xmn has joined #maemo-leste
jk__00 has quit [Quit: Leaving]
Pali has quit [Ping timeout: 246 seconds]
Daanct12 has joined #maemo-leste
Daanct12 has quit [Remote host closed the connection]
macros_ has quit [Ping timeout: 240 seconds]
ikmaak has quit [Ping timeout: 260 seconds]
macros_ has joined #maemo-leste
ikmaak has joined #maemo-leste
joerg has quit [Ping timeout: 272 seconds]
joerg has joined #maemo-leste
<Wizzup> freemangordon: what is the offending version?
_whitelogger has joined #maemo-leste
<freemangordon> Wizzup: 1.1.1n-0+deb10u1
xmn has quit [Ping timeout: 240 seconds]
<Wizzup> freemangordon: ok
<freemangordon> building openssl on PP ATM
<freemangordon> will debug that
<Wizzup> ok
<Wizzup> maybe we can just check the changelog?
<Wizzup> is it certs or openssl patches?
<freemangordon> it is openssl, not certs
<freemangordon> but better debug it
<freemangordon> also, it is weird that we hit the bug on arm only
yanu_ has joined #maemo-leste
yanu_ has quit [Client Quit]
<Wizzup> right
<freemangordon> tls1_get_legacy_sigalg (whatever it is) fails
uvos has joined #maemo-leste
elastic_dog has quit [Ping timeout: 248 seconds]
Pali has joined #maemo-leste
pimmeldrian is now known as meldrian
vagag has joined #maemo-leste
elastic_dog has joined #maemo-leste
elastic_dog has quit [Ping timeout: 250 seconds]
elastic_dog has joined #maemo-leste
<freemangordon> Wizzup: ssl_get_security_level_bits returns 112 on ARM64 and 80 on amd64
<freemangordon> Wizzup: on ARM SSL_get_security_level returns 2, on x86 - 1
<freemangordon> any clue why?
<norayr> very interesting
<freemangordon> it seems the actual bug is in x86 lib, it seems to ignore /etc/ssl/openssl.cnf
<norayr> since we use debian's ssl, didn't anyone noticed already that this version causes problems?
<freemangordon> well, it was pushed 2 weeks ago
<freemangordon> also, I am still not sure the problem is in openssl itself
<Wizzup> freemangordon: hrm, we might need to file that with debian
<freemangordon> ok, I am officially confused: fopen("/usr/lib/ssl/openssl.cnf", "rb"); fails with errno==13 in my VM
<Wizzup> eaccess
<freemangordon> yes
<Wizzup> what are the privs of hte full path
<freemangordon> but I can cat that file with no issue
<Wizzup> e.g. /usr/lib/ssl
<freemangordon> fine:
<Wizzup> world executable?
<freemangordon> lrwxrwxrwx 1 root root 20 Mar 18 20:41 /usr/lib/ssl/openssl.cnf -> /etc/ssl/openssl.cnf
<Wizzup> what about /etc/ssl/openssl.cnf ?
<freemangordon> -rw-r--r-- 1 root root 11118 Oct 12 2019 /etc/ssl/openssl.cnf
<freemangordon> exactly the same on pinephone
<freemangordon> besides the date
<freemangordon> -rw-r--r-- 1 root root 11118 Aug 24 2021 /etc/ssl/openssl.cnf
<Wizzup> what about /etc/ssl?
<freemangordon> this is pinephone
<Wizzup> the dir
<freemangordon> mhm
<freemangordon> drwxr-xr-x 4 root root 4096 Apr 15 12:29 .
<freemangordon> in VM
<freemangordon> drwxr-xr-x 4 root root 4096 Apr 22 12:00 .
<freemangordon> in PP
<Wizzup> you can also do ls -lshd /etc/ssl fwiw
<Wizzup> ok
<Wizzup> I need to go and get my lost bag (with the n900 serial!)
<Wizzup> bbl
<freemangordon> ok
<freemangordon> PP: 4.0K drwxr-xr-x 4 root root 4.0K Apr 22 12:00 /etc/ssl
<freemangordon> VM: 4.0K drwxr-xr-x 4 root root 4.0K Apr 15 12:29 /etc/ssl
<freemangordon> the same
<freemangordon> maybe FS issue
<Wizzup> seems very weird
<freemangordon> mhm
<freemangordon> this is crazy!!!
<freemangordon> strace: openat(AT_FDCWD, "/usr/lib/ssl/openssl.cnf", O_RDONLY) = -1 EACCES (Permission denied)
<freemangordon> ok, getting even more strange - if I run telepathy-gabble through valgrind on VM, I can recreate the issue
<freemangordon> WTF is going on?
<freemangordon> umm: [ 2258.304349] EXT4-fs error (device sda1): ext4_lookup:1619: inode #303423: comm find: iget: checksum invalid
<freemangordon> ugh:
<freemangordon> audit: type=1400 audit(1650720903.508:17): apparmor="DENIED" operation="open" profile="/usr/lib/telepathy/telepathy-*" name="/etc/ssl/openssl.cnf" pid=3925 comm="telepathy-gabbl" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
<freemangordon> ok, for some reason I have apparmor installed and it prevents access to openssl.cnf
<sixwheeledbeast> aa-logprof ?
<freemangordon> apt-get remove --purge apparmor :)
<norayr> folks, i booted leste on droid, and got info about april update.
<norayr> at the end of the text it recommends to remove old zram cotfiguration
<norayr> with rc-update del zram atd then on the same line, rm /etc/init.d/zram
<norayr> So i was wondering (btw now i write from leste's pidgin) should i run those probably o separate lines, and if i do, wouldn't it just remove the serice startup script?
<norayr> But wasn't the intention to run the init script?
<norayr> Oh, i mean to run on startup
joerg has quit [Read error: Connection reset by peer]
joerg has joined #maemo-leste
<norayr> other question is, i noticed that the boot option was mentioned which allows droid to charge.
<norayr> isn't it in boot loader? and that bootloader is separate from leste image.
<norayr> so leste image update won't reveal that option for me right?
<Wizzup> freemangordon: hm, we should look into that problem @ apparmor
<Wizzup> freemangordon: I think we want to suppor tapparmor
<Wizzup> freemangordon: sorry I thought have thought of it being apparmor before
<Wizzup> it's always the MAC once DAC ought to work
arno11 has joined #maemo-leste
arno11 has left #maemo-leste [#maemo-leste]
xmn has joined #maemo-leste
<freemangordon> Wizzup: still, now I have 'fixed' my VM to behave like PP I will investigate why ssl upgrade broke it
Twig has joined #maemo-leste
Livio has joined #maemo-leste
* enyc meows :O
<enyc> I'm wondering if n900 usb get damaged with these bypassing of the micro-usb protection-circuit etc going stroight over to the 2 pins under board
norly has quit [Quit: Leaving.]
norly has joined #maemo-leste
avoidr has joined #maemo-leste
wunderwungiel[m] has joined #maemo-leste
<wunderwungiel[m]> Hello
[TheBug] has quit [Changing host]
[TheBug] has joined #maemo-leste
<freemangordon> but, TBH I am not sure the commit is wrong
<freemangordon> but my openssl-fu is not the best around :)
<freemangordon> ok, so telepathy-gabble (wocky) wants to do tls1.0, which is disabled by policy
<freemangordon> enabling tls1.0 is not very good idea IMO
<sicelo> enyc: maybe #maemo. I think it can get damaged, yes. That said ... i did exactly that bypass on my old n900 back in 2015 ... still perfectly fine today (only non-working modem, which is unrelated)
<Wizzup> got the n900 serial module back :)
<Wizzup> freemangordon: why does wocky only do 1.0 ?
<Wizzup> freemangordon: I think I fixed this in some other pkgs that I forward ported
<Wizzup> it's a bug to request only 1.0
<freemangordon> agree
<freemangordon> so I changed it to request 1.2
<freemangordon> (for 1.3 google presents some strange certificate)
<freemangordon> Wizzup: will push the fix in a minute
<Wizzup> what is strange about it, and yes at least 1.2 is ok, 1.3 would be better
<Wizzup> is it ecc?
<freemangordon> hmm?
<freemangordon> ecc?
<Wizzup> ed25519 or similar elyptic curve crypto
<freemangordon> ah
<freemangordon> no idea
<freemangordon> sec
<Wizzup> lgtm, let's look at tls 1.3 eventually though
<freemangordon> the issue with 1.3 is that google serves some unknown certificate
<freemangordon> "00 90 76 89 18 E9 33 93 A0" is the serial
<Wizzup> imho that warrants a google specific workaround
<freemangordon> exactly like in the thread
<freemangordon> well, what is wrong with tls1.2?
<Wizzup> the same as pinning to 1.0
<Wizzup> better to just use default openssl ctx
<freemangordon> I agree in principle, but don;t really want to waste any more time on that now
<Wizzup> sure
<Wizzup> maybe we can make an issue
<freemangordon> better make an issue upstream
<Wizzup> righty
<freemangordon> going afk, night!
<Wizzup> gn
vagag has left #maemo-leste [Error from remote client]
Twig has quit [Ping timeout: 240 seconds]
elastic_dog has quit [Ping timeout: 248 seconds]
belcher has quit [Ping timeout: 240 seconds]
elastic_dog has joined #maemo-leste
belcher has joined #maemo-leste
Pali has quit [Ping timeout: 240 seconds]
Pali has joined #maemo-leste
uvos has quit [Ping timeout: 272 seconds]