You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2017/08/08 20:16:01 UTC
[Bug 61394] New: NIO/NIO2 + OpenSSL renegotiation doesn't send list
of CAS to user agent
https://bz.apache.org/bugzilla/show_bug.cgi?id=61394
Bug ID: 61394
Summary: NIO/NIO2 + OpenSSL renegotiation doesn't send list of
CAS to user agent
Product: Tomcat 9
Version: unspecified
Hardware: PC
OS: Linux
Status: NEW
Severity: minor
Priority: P2
Component: Connectors
Assignee: dev@tomcat.apache.org
Reporter: markt@apache.org
Target Milestone: -----
There is a small glitch with NIO and NIO2 with OpenSSL. Because the code
doesn't specify a set of trusted certs, OpenSSL doesn't send any CA names to
the user agent which in turn (typically) opts to display all of the available
client certs. If the user has a lot of certs it can take time to find the right
one.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 61394] NIO/NIO2 + OpenSSL renegotiation doesn't send list of
CAs to user agent
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=61394
--- Comment #10 from matej.spiller@gmail.com ---
I am unable to debug the exact SSL error but I too have a problem with OpenSSL
& NIO (or NIO2) when I have truststoreFile setup.
As soon as I enable certificateVerification I start getting SSL errors in
chrome. If I switch to JSSE it works as advertised. I can set the verification
to optional and not select a certificate and still get the same error.
<Connector port="8443"
protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="150" SSLEnabled="true">
<SSLHostConfig truststoreFile="conf/truststore.jks"
truststorePassword="test" certificateVerification="optional">
<Certificate certificateKeystoreFile="conf/keystore.jks"
certificateKeystorePassword="test"
type="RSA" />
</SSLHostConfig>
</Connector>
If I open the page in IE it lists all the certificates.
Is there any chance to get a 1.2.13 snapshot build to test it on windows x64?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 61394] NIO/NIO2 + OpenSSL renegotiation doesn't send list of
CAs to user agent
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=61394
--- Comment #6 from Mark Thomas <ma...@apache.org> ---
Currently no trusted certs means trust all. I don't see a reason to change
that.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 61394] NIO/NIO2 + OpenSSL renegotiation doesn't send list of
CAs to user agent
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=61394
--- Comment #11 from matej.spiller@gmail.com ---
Created attachment 35228
--> https://bz.apache.org/bugzilla/attachment.cgi?id=35228&action=edit
screenshot of a chrome ssl protocl error
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 61394] NIO/NIO2 + OpenSSL renegotiation doesn't send list of
CAs to user agent
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=61394
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|NIO/NIO2 + OpenSSL |NIO/NIO2 + OpenSSL
|renegotiation doesn't send |renegotiation doesn't send
|list of CAS to user agent |list of CAs to user agent
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 61394] NIO/NIO2 + OpenSSL renegotiation doesn't send list of
CAs to user agent
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=61394
--- Comment #8 from Rainer Jung <ra...@kippdata.de> ---
The patch is based on the native extension committed in r1804622.
Please also note a related fix I noticed when looking at that part of the code
(r1804595).
I started some testing for the attached patch and will add some new test cases.
Simple preliminary tests look OK.
Note that the patch also moved the code for the "use files instead of trust
managers" case.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 61394] NIO/NIO2 + OpenSSL renegotiation doesn't send list of
CAs to user agent
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=61394
--- Comment #1 from Rainer Jung <ra...@kippdata.de> ---
The OpenSSL call for this should be SSL_CTX_set_client_CA_list() (at least
mod_ssl in Apache httpd uses it).
We already wired that functionality in tcnative, file native/src/sslcontext.c,
function setCACertificate. It gets alrady called in
org.apache.tomcat.jni.SSLContext.setCACertificate(long ctx, String file, String
path) which in trun is (conditionally) called from
org.apache.tomcat.util.net.openssl.OpenSSLContext.init(...) and
org.apache.tomcat.util.net.AprEndpoint.createSSLContext(...). Maybe something
with the setup is wrong?
Regards,
Rainer
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 61394] NIO/NIO2 + OpenSSL renegotiation doesn't send list of
CAs to user agent
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=61394
--- Comment #2 from Mark Thomas <ma...@apache.org> ---
I don't think we are calling that method when we are using JSSE config with the
OpenSSL engine. I think we need the equivalent of the call to setCertificateRaw
for the trusted certs.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 61394] NIO/NIO2 + OpenSSL renegotiation doesn't send list of
CAs to user agent
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=61394
--- Comment #9 from Rainer Jung <ra...@kippdata.de> ---
I applied the patch, wrapping the new native call in a check for a
UnsatisfiedLinkError to not break compatibility with older tcnative.
I also added one new test and checks to existing tests to detcet, whether a CA
for client cert is contained in the handshake and whether it is the right one.
We need to decide, whether and how to backport, since the fix relies on the not
yet released tcnative 1.2.13. Eve once it is released it might not be widely
available.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 61394] NIO/NIO2 + OpenSSL renegotiation doesn't send list of
CAs to user agent
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=61394
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED
--- Comment #13 from Mark Thomas <ma...@apache.org> ---
9.0.x and 8.5.x have been updated to require 1.2.14
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 61394] NIO/NIO2 + OpenSSL renegotiation doesn't send list of
CAs to user agent
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=61394
--- Comment #4 from Mark Thomas <ma...@apache.org> ---
Yes, this is JSSE style config only.
Yes, I was thinking along the lines you describe.
Regarding the custom trust manager, what I think Tomcat needs to do is
replicate what JSSE does which is:
- iterate through the provided TrustManager instances array and select the
first instance of X509TrustManager
- call getAcceptedIssuers() on that instance to get the list of acceptable CAs
Then Tomcat can pass that array of X509Certificates to OpenSSL.
That should then give us equivalent behaviour for the same configuration with
either implementation.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 61394] NIO/NIO2 + OpenSSL renegotiation doesn't send list of
CAs to user agent
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=61394
--- Comment #5 from George Stanchev <st...@hotmail.com> ---
I don't mean to derail the discussion but we implement a trust-all manager
thats gets injected from the connector attrobutes:
public class AnyCertX509TrustManager implements X509TrustManager {
public void checkClientTrusted(X509Certificate[] certs, String auth) {}
public void checkServerTrusted(X509Certificate[] certs, String auth) {}
public X509Certificate[] getAcceptedIssuers() { return new
X509Certificate[0]; }
}
In case of OpenSSL setup, would the proposed approach to send the accepted
issuers as [0] sized array of certs mean "trust-all" to OpenSSL or "trust-none"
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 61394] NIO/NIO2 + OpenSSL renegotiation doesn't send list of
CAs to user agent
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=61394
--- Comment #3 from Rainer Jung <ra...@kippdata.de> ---
OK, so the problem is only occuring if JSSE style config is used?
And the attempt would be to read CA certs from the configured truststore, pass
them as raw data to a new method setCACertificateRaw(), whose native impl
converts them to OpenSSL X509 analogous to setCertificateRaw() and passes the
result directly to OpenSSL via SSL_CTX_set_client_CA_list().
Is that what you expect?
I might give it an attempt this evening.
Note that our docs say:
###################
trustManagerClassName
JSSE only.
The name of a custom trust manager class to use to validate client
certificates. The class must have a zero argument constructor and must also
implement javax.net.ssl.X509TrustManager. If this attribute is set, the trust
store attributes may be ignored.
###################
So retrieving CA certs from a configured trust store might give wrong results,
if e.g. a custom trust manager gets used and a trust store is configured, that
the trust manager would not use but we would still use it to feed OpenSSL. One
could argue that would be a configuration issue, but at least the docs ("may be
ignored") would open to interpretation then.
Regards,
Rainer
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 61394] NIO/NIO2 + OpenSSL renegotiation doesn't send list of
CAs to user agent
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=61394
--- Comment #7 from Rainer Jung <ra...@kippdata.de> ---
Created attachment 35210
--> https://bz.apache.org/bugzilla/attachment.cgi?id=35210&action=edit
TC trunk support adding client CA list from trust managers
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 61394] NIO/NIO2 + OpenSSL renegotiation doesn't send list of
CAs to user agent
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=61394
--- Comment #12 from Mark Thomas <ma...@apache.org> ---
comment #10 looks like the renegotiation issues that were fixed in 1.2.13. I
can't reproduce the issue.
I've tested this with 1.2.14 and various combinations and all now behave as
expected.
Once 1.2.14 is available and Tomcat has been updated to require it, this can be
closed.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org