🐛 BUG: armhf/i386: Test_ca: runtime: out of memory: cannot allocate 2147483648-byte block (2151022592 in use)

[jas4711]

What version of nebula are you using? (nebula -version)

1.10.2

What operating system are you using?

Debian

Describe the Bug

Hi! I'm updating this package for Debian (we could use testers to get confidence in newer packages, let me know how to reach people interested in this). On armhf/i386 we got this failure:

=== RUN   Test_ca
runtime: out of memory: cannot allocate 2147483648-byte block (2151022592 in use)
fatal error: out of memory

See logs here:

https://buildd.debian.org/status/fetch.php?pkg=nebula&arch=armhf&ver=1.10.2%2Bdfsg-1%7Eexp0&stamp=1770158339&raw=0

https://buildd.debian.org/status/fetch.php?pkg=nebula&arch=i386&ver=1.10.2%2Bdfsg-1%7Eexp0&stamp=1770158639&raw=0

Any ideas?

We'll probably just skip this test on armhf/i386 unless there is some other ideas.

Thanks,
Simon

Logs from affected hosts

Config files from affected hosts

[jas4711]

This line is suspicious:

https://github.com/slackhq/nebula/blob/master/cmd/nebula-cert/ca_test.go#L191

The value in the crash backtrace 2147483648 is identical to 2*1024*1024*1024, although the code says 2*1024*1024.

Maybe there is an additional unintended implicit *1024?

I am trying a rebuild on i386 changing the 2*1024*1024 into merely 2*1024 now.

[jas4711]

Even more suspicious line:

https://github.com/slackhq/nebula/blob/master/cmd/nebula-cert/ca.go#L58

	cf.argonMemory = cf.set.Uint("argon-memory", 2*1024*1024, "Optional: Argon2 memory parameter (in KiB) used for encrypted private key passphrase")

Allocating 2GB will not work well on 32-bit archs. I don't want to suggest to lower this number, as that seems like a horrible solution.

[jas4711]

Debian is now using jas4711@595e9ee to resolve this problem -- it lowers the memory usage for the self-tests only. I've confirmed Nebula 1.10.2 now builds and passes self tests on i386, more archs to follow.

[jas4711]

I now see earlier report in #1387 however I think that Nebula should not downgrade security just to cater for self-check failures on 32-bit platforms. Speaking as Argon2 RFC co-author, I'm happy Nebula is actually using the recommended parameters. The patch we are using now just downgrade the parameters used by self-checks, not changing any end-user behaviour.