614975 - irc.mozilla.org requests client certificate when connecting by SSL

Status: RESOLVED WONTFIX

(mozilla.org Graveyard :: Server Operations, task)

Description

[Brant Gurganus]

When an irc.mozilla.org connection is made over SSL, it requests optionally a client certificate. However, I have not seen any use of a client certificate and my understanding has been not to send a client certificate if the server doesn't need it for anything.

irc.oftc.net will use a client SSL for NickServ authentication, but I don't see that use on irc.mozilla.org. irc.freenode.net also supports SSL, but it's not asking for a client certificate.

So I'd either like it to be clearer what client certificates are used for, or turn off that capability if client certificates aren't used for anything.

Comment 1

[Brant Gurganus]

It does not do this every connection. It did it for the current connection which is to sand.mozilla.org according to the message of the day.

Comment 2

[Brant Gurganus]

I think that's inaccurate. I think it was that Firefox was caching my allowance or disallowance to send the certificate.

Comment 3

[Shyam Mani [:fox2mike]]

Can you get a screenshot or a screencast? I'm not exactly sure what the issue is here. Thanks!

Comment 4

[Shyam Mani [:fox2mike]]

Reopen with more information. Thanks!

Comment 5

[Brant Gurganus]

Sorry about not replying sooner. Apparently Bugzilla didn't notify me of your comments. Maybe my e-mail preferences have been messed up in the Bugzilla upgrades since I set them.

Comment 6

[Brant Gurganus]

Attachment: screenshot attached as requested

This is the request that Firefox shows on behalf of Chatzilla due to the server requesting a client certificate.

I did some research into the IRC daemon used, and it appears it can authenticate administrators/ops with client SSL certificates, but with you not knowing what I was talking about, I imagine that functionality is not being used. So it might just be a matter of changing that setting.

Comment 7

[Shyam Mani [:fox2mike]]

Hi Brant,

So I use a different IRC client...and wasn't sure about Chatzilla, so I installed chatzilla and used the /sslserver command to connect (http://chatzilla.hacksrus.com/faq/#connect) and didn't see any issues (like the one you've mentioned).

How are you trying to connect?

Comment 8

[Shyam Mani [:fox2mike]]

Or to rephrase, can you give me steps to reproduce this issue with Chatzilla?

Comment 9

[Shyam Mani [:fox2mike]]

Reopen when you have an STR.

Comment 10

[Brant Gurganus]

Did you make a client side certificate? It's obviously not going to prompt you to send one if there isn't one to send.

Mine was created to authenticate with the OFTC SSL server. The instructions are at http://www.oftc.net/oftc/NickServ/CertFP. Those are the same instructions I used. The steps for converting the certificate to import into Firefox are in fact ones I came up with since they didn't have Chatzilla instructions previously and Firefox apparently doesn't import the original format of the certificate.

Comment 11

[Shyam Mani [:fox2mike]]

(In reply to comment #6)

> I did some research into the IRC daemon used, and it appears it can
> authenticate administrators/ops with client SSL certificates, but with you not
> knowing what I was talking about, I imagine that functionality is not being
> used. So it might just be a matter of changing that setting.

There doesn't seem to be a way to turn off the setting. FWIW, it's not being used in our configs as far as I can see. 

This was confirmed by another admin who took a look at Unreal code :

23:53:22 < atoll> #ifdef AUTHENABLE_SSL_CLIENTCERT
23:53:28 < atoll> in Unreal auth.c
23:54:19 < atoll> at one point, if that's enabled, it calls
23:54:20 < atoll>                         x509_clientcert = SSL_get_peer_certificate((SSL *)cptr->ssl);
23:54:40 < atoll> which leads me to a man page saying
23:54:41 < atoll> > A client will only send a certificate when explicitly requested to do so by the server (see SSL_CTX_set_verify(3)).
23:54:51 < atoll> which leads to
23:54:51 < atoll> > ./src/ssl.c:ISSL_CTX_set_verify(ctx_server, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE
23:55:06 < atoll> and that turns out to ALWAYS BE ON ha

This basically means that we have no way of safely turning this off unless we modify unreal source and rebuild the IRCd, which at this point I'm not inclined to do. You're welcome to take this up with Unreal IRCd upstream and see if they'll be happy to patch it. None of us here know enough about SSL to mess with the code to disable this and be assured that we haven't broken any other parts of the IRCd's SSL capabilities, hence I'm going to WONTFIX this.

Comment 12

[:Atoll]

I dug into this a few minutes ago to learn how SSL client certificates are requested in the first place.  It looks like you have to request them at the start of the SSL session itself, and so it's not something that can simply be done at any time during the conversation.  In OpenSSL I guess this falls to the SSL_CTX_set_verify(3) function to handle, during SSL session create.

Most of the code in Unreal, related to client certificate authentication at least, is wrapped in #ifdef's that only enable it when we leave that enabled in config.h.  In this case, however, the above SSL_CTX_set_verify that is at the root of your bugzilla issue cannot be disabled except by patching src/ssl.c in the Unreal distribution.

There is no #define or config flag that would be of use in resolving the issue you've reported.  I am not comfortable enough with this codebase to simply comment out the line of code and ask the other admins to trust that the IRC daemon is still safe and secure.

You may want to file a bug about this for the Unreal developers at http://bugs.unrealircd.org/signup_page.php -- I don't think they intended SSL client certificate verification *always*be enabled, even when we don't care about client auth.  And so they might simply fix it with an #ifdef.  Or they might implement something more complex.  They have accepted patches from us in the past, so even a two-line patch that simply wraps the ctx_verify call in #ifdef AUTHENABLE_SSL_CLIENTCERT would probably be sufficient to open an issue with.

For now, we will remain with the current IRC server, even though it has the client certificate request flaw you described here.  If Unreal does approve and/or release a patch for this issue, please do file a new bug with us to see how we can merge it into the Mozilla IRC daemon.  I'm sorry this didn't work out to making the client certificate dialog go away, but it's a whole lot of interesting stuff all the same.

Comment 13

[Reed Loden [:reed]]

I filed this upstream as http://bugs.unrealircd.org/view.php?id=3983.

Comment 14

[Brant Gurganus]

Cool, thanks for looking into it more in depth.

As far as settings, this one seems relevant:

http://www.unrealircd.com/files/docs/unreal32docs.html#operblock_password_sslclientcert

But it may not be getting reflected into the iConf.ssl_options field as one might expect.

Comment 15

[:Atoll]

I think that the server will ask for a client certificate, no matter what the contents of iConf.ssl_options.  The source code says, approximately:

SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE | (iConf.ssl_options ? FAIL_IF_NO_PEER_CERT : 0)

No matter what is contained within iConf.ssl_options, the bitwise OR functions ensure that SSL_VERIFY_PEER is *always* set, and depending on ssl_options an additional "reject no-certificate ssl clients" flag is set as well.  There's no value of ssl_options that would unset the SSL_VERIFY_PEER bit.