<div dir="ltr">I did more testing and found the reason why it accepts any client certification.<div>The error is due to the self signed certificate cannot be found in the list of trusted certificates.</div><div>Without the user defined verify callback function, it works as expected.</div><div><br><table class="gmail-memberdecls" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:19px;font-family:Roboto,sans-serif;border-spacing:0px;padding:0px;color:rgb(0,0,0)"><tbody><tr class="gmail-memitem:aa4f5a3309eae833f85dff37c36fa039d"><td class="gmail-memItemLeft" align="right" valign="top" style="background-color:rgb(249,250,252);border:none;margin:4px;padding:1px 0px 0px 8px;white-space:nowrap">#define </td><td class="gmail-memItemRight" valign="bottom" style="background-color:rgb(249,250,252);border:none;margin:4px;padding:1px 0px 0px 8px;width:1338px"><a class="el" href="https://docs.huihoo.com/doxygen/openssl/1.0.1c/crypto_2x509_2x509__vfy_8h.html#aa4f5a3309eae833f85dff37c36fa039d" style="color:rgb(70,101,162);font-weight:bold">X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT</a> 18</td></tr></tbody></table><div><br></div><div><div style="color:rgb(212,212,212);background-color:rgb(30,30,30);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;line-height:18px;white-space:pre"><div><span style="color:rgb(106,153,85)"> // Check if certificate is OK</span></div><div> <span style="color:rgb(86,156,214)">int</span> error = <span style="color:rgb(220,220,170)">X509_STORE_CTX_get_error</span>(cts);</div><div> <span style="color:rgb(197,134,192)">if</span> (error != X509_V_OK)</div><div> {</div><div> <span style="color:rgb(197,134,192)">return</span> <span style="color:rgb(86,156,214)">true</span>;</div><div> }</div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Apr 30, 2020 at 12:09 PM Zhenfei Tai <<a href="mailto:ztai@google.com">ztai@google.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Also, with that change in http_connection.h, it still accepts any client certificate provided in curl.<div><br></div><div>Here's what I did:</div><div>1. Disable BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION</div><div>2. Uncommented ssl_key_handler.hpp:315 and added the boost::asio::ssl::verify_fail_if_no_peer_cert</div><div><br></div><div>Behavior after change:</div><div>1. Rejects curl without client certificate.</div><div>2. Returns when client certificate matches the one authority directory.</div><div>3. Rejects when client sends other certificates. </div><div><br></div><div>The change is just for testing purposes, I guess the original intention was not to mTLS every request.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Apr 30, 2020 at 11:34 AM Zhenfei Tai <<a href="mailto:ztai@google.com" target="_blank">ztai@google.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi P.K.<div><br></div><div>I tried the same thing. </div><div><br></div><div>Could you share which url you tested?</div><div>With that change, if I access the https://${bmc}/redfish/v1 url in chrome, it prompts to choose a client certificate, but will also work if no certificate is chosen.</div><div><br>Thanks,</div><div>Zhenfei</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Apr 30, 2020 at 6:27 AM P. K. Lee (李柏寬) <<a href="mailto:P.K.Lee@quantatw.com" target="_blank">P.K.Lee@quantatw.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I found a way to fix this issue, but it needs to be modified to the source code. In two steps:<br>
<br>
Step 1.<br>
The source code "adaptor.set_verify_mode(boost::asio::ssl::verify_peer);" in http_connection.h is replaced with <br>
"adaptor.set_verify_mode(boost::asio::ssl::verify_peer | boost::asio::ssl::verify_fail_if_no_peer_cert);"<br>
<br>
Step 2.<br>
AccountService->Oem->OpenBMC->AuthMethods->TLS is set. (false by default)<br>
<br>
It will enable enforce mTLS authentication.<br>
<br>
Best,<br>
P.K.<br>
<br>
> -----Original Message-----<br>
> From: Wiktor Gołgowski <<a href="mailto:wiktor.golgowski@linux.intel.com" target="_blank">wiktor.golgowski@linux.intel.com</a>><br>
> Sent: Saturday, April 25, 2020 1:03 AM<br>
> To: Richard Hanley <<a href="mailto:rhanley@google.com" target="_blank">rhanley@google.com</a>>; Zhenfei Tai <<a href="mailto:ztai@google.com" target="_blank">ztai@google.com</a>><br>
> Cc: <a href="mailto:openbmc@lists.ozlabs.org" target="_blank">openbmc@lists.ozlabs.org</a>; P. K. Lee (李柏寬) <<a href="mailto:P.K.Lee@quantatw.com" target="_blank">P.K.Lee@quantatw.com</a>>;<br>
> <a href="mailto:jrey@linux.ibm.com" target="_blank">jrey@linux.ibm.com</a>; P. K. Lee (李柏寬) <<a href="mailto:P.K.Lee@quantatw.com" target="_blank">P.K.Lee@quantatw.com</a>>; Joseph<br>
> Reynolds <<a href="mailto:jrey@linux.ibm.com" target="_blank">jrey@linux.ibm.com</a>><br>
> Subject: Re: mTLS on bmcweb<br>
> <br>
> <br>
> <br>
> On 4/23/20 7:35 PM, Richard Hanley wrote:<br>
> > My guess is that somehow the root cert used to validate clients isn't installed<br>
> correctly, and so it's defaulting to basic auth.<br>
> ><br>
> > At least that's my reading of this review<br>
> > <a href="https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/27270" rel="noreferrer" target="_blank">https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/27270</a><br>
> ><br>
> <br>
> I think this would be the case. If the client certificate is not provided, TLS<br>
> connection is still established, just without authenticating the client. This<br>
> allows upper layer to provide other authentication methods (e.g. Basic Auth).<br>
> ><br>
> > On Thu, Apr 23, 2020 at 9:47 AM Zhenfei Tai <<a href="mailto:ztai@google.com" target="_blank">ztai@google.com</a><br>
> <mailto:<a href="mailto:ztai@google.com" target="_blank">ztai@google.com</a>>> wrote:<br>
> ><br>
> > I guess part of my question is how to configure the mTLS certs to make<br>
> it work properly.<br>
> ><br>
> > So far only https works (server side TLS).<br>
> ><br>
> > Thanks,<br>
> > Zhenfei<br>
> ><br>
> > On Thu, Apr 23, 2020 at 8:50 AM Joseph Reynolds <<a href="mailto:jrey@linux.ibm.com" target="_blank">jrey@linux.ibm.com</a><br>
> <mailto:<a href="mailto:jrey@linux.ibm.com" target="_blank">jrey@linux.ibm.com</a>>> wrote:<br>
> ><br>
> > On 4/23/20 5:47 AM, P. K. Lee (李柏寬) wrote:<br>
> > > Hi,<br>
> > ><br>
> > > I encountered the same issue when using Redfish to replace the<br>
> certificate.<br>
> > > Regardless of whether the parameters include --cert --key<br>
> --cacert or only --cacert, the authentication can still succeed.<br>
> > ><br>
> > > Best,<br>
> > > P.K.<br>
> > ><br>
> > >> Date: Wed, 22 Apr 2020 14:58:06 -0700<br>
> > >> From: Zhenfei Tai <<a href="mailto:ztai@google.com" target="_blank">ztai@google.com</a><br>
> <mailto:<a href="mailto:ztai@google.com" target="_blank">ztai@google.com</a>>><br>
> > >> To: <a href="mailto:openbmc@lists.ozlabs.org" target="_blank">openbmc@lists.ozlabs.org</a><br>
> <mailto:<a href="mailto:openbmc@lists.ozlabs.org" target="_blank">openbmc@lists.ozlabs.org</a>><br>
> > >> Subject: mTLS on bmcweb<br>
> > >> Message-ID:<br>
> ><br>
> >> <CAMXw96Pp511sUO=q1XLz2uJzh4S6D7tUwmkvpbnq_yU-iJfiKg@<br>
> mail.g<br>
> > >> <a href="http://mail.com" rel="noreferrer" target="_blank">mail.com</a> <<a href="http://mail.com" rel="noreferrer" target="_blank">http://mail.com</a>>><br>
> > >> Content-Type: text/plain; charset="utf-8"<br>
> > >><br>
> > >> Hi,<br>
> > >><br>
> > >> I'm trying out bmcweb mTLS which should be enabled by<br>
> default by<br>
> > >><br>
> <a href="https://github.com/openbmc/bmcweb/blob/master/CMakeLists.txt#L89" rel="noreferrer" target="_blank">https://github.com/openbmc/bmcweb/blob/master/CMakeLists.txt#L89</a><br>
> > >><br>
> > >> In my test, I created a self signed key and certificate pair,<br>
> stacked them<br>
> > >> up into server.pem in /etc/ssl/certs/https that bmcweb uses.<br>
> > >><br>
> > >> However when I tried to curl bmcweb service, I was able to get<br>
> response by<br>
> > >> only supplying the cert.<br>
> > >><br>
> > >> curl --cacert cert.pem https://${bmc}/redfish/v1<br>
> > >><br>
> > >> With the mTLS enabled, I expected it should error out since no<br>
> client<br>
> > >> certificate is provided.<br>
> > >><br>
> <br>
> As mentioned, if you did not provide a client certificate, connection was<br>
> established to allow for Basic Auth. And as the Service Root requires no<br>
> authentication, you got a response.<br>
> <br>
> - Wiktor<br>
> <br>
> > >> Could someone with relevant knowledge help with my<br>
> question?<br>
> ><br>
> > I'm not sure what you are asking. Are you asking how to install<br>
> mTLS<br>
> > certs into the BMC and then use them to connect? I am still<br>
> waiting for<br>
> > documentation that describes how to configure and use the mTLS<br>
> feature.<br>
> ><br>
> > I've added an entry to the security working group as a reminder to<br>
> do<br>
> > this. (I don't have the skill to document this feature.)<br>
> ><br>
> > - Joseph<br>
> ><br>
> > >><br>
> > >> Thanks,<br>
> > >> Zhenfei<br>
> ><br>
</blockquote></div>
</blockquote></div>
</blockquote></div>