Log information about the certificate chain at higher debug levels, when making OCSP...

diff --git a/src/lib/tls/base-h b/src/lib/tls/base-h
index 9fb7a9c9297020ca5642e1e28cea09b8a22306ea..d1d6fd933dd493706c625e04c8f955ebdeb438fc 100644 (file)
--- a/src/lib/tls/base-h
+++ b/src/lib/tls/base-h
@@ -448,6 +448,10 @@ int                tls_log_error(REQUEST *request, char const *msg, ...) CC_HINT(format (print
 int            tls_log_io_error(REQUEST *request, tls_session_t *session, int ret, char const *msg, ...)
                                 CC_HINT(format (printf, 4, 5));
 
+#define                tls_log_certificate_chain(_request, _chain, _cert) \
+               _tls_log_certificate_chain( __FILE__, __LINE__, _request, _chain, _cert)
+void           _tls_log_certificate_chain(char const *file, int line,
+                                          REQUEST *request, STACK_OF(X509) *chain, X509 *cert);
 /*
  *     tls/ocsp.c
  */

diff --git a/src/lib/tls/ctx.c b/src/lib/tls/ctx.c
index 1a159675b10117bea1e2aeca58950e883e0868b2..59b237afd081b042aec8714c911aa9cde134463d 100644 (file)
--- a/src/lib/tls/ctx.c
+++ b/src/lib/tls/ctx.c
@@ -257,16 +257,6 @@ static int tls_ctx_load_cert_chain(SSL_CTX *ctx, fr_tls_chain_conf_t const *chai
        return 0;
 }
 
-static void _tls_ctx_print_cert_line(int index, X509 *cert)
-{
-       char            subject[1024];
-
-       X509_NAME_oneline(X509_get_subject_name(cert), subject, sizeof(subject));
-       subject[sizeof(subject) - 1] = '\0';
-
-       DEBUG3("[%i] %s %s", index, tls_utils_x509_pkey_type(cert), subject);
-}
-
 /** Create SSL context
  *
  * - Load the trusted CAs
@@ -530,7 +520,6 @@ SSL_CTX *tls_ctx_alloc(fr_tls_conf_t const *conf, bool client)
                             ret = SSL_CTX_set_current_cert(ctx, SSL_CERT_SET_NEXT)) {
                                STACK_OF(X509)  *our_chain;
                                X509            *our_cert;
-                               int             i;
 
                                our_cert = SSL_CTX_get0_certificate(ctx);
 
@@ -545,10 +534,7 @@ SSL_CTX *tls_ctx_alloc(fr_tls_conf_t const *conf, bool client)
                                        goto error;
                                }
 
-                               for (i = sk_X509_num(our_chain); i > 0 ; i--) {
-                                       _tls_ctx_print_cert_line(i, sk_X509_value(our_chain, i - 1));
-                               }
-                               _tls_ctx_print_cert_line(i, our_cert);
+                               if (DEBUG_ENABLED3) tls_log_certificate_chain(NULL, our_chain, our_cert);
                        }
                        (void)SSL_CTX_set_current_cert(ctx, SSL_CERT_SET_FIRST);        /* Reset */
                }

diff --git a/src/lib/tls/log.c b/src/lib/tls/log.c
index 2787495bc5f08a70265bbbd1b84aa62f2e106a1a..0046a2c3b3bd0e68a973d208024c88c5aecf2ba7 100644 (file)
--- a/src/lib/tls/log.c
+++ b/src/lib/tls/log.c
@@ -237,6 +237,43 @@ int tls_strerror_printf(char const *msg, ...)
        return ret;
 }
 
+static void _tls_ctx_print_cert_line(char const *file, int line,
+                                    REQUEST *request, int index, X509 *cert)
+{
+       char            subject[1024];
+
+       X509_NAME_oneline(X509_get_subject_name(cert), subject, sizeof(subject));
+       subject[sizeof(subject) - 1] = '\0';
+
+       if (request) {
+               log_request(L_DBG, fr_debug_lvl, request, file, line,
+                           "[%i] %s %s", index, tls_utils_x509_pkey_type(cert), subject);
+       } else {
+               fr_log(LOG_DST, fr_debug_lvl, file, line,
+                      "[%i] %s %s", index, tls_utils_x509_pkey_type(cert), subject);
+       }
+}
+
+/** Print out the current stack of certs
+ *
+ * @param[in] file     File where this function is being called.
+ * @param[in] line     Line where this function is being called.
+ * @param[in] request  Current request, may be NULL.
+ * @param[in] chain    The certificate chain.
+ * @param[in] cert     The leaf certificate.
+ */
+void _tls_log_certificate_chain(char const *file, int line,
+                               REQUEST *request, STACK_OF(X509) *chain, X509 *cert)
+{
+       int i;
+
+       for (i = sk_X509_num(chain); i > 0 ; i--) {
+               _tls_ctx_print_cert_line(file, line, request, i, sk_X509_value(chain, i - 1));
+       }
+       _tls_ctx_print_cert_line(file, line, request, i, cert);
+}
+
+
 /** Print errors raised by OpenSSL I/O functions
  *
  * Drains the thread local OpenSSL error queue, and prints out errors

diff --git a/src/lib/tls/ocsp.c b/src/lib/tls/ocsp.c
index 3b965e5322b1b567d34df1136e866c5142fe99bc..06b8529dfc18227d1440d9a87db9759600d2a20e 100644 (file)
--- a/src/lib/tls/ocsp.c
+++ b/src/lib/tls/ocsp.c
@@ -220,11 +220,61 @@ int tls_ocsp_staple_cb(SSL *ssl, void *data)
                goto error;
        }
 
-       if ((X509_STORE_CTX_get1_issuer(&issuer_cert, server_store_ctx, cert) != 1) || !issuer_cert) {
-               tls_log_error(request, "Can't get server certificate's issuer");
+       /*
+        *      Print out the current chain in the certificate store
+        *      to help with debugging issues where we can't find the
+        *      server cert.
+        */
+       if (RDEBUG_ENABLED3) {
+               STACK_OF(X509)  *chain;
+
+               RDEBUG3("Current SSL session cert store contents");
+               chain = X509_STORE_CTX_get_chain(server_store_ctx);
+               RINDENT();
+               tls_log_certificate_chain(request, chain, cert);
+               REXDENT();
+       }
+
+       ret = X509_STORE_CTX_get1_issuer(&issuer_cert, server_store_ctx, cert);
+       if (ret != 1) {
+               X509_NAME       *subject;
+               X509_NAME       *issuer = X509_get_issuer_name(cert);
+               char            *subject_str;
+               char            *issuer_str;
+
+               subject = X509_get_subject_name(cert);
+               if (!subject) {
+                       tls_log_error(request, "Couldn't retrieve subject name of SSL session cert");
+                       goto error;
+               }
+               MEM(subject_str = X509_NAME_oneline(subject, NULL, 0));
+
+               issuer = X509_get_issuer_name(cert);
+               if (!issuer) {
+                       tls_log_error(request, "Couldn't retrieve issuer name of SSL session cert");
+                       OPENSSL_free(subject_str);
+                       goto error;
+               }
+               MEM(issuer_str = X509_NAME_oneline(issuer, NULL, 0));
+
+               switch (ret) {
+               case 0:
+                       tls_log_error(request, "Issuer \"%s\" of \"%s\" not found in certificate store",
+                                     issuer_str, subject_str);
+                       break;
+               default:
+                       tls_log_error(request, "Error retrieving issuer \"%s\" of \"%s\" from certificate store",
+                                     issuer_str, subject_str);
+                       break;
+               }
+
+               OPENSSL_free(subject_str);
+               OPENSSL_free(issuer_str);
                goto error;
        }
 
+       rad_assert(issuer_cert);
+
        ret = tls_ocsp_check(request, ssl, server_store, issuer_cert, cert, conf, true);
        switch (ret) {
        default: