bugGNU Wget - Bugs: bug #22767, private key is no longer read from...

 
 

bug #22767: private key is no longer read from the certificate file

Submitted by:  Noël Köthe <nok>
Submitted on:  Fri 28 Mar 2008 07:13:57 PM UTC  
 
Category: Program LogicSeverity: 3 - Normal
Priority: 7 - HighStatus: Fixed
Privacy: PublicAssigned to: None
Originator Name: Open/Closed: Closed
Release: 1.10Operating System: None
Reproducibility: NoneFixed Release: 1.12
Planned Release: 1.12Regression: None
Work Required: NonePatch Included: Yes

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 23 Apr 2008 06:31:16 AM UTC, comment #2:

Fixed for mainline in 52d6a687a3c3.

Micah Cowan <micahcowan>
Wed 23 Apr 2008 06:28:06 AM UTC, comment #1:

Looks like it was originally commented out in 710c20dec7b9, with a "what was this supposed to achieve?" comment, sometime before the filename change to openssl.c.

Micah Cowan <micahcowan>
Fri 28 Mar 2008 07:13:57 PM UTC, original submission:

Hello,

sorry for forwarding this patch with a long delay:
http://bugs.debian.org/425768

--8<--
In wget versions prior to 1.10, specifying a SSL client certificate file that contained both the public and private key was sufficient:
wget --certificate=foo.pem https://server/

With 1.10, it now needs the private key specified separately, even if it's in the same file:
wget --certificate=foo.pem --private-key=foo.pem https://server/

>From the man page wget(1), it seems that the --private-key option is still intended to be required only when the private key is in a different file:


--private-key=file
Read the private key from file. This allows you to provide
the private key in a file separate from the certificate.

It looks like the behavior changed at the same time the SSL stuff was moved into openssl.c, so I suspect it was unintentional. The below patch restores the previous behavior.

-jim

diff -purN wget-1.10.2+1.11.beta1.orig/src/openssl.c wget-1.10.2+1.11.beta1/src/openssl.c
--- wget-1.10.2+1.11.beta1.orig/src/openssl.c 2006-07-14 09:25:50.000000000 -0400
+++ wget-1.10.2+1.11.beta1/src/openssl.c 2007-05-23 16:23:56.000000000 -0400
@@ -210,6 +210,12 @@ ssl_init ()
than examining the error stack after a failed SSL_connect. */
SSL_CTX_set_verify (ssl_ctx, SSL_VERIFY_NONE, NULL);

+ /* Use the private key from the cert file unless specified otherwise. */
+ if (opt.cert_file && !opt.private_key) {
+ opt.private_key = opt.cert_file;
+ opt.private_key_type = opt.cert_type;
+ }
+
if (opt.cert_file)
if (SSL_CTX_use_certificate_file (ssl_ctx, opt.cert_file,
key_type_to_ssl_type (opt.cert_type))

--8<--

Noël Köthe <nok>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by micahcowan (Updated the item)
  • -unavailable- added by nok (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 9 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 23 Apr 2008 06:31:16 AM UTCmicahcowanStatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
      Release1.11=>1.10
      Fixed ReleaseNone=>1.12
    Wed 23 Apr 2008 06:28:06 AM UTCmicahcowanStatusNeeds Investigation=>In Progress
    Mon 14 Apr 2008 11:38:32 AM UTCmicahcowanStatusNeeds Discussion=>Needs Investigation
    Fri 28 Mar 2008 07:28:32 PM UTCmicahcowanPriority5 - Normal=>7 - High
      StatusNone=>Needs Discussion
      Planned ReleaseNone=>1.12

    Back to the top


    Powered by Savane 3.1-cleanup1