Changeset 10d9053 in mod_gnutls

Timestamp:

Jan 8, 2017, 9:00:28 AM (6 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

asyncio, debian/master, debian/stretch-backports, master, proxy-ticket, upstream

Children:

0202d6b

Parents:

0a12ff8

git-author:

Thomas Klute <thomas2.klute@…> (01/08/17 08:18:56)

git-committer:

Thomas Klute <thomas2.klute@…> (01/08/17 09:00:28)

Message:

Test suite, gen_ocsp_index.c: Handle serial as fixed order byte array

The previous approach assumed that the serial fits within a long long
unsigned type, because the test suite controls the serial. However,
this breaks on big endian architectures because the order in the
certificate is fixed and returned by gnutls_x509_crt_get_serial in
that way.

The fix is to print the serial byte for byte. Additionally OpenSSL
apparently requires upper case characters in the DB hex encoded
serial, which didn't show up previously due to the small serials. Use
a larger one for the server certificate to detect similar problems in
the future.

Cat the OCSP database into the test log for easier debugging on build
systems without direct file system access (e.g. Debian buildd).

Location:

test

Files:

• gen_ocsp_index.c (modified) (4 diffs)
• server.template.in (modified) (1 diff)
• test-27_OCSP_server.bash (modified) (1 diff)

test/gen_ocsp_index.c

@@ -19 +19 @@
  * permissions and limitations under the License.
  */
+#include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -51 +52 @@
      * any */
     char* revocation = "";
-    /* serial number (hex) */
-    char serial[128];
+    /* serial number (hex), allocated when the length is known */
+    char* serial = NULL;
     /* certificate filename, or "unknown" */
     char* fname = "unknown";
@@ -64 +65 @@
     strftime(expires, sizeof(expires), "%y%m%d%H%M%SZ", &etmp);
 
-    unsigned long long sno = 0;
-    size_t serial_size = sizeof(sno);
-    gnutls_x509_crt_get_serial(cert, &sno, &serial_size);
-    snprintf(serial, sizeof(serial), "%llx", sno);
+    /* determine size of the serial number (in bytes) */
+    size_t serial_size = 0;
+    gnutls_x509_crt_get_serial(cert, NULL, &serial_size);
+    /* allocate memory for serial number and its string representation */
+    uint8_t* sno = calloc(serial_size, sizeof(uint8_t));
+    serial = calloc(serial_size * 2 + 1, sizeof(char));
+    /* actually get the serial */
+    gnutls_x509_crt_get_serial(cert, sno, &serial_size);
+    /* print serial into the buffer byte for byte */
+    for (int i = 0; i < serial_size; i++)
+        snprintf(serial + (2 * i), 3, "%.2X", sno[i]);
+    /* free binary serial */
+    free(sno);
 
     size_t dn_size = sizeof(dn);
@@ -74 +84 @@
     fprintf(stdout, "%s\t%s\t%s\t%s\t%s\t%s\n",
             flag, expires, revocation, serial, fname, dn);
+
+    /* free hex serial */
+    free(serial);
 
 cleanup:

test/server.template.in

@@ -1 @@
-serial=2
+serial=587198681
 cn=__HOSTNAME__
 tls_www_server

test/test-27_OCSP_server.bash

@@ -7 +7 @@
 # trigger OCSP server test in the runtests script
 export CHECK_OCSP_SERVER="true"
+echo "OCSP index for the test CA:"
+cat authority/ocsp_index.txt
 
 ${srcdir}/runtests t-27