client certificate authenticated web service

[re...@lightningtechie.co.uk]

Hello,

Hope someone out there can help - we are using a client certificate
authenticated web service which we would like to monitoir it but
whatever settings I try to pass to webinject, I`m basically greeted
with an error which suggests to me its not passing the client cert to
the web server (access denied). I`ve experimented with some
environment variables at the top of webinject.pl but it seems like
they are being ignored -

$ENV{PERL_LWP_SSL_VERIFY_HOSTNAME} = 0;

$ENV{HTTPS_CERT_FILE} = "/usr/local/nagios/libexec/webinject/
cert.pem";

$ENV{HTTPS_KEY_FILE} = "/usr/local/nagios/libexec/webinject/priv.pem";

yet if I use curl from the command line and connect ot the same web
service by referencing the same cert and key file above, it connects
fine, what could I be doing wrong??

thanks

[Sven Nierlein]

Have you tried that already:

http://groups.google.com/group/webinject/msg/5edfba7e42167093

especially setting HTTPS_DEBUG=100 for debugging and HTTPS_CA_FILE.

Bye,
Sven

[re...@lightningtechie.co.uk]

Thanks - yes I tried specifying the environment settings within the
line when calling the script. I also tried the debugging command - I
presume the results of the debug get written to the httpd.log file -
which is where I see the access denied error (like the client cert is
not being passed - i know the cert & key file work because I can pass
them in a curl command line fine) - I`m not exactly sure what to put
in the CA file and heres why - we use a public CA for the SSL cert of
the web service but we issue our client certs from our own internal
CA. If I leave this environment setting out -
$ENV{PERL_LWP_SSL_VERIFY_HOSTNAME} = 0; then in the CA file I have to
specify is of the public CA used for the SSL cert or handshaking fails
(which is why I leave the setting in as I`m not interested in checking
the public CA cert). I`ve also tried specifying the intermediate cert
of our own internal CA in the CA file but still fails with access
denied. Its almost like webinject is expecting to see a client cert
issued by the same CA which issued the server SSL cert???

[Sven Nierlein]

On 12/27/11 12:06, re...@lightningtechie.co.uk wrote:
> Thanks - yes I tried specifying the environment settings within the
> line when calling the script. I also tried the debugging command - I
> presume the results of the debug get written to the httpd.log file -

No, the http.log is written by webinject itself. All the http/ssl stuff is
done by 3rd party modules. So i would assume the debug output is written
to STDERR.

[re...@lightningtechie.co.uk]

any clue as to where I would find stderr output - it doesn`t seem to
be under var/log

[Sven Nierlein]

stderr is written directly to your console where you started webinject.

[re...@lightningtechie.co.uk]

this is the output I see

Starting WebInject Engine...

-------------------------------------------------------
Test: testcases.xml - 1
Liquidity Online Test
verify string
Verify : "operations are supported"
Failed Positive Verification
Failed HTTP Response Code Verification (HTTP/1.1 403 Forbidden)
TEST CASE FAILED
Response Time = 0.512 sec
-------------------------------------------------------

Start Time: Tue Dec 27 12:02:55 2011
Total Run Time: 0.648 seconds

Test Cases Run: 1
Test Cases Passed: 0
Test Cases Failed: 1
Verifications Passed: 0
Verifications Failed: 2

[sven]

Then you did it wrong. When i run a simple test case:

<testcases repeat="1">
<case
id = "1"
description1 = "description"
description2 = "description2"
method = "get"
url = "https://www.openssl.org/"
verifyresponsecode = "200"
verifypositive = "Welcome to the OpenSSL Project"
/>
</testcases>

And run it with:
HTTPS_DEBUG=100 ./webinject.pl t/data/98-ssl.xml

I can see the ssl debug output in between the webinject output. Btw,
which version do you use?

Starting WebInject Engine (v1.70)...
-------------------------------------------------------
Test: t/data/98-ssl.xml - 1
Desc: description
Desc: description2
GET Request: https://www.openssl.org/
SSL_connect:before/connect initialization
SSL_connect:SSLv2/v3 write client hello A
SSL_connect:SSLv3 read server hello A
SSL_connect:SSLv3 read server certificate A
SSL_connect:SSLv3 read server key exchange A
SSL_connect:SSLv3 read server done A
SSL_connect:SSLv3 write client key exchange A
SSL_connect:SSLv3 write change cipher spec A
SSL_connect:SSLv3 write finished A
SSL_connect:SSLv3 flush data
SSL_connect:SSLv3 read finished A
Verify Response Code: "200"
Passed HTTP Response Code Verification
Verify: 'Welcome to the OpenSSL Project'
Passed Positive Verification
TEST CASE PASSED
Response Time = 0.244 sec
-------------------------------------------------------

Start Time: Tue Dec 27 20:54:03 2011
Total Run Time: 0.338 seconds

Test Cases Run: 1
Test Cases Passed: 1
Test Cases Failed: 0
Verifications Passed: 2
Verifications Failed: 0

[re...@lightningtechie.co.uk]

Hello,

I am running webinject 1.7 and I used the debug environment setting
just as you have but I see no debug output on screen

[Sven Nierlein]

Could you try my testcase? Maybe you are not using ssl at all. Have you
double checked your url?

[Dirk Laan]

Hello Reece,

 

Did you enable "use Crypt::SSLeay;" ?

 

I use version 1.57 and I also use a clientcert with password and this works just fine.

I used the following settings in the webinject file:

 

Under the setting:    my $useragent = $self->_get_useragent();

 

    $ENV{HTTPS_CA_FILE}= "/usr/local/nagios/libexec/ca.crt";
    $ENV{HTTPS_CERT_FILE} = "/usr/local/nagios/libexec/cert.pem";
    $ENV{HTTPS_KEY_FILE}  = "/usr/local/nagios/libexec/key_nopw.pem";

 

I also attached the webinject file, maybe you can try this one to see if it makes a difference.

 

I used the following commands to create the key without a password:

 

Extract user key:
openssl pkcs12 -nocerts -in c:\certs\mycert.pfx -out c:\certs\userkey.pem

 

Extract User certificate:
openssl pkcs12 -clcerts -nokeys -i  c:\certs\mycert.pfx -out c:\certs\usercert.pem

 

Strip password from user key:
openssl rsa -in c:\certs\userkey.pem -out c:\certs\userkey_nopw.pem

 

Regards,

 

Dirk

2011/12/28 re...@lightningtechie.co.uk <re...@lightningtechie.co.uk>

[Dirk Laan]

Sorry forgot the file "webinject"

2011/12/28 Dirk Laan <tld....@gmail.com>

Hello Reece,

 

Did you enable "use Crypt::SSLeay;" ?

 

I use version 1.57 and I  use a clientcert with password and this works just fine.

[re...@lightningtechie.co.uk]

thank you to all for the help so far. I am definitely using https in
my test case and anyway, the site is set to only allow ssl and I`ve
tried the attached file above but still behaves the same. I presume
the attached file should be renamed to webinject.pl? Should I put
this file in a particular place on the file system?? should I run the
file in a particular way? at the moment i`m simply calling it
directly from a local terminal window command line on the linux box

On Dec 28, 8:20 pm, Dirk Laan <tld.l...@gmail.com> wrote:
> Sorry forgot the file "webinject"
>

>  webinject.txt
> 91KViewDownload
>
> 2011/12/28 Dirk Laan <tld.l...@gmail.com>

> >> > Verifications Failed: 0- Hide quoted text -
>
> - Show quoted text -

[Dirk Laan]

You can put the file anywhere you want, make sure you edit the file so that the path to your cert etc is correct.

Yes, you must rename the file and give it execute rights.

 

I run the file like this:

./check_webinject  app.xml -c appconfig.xml

 

If you put in a rule to log the request and response what do you get?

2011/12/28 re...@lightningtechie.co.uk <re...@lightningtechie.co.uk>

[re...@lightningtechie.co.uk]

Hi, If I turn off the client certificate requirement the rule passes
fine. Turn it back on and I get a 'forbidden' http status error. I
know that the certificate files I`m using are fine because I can use a
curl command line to connect to the same website with the certs with
no problems - it seems to be webinject that is refusing me - but I`m
still not convinced its even passing through the client certs when
running the test but not sure how to prove that one. Itwo other
points of note (just in case they matter) - the web server is IIS and
the client certificates are issued by an internal CA whereas the SSL
cert on the server is issued by a commercial CA.

What I would really like is to enable some debug logging of some sort
but HTTPS_DEBUG=100 doesn`t seem to do anything for me.

[re...@lightningtechie.co.uk]

Any further ideas please? Thank you

On Dec 28 2011, 11:55 pm, "re...@lightningtechie.co.uk"

[Dirk Laan]

Can you send the testcase?

Dirk

Verstuurd vanaf mijn iPhone

[Arnaud]

Hi, i just post for the same case. Can you say me if you have fix your
problem ?
Thanks

> >>>>> - Show quoted text -- Masquer le texte des messages précédents -
>
> - Afficher le texte des messages précédents -

[Frank Truscott]

I know this thread is old. I couldn't get this working for a while and it seemed like the $ENV variables I was setting were being ignored. I traced through the perl module code and found that the Net::HTTPS module was using the IO::Socket:SSL module by default and not the Net:SSL module (which would respond to the $ENV variables laid out here). So I had to set an additional $ENV variable in my webinject.pl file to make it work, forcing Net:HTTPS to use Net::SSL as shown below.

$ENV{PERL_NET_HTTPS_SSL_SOCKET_CLASS} = "Net::SSL";

$ENV{HTTPS_CA_FILE}= "/usr/local/nagios/libexec/ca.crt";

$ENV{HTTPS_CERT_FILE} = "/usr/local/nagios/libexec/cert.pem";

$ENV{HTTPS_KEY_FILE} = "/usr/local/nagios/libexec/key_nopw.pem";

[vincent palluel]

In a context with multiple cases (any number) and no break_on_errors set you get a truncated output.

<case
    id             = "1"
    description1   = "AAAA"
    description2   = "AAAA2"
    method         = "get"
    url            = "http://localhost"
    verifypositive = "Hello"
    warning        = "5"
    critical       = "15"
    label          = "AAAA"
    errormessage   = "this_is_errormessage_AAAA"
/>

<case
    id             = "2"
    description1   = "BBBB"
    description2   = "BBBB2"
    method         = "get"
    url            = "http://localhost"
    verifypositive = "Hello"
    warning        = "5"
    critical       = "15"
    label          = "BBBB"
    errormessage   = "this_is_errormessage_BBBB"
/>

<case
    id             = "3"
    description1   = "CCCC"
    description2   = "CCCC2"
    method         = "get"
    url            = "http://localhost"
    verifypositive = "Hello"
    warning        = "5"
    critical       = "15"
    label          = "CCCC"
    maxretry       = "1"
    retrysleep     = "2"
    errormessage   = "this_is_errormessage_CCCC"
/>

<case
    id             = "4"
    description1   = "DDDD"
    description2   = "DDDD2"
    method         = "get"
    url            = "http://localhost"
    verifypositive = "Hello"
    warning        = "5"
    critical       = "15"
    label          = "DDDD"
    maxretry       = "1"
    retrysleep     = "2"
    errormessage   = "this_is_errormessage_DDDD"
/>

Webinject OUTPUT:

WebInject CRITICAL - DDDD (case #4): CCCC (case #3): BBBB (case #2): this_is_errormessage_AAAA

Explanation of returnmessage:

case 1 is executed:
returnmessage is set in _verify function only if break_on_errors is set (it is not).
in run_test_case (after _verify), if no returnmessage, returnmessage is set to errormessage if defined (line 459), this is what we get.
case 2 is executed:
we enter in the  if( $self->{'result'}->{'returnmessage'} ) loop (line 425)
then returnmessage is set to: label (if defined) + (#caseid): + returnmessage.

caseid: 1 self result returnmessage this_is_errormessage_AAAA
caseid: 2 self result returnmessage BBBB (case #2): this_is_errormessage_AAAA
caseid: 3 self result returnmessage CCCC (case #3): BBBB (case #2): this_is_errormessage_AAAA
caseid: 4 self result returnmessage DDDD (case #4): CCCC (case #3): BBBB (case #2): this_is_errormessage_AAAA

As a result we always loose the first case label + caseid: AAAA (case #1) and the others are added in descending order with only the first errormessage at the end.
Is this output format a wish of authors ? I dont't find it very readable and information management is not easy.

The $self->_out INFO is also truncated.

TEST CASE FAILED : this_is_errormessage_AAAA
TEST CASE FAILED : BBBB (case #2): this_is_errormessage_AAAA - this_is_errormessage_BBBB
TEST CASE FAILED : CCCC (case #3): BBBB (case #2): this_is_errormessage_AAAA - this_is_errormessage_CCCC
TEST CASE FAILED : DDDD (case #4): CCCC (case #3): BBBB (case #2): this_is_errormessage_AAAA - this_is_errormessage_DDDD

2013/8/2 Frank Truscott <ftru...@gmail.com>

--
You received this message because you are subscribed to the Google Groups "WebInject" group.
To unsubscribe from this group and stop receiving emails from it, send an email to webinject+...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

[vincent palluel]

Sorry for the bad subject this is another
topic.

I think Improvement axes are welcome in messages format.

I m working on it
I'm also working on proxy management at cases level (enable/disable/switch).

And also working on onfail actions at cases level (specific break, retry, execute other case or testcase).

A verify parseresponse could be also interesting before using it in PARSEDRESULT.
verifypositivenext and verifynegativenext are useless.

Let me know if you find this ideas interesting.

2013/9/6 vincent palluel <vincent...@gmail.com>

[vincent palluel]

OOps :( my mistake i apologize

You "loose" first case label + caseid: AAAA output format only if you specify an errormessage, if no errormessage specified you get the generic errormessage message.
WebInject CRITICAL - DDDD (case #4): CCCC (case #3): BBBB (case #2): Test case AAAA (#1) failed

I am aware of Nagios plugin output length restrictions. Anyway it could be interesting to get custom messages for every critical cases but it's a bit dangerous to rely on users fingers :(. It would be necessary to check message length/syntax.

2013/9/6 vincent palluel <vincent...@gmail.com>

[vincent palluel]

I have modified a little bit of Webinject code.

context:

config.xml
<globalhttplog>onfail</globalhttplog>
<reporttype>nagios</reporttype>
<testcasefile>testcases1.xml</testcasefile>
<testcasefile>testcases2.xml</testcasefile>

testcases1.xml

<testcases repeat="1">

<case
    id             = "1"

    description1   = "AAAA"
    description2   = "AAAA2"
    method         = "get"
    url            = "http://localhost"
    verifypositive = "Hello"

    warning        = "1"

    critical       = "15"
    label          = "AAAA"

/>

<case
    id             = "2"
    description1   = "BBBB"
    description2   = "BBBB2"
    method         = "get"
    url            = "http://localhost"
    verifypositive = "Hello"
    warning        = "5"
    critical       = "15"
    label          = "BBBB"

/>

<case
    id             = "3"
    description1   = "CCCC"
    description2   = "CCCC2"
    method         = "get"
    url            = "http://localhost"
    verifypositive = "Hello"
    warning        = "5"
    critical       = "15"
    label          = "CCCC"

/>

<case
    id             = "4"
    description1   = "DDDD"
    description2   = "DDDD2"
    method         = "get"
    url            = "http://localhost"
    verifypositive = "Hello"
    warning        = "5"
    critical       = "15"
    label          = "DDDD"

    errormessage   = "errormessageDDDD"
/>


</testcases>

testcases2.xml

<testcases repeat="1">

<case
    id             = "1"

    description1   = "AAAAtestcase2"
    description2   = "AAAAtestcase22"

    method         = "get"
    url            = "http://localhost"

    verifypositive = "Zello"
    verifypositivenext = "Hello"

    warning        = "5"
    critical       = "15"

    label          = "AAAAtestcase2"
    errormessage   = "errormessage_AAAAtestcase2"
/>

</testcases>

This was output i got with original version.
WebInject CRITICAL - AAAAtestcase2 (case #1): DDDD (case #4): CCCC (case #3): BBBB (case #2): Test case AAAA (#1) failed

This is the output i get after modifs.
returnmessage is now set on verifs even if break_on_errors is off (generic messages have been shortened).
two specific errormessage are used (1 in case 4 of testcases1.xml, 1 in case 1 of testcases2.xml)

WebInject CRITICAL - AAAA: Failed verifypositive: Hello BBBB: Failed verifypositive: Hello CCCC: Failed verifypositive: Hello DDDD: errormessageDDDD AAAAtestcase2: errormessage_AAAAtestcase2

Let me know if you find this interesting

2013/9/11 vincent palluel <vincent...@gmail.com>