{"action":"created","issue":{"url":"https://api.github.com/repos/eu-emi/canl-java/issues/88","repository_url":"https://api.github.com/repos/eu-emi/canl-java","labels_url":"https://api.github.com/repos/eu-emi/canl-java/issues/88/labels{/name}","comments_url":"https://api.github.com/repos/eu-emi/canl-java/issues/88/comments","events_url":"https://api.github.com/repos/eu-emi/canl-java/issues/88/events","html_url":"https://github.com/eu-emi/canl-java/issues/88","id":168351736,"number":88,"title":"caNL produces incompatible draft-RFC proxies","user":{"login":"msalle","id":339484,"avatar_url":"https://avatars.githubusercontent.com/u/339484?v=3","gravatar_id":"","url":"https://api.github.com/users/msalle","html_url":"https://github.com/msalle","followers_url":"https://api.github.com/users/msalle/followers","following_url":"https://api.github.com/users/msalle/following{/other_user}","gists_url":"https://api.github.com/users/msalle/gists{/gist_id}","starred_url":"https://api.github.com/users/msalle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msalle/subscriptions","organizations_url":"https://api.github.com/users/msalle/orgs","repos_url":"https://api.github.com/users/msalle/repos","events_url":"https://api.github.com/users/msalle/events{/privacy}","received_events_url":"https://api.github.com/users/msalle/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/eu-emi/canl-java/labels/Severity:%20Defect","name":"Severity: Defect","color":"fc2929"}],"state":"open","locked":false,"assignee":{"login":"golbi","id":1583731,"avatar_url":"https://avatars.githubusercontent.com/u/1583731?v=3","gravatar_id":"","url":"https://api.github.com/users/golbi","html_url":"https://github.com/golbi","followers_url":"https://api.github.com/users/golbi/followers","following_url":"https://api.github.com/users/golbi/following{/other_user}","gists_url":"https://api.github.com/users/golbi/gists{/gist_id}","starred_url":"https://api.github.com/users/golbi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/golbi/subscriptions","organizations_url":"https://api.github.com/users/golbi/orgs","repos_url":"https://api.github.com/users/golbi/repos","events_url":"https://api.github.com/users/golbi/events{/privacy}","received_events_url":"https://api.github.com/users/golbi/received_events","type":"User","site_admin":false},"assignees":[{"login":"golbi","id":1583731,"avatar_url":"https://avatars.githubusercontent.com/u/1583731?v=3","gravatar_id":"","url":"https://api.github.com/users/golbi","html_url":"https://github.com/golbi","followers_url":"https://api.github.com/users/golbi/followers","following_url":"https://api.github.com/users/golbi/following{/other_user}","gists_url":"https://api.github.com/users/golbi/gists{/gist_id}","starred_url":"https://api.github.com/users/golbi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/golbi/subscriptions","organizations_url":"https://api.github.com/users/golbi/orgs","repos_url":"https://api.github.com/users/golbi/repos","events_url":"https://api.github.com/users/golbi/events{/privacy}","received_events_url":"https://api.github.com/users/golbi/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/eu-emi/canl-java/milestones/20","html_url":"https://github.com/eu-emi/canl-java/milestones/Milestone%202.4.1","labels_url":"https://api.github.com/repos/eu-emi/canl-java/milestones/20/labels","id":1916628,"number":20,"title":"Milestone 2.4.1","description":"","creator":{"login":"golbi","id":1583731,"avatar_url":"https://avatars.githubusercontent.com/u/1583731?v=3","gravatar_id":"","url":"https://api.github.com/users/golbi","html_url":"https://github.com/golbi","followers_url":"https://api.github.com/users/golbi/followers","following_url":"https://api.github.com/users/golbi/following{/other_user}","gists_url":"https://api.github.com/users/golbi/gists{/gist_id}","starred_url":"https://api.github.com/users/golbi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/golbi/subscriptions","organizations_url":"https://api.github.com/users/golbi/orgs","repos_url":"https://api.github.com/users/golbi/repos","events_url":"https://api.github.com/users/golbi/events{/privacy}","received_events_url":"https://api.github.com/users/golbi/received_events","type":"User","site_admin":false},"open_issues":1,"closed_issues":2,"state":"open","created_at":"2016-08-01T19:21:15Z","updated_at":"2016-08-29T22:21:59Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2016-07-29T15:33:14Z","updated_at":"2016-08-30T20:31:48Z","closed_at":null,"body":"draft-RFC (=GT3) proxies produces by the globus toolkit or C(++)-based VOMS have a different proxyCertInfo than the RFC proxies in case of non-infinite proxy pathlength constraint. In openssl.conf notation, a GT3 proxy cert info is of the form\r\n> field1 = SEQUENCE:_proxy policy_\r\n> field2 = EXPLICIT:1C,INTEGER:_proxy path length_\r\n\r\nwhere _proxy policy_ and _proxy pathlength_ are of the same form as for RFC proxies.\r\n\r\nFor reference, the corresponding RFC proxy would have:\r\n> field1 = INTEGER:_proxy pathlength_\r\n> field2 = SEQUENCE:_proxy policy_\r\n\r\nSee e.g. https://github.com/globus/globus-toolkit/blob/globus_6_branch/gsi/proxy/proxy_ssl/source/library/proxycertinfo.c#L450 and https://github.com/italiangrid/voms/blob/master/src/sslutils/proxycertinfo.c#L276\r\n\r\nIn caNL-java, the problem is around lines https://github.com/eu-emi/canl-java/blob/master/src/main/java/eu/emi/security/authn/x509/helpers/proxy/ProxyGeneratorHelper.java#L240 where the same ProxyCertInfoExtension is added for both types of proxies.\r\n\r\nThe practical implication is that a draft-RFC proxy **with path-length constraint** created with voms-proxy-init2 or grid-proxy-init fails to verify with voms-proxy-init3.\r\n"},"comment":{"url":"https://api.github.com/repos/eu-emi/canl-java/issues/comments/243570997","html_url":"https://github.com/eu-emi/canl-java/issues/88#issuecomment-243570997","issue_url":"https://api.github.com/repos/eu-emi/canl-java/issues/88","id":243570997,"user":{"login":"msalle","id":339484,"avatar_url":"https://avatars.githubusercontent.com/u/339484?v=3","gravatar_id":"","url":"https://api.github.com/users/msalle","html_url":"https://github.com/msalle","followers_url":"https://api.github.com/users/msalle/followers","following_url":"https://api.github.com/users/msalle/following{/other_user}","gists_url":"https://api.github.com/users/msalle/gists{/gist_id}","starred_url":"https://api.github.com/users/msalle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msalle/subscriptions","organizations_url":"https://api.github.com/users/msalle/orgs","repos_url":"https://api.github.com/users/msalle/repos","events_url":"https://api.github.com/users/msalle/events{/privacy}","received_events_url":"https://api.github.com/users/msalle/received_events","type":"User","site_admin":false},"created_at":"2016-08-30T20:31:48Z","updated_at":"2016-08-30T20:31:48Z","body":"Hi,\r\nthanks!\r\n1) unfortunately there isn't any as far as I know. The tag is indeed an integer, but value is\r\n[GT3_proxy.zip](https://github.com/eu-emi/canl-java/files/445902/GT3_proxy.zip)\r\n\r\n 1 (the C is for context-specific, see e.g. https://www.openssl.org/docs/manmaster/crypto/ASN1_generate_nconf.html and look for EXPLICIT). The way it's defined in C-code you can see in https://ndpfsvn.nikhef.nl/viewvc/mwsec/trunk/lcmaps-plugins-verify-proxy/src/verify-proxy/verify-lib/src_internal/_verify_proxy_certinfo.c lines 75-79 for GT3, lines 67-71 for GT4. \r\n2) see the attached GT3 proxy without private key, with path-length 42 (0x2A).\r\nIf you have a voms-client2 lying around (still shipped with Debian as voms-clients or EPEL as voms-clients-cpp, or build from source from https://github.com/italiangrid/voms), you can create them using the `-proxyver 3 -path-length 42` options (the java-based voms-clients use canl-java). Alternatively use Globus' grid-proxy-init, using the `-draft -path-length 42 `options.\r\n\r\nJust let me know if I can help further...\r\nCheers,\r\nMischa\r\n\r\n"}}
{"actor":{"display_login":"msalle"}}