Bug 1777129: Birthday attack against 64-bit block ciphers [Release-4.4] #3389

benjaminapetersen · 2019-11-13T21:30:39Z

Update tls.Config with DefaultCiphers() from library-go.

library-go file:
https://github.com/openshift/library-go/blob/11013d437d762f00827c7e80d18b0a7b0abc07bd/pkg/crypto/crypto.go#L242

Note that Bug 1745431 is for 3.11, but I assume we want to apply to current console & backport?

Will require backports 4.4,4.3,4.2,4.1, 3.11.

/assign @spadgett

openshift-ci-robot · 2019-11-13T21:30:41Z

@benjaminapetersen: This pull request references Bugzilla bug 1745431, which is invalid:

expected the bug to target the "4.3.0" release, but it targets "3.11.z" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

Bug 1745431: Birthday attack against 64-bit block ciphers

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2019-11-13T21:36:50Z

@benjaminapetersen: This pull request references Bugzilla bug 1745431, which is invalid:

expected the bug to target the "4.3.0" release, but it targets "3.11.z" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

Bug 1745431: Birthday attack against 64-bit block ciphers

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2019-11-13T21:37:22Z

@benjaminapetersen: This pull request references Bugzilla bug 1745431, which is invalid:

expected the bug to target the "4.3.0" release, but it targets "3.11.z" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

Bug 1745431: Birthday attack against 64-bit block ciphers

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

benjaminapetersen · 2019-11-13T21:38:07Z

expected the bug to target the "4.3.0" release, but it targets "3.11.z" instead

Assuming this may be relevant to 4.x as well, not sure why the bug only targets 3.11.

spadgett · 2019-11-14T00:48:27Z

/bugzilla refresh

openshift-ci-robot · 2019-11-14T00:48:34Z

@spadgett: This pull request references Bugzilla bug 1745431, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

/bugzilla refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

spadgett · 2019-11-14T00:48:47Z

Needs gofmt

benjaminapetersen · 2019-11-15T03:48:13Z

fmt'd

pkg/crypto/crypto_test.go

benjaminapetersen · 2019-11-15T04:06:57Z

Added a unit test.
I think this is the only test 😛 😮

benjaminapetersen · 2019-11-15T16:06:47Z

gofmt checking failed:
cmd/bridge/main.go

Grrrr GoLand you fail me!

benjaminapetersen · 2019-11-15T20:06:56Z

/retest

 A Jasmine spec timed out. Resetting the WebDriver Control Flow.

benjaminapetersen · 2019-11-18T16:10:30Z

/retest

Jasmine timeout

pkg/crypto/crypto_test.go

openshift-bot · 2019-12-05T03:20:38Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2019-12-05T04:25:21Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2019-12-05T04:38:34Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2019-12-05T05:30:36Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2019-12-05T06:35:35Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2019-12-05T06:48:41Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-ci-robot · 2019-12-05T09:20:13Z

@benjaminapetersen: All pull requests linked via external trackers have merged. Bugzilla bug 1777129 has been moved to the MODIFIED state.

Details

In response to this:

Bug 1777129: Birthday attack against 64-bit block ciphers

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-cherrypick-robot · 2019-12-05T09:20:18Z

@benjaminapetersen: failed to push cherry-picked changes in GitHub: pushing failed, output: "remote: Not Found\nfatal: repository 'https://openshift-cherrypick-robot:CENSORED@github.com/openshift-cherrypick-robot/openshift/console/' not found\n", error: exit status 128

Details

In response to this:

/cherry-pick release-4.3
/cherry-pick release-4.2
/cherry-pick release-4.1
/cherry-pick release-3.11

I forget if you need these in separate comments, and if it has to wait for a complete merge.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-cherrypick-robot · 2019-12-05T09:20:23Z

@benjaminapetersen: failed to push cherry-picked changes in GitHub: pushing failed, output: "remote: Not Found\nfatal: repository 'https://openshift-cherrypick-robot:CENSORED@github.com/openshift-cherrypick-robot/openshift/console/' not found\n", error: exit status 128

Details

In response to this:

/cherry-pick release-4.2

looks like 1 per comment

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-cherrypick-robot · 2019-12-05T09:20:26Z

@benjaminapetersen: #3389 failed to apply on top of branch "release-4.1":

.git/rebase-apply/patch:155: trailing whitespace.
  else    
.git/rebase-apply/patch:159: trailing whitespace.
done 
.git/rebase-apply/patch:179: trailing whitespace.
    echo "invalid cipher suite used to connect to console (${CIPHER})"  
.git/rebase-apply/patch:180: trailing whitespace.
    exit 1  
.git/rebase-apply/patch:181: trailing whitespace.
  else    
warning: 5 lines add whitespace errors.
error: Failed to merge in the changes.
Using index info to reconstruct a base tree...
M	cmd/bridge/main.go
A	pkg/serverconfig/types.go
M	test-prow-e2e.sh
Falling back to patching base and 3-way merge...
Auto-merging test-prow-e2e.sh
CONFLICT (modify/delete): pkg/serverconfig/types.go deleted in HEAD and modified in Update tls.Config with DefaultCiphers() from library-go. Version Update tls.Config with DefaultCiphers() from library-go of pkg/serverconfig/types.go left in tree.
Auto-merging cmd/bridge/main.go
CONFLICT (content): Merge conflict in cmd/bridge/main.go
Patch failed at 0001 Update tls.Config with DefaultCiphers() from library-go

Details

In response to this:

/cherry-pick release-4.1

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-cherrypick-robot · 2019-12-05T09:20:30Z

@benjaminapetersen: #3389 failed to apply on top of branch "release-3.11":

.git/rebase-apply/patch:155: trailing whitespace.
  else    
.git/rebase-apply/patch:159: trailing whitespace.
done 
.git/rebase-apply/patch:179: trailing whitespace.
    echo "invalid cipher suite used to connect to console (${CIPHER})"  
.git/rebase-apply/patch:180: trailing whitespace.
    exit 1  
.git/rebase-apply/patch:181: trailing whitespace.
  else    
warning: 5 lines add whitespace errors.
error: Failed to merge in the changes.
Using index info to reconstruct a base tree...
M	cmd/bridge/main.go
A	pkg/serverconfig/types.go
A	test-prow-e2e.sh
Falling back to patching base and 3-way merge...
CONFLICT (modify/delete): test-prow-e2e.sh deleted in HEAD and modified in Update tls.Config with DefaultCiphers() from library-go. Version Update tls.Config with DefaultCiphers() from library-go of test-prow-e2e.sh left in tree.
CONFLICT (modify/delete): pkg/serverconfig/types.go deleted in HEAD and modified in Update tls.Config with DefaultCiphers() from library-go. Version Update tls.Config with DefaultCiphers() from library-go of pkg/serverconfig/types.go left in tree.
Auto-merging cmd/bridge/main.go
CONFLICT (content): Merge conflict in cmd/bridge/main.go
Patch failed at 0001 Update tls.Config with DefaultCiphers() from library-go

Details

In response to this:

/cherry-pick release-3.11

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

spadgett · 2019-12-05T13:54:10Z

/cherrypick release-4.3

openshift-cherrypick-robot · 2019-12-05T13:54:17Z

@spadgett: new pull request created: #3684

Details

In response to this:

/cherrypick release-4.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

spadgett · 2019-12-05T13:55:14Z

/cherrypick release-4.2

openshift-cherrypick-robot · 2019-12-05T13:55:21Z

@spadgett: new pull request created: #3685

Details

In response to this:

/cherrypick release-4.2

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

benjaminapetersen · 2019-12-05T15:37:58Z

Hmm. My first cherry picks didn't work, apparently.

benjaminapetersen · 2019-12-05T15:38:04Z

/cherrypick release-4.1

openshift-cherrypick-robot · 2019-12-05T15:38:08Z

@benjaminapetersen: #3389 failed to apply on top of branch "release-4.1":

.git/rebase-apply/patch:155: trailing whitespace.
  else    
.git/rebase-apply/patch:159: trailing whitespace.
done 
.git/rebase-apply/patch:179: trailing whitespace.
    echo "invalid cipher suite used to connect to console (${CIPHER})"  
.git/rebase-apply/patch:180: trailing whitespace.
    exit 1  
.git/rebase-apply/patch:181: trailing whitespace.
  else    
warning: 5 lines add whitespace errors.
error: Failed to merge in the changes.
Using index info to reconstruct a base tree...
M	cmd/bridge/main.go
A	pkg/serverconfig/types.go
M	test-prow-e2e.sh
Falling back to patching base and 3-way merge...
Auto-merging test-prow-e2e.sh
CONFLICT (modify/delete): pkg/serverconfig/types.go deleted in HEAD and modified in Update tls.Config with DefaultCiphers() from library-go. Version Update tls.Config with DefaultCiphers() from library-go of pkg/serverconfig/types.go left in tree.
Auto-merging cmd/bridge/main.go
CONFLICT (content): Merge conflict in cmd/bridge/main.go
Patch failed at 0001 Update tls.Config with DefaultCiphers() from library-go

Details

In response to this:

/cherrypick release-4.1

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

benjaminapetersen · 2019-12-05T15:38:45Z

Ah, will have to manually do the 4.1 & 3.11.

sdodson · 2019-12-19T15:11:46Z

/bugzilla refresh

openshift-ci-robot · 2019-12-19T15:11:52Z

@sdodson: All pull requests linked via external trackers have merged. Bugzilla bug 1777129 has been moved to the MODIFIED state.

Details

In response to this:

/bugzilla refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot assigned spadgett Nov 13, 2019

openshift-ci-robot added bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Nov 13, 2019

openshift-ci-robot requested review from jhadvig and spadgett November 13, 2019 21:31

openshift-ci-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. component/backend Related to backend labels Nov 13, 2019

openshift-ci-robot added bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. and removed bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. labels Nov 14, 2019

benjaminapetersen force-pushed the bug/1745431/birthday-attack-64-bit-ciphers branch from 3483622 to 060f1b9 Compare November 15, 2019 03:46

benjaminapetersen force-pushed the bug/1745431/birthday-attack-64-bit-ciphers branch from 060f1b9 to dafdf21 Compare November 15, 2019 04:04

openshift-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Nov 15, 2019

benjaminapetersen force-pushed the bug/1745431/birthday-attack-64-bit-ciphers branch from dafdf21 to 0d63e40 Compare November 15, 2019 04:05

benjaminapetersen commented Nov 15, 2019

View reviewed changes

pkg/crypto/crypto_test.go Outdated Show resolved Hide resolved

benjaminapetersen force-pushed the bug/1745431/birthday-attack-64-bit-ciphers branch from 0d63e40 to 144d16c Compare November 15, 2019 16:06

spadgett reviewed Nov 18, 2019

View reviewed changes

pkg/crypto/crypto_test.go Outdated Show resolved Hide resolved

pkg/crypto/crypto_test.go Outdated Show resolved Hide resolved

benjaminapetersen mentioned this pull request Nov 18, 2019

Bug 1745431: Birthday attack against 64-bit block ciphers (with library-go) #3460

Closed

openshift-merge-robot merged commit 4cefa8f into openshift:master Dec 5, 2019

openshift-cherrypick-robot mentioned this pull request Dec 5, 2019

Bug 1773786: Birthday attack against 64-bit block ciphers [release-4.3] #3684

Merged

openshift-cherrypick-robot mentioned this pull request Dec 5, 2019

Bug 1773787: Birthday attack against 64-bit block ciphers [release-4.2] #3685

Closed

benjaminapetersen deleted the bug/1745431/birthday-attack-64-bit-ciphers branch December 5, 2019 15:36

This was referenced Dec 5, 2019

Bug 1773788: Birthday attack against 64-bit block ciphers [Release-4.1.z] #3693

Closed

Bug 1745431: Birthday attack against 64-bit block ciphers [Release-3.11.z] #3700

Closed

benjaminapetersen changed the title ~~Bug 1777129: Birthday attack against 64-bit block ciphers~~ Bug 1777129: Birthday attack against 64-bit block ciphers [Release-4.4] Dec 16, 2019

benjaminapetersen mentioned this pull request Feb 21, 2020

Birthday attack follow: Update additional server configs with tls config containing restricted set of cipher suites #4419

Merged

openshift-ci-robot mentioned this pull request Aug 11, 2020

Bug 1777129: Tighten cipher usage to library-go #6292

Merged

Bug 1777129: Birthday attack against 64-bit block ciphers [Release-4.4] #3389

Bug 1777129: Birthday attack against 64-bit block ciphers [Release-4.4] #3389

Uh oh!

Conversation

benjaminapetersen commented Nov 13, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Nov 13, 2019

Uh oh!

openshift-ci-robot commented Nov 13, 2019

Uh oh!

openshift-ci-robot commented Nov 13, 2019

Uh oh!

benjaminapetersen commented Nov 13, 2019

Uh oh!

spadgett commented Nov 14, 2019

Uh oh!

openshift-ci-robot commented Nov 14, 2019

Uh oh!

spadgett commented Nov 14, 2019

Uh oh!

benjaminapetersen commented Nov 15, 2019

Uh oh!

Uh oh!

benjaminapetersen commented Nov 15, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

benjaminapetersen commented Nov 15, 2019

Uh oh!

benjaminapetersen commented Nov 15, 2019

Uh oh!

benjaminapetersen commented Nov 18, 2019

Uh oh!

Uh oh!

Uh oh!

openshift-bot commented Dec 5, 2019

Uh oh!

openshift-bot commented Dec 5, 2019

Uh oh!

openshift-bot commented Dec 5, 2019

Uh oh!

openshift-bot commented Dec 5, 2019

Uh oh!

openshift-bot commented Dec 5, 2019

Uh oh!

openshift-bot commented Dec 5, 2019

Uh oh!

openshift-ci-robot commented Dec 5, 2019

Uh oh!

openshift-cherrypick-robot commented Dec 5, 2019

Uh oh!

openshift-cherrypick-robot commented Dec 5, 2019

Uh oh!

openshift-cherrypick-robot commented Dec 5, 2019

Uh oh!

openshift-cherrypick-robot commented Dec 5, 2019

Uh oh!

spadgett commented Dec 5, 2019

Uh oh!

openshift-cherrypick-robot commented Dec 5, 2019

Uh oh!

spadgett commented Dec 5, 2019

Uh oh!

openshift-cherrypick-robot commented Dec 5, 2019

Uh oh!

benjaminapetersen commented Dec 5, 2019

Uh oh!

benjaminapetersen commented Dec 5, 2019

Uh oh!

openshift-cherrypick-robot commented Dec 5, 2019

Uh oh!

benjaminapetersen commented Dec 5, 2019

Uh oh!

sdodson commented Dec 19, 2019

Uh oh!

openshift-ci-robot commented Dec 19, 2019

Uh oh!

Reviewers

Assignees

Labels

benjaminapetersen commented Nov 13, 2019 •

edited

Loading

benjaminapetersen commented Nov 15, 2019 •

edited

Loading