[Openswan dev] crl core dumps pluto
Andreas Steffen
andreas.steffen at strongsec.net
Sat Feb 14 20:45:00 CET 2004
I cannot reproduce this segfault using x509-1.5.2-freeswan-2.04.
My log with the setting plutodebug=all shows:
Feb 14 20:25:15 tandoori pluto[2298]: Changing to directory '/etc/ipsec.d/crls'
Feb 14 20:25:15 tandoori pluto[2298]: loaded crl file 'warden-crl.pem' (702 bytes)
Feb 14 20:25:15 tandoori pluto[2298]: | file content is not binary ASN.1
Feb 14 20:25:15 tandoori pluto[2298]: | -----BEGIN X509 CRL-----
Feb 14 20:25:15 tandoori pluto[2298]: | -----END X509 CRL-----
Feb 14 20:25:15 tandoori pluto[2298]: | file coded in PEM format
Feb 14 20:25:15 tandoori pluto[2298]: | L0 - certificateList:
Feb 14 20:25:15 tandoori pluto[2298]: | 30 82 01 d5 30 81 be 30 0d 06 09 2a
86 48 86 f7
Feb 14 20:25:15 tandoori pluto[2298]: | 0d 01 01 04 05 00 30 81 8e 31 0b 30
09 06 03 55
Feb 14 20:25:15 tandoori pluto[2298]: | 04 06 13 02 55 53 31 12 30 10 06 03
55 04 08 13
Feb 14 20:25:15 tandoori pluto[2298]: | 09 4d 69 6e 6e 65 73 6f 74 61 31 15
30 13 06 03
Feb 14 20:25:15 tandoori pluto[2298]: | 55 04 07 13 0c 45 64 65 6e 20 50 72
61 69 72 69
Feb 14 20:25:15 tandoori pluto[2298]: | 65 31 1e 30 1c 06 03 55 04 0a 13 15
52 65 61 6c
Feb 14 20:25:15 tandoori pluto[2298]: | 20 54 69 6d 65 20 45 6e 74 65 72 70
72 69 73 65
Feb 14 20:25:15 tandoori pluto[2298]: | 73 31 0c 30 0a 06 03 55 04 0b 13 03
56 50 4e 31
Feb 14 20:25:15 tandoori pluto[2298]: | 26 30 24 06 03 55 04 03 13 1d 52 54
45 20 56 50
Feb 14 20:25:15 tandoori pluto[2298]: | 4e 20 43 65 72 74 69 66 69 63 61 74
65 20 41 75
Feb 14 20:25:15 tandoori pluto[2298]: | 74 68 6f 72 69 74 79 17 0d 30 33 30
39 32 32 32
Feb 14 20:25:15 tandoori pluto[2298]: | 30 30 31 30 35 5a 17 0d 30 34 30 39
32 31 32 30
Feb 14 20:25:15 tandoori pluto[2298]: | 30 31 30 35 5a 30 0d 06 09 2a 86 48
86 f7 0d 01
Feb 14 20:25:15 tandoori pluto[2298]: | 01 04 05 00 03 82 01 01 00 6b 5b ed
2b 0a f7 5d
Feb 14 20:25:15 tandoori pluto[2298]: | 05 54 cc ed c1 df 2d aa f2 6c 42 2f
be 5b d3 c2
Feb 14 20:25:15 tandoori pluto[2298]: | 6a 6d 3c 86 cc ed 12 4f 08 d7 6e b6
68 2e 01 c8
Feb 14 20:25:15 tandoori pluto[2298]: | 64 eb 23 17 db c0 0e bd b8 13 2a c8
ac 71 a3 f3
Feb 14 20:25:15 tandoori pluto[2298]: | b0 34 6c 29 91 38 e6 42 6e 32 19 e8
f0 a3 6c a3
Feb 14 20:25:15 tandoori pluto[2298]: | 75 24 b3 32 42 0b d5 3d 6b 8c ff 71
3e 04 59 62
Feb 14 20:25:15 tandoori pluto[2298]: | a4 01 45 13 65 36 78 c3 38 1a 35 8e
7c 4e c7 a5
Feb 14 20:25:15 tandoori pluto[2298]: | b3 9b 1f 54 98 bc 16 2c bc cf 3e 5e
9e 0c d5 7b
Feb 14 20:25:15 tandoori pluto[2298]: | a3 0c 92 38 5d f7 b8 ba 00 63 69 de
06 b4 a7 98
Feb 14 20:25:15 tandoori pluto[2298]: | 30 8d 14 ea 27 7b 6d 85 22 dd 87 dd
8e 84 bd 30
Feb 14 20:25:15 tandoori pluto[2298]: | db da 30 7e ae 5d 6e 5c e9 45 5c a7
a7 90 cb 0c
Feb 14 20:25:15 tandoori pluto[2298]: | b0 c2 c2 9f 09 f9 e5 dc 74 7b 72 2c
f9 8d d6 be
Feb 14 20:25:15 tandoori pluto[2298]: | c0 c4 e7 ae 51 7a 65 3c 74 0a ad f4
e8 43 48 68
Feb 14 20:25:15 tandoori pluto[2298]: | c2 76 f1 c5 94 37 ec 19 c1 e2 e3 f6
09 34 d2 37
Feb 14 20:25:15 tandoori pluto[2298]: | 7a 5c cc 17 3d 1e 02 50 a1 45 f7 38
42 ee 59 32
Feb 14 20:25:15 tandoori pluto[2298]: | 55 9f f3 bc bf 00 23 9b 86 71 eb 80
e1 46 13 88
Feb 14 20:25:15 tandoori pluto[2298]: | 29 4c 75 5c 36 00 b2 26 9d
Feb 14 20:25:15 tandoori pluto[2298]: | L1 - tbsCertList:
Feb 14 20:25:15 tandoori pluto[2298]: | 30 81 be 30 0d 06 09 2a 86 48 86 f7
0d 01 01 04
Feb 14 20:25:15 tandoori pluto[2298]: | 05 00 30 81 8e 31 0b 30 09 06 03 55
04 06 13 02
Feb 14 20:25:15 tandoori pluto[2298]: | 55 53 31 12 30 10 06 03 55 04 08 13
09 4d 69 6e
Feb 14 20:25:15 tandoori pluto[2298]: | 6e 65 73 6f 74 61 31 15 30 13 06 03
55 04 07 13
Feb 14 20:25:15 tandoori pluto[2298]: | 0c 45 64 65 6e 20 50 72 61 69 72 69
65 31 1e 30
Feb 14 20:25:15 tandoori pluto[2298]: | 1c 06 03 55 04 0a 13 15 52 65 61 6c
20 54 69 6d
Feb 14 20:25:15 tandoori pluto[2298]: | 65 20 45 6e 74 65 72 70 72 69 73 65
73 31 0c 30
Feb 14 20:25:15 tandoori pluto[2298]: | 0a 06 03 55 04 0b 13 03 56 50 4e 31
26 30 24 06
Feb 14 20:25:15 tandoori pluto[2298]: | 03 55 04 03 13 1d 52 54 45 20 56 50
4e 20 43 65
Feb 14 20:25:15 tandoori pluto[2298]: | 72 74 69 66 69 63 61 74 65 20 41 75
74 68 6f 72
Feb 14 20:25:15 tandoori pluto[2298]: | 69 74 79 17 0d 30 33 30 39 32 32 32
30 30 31 30
Feb 14 20:25:15 tandoori pluto[2298]: | 35 5a 17 0d 30 34 30 39 32 31 32 30
30 31 30 35
Feb 14 20:25:15 tandoori pluto[2298]: | 5a
Feb 14 20:25:15 tandoori pluto[2298]: | L2 - signature:
Feb 14 20:25:15 tandoori pluto[2298]: | L3 - algorithmIdentifier:
Feb 14 20:25:15 tandoori pluto[2298]: | L4 - algorithm:
Feb 14 20:25:15 tandoori pluto[2298]: | 'md5WithRSAEncryption'
Feb 14 20:25:15 tandoori pluto[2298]: | L2 - issuer:
Feb 14 20:25:15 tandoori pluto[2298]: | 30 81 8e 31 0b 30 09 06 03 55 04 06
13 02 55 53
Feb 14 20:25:15 tandoori pluto[2298]: | 31 12 30 10 06 03 55 04 08 13 09 4d
69 6e 6e 65
Feb 14 20:25:15 tandoori pluto[2298]: | 73 6f 74 61 31 15 30 13 06 03 55 04
07 13 0c 45
Feb 14 20:25:15 tandoori pluto[2298]: | 64 65 6e 20 50 72 61 69 72 69 65 31
1e 30 1c 06
Feb 14 20:25:15 tandoori pluto[2298]: | 03 55 04 0a 13 15 52 65 61 6c 20 54
69 6d 65 20
Feb 14 20:25:15 tandoori pluto[2298]: | 45 6e 74 65 72 70 72 69 73 65 73 31
0c 30 0a 06
Feb 14 20:25:15 tandoori pluto[2298]: | 03 55 04 0b 13 03 56 50 4e 31 26 30
24 06 03 55
Feb 14 20:25:15 tandoori pluto[2298]: | 04 03 13 1d 52 54 45 20 56 50 4e 20
43 65 72 74
Feb 14 20:25:15 tandoori pluto[2298]: | 69 66 69 63 61 74 65 20 41 75 74 68
6f 72 69 74
Feb 14 20:25:15 tandoori pluto[2298]: | 79
Feb 14 20:25:15 tandoori pluto[2298]: | 'C=US, ST=Minnesota, L=Eden Prairie,
O=Real Time Enterprises, OU=VPN, CN=RTE VPN Certificate Authority'
Feb 14 20:25:15 tandoori pluto[2298]: | L2 - thisUpdate:
Feb 14 20:25:15 tandoori pluto[2298]: | L3 - utcTime:
Feb 14 20:25:15 tandoori pluto[2298]: | 'Sep 22 20:01:05 UTC 2003'
Feb 14 20:25:15 tandoori pluto[2298]: | L2 - nextUpdate:
Feb 14 20:25:15 tandoori pluto[2298]: | L3 - utcTime:
Feb 14 20:25:15 tandoori pluto[2298]: | 'Sep 21 20:01:05 UTC 2004'
Feb 14 20:25:15 tandoori pluto[2298]: | L1 - signatureAlgorithm:
Feb 14 20:25:15 tandoori pluto[2298]: | L2 - algorithmIdentifier:
Feb 14 20:25:15 tandoori pluto[2298]: | L3 - algorithm:
Feb 14 20:25:15 tandoori pluto[2298]: | 'md5WithRSAEncryption'
Feb 14 20:25:15 tandoori pluto[2298]: | L1 - signatureValue:
Feb 14 20:25:15 tandoori pluto[2298]: | 00 6b 5b ed 2b 0a f7 5d 05 54 cc ed
c1 df 2d aa
Feb 14 20:25:15 tandoori pluto[2298]: | f2 6c 42 2f be 5b d3 c2 6a 6d 3c 86
cc ed 12 4f
Feb 14 20:25:15 tandoori pluto[2298]: | 08 d7 6e b6 68 2e 01 c8 64 eb 23 17
db c0 0e bd
Feb 14 20:25:15 tandoori pluto[2298]: | b8 13 2a c8 ac 71 a3 f3 b0 34 6c 29
91 38 e6 42
Feb 14 20:25:15 tandoori pluto[2298]: | 6e 32 19 e8 f0 a3 6c a3 75 24 b3 32
42 0b d5 3d
Feb 14 20:25:15 tandoori pluto[2298]: | 6b 8c ff 71 3e 04 59 62 a4 01 45 13
65 36 78 c3
Feb 14 20:25:15 tandoori pluto[2298]: | 38 1a 35 8e 7c 4e c7 a5 b3 9b 1f 54
98 bc 16 2c
Feb 14 20:25:15 tandoori pluto[2298]: | bc cf 3e 5e 9e 0c d5 7b a3 0c 92 38
5d f7 b8 ba
Feb 14 20:25:15 tandoori pluto[2298]: | 00 63 69 de 06 b4 a7 98 30 8d 14 ea
27 7b 6d 85
Feb 14 20:25:15 tandoori pluto[2298]: | 22 dd 87 dd 8e 84 bd 30 db da 30 7e
ae 5d 6e 5c
Feb 14 20:25:15 tandoori pluto[2298]: | e9 45 5c a7 a7 90 cb 0c b0 c2 c2 9f
09 f9 e5 dc
Feb 14 20:25:15 tandoori pluto[2298]: | 74 7b 72 2c f9 8d d6 be c0 c4 e7 ae
51 7a 65 3c
Feb 14 20:25:15 tandoori pluto[2298]: | 74 0a ad f4 e8 43 48 68 c2 76 f1 c5
94 37 ec 19
Feb 14 20:25:15 tandoori pluto[2298]: | c1 e2 e3 f6 09 34 d2 37 7a 5c cc 17
3d 1e 02 50
Feb 14 20:25:15 tandoori pluto[2298]: | a1 45 f7 38 42 ee 59 32 55 9f f3 bc
bf 00 23 9b
Feb 14 20:25:15 tandoori pluto[2298]: | 86 71 eb 80 e1 46 13 88 29 4c 75 5c
36 00 b2 26
Feb 14 20:25:15 tandoori pluto[2298]: | 9d
Feb 14 20:25:15 tandoori pluto[2298]: | authcert list locked by 'insert_crl'
Feb 14 20:25:15 tandoori pluto[2298]: crl issuer cacert not found
Feb 14 20:25:15 tandoori pluto[2298]: | authcert list unlocked by 'insert_crl'
It's strange that Nate's log shows:
Feb 13 16:55:16 openswan pluto[10979]: Changing to directory '/etc/ipsec.d/crls'
Feb 13 16:55:16 openswan pluto[10979]: loaded crl file 'warden-crl.pem' (690
bytes)
Feb 13 16:55:16 openswan pluto[10979]: | file content is not binary ASN.1
Feb 13 16:55:16 openswan pluto[10979]: | -----BEGIN X509 CRL-----
Feb 13 16:55:16 openswan pluto[10979]: | -----END X509 CRL-----
Feb 13 16:55:16 openswan pluto[10979]: | file coded in PEM format
<eof>
i.e. his file size is 690 bytes whereas my copy has 702 bytes.
The file size is determined in certs.c:loaded_coded_file() using
fseek(fd, 0, SEEK_END );
blob->len = ftell(fd);
rewind(fd);
blob->ptr = alloc_bytes(blob->len, type);
bytes = fread(blob->ptr, 1, blob->len, fd);
fclose(fd);
Could it be that ftell() is giving wrong answers on certain platforms?
In Paul's case the file size seems to be 1'249'280 bytes.
Regards
Andreas
Paul Wouters wrote:
> This is a crl that according to Andreas looks normal, generated by Nat,
> killing openswan-2 HEAD:
>
> Program terminated with signal 11, Segmentation fault.
> Reading symbols from /usr/lib/libgmp.so.3...done.
> Loaded symbols for /usr/lib/libgmp.so.3
> Reading symbols from /lib/libresolv.so.2...done.
> Loaded symbols for /lib/libresolv.so.2
> Reading symbols from /lib/tls/libc.so.6...done.
> Loaded symbols for /lib/tls/libc.so.6
> Reading symbols from /lib/ld-linux.so.2...done.
> Loaded symbols for /lib/ld-linux.so.2
> #0 0x0080d4fe in malloc_consolidate () from /lib/tls/libc.so.6
> (gdb) bt
> #0 0x0080d4fe in malloc_consolidate () from /lib/tls/libc.so.6
> #1 0x0080caea in _int_malloc () from /lib/tls/libc.so.6
> #2 0x0080be9d in malloc () from /lib/tls/libc.so.6
> #3 0x08052bb2 in alloc_bytes (size=1249280, name=0x80a88a9 "crl")
> at defs.c:126
> #4 0x08085571 in load_coded_file (filename=0x8174acb "core.25629", pass=0x0,
> type=0x80a88a9 "crl", blob=0xbfe955e8, pgp=0xbfe955f4) at certs.c:83
> #5 0x08083070 in load_crls () at x509.c:1767
> #6 0x08057b2a in main (argc=7, argv=0xbfe958e4) at plutomain.c:639
>
> Note that the core file appears in /etc/ipsec.d/crls/ and not at the
> location defined in dumpdir=
>
> Paul
=======================================================================
Andreas Steffen e-mail: andreas.steffen at strongsec.com
strongSec GmbH home: http://www.strongsec.com
Alter Zürichweg 20 phone: +41 1 730 80 64
CH-8952 Schlieren (Switzerland) fax: +41 1 730 80 65
==========================================[strong internet security]===
More information about the Dev
mailing list