Bugs item #3578418, was opened at 2012-10-19 11:07
Message generated for change (Tracker Item Submitted) made by jeffconnelly
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=3578418&group_id=976

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: SSL/TLS
Group: wrong behaviour
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Jeff Connelly (jeffconnelly)
Assigned to: Daniel Stenberg (bagder)
Summary: [PATCH] '--tlsauthtype srp' fails to send client username

Initial Comment:
The --tlsauthtype command-line option will attempt to use TLS-SRP but fail to send the username in the Client Hello message if specified as 'srp' (instead of 'SRP').

This causes the handshake to always fail with: curl: (35) error:1407745B:SSL routines:SSL23_GET_SERVER_HELLO:reason(1115)) (the "Unknown PSK Identity" alert):

/usr/local/bin/curl -ik -vvv --tlsuser alice --tlspassword password123 https://localhost:8443/ --tlsauthtype SRP # works
/usr/local/bin/curl -ik -vvv --tlsuser alice --tlspassword password123 https://localhost:8443/ --tlsauthtype foo # fails with invalid --tlsauthtype, as expected
/usr/local/bin/curl -ik -vvv --tlsuser alice --tlspassword password123 https://localhost:8443/ --tlsauthtype srp # fails with reason(1115) - not expected

--tlsauthtype srp is missing:
TLS client extension "SRP" (id=12), len=6
0000 - 05 61 6c 69 63 65 .alice

This is caused by src/tool_getparam.c doing a case-insensitive comparison using strequal() but lib/url.c using the case-sensitive strncmp().

Patch attached to change lib/url.c to the case-insensitive strnequal() to fix this. Tested on curl 7.28.0 with OpenSSL 1.0.1c.

----------------------------------------------------------------------

You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=3578418&group_id=976
Received on 2012-10-19