openssl ca -spkac output regressed

[Dimitri John Ledkov]

[Impact]

 * openssl command line utility option parsing has regressed in 1.1.0i+ and produces binary output, where text output is expected, breaking applications that parse that.

[Test Case]

Setup CA:
$ apt install openssl
$ mkdir -p demoCA/private demoCA/newcerts
$ touch demoCA/index.txt
$ echo 01 > demoCA/serial

$ openssl req -new -x509 -days 365 -newkey rsa:4096 -keyout demoCA/private/cakey.pem -out demoCA/cacert.pem

# Use password test
# Accept defaults for all other settings

$ openssl req -new -days 365 -newkey rsa:4096 -keyout demoCA/sslkey.pem -out demoCA/sslcert.pem

Generate regular request / key:
# Use password test
# Set common name to: example.com
# Accept defaults for all other settings

Generate spkac request:
$ openssl spkac -key demoCA/sslkey.pem -out demoCA/sslcert.spkac
$ cat <<EOF >>demoCA/sslcert.spkac
countryName=AU
stateOrProvinceName=Some-State
organizationName=Internet Widgits Pty Ltd
commonName=example.com
EOF

Sign spkac request:
$ echo test | openssl ca -passin stdin -batch -spkac demoCA/sslcert.spkac -startdate 190121130654Z

Expected: pure text output
Unexpected: binary output for the signed cert

 Currently produces binary goop.

 Should produce PEM format Base64 encoded certificate data in a block surrounded
 with BEGIN/END certificate.

[Regression Potential]

 * This is a regression in cosmic and up, and impeding regression in bionic with the upcoming 1.1.1 SRU. A bugfix exists upstream.

[Other Info]

 * Originally reported https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1797386/comments/39

[Dimitri John Ledkov (xnox)]

Hm, the test case is incomplete. As I appear to not be able to use the stock config, and I need a CA generated too. I should get better details for it.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Tim Wegener (tim.embertec)]

Here's a recipe for generating a CA directory for testing.
It assumes you have already generated a CA key and cert.

touch $CA_DIR/index.txt
echo '1000' > $CA_DIR/serial
echo '1000' > $CA_DIR/crlnumber
mkdir -m 700 $CA_DIR/newcerts
mkdir -m 700 $CA_DIR/private
mkdir $CA_DIR/certs

cp $CA_KEY $CA_DIR/private/ca_key.pem
chmod 600 $CA_DIR/private/ca_key.pem

cp $CA_CERT $CA_DIR/certs/ca_cert.pem

Those paths need to correspond to those set in the "[ CA_default ]" section of the openssl.cnf file.

E.g.

[ ca ]
default_ca = CA_default # The default ca section
####################################################################
[ CA_default ]
dir = somedir/ca_dir # Where everything is kept
certs = $dir/certs # Where the issued certs are kept
crl_dir = $dir/crl # Where the issued crl are kept
database = $dir/index.txt # database index file.
unique_subject = no # Set to 'no' to allow creation of
                                        # several ctificates with same subject.
new_certs_dir = $dir/newcerts # default place for new certs.

certificate = $dir/certs/ca_cert.pem
serial = $dir/serial # The current serial number
crlnumber = $dir/crlnumber # the current crl number
                                        # must be commented out to leave a V1 CRL
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/ca_key.pem
RANDFILE = $dir/.rand # private random number file

The initial crl file can be generated like so:

cat ca_key_passphrase_file.txt | openssl ca -gencrl -out $CA_DIR/crl.pem -config /path/to/test.openssl.cnf -passin stdin

Use 'openssl req' to generate the cert request private key.
Use 'openssl spkac' to generate the spkac cert request data.

[Dimitri John Ledkov (xnox)]

Follow roughly https://blog.felipe-alfaro.com/2005/11/18/setting-up-certificate-authority-ca-using-openssl/ to setup CA

Generate req & spkac => however somehow my spkac only had the SPKAC= line so I had to edit in:

countryName=AU
stateOrProvinceName=Some-State
organizationName=Internet Widgits Pty Ltd
commonName=foo

To make it a valid spkac for batch processing.

Then yeah the batch command generates binary garbage to stdout.

[Dimitri John Ledkov (xnox)]

reset index.txt, and resigned pkac with upgraded openssl in eoan, the output is pure text and can be read/parsed by humans and machines.

[Steve Langasek (vorlon)]

Hello Dimitri, or anyone else affected,

Accepted openssl into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/openssl/1.1.1-1ubuntu2.1~18.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Dimitri John Ledkov (xnox)]

Run through CA setup, and ended up corrupting my terminal due to binary output using the current bionic-updates 1.1.1-1ubuntu2.1~18.04.1

Upgraded to:
# dpkg-query -W openssl libssl1.1
libssl1.1:amd64 1.1.1-1ubuntu2.1~18.04.2
openssl 1.1.1-1ubuntu2.1~18.04.2

Rerun the procedure and ended up with text output:
...
GByCiz1ccn33zfoZa4Wc9e8F/Cm0sihZoGfW3ZKaHT9hoE/bfB4o/4JnIJCCzjrD
0I0+Aaqph4FbJf8qlzeViPcb6P0MRdNr+6eLedKcDLTJHFWAGIn0ahKa
-----END CERTIFICATE-----
Data Base Updated

All is good.

[Steve Langasek (vorlon)]

Hello Dimitri, or anyone else affected,

Accepted openssl into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/openssl/1.1.1-1ubuntu2.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Steve Langasek (vorlon)]

Hello Dimitri, or anyone else affected,

Accepted openssl into disco-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/openssl/1.1.1b-1ubuntu2.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-disco to verification-done-disco. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-disco. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Marc Deslauriers (mdeslaur)]

ACK from the security team on the low CVE being included in this SRU.

[Dimitri John Ledkov (xnox)]

Cosmic

# dpkg-query -W openssl libssl1.1
libssl1.1:amd64 1.1.1-1ubuntu2.3
openssl 1.1.1-1ubuntu2.3

Run the procedure, got text output:
...
tEInj8E8hiIwr3qgnHEeaoHrk2v3H82zDSI6NFalcwqCVeLtP3SeLFNvBYovISBX
JQrpUFhq1/+PwOMogxfRZQBmS1Za0Yxd8VK12M5smfI4WRDbqUbmZfqA
-----END CERTIFICATE-----
Data Base Updated

All is good.

[Dimitri John Ledkov (xnox)]

Disco:

# dpkg-query -W openssl libssl1.1
libssl1.1:amd64 1.1.1b-1ubuntu2.2
openssl 1.1.1b-1ubuntu2.2

Run the procedure, got text output:

...
N8j0iLb0NtNIssnxRKKlw7NG4fGCOs7uHUbIcDg2u8nFM9bUoAQoUauRaNQjmWkZ
tx4U93+m6UnLSCxc9fyZWrax5mVL05C/AyB9H6NcfTYEyYyBPob5C4fG
-----END CERTIFICATE-----
Data Base Updated

[Marc Deslauriers (mdeslaur)]

I have run bionic-proposed cosmic-proposed and disco-proposed through the usual security team test procedure. They can be released with the fix for CVE-2019-1543.

[Launchpad Janitor (janitor)]

This bug was fixed in the package openssl - 1.1.1-1ubuntu2.1~18.04.2

---------------
openssl (1.1.1-1ubuntu2.1~18.04.2) bionic; urgency=medium

  * Cherrypick upstream patch to fix ca -spkac output to be text again.
    LP: #1828215
  * Cherrypick upstream patch to prevent over long nonces in ChaCha20-Poly1305
    CVE-2019-1543
  * Bump major version of OpenSSL in postinst to trigger services restart
    upon upgrade. Many services listed there must be restarted when
    upgrading 1.1.0 to 1.1.1. LP: #1832522

 -- Dimitri John Ledkov <email address hidden> Wed, 12 Jun 2019 00:12:47 +0100

[Steve Langasek (vorlon)]

The verification of the Stable Release Update for openssl has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package openssl - 1.1.1c-1ubuntu2

---------------
openssl (1.1.1c-1ubuntu2) eoan; urgency=medium

  * Bump major version of OpenSSL in postinst to trigger services restart
    upon upgrade. Many services listed there must be restarted when
    upgrading 1.1.0 to 1.1.1. LP: #1832522
  * Fix path to Xorg for reboot notifications on desktop. LP: #1832421

 -- Dimitri John Ledkov <email address hidden> Thu, 13 Jun 2019 15:29:07 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package openssl - 1.1.1b-1ubuntu2.4

---------------
openssl (1.1.1b-1ubuntu2.4) disco; urgency=medium

  * Import libraries/restart-without-asking as used in postinst, to
    prevent failure to configure the package without debconf database.
    LP: #1832919

 -- Dimitri John Ledkov <email address hidden> Thu, 20 Jun 2019 18:31:25 +0100