Skip to content

Commit 56c26e5

Browse files
TurboGitTurboGit
committed
Merge branch '25.1-tls-security-fix' into '25.1'
(25.1) - aws-net-ssl__gnutls.adb: Properly initialize the API. See merge request eng/toolchain/aws!78
2 parents 5630673 + 0616c67 commit 56c26e5

File tree

8 files changed

+385
-0
lines changed

8 files changed

+385
-0
lines changed

‎config/ssl/aws-net-ssl__gnutls.adb‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2502,6 +2502,8 @@ package body AWS.Net.SSL is
25022502
end Write_Socket;
25032503

25042504
begin
2505+
Initialize_Default_Config;
2506+
25052507
TSSL.gnutls_global_set_mem_functions
25062508
(alloc_func => Lib_Alloc'Address,
25072509
secure_alloc_func => System.Memory.Alloc'Address,

‎regtests/0364_ssl_check_certs/cert.pem‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
Certificate:
2+
Data:
3+
Version: 1 (0x0)
4+
Serial Number: 1 (0x1)
5+
Signature Algorithm: sha256WithRSAEncryption
6+
Issuer: C=FR, ST=Ile de France, O=AWS Team, CN=localhost/[email protected]
7+
Validity
8+
Not Before: Jun 28 14:05:49 2022 GMT
9+
Not After : Jun 25 14:05:49 2032 GMT
10+
Subject: C=FR, ST=Ile de France, O=AWS Team, CN=0043_check_mem/[email protected]
11+
Subject Public Key Info:
12+
Public Key Algorithm: rsaEncryption
13+
RSA Public-Key: (2048 bit)
14+
Modulus:
15+
00:d3:97:fb:e7:70:79:e9:09:77:97:94:6a:6e:eb:
16+
11:93:74:47:47:d0:6d:8f:b3:85:6a:57:85:ad:5d:
17+
78:b3:6f:97:e4:e3:ec:fe:de:dd:9d:58:e0:c9:d0:
18+
bb:08:eb:21:fd:27:20:43:87:3f:e9:ef:0d:f6:21:
19+
c9:c3:66:bf:4f:d7:34:ef:d8:c9:07:9f:e0:d6:32:
20+
cc:e8:59:45:2c:65:57:6c:24:e3:af:7f:11:ae:0b:
21+
1c:25:82:10:a1:4f:b0:fb:f3:13:e9:e6:44:7e:0b:
22+
c3:3f:1c:11:a3:71:6d:f4:bf:ef:0d:c1:b2:75:52:
23+
6a:2e:e4:4c:5f:92:80:0d:a4:73:64:d4:cc:5d:cd:
24+
51:59:45:8d:73:36:6c:28:3f:a2:e6:7e:6f:70:48:
25+
cc:7a:0c:df:25:9a:63:b4:d8:0b:4d:d3:a9:2b:21:
26+
8e:23:5f:fa:d0:23:fd:4b:4d:5a:c3:f6:9b:55:9e:
27+
92:9d:0a:8a:28:2c:7a:d7:bb:e9:8d:77:14:74:63:
28+
a7:79:d2:07:d0:fc:37:56:b6:6d:88:0f:b0:36:c4:
29+
8b:f8:1f:87:a5:b4:92:36:07:ba:5f:2b:11:25:c7:
30+
02:28:df:f5:8d:26:49:3b:26:2a:14:a4:fa:78:e7:
31+
6e:41:70:b5:39:33:7e:4a:a3:04:4b:32:04:b5:3b:
32+
f4:fb
33+
Exponent: 65537 (0x10001)
34+
Signature Algorithm: sha256WithRSAEncryption
35+
8a:8c:93:a8:3b:00:a7:f1:c4:bd:6e:2b:e1:22:f5:34:10:77:
36+
4d:9e:85:e9:ce:eb:1d:46:1b:5d:85:c6:e2:80:bb:30:ac:66:
37+
9b:51:99:e6:ce:dc:65:3d:e4:c8:a2:c3:2c:ba:d8:bb:b9:8a:
38+
e5:d6:88:12:3b:44:07:2b:d6:6d:f1:31:53:0d:84:3e:4f:81:
39+
c3:2b:f4:60:2b:b6:2c:61:2b:91:cd:6c:61:11:a6:11:b6:2e:
40+
cd:9a:7a:f7:4c:d5:89:4f:b3:40:e4:60:cb:76:6e:77:62:fb:
41+
ff:5f:62:87:c4:3f:22:27:a8:33:49:80:32:9e:b9:08:b3:ea:
42+
f5:91:39:da:4a:b2:5e:da:2f:f5:ab:a3:52:59:17:fa:71:0b:
43+
7c:16:fc:6a:6a:ab:38:89:36:c2:49:89:01:c9:77:db:3c:97:
44+
94:02:29:30:17:43:a4:07:88:86:7e:fa:f8:59:50:18:c5:4d:
45+
ac:3e:83:a2:6b:eb:84:e2:88:1e:94:bc:96:13:e6:2b:aa:70:
46+
a3:52:10:e6:fb:2d:0c:f5:61:5f:5a:9b:9b:50:7b:af:5a:0b:
47+
43:55:e6:22:2c:36:cb:b8:91:99:51:f3:00:92:58:71:ea:b4:
48+
13:ab:c8:5e:38:96:b1:16:b2:fd:a6:3d:e0:77:33:c8:27:0c:
49+
0e:4c:c0:4f
50+
-----BEGIN CERTIFICATE-----
51+
MIIDSzCCAjMCAQEwDQYJKoZIhvcNAQELBQAwaTELMAkGA1UEBhMCRlIxFjAUBgNV
52+
BAgMDUlsZSBkZSBGcmFuY2UxETAPBgNVBAoMCEFXUyBUZWFtMRIwEAYDVQQDDAls
53+
b2NhbGhvc3QxGzAZBgkqhkiG9w0BCQEWDGF3c0BvYnJ5Lm5ldDAeFw0yMjA2Mjgx
54+
NDA1NDlaFw0zMjA2MjUxNDA1NDlaMG4xCzAJBgNVBAYTAkZSMRYwFAYDVQQIDA1J
55+
bGUgZGUgRnJhbmNlMREwDwYDVQQKDAhBV1MgVGVhbTEXMBUGA1UEAwwOMDA0M19j
56+
aGVja19tZW0xGzAZBgkqhkiG9w0BCQEWDGF3c0BvYnJ5Lm5ldDCCASIwDQYJKoZI
57+
hvcNAQEBBQADggEPADCCAQoCggEBANOX++dweekJd5eUam7rEZN0R0fQbY+zhWpX
58+
ha1deLNvl+Tj7P7e3Z1Y4MnQuwjrIf0nIEOHP+nvDfYhycNmv0/XNO/YyQef4NYy
59+
zOhZRSxlV2wk469/Ea4LHCWCEKFPsPvzE+nmRH4Lwz8cEaNxbfS/7w3BsnVSai7k
60+
TF+SgA2kc2TUzF3NUVlFjXM2bCg/ouZ+b3BIzHoM3yWaY7TYC03TqSshjiNf+tAj
61+
/UtNWsP2m1Wekp0Kiigsete76Y13FHRjp3nSB9D8N1a2bYgPsDbEi/gfh6W0kjYH
62+
ul8rESXHAijf9Y0mSTsmKhSk+njnbkFwtTkzfkqjBEsyBLU79PsCAwEAATANBgkq
63+
hkiG9w0BAQsFAAOCAQEAioyTqDsAp/HEvW4r4SL1NBB3TZ6F6c7rHUYbXYXG4oC7
64+
MKxmm1GZ5s7cZT3kyKLDLLrYu7mK5daIEjtEByvWbfExUw2EPk+Bwyv0YCu2LGEr
65+
kc1sYRGmEbYuzZp690zViU+zQORgy3Zud2L7/19ih8Q/IieoM0mAMp65CLPq9ZE5
66+
2kqyXtov9aujUlkX+nELfBb8amqrOIk2wkmJAcl32zyXlAIpMBdDpAeIhn76+FlQ
67+
GMVNrD6DomvrhOKIHpS8lhPmK6pwo1IQ5vstDPVhX1qbm1B7r1oLQ1XmIiw2y7iR
68+
mVHzAJJYceq0E6vIXjiWsRay/aY94HczyCcMDkzATw==
69+
-----END CERTIFICATE-----
70+
-----BEGIN RSA PRIVATE KEY-----
71+
MIIEpAIBAAKCAQEA05f753B56Ql3l5RqbusRk3RHR9Btj7OFaleFrV14s2+X5OPs
72+
/t7dnVjgydC7COsh/ScgQ4c/6e8N9iHJw2a/T9c079jJB5/g1jLM6FlFLGVXbCTj
73+
r38RrgscJYIQoU+w+/MT6eZEfgvDPxwRo3Ft9L/vDcGydVJqLuRMX5KADaRzZNTM
74+
Xc1RWUWNczZsKD+i5n5vcEjMegzfJZpjtNgLTdOpKyGOI1/60CP9S01aw/abVZ6S
75+
nQqKKCx617vpjXcUdGOnedIH0Pw3VrZtiA+wNsSL+B+HpbSSNge6XysRJccCKN/1
76+
jSZJOyYqFKT6eOduQXC1OTN+SqMESzIEtTv0+wIDAQABAoIBAQCGSan025xzeq+s
77+
wuO9m3CfLafjevNdxSiCMiPDwFPPRZ6YBNOvedAagYLAcrmRUnFS0hcW5Gp61F3+
78+
/LipS7dVO5b8NZB4R06RgtIrECTnpTWTi+H4ymN1GtX1NBPL3ODNNhtIUfzcJij3
79+
D6BeI6oOMBXOnETfUrvTIM8bxMWCYdjB/kTLBdn6dnY8Jfjits7HklFtYCyB9N86
80+
V75lKt247cDnahf7A+sYdNVJlWHgCcTQjwNhfCmMyou/FAt0M2hs8Rm5jK6iPLE/
81+
5ow3zVw0H/bVoNtpf/dDUtMV0wrnEieX78PdoRXvR35XMfIKiNzcTBEJnlzGlYjn
82+
C4/QecxZAoGBAP6XIfY2MSHcTFUc6Dh7vrsIYAWbcane2ax0OLv+Pqm9lniP7VT6
83+
jfPM1Wj1LsK5V22jNNQU5Y6NcLzInWwnMa8pgelEgr7DL/B9UfGTzfd4mbFPcOYG
84+
YgG3FRRu5PatVLOGfPUdgYUtZOTQbAdYLjye3CNUFoxu3+SZI05tOaiVAoGBANTD
85+
5++fMHgKPNbmzvrwqI8ASkRWdvKJK4WRKr/BOh3UiWzeIERH2QmA2sud8vJi7ALD
86+
vXgw1YkP9v39/DXEeO7L6/ydX7rmt/ZwK37TiKgY2KMxkZFXKqB6dEk0gyF3yAv2
87+
zgxysMn8GzVCcrY6fQPihhwqlKxaCKox/W+nXnNPAoGBAK9VyKb3lYjbXpqziN71
88+
olrPHspdzr8N4l3ZwQT/yYo/LrUjcnE3CbJhXIynZyfmW2b/oq95IMu3b3Akvf4x
89+
VA9th7HuZBka9hYrSNcWUyBfJ4Is0vUoajECNPtYkEmvAAmP0tlBE+VzaOwI+o1o
90+
VpebVMLj84+OAJZAPUeTA8WtAoGAB0Z/qtj1rlUjSXHxB/Gswd8PqxCN1rNMErAp
91+
Fw+DbjuzS065KbyPNlz6nlXTVeh+C4Yn93EsDBjIqFzEAA6s1/WPJz82Y8y546po
92+
Qlj3ZlAbMFFkmeSyJ3Sof0xVY5KV+5q/5vsRAoclYwfXplWPqs9XKKVoGhCmFTPK
93+
Z8QAXc8CgYBe1GTV6GEcCgv9zcZUOXQpg9iq3rgpJUUg2N1HLkJDesNq+YZjbh0v
94+
02u3CkDLiYhQi7ClxGGvVcZ3tBf0y37Mi4n/GH651HDUVhXmj0fsTf1Sh7F3OpD8
95+
3M/kr2QFBGZgq3H7rfIh/eQdH3PZdk38c2e+DzXpi8KkyY4cuAB7pg==
96+
-----END RSA PRIVATE KEY-----

‎regtests/0364_ssl_check_certs/check_cert.adb‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
------------------------------------------------------------------------------
2+
-- Ada Web Server --
3+
-- --
4+
-- Copyright (C) 2024, AdaCore --
5+
-- --
6+
-- This is free software; you can redistribute it and/or modify it --
7+
-- under terms of the GNU General Public License as published by the --
8+
-- Free Software Foundation; either version 3, or (at your option) any --
9+
-- later version. This software is distributed in the hope that it will --
10+
-- be useful, but WITHOUT ANY WARRANTY; without even the implied warranty --
11+
-- of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU --
12+
-- General Public License for more details. --
13+
-- --
14+
-- You should have received a copy of the GNU General Public License --
15+
-- distributed with this software; see file COPYING3. If not, go --
16+
-- to http://www.gnu.org/licenses for a complete copy of the license. --
17+
------------------------------------------------------------------------------
18+
19+
with Ada.Text_IO;
20+
with Ada.Exceptions;
21+
22+
with AWS.Client;
23+
with AWS.Response;
24+
with AWS.Net.SSL.Certificate;
25+
26+
procedure Check_Cert is
27+
28+
use Ada;
29+
use Ada.Exceptions;
30+
31+
function Clean_Up_Response (Content : String) return String;
32+
-- Only first line, remove traceback
33+
34+
procedure Check (URL : String);
35+
-- Check a bad URL and report error
36+
37+
---------------
38+
-- Check_Def --
39+
---------------
40+
41+
procedure Check_Def (URL : String) is
42+
use AWS;
43+
44+
Conn : Client.HTTP_Connection;
45+
Data : Response.Data;
46+
begin
47+
Text_IO.Put_Line ("CHECK: default SSL setup");
48+
49+
-- Issue a Get on a connection established with the default SSL
50+
-- setting (request to check certificates which is the default).
51+
52+
Client.Create
53+
(Connection => Conn,
54+
Host => URL);
55+
56+
Client.Get (Conn, Data);
57+
58+
Text_IO.Put_Line (" Status Code: " & Response.Status_Code (Data)'Img);
59+
Text_IO.Put_Line
60+
(" Response: "
61+
& Clean_Up_Response (Response.Message_Body (Data)));
62+
exception
63+
when E : others =>
64+
Text_IO.Put_Line (Exception_Message (E));
65+
end Check_Def;
66+
67+
---------------
68+
-- Check_Cnf --
69+
---------------
70+
71+
procedure Check_Cnf (URL : String; Check_Certificate : Boolean) is
72+
use AWS;
73+
74+
Conn : Client.HTTP_Connection;
75+
Data : Response.Data;
76+
SSL_Cfg : AWS.Net.SSL.Config;
77+
78+
begin
79+
Text_IO.Put_Line
80+
("CHECK: SSL config with Check_Certificate = "
81+
& Check_Certificate'Image);
82+
83+
AWS.Net.SSL.Initialize
84+
(Config => SSL_Cfg,
85+
Security_Mode => AWS.Net.SSL.TLS_Client,
86+
Check_Certificate => Check_Certificate,
87+
Exchange_Certificate => True);
88+
89+
-- Issue a Get on a connection established with an explicit
90+
-- request to check or ignore certificates.
91+
--
92+
-- When checking certificate we expect a S4xx response
93+
-- otherwise S200 status code is expected.
94+
95+
Client.Create
96+
(Connection => Conn,
97+
Host => URL,
98+
SSL_Config => SSL_Cfg);
99+
100+
Client.Get (Conn, Data);
101+
102+
Text_IO.Put_Line (" Status Code: " & Response.Status_Code (Data)'Img);
103+
104+
-- Don't display the actual body if we do not check certificate, this
105+
-- has no meaning as a standard Web page is returned.
106+
107+
if Check_Certificate then
108+
Text_IO.Put_Line
109+
(" Response: "
110+
& Clean_Up_Response (Response.Message_Body (Data)));
111+
end if;
112+
exception
113+
when E : others =>
114+
Text_IO.Put_Line (Exception_Message (E));
115+
end Check_Cnf;
116+
117+
-----------
118+
-- Check --
119+
-----------
120+
121+
procedure Check (URL : String) is
122+
begin
123+
-- We check three cases
124+
Text_IO.Put_Line ("-------------------------------------------------");
125+
Text_IO.Put_Line ("URL : " & URL);
126+
127+
-- Check that the default SSL configuration is properly initialized
128+
Check_Def (URL);
129+
-- Check that when using a specific configuration the check is done
130+
Check_Cnf (URL, Check_Certificate => True);
131+
-- Check that when using a specific configuration without certificate
132+
-- checking we don't fail.
133+
Check_Cnf (URL, Check_Certificate => False);
134+
Text_IO.New_Line;
135+
end Check;
136+
137+
-----------------------
138+
-- Clean_Up_Response --
139+
-----------------------
140+
141+
function Clean_Up_Response (Content : String) return String is
142+
C : String := Content;
143+
Last : Natural := C'First;
144+
begin
145+
while Last in C'Range
146+
and then C (Last) /= ASCII.CR
147+
and then C (Last) /= ASCII.LF
148+
loop
149+
if C (Last) in '0' .. '9' then
150+
C (Last) := 'x';
151+
end if;
152+
Last := Last + 1;
153+
end loop;
154+
155+
return C (C'First .. Last);
156+
end Clean_Up_Response;
157+
158+
begin
159+
Check ("https://expired.badssl.com");
160+
Check ("https://wrong.host.badssl.com");
161+
Check ("https://self-signed.badssl.com");
162+
Check ("https://untrusted-root.badssl.com");
163+
end Check_Cert;

‎regtests/0364_ssl_check_certs/check_cert.gpr‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
with "aws";
2+
project Check_Cert is
3+
for Source_Dirs use (".");
4+
for Main use ("check_cert.adb");
5+
end Check_Cert;

‎regtests/0364_ssl_check_certs/test-gnutls.out‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
-------------------------------------------------
2+
URL : https://expired.badssl.com
3+
4+
CHECK: default SSL setup
5+
Status Code: S400
6+
Response: GET request error. raised AWS.CLIENT.CONNECTION_ERROR : Error in the certificate verification.
7+
8+
CHECK: SSL config with Check_Certificate = TRUE
9+
Status Code: S400
10+
Response: GET request error. raised AWS.CLIENT.CONNECTION_ERROR : Error in the certificate verification.
11+
12+
CHECK: SSL config with Check_Certificate = FALSE
13+
Status Code: S200
14+
15+
-------------------------------------------------
16+
URL : https://wrong.host.badssl.com
17+
18+
CHECK: default SSL setup
19+
Status Code: S400
20+
Response: GET request error. raised AWS.CLIENT.CONNECTION_ERROR : Error in the certificate verification.
21+
22+
CHECK: SSL config with Check_Certificate = TRUE
23+
Status Code: S400
24+
Response: GET request error. raised AWS.CLIENT.CONNECTION_ERROR : Error in the certificate verification.
25+
26+
CHECK: SSL config with Check_Certificate = FALSE
27+
Status Code: S200
28+
29+
-------------------------------------------------
30+
URL : https://self-signed.badssl.com
31+
32+
CHECK: default SSL setup
33+
Status Code: S400
34+
Response: GET request error. raised AWS.CLIENT.CONNECTION_ERROR : Error in the certificate verification.
35+
36+
CHECK: SSL config with Check_Certificate = TRUE
37+
Status Code: S400
38+
Response: GET request error. raised AWS.CLIENT.CONNECTION_ERROR : Error in the certificate verification.
39+
40+
CHECK: SSL config with Check_Certificate = FALSE
41+
Status Code: S200
42+
43+
-------------------------------------------------
44+
URL : https://untrusted-root.badssl.com
45+
46+
CHECK: default SSL setup
47+
Status Code: S400
48+
Response: GET request error. raised AWS.CLIENT.CONNECTION_ERROR : Error in the certificate verification.
49+
50+
CHECK: SSL config with Check_Certificate = TRUE
51+
Status Code: S400
52+
Response: GET request error. raised AWS.CLIENT.CONNECTION_ERROR : Error in the certificate verification.
53+
54+
CHECK: SSL config with Check_Certificate = FALSE
55+
Status Code: S200

‎regtests/0364_ssl_check_certs/test.opt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
ssl REQUIRED
2+
gnutls OUT test-gnutls.out

‎regtests/0364_ssl_check_certs/test.out‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
-------------------------------------------------
2+
URL : https://expired.badssl.com
3+
4+
CHECK: default SSL setup
5+
Status Code: S400
6+
Response: GET request error. raised AWS.CLIENT.CONNECTION_ERROR : certificate verification error : (xx) certificate has expired
7+
8+
CHECK: SSL config with Check_Certificate = TRUE
9+
Status Code: S400
10+
Response: GET request error. raised AWS.CLIENT.CONNECTION_ERROR : certificate verification error : (xx) certificate has expired
11+
12+
CHECK: SSL config with Check_Certificate = FALSE
13+
Status Code: S200
14+
15+
-------------------------------------------------
16+
URL : https://wrong.host.badssl.com
17+
18+
CHECK: default SSL setup
19+
Status Code: S400
20+
Response: GET request error. raised AWS.CLIENT.CONNECTION_ERROR : certificate verification error : (xx) hostname mismatch
21+
22+
CHECK: SSL config with Check_Certificate = TRUE
23+
Status Code: S400
24+
Response: GET request error. raised AWS.CLIENT.CONNECTION_ERROR : certificate verification error : (xx) hostname mismatch
25+
26+
CHECK: SSL config with Check_Certificate = FALSE
27+
Status Code: S200
28+
29+
-------------------------------------------------
30+
URL : https://self-signed.badssl.com
31+
32+
CHECK: default SSL setup
33+
Status Code: S400
34+
Response: GET request error. raised AWS.CLIENT.CONNECTION_ERROR : certificate verification error : (xx) self-signed certificate
35+
36+
CHECK: SSL config with Check_Certificate = TRUE
37+
Status Code: S400
38+
Response: GET request error. raised AWS.CLIENT.CONNECTION_ERROR : certificate verification error : (xx) self-signed certificate
39+
40+
CHECK: SSL config with Check_Certificate = FALSE
41+
Status Code: S200
42+
43+
-------------------------------------------------
44+
URL : https://untrusted-root.badssl.com
45+
46+
CHECK: default SSL setup
47+
Status Code: S400
48+
Response: GET request error. raised AWS.CLIENT.CONNECTION_ERROR : certificate verification error : (xx) self-signed certificate in certificate chain
49+
50+
CHECK: SSL config with Check_Certificate = TRUE
51+
Status Code: S400
52+
Response: GET request error. raised AWS.CLIENT.CONNECTION_ERROR : certificate verification error : (xx) self-signed certificate in certificate chain
53+
54+
CHECK: SSL config with Check_Certificate = FALSE
55+
Status Code: S200

‎regtests/0364_ssl_check_certs/test.py‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
from test_support import *
2+
3+
# This test that the SSL layer is properly setup to
4+
# reject wrong host or expired certificates. This is
5+
# an important secure aspect to check.
6+
7+
build_and_run('check_cert')

0 commit comments

Comments
 (0)