Hi list,
Please Cc: me when replying.
I've coded the following function (in Postfix FWIW). Nothing tricky:
% char *tls_serial_number(X509 *peer)
% {
% ASN1_INTEGER *sn;
% BIGNUM bn;
% char *bnstr, *snstr;
% size_t len;
%
% if ((sn = X509_get_serialNumber(peer)) == 0)
% return (0);
% ASN1_INTEGER_to_BN(sn, &bn);
% if ((bnstr = BN_bn2hex(&bn)) == NULL)
% msg_fatal("insufficient memory for bignum stringification: %m");
% snstr = mystrdup(bnstr);
% OPENSSL_free(bnstr);
% return (snstr);
% }
Unfortunately, ASN1_INTEGER_to_BN() happens to trigger a SEGFAULT.
Here is the trace from gdb(1):
% (gdb) bt
% #0 0x281cf1c8 in BN_new () from /lib/libcrypto.so.4
% #1 0x281cf2c5 in bn_expand2 () from /lib/libcrypto.so.4
% #2 0x281cf6cb in BN_bin2bn () from /lib/libcrypto.so.4
% #3 0x281c93c9 in ASN1_INTEGER_to_BN () from /lib/libcrypto.so.4
% #4 0x0805e106 in tls_serial_number (peer=0x80b1700) at tls_verify.c:332
% #5 0x0805cf55 in tls_server_start (props=0xbfbfe280) at tls_server.c:682
% #6 0x080501be in smtpd_start_tls (state=0xbfbfe320) at smtpd.c:3569
% #7 0x0805038b in starttls_cmd (state=0xbfbfe320, argc=1,
% unused_argv=0x809fe48) at smtpd.c:3699
% #8 0x08050a81 in smtpd_proto (state=0xbfbfe320) at smtpd.c:4022
% #9 0x08050ecd in smtpd_service (stream=0x80b2608, service=0xbfbfef2d "smtp",
% argv=0xbfbfe280) at smtpd.c:4149
% #10 0x0805ae2a in single_server_wakeup (fd=134933256) at single_server.c:257
% #11 0x08074c96 in event_loop (delay=-1077942944) at events.c:1080
% #12 0x0805b62c in single_server_main (argc=8, argv=0xbfbfee74,
% service=0x8050de8 <smtpd_service>) at single_server.c:722
% #13 0x080515d1 in main (argc=8, argv=0xbfbfee74) at smtpd.c:4585
% (gdb) frame 4
% #4 0x0805e106 in tls_serial_number (peer=0x80b1700) at tls_verify.c:332
% 332 ASN1_INTEGER_to_BN(sn, &bn);
% (gdb) print *peer
% $1 = {cert_info = 0x80af080, sig_alg = 0x80b0590, signature = 0x80b05a0,
% valid = 1, references = 2,
% name = 0x80d4400 "/C=FR/O=TEST/OU=Clients/CN=diogene.jeremie.int",
% ex_data = {sk = 0x0, dummy = 0}, ex_pathlen = -1, ex_flags = 263,
% ex_kusage = 128, ex_xkusage = 2, ex_nscert = 0, skid = 0x80d5030,
% akid = 0x80d5080, sha1_hash = "\016ûd2v;\177QØ61Ä\005I^\0252hMJ", aux = 0x0}
% (gdb) print *peer->cert_info
% $2 = {version = 0x80b05b0, serialNumber = 0x80b04b0, signature = 0x80b04c0,
% issuer = 0x80b04d0, validity = 0x80b0500, subject = 0x80b0530,
% key = 0x80b0560, issuerUID = 0x0, subjectUID = 0x0, extensions = 0x80d2320}
% (gdb) print sn
% $2 = (ASN1_INTEGER *) 0xbfbfe280
% (gdb) print *sn
% $1 = {length = 134834432, type = 134948360,
% data = 0x2 <Error reading address 0x2: Bad address>, flags = 300}
What's wrong with my code? The certificate used by the TLS client is
not special in any way:
% Certificate:
% Data:
% Version: 3 (0x2)
% Serial Number:
% d3:f9:b3:9a:02:3a:72:10
% Signature Algorithm: sha1WithRSAEncryption
% Issuer: C=FR, O=TEST, OU=JEREMIE, CN=Autorite de certification racine
Test
% Validity
% Not Before: Jul 25 19:00:13 2007 GMT
% Not After : Jul 24 19:00:13 2008 GMT
% Subject: C=FR, O=TEST, OU=Clients, CN=diogene.jeremie.int
% Subject Public Key Info:
% Public Key Algorithm: rsaEncryption
% RSA Public Key: (2048 bit)
% Modulus (2048 bit):
% ...
% X509v3 extensions:
% X509v3 Subject Key Identifier:
% 2A:E9:A1:01:9A:74:4F:EE:23:10:A9:9C:97:C3:B7:77:55:E0:B4:45
% X509v3 Authority Key Identifier:
%
keyid:FE:CF:61:36:EF:9B:78:5C:BE:72:B2:58:AA:8D:B3:F9:67:80:98:7C
% DirName:/C=FR/O=TEST/OU=JEREMIE/CN=Autorite de certification
racine Test
% serial:A6:A6:76:4D:F0:1F:36:7D
%
% X509v3 Basic Constraints: critical
% CA:FALSE
% X509v3 Key Usage:
% Digital Signature
% X509v3 Extended Key Usage:
% TLS Web Client Authentication
% X509v3 Subject Alternative Name:
% DNS:diogene.jeremie.int, email:[EMAIL PROTECTED]
% Signature Algorithm: sha1WithRSAEncryption
% ...
Thank you for your help.
Best regards,
--
Jeremie Le Hen
< jeremie at le-hen dot org >< ttz at chchile dot org >
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
