mathias.gug@canonical.com wrote:
> Full_Name: Mathias Gug
> Version: 2.4.15
> OS: Ubuntu Linux (Jaunty - 9.04)
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (64.56.226.136)
>
>
> slapd+gnutls doesn't send all the certificates in the chain while slapd+openssl
> does.
>
> openldap version: 2.4.15
> gnutls version: 2.4.2
> openssl version: 0.9.8g
>
> Here are two systems running slapd 2.4.15 - one compiled with gnutls
> (t-slapd-gnutls), the other with openssl (t-slapd-openssl).

This appears to be a logical disconnect between the GnuTLS and OpenSSL APIs; 
the OpenLDAP docs were written for OpenSSL...

The way we use the OpenSSL library, it's assumed that only a single cert and 
key are present in the configured certfile and keyfile, and all of the 
relevant CAs for that cert are present in the CA file/path.

In the GnuTLS library, the library expects the entire cert chain to be present 
in the certfile. I think it's clear from this message
http://groups.google.com/group/linux.debian.bugs.dist/msg/8fec96a62571d6e9
that this is a weakness in the GnuTLS API, one that prevents it from 
distinguishing between CA certs and end-entity certs, and thus the reason the 
whole V1 trust problem arose in the first place.

As an immediate workaround, you can simply copy the appropriate CA certs into 
your server cert file. In the meantime it looks like we'll just have to use 
gnutls_certificate_set_x509_key() to address this.

> mathiaz@t-slapd-gnutls:~$ gnutls-cli --x509cafile allca.pem --print-cert -p 636
> t-slapd-gnutls.
> Processed 2 CA certificate(s).
> Resolving 't-slapd-gnutls.'...
> Connecting to '172.19.42.87:636'...
> - Certificate type: X.509
>   - Got a certificate list of 1 certificates.
>
>   - Certificate[0] info:
>
> -----BEGIN CERTIFICATE-----
> MIICyTCCAjKgAwIBAgIBBTANBgkqhkiG9w0BAQUFADBIMQswCQYDVQQGEwJDQTEL
> MAkGA1UECBMCUUMxEDAOBgNVBAoTB01hdGhpYXoxGjAYBgNVBAMTEVRFU1QgQ0FW
> MSAtIEhBUkRZMB4XDTA5MDMwNDE5NTcxMVoXDTEwMDMwNDE5NTcxMVowRjELMAkG
> A1UEBhMCQ0ExCzAJBgNVBAgTAlFDMRAwDgYDVQQKEwdNYXRoaWF6MRgwFgYDVQQD
> Ew90LXNsYXBkLWdudXRscy4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL5X
> ERAGYnqTCJae2FnEB1qT2Hk0sNiD1n+mnyhNDespomTINPLKpZZmqOSlD7x71zuy
> DQ/Z6uxgIxOhuUV9VVo2cISi9MmEOYn4qxGq2YIHyra5FJZf6O43qajicDaRRzGz
> UA17ap7vDqgig9T4qFvwCllz4EFlcTzxV+N99m1RAgMBAAGjgcQwgcEwCQYDVR0T
> BAIwADALBgNVHQ8EBAMCBaAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJh
> dGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBSii4L1Po9xGWrMD2oG8VeFuTQtfzBa
> BgNVHSMEUzBRoUykSjBIMQswCQYDVQQGEwJDQTELMAkGA1UECBMCUUMxEDAOBgNV
> BAoTB01hdGhpYXoxGjAYBgNVBAMTEVRFU1QgQ0FWMSAtIEhBUkRZggEAMA0GCSqG
> SIb3DQEBBQUAA4GBAEEQMsEc0VQOt1y8B22xfRewUmwMKk34J80aFkKuG/RQJoBw
> TSnlHpqyZFvmOu4JaCJAh6IdTdxfsuDB5vu/5kpNMc3jJX1Ale17l1MuxB6lvcKn
> zG3A17BIIZh3aoJcVQgDAQ8Vr/I9z8y51i1Qr37E5HF2GjuuyF+5BJz9lITq
> -----END CERTIFICATE-----
>
>   # The hostname in the certificate matches 't-slapd-gnutls.'.
>   # valid since: Wed Mar  4 14:57:11 EST 2009
>   # expires at: Thu Mar  4 14:57:11 EST 2010
>   # fingerprint: 72:5A:24:83:6C:5C:3F:0E:80:52:F1:61:CD:C3:0D:31
>   # Subject's DN: C=CA,ST=QC,O=Mathiaz,CN=t-slapd-gnutls.
>   # Issuer's DN: C=CA,ST=QC,O=Mathiaz,CN=TEST CAV1 - HARDY
>
>
> - Peer's certificate is trusted
> - Version: TLS1.1
> - Key Exchange: RSA
> - Cipher: AES-128-CBC
> - MAC: SHA1
> - Compression: NULL
> - Handshake was completed
>
> - Simple Client Mode:
>
> mathiaz@t-slapd-gnutls:~$ gnutls-cli --x509cafile allca.pem --print-cert -p 636
> t-slapd-openssl.
> Processed 2 CA certificate(s).
> Resolving 't-slapd-openssl.'...
> Connecting to '172.19.42.220:636'...
> - Certificate type: X.509
>   - Got a certificate list of 2 certificates.
>
>   - Certificate[0] info:
>
> -----BEGIN CERTIFICATE-----
> MIIB/jCCAWcCAQcwDQYJKoZIhvcNAQEFBQAwSDELMAkGA1UEBhMCQ0ExCzAJBgNV
> BAgTAlFDMRAwDgYDVQQKEwdNYXRoaWF6MRowGAYDVQQDExFURVNUIENBVjEgLSBI
> QVJEWTAeFw0wOTAzMDQyMDExMTRaFw0xMDAzMDQyMDExMTRaMEcxCzAJBgNVBAYT
> AkNBMQswCQYDVQQIEwJRQzEQMA4GA1UEChMHTWF0aGlhejEZMBcGA1UEAxMQdC1z
> bGFwZC1vcGVuc3NsLjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAzTEuHfVR
> ELoXxSyVTwWrfIIsoKqBfbZYJSGQcTTEtuvxABxX8AoKyc9T+AkhR4wsSmRZGOBz
> opH9u0LReaGyhWkUA/XaFF24jkSogi6yDsh478P/ayZjushPLh9LpIeW/2lD9xkh
> t5LGW255lXIMGI5+/x8EgiaU1pS5OO9wz/kCAwEAATANBgkqhkiG9w0BAQUFAAOB
> gQBlg/lIawsDYFqqNz61BNl2nix4LrIRFxiOA/p14VFkRyuCVHXDjhBtlb13wBZk
> wVTDfUdykvy2nlJq8bLQ7OYYdiA4h64HMnLTMyMALKBFiVwyrg/GvF7TsUg3K41K
> uFTF0H1bQOmqrJPcIu8r+h3gQLkCRvBLssZaQtA4M4jw4A==
> -----END CERTIFICATE-----
>
>   # The hostname in the certificate matches 't-slapd-openssl.'.
>   # valid since: Wed Mar  4 15:11:14 EST 2009
>   # expires at: Thu Mar  4 15:11:14 EST 2010
>   # fingerprint: 85:7F:06:0A:EC:3A:9E:6C:78:BC:FC:C3:8F:4D:4B:E9
>   # Subject's DN: C=CA,ST=QC,O=Mathiaz,CN=t-slapd-openssl.
>   # Issuer's DN: C=CA,ST=QC,O=Mathiaz,CN=TEST CAV1 - HARDY
>
>   - Certificate[1] info:
>
> -----BEGIN CERTIFICATE-----
> MIIB/zCCAWgCAQAwDQYJKoZIhvcNAQEFBQAwSDELMAkGA1UEBhMCQ0ExCzAJBgNV
> BAgTAlFDMRAwDgYDVQQKEwdNYXRoaWF6MRowGAYDVQQDExFURVNUIENBVjEgLSBI
> QVJEWTAeFw0wOTAzMDMxODI1NTBaFw0xMjAzMDIxODI1NTBaMEgxCzAJBgNVBAYT
> AkNBMQswCQYDVQQIEwJRQzEQMA4GA1UEChMHTWF0aGlhejEaMBgGA1UEAxMRVEVT
> VCBDQVYxIC0gSEFSRFkwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMZSKqDg
> Y5rn4SgJUgnO0IAM2Us/5sQ18mu8gxoDeLkIcHHuiwYHeT4BcOit2hemmOCIEolh
> XPKkMD4MVAbafDFtJjhuEgPtWoUuZcOa9gRi3eH+h7QEYhhwnwLewrQGhx4tsfY4
> wR3LIUm/lxkJISy17v3uc5yNLcAlreUrrdJ1AgMBAAEwDQYJKoZIhvcNAQEFBQAD
> gYEAAsaBDAMUKofwOZPNNV/9EKglG7O3G5p/i9h8n5C3bXy6E6vWtVxqpWd5qBEt
> uMXU1vIIop7FrKornuPWtEy4jKSw12Sv9EXaUJ9rfXQTWh6GpgUmTjlZtOwjABT9
> fAU4M9MdLDTBaZA11NqtdMMPKTwTHXjmv9bKcgOLh1g5WhQ=
> -----END CERTIFICATE-----
>
>   # valid since: Tue Mar  3 13:25:50 EST 2009
>   # expires at: Fri Mar  2 13:25:50 EST 2012
>   # fingerprint: 66:D2:B7:8E:03:DD:BF:24:4D:A1:D8:EA:8E:6F:8B:80
>   # Subject's DN: C=CA,ST=QC,O=Mathiaz,CN=TEST CAV1 - HARDY
>   # Issuer's DN: C=CA,ST=QC,O=Mathiaz,CN=TEST CAV1 - HARDY
>
>
> - Peer's certificate is trusted
> - Version: TLS1.0
> - Key Exchange: RSA
> - Cipher: AES-128-CBC
> - MAC: SHA1
> - Compression: NULL
> - Handshake was completed
>
> - Simple Client Mode:
>
> ^C
>
>


-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/

hyc@symas.com wrote:
> mathias.gug@canonical.com wrote:
>> Full_Name: Mathias Gug
>> Version: 2.4.15
>> OS: Ubuntu Linux (Jaunty - 9.04)
>> URL: ftp://ftp.openldap.org/incoming/
>> Submission from: (NULL) (64.56.226.136)
>>
>>
>> slapd+gnutls doesn't send all the certificates in the chain while slapd+openssl
>> does.
>>
>> openldap version: 2.4.15
>> gnutls version: 2.4.2
>> openssl version: 0.9.8g

I'm unable to reproduce this using GnuTLS 2.6. Why are you using 2.4?

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/

hyc@symas.com wrote:
> hyc@symas.com wrote:
>> mathias.gug@canonical.com wrote:
>>> Full_Name: Mathias Gug
>>> Version: 2.4.15
>>> OS: Ubuntu Linux (Jaunty - 9.04)
>>> URL: ftp://ftp.openldap.org/incoming/
>>> Submission from: (NULL) (64.56.226.136)
>>>
>>>
>>> slapd+gnutls doesn't send all the certificates in the chain while slapd+openssl
>>> does.
>>>
>>> openldap version: 2.4.15
>>> gnutls version: 2.4.2
>>> openssl version: 0.9.8g
>
> I'm unable to reproduce this using GnuTLS 2.6. Why are you using 2.4?
>
Hm, I may have been testing the wrong code before, I see it now. A fix is 
coming in HEAD.

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/

changed notes
changed state Open to Test
moved from Incoming to Software Bugs

changed notes
changed state Test to Release

On Wed, Mar 04, 2009 at 07:49:38PM -0800, Howard Chu wrote:
> mathias.gug@canonical.com wrote:
>> slapd+gnutls doesn't send all the certificates in the chain while slapd+openssl
>> does.
>>
>> openldap version: 2.4.15
>> gnutls version: 2.4.2
>> openssl version: 0.9.8g
>>
>> Here are two systems running slapd 2.4.15 - one compiled with gnutls
>> (t-slapd-gnutls), the other with openssl (t-slapd-openssl).
>
> This appears to be a logical disconnect between the GnuTLS and OpenSSL 
> APIs; the OpenLDAP docs were written for OpenSSL...
>
> The way we use the OpenSSL library, it's assumed that only a single cert 
> and key are present in the configured certfile and keyfile, and all of 
> the relevant CAs for that cert are present in the CA file/path.
>
> In the GnuTLS library, the library expects the entire cert chain to be 
> present in the certfile. I think it's clear from this message
> http://groups.google.com/group/linux.debian.bugs.dist/msg/8fec96a62571d6e9
> that this is a weakness in the GnuTLS API, one that prevents it from  
> distinguishing between CA certs and end-entity certs, and thus the reason 
> the whole V1 trust problem arose in the first place.
>
> As an immediate workaround, you can simply copy the appropriate CA certs 
> into your server cert file. In the meantime it looks like we'll just have 
> to use gnutls_certificate_set_x509_key() to address this.

Thanks for the workaround. It works as expected. I haven't tested the
patch applied to CVS and thus haven't included it in Ubuntu yet.

-- 
Mathias Gug
Ubuntu Developer  http://www.ubuntu.com

changed notes
changed state Release to Closed

fixed in HEAD
fixed in RE24