[openssl-dev] [openssl.org #4434] Gentoo 13, x86_64: 4 failed self tests

[via RT]

Working from Master on a Gentoo 13 machine, x86_64. The test was run
as root which explains one of the failures (I don't have users or SSH
set up yet).

Kernel is 4.1.15, GCC is 4.9.3.

$ make test
...

( cd test; \
SRCTOP=../. \
BLDTOP=../. \
EXE_EXT= \
/usr/bin/perl .././test/run_tests.pl )
../test/recipes/01-test_ordinals.t ........ ok
../test/recipes/05-test_bf.t .............. ok
../test/recipes/05-test_cast.t ............ ok
../test/recipes/05-test_des.t ............. ok
../test/recipes/05-test_hmac.t ............ ok
../test/recipes/05-test_idea.t ............ ok
../test/recipes/05-test_md2.t ............. skipped: md2 is not
supported by this OpenSSL build
../test/recipes/05-test_md4.t ............. ok
../test/recipes/05-test_md5.t ............. ok
../test/recipes/05-test_mdc2.t ............ ok
../test/recipes/05-test_rand.t ............ ok
../test/recipes/05-test_rc2.t ............. ok
../test/recipes/05-test_rc4.t ............. ok
../test/recipes/05-test_rc5.t ............. skipped: rc5 is not
supported by this OpenSSL build
../test/recipes/05-test_rmd.t ............. ok
../test/recipes/05-test_sha1.t ............ ok
../test/recipes/05-test_sha256.t .......... ok
../test/recipes/05-test_sha512.t .......... ok
../test/recipes/05-test_wp.t .............. ok
../test/recipes/10-test_bn.t .............. ok
../test/recipes/10-test_exp.t ............. ok
../test/recipes/15-test_dh.t .............. ok
../test/recipes/15-test_dsa.t ............. ok
../test/recipes/15-test_ec.t .............. ok
../test/recipes/15-test_ecdh.t ............ ok
../test/recipes/15-test_ecdsa.t ........... ok
../test/recipes/15-test_rsa.t ............. ok
../test/recipes/20-test_enc.t ............. ok
../test/recipes/25-test_crl.t ............. ok
../test/recipes/25-test_gen.t ............. ok
../test/recipes/25-test_pkcs7.t ........... ok
../test/recipes/25-test_req.t ............. ok
../test/recipes/25-test_sid.t ............. ok
../test/recipes/25-test_verify.t .......... ok
../test/recipes/25-test_x509.t ............ ok

# Failed test 'running afalgtest'
# at ../test/recipes/30-test_afalg.t line 68.
# Looks like you failed 1 test of 1.
../test/recipes/30-test_afalg.t ...........
Dubious, test returned 1 (wstat 256, 0x100)
Failed 1/1 subtests
../test/recipes/30-test_engine.t .......... ok
../test/recipes/30-test_evp.t ............. ok
../test/recipes/30-test_evp_extra.t ....... ok
../test/recipes/30-test_pbelu.t ........... ok

# Failed test 'Testing that we aren't running as a privileged user,
such as root'
# at ../test/recipes/40-test_rehash.t line 41.
# Looks like you failed 1 test of 5.
../test/recipes/40-test_rehash.t ..........
Dubious, test returned 1 (wstat 256, 0x100)
Failed 1/5 subtests
(less 1 skipped subtest: 3 okay)
../test/recipes/70-test_clienthello.t ..... ok
../test/recipes/70-test_packet.t .......... ok
../test/recipes/70-test_sslcertstatus.t ... skipped:
test_sslcertstatus needs the dynamic engine feature enabled
../test/recipes/70-test_sslextension.t .... skipped: test_sslextension
needs the dynamic engine feature enabled
../test/recipes/70-test_sslsessiontick.t .. skipped:
test_sslsessiontick needs the dynamic engine feature enabled
../test/recipes/70-test_sslskewith0p.t .... skipped: test_sslskewith0p
needs the dynamic engine feature enabled
../test/recipes/70-test_sslvertol.t ....... skipped: test_sslextension
needs the dynamic engine feature enabled
../test/recipes/70-test_tlsextms.t ........ skipped: test_tlsextms
needs the dynamic engine feature enabled
../test/recipes/70-test_verify_extra.t .... ok
../test/recipes/80-test_ca.t .............. ok
../test/recipes/80-test_cms.t ............. ok
../test/recipes/80-test_ct.t .............. ok
../test/recipes/80-test_dane.t ............ ok
../test/recipes/80-test_dtlsv1listen.t .... ok
../test/recipes/80-test_ocsp.t ............ ok
../test/recipes/80-test_ssl.t ............. ok
../test/recipes/80-test_tsa.t ............. ok
../test/recipes/90-test_async.t ........... ok
../test/recipes/90-test_constant_time.t ... ok
../test/recipes/90-test_gmdiff.t .......... ok
../test/recipes/90-test_heartbeat.t ....... skipped: heartbeats is not
supported by this OpenSSL build
../test/recipes/90-test_ige.t ............. ok
../test/recipes/90-test_memleak.t ......... ok
../test/recipes/90-test_networking.t ...... skipped: test_networking
needs the dynamic engine feature enabled
../test/recipes/90-test_np.t .............. ok
../test/recipes/90-test_p5_crpt2.t ........ ok
../test/recipes/90-test_secmem.t .......... ok
../test/recipes/90-test_srp.t ............. ok
../test/recipes/90-test_threads.t ......... ok
../test/recipes/90-test_v3name.t .......... ok

Test Summary Report
-------------------
../test/recipes/30-test_afalg.t (Wstat: 256 Tests: 1 Failed: 1)
Failed test: 1
Non-zero exit status: 1
../test/recipes/40-test_rehash.t (Wstat: 256 Tests: 5 Failed: 1)
Failed test: 4
Non-zero exit status: 1
Files=71, Tests=367, 31 wallclock secs ( 0.41 usr 0.10 sys + 22.79
cusr 4.20 csys = 27.50 CPU)
Result: FAIL
Failed 2/71 test programs. 2/367 subtests failed.
Makefile:122: recipe for target 'test' failed
make: *** [test] Error 255

-----

$ ./config
Operating system: x86_64-whatever-linux2
Configuring for linux-x86_64
Configuring OpenSSL version 1.1.0-pre4-dev (0x0x10100004L)
no-crypto-mdebug [default] OPENSSL_NO_CRYPTO_MDEBUG (skip dir)
no-crypto-mdebug-backtrace [forced]
OPENSSL_NO_CRYPTO_MDEBUG_BACKTRACE (skip dir)
no-dynamic-engine [forced]
no-ec_nistp_64_gcc_128 [default] OPENSSL_NO_EC_NISTP_64_GCC_128 (skip dir)
no-egd [default] OPENSSL_NO_EGD (skip dir)
no-heartbeats [default] OPENSSL_NO_HEARTBEATS (skip dir)
no-md2 [default] OPENSSL_NO_MD2 (skip dir)
no-rc5 [default] OPENSSL_NO_RC5 (skip dir)
no-sctp [default] OPENSSL_NO_SCTP (skip dir)
no-shared [default]
no-ssl-trace [default] OPENSSL_NO_SSL_TRACE (skip dir)
no-ssl3 [default] OPENSSL_NO_SSL3 (skip dir)
no-ssl3-method [default] OPENSSL_NO_SSL3_METHOD (skip dir)
no-unit-test [default] OPENSSL_NO_UNIT_TEST (skip dir)
no-weak-ssl-ciphers [default] OPENSSL_NO_WEAK_SSL_CIPHERS (skip dir)
no-zlib [default]
no-zlib-dynamic [default]
Configuring for linux-x86_64
IsMK1MF =no
CC =gcc
CFLAG =-Wall -O3 -pthread -m64 -DL_ENDIAN -Wa,--noexecstack
SHARED_CFLAG =-fPIC
DEFINES =DSO_DLFCN HAVE_DLFCN_H OPENSSL_THREADS
OPENSSL_NO_DYNAMIC_ENGINE OPENSSL_PIC OPENSSL_IA32_SSE2
OPENSSL_BN_ASM_MONT OPENSSL_BN_ASM_MONT5 OPENSSL_BN_ASM_GF2m SHA1_ASM
SHA256_ASM SHA512_ASM MD5_ASM AES_ASM VPAES_ASM BSAES_ASM GHASH_ASM
ECP_NISTZ256_ASM POLY1305_ASM
LFLAG =
PLIB_LFLAG =
EX_LIBS =-ldl
APPS_OBJ =
CPUID_OBJ =x86_64cpuid.o
UPLINK_OBJ =
BN_ASM =asm/x86_64-gcc.o x86_64-mont.o x86_64-mont5.o
x86_64-gf2m.o rsaz_exp.o rsaz-x86_64.o rsaz-avx2.o
EC_ASM =ecp_nistz256.o ecp_nistz256-x86_64.o
DES_ENC =des_enc.o fcrypt_b.o
AES_ENC =aes-x86_64.o vpaes-x86_64.o bsaes-x86_64.o
aesni-x86_64.o aesni-sha1-x86_64.o aesni-sha256-x86_64.o
aesni-mb-x86_64.o
BF_ENC =bf_enc.o
CAST_ENC =c_enc.o
RC4_ENC =rc4-x86_64.o rc4-md5-x86_64.o
RC5_ENC =rc5_enc.o
MD5_OBJ_ASM =md5-x86_64.o
SHA1_OBJ_ASM =sha1-x86_64.o sha256-x86_64.o sha512-x86_64.o
sha1-mb-x86_64.o sha256-mb-x86_64.o
RMD160_OBJ_ASM=
CMLL_ENC =cmll-x86_64.o cmll_misc.o
MODES_OBJ =ghash-x86_64.o aesni-gcm-x86_64.o
PADLOCK_OBJ =e_padlock-x86_64.o
CHACHA_ENC =chacha-x86_64.o
POLY1305_OBJ =poly1305-x86_64.o
BLAKE2_OBJ =
PROCESSOR =
RANLIB =/usr/bin/ranlib
ARFLAGS =
PERL =/usr/bin/perl

SIXTY_FOUR_BIT_LONG mode

Configured for linux-x86_64.

[Matt Caswell via RT]

What happens if you run the afalgtest directly?

$ cd test
$ ./afalgtest


Matt

Post by via RT
Working from Master on a Gentoo 13 machine, x86_64. The test was run
as root which explains one of the failures (I don't have users or SSH
set up yet).
Kernel is 4.1.15, GCC is 4.9.3.
$ make test
...
( cd test; \
SRCTOP=../. \
BLDTOP=../. \
EXE_EXT= \
/usr/bin/perl .././test/run_tests.pl )
../test/recipes/01-test_ordinals.t ........ ok
../test/recipes/05-test_bf.t .............. ok
../test/recipes/05-test_cast.t ............ ok
../test/recipes/05-test_des.t ............. ok
../test/recipes/05-test_hmac.t ............ ok
../test/recipes/05-test_idea.t ............ ok
../test/recipes/05-test_md2.t ............. skipped: md2 is not
supported by this OpenSSL build
../test/recipes/05-test_md4.t ............. ok
../test/recipes/05-test_md5.t ............. ok
../test/recipes/05-test_mdc2.t ............ ok
../test/recipes/05-test_rand.t ............ ok
../test/recipes/05-test_rc2.t ............. ok
../test/recipes/05-test_rc4.t ............. ok
../test/recipes/05-test_rc5.t ............. skipped: rc5 is not
supported by this OpenSSL build
../test/recipes/05-test_rmd.t ............. ok
../test/recipes/05-test_sha1.t ............ ok
../test/recipes/05-test_sha256.t .......... ok
../test/recipes/05-test_sha512.t .......... ok
../test/recipes/05-test_wp.t .............. ok
../test/recipes/10-test_bn.t .............. ok
../test/recipes/10-test_exp.t ............. ok
../test/recipes/15-test_dh.t .............. ok
../test/recipes/15-test_dsa.t ............. ok
../test/recipes/15-test_ec.t .............. ok
../test/recipes/15-test_ecdh.t ............ ok
../test/recipes/15-test_ecdsa.t ........... ok
../test/recipes/15-test_rsa.t ............. ok
../test/recipes/20-test_enc.t ............. ok
../test/recipes/25-test_crl.t ............. ok
../test/recipes/25-test_gen.t ............. ok
../test/recipes/25-test_pkcs7.t ........... ok
../test/recipes/25-test_req.t ............. ok
../test/recipes/25-test_sid.t ............. ok
../test/recipes/25-test_verify.t .......... ok
../test/recipes/25-test_x509.t ............ ok
# Failed test 'running afalgtest'
# at ../test/recipes/30-test_afalg.t line 68.
# Looks like you failed 1 test of 1.
../test/recipes/30-test_afalg.t ...........
Dubious, test returned 1 (wstat 256, 0x100)
Failed 1/1 subtests
../test/recipes/30-test_engine.t .......... ok
../test/recipes/30-test_evp.t ............. ok
../test/recipes/30-test_evp_extra.t ....... ok
../test/recipes/30-test_pbelu.t ........... ok
# Failed test 'Testing that we aren't running as a privileged user,
such as root'
# at ../test/recipes/40-test_rehash.t line 41.
# Looks like you failed 1 test of 5.
../test/recipes/40-test_rehash.t ..........
Dubious, test returned 1 (wstat 256, 0x100)
Failed 1/5 subtests
(less 1 skipped subtest: 3 okay)
../test/recipes/70-test_clienthello.t ..... ok
../test/recipes/70-test_packet.t .......... ok
test_sslcertstatus needs the dynamic engine feature enabled
../test/recipes/70-test_sslextension.t .... skipped: test_sslextension
needs the dynamic engine feature enabled
test_sslsessiontick needs the dynamic engine feature enabled
../test/recipes/70-test_sslskewith0p.t .... skipped: test_sslskewith0p
needs the dynamic engine feature enabled
../test/recipes/70-test_sslvertol.t ....... skipped: test_sslextension
needs the dynamic engine feature enabled
../test/recipes/70-test_tlsextms.t ........ skipped: test_tlsextms
needs the dynamic engine feature enabled
../test/recipes/70-test_verify_extra.t .... ok
../test/recipes/80-test_ca.t .............. ok
../test/recipes/80-test_cms.t ............. ok
../test/recipes/80-test_ct.t .............. ok
../test/recipes/80-test_dane.t ............ ok
../test/recipes/80-test_dtlsv1listen.t .... ok
../test/recipes/80-test_ocsp.t ............ ok
../test/recipes/80-test_ssl.t ............. ok
../test/recipes/80-test_tsa.t ............. ok
../test/recipes/90-test_async.t ........... ok
../test/recipes/90-test_constant_time.t ... ok
../test/recipes/90-test_gmdiff.t .......... ok
../test/recipes/90-test_heartbeat.t ....... skipped: heartbeats is not
supported by this OpenSSL build
../test/recipes/90-test_ige.t ............. ok
../test/recipes/90-test_memleak.t ......... ok
../test/recipes/90-test_networking.t ...... skipped: test_networking
needs the dynamic engine feature enabled
../test/recipes/90-test_np.t .............. ok
../test/recipes/90-test_p5_crpt2.t ........ ok
../test/recipes/90-test_secmem.t .......... ok
../test/recipes/90-test_srp.t ............. ok
../test/recipes/90-test_threads.t ......... ok
../test/recipes/90-test_v3name.t .......... ok
Test Summary Report
-------------------
../test/recipes/30-test_afalg.t (Wstat: 256 Tests: 1 Failed: 1)
Failed test: 1
Non-zero exit status: 1
../test/recipes/40-test_rehash.t (Wstat: 256 Tests: 5 Failed: 1)
Failed test: 4
Non-zero exit status: 1
Files=71, Tests=367, 31 wallclock secs ( 0.41 usr 0.10 sys + 22.79
cusr 4.20 csys = 27.50 CPU)
Result: FAIL
Failed 2/71 test programs. 2/367 subtests failed.
Makefile:122: recipe for target 'test' failed
make: *** [test] Error 255
-----
$ ./config
Operating system: x86_64-whatever-linux2
Configuring for linux-x86_64
Configuring OpenSSL version 1.1.0-pre4-dev (0x0x10100004L)
no-crypto-mdebug [default] OPENSSL_NO_CRYPTO_MDEBUG (skip dir)
no-crypto-mdebug-backtrace [forced]
OPENSSL_NO_CRYPTO_MDEBUG_BACKTRACE (skip dir)
no-dynamic-engine [forced]
no-ec_nistp_64_gcc_128 [default] OPENSSL_NO_EC_NISTP_64_GCC_128 (skip dir)
no-egd [default] OPENSSL_NO_EGD (skip dir)
no-heartbeats [default] OPENSSL_NO_HEARTBEATS (skip dir)
no-md2 [default] OPENSSL_NO_MD2 (skip dir)
no-rc5 [default] OPENSSL_NO_RC5 (skip dir)
no-sctp [default] OPENSSL_NO_SCTP (skip dir)
no-shared [default]
no-ssl-trace [default] OPENSSL_NO_SSL_TRACE (skip dir)
no-ssl3 [default] OPENSSL_NO_SSL3 (skip dir)
no-ssl3-method [default] OPENSSL_NO_SSL3_METHOD (skip dir)
no-unit-test [default] OPENSSL_NO_UNIT_TEST (skip dir)
no-weak-ssl-ciphers [default] OPENSSL_NO_WEAK_SSL_CIPHERS (skip dir)
no-zlib [default]
no-zlib-dynamic [default]
Configuring for linux-x86_64
IsMK1MF =no
CC =gcc
CFLAG =-Wall -O3 -pthread -m64 -DL_ENDIAN -Wa,--noexecstack
SHARED_CFLAG =-fPIC
DEFINES =DSO_DLFCN HAVE_DLFCN_H OPENSSL_THREADS
OPENSSL_NO_DYNAMIC_ENGINE OPENSSL_PIC OPENSSL_IA32_SSE2
OPENSSL_BN_ASM_MONT OPENSSL_BN_ASM_MONT5 OPENSSL_BN_ASM_GF2m SHA1_ASM
SHA256_ASM SHA512_ASM MD5_ASM AES_ASM VPAES_ASM BSAES_ASM GHASH_ASM
ECP_NISTZ256_ASM POLY1305_ASM
LFLAG =
PLIB_LFLAG =
EX_LIBS =-ldl
APPS_OBJ =
CPUID_OBJ =x86_64cpuid.o
UPLINK_OBJ =
BN_ASM =asm/x86_64-gcc.o x86_64-mont.o x86_64-mont5.o
x86_64-gf2m.o rsaz_exp.o rsaz-x86_64.o rsaz-avx2.o
EC_ASM =ecp_nistz256.o ecp_nistz256-x86_64.o
DES_ENC =des_enc.o fcrypt_b.o
AES_ENC =aes-x86_64.o vpaes-x86_64.o bsaes-x86_64.o
aesni-x86_64.o aesni-sha1-x86_64.o aesni-sha256-x86_64.o
aesni-mb-x86_64.o
BF_ENC =bf_enc.o
CAST_ENC =c_enc.o
RC4_ENC =rc4-x86_64.o rc4-md5-x86_64.o
RC5_ENC =rc5_enc.o
MD5_OBJ_ASM =md5-x86_64.o
SHA1_OBJ_ASM =sha1-x86_64.o sha256-x86_64.o sha512-x86_64.o
sha1-mb-x86_64.o sha256-mb-x86_64.o
RMD160_OBJ_ASM=
CMLL_ENC =cmll-x86_64.o cmll_misc.o
MODES_OBJ =ghash-x86_64.o aesni-gcm-x86_64.o
PADLOCK_OBJ =e_padlock-x86_64.o
CHACHA_ENC =chacha-x86_64.o
POLY1305_OBJ =poly1305-x86_64.o
BLAKE2_OBJ =
PROCESSOR =
RANLIB =/usr/bin/ranlib
ARFLAGS =
PERL =/usr/bin/perl
SIXTY_FOUR_BIT_LONG mode
Configured for linux-x86_64.

[via RT]

Post by Matt Caswell via RT
What happens if you run the afalgtest directly?
$ cd test
$ ./afalgtest

./afalgtest
ALG_PERR: afalg_create_sk: Failed to open socket : Address family not
supported by protocol
test_afalg_aes_128_cbc() failed encryption

And:

$ git reset --hard HEAD && git pull
HEAD is now at 43c1fd6 Deal with DSA_SIG opaqueness.
Already up-to-date.

Jeff

[via RT]

Post by Matt Caswell via RT

Post by Matt Caswell via RT
What happens if you run the afalgtest directly?
$ cd test
$ ./afalgtest

./afalgtest
ALG_PERR: afalg_create_sk: Failed to open socket : Address family not
supported by protocol
test_afalg_aes_128_cbc() failed encryption

It appears I missed the following kernel configuration parameters when
building the kernel:

* CONFIG_CRYPTO_USER_API=m
* CONFIG_CRYPTO_USER_API_HASH=m
* CONFIG_CRYPTO_USER_API_SKCIPHER=m

Maybe what should be done for the engine is to determine if the kernel
supports AF_ALG, and latch the result at startup. Perhaps something
like the following in afalg_chk_platform():

$ git diff engines/afalg/e_afalg.c
diff --git a/engines/afalg/e_afalg.c b/engines/afalg/e_afalg.c
index 90d7602..e2b5896 100644
--- a/engines/afalg/e_afalg.c
+++ b/engines/afalg/e_afalg.c
@@ -799,7 +799,11 @@ static int afalg_chk_platform(void)
return 0;
}

- return 1;
+ ret = socket(AF_ALG, SOCK_SEQPACKET, 0);
+ if(ret != -1)
+ close(ret);
+
+ return !!(ret != -1);
}

# ifdef OPENSSL_NO_DYNAMIC_ENGINE

When runtime testing for AF_ALG is added to afalg_chk_platform(), then
the test fails with:

$ ./test/afalgtest
AFALG Test: Failed to load AFALG Engine

Jeff

[Matt Caswell via RT]

Jeff

Please can you check this again on latest master. Is this still an issue?

Thanks

Matt

[Matt Caswell via RT]

Hi Jeff

Please could you try the attached patch?

Thanks

Matt