<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<p class="details" style="font-style: italic; color: #666;">
<a href="https://gitlab.com/pfg666">Paul</a> created an issue: <a href="https://gitlab.com/gnutls/gnutls/-/issues/1245">#1245</a>
</p>
<div></div>
<h2 dir="auto">
<a id="user-content-version-of-gnutls-used" class="anchor" href="#version-of-gnutls-used" aria-hidden="true"></a>Version of gnutls used:</h2>
<p dir="auto">3.7.1</p>
<h2 dir="auto">
<a id="user-content-operating-system" class="anchor" href="#operating-system" aria-hidden="true"></a>Operating System</h2>
<p dir="auto">Ubuntu 20</p>
<h2 dir="auto">
<a id="user-content-description-of-problem" class="anchor" href="#description-of-problem" aria-hidden="true"></a>Description of problem:</h2>
<p dir="auto">The problem regards, as the title suggests, the client's Certificate response to a CertificateRequest by the server. The <a href="https://datatracker.ietf.org/doc/html/rfc5246#page-54" rel="nofollow noreferrer noopener" target="_blank">TLS 1.2 RFC</a> introduces the following requirements on the client Certificate:</p>
<blockquote dir="auto">
<p>The end-entity certificate provided by the client MUST contain a key
that is compatible with certificate_types.</p>
</blockquote>
<blockquote dir="auto">
<p>This message is only sent if the server requests a certificate. If no
suitable certificate is available, the client MUST send a certificate
message containing no certificates.</p>
</blockquote>
<p dir="auto">According to our testing, the GnuTLS DTLS client responds with the Certificate under its possession even if it is unsuitable. In our case, unsuitable means that the type of the public key contained in the Certificate is not compatible with certificate_types in CertificateRequest. This is showcased in the below capture of an interaction with a GnuTLS client.</p>
<p dir="auto"><a class="no-attachment-icon gfm" href="https://gitlab.com/gnutls/gnutls/uploads/22e0d763a3a8b08d2991f87ff10917bc/gnutls_wrong_certificate_type.png" target="_blank" rel="noopener noreferrer" data-link="true"><img src="https://gitlab.com/gnutls/gnutls/uploads/22e0d763a3a8b08d2991f87ff10917bc/gnutls_wrong_certificate_type.png" alt="gnutls_wrong_certificate_type" class="gfm" style="max-width: 100%; height: auto;"></a></p>
<p dir="auto">Inspection of the CertificateRequest and client Certificate messages reveals the incompatibility (DSS_SIGN requires a DSA key, whereas the client Certificate contains an RSA key).</p>
<p dir="auto"><a class="no-attachment-icon gfm" href="https://gitlab.com/gnutls/gnutls/uploads/319b6c45d958d3bd8fb31dfdd089abf5/gnutls_wrong_certificate_type_certreq.png" target="_blank" rel="noopener noreferrer" data-link="true"><img src="https://gitlab.com/gnutls/gnutls/uploads/319b6c45d958d3bd8fb31dfdd089abf5/gnutls_wrong_certificate_type_certreq.png" alt="gnutls_wrong_certificate_type_certreq" class="gfm" style="max-width: 100%; height: auto;"></a></p>
<p dir="auto"><a class="no-attachment-icon gfm" href="https://gitlab.com/gnutls/gnutls/uploads/d73401e981fd101670a44a7afc16039e/gnutls_wrong_certificate_type_cert.png" target="_blank" rel="noopener noreferrer" data-link="true"><img src="https://gitlab.com/gnutls/gnutls/uploads/d73401e981fd101670a44a7afc16039e/gnutls_wrong_certificate_type_cert.png" alt="gnutls_wrong_certificate_type_cert" class="gfm" style="max-width: 100%; height: auto;"></a></p>
<p dir="auto">This behavior can lead to interoperability problems when connecting to servers that request but do not require client Certificates. On receiving a Certificate of the wrong type from the client, the server may abort the handshake, which would have been avoided had the client sent an empty Certificate message. A similar bug has been shown to affect MbedTLS. In the respective <a href="https://github.com/ARMmbed/mbedtls/issues/4059" rel="nofollow noreferrer noopener" target="_blank">issue</a> we also give a concrete interoperability scenario involving an MbedTLS client and OpenSSL server where the two sides fail to complete the handshake because of this issue.</p>
<h2 dir="auto">
<a id="user-content-how-reproducible" class="anchor" href="#how-reproducible" aria-hidden="true"></a>How reproducible:</h2>
<p dir="auto"><a href="https://gitlab.com/gnutls/gnutls/uploads/2b5d9f9ea12e2014e890bce23b27dccb/reproduction.tar.gz" data-link="true" class="gfm">Attached</a> are the files necessary for reproduction using <a href="https://github.com/assist-project/dtls-fuzzer/" rel="nofollow noreferrer noopener" target="_blank">DTLS-Fuzzer</a>. Also included in the archive is the capture shown above. DTLS-Fuzzer requires the JDK for Java 8. On Ubuntu, this can be installed by running:
<code>sudo apt-get install openjdk-8-jdk</code></p>
<p dir="auto">Unpack the archive, <code>cd</code> to resulting folder and run <code>bash reproduce.sh</code>, while running an instance of Wireshark on the side. The reproduction script will:</p>
<ul dir="auto">
<li>setup DTLS-Fuzzer;</li>
<li>launch gnutls-cli utility (it is assumed the correct version of GnuTLS is already installed)</li>
<li>launch DTLS-Fuzzer to execute input sequence found in 'test_sequence' to expose this problem.</li>
</ul>
<h2 dir="auto">
<a id="user-content-actual-results" class="anchor" href="#actual-results" aria-hidden="true"></a>Actual results:</h2>
<p dir="auto">The client generates a non-empty Certificate message whose public key is incompatible with the certificate_types in CertificateRequest.</p>
<h2 dir="auto">
<a id="user-content-expected-results" class="anchor" href="#expected-results" aria-hidden="true"></a>Expected results:</h2>
<p dir="auto">The client should have responded with an empty Certificate.</p>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #666;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/issues/1245">view it on GitLab</a>.
<br>
You're receiving this email because of your account on gitlab.com.
If you'd like to receive fewer emails, you can
<a href="https://gitlab.com/-/sent_notifications/6b154a15168a965f2b40ff23d0bbb6ca/unsubscribe">unsubscribe</a>
from this thread or
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/-/issues/1245"}}</script>
</p>
</div>
</body>
</html>