Subject: [alpine-devel] Switching back to OpenSSL

From: Natanael Copa <[email-masked]>
Date: Thu, 11 Oct 2018 17:17:46 +0200

Hi,

Are there any good reasons to not switch back to OpenSSL for v3.9?

Some reasons why I think we should switch back to OpenSSL:
- better upstream support from projects
- To my understanding, various of the issues in OpenSSL that made us
  switch to libressl have been resolved. (for example memory management)
- libressl failed to retain compability with OpenSSL
- libressl breaks ABI every 6 months, OpenSSL does not
- FIPS support

Some reasons to why we may continue with libressl may be:
- its smaller
- has fewer CVEs (due to their approach to remove stuff)
- libtls

Previous thread on the issue:
http://lists.alpinelinux.org/alpine-devel/6073.html

-nc

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---

---

From: Leonardo Arena <[email-masked]>
Date: Thu, 11 Oct 2018 18:39:14 +0200

> http://lists.alpinelinux.org/alpine-devel/6073.html
I think that the package maintenance work alone doesn't justify LibreSSL
pros, not to mention that some packages never worked with LibreSSL (not
implying that is due to LibreSSL fault).

+1 to revert.

/eo

---

From: "Laurent Bercot" <[email-masked]>
Date: Thu, 11 Oct 2018 17:40:58 +0000

>>Are there any good reasons to not switch back to OpenSSL for v3.9?

  Please confirm that "switching back" means using the OpenSSL library
again as a dependency for base packages, and *not* dropping the
packaging of LibreSSL (that some software specifically depends on).

  If it's the case, I have no objection.
  Thanks,

--
  Laurent

---

---

From: William Pitcock <[email-masked]>
Date: Fri, 12 Oct 2018 08:00:54 -0500

Hi,

> packaging of LibreSSL (that some software specifically depends on).

I prefer to drop the packaging, there are serious ABI problems when
you combine software that use OpenSSL with other software that use
LibreSSL.

But, I can split out the LibreSSL libtls as a standalone package and
adapt it to use with our OpenSSL packages.  It is something we plan to
do in Adélie anyway, so it may as well be incubated upstream.

>   If it's the case, I have no objection.

Would the above solution be sufficient to resolve your concerns?

William

---

---

From: "Laurent Bercot" <[email-masked]>
Date: Fri, 12 Oct 2018 17:30:04 +0000

>Would the above solution be sufficient to resolve your concerns?

  Yes, an alternative implementation of libtls works for me.
  Thanks!

--
  Laurent

---

---

From: Natanael Copa <[email-masked]>
Date: Fri, 12 Oct 2018 20:12:58 +0200

On Fri, 12 Oct 2018 17:30:04 +0000

>   Yes, an alternative implementation of libtls works for me.

We use libtls for our ssl_client for busybox wget, so yes, we need some
sort of libtls implementation.

I think there are some port of it to OpenSSL out there, but I don't
know what the state is.

-nc

---

---

From: William Pitcock <[email-masked]>
Date: Sat, 13 Oct 2018 11:43:34 -0500

Hi,

> I think there are some port of it to OpenSSL out there, but I don't

I created an aport which builds LibreSSL's libtls against some compat
stubs and links against system openssl.  This is, for obvious reasons,
living in testing.
Can people give it a go and tell me if it works?

Some very light testing indicates success thus far, but...

William

---

---

From: Natanael Copa <[email-masked]>
Date: Tue, 23 Oct 2018 19:59:55 +0200

On Sat, 13 Oct 2018 11:43:34 -0500
 
> Can people give it a go and tell me if it works?

Hi!

I pushed openssl 1.1 to testing. It seems like libtls-standalone does
not build against it?

-nc

---

---

From: William Pitcock <[email-masked]>
Date: Wed, 24 Oct 2018 18:46:27 -0500

Hi,

> I pushed openssl 1.1 to testing. It seems like libtls-standalone does

I pushed a new libtls-standalone which has been ported to use OpenSSL
1.1.0 APIs.  I intend to clean this up and present it for upstream
consideration, so hopefully we can drop those patches soon.

William

---

---

From: William Pitcock <[email-masked]>
Date: Tue, 23 Oct 2018 00:07:55 -0500

Hi,

> Some very light testing indicates success thus far, but...

Has anyone tried using the libtls-standalone package in testing as of
yet?  It would be nice to know if it is working for others.

William

---

---

From: Natanael Copa <[email-masked]>
Date: Tue, 23 Oct 2018 13:35:53 +0200

On Tue, 23 Oct 2018 00:07:55 -0500

> yet?  It would be nice to know if it is working for others.

I haven't yet. I was thinking to get the openssl 1.1. package built
first and maybe pushed to either main or testing.

Once that is done I will test it with our ssl_client with busybox.

-nc

---

---

From: Natanael Copa <[email-masked]>
Date: Thu, 25 Oct 2018 14:44:00 +0200

Hi,

I tested it with our ssl_client busybox helper and it works as
expected. I had to add a missing libtls.so symlink to the
libtls-standalone-dev package, though.

There is another problem though, that it conflicts with the libressl
libtls. After libtls-standalone was installed, I cannot uninstall it:

ncopa-edge-x86_64:~/aports/main/busybox$ sudo apk del libtls-standalone
World updated, but the following packages are not removed due to:
  libtls-standalone: libressl abuild aports-build .alpine-release-deps
  ssl_client

This happens because both libressl libtls and libtls-standalone
provides so:libtls.so.17.

ncopa-edge-x86_64:~/aports/main/busybox$ apk info -R libressl
libressl-2.7.4-r1 depends on:
so:libc.musl-x86_64.so.1
so:libcrypto.so.43
so:libssl.so.45
so:libtls.so.17

I think that the fix for this is to use the openssl ABI, libtls.so.1.1,
or use a completely different name, like libtls-standalone.so.17 or
libtls1.1.so.17. Anything that does not conflict with libressl's libtls.

-nc

---

---

From: William Pitcock <[email-masked]>
Date: Sat, 27 Oct 2018 18:00:53 -0500

Hello,

> libtls-standalone-dev package, though.

Great to hear it works.  I'll fix the symlink problem.

> libtls1.1.so.17. Anything that does not conflict with libressl's libtls.

I propose that we install the file as libtls-standalone.so.1 and use a
Provides rule in libtls.pc.in to allow us to save it as
libtls-standalone.pc.

Thoughts?

William

---

---

From: Natanael Copa <[email-masked]>
Date: Sun, 28 Oct 2018 20:04:46 +0100

On Sat, 27 Oct 2018 18:00:53 -0500

> Provides rule in libtls.pc.in to allow us to save it as

sound good.

-nc

---

---

From: "Francesco Colista" <[email-masked]>
Date: Fri, 12 Oct 2018 06:20:19 +0000

> - has fewer CVEs (due to their approach to remove stuff)

+1 to switch back to openssl.
Reasons to come back are totally valid (an more) compared with the pros in having libressl.
Thanks.

.: Francesco Colista

---

---

From: Timo Teräs <[email-masked]>
Date: Thu, 11 Oct 2018 18:55:54 +0300

+1 for openssl

Libressl removed things we need. Like engine support.