headers
Nikos Mavrogiannopoulos | 1 Jun 2012 13:28

Re: LDAP over SSL does not work with Ubuntu Prolonged Pain

On Thu, May 31, 2012 at 2:24 PM, Thorsten Glaser <t.glaser <at> tarent.de> wrote:

> In the meanwhile, I tested this patch on Debian squeeze (exemplarily;
> lenny is also affected), *buntu hardy, lucid, oneiric and precise,
> and it works (turns out the older versions are also affected). I only
> had thought it to be a regression since we used to have
>        TLS_CACERT      /etc/ssl/certs/dc.lan.tarent.de.cer
> in our /etc/ldap/ldap.conf, and my coworker’s new setup places the
> whole ca-certificates.crt file there, instead of just the certificate
> of the CA who signed the LDAP servers’ certs.

Thanks.

> There’s a comment typo (isser instead of issuer) and a few occurences of
> trailing whitespace in the patch. </nitpick-mode>

I'll correct it.

regards,
Nikos

_______________________________________________
Help-gnutls mailing list
Help-gnutls <at> gnu.org
https://lists.gnu.org/mailman/listinfo/help-gnutls
Permalink | Reply | 0 comments |
headers
Carolin Latze | 9 Jun 2012 12:36

how to use gnutls_privkey_import_ext

Hi all

I tried to port some of my really old code to a new version of GnuTLS. I 
used a signing callback in order to let the TPM sign data. However since 
gnutls_sign_callback_set is deprecated now I tried to move to 
gnutls_privkey_import_ext. Here is what I did:

I defined an empty privkey structure (since the privkey is stored within 
the TPM):
const gnutls_datum_t key = { NULL, 0 };

I took my old sign callback and assigned it to that structure:
gnutls_privkey_import_ext(&key,NULL,NULL,gnutls_tpm_sign,NULL,0);
gnutls_certificate_set_x509_key_mem(xcred, &ccert, &key, 
GNUTLS_X509_FMT_PEM);

But now when I try to run the handshake, I get:
GnuTLS error: Insufficient credentials for that request.
Segmentation fault (core dumped)

Since I have debug messages in my sign function I know that it does 
never execute that function

Are there any examples on how to use privkey_import_ext? I did not find 
any so far :-/

PKCS#11 is not really an option since that comes with some limitations 
on the TPM...

Regards
(Continue reading)

Permalink | Reply | 13 comments |
headers
Nikos Mavrogiannopoulos | 10 Jun 2012 02:47

Re: how to use gnutls_privkey_import_ext

On 06/09/2012 12:36 PM, Carolin Latze wrote:

> Hi all
> 
> I tried to port some of my really old code to a new version of GnuTLS. I
> used a signing callback in order to let the TPM sign data. However since
> gnutls_sign_callback_set is deprecated now I tried to move to
> gnutls_privkey_import_ext. Here is what I did:
> 
> I defined an empty privkey structure (since the privkey is stored within
> the TPM):
> const gnutls_datum_t key = { NULL, 0 };
> 
> I took my old sign callback and assigned it to that structure:
> gnutls_privkey_import_ext(&key,NULL,NULL,gnutls_tpm_sign,NULL,0);

Hello,
 Did you check the error code from this function? It should have failed
because it requires a sign function and a decryption function. You also
do not set the public key algorithm to be used and put a NULL there.

If you do not want to use decryption, then put a dummy function that
always returns an error code and then make sure you use ciphersuites
that require signing (DHE-RSA/ECDHE-RSA).

> PKCS#11 is not really an option since that comes with some limitations
> on the TPM...

I see that trousers comes with a PKCS #11 module (or they claim to).
I've never tried it, but doesn't it work?
(Continue reading)

Permalink | Reply | 12 comments |
headers
Carolin Latze | 10 Jun 2012 11:37

Re: how to use gnutls_privkey_import_ext

Hi Nikos,

On 06/10/2012 02:47 AM, Nikos Mavrogiannopoulos wrote:
> On 06/09/2012 12:36 PM, Carolin Latze wrote:
>
>    
>> Hi all
>>
>> I tried to port some of my really old code to a new version of GnuTLS. I
>> used a signing callback in order to let the TPM sign data. However since
>> gnutls_sign_callback_set is deprecated now I tried to move to
>> gnutls_privkey_import_ext. Here is what I did:
>>
>> I defined an empty privkey structure (since the privkey is stored within
>> the TPM):
>> const gnutls_datum_t key = { NULL, 0 };
>>
>> I took my old sign callback and assigned it to that structure:
>> gnutls_privkey_import_ext(&key,NULL,NULL,gnutls_tpm_sign,NULL,0);
>>      
>
> Hello,
>   Did you check the error code from this function? It should have failed
> because it requires a sign function and a decryption function. You also
> do not set the public key algorithm to be used and put a NULL there.
>    
I also tried with GNUTLS_PK_RSA, but that did not help. And yeah I also 
switched on logging with a level of 15, but did not really see what the 
problem could. Well I thought it would be the pk algorithm, but as I 
said, that did not solve the problem.
(Continue reading)

Permalink | Reply | 11 comments |
headers
Nikos Mavrogiannopoulos | 10 Jun 2012 11:55

Re: how to use gnutls_privkey_import_ext

On 06/10/2012 11:37 AM, Carolin Latze wrote:

>> Hello,
>>   Did you check the error code from this function? It should have failed
>> because it requires a sign function and a decryption function. You also
>> do not set the public key algorithm to be used and put a NULL there.

> I also tried with GNUTLS_PK_RSA, but that did not help. And yeah I also
> switched on logging with a level of 15, but did not really see what the
> problem could. Well I thought it would be the pk algorithm, but as I
> said, that did not solve the problem.

Note that I didn't refer to logging but to checking the error code
returned by the function. If such a function fails the results are
inpredictable (like the crash you see). If possible send me an output of
valgrind with the crash to see whether an error code can be returned
instead of crash.

>> I see that trousers comes with a PKCS #11 module (or they claim to).
>> I've never tried it, but doesn't it work?
> It does. But the TPM has never been designed to meet the PKCS#11 spec,
> so it requires for instance to set some keys to NULL. I could do that
> but I need to clear and reset my TPM to do that and I was hoping that I
> could prevent that. Maybe that is the next thing I try if I don't manage
> to get the other function to work.

This function works (I know it is used in windows which usually has no
pkcs #11), so if you have more issues let me know. Just make sure you
provide functions of the correct type (note that the parameters in
gnutls_privkey_sign_func are different than the old gnutls_sign_func).
(Continue reading)

Permalink | Reply | 10 comments |
headers
Carolin Latze | 10 Jun 2012 11:58

Re: how to use gnutls_privkey_import_ext

On 06/10/2012 11:55 AM, Nikos Mavrogiannopoulos wrote:
> On 06/10/2012 11:37 AM, Carolin Latze wrote:
>
>
>    
>>> Hello,
>>>    Did you check the error code from this function? It should have failed
>>> because it requires a sign function and a decryption function. You also
>>> do not set the public key algorithm to be used and put a NULL there.
>>>        
>
>    
>> I also tried with GNUTLS_PK_RSA, but that did not help. And yeah I also
>> switched on logging with a level of 15, but did not really see what the
>> problem could. Well I thought it would be the pk algorithm, but as I
>> said, that did not solve the problem.
>>      
>
> Note that I didn't refer to logging but to checking the error code
> returned by the function. If such a function fails the results are
> inpredictable (like the crash you see). If possible send me an output of
> valgrind with the crash to see whether an error code can be returned
> instead of crash.
>    
I will try that.
>    
>>> I see that trousers comes with a PKCS #11 module (or they claim to).
>>> I've never tried it, but doesn't it work?
>>>        
>> It does. But the TPM has never been designed to meet the PKCS#11 spec,
(Continue reading)

Permalink | Reply | 9 comments |
headers
Carolin Latze | 10 Jun 2012 12:56

Re: how to use gnutls_privkey_import_ext

Ok, this is what I did now: I defined a sign_func and a decrypt_func 
based on the type found in abstract.h:

int gnutls_tpm_sign_func (gnutls_privkey_t key,
                           void *userdata,
                           const gnutls_datum_t * raw_data,
                           gnutls_datum_t * signature);
int gnutls_tpm_decrypt_func (gnutls_privkey_t key,
                              void *userdata,
                              const gnutls_datum_t * ciphertext,
                              gnutls_datum_t * plaintext);

The decrypt func will just return -1, whereas the sign func will call 
the TPM. Furthermore I create a NULL privkey:

gnutls_privkey_t key;
gnutls_privkey_init(&key);

and assigned a NULL privkey to the credentials of this session: (even if 
I assign the &key here, it does not help)

gnutls_certificate_set_x509_key_mem(xcred, &ccert, NULL, 
GNUTLS_X509_FMT_PEM);

Later, after gnutls_init, I tried to import the key callbacks:

gnutls_privkey_import_ext(key,GNUTLS_PK_RSA,NULL,gnutls_tpm_sign_func,gnutls_tpm_decrypt_func,0);

Now I see that gnutls_privkey_import_ext is executed without problems 
(no errors, no segfault, valgrind just silent), but none of the
(Continue reading)

Permalink | Reply | 8 comments |
headers
Nikos Mavrogiannopoulos | 10 Jun 2012 13:18

Re: how to use gnutls_privkey_import_ext

On 06/10/2012 12:56 PM, Carolin Latze wrote:

> gnutls_privkey_t key;
> gnutls_privkey_init(&key);
> 
> and assigned a NULL privkey to the credentials of this session: (even if
> I assign the &key here, it does not help)
> 
> gnutls_certificate_set_x509_key_mem(xcred, &ccert, NULL,
> GNUTLS_X509_FMT_PEM);

Unfortunately you cannot call this. If you have a gnutls_privkey_t you
need to use gnutls_certificate_set_key(). That means that you'll have to
import the certificate and convert it to gnutls_pcert_st. A helper
function is indeed needed in that case.

regards,
Nikos
Permalink | Reply | 7 comments |
headers
Carolin Latze | 10 Jun 2012 14:51

Re: how to use gnutls_privkey_import_ext

yay, that works ( I do it with a cert_callback now). I just need to 
restrict the hash algorithms to SHA-1 since the TPM refuses to sign an 
SHA256 hash :-/

need to figure out how to do this. If all is running fine I need to 
clean up the code and will send it to you.

On 06/10/2012 01:18 PM, Nikos Mavrogiannopoulos wrote:
> On 06/10/2012 12:56 PM, Carolin Latze wrote:
>
>
>    
>> gnutls_privkey_t key;
>> gnutls_privkey_init(&key);
>>
>> and assigned a NULL privkey to the credentials of this session: (even if
>> I assign the&key here, it does not help)
>>
>> gnutls_certificate_set_x509_key_mem(xcred,&ccert, NULL,
>> GNUTLS_X509_FMT_PEM);
>>      
>
> Unfortunately you cannot call this. If you have a gnutls_privkey_t you
> need to use gnutls_certificate_set_key(). That means that you'll have to
> import the certificate and convert it to gnutls_pcert_st. A helper
> function is indeed needed in that case.
>
> regards,
> Nikos
>
(Continue reading)

Permalink | Reply | 6 comments |
headers
Nikos Mavrogiannopoulos | 10 Jun 2012 15:26

Re: how to use gnutls_privkey_import_ext

On 06/10/2012 02:51 PM, Carolin Latze wrote:

> yay, that works ( I do it with a cert_callback now). I just need to
> restrict the hash algorithms to SHA-1 since the TPM refuses to sign an
> SHA256 hash :-/

> need to figure out how to do this. If all is running fine I need to

> clean up the code and will send it to you.

This you can control using the priority string. Add "-SIGN-ALL:+SIGN-SHA1".

regards,
Nikos
Permalink | Reply | 5 comments |

Gmane