Merge ~bryce/ubuntu/+source/nginx:fix-lp1981457-jammy into ubuntu/+source/nginx:ubuntu/jammy-devel

[Bryce Harrington]

SRUs a fix for an SSL bug for nginx that users are seeing often in production system nginx error logs. See LP #191457 for details.

PPA: https://launchpad.net/~bryce/+archive/ubuntu/nginx-fix-lp1981457

[Andreas Hasenack (ahasenack)]

I'll look at this.

[Andreas Hasenack (ahasenack)]

+1

patch is ok, headers are ok (bug is against openssl, not nginx, but it has the info we need)

In the changelog, I just wouldn't say "older clients". It's any client really that misbehaves. So perhaps just say "for clients that don't close ...". Totally up to you.

I was able to confirm the fix even, with the test case from the SRU.

I would just suggest to clarify that a bit. Here is what I did:

- install nginx-full and ssl-cert
- edit /etc/nginx/sites-enabled/default and uncomment both "listen" lines for 443, and the "include" line for snakeoil.conf
- restart nginx
- run the script:
#!/bin/bash
URL="https://localhost"
while :; do
  timeout -s KILL 0.2s curl -v -k -K <(echo verbose;for i in {1..2000}; do echo url = "$URL"; echo -o /dev/null; done)
done

- in another terminal, tail -f /var/log/nginx/error.log and observe tons of SSL_READ() errors.
- with the updated package, these errors are gone

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: bryce, ahasenack
Uploaders: bryce, ahasenack
MP auto-approved

review: Approve

[Bryce Harrington (bryce)]

Thanks, I've made those updates to the test case

[Bryce Harrington (bryce)]

$ grep "^Vcs-Git" "${changes_file}"
Vcs-Git: https://git.launchpad.net/~bryce/ubuntu/+source/nginx
Vcs-Git-Commit: b77769fb2df154e358026cac3952511cf7794701
Vcs-Git-Ref: refs/heads/fix-lp1981457-jammy
triage-jammy+22.04:~/pkg/Nginx/fix-lp1981457/nginx-gu-jammy$ dput ubuntu "${changes_file}"
D: Setting host argument.
Checking signature on .changes
gpg: ../nginx_1.18.0-6ubuntu14.2_source.changes: Valid signature from E603B2578FB8F0FB
Checking signature on .dsc
gpg: ../nginx_1.18.0-6ubuntu14.2.dsc: Valid signature from E603B2578FB8F0FB
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading nginx_1.18.0-6ubuntu14.2.dsc: done.
  Uploading nginx_1.18.0-6ubuntu14.2.debian.tar.xz: done.
  Uploading nginx_1.18.0-6ubuntu14.2_source.buildinfo: done.
  Uploading nginx_1.18.0-6ubuntu14.2_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index 8ac1551..79b7f8c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+nginx (1.18.0-6ubuntu14.2) jammy; urgency=medium
+
+  * d/p/ssl-op-ignore-unexpected-eof-option.patch: Add compatibility
+    flag for certain clients that don't close their connection properly.
+    (LP: #1981457)
+
+ -- Bryce Harrington <[e-mail]>  Tue, 02 Aug 2022 15:24:53 -0700
+
 nginx (1.18.0-6ubuntu14.1) jammy-security; urgency=medium
 
   * SECURITY UPDATE: ALPACA TLS issue
diff --git a/debian/patches/series b/debian/patches/series
index 66b5b62..9ed2cf9 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -6,3 +6,4 @@ nginx-fix-pidfile.patch
 CVE-2021-23017-1.patch
 CVE-2021-23017-2.patch
 CVE-2021-3618.patch
+ssl-op-ignore-unexpected-eof-option.patch
diff --git a/debian/patches/ssl-op-ignore-unexpected-eof-option.patch b/debian/patches/ssl-op-ignore-unexpected-eof-option.patch
new file mode 100644
index 0000000..5d4b99d
--- /dev/null
+++ b/debian/patches/ssl-op-ignore-unexpected-eof-option.patch
@@ -0,0 +1,46 @@
+From 5155845ce4453a07d60e2ce43946c9181bc311fa Mon Sep 17 00:00:00 2001
+From: Sergey Kandaurov <[e-mail]>
+Date: Tue, 10 Aug 2021 23:43:17 +0300
+Subject: [PATCH] SSL: use of the SSL_OP_IGNORE_UNEXPECTED_EOF option.
+
+A new behaviour was introduced in OpenSSL 1.1.1e, when a peer does not send
+close_notify before closing the connection.  Previously, it was to return
+SSL_ERROR_SYSCALL with errno 0, known since at least OpenSSL 0.9.7, and is
+handled gracefully in nginx.  Now it returns SSL_ERROR_SSL with a distinct
+reason SSL_R_UNEXPECTED_EOF_WHILE_READING ("unexpected eof while reading").
+This leads to critical errors seen in nginx within various routines such as
+SSL_do_handshake(), SSL_read(), SSL_shutdown().  The behaviour was restored
+in OpenSSL 1.1.1f, but presents in OpenSSL 3.0 by default.
+
+Use of the SSL_OP_IGNORE_UNEXPECTED_EOF option added in OpenSSL 3.0 allows
+to set a compatible behaviour to return SSL_ERROR_ZERO_RETURN:
+https://git.openssl.org/?p=openssl.git;a=commitdiff;h=09b90e0
+
+See for additional details: https://github.com/openssl/openssl/issues/11381
+
+Origin: upstream, https://github.com/nginx/nginx/commit/5155845ce4453a07d60e2ce43946c9181bc311fa
+Applied-Upstream: 1.21.2, 5155845ce4453a07d60e2ce43946c9181bc311fa
+Bug: https://github.com/openssl/openssl/issues/11381
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/1981457
+Reviewed-By: Bryce Harrington <[e-mail]>
+Last-Update: 2022-07-27
+
+---
+ src/event/ngx_event_openssl.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
+index 72dd20649d..ce2a566cdd 100644
+--- a/src/event/ngx_event_openssl.c
++++ b/src/event/ngx_event_openssl.c
+@@ -378,6 +378,10 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
+     SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_CLIENT_RENEGOTIATION);
+ #endif
+ 
++#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF
++    SSL_CTX_set_options(ssl->ctx, SSL_OP_IGNORE_UNEXPECTED_EOF);
++#endif
++
+ #ifdef SSL_MODE_RELEASE_BUFFERS
+     SSL_CTX_set_mode(ssl->ctx, SSL_MODE_RELEASE_BUFFERS);
+ #endif