Bug 1213051

Summary:	mozilla/mozilla-nss: "fips - softokn: crypto test failed - aborting" for Firefox and Thunderbird
Product:	[openSUSE] openSUSE.org	Reporter:	James Knott <james.knott>
Component:	3rd party software	Assignee:	Factory Mozilla <factory-mozilla>
Status:	NEW ---	QA Contact:	E-mail List <screening-team-bugs>
Severity:	Major
Priority:	P5 - None	CC:	Andreas.Stieger, wolfgang
Version:	unspecified	Flags:	wolfgang: needinfo?
Target Milestone:	---
Hardware:	x86-64
OS:	Other
Whiteboard:
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description James Knott 2023-07-05 16:17:13 UTC

Today, two updates installed and killed Firefox & Thunderbird.
The packages are:

libsoftokn3-3.90-lp154.2.1.x86_64             Wed 05 Jul 2023 10:33:38 AM EDT
libfreebl3-3.90-lp154.2.1.x86_64              Wed 05 Jul 2023 10:33:34 AM EDT


Here are the error reports:

firefox
ATTENTION: default value of option mesa_glthread overridden by environment.
ATTENTION: default value of option mesa_glthread overridden by environment.
ATTENTION: default value of option mesa_glthread overridden by environment.
ATTENTION: default value of option mesa_glthread overridden by environment.
fips - softokn: crypto test failed - aborting
Redirecting call to abort() to mozalloc_abort

fips - softokn: crypto test failed - aborting
Redirecting call to abort() to mozalloc_abort

ExceptionHandler::GenerateDump cloned child 3111
ExceptionHandler::SendContinueSignalToChild sent continue signal to child
ExceptionHandler::WaitForContinueSignal waiting for continue signal...
Exiting due to channel error.
jknott@linux:~> fips - softokn: crypto test failed - aborting
^C
jknott@linux:~> thunderbird
fips - softokn: crypto test failed - aborting
Redirecting call to abort() to mozalloc_abort

ExceptionHandler::GenerateDump cloned child 3157
ExceptionHandler::SendContinueSignalToChild sent continue signal to child
ExceptionHandler::WaitForContinueSignal waiting for continue signal...
jknott@linux:~> fips - softokn: crypto test failed - aborting

I have reverted to earlier versions and now both Firefox and Thunderbird are working.

Comment 1 Andreas Stieger 2023-07-05 17:08:13 UTC

From the Leap 15.4 repositories:

libfreebl3 3.79.4-150400.3.29.1
libsoftokn3 3.79.4-150400.3.29.1

These do not match the versions you have installed. You seem to be reporting this against mozilla/mozilla-nss? Are you using non-distribution packages intentionally?

(In reply to James Knott from comment #0)
> fips - softokn: crypto test failed - aborting
> Redirecting call to abort() to mozalloc_abort

Are you using fips mode?

Comment 2 James Knott 2023-07-05 17:40:33 UTC

(In reply to Andreas Stieger from comment #1)
> From the Leap 15.4 repositories:
> 
> libfreebl3 3.79.4-150400.3.29.1
> libsoftokn3 3.79.4-150400.3.29.1
> 
> These do not match the versions you have installed. You seem to be reporting
> this against mozilla/mozilla-nss? Are you using non-distribution packages
> intentionally?
> 
> (In reply to James Knott from comment #0)
> > fips - softokn: crypto test failed - aborting
> > Redirecting call to abort() to mozalloc_abort
> 
> Are you using fips mode?

These were automatically installed with Software Updates.  Other than accept the updates, I didn't do anything.  This happened on 2 computers.  The Firefox version is 102.12.0esr and Thunderbird, 102.12.0.

Comment 3 Andreas Stieger 2023-07-05 18:09:13 UTC

Well yes, because instead of the stable maintained openSUSE Leap 15.4 you installed a package from a development repository. Do you remember doing so in the past? Switching these packages to the distribution version would solve this problem.

Comment 4 James Knott 2023-07-05 20:29:44 UTC

(In reply to Andreas Stieger from comment #3)
> Well yes, because instead of the stable maintained openSUSE Leap 15.4 you
> installed a package from a development repository. Do you remember doing so
> in the past? Switching these packages to the distribution version would
> solve this problem.

If I did, it was quite a while ago.  The only Mozilla repository I see is https://download.opensuse.org/repositories/mozilla/openSUSE_Leap_15.4.

Comment 5 Andreas Stieger 2023-07-06 06:07:12 UTC

Relevant thread:
https://lists.opensuse.org/archives/list/users@lists.opensuse.org/thread/7GJBRSHZNDQMK7ZIYCSVF2IYJCPMHSTM/

Running things from a development repo that are not the distribution, reporting this against the distribution, and calling this a regression. I see you found the package downgrade and profile downgrade option.

Comment 6 Wolfgang Rosenauer 2023-07-06 06:41:40 UTC

While the repo mixup is not optimal I would not directly expect that error but most likely it has to do with it.

It smells a bit like the installed hmac checksums are mixed up.
/usr/lib64/libsoftokn3.chk

I understand you already downgraded so not sure if you still can/want to debug further, but

rpm -V libsoftokn3
rpm -qf /usr/lib64/libsoftokn3.chk

could be interesting.