helpGnuTLS - Support: sr #108582, "ocsptool --ask" does...

 
 

sr #108582: "ocsptool --ask" does not send URL path to the server

Submitted by:  Matt McCutchen <hashproduct>
Submitted on:  Mon 26 May 2014 02:35:56 AM UTC  
 
Category:  Core library Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  Nikos Mavrogiannopoulos <nmav>
Open/Closed:  Closed Operating System:  None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 26 May 2014 03:21:47 PM UTC, comment #1:

Thank you for reporting that. It is now fixed in:
https://www.gitorious.org/gnutls/gnutls/commit/e58cad6a1473164665f007aba7435e3637884213

Nikos Mavrogiannopoulos <nmav>
Project AdministratorIn charge of this item.
Mon 26 May 2014 02:35:56 AM UTC, original submission:

"ocsptool --ask" does not send the path part of the URL (specified either in the certificate or in the --ask option) to the OCSP server, which causes my OCSP server to return an error.

To reproduce:

$ gnutls-cli -p 443 mattmccutchen.net --print-cert </dev/null | csplit - '/BEGIN CERTIFICATE/' '/^$/' '/BEGIN CERTIFICATE/' '/^$/'
$ ocsptool --ask --load-cert=xx01 --load-issuer=xx03Connecting to OCSP server: ocsp.startssl.com...
Resolving 'ocsp.startssl.com'...
Connecting to '23.62.228.64:80'...
ocsptool: importing response: ASN1 parser: Error in TAG.

For comparison:

$ ocsptool -q --load-cert=xx01 --load-issuer=xx03 | curl -H 'Content-Type: application/ocsp-request' --data-binary @- http://ocsp.startssl.com/sub/class1/server/ca | ocsptool -j --load-issuer=xx03
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 1679 100 1609 100 70 15262 664 --:--:-- --:--:-- --:--:-- 15323
OCSP Response Information:
Response Status: Successful
Response Type: Basic OCSP Response
Version: 1
Responder ID: C=IL,O=StartCom Ltd. (Start Commercial Limited),CN=StartCom Class 1 Server OCSP Signer
Produced At: Mon May 26 00:56:32 UTC 2014
Responses:
Certificate ID:
Hash Algorithm: SHA1
Issuer Name Hash: 6568874f40750f016a3475625e1f5c93e5a26d58
Issuer Key Hash: eb4234d098b0ab9ff41b6b08f7cc642eef0e2c45
Serial Number: 10b2a0
Certificate Status: good
This Update: Mon May 26 00:56:32 UTC 2014
Next Update: Wed May 28 00:56:32 UTC 2014
Extensions:

To see what is happening:

$ nc -l localhost 8080

In another terminal:

$ ocsptool --ask=http://localhost:8080/foo --load-cert=xx01 --load-issuer=xx03

nc prints:

POST / HTTP/1.1

(It should be POST /foo HTTP/1.1 .)

I tested Fedora's gnutls-3.1.23-1.fc20.x86_64, but it's clear the behavior hasn't changed in head looking at HEADER_PATTERN at https://gitorious.org/gnutls/gnutls/source/e1369328dd449620edcd6401b495be62f12e956e:src/ocsptool-common.c .

Matt McCutchen <hashproduct>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nmav (Updated the item)
  • -email is unavailable- added by hashproduct (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-05-26 nmav CategoryNone => Core library
        StatusConfirmed => Done
        Open/ClosedOpen => Closed
    2014-05-26 nmav StatusNone => Confirmed
        Assigned toNone => nmav

    Back to the top


    Powered by Savane 3.3