DTLS handshake broken - precise x64

[Pavel]

Hi,

there is a problem in DTLS handshake in OpenSSL library in Ubuntu 12.04 x86_64. The affected library version is libssl 1.0.1-4ubuntu5.21. The problem causes, that it is impossible to establish DTLS session with Chrome or Firefox when trying to perform a SIP call via WebRTC.

The problem is fixed in OpenSSL upstream by commit https://github.com/openssl/openssl/commit/a20152bdaf7a99b006ff5a0eef081502e0e11553
committed April 4th 2012.

32bit version of Ubuntu 12.04 is not affected by this issue, because it doesn't support HMAC ciphers, which cause the problem.

I've checked other distributions (Centos6, Centos7, Ubuntu 14.04 and especially Debian 7 - which should be close to Ubuntu 12.04) and all has this patch applied and thus WebRTC calls work.

Please merge this upstream fix to Ubuntu 12.04 x86_64 libssl package.

Thanks

[Marc Deslauriers (mdeslaur)]

Hi Pavel,

Thanks for reporting this issue. I have prepared an update for precise which I will upload for processing by the SRU team.

In the meantime, could you please describe the simple steps required to reproduce this issue, to help with testing?

Thanks!

[Pavel (pavel-bazika)]

Hi,

unfortunately I don't have any separate little tool how to test it. The bug causes, that WebRTC calls in our proprieatry application - IceWarp server doesn't work. However we have a free demo, so you can test it like this:

0) Have Ubuntu 12.04 x86_64
1) Download http://linuxbuilds.icewarp.com/UBUNTU1204_x64/devel/2015-02-26-05-00-03/IceWarpServer-11.2.0.0_x64_20150226_UBUNTU1204.tar.gz
2) Unpack
3) Run install.sh with parameter -f
4) Confirm installation of all dependencies, libreoffice, java etc.
5) Install it to /opt/icewarp, create admin user, do not register license - it is not needed, you will get 30 days demo
6) Stop any HTTP and SIP server running on the machine
7) Start IceWarp server running /opt/icewarp/icewarpd.sh --start
8) Run firefox, go to localhost - webmail login page appears
9) Login using credentials admin/admin
10) Click the phone icon in the upper right corner - webphone will start
11) Type echo and click Call
-> You should hear echo service voice

You can also try it on Ubuntu 12.04 i686 with http://linuxbuilds.icewarp.com/UBUNTU1204/devel/2015-02-26-05-00-03/IceWarpServer-11.2.0.0_20150226_UBUNTU1204.tar.gz - there it works normally.

If needed, I'm able to test it using steps above on our side too. Just give me the fixed package.

Thanks

[Brian Murray (brian-murray)]

Hello Pavel, or anyone else affected,

Accepted openssl into precise-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.22 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Pavel (pavel-bazika)]

Hello Brian,

I confirm this issue is fixed with openssl package in proposed repository of version 1.0.1-4ubuntu5.22. Tested with scenario above.

Thanks

[Launchpad Janitor (janitor)]

This bug was fixed in the package openssl - 1.0.1-4ubuntu5.22

---------------
openssl (1.0.1-4ubuntu5.22) precise; urgency=medium

  * Fix DTLS handshake on amd64 (LP: #1425914)
    - debian/patches/lp1425914.patch: backport upstream patch that fixes
      alignment issue causing an assert in ssl/ssl_ciph.c.
 -- Marc Deslauriers <email address hidden> Thu, 26 Feb 2015 13:05:15 -0500

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for openssl has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.