Package: gajim Version: 0.15.1-3 Severity: important Hi,
I just notice an issue with the way gajim checks certificates for jabber servers. In case you're not familiar with jabber server certificates, they have a pretty complex setup, where you can put some “otherName” with specific oids in the SubjectAlternateName of the certificate. More info can be found on http://wiki.xmpp.org/web/XMPP_Server_Certificates and http://tools.ietf.org/html/draft-ietf-xmpp-3920bis-22#section-13.7.1.2 but basically the SAN looks like [jabber.org]: openssl x509: X509v3 Subject Alternative Name: DNS:register.jabber.org, DNS:jabber.org, othername:<unsupported>, othername:<unsupported>, othername:<unsupported>, othername:<unsupported> openssl 0:d=0 hl=3 l= 155 cons: SEQUENCE 3:d=1 hl=2 l= 19 prim: cont [ 2 ] 24:d=1 hl=2 l= 10 prim: cont [ 2 ] 36:d=1 hl=2 l= 33 cons: cont [ 0 ] 38:d=2 hl=2 l= 8 prim: OBJECT :1.3.6.1.5.5.7.8.5 48:d=2 hl=2 l= 21 cons: cont [ 0 ] 50:d=3 hl=2 l= 19 prim: UTF8STRING :register.jabber.org 71:d=1 hl=2 l= 33 cons: cont [ 0 ] 73:d=2 hl=2 l= 8 prim: OBJECT :1.3.6.1.5.5.7.8.7 83:d=2 hl=2 l= 21 cons: cont [ 0 ] 85:d=3 hl=2 l= 19 prim: IA5STRING :register.jabber.org 106:d=1 hl=2 l= 24 cons: cont [ 0 ] 108:d=2 hl=2 l= 8 prim: OBJECT :1.3.6.1.5.5.7.8.5 118:d=2 hl=2 l= 12 cons: cont [ 0 ] 120:d=3 hl=2 l= 10 prim: UTF8STRING :jabber.org 132:d=1 hl=2 l= 24 cons: cont [ 0 ] 134:d=2 hl=2 l= 8 prim: OBJECT :1.3.6.1.5.5.7.8.7 144:d=2 hl=2 l= 12 cons: cont [ 0 ] 146:d=3 hl=2 l= 10 prim: IA5STRING :jabber.org Gajim supports this when python-pyasn1 parse is installed, but unfortunately, it doesn't work. When it tries to check the SAN extension (in common/check_X509.py:check_certificate()), it first parses the extension and set the fields in a python dictionnaries, then tries to see if the relevant OIDs are present in that dictionnary. Unfortunately, the way it checks is wrong. Let me show you a quick example against jabber.org server (which has this kind of certificate). I've applied the following diff to Gajim to get some output: ---- diff --git a/src/common/check_X509.py b/src/common/check_X509.py index 5a77eed..4ad23e6 100644 --- a/src/common/check_X509.py +++ b/src/common/check_X509.py @@ -135,6 +135,8 @@ try: if ext.get_short_name() == 'subjectAltName': r = _parse_asn1(ext.get_data()) if 'otherName' in r: + print "oid from cert: %s" % r['otherName'].keys()[0] + print "oid from src: %s" % oid_xmppaddr if oid_xmppaddr in r['otherName']: for host in r['otherName'][oid_xmppaddr]: try: ---- oid_xmppaddr is defined on top of the file, along with oid_dnssrv: oid_xmppaddr = '(1, 3, 6, 1, 5, 5, 7, 8, 5)' oid_dnssrv = '(1, 3, 6, 1, 5, 5, 7, 8, 7)' When running against jabber.org server, here's the output: oid from cert: 1.3.6.1.5.5.7.8.7 oid from src: (1, 3, 6, 1, 5, 5, 7, 8, 5) So basically there's no chance the test ever succeeds. Fortunately, if the “extended” way (where you have those otherName fields in SAN) fails, it falls back to DNS: SAN, which is usually present, so that's why I guess people didn't saw it before. Attached patch should fix the problem. -- System Information: Debian Release: 7.0 APT prefers unstable APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 3.2.0-4-grsec-amd64 (SMP w/4 CPU cores) Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages gajim depends on: ii dnsutils 1:9.8.4.dfsg.P1-5 ii python 2.7.3-3 ii python-gtk2 2.24.0-3+b1 Versions of packages gajim recommends: ii dbus 1.6.8-1 ii python-crypto 2.6-3 ii python-dbus 1.1.1-1 ii python-openssl 0.13-2 ii python-pyasn1 0.1.3-1 ii xfce4-notifyd [notification-daemon] 0.2.2-3 Versions of packages gajim suggests: ii aspell-en 7.1-0-1 pn avahi-daemon <none> pn dvipng <none> ii gnome-keyring 3.4.1-5 pn gstreamer0.10-plugins-ugly <none> ii libgtkspell0 2.0.16-1 pn nautilus-sendto <none> ii network-manager 0.9.4.0-10 pn python-avahi <none> pn python-farstream <none> ii python-gconf 2.28.1+dfsg-1 ii python-gnome2 2.28.1+dfsg-1 pn python-gnomekeyring <none> pn python-gupnp-igd <none> pn python-kerberos <none> pn python-pycurl <none> ii texlive-latex-base 2012.20120611-5 -- no debconf information
>From cd3ce23f426ac03fb2b97816e44669a395c266ce Mon Sep 17 00:00:00 2001 From: Yves-Alexis Perez <[email protected]> Date: Thu, 31 Jan 2013 21:55:03 +0100 Subject: [PATCH] Fix OID definitions oid_xmppaddr and oid_dnssrv comparison are not correctly defined so when they are compared to the data parsed by pyasn1, it will always fail. --- src/common/check_X509.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/common/check_X509.py b/src/common/check_X509.py index 5a77eed..e0b24d5 100644 --- a/src/common/check_X509.py +++ b/src/common/check_X509.py @@ -12,8 +12,8 @@ try: from common.helpers import prep, InvalidFormat MAX = 64 - oid_xmppaddr = '(1, 3, 6, 1, 5, 5, 7, 8, 5)' - oid_dnssrv = '(1, 3, 6, 1, 5, 5, 7, 8, 7)' + oid_xmppaddr = '1.3.6.1.5.5.7.8.5' + oid_dnssrv = '1.3.6.1.5.5.7.8.7' -- 1.7.10.4
