Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[release/6.0] Fix OpenSSL 3 reporting an OutOfMemoryException for missing private key #63955

Merged
merged 1 commit into from
Feb 7, 2022

Conversation

vcsjones
Copy link
Member

@vcsjones vcsjones commented Jan 18, 2022

Backport of #63804 to release/6.0.

Customer Impact

Reported in #63624 by Red Hat. Customers moving to Linux distributions that come with OpenSSL 3, the next major version of OpenSSL, will experience incorrect exceptions when attempting to perform private key operations using only a public key.

Prior to this change, we reported an OutOfMemoryException on OpenSSL 3 when using a public-only key for operations that required a private key. This adjusts the exception throwing logic to report a CryptographicException as we are with OpenSSL 1.x.

Testing

This was uncovered by existing tests when run against OpenSSL 3.0. The tests were manually run against a Linux distribution that includes OpenSSL 3.0, in this case Fedora 36. With the changes, the tests began to pass again.

Risk

Low. Existing test infrastructure ensures we remain working with OpenSSL 1.x. The change is simply to react to OpenSSL's error conditions differently in an isolated location.

@ghost ghost added the community-contribution Indicates that the PR has been added by a community member label Jan 18, 2022
@ghost
Copy link

ghost commented Jan 18, 2022

Tagging subscribers to this area: @dotnet/area-system-security, @vcsjones, @krwq
See info in area-owners.md if you want to be subscribed.

Issue Details

Backport of #63804 to release/6.0.

Customer Impact

Reported in #63624 by Red Hat. Customers moving to Linux distributions that come with OpenSSL 3, the next major version of OpenSSL, will experience incorrect exceptions when attempting to perform private key operations using only a public key.

Prior to this change, we reported an OutOfMemoryException on OpenSSL 3 when using a public-only key for operations that required a public key. This adjusts the exception throwing logic to report a CryptographicException as we are with OpenSSL 1.x.

Testing

This was uncovered by existing tests when run against OpenSSL 3.0. The tests were manually run against a Linux distribution that includes OpenSSL 3.0, in this case Fedora 36. With the changes, the tests began to pass again.

Risk

Low. Existing test infrastructure ensures we remain working with OpenSSL 1.x. The change is simply to react to OpenSSL's error conditions differently in an isolated location.

Author: vcsjones
Assignees: -
Labels:

area-System.Security, community-contribution

Milestone: -

@bartonjs bartonjs added the Servicing-consider Issue for next servicing release review label Jan 18, 2022
@leecow leecow added Servicing-approved Approved for servicing release and removed Servicing-consider Issue for next servicing release review labels Jan 20, 2022
@leecow leecow added this to the 6.0.3 milestone Jan 20, 2022
@safern safern merged commit 4c8a389 into dotnet:release/6.0 Feb 7, 2022
@vcsjones vcsjones deleted the backport-63804-to-release-6.0 branch February 7, 2022 19:06
@ghost ghost locked as resolved and limited conversation to collaborators Mar 10, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
area-System.Security community-contribution Indicates that the PR has been added by a community member Servicing-approved Approved for servicing release
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants