{"action":"created","issue":{"url":"https://api.github.com/repos/openssl/openssl/issues/6700","repository_url":"https://api.github.com/repos/openssl/openssl","labels_url":"https://api.github.com/repos/openssl/openssl/issues/6700/labels{/name}","comments_url":"https://api.github.com/repos/openssl/openssl/issues/6700/comments","events_url":"https://api.github.com/repos/openssl/openssl/issues/6700/events","html_url":"https://github.com/openssl/openssl/issues/6700","id":340516090,"node_id":"MDU6SXNzdWUzNDA1MTYwOTA=","number":6700,"title":"Openssl issue while upgrading from version 1.0.2g with fips mode enabled.","user":{"login":"ajaynalawade","id":5375957,"node_id":"MDQ6VXNlcjUzNzU5NTc=","avatar_url":"https://avatars3.githubusercontent.com/u/5375957?v=4","gravatar_id":"","url":"https://api.github.com/users/ajaynalawade","html_url":"https://github.com/ajaynalawade","followers_url":"https://api.github.com/users/ajaynalawade/followers","following_url":"https://api.github.com/users/ajaynalawade/following{/other_user}","gists_url":"https://api.github.com/users/ajaynalawade/gists{/gist_id}","starred_url":"https://api.github.com/users/ajaynalawade/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ajaynalawade/subscriptions","organizations_url":"https://api.github.com/users/ajaynalawade/orgs","repos_url":"https://api.github.com/users/ajaynalawade/repos","events_url":"https://api.github.com/users/ajaynalawade/events{/privacy}","received_events_url":"https://api.github.com/users/ajaynalawade/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/openssl/openssl/milestones/12","html_url":"https://github.com/openssl/openssl/milestone/12","labels_url":"https://api.github.com/repos/openssl/openssl/milestones/12/labels","id":3045922,"node_id":"MDk6TWlsZXN0b25lMzA0NTkyMg==","number":12,"title":"Assessed","description":"","creator":{"login":"mattcaswell","id":7422273,"node_id":"MDQ6VXNlcjc0MjIyNzM=","avatar_url":"https://avatars0.githubusercontent.com/u/7422273?v=4","gravatar_id":"","url":"https://api.github.com/users/mattcaswell","html_url":"https://github.com/mattcaswell","followers_url":"https://api.github.com/users/mattcaswell/followers","following_url":"https://api.github.com/users/mattcaswell/following{/other_user}","gists_url":"https://api.github.com/users/mattcaswell/gists{/gist_id}","starred_url":"https://api.github.com/users/mattcaswell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattcaswell/subscriptions","organizations_url":"https://api.github.com/users/mattcaswell/orgs","repos_url":"https://api.github.com/users/mattcaswell/repos","events_url":"https://api.github.com/users/mattcaswell/events{/privacy}","received_events_url":"https://api.github.com/users/mattcaswell/received_events","type":"User","site_admin":false},"open_issues":180,"closed_issues":30,"state":"open","created_at":"2018-01-18T16:36:46Z","updated_at":"2018-07-20T12:03:41Z","due_on":null,"closed_at":null},"comments":6,"created_at":"2018-07-12T07:15:13Z","updated_at":"2018-07-20T12:40:05Z","closed_at":"2018-07-20T12:03:41Z","author_association":"NONE","body":"Hi,\r\n\r\nI am running go lang based server with fips mode enabled. I am using spacemonkeygo for openssl bindings. When I run server with version post Openssl 1.0.2g (1.0.2h onwards), I get following error while reading request from connection.\r\n\"SSL errors: SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac\"\r\n\r\nHere are some of my observations,\r\n1. Creating 2 connections in parallel gives this issue.\r\n2. While a client is sending data, another client connecting does not error. The error seems to be only when two clients try to handshake together. If we serialise ssl wrap even thousands of clients do not give this issue.\r\n3. There comes a time(after 40 iterations in case of 3 parallel handshaking clients) after which the server kind of gives up and keeps on giving the same error no matter how much we slow down the clients(I stopped my client script for 5 minutes before trying again).\r\n\r\nHere is server code, with which I am able to reproduce this issue.\r\n\r\n`\r\npackage main\r\n\r\nimport (\r\n    \"log\"\r\n    \"net\"\r\n    \"net/http\"\r\n    \"fmt\"\r\n    \"os\"\r\n    \"bufio\"\r\n    \"io\"\r\n    \"strconv\"\r\n    \"github.com/spacemonkeygo/openssl\"\r\n)\r\n\r\nfunc init_fips() {\r\n        err := openssl.FIPSModeSet(true)\r\n        if err != nil {\r\n                panic(fmt.Errorf(\"%v Error:%v\\n\", \"openssl failed to set fips mode.\", err))\r\n        }\r\n        log.Print(\"OpenSSL FIPS mode is set to: True\\n\")\r\n}\r\n\r\nfunc main() {\r\n    init_fips()\r\n    \r\n    laddr := \"0.0.0.0:443\"\r\n    var ln net.Listener\r\n    var err error\r\n\r\n    // Init SSL shared context used across connections\r\n    ctx, err := openssl.NewCtxFromFiles(\"/etc/certs/sslcert.crt\", \"/etc/certs/sslcert.key\")\r\n    if err != nil {\r\n        log.Fatalf(\"Failed to read ssl certificate. Error: %v\", err)\r\n    }\r\n\r\n    // Set options and do not allow SSLv2 and SSLv3 communication\r\n    _ = ctx.SetOptions(openssl.CipherServerPreference |\r\n        openssl.NoSSLv2 | openssl.NoSSLv3)\r\n\r\n    // Read certificate\r\n    // Listen on bind address\r\n    ln, err = openssl.Listen(\"tcp\", laddr, ctx)\r\n\r\n    if err != nil {\r\n        log.Fatalf(\"Failed to start server. Error: %v\",\r\n            err)\r\n        os.Exit(1)\r\n    } else {\r\n            log.Println(\"Started secure server\")\r\n    }\r\n    if err != nil {\r\n        log.Fatalf(\"server: listen: %s\", err)\r\n    }\r\n    log.Print(\"server: listening\")\r\n    for {\r\n        accepted, err := ln.Accept()\r\n\r\n        if err != nil {\r\n            log.Println(\"Got errored while accepting connection. %v\", err)\r\n            return\r\n        }\r\n\r\n        go handleClient(accepted)\r\n    }\r\n}\r\n\r\nfunc handleClient(conn net.Conn) {\r\n    defer conn.Close()\r\n    reader := bufio.NewReader(conn)\r\n    for {\r\n        //log.Print(\"server: conn: waiting\")\r\n        var err error\r\n        httpreq, err := http.ReadRequest(reader)\r\n        if err != nil {\r\n                log.Print(\"Errored while reading request. Error: \", err)\r\n                break\r\n        }\r\n        buf := make([]byte, httpreq.ContentLength)\r\n        toread := int(httpreq.ContentLength)\r\n        rbytes := 0\r\n        n := 0\r\n        for toread > 0 {\r\n                n, err = httpreq.Body.Read(buf[rbytes:])\r\n                if err != nil && err != io.EOF {\r\n                        log.Print(\"Errored while reading request body. Error: \", err)\r\n                        break\r\n                }\r\n                rbytes += n\r\n                toread = toread - n\r\n        }\r\n\r\n        resp := append([]byte(\"HTTP/1.1 200 OK\\r\\n\"+\"Content-Length: \"+\r\n                strconv.Itoa(len(buf))+\"\\r\\n\\r\\n\"), buf...)\r\n        _, err = conn.Write(resp)\r\n        if err != nil {\r\n                log.Print(\"Errored while writing response. Error: \", err)\r\n                break\r\n        }\r\n\r\n        log.Printf(\"server: conn: wrote %d bytes\", n)\r\n\r\n    }\r\n    log.Println(\"server: conn: closed\")\r\n}\r\n`\r\n\r\nIssue is reproducible with openssl-1.0.2h build with fips module openssl-fips-2.0.16.  I am running server on Ubuntu 14.04.5 .\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/openssl/openssl/issues/comments/406588745","html_url":"https://github.com/openssl/openssl/issues/6700#issuecomment-406588745","issue_url":"https://api.github.com/repos/openssl/openssl/issues/6700","id":406588745,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNjU4ODc0NQ==","user":{"login":"ajaynalawade","id":5375957,"node_id":"MDQ6VXNlcjUzNzU5NTc=","avatar_url":"https://avatars3.githubusercontent.com/u/5375957?v=4","gravatar_id":"","url":"https://api.github.com/users/ajaynalawade","html_url":"https://github.com/ajaynalawade","followers_url":"https://api.github.com/users/ajaynalawade/followers","following_url":"https://api.github.com/users/ajaynalawade/following{/other_user}","gists_url":"https://api.github.com/users/ajaynalawade/gists{/gist_id}","starred_url":"https://api.github.com/users/ajaynalawade/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ajaynalawade/subscriptions","organizations_url":"https://api.github.com/users/ajaynalawade/orgs","repos_url":"https://api.github.com/users/ajaynalawade/repos","events_url":"https://api.github.com/users/ajaynalawade/events{/privacy}","received_events_url":"https://api.github.com/users/ajaynalawade/received_events","type":"User","site_admin":false},"created_at":"2018-07-20T12:40:05Z","updated_at":"2018-07-20T12:40:05Z","author_association":"NONE","body":"I was using Openssl 1.0.2o version. Sure I have working code, but was curious 'why issue was seen with fips mode set'."}}
{"actor":{"display_login":"ajaynalawade"}}