Improve certificate authentication #93

Firgeis · 2021-04-07T23:02:12Z

This PR improves client certificate handling in piaf with the following:

Allows to check server certificate validity (either from a file or from a certificate string)
Allows to present a client certificate for authentication (from a certificate string and private key string)

Outstanding issues:

Requires a modifiied ocaml-ssl library: Implement verification functions savonet/ocaml-ssl#71
Testing for a non existing client certificate causes the test server to crash

anmonteiro · 2021-04-07T23:24:49Z

Whoa! I really like this. Thanks for putting in the work.

Give me some time to review it.

What are some blockers for you right now?

Firgeis · 2021-04-07T23:35:12Z

Well mostly getting the changes to ocaml-ssl in and updating the dependency

Firgeis · 2021-04-10T05:49:44Z

These commits fix the outstanding test issues

anmonteiro · 2021-04-10T06:00:58Z

Thanks, I'm gonna take a look at this soon. I pushed a commit bumping the Nix package sources to a commit that includes your openssl PR.

Let's see what CI says.

anmonteiro

This looks great!

I left a couple comments that are mostly nits, some questions, and a couple code suggestions. Let me know what you think.

bin/carl.ml

lib/cert.ml

lib/openssl.ml

lib_test/helper_server.ml

lib_test/test_client.ml

Co-authored-by: Antonio Nuno Monteiro <anmonteiro@gmail.com>

anmonteiro

Alright, 2nd round! Everything looks great, there's only the change in bin/carl.ml that I'd rather revert.

bin/carl.ml

lib/cert.ml

Firgeis · 2021-04-11T20:05:20Z

I have added the possibility of passing the cert/key pair as files, and added to carl an implementation resembling curl of client certificates

anmonteiro · 2021-04-11T21:59:14Z

Thank you!

anmonteiro · 2021-04-13T21:06:26Z

lib_test/helper_server.ml

    let cert = "./certificates/server.pem" in
    let priv_key = "./certificates/server.key" in
    Lwt_io.establish_server_with_client_socket
      listen_address
      (fun client_addr fd ->
        let server_ctx = Ssl.create_context Ssl.TLSv1_3 Ssl.Server_context in
        Ssl.disable_protocols server_ctx [ Ssl.SSLv23; Ssl.TLSv1_1 ];
+        Ssl.load_verify_locations server_ctx ca "";


@Firgeis why did you add this here? Trying to run the tests locally, it seems like openssl is not happy with it.

That loads the ca certificate so it can verify the client cert properly. What error are you getting?

It was my bad. dune runtest works but dune exec lib_test/test_client.exe couldn't find the certificates.

I'm exploring how to make both work with dune-sites

Probably related to the relative paths

I fixed the paths and now I'm getting an infinite loop running the client certs test. Similar to what I see in #94 (CI just hangs)

Retrieving the client certs here also uses relative paths
https://github.com/Firgeis/piaf/blob/fd5e07ceea0ef9d072abc1b39d39229c1300b85f/lib_test/test_client.ml#L225
We should probably add a try block there

That's not the issue. The problem is that the server never returns if it can't verify the peer. So the try / catch around the client request is useless because the server never really returns a response.

Strange, because when I run the following test:

piaf/lib_test/test_client.ml

Line 278 in 6e1b433

(* No client certificate provided *)

(which covers that case when the client doesn't send the client cert and the server verifies it) is passing, at least when running dune test

My suggestion was a try block around the reading of the certs not the client request, sorry if I was unclear

@Firgeis

CHANGES: - Improve certificate checking and authentication ([anmonteiro/piaf#93](anmonteiro/piaf#93)) - [@Firgeis](https://github.com/Firgeis) - Check certificate SAN IP address when appropriate ([anmonteiro/piaf#96](anmonteiro/piaf#96)) - [@Firgeis](https://github.com/Firgeis) - Close the file descriptor when failing to open a connection ([anmonteiro/piaf#97](anmonteiro/piaf#97)) - [@EduardoRFS](https://github.com/EduardoRFS) - Yield to other threads when reading a message body. This improves fairness for large message bodies ([anmonteiro/piaf#100](anmonteiro/piaf#100)) - Add error handling to `Response.of_file` ([anmonteiro/piaf#103](anmonteiro/piaf#103)) - Add `Client.send` which sends a `Request.t` ([anmonteiro/piaf#110](anmonteiro/piaf#110)) - openssl: set the client verify callback ([anmonteiro/piaf#112](anmonteiro/piaf#112)) - Piaf.Response: add `or_internal_error` ([anmonteiro/piaf#120](anmonteiro/piaf#120)) - Piaf.Response: Add `Body.sendfile` and `Response.sendfile` ([anmonteiro/piaf#124](anmonteiro/piaf#124)) - Piaf.Config: Add `config.flush_headers_immediately` ([anmonteiro/piaf#125](anmonteiro/piaf#125)) - Piaf.Server: Add `config.shutdown_timeout` to wait before shutting down the Piaf server ([anmonteiro/piaf#174](anmonteiro/piaf#174)) - Websocket support ([anmonteiro/piaf#139](anmonteiro/piaf#139)) - Multicore support ([anmonteiro/piaf#151](anmonteiro/piaf#151)) - Allow binding to UNIX domain socket ([anmonteiro/piaf#161](anmonteiro/piaf#161)) - Don't send invalid HTTP/2 headers ([anmonteiro/piaf#197](anmonteiro/piaf#197))

Docker and others added 13 commits March 29, 2021 22:44

Add devcontainer to gitignore

f686024

Initial

ca61329

Partial implementation client

00d7ad5

Implement connect

089ffdf

Update interface signature

1975536

Add cert to interface

5592787

Add cert to interface file

4d3b4cb

Add pp for cert type

92e8c6e

Updarte carl

bbbd5d6

New certificates for testing

7440fec

Remove unused function

595ef62

Better doc

14114e9

Add tests

40597ac

Firgeis changed the title ~~Improve certificate authetication~~ Improve certificate authentication Apr 7, 2021

Docker and others added 2 commits April 10, 2021 05:03

Better test certificates

bc9ec9d

Fix client cert tests

7054f79

Update nix sources to have the experimental ocaml-ssl version

4f08aa9

Firgeis marked this pull request as ready for review April 10, 2021 06:13

anmonteiro reviewed Apr 10, 2021

View reviewed changes

Firgeis and others added 6 commits April 10, 2021 15:06

Apply suggestions from code review

59de73e

Co-authored-by: Antonio Nuno Monteiro <anmonteiro@gmail.com>

Remove unused variable

e85a346

Change to named arguments

75b10d0

Change application

74a0208

Fix carl arguments

a9a1eaf

Refactor cert to option

57cee74

Firgeis requested a review from anmonteiro April 10, 2021 20:03

anmonteiro reviewed Apr 11, 2021

View reviewed changes

bin/carl.ml Outdated Show resolved Hide resolved

lib/cert.ml Show resolved Hide resolved

Firgeis added 3 commits April 11, 2021 18:53

Refactor cacert

e16fd3e

Support passing client cert and key as file

c249f97

Add test

fd5e07c

Firgeis requested a review from anmonteiro April 11, 2021 20:05

anmonteiro merged commit 6e1b433 into anmonteiro:master Apr 11, 2021

anmonteiro reviewed Apr 13, 2021

View reviewed changes

anmonteiro added a commit that referenced this pull request May 28, 2021

add changelog for #93, #96 and #97

cbf69d7

anmonteiro mentioned this pull request Sep 6, 2024

[new release] piaf (0.2.0) ocaml/opam-repository#26505

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Improve certificate authentication #93

Improve certificate authentication #93

Firgeis commented Apr 7, 2021

anmonteiro commented Apr 7, 2021

Firgeis commented Apr 7, 2021

Firgeis commented Apr 10, 2021 •

edited

Loading

anmonteiro commented Apr 10, 2021

anmonteiro left a comment

anmonteiro left a comment

Firgeis commented Apr 11, 2021

anmonteiro commented Apr 11, 2021

anmonteiro Apr 13, 2021

Firgeis Apr 13, 2021

anmonteiro Apr 13, 2021

Firgeis Apr 13, 2021

anmonteiro Apr 13, 2021

Firgeis Apr 13, 2021 •

edited

Loading

anmonteiro Apr 13, 2021

Firgeis Apr 13, 2021 •

edited

Loading

Firgeis Apr 13, 2021

Improve certificate authentication #93

Improve certificate authentication #93

Conversation

Firgeis commented Apr 7, 2021

anmonteiro commented Apr 7, 2021

Firgeis commented Apr 7, 2021

Firgeis commented Apr 10, 2021 • edited Loading

anmonteiro commented Apr 10, 2021

anmonteiro left a comment

Choose a reason for hiding this comment

anmonteiro left a comment

Choose a reason for hiding this comment

Firgeis commented Apr 11, 2021

anmonteiro commented Apr 11, 2021

anmonteiro Apr 13, 2021

Choose a reason for hiding this comment

Firgeis Apr 13, 2021

Choose a reason for hiding this comment

anmonteiro Apr 13, 2021

Choose a reason for hiding this comment

Firgeis Apr 13, 2021

Choose a reason for hiding this comment

anmonteiro Apr 13, 2021

Choose a reason for hiding this comment

Firgeis Apr 13, 2021 • edited Loading

Choose a reason for hiding this comment

anmonteiro Apr 13, 2021

Choose a reason for hiding this comment

Firgeis Apr 13, 2021 • edited Loading

Choose a reason for hiding this comment

Firgeis Apr 13, 2021

Choose a reason for hiding this comment

Firgeis commented Apr 10, 2021 •

edited

Loading

Firgeis Apr 13, 2021 •

edited

Loading

Firgeis Apr 13, 2021 •

edited

Loading