mainGnuTLS - Support: sr #108582, "ocsptool --ask" does...

 
 

sr #108582: "ocsptool --ask" does not send URL path to the server

Submitter:  Matt McCutchen <hashproduct>
Submitted:  Mon 26 May 2014 02:35:56 AM UTC
   
 
Category:  Core library Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  nmav
Open/Closed:  Closed Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 26 May 2014 03:21:47 PM UTC, comment #1: 
Nikos Mavrogiannopoulos <nmav>
Group administrator
Mon 26 May 2014 02:35:56 AM UTC, original submission:  

"ocsptool --ask" does not send the path part of the URL (specified either in the certificate or in the --ask option) to the OCSP server, which causes my OCSP server to return an error.

To reproduce:

$ gnutls-cli -p 443 mattmccutchen.net --print-cert </dev/null | csplit - '/BEGIN CERTIFICATE/' '/^$/' '/BEGIN CERTIFICATE/' '/^$/'
$ ocsptool --ask --load-cert=xx01 --load-issuer=xx03Connecting to OCSP server: ocsp.startssl.com...
Resolving 'ocsp.startssl.com'...
Connecting to '23.62.228.64:80'...
ocsptool: importing response: ASN1 parser: Error in TAG.

For comparison:

$ ocsptool -q --load-cert=xx01 --load-issuer=xx03 | curl -H 'Content-Type: application/ocsp-request' --data-binary @- http://ocsp.startssl.com/sub/class1/server/ca | ocsptool -j --load-issuer=xx03
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1679  100  1609  100    70  15262    664 --:--:-- --:--:-- --:--:-- 15323
OCSP Response Information:
Response Status: Successful
Response Type: Basic OCSP Response
Version: 1
Responder ID: C=IL,O=StartCom Ltd. (Start Commercial Limited),CN=StartCom Class 1 Server OCSP Signer
Produced At: Mon May 26 00:56:32 UTC 2014
Responses:
Certificate ID:
Hash Algorithm: SHA1
Issuer Name Hash: 6568874f40750f016a3475625e1f5c93e5a26d58
Issuer Key Hash: eb4234d098b0ab9ff41b6b08f7cc642eef0e2c45
Serial Number: 10b2a0
Certificate Status: good
This Update: Mon May 26 00:56:32 UTC 2014
Next Update: Wed May 28 00:56:32 UTC 2014
Extensions:

To see what is happening:

$ nc -l localhost 8080

In another terminal:

$ ocsptool --ask=http://localhost:8080/foo --load-cert=xx01 --load-issuer=xx03

nc prints:

POST / HTTP/1.1

(It should be POST /foo HTTP/1.1 .)

I tested Fedora's gnutls-3.1.23-1.fc20.x86_64, but it's clear the behavior hasn't changed in head looking at HEADER_PATTERN at https://gitorious.org/gnutls/gnutls/source/e1369328dd449620edcd6401b495be62f12e956e:src/ocsptool-common.c .

Matt McCutchen <hashproduct>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nmav (Updated the item)
  • -email is unavailable- added by hashproduct (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-05-26 nmav CategoryNone Core library
        StatusConfirmed Done
        Open/ClosedOpen Closed
    2014-05-26 nmav StatusNone Confirmed
        Assigned toNone nmav

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code