2012-10-19, 17:18
imgload from https://developer.mozilla.org causes 'Permission denied' error
I compile iPXE with HTTPS protocol enabled and
TRUST=/etc/ssl/certs/GeoTrust_Global_CA.pem
but have 'Permission denied' (http://ipxe.org/0216e63c) error here.
Steps for reproduce:
(all of this steps are implemented into the attached 'makeimage.sh' POSIX shell script). Just get it, chmod +x and run (tested on Ubuntu 12.04).
1. $ git clone git://git.ipxe.org/ipxe.git
$ cd ipxe/src
2. define DOWNLOAD_PROTO_HTTPS in config/general.h
3. $ make bin/ipxe.lkrn TRUST=/etc/ssl/certs/GeoTrust_Global_CA.pem
4. wget http://boot.ipxe.org/ipxe.iso
5. Remaster iso:
* to isolinux.cfg add line:
INITRD script.txt
* create script.txt:
6. Boot from it (under VirtualBox for example).
Actual result:
Error message in console:
Permission denied (http://ipxe.org/0216e63c)
Expected result:
* Successfull file transfer over https
(and then fail on attempt to execute .ico file content).
* TRUST will works even for my own CA and existing one.
Additional details:
If I make with
$ make bin/ipxe.lkrn \
TRUST=/etc/ssl/certs/GeoTrust_Global_CA.pem \
DEBUG=x509,httpcore,https,rootcert
The following I get into console:
(entire console output into attached file com1_raw_dump_https_error_with_debug.bin, you can see it pretty colored with 'less -R <file> command)
This is exactly matches with SHA256 fingerprint of GeoTrustGlobalCA certificate- it is all right.
Also, file com1_raw_dump_https_error_with_debug_7.bin contains console log for build
$ make bin/ipxe.lkrn \
TRUST=/etc/ssl/certs/GeoTrust_Global_CA.pem \
DEBUG=x509:7,httpcore:7,https:7,rootcert:7
I compile iPXE with HTTPS protocol enabled and
TRUST=/etc/ssl/certs/GeoTrust_Global_CA.pem
but have 'Permission denied' (http://ipxe.org/0216e63c) error here.
Steps for reproduce:
(all of this steps are implemented into the attached 'makeimage.sh' POSIX shell script). Just get it, chmod +x and run (tested on Ubuntu 12.04).
1. $ git clone git://git.ipxe.org/ipxe.git
$ cd ipxe/src
2. define DOWNLOAD_PROTO_HTTPS in config/general.h
3. $ make bin/ipxe.lkrn TRUST=/etc/ssl/certs/GeoTrust_Global_CA.pem
4. wget http://boot.ipxe.org/ipxe.iso
5. Remaster iso:
* to isolinux.cfg add line:
INITRD script.txt
* create script.txt:
Code:
#!ipxe
echo "iPXE script: configuring network..."
dhcp
route
echo "iPXE script: try to load image"
imgload https://developer.mozilla.org/media/img/favicon.ico || shell
shell
6. Boot from it (under VirtualBox for example).
Actual result:
Error message in console:
Permission denied (http://ipxe.org/0216e63c)
Expected result:
* Successfull file transfer over https
(and then fail on attempt to execute .ico file content).
* TRUST will works even for my own CA and existing one.
Additional details:
If I make with
$ make bin/ipxe.lkrn \
TRUST=/etc/ssl/certs/GeoTrust_Global_CA.pem \
DEBUG=x509,httpcore,https,rootcert
The following I get into console:
(entire console output into attached file com1_raw_dump_https_error_with_debug.bin, you can see it pretty colored with 'less -R <file> command)
Quote:ROOTCERT using 1 built-in certificate(s):
00000000 : ff 85 6a 2d 25 1d cd 88-d3 66 56 f4 50 12 67 98 : ..j-%....fV.P.g.
00000010 : cf ab aa de 40 79 9c 72-2d e4 d2 b5 db 36 a7 3a : ....@y.r-....6.:
This is exactly matches with SHA256 fingerprint of GeoTrustGlobalCA certificate- it is all right.
Quote:https://developer.mozilla.org/media/img/favicon.ico..."GeoTrust Global CA" should be valid, isn't it?
X509 chain 0xda154 added X509 0xdcf94 "developer.mozilla.org"
X509 chain 0xda154 added X509 0xdf7f4 "GeoTrust SSL CA"
X509 chain 0xda154 added X509 0xdfc84 "GeoTrust Global CA"
X509 chain 0xda154 found no valid certificates
Quote:.HTTP 0xdb244 response "HTTP/1.1 200 OK"What is the "<NULL>" certificate into the chain? Is it all right?
HTTP 0xdb244 header "Date: Fri, 19 Oct 2012 06:12:29 GMT"
HTTP 0xdb244 header "Server: Apache/2.2.22 (Mandriva Linux/PREFORK-0.1mdv2010.2)"
HTTP 0xdb244 header "Last-Modified: Mon, 01 Oct 2012 11:07:43 GMT"
HTTP 0xdb244 header "ETag: "52d8-9ee-4cafd6a221dc0""
HTTP 0xdb244 header "Accept-Ranges: bytes"
HTTP 0xdb244 header "Content-Length: 2542"
HTTP 0xdb244 header "Content-Type: application/x-x509-ca-cert"
HTTP 0xdb244 start of data
X509 chain 0xda134 added X509 0xdbf94 "<NULL>"
X509 chain 0xda134 added X509 0xdc2f4 "iPXE cross-signing CA"
X509 chain 0xda134 added X509 0xdc704 "iPXE root CA"
X509 chain 0xda154 added X509 0xdbf94 "<NULL>"
X509 chain 0xda154 added X509 0xdc2f4 "iPXE cross-signing CA"
X509 chain 0xda154 added X509 0xdc704 "iPXE root CA"
.X509 chain 0xda154 found no valid certificates
Permission denied (http://ipxe.org/0216e63c)
Also, file com1_raw_dump_https_error_with_debug_7.bin contains console log for build
$ make bin/ipxe.lkrn \
TRUST=/etc/ssl/certs/GeoTrust_Global_CA.pem \
DEBUG=x509:7,httpcore:7,https:7,rootcert:7