Bug Watch Updater (bug-watch-updater)
Changed in lighttpd (Debian):
status: Unknown → Fix Released
Dimitri John Ledkov (xnox)
description: updated
description: updated
Revision history for this message
Robie Basak (racb) wrote : Please test proposed package

Hello Jim, or anyone else affected,

Accepted lighttpd into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/lighttpd/1.4.45-1ubuntu3.18.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in lighttpd (Ubuntu Bionic):
status: In Progress → Fix Committed
tags: added: verification-needed verification-needed-bionic
Changed in lighttpd (Ubuntu Cosmic):
status: In Progress → Fix Committed
tags: added: verification-needed-cosmic
Revision history for this message
Robie Basak (racb) wrote :

Hello Jim, or anyone else affected,

Accepted lighttpd into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/lighttpd/1.4.45-1ubuntu3.18.10 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Revision history for this message
Dimitri John Ledkov (xnox) wrote :

Reproducing on bionic:

# dpkg-query -W lighttpd
lighttpd 1.4.45-1ubuntu3
# curl --cacert /etc/ssl/certs/ssl-cert-snakeoil.pem https://diverse-basilisk.lxd &>/dev/null && echo Pass || echo Fail
Fail
# sed 's/-updates/-proposed/' -i /etc/apt/sources.list
# apt update
# apt install lighttpd
# dpkg-query -W lighttpd
lighttpd 1.4.45-1ubuntu3.18.04
# curl --cacert /etc/ssl/certs/ssl-cert-snakeoil.pem https://diverse-basilisk.lxd &>/dev/null && echo Pass || echo Fail
Pass

All is good in bionic-proposed.

tags: added: verification-done-bionic
removed: verification-needed-bionic
Revision history for this message
Dimitri John Ledkov (xnox) wrote :

Reproducing on cosmic:

# dpkg-query -W lighttpd
lighttpd 1.4.45-1ubuntu3

# curl --cacert /etc/ssl/certs/ssl-cert-snakeoil.pem https://composed-cattle.lxd &>/dev/null && echo Pass || echo Fail
Fail

# sed 's/-updates/-proposed/' -i /etc/apt/sources.list
# apt update
# apt install lighttpd
# dpkg-query -W lighttpd
lighttpd 1.4.45-1ubuntu3.18.10

# curl --cacert /etc/ssl/certs/ssl-cert-snakeoil.pem https://composed-cattle.lxd &>/dev/null && echo Pass || echo Fail
Pass

All is good in cosmic-proposed.

tags: added: verification-done-cosmic
removed: verification-needed verification-needed-cosmic
Revision history for this message
Ferdi (ferdi-sttc-nlp) wrote :

The version in proposed works for me.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package lighttpd - 1.4.45-1ubuntu3.18.10

---------------
lighttpd (1.4.45-1ubuntu3.18.10) cosmic; urgency=medium

  * Cherrypick and rebase upstream patch to disable client renegotiation
    with TLSv1.3 connections. LP: #1832295

 -- Dimitri John Ledkov <email address hidden> Mon, 24 Jun 2019 23:58:56 +0100

Changed in lighttpd (Ubuntu Cosmic):
status: Fix Committed → Fix Released
Revision history for this message
Brian Murray (brian-murray) wrote : Update Released

The verification of the Stable Release Update for lighttpd has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package lighttpd - 1.4.45-1ubuntu3.18.04

---------------
lighttpd (1.4.45-1ubuntu3.18.04) bionic; urgency=medium

  * Cherrypick and rebase upstream patch to disable client renegotiation
    with TLSv1.3 connections. LP: #1832295

 -- Dimitri John Ledkov <email address hidden> Mon, 24 Jun 2019 23:58:56 +0100

Changed in lighttpd (Ubuntu Bionic):
status: Fix Committed → Fix Released
Robie Basak (racb)
tags: added: bionic-openssl-1.1
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.