Bug 688010

Summary: python-m2crypto broken after latest openssl changes
Product: [openSUSE] openSUSE 12.1 Reporter: Bjørn Lie <zaitor>
Component: BasesystemAssignee: Cristian Rodríguez <crrodriguez>
Status: RESOLVED FIXED QA Contact: E-mail List <qa-bugs>
Severity: Major    
Priority: P3 - Medium CC: alinm.elena, bruno, crrodriguez, ismail, jmatejek, lnussel, meissner
Version: Factory   
Target Milestone: ---   
Hardware: x86-64   
OS: openSUSE 11.4   
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Bjørn Lie 2011-04-16 20:03:24 UTC
User-Agent:       Mozilla/5.0 (X11; Linux x86_64; rv:2.0.0) Gecko/20100101 Firefox/4.0

python-m2crypto-0.20.2-6.1.x86_64

bjolie@embla:~/build/> osc meta pkg openSUSE:Factory curl /usr/lib64/python2.7/site-packages/M2Crypto/__m2crypto.so: undefined symbol: SSLv2_method
M2Crypto is needed to access https://api.opensuse.org in a secure way.
Please install python-m2crypto.

bjolie@embla:~/> rpm -qa openssl
openssl-1.0.0d-89.1.x86_64

changelog last entry  openssl
* Wed Apr 13 2011 crrodriguez@opensuse.org
- Fix engine loading issues [bnc#660452]
- Update AES-NI patch to upstream version 4
- Drop CVE-2011-0014.patch and replace it with pristine tarball
  of 1.0.0d which only fixes this vulnerability.




Reproducible: Always

Steps to Reproduce:
1. install openssl
2. do osc ls ( or other osc commands)
3.
Comment 1 Bjørn Lie 2011-04-16 20:18:47 UTC
Downgrading to these versions fix it for me.

embla:~ # zypper se -is openssl
Loading repository data...
Reading installed packages...

S | Name                  | Type    | Version     | Arch   | Repository
--+-----------------------+---------+-------------+--------+-----------
i | libopenssl1_0_0       | package | 1.0.0c-16.2 | x86_64 | rpms_root 
i | libopenssl1_0_0-32bit | package | 1.0.0c-16.2 | x86_64 | rpms_root 
i | openssl               | package | 1.0.0c-19.1 | x86_64 | rpms_root 
i | python-openssl        | package | 0.11-2.2    | x86_64 | factory
Comment 2 Bjørn Lie 2011-04-16 20:50:38 UTC
I osc bco python-m2crypto, and added base:system to the repos to build against
openSUSE_Factory (i586, x86_64)
Base:System/openSUSE_Factory
devel:languages:python/openSUSE_Factory 

-- 
The build fails, so I guess we need to figure out how to fix the build of that package, or change the last change to openssl.

Added last person to touch openssl to cc


Link to buildlogs

https://build.opensuse.org/project/monitor?project=home%3AZaitor%3Abranches%3Adevel%3Alanguages%3Apython
Comment 3 Cristian Rodríguez 2011-04-16 21:01:05 UTC
SSLv2 support has been dropped from openSSL, and it is mentioned in the changelog ( a few entries above the one you mention )

The problem is in 

SWIG/_m2crypto_wrap.c line 15776

says..


result = (SSL_METHOD *)SSLv2_method(); 

the code should be something like

#ifdef OPENSSL_NO_SSL2
SWIG_fail;
#else
result = (SSL_METHOD *)SSLv2_method(); 
#endif

OR similar.
Comment 4 Cristian Rodríguez 2011-04-16 21:02:41 UTC
You may also find patches in Ubuntu,Debian or other distributions that currently build openSSL without SSlv2.
Comment 5 Cristian Rodríguez 2011-04-16 21:17:59 UTC
relevant google searches to figure out why ;)

http://www.google.cl/search?hl=es&q=openssl+sslv2


http://www.google.cl/search?hl=es&q=sslv2+vulnerabilities&aq=f&aqi=&aql=&oq=

and specially
http://osvdb.org/56387
(note the date, 1996..phasing it out after ...hrmmm more than 15 years, looks reasonable ;) )
Comment 6 Cristian Rodríguez 2011-04-16 21:44:03 UTC
Also "FTBFS sslv2 debian" search term may provide patches, in any case, the application/library/whatever MUST fail, either to build (like this case) or to estabilish the connection.
Comment 7 Alin M Elena 2011-04-17 09:30:58 UTC
*** Bug 688009 has been marked as a duplicate of this bug. ***
Comment 8 Marcus Meissner 2011-04-17 09:47:32 UTC
Cristian, revert this openssl change for now... this violates the rule of not breaking factory.

post a list of packages to be fixed to -factory.
Comment 9 Bruno Friedmann 2011-04-17 10:33:38 UTC
+1
Comment 10 Bjørn Lie 2011-04-17 11:35:48 UTC
Looking into m2crypto, I've tried to build it with latest upstream package 0.21.1,
that version obsoleted all current patches that we carry.

Unfortunatly this did not fix the build problem.

I then took all of fedoras patches, but I guess there is a diff i've overlooked
cause fedora makes this work with latest upstream package and without sslv2 

A packager with more experience with python probably need to take a look :-)

Fedora patches

http://pkgs.fedoraproject.org/gitweb/?p=m2crypto.git;a=tree;h=refs/heads/master;hb=master
Comment 11 Bruno Friedmann 2011-04-17 16:31:16 UTC
Other packages impacted php 

PHP Warning:  PHP Startup: Unable to load dynamic library '/usr/lib64/php5/extensions/openssl.so' - /usr/lib64/php5/extensions/openssl.so: undefined symbol: SSLv2_server_method in Unknown on line 0

Warning: PHP Startup: Unable to load dynamic library '/usr/lib64/php5/extensions/openssl.so' - /usr/lib64/php5/extensions/openssl.so: undefined symbol: SSLv2_server_method in Unknown on line 0
Comment 12 Cristian Rodríguez 2011-04-17 16:32:31 UTC
(In reply to comment #11)
> Other packages impacted php 
> 
> PHP Warning:  PHP Startup: Unable to load dynamic library
> '/usr/lib64/php5/extensions/openssl.so' -
> /usr/lib64/php5/extensions/openssl.so: undefined symbol: SSLv2_server_method in
> Unknown on line 0
> 
> Warning: PHP Startup: Unable to load dynamic library
> '/usr/lib64/php5/extensions/openssl.so' -
> /usr/lib64/php5/extensions/openssl.so: undefined symbol: SSLv2_server_method in
> Unknown on line 0


Again, I already fixed that, in fact, fixed pretty much everything. :|
Comment 13 Cristian Rodríguez 2011-04-17 16:45:22 UTC
 > Again, I already fixed that, in fact, fixed pretty much everything. :|

Exactly on apr 13 2011.
Comment 14 Cristian Rodríguez 2011-04-17 17:00:10 UTC
Ok, so before someone adds more packages.

CURL: (and all that depends on it) fixed apr 09 2011 in openSUSE and in upstream commit https://github.com/bagder/curl/commit/c66b0b32fba175d5f096c944d8ec8f9f06299f4a#lib/ssluse.c

Wget : http://bzr.savannah.gnu.org/lh/wget/trunk/revision/2479

PHP : http://bugs.php.net/bug.php?id=54507

Apache: SR# (number unknown, OBS is down)

also, mailx, and other has also been corrected, I dont know what else has to be fixed right now, will check it as soon as the OBS comes back to life..
Comment 15 Ismail Dönmez 2011-04-18 07:13:08 UTC
(In reply to comment #14)
> Ok, so before someone adds more packages.
> 
> CURL: (and all that depends on it) fixed apr 09 2011 in openSUSE and in
> upstream commit
> https://github.com/bagder/curl/commit/c66b0b32fba175d5f096c944d8ec8f9f06299f4a#lib/ssluse.c
> 
> Wget : http://bzr.savannah.gnu.org/lh/wget/trunk/revision/2479
> 
> PHP : http://bugs.php.net/bug.php?id=54507
> 
> Apache: SR# (number unknown, OBS is down)
> 
> also, mailx, and other has also been corrected, I dont know what else has to be
> fixed right now, will check it as soon as the OBS comes back to life..

What is the SR# for python-m2crypto btw, I can't see it in the package's web interface.
Comment 16 Jan Matejek 2011-04-18 13:59:31 UTC
(In reply to comment #15)
> What is the SR# for python-m2crypto btw, I can't see it in the package's web
> interface.

apparently it was already accepted into factory
https://build.opensuse.org/package/files?package=python-m2crypto&project=openSUSE%3AFactory
Comment 17 Bruno Friedmann 2011-04-19 05:24:28 UTC
Apache2 nor php5 are not working actually even after update ? 

zypper se -s -i apache2 openssl
Loading repository data...
Reading installed packages...

S | Name                                | Type    | Version      | Arch   | Repository        
--+-------------------------------------+---------+--------------+--------+-------------------
i | apache2                             | package | 2.2.17-5.2   | x86_64 | factory-oss       
i | apache2-debuginfo                   | package | 2.2.17-5.2   | x86_64 | factory-debug     
i | apache2-devel                       | package | 2.2.17-5.2   | x86_64 | factory-oss       
i | apache2-doc                         | package | 2.2.17-5.2   | noarch | factory-oss       
i | apache2-example-pages               | package | 2.2.17-5.2   | x86_64 | factory-oss       
i | apache2-icons-oxygen                | package | 1.0.0-2.1    | noarch | factory-oss       
i | apache2-itk                         | package | 2.2.17-5.2   | x86_64 | factory-oss       
i | apache2-itk-debuginfo               | package | 2.2.17-5.2   | x86_64 | factory-debug     
i | apache2-mod_dnssd                   | package | 0.6-9.8      | x86_64 | factory-oss       
i | apache2-mod_dnssd-debuginfo         | package | 0.6-9.8      | x86_64 | factory-debug     
i | apache2-mod_fcgid                   | package | 2.3.6-2.3    | x86_64 | factory-oss       
i | apache2-mod_fcgid-debuginfo         | package | 2.3.6-2.3    | x86_64 | factory-debug     
i | apache2-mod_mono                    | package | 2.10-4.1     | x86_64 | factory-oss       
i | apache2-mod_mono-debuginfo          | package | 2.10-4.1     | x86_64 | factory-debug     
i | apache2-mod_perl                    | package | 2.0.4-54.1   | x86_64 | factory-oss       
i | apache2-mod_perl-debuginfo          | package | 2.0.4-54.1   | x86_64 | factory-debug     
i | apache2-mod_php5                    | package | 5.3.6-68.1   | x86_64 | factory-server:php
i | apache2-mod_php5-debuginfo          | package | 5.3.6-68.1   | x86_64 | factory-server:php
i | apache2-mod_python                  | package | 3.3.1-164.1  | x86_64 | factory-oss       
i | apache2-mod_python-debuginfo        | package | 3.3.1-164.1  | x86_64 | factory-debug     
i | apache2-mod_security2               | package | 2.5.9-8.10   | x86_64 | factory-oss       
i | apache2-mod_security2-debuginfo     | package | 2.5.9-8.10   | x86_64 | factory-debug     
i | apache2-prefork                     | package | 2.2.17-5.2   | x86_64 | factory-oss       
i | apache2-prefork-debuginfo           | package | 2.2.17-5.2   | x86_64 | factory-debug     
i | apache2-utils                       | package | 2.2.17-5.2   | x86_64 | factory-oss       
i | apache2-utils-debuginfo             | package | 2.2.17-5.2   | x86_64 | factory-debug     
i | compat-openssl097g                  | package | 0.9.7g-159.1 | x86_64 | factory-oss       
i | libopenssl-devel                    | package | 1.0.0d-21.1  | x86_64 | (System Packages) 
i | libopenssl0_9_8                     | package | 0.9.8m-9.1   | x86_64 | factory-oss       
i | libopenssl0_9_8-32bit               | package | 0.9.8m-9.1   | x86_64 | factory-oss       
i | libopenssl0_9_8-debuginfo-32bit     | package | 0.9.8m-9.1   | x86_64 | factory-debug     
i | libopenssl1_0_0                     | package | 1.0.0d-21.1  | x86_64 | (System Packages) 
i | libopenssl1_0_0-32bit               | package | 1.0.0d-21.1  | x86_64 | (System Packages) 
i | libopenssl1_0_0-debuginfo           | package | 1.0.0d-21.1  | x86_64 | (System Packages) 
i | openssl                             | package | 1.0.0d-21.1  | x86_64 | (System Packages) 
i | perl-Crypt-OpenSSL-Bignum           | package | 0.04-11.4    | x86_64 | factory-oss       
i | perl-Crypt-OpenSSL-Bignum-debuginfo | package | 0.04-11.4    | x86_64 | factory-debug     
i | perl-Crypt-OpenSSL-RSA              | package | 0.26-5.4     | x86_64 | factory-oss       
i | perl-Crypt-OpenSSL-RSA-debuginfo    | package | 0.26-5.4     | x86_64 | factory-debug     
i | perl-Crypt-OpenSSL-Random           | package | 0.04-11.4    | x86_64 | factory-oss       
i | perl-Crypt-OpenSSL-Random-debuginfo | package | 0.04-11.4    | x86_64 | factory-debug     
i | php5-openssl                        | package | 5.3.6-68.1   | x86_64 | factory-server:php
i | php5-openssl-debuginfo              | package | 5.3.6-68.1   | x86_64 | factory-server:php
i | python-openssl                      | package | 0.11-2.2     | x86_64 | factory-oss   



PHP Warning:  PHP Startup: Unable to load dynamic library '/usr/lib64/php5/extensions/openssl.so' - /usr/lib64/php5/extensions/openssl.so: undefined symbol: SSLv2_server_method in Unknown on line 0

Warning: PHP Startup: Unable to load dynamic library '/usr/lib64/php5/extensions/openssl.so' - /usr/lib64/php5/extensions/openssl.so: undefined symbol: SSLv2_server_method in Unknown on line 0
 
httpd2-prefork: Syntax error on line 116 of /etc/apache2/httpd.conf: Syntax error on line 53 of /etc/apache2/sysconfig.d/loadmodule.conf: Cannot load /usr/lib64/apache2-prefork/mod_ssl.so into server: /usr/lib64/apache2-prefork/mod_ssl.so: undefined symbol: SSLv2_client_method


nor libcurl
cmake: symbol lookup error: /usr/lib64/libcurl.so.4: undefined symbol: SSLv2_client_method

nor svn 
svn: symbol lookup error: /usr/lib64/libneon.so.27: undefined symbol: SSLv2_server_method

etc etc ... 
This need a fix now.
Comment 18 Cristian Rodríguez 2011-04-19 13:44:55 UTC
There is nothing to fix, it is a build problem, coolo reverted the openssl change already.
Comment 19 Bjørn Lie 2011-04-26 20:36:52 UTC
As per comment 18 - I'm closing the bug