Kai Engert (:KaiE:) Reporter
	Description • 14 years ago

I'm on a libPKIX debugging journey.
I try to switch PSM to use the new PKIX verify API.

While searching for a site with a real simple cert, I found www.cacert.org (that site's doesn't have any AIA pointer).

So, in my test profile, I imported the root from www.cacert.org, imported and marked as trust.

PKIX returns an error when verifying the server cert:
PKIX_ILLEGALCHARACTERINESCAPEDASCII

	Kai Engert (:KaiE:) Reporter
	Comment 1 • 14 years ago

Breakpoint 2, CERT_PKIXVerifyCert (cert=0xa3a30810, usages=1, paramsIn=0xa5683ec0, paramsOut=0xa54fec94, wincx=0xa56cd0e8) at certvfypkix.c:2318
2318        if (error != NULL) {
(gdb) print error
$1 = (PKIX_Error *) 0xa3ae79a0
(gdb) print *error
$2 = {errCode = PKIX_BUILDINITIATEBUILDCHAINFAILED, errClass = PKIX_BUILD_ERROR, plErr = 0, cause = 0xa3ae7960, info = 0x0}
(gdb) print *error->cause
$3 = {errCode = PKIX_UNABLETOBUILDCHAIN, errClass = PKIX_BUILD_ERROR, plErr = 0, cause = 0xa3ae7d60, info = 0x0}
(gdb) print *error->cause->cause
$4 = {errCode = PKIX_FORWARDBUILDERSTATEDUMPSTATEFAILED, errClass = PKIX_BUILD_ERROR, plErr = 0, cause = 0xa3ae7d20, info = 0x0}
(gdb) print *error->cause->cause->cause
$5 = {errCode = PKIX_OBJECTTOSTRINGFAILED, errClass = PKIX_FORWARDBUILDERSTATE_ERROR, plErr = 0, cause = 0xa3ae7ce0, info = 0x0}
(gdb) print *error->cause->cause->cause->cause
$6 = {errCode = PKIX_OBJECTSPECIFICFUNCTIONFAILED, errClass = PKIX_OBJECT_ERROR, plErr = 0, cause = 0xa3ae7ca0, info = 0x0}
(gdb) print *error->cause->cause->cause->cause->cause
$7 = {errCode = PKIX_OBJECTTOSTRINGFAILED, errClass = PKIX_FORWARDBUILDERSTATE_ERROR, plErr = 0, cause = 0xa3ae7c60, info = 0x0}
(gdb) print *error->cause->cause->cause->cause->cause->cause
$8 = {errCode = PKIX_OBJECTSPECIFICFUNCTIONFAILED, errClass = PKIX_OBJECT_ERROR, plErr = 0, cause = 0xa3ae7c20, info = 0x0}
(gdb) print *error->cause->cause->cause->cause->cause->cause->cause
$9 = {errCode = PKIX_LISTTOSTRINGHELPERFAILED, errClass = PKIX_LIST_ERROR, plErr = 0, cause = 0xa3ae7be0, info = 0x0}
(gdb) print *error->cause->cause->cause->cause->cause->cause->cause->cause
$10 = {errCode = PKIX_LISTTOSTRINGHELPERFAILED, errClass = PKIX_LIST_ERROR, plErr = 0, cause = 0xa3ae7ba0, info = 0x0}
(gdb) print *error->cause->cause->cause->cause->cause->cause->cause->cause->cause
$11 = {errCode = PKIX_OBJECTTOSTRINGFAILED, errClass = PKIX_LIST_ERROR, plErr = 0, cause = 0xa3ae7b60, info = 0x0}
(gdb) print *error->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause
$12 = {errCode = PKIX_OBJECTSPECIFICFUNCTIONFAILED, errClass = PKIX_OBJECT_ERROR, plErr = 0, cause = 0xa3ae7b20, info = 0x0}
(gdb) print *error->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause
$13 = {errCode = PKIX_CERTTOSTRINGHELPERFAILED, errClass = PKIX_CERT_ERROR, plErr = 0, cause = 0xa3ae7ae0, info = 0x0}
(gdb) print *error->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause
$14 = {errCode = PKIX_DATETOSTRINGHELPERFAILED, errClass = PKIX_CERT_ERROR, plErr = 0, cause = 0xa3ae7aa0, info = 0x0}
(gdb) print *error->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause
$15 = {errCode = PKIX_STRINGCREATEFAILED, errClass = PKIX_DATE_ERROR, plErr = 0, cause = 0xa3ae7a60, info = 0x0}
(gdb) print *error->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause
$16 = {errCode = PKIX_ESCASCIITOUTF16FAILED, errClass = PKIX_STRING_ERROR, plErr = 0, cause = 0xa3ae7a20, info = 0x0}
(gdb) print *error->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause->cause
$17 = {errCode = PKIX_ILLEGALCHARACTERINESCAPEDASCII, errClass = PKIX_STRING_ERROR, plErr = 4294959109, cause = 0x0, info = 0x0}

	Kai Engert (:KaiE:) Reporter
	Comment 2 • 14 years ago

I get the same problem when conecting to paypal.

	Kai Engert (:KaiE:) Reporter
	Comment 3 • 14 years ago

Looks like libPKIX is unable to deal with international characters?

My computer uses the german locale and settings. See date parameter in first line.


#0  pkix_EscASCII_to_UTF16 (escAsciiString=0xa3cd8b80 "Mo Mär 22, 2010", escAsciiLen=16, debug=0, pDest=0xa2a1c960, pLength=0xa2a1c964, plContext=0xa2a1c310) at pkix_pl_common.c:820
#1  0x039fe5c3 in PKIX_PL_String_Create (fmtIndicator=0, stringRep=0xa3c66d00, stringLen=0, pString=0xa56fe3c4, plContext=0xa2a1c310) at pkix_pl_string.c:346
#2  0x039e117f in pkix_pl_Date_ToString_Helper (nssTime=0xa3c128c4, pString=0xa56fe3c4, plContext=0xa2a1c310) at pkix_pl_date.c:183
#3  0x039ccbe4 in pkix_pl_Cert_ToString_Helper (cert=0xa3dcf050, partialString=0, pString=0xa56fe498, plContext=0xa2a1c310) at pkix_pl_cert.c:963
#4  0x039cef6a in pkix_pl_Cert_ToString (object=0xa3dcf050, pString=0xa56fe4fc, plContext=0xa2a1c310) at pkix_pl_cert.c:1228
#5  0x039f9f2d in PKIX_PL_Object_ToString (object=0xa3dcf050, pString=0xa56fe65c, plContext=0xa2a1c310) at pkix_pl_object.c:1267
#6  0x039a9d90 in pkix_ForwardBuilderState_ToString (object=0xa6d248a0, pString=0xa56fe70c, plContext=0xa2a1c310) at pkix_build.c:484
#7  0x039f9f2d in PKIX_PL_Object_ToString (object=0xa6d248a0, pString=0xa56fe7ac, plContext=0xa2a1c310) at pkix_pl_object.c:1267
#8  0x039aab85 in pkix_ForwardBuilderState_DumpState (state=0xa6d248a0, plContext=0xa2a1c310) at pkix_build.c:635
#9  0x039b015a in pkix_BuildForwardDepthFirstSearch (pNBIOContext=0xa56fe9d0, state=0xa6d248a0, pValResult=0xa56fe980, plContext=0xa2a1c310) at pkix_build.c:2350

	Kai Engert (:KaiE:) Reporter
	Comment 4 • 14 years ago

Only seen with PKIX debugging output enabled.