Should load all available CA Certificates and not just the u1 bundled/shipped ones

[Guillermo Gonzalez]

The client should load all available certificates instead of the UbuntuOne*.pem ones.

[Impact]

This is needed as the server will change the certificates due to the recent SSL bug and it will not verify against the current loaded CA certificates. This change will be future-proof against any other changes to the certificate chain.

[Test Case]

A small protocol client is attached that connects and pings the server.

In order to test it, we have the new certificates (with the chain, etc) at staging:

from the root of the branch:

PYTHONPATH=. python2.7 ping_client.py staging

or with the package installed:

python2.7 ping_client.py staging

[Regression Potential]

The use of all available certificates in the system certificate store, instead of a select few, increases the risk of a MITM attack by way of a weakest-link CA. However, many other packages use /etc/ssl/certs as their certificate store, so this problem would not be specific to UbuntuOne and it would be a critical security problem if any of the listed CAs were compromised.

[Steve Langasek (vorlon)]

Hi folks,

I've filled out the SRU template for this bug as best I can based on the package in the queue. However, I don't consider the test case included in the source to be sufficient; the test case merely duplicates the code in the get_certificates() call itself, but does not prove that loading the certificates in this way will work with either the current production certificate, or the future replacement certificate. Could someone please provide an appropriate test for this? (Does not have to be an automated test in python - a text "how to test" in the bug description is sufficient.)

[Guillermo Gonzalez (verterok)]

Hi Steve,

Apologize the delay.

I attached a small protocol client that connects and ping the server.

In order to test it, we have the new certificates (with the chain, etc) at staging:

from the root of the branch:

PYTHONPATH=. python2.7 ping_client.py staging

or with the package installed:

python2.7 ping_client.py staging

[Adam Conrad (adconrad)]

Hello Guillermo, or anyone else affected,

Accepted ubuntuone-storage-protocol into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/ubuntuone-storage-protocol/3.0.2-0ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Adam Conrad (adconrad)]

Hello Guillermo, or anyone else affected,

Accepted ubuntuone-storage-protocol into saucy-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/ubuntuone-storage-protocol/13.10-0ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Ubuntu Foundations Team Bug Bot (crichton)]

The fix for this bug has been awaiting testing feedback in the -proposed repository for precise for more than 90 days. Please test this fix and update the bug appropriately with the results. In the event that the fix for this bug is still not verified 15 days from now, the package will be removed from the -proposed repository.

[Rolf Leggewie (r0lf)]

saucy has seen the end of its life and is no longer receiving any updates. Marking the saucy task for this ticket as "Won't Fix".

[Rolf Leggewie (r0lf)]

Please add a test case for verification

[Martin Pitt (pitti)]

The version of ubuntuone-storage-protocol in the proposed pocket of Precise that was purported to fix this bug report has been removed because the bugs that were to be fixed by the upload were not verified in a timely (105 days) fashion.