Comment 66 for bug 305264

Copy of note sent on 1/8/2009:

Attached are the server cert (auth2.it.anl.gov), the intermediate cert (f0a38a80.0)
and the CA self signed cert (7651b327.0) a debug version of verify.c
and partial output of an ldapsearch using the debug.c

My patch has been #if 0'ed out at line 151.

   Lets refer to the cert chain as A, B and C. The OpenLDAP server (using OpenSSL)
sends server cert A, intermediate cert B, and CA cert C.

The TLS_CACERT file has B and C.

The clist_size is then 3, and the code in _gnutls_x509_verify_certificate
around lines 443 drop it to 2, leaving the chain as A, B.

The tcase_size is 2.

_gnutls_verify_certificate2 at line 452 is called with cert B and
tcas with B and C and flags 0.

At line 265, find_issuer is called with B. It returns C.
check_is_ca is called at line 297, which fails
because there is no BasicConstraint. The if at 293 looks correct too.

*BUT* if one trusts both B and C, do we need to verify C?
Why does the code arount line 265 not stop after finding that B is in the tcas,
rather then looking for C, and then verifying it?

If I try it again with the TLS_CACERT file with only B,
it also fails because it can not find the issuer of B.
If the code around line 265 was modified if B was found in the tcas,
this shopuld also work.

Simon Josefsson wrote:
> "Douglas E. Engert" <email address hidden> writes:
>
>> This is also being submitted to https://bugs.launchpad.net/bugs
>>
>> Using the Ubuntu version of libgnutls13_2.0.4-1ubuntu2.3 on Hardy 8.04.1,
>> ldaps: has stopped working. This looks like it is related to
>> the December changes that are also in gnutls-2.6.3. See attached
>> patch that should work in both.
>>
>> ldapsearch -d 1 -H ldaps://...
>>
>> TLS: peer cert untrusted or revoked (0x82)
>> ldap_err2string
>> ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
>>
>>
>> The OpenLDAP ldap server certificate issued by Verisign is signed by:
>>
>> Verisign_Intermediate-Secure_Site_Managed_PKI_for_SSL_Standard_Certificates.pem
>>
>> which is signed by:
>> Verisign_Class_3_Public_Primary_Certification_Authority.pem
>>
>> Both of these are in /etc/ssl/certs as 7651b327.0 and f0a38a80.0
>>
>> Verisign_Class_3_Public_Primary_Certification_Authority.pem
>> is a self signed version 1 cert issued in 1996, with no extensions.
>
> Do you have a complete chain that triggers this? It will help our
> regression test suite.
>
> I don't have f0a38a80.0 on my debian lenny system. Does it also lack a
> basicConstraint? Does it use RSA-MDx? If yes, that would explain the
> problem.
>
>> In lib/x509/verify.c gnutls_x509_crt_get_ca_status is called
>> but returns GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE as there is no
>> Basic Constraint.
>>
>> The attached patch (to gnutls13_2.0.4-1ubuntu2.3) checks for
>> this return and if it is a self signed cert, will treat it as a CA.
>> The patch looks like it can be applied to 2.6.3 as well.
>
> The patch seems too permissive to me: the intention is that V1 certs
> should be rejected by GnuTLS unless GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT
> and/or GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT are passed as flags.
>
> Internally, GnuTLS by default enables the
> GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag when called via
> gnutls_certificate_verify_peers2. So I think GnuTLS should typically
> accept this chain.
>
> Indeed, looking at the code that invokes the function you patched:
>
> if (!(flags & GNUTLS_VERIFY_DISABLE_CA_SIGN) &&
> !((flags & GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT) && issuer_version == 1))
> {
> if (check_if_ca (cert, issuer, flags) == 0)
> {
> gnutls_assert ();
> if (output)
> *output |= GNUTLS_CERT_SIGNER_NOT_CA | GNUTLS_CERT_INVALID;
> return 0;
> }
> }
>
> It seems that the code you patched should not have been invoked at all
> if (flags & GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT) && issuer_version == 1
> is true (if I understand the logic correctly..). Could you debug why
> this isn't the case? Maybe issuer_version is wrong?
>
> A complete chain to reproduce this will let me debug it too.
>
> /Simon
>
>> Clients on Solaris 9 and 10, and OpenLDAP using OpenSSL on any
>> platform have no problems with this old cert.
>>
>>
>>
>>
>> --
>>
>> Douglas E. Engert <email address hidden>
>> Argonne National Laboratory
>> 9700 South Cass Avenue
>> Argonne, Illinois 60439
>> (630) 252-5444
>> --- ,verify.c 2009-01-06 14:02:41.000000000 -0600
>> +++ verify.c 2009-01-07 17:07:27.000000000 -0600
>> @@ -130,11 +130,20 @@
>> }
>> }
>>
>> - if (gnutls_x509_crt_get_ca_status (issuer, NULL) == 1)
>> + result = gnutls_x509_crt_get_ca_status (issuer, NULL);
>> + if (result == 1)
>> {
>> result = 1;
>> goto cleanup;
>> }
>> + /* Old self signed CA certs may not have basic constrant */
>> + else if ((result == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) &&
>> + (gnutls_x509_crt_check_issuer(issuer, issuer) == 1))
>> + {
>> + gnutls_assert ();
>> + result = 1;
>> + goto cleanup;
>> + }
>> else
>> gnutls_assert ();
>>
>> _______________________________________________
>> Gnutls-devel mailing list
>> <email address hidden>
>> http://lists.gnu.org/mailman/listinfo/gnutls-devel
>
>

--

   Douglas E. Engert <email address hidden>
   Argonne National Laboratory
   9700 South Cass Avenue
   Argonne, Illinois 60439
   (630) 252-5444