Issue with recent Belgium Identity Card, openconnect 7.06 and

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello,

I'm trying to use openconnect to connect to our corporate vpn.

The command that I'm currently using (I need to go through our internal
proxy):
# openconnect --timestamp --proxy=localhost:3128 -v --dump-http-traffic
-c 'pkcs11:model=PKCS%2315;mycert[...];object-type=cert' vpnserver

I've the following output:
[2015-04-09 09:24:44] POST vpnserver
[2015-04-09 09:24:44] Attempting to connect to server [::1]:3128
[2015-04-09 09:24:44] Attempting to connect to server 127.0.0.1:3128
[2015-04-09 09:24:44] Requesting HTTP proxy connection to vpnserver:443
[2015-04-09 09:24:44] > CONNECT vpnserver:443 HTTP/1.1
[2015-04-09 09:24:44] > Host: vpnserver
[2015-04-09 09:24:44] > User-Agent: Open AnyConnect VPN Agent v7.06
[2015-04-09 09:24:44] > Proxy-Connection: keep-alive
[2015-04-09 09:24:44] > Connection: keep-alive
[2015-04-09 09:24:44] > Accept-Encoding: identity
[2015-04-09 09:24:44] >
[2015-04-09 09:24:44] Got HTTP response: HTTP/1.1 200 Connection established
[2015-04-09 09:24:44] Connection: close
[2015-04-09 09:24:44] Using PKCS#11 certificate
pkcs11:model=PKCS%2315;mycert[...];type=cert
PIN required for BELPIC (Basic PIN)
Enter PIN:
[2015-04-09 09:24:52] Using PKCS#11 key
pkcs11:model=PKCS%2315;mycert[...];type=private
[2015-04-09 09:24:52] Error signing test data with private key: PKCS #11
unsupported feature
[2015-04-09 09:24:52] Loading certificate failed. Aborting.
[2015-04-09 09:24:52] Failed to open HTTPS connection to vpnserver

When I'm using an older identity card, I've the following output:
# openconnect --timestamp --proxy=localhost:3128 -v --dump-http-traffic
-c 'pkcs11:model=PKCS%2315;othercert;type=cert' vpnserver
[2015-04-09 09:30:49] POST vpnserver
[2015-04-09 09:30:49] Attempting to connect to server [::1]:3128
[2015-04-09 09:30:49] Attempting to connect to server 127.0.0.1:3128
[2015-04-09 09:30:49] Requesting HTTP proxy connection to
damona.onprvp.fgov.be:443
[2015-04-09 09:30:49] > CONNECT vpnserver:443 HTTP/1.1
[2015-04-09 09:30:49] > Host: vpnserver
[2015-04-09 09:30:49] > User-Agent: Open AnyConnect VPN Agent v7.06
[2015-04-09 09:30:49] > Proxy-Connection: keep-alive
[2015-04-09 09:30:49] > Connection: keep-alive
[2015-04-09 09:30:49] > Accept-Encoding: identity
[2015-04-09 09:30:49] >
[2015-04-09 09:30:49] Got HTTP response: HTTP/1.1 200 Connection established
[2015-04-09 09:30:49] Connection: close
[2015-04-09 09:30:49] Using PKCS#11 certificate
pkcs11:model=PKCS%2315;othercert;type=cert
PIN required for BELPIC (Basic PIN)
Enter PIN:
[2015-04-09 09:30:58] Using PKCS#11 key
pkcs11:model=PKCS%2315;othercert;type=private
[2015-04-09 09:30:59] Using client certificate 'Firstname Lastname
(Authentication)'
[2015-04-09 09:31:02] Got next CA 'Citizen CA' from PKCS11
[2015-04-09 09:31:02] Got next CA 'Belgium Root CA2' from PKCS11
[2015-04-09 09:31:02] Adding supporting CA 'Citizen CA'
[2015-04-09 09:31:03] SSL negotiation with vnpserver

To retrieve the PKCS#11 url, I'm using the following commands:
# p11tool --list-certs
warning: no token URL was provided for this operation; the available
tokens are:
Token 0:
pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=System%20Trust
Token 1: pkcs11:model=PKCS%2315;mycert

With the token 1:

# p11tool --list-all --login 'pkcs11:model=PKCS%2315;mycert'
Object 0:
        URL:
pkcs11:model=PKCS%2315;mycert;object=Authentication;type=private
        Type: Private key
        Label: Authentication
        Flags: CKA_PRIVATE; CKA_SENSITIVE;
        ID: 02

Object 1:
        URL: pkcs11:model=PKCS%2315;mycert;object=Authentication;type=cert
        Type: X.509 Certificate
        Label: Authentication
        Flags: CKA_PRIVATE;
        ID: 02

Object 2:
        URL: pkcs11:model=PKCS%2315;mycert;object=Authentication;type=public
        Type: Public key
        Label: Authentication
        Flags: CKA_PRIVATE; CKA_SENSITIVE;
        ID: 02

Object 3:
        URL: pkcs11:model=PKCS%2315;mycert;object=Signature;type=private
        Type: Private key
        Label: Signature
        Flags: CKA_PRIVATE; CKA_SENSITIVE;
        ID: 03

Object 4:
        URL: pkcs11:model=PKCS%2315;mycert;object=Signature;type=cert
        Type: X.509 Certificate
        Label: Signature
        Flags: CKA_PRIVATE;
        ID: 03

Object 5:
        URL: pkcs11:model=PKCS%2315;mycert;object=Signature;type=public
        Type: Public key
        Label: Signature
        Flags: CKA_PRIVATE; CKA_SENSITIVE;
        ID: 03

Object 6:
        URL: pkcs11:model=PKCS%2315;mycert;object=CA;type=cert
        Type: X.509 Certificate
        Label: CA
        Flags: CKA_PRIVATE; CKA_TRUSTED;
        ID: 04

Object 7:
        URL: pkcs11:model=PKCS%2315;mycert;object=CA;type=public
        Type: Public key
        Label: CA
        Flags: CKA_PRIVATE; CKA_SENSITIVE;
        ID: 04

Object 8:
        URL: pkcs11:model=PKCS%2315;mycert;object=Root;type=cert
        Type: X.509 Certificate
        Label: Root
        Flags: CKA_PRIVATE; CKA_TRUSTED;
        ID: 06

Object 9:
        URL: pkcs11:model=PKCS%2315;mycert;object=Root;type=public
        Type: Public key
        Label: Root
        Flags: CKA_PRIVATE; CKA_SENSITIVE;
        ID: 06

And then I'm taking the Object 1, which is a X.509
Certificate/Authentication (it's the same object for both old and new
identity card).

There is currently two batch of identity cards in Belgium:
- the ones with a validity of 5 years (which seems to be working),
- the recent ones with a validity of 10 years (which doesn't seems to be
working).


I'm currently using:
- # uname -a
Linux lp-20140069-linux 3.18.7-gentoo #14 SMP Thu Apr 2 09:46:15 CEST
2015 x86_64 Intel(R) Core(TM) i7-4600U CPU @ 2.10GHz GenuineIntel GNU/Linux
- openconnect --version
OpenConnect version v7.06
Using GnuTLS. Features present: PKCS#11, HOTP software token, TOTP
software token, Yubikey OATH, DTLS
- gnutls 3.3.12
- # pcscd --version
pcsc-lite version 1.8.13.

>From the error I'm getting (Error signing test data with private key:
PKCS #11
unsupported feature), I'm guessing that the error is coming directly
from gnutls.
I've tried upgrading to gnutls-3.3.14 with no luck.
gnutls-3.4.0 has been released yesterday (2015-04-08), but I've haven't
any package on my package manager to install it.

Does anybody have any ideas how I can investigate some more on it?

Thanks,

-- 
Sebastien Canart <sebastien.canart at onprvp.fgov.be>



[Index of Archives]     [Linux Samsung SoC]     [Linux Rockchip SoC]     [Linux Actions SoC]     [Linux for Synopsys ARC Processors]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]


  Powered by Linux