Ключевое слово в защите информации
КЛЮЧЕВОЕ СЛОВО
в защите информации
Получить ГОСТ TLS-сертификат для домена (SSL-сертификат)
Добро пожаловать, Гость! Чтобы использовать все возможности Вход. Новые регистрации запрещены.

Уведомление

Icon
Error
2 Страницы12>
Ошибка при подключении к stunnel
Опции
К последнему сообщению К первому непрочитанному
Предыдущая тема Следующая тема
Offline meremin  
#1 Оставлено : 15 апреля 2014 г. 17:26:24(UTC)
meremin

Статус: Новичок

Группы: Участники
Зарегистрирован: 07.04.2014(UTC)
Сообщений: 9
Российская Федерация
Откуда: Москва
Добрый день.

Собрал приложение с боддержкой aladdin jacarta

В хранилише MY создал сертификат с ссылкой на приватный ключ на карте.

Настроил тунель на прослушку 127.0.0.1:1500. Перенаправляю на test.vz3:443
Далее webView пытается подключиться к 127.0.0.1:1500, после чего выдает ошибку: Сетевое соединение потеряно.

istunnel выдает: **** Error 0x80090304 returned by AcquireCredentialsHandle
Установил сертификат УЦ от сюда https://www.cryptopro.ru/certsrv/certcarc.asp
Записывал ключи на карту тоже там

Лог istunnel

Цитата:
2014.04.15 17:14:03 LOG5[2211:56987648]: stunnel 4.18 on arm-apple-darwin
2014.04.15 17:14:03 LOG5[2211:56987648]: Threading:PTHREAD Sockets:SELECT,IPv4
2014.04.15 17:14:03 LOG6[2211:56987648]: file ulimit = 256 (can be changed with 'ulimit -n')
2014.04.15 17:14:03 LOG6[2211:56987648]: FD_SETSIZE = 1024 (some systems allow to increase this value)
2014.04.15 17:14:03 LOG5[2211:56987648]: 0 clients allowed
2014.04.15 17:14:03 LOG7[2211:56987648]: FD 19 in non-blocking mode
2014.04.15 17:14:03 LOG7[2211:56987648]: FD 21 in non-blocking mode
2014.04.15 17:14:03 LOG7[2211:56987648]: FD 22 in non-blocking mode
2014.04.15 17:14:03 LOG7[2211:56987648]: SO_REUSEADDR option set on accept socket
2014.04.15 17:14:03 LOG7[2211:56987648]: https bound to 127.0.0.1:1500
2014.04.15 17:14:03 LOG7[2211:56987648]: Created pid file /var/mobile/Applications/17AC5925-4733-4ECA-B493-7A24356F3989/Documents/../Library/stunnel.pid
2014.04.15 17:14:04 LOG7[2211:56987648]: https accepted FD=34 from 127.0.0.1:60499
2014.04.15 17:14:04 LOG7[2211:87216128]: client start
2014.04.15 17:14:04 LOG7[2211:87216128]: https started
2014.04.15 17:14:04 LOG7[2211:87216128]: FD 34 in non-blocking mode
2014.04.15 17:14:04 LOG7[2211:87216128]: TCP_NODELAY option set on local socket
2014.04.15 17:14:04 LOG5[2211:87216128]: https connected from 127.0.0.1:60499
2014.04.15 17:14:04 LOG7[2211:87216128]: FD 38 in non-blocking mode
2014.04.15 17:14:04 LOG7[2211:87216128]: https connecting
2014.04.15 17:14:04 LOG7[2211:87216128]: connect_wait: waiting 10 seconds
2014.04.15 17:14:04 LOG7[2211:87216128]: connect_wait: connected
2014.04.15 17:14:04 LOG7[2211:87216128]: Remote FD=38 initialized
2014.04.15 17:14:04 LOG7[2211:87216128]: TCP_NODELAY option set on remote socket
2014.04.15 17:14:04 LOG7[2211:87216128]: start SSPI connect
2014.04.15 17:14:04 LOG5[2211:87216128]: try to read the client certificate
2014.04.15 17:14:04 LOG7[2211:87216128]: open file /var/mobile/Applications/17AC5925-4733-4ECA-B493-7A24356F3989/Documents/client.cer with certificate
2014.04.15 17:14:11 LOG3[2211:87216128]: **** Error 0x80090304 returned by AcquireCredentialsHandle
2014.04.15 17:14:11 LOG3[2211:87216128]: Credentials complete
2014.04.15 17:14:11 LOG3[2211:87216128]: Error creating credentials
2014.04.15 17:14:11 LOG5[2211:87216128]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2014.04.15 17:14:11 LOG7[2211:87216128]: free Buffers
2014.04.15 17:14:11 LOG7[2211:87216128]: delete c->hContext
2014.04.15 17:14:11 LOG7[2211:87216128]: delete c->hClientCreds
2014.04.15 17:14:11 LOG5[2211:87216128]: incomp_mess = 0, extra_data = 0
2014.04.15 17:14:11 LOG7[2211:87216128]: https finished (0 left)
2014.04.15 17:14:11 LOG7[2211:56987648]: https accepted FD=35 from 127.0.0.1:60501
2014.04.15 17:14:11 LOG7[2211:87216128]: client start
2014.04.15 17:14:11 LOG7[2211:87216128]: https started
2014.04.15 17:14:11 LOG7[2211:87216128]: FD 35 in non-blocking mode
2014.04.15 17:14:11 LOG7[2211:87216128]: TCP_NODELAY option set on local socket
2014.04.15 17:14:11 LOG5[2211:87216128]: https connected from 127.0.0.1:60501
2014.04.15 17:14:11 LOG7[2211:87216128]: FD 38 in non-blocking mode
2014.04.15 17:14:11 LOG7[2211:87216128]: https connecting
2014.04.15 17:14:11 LOG7[2211:87216128]: connect_wait: waiting 10 seconds
2014.04.15 17:14:11 LOG7[2211:87216128]: connect_wait: connected
2014.04.15 17:14:11 LOG7[2211:87216128]: Remote FD=38 initialized
2014.04.15 17:14:11 LOG7[2211:87216128]: TCP_NODELAY option set on remote socket
2014.04.15 17:14:11 LOG7[2211:87216128]: start SSPI connect
2014.04.15 17:14:11 LOG5[2211:87216128]: try to read the client certificate
2014.04.15 17:14:11 LOG7[2211:87216128]: open file /var/mobile/Applications/17AC5925-4733-4ECA-B493-7A24356F3989/Documents/client.cer with certificate
2014.04.15 17:14:17 LOG3[2211:87216128]: **** Error 0x80090304 returned by AcquireCredentialsHandle
2014.04.15 17:14:17 LOG3[2211:87216128]: Credentials complete
2014.04.15 17:14:17 LOG3[2211:87216128]: Error creating credentials
2014.04.15 17:14:17 LOG5[2211:87216128]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2014.04.15 17:14:17 LOG7[2211:87216128]: free Buffers
2014.04.15 17:14:17 LOG7[2211:87216128]: delete c->hContext
2014.04.15 17:14:17 LOG7[2211:87216128]: delete c->hClientCreds
2014.04.15 17:14:17 LOG5[2211:87216128]: incomp_mess = 0, extra_data = 0
2014.04.15 17:14:17 LOG7[2211:87216128]: https finished (0 left)
2014.04.15 17:14:17 LOG7[2211:56987648]: https accepted FD=34 from 127.0.0.1:60503
2014.04.15 17:14:17 LOG7[2211:87216128]: client start
2014.04.15 17:14:17 LOG7[2211:87216128]: https started
2014.04.15 17:14:17 LOG7[2211:87216128]: FD 34 in non-blocking mode
2014.04.15 17:14:17 LOG7[2211:87216128]: TCP_NODELAY option set on local socket
2014.04.15 17:14:17 LOG5[2211:87216128]: https connected from 127.0.0.1:60503
2014.04.15 17:14:17 LOG7[2211:87216128]: FD 38 in non-blocking mode
2014.04.15 17:14:17 LOG7[2211:87216128]: https connecting
2014.04.15 17:14:17 LOG7[2211:87216128]: connect_wait: waiting 10 seconds
2014.04.15 17:14:17 LOG7[2211:87216128]: connect_wait: connected
2014.04.15 17:14:17 LOG7[2211:87216128]: Remote FD=38 initialized
2014.04.15 17:14:17 LOG7[2211:87216128]: TCP_NODELAY option set on remote socket
2014.04.15 17:14:17 LOG7[2211:87216128]: start SSPI connect
2014.04.15 17:14:17 LOG5[2211:87216128]: try to read the client certificate
2014.04.15 17:14:17 LOG7[2211:87216128]: open file /var/mobile/Applications/17AC5925-4733-4ECA-B493-7A24356F3989/Documents/client.cer with certificate
2014.04.15 17:14:22 LOG3[2211:87216128]: **** Error 0x80090304 returned by AcquireCredentialsHandle
2014.04.15 17:14:22 LOG3[2211:87216128]: Credentials complete
2014.04.15 17:14:22 LOG3[2211:87216128]: Error creating credentials
2014.04.15 17:14:22 LOG5[2211:87216128]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket
2014.04.15 17:14:22 LOG7[2211:87216128]: free Buffers
2014.04.15 17:14:22 LOG7[2211:87216128]: delete c->hContext
2014.04.15 17:14:22 LOG7[2211:87216128]: delete c->hClientCreds
2014.04.15 17:14:22 LOG5[2211:87216128]: incomp_mess = 0, extra_data = 0
2014.04.15 17:14:22 LOG7[2211:87216128]: https finished (0 left)


Код на поднятие istunnel

Цитата:
NSArray *paths = NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, NSUserDomainMask, YES);
NSString *documentsDirectory = [paths objectAtIndex:0];
NSString *auth = @"mutual_auth=no";
std::string certThumbprint;


std::vector<std::string> RDN;
std::vector<std::string> notBefore;
std::vector<std::string> notAfter;
std::vector<std::string> thumbprint;
EnumCerts(RDN, notBefore, notAfter, thumbprint);
NSLog(@"Certificates total count: %li",thumbprint.size());
certThumbprint = thumbprint[0];

if ( certThumbprint.size() && (certThumbprint != "No certificate")) {
BYTE bSHA1Digest[20];
CRYPT_HASH_BLOB bHash;
HCERTSTORE hStoreMy = 0;
PCCERT_CONTEXT pCertCtx = 0;
bHash.cbData = 20;
bHash.pbData = bSHA1Digest;
if (!StrTPToHex(certThumbprint.c_str(), 40, bHash.pbData, &bHash.cbData))
{
NSLog(@"Error HEx");
}

hStoreMy = CertOpenSystemStore(0,"MY");
pCertCtx = CertFindCertificateInStore(hStoreMy,
X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
0,CERT_FIND_HASH,&bHash,0);
if(!pCertCtx){
NSLog(@"Error context");
}

BYTE *EncCert;
DWORD EncCertSize;

EncCertSize=pCertCtx->cbCertEncoded;
if(!(EncCert=(BYTE*)malloc(EncCertSize)))
NSLog(@"Error context2");
memcpy(EncCert,pCertCtx->pbCertEncoded,EncCertSize);
//файл сертификата храним в каталоге приложения
//если это не удобно -- положите в другое место
if(!WriteToFile( [[NSString stringWithFormat:@"%@/client.cer", documentsDirectory] cString],
EncCert,EncCertSize))
NSLog(@"Error weite");
auth = [NSString stringWithFormat: @"cert=%@/client.cer", documentsDirectory];
}

NSString *fileName = [NSString stringWithFormat:@"%@/stunnel.conf", documentsDirectory];
NSString *content = [NSString stringWithFormat: @"pid = %@/../Library/stunnel.pid\n\
output = %@/../Library/stunnel2.log\nsocket = a:SO_REUSEADDR=1\n\
foreground = yes\ndebug = 7\nsocket = l:TCP_NODELAY=1\nsocket = r:TCP_NODELAY=1\n\
[https]\nclient = yes\naccept = %s:%d\nconnect = %s:%s\nverify=2\n%@",
documentsDirectory, documentsDirectory,(char *)"127.0.0.1",1500,
(char *)"test.vz3",(char *)"443",auth];

[content writeToFile:fileName
atomically:YES
encoding:NSStringEncodingConversionAllowLossy
error:nil];
NSLog(@"config\n");
NSLog(content);
NSLog(@"\nconfig end\n");
const char *fname_temp = [fileName cString];
char *fname = (char *)malloc(strlen(fname_temp + 1));
strcpy(fname, fname_temp);

// char *argv[]={"stunnel", fname};
// stunnel_main(2, argv);

pthread_attr_t attr;
pthread_t threadID;
int ret = pthread_attr_init(&attr);
ret = pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
//запускаем в отдельной нитке, передаём в качестве параметра имя файла с конфигурацией
int error = pthread_create(&threadID, &attr, &stunnel_routine, (void *)fname);
ret = pthread_attr_destroy(&attr);
if (error != 0){
[ModalAlert displayMessageOKButton: @"CryptoPro iStunnel" message: @"Error while starting stunnel"];
NSLog(@"dsadsad");
}


Код на создание ключа в MY

Цитата:

HCRYPTPROV hCryptProv = 0;
//получаем контейнер (для тестового примера он у нас один)
if(CryptAcquireContext(
&hCryptProv,
NULL,
CP_KC1_GR3410_2001_PROV,
PROV_GOST_2001_DH,
CRYPT_VERIFYCONTEXT))
{
NSLog(@"A cryptcontext with the key container has been acquired.\n");
DWORD size = 1024;
BYTE* ContName = (BYTE*)malloc(1024);
DWORD fParam = CRYPT_FIRST;
while (CryptGetProvParam(hCryptProv, PP_ENUMCONTAINERS, ContName, &size, fParam) ) {
fParam = CRYPT_NEXT;
NSLog(@"Container name: %s\n", (char*) ContName );
}

if (hCryptProv != 0) {
CryptReleaseContext(hCryptProv, 0);
}
//открываем контейнер
if(CryptAcquireContext(&hCryptProv, (char*)ContName,CP_KC1_GR3410_2001_PROV, PROV_GOST_2001_DH, 0)) {
NSLog(@"Container opened!");
HCRYPTKEY UserKey;
if (CryptGetUserKey(hCryptProv, AT_KEYEXCHANGE, &UserKey)) {
NSLog(@"Key opened!");
DWORD length;
//забираем кодированный сертификат
if (CryptGetKeyParam(UserKey, KP_CERTIFICATE, NULL, &length, 0)) {
BYTE *container = (BYTE*) malloc(length * sizeof(BYTE));
CryptGetKeyParam(UserKey, KP_CERTIFICATE, container, &length, 0);

//выводим сертификат в лог в формате der
NSMutableString *hex = [NSMutableString string];
for (int i=0; i < length; i++) {
[hex appendFormat:@"%02x ", container[i]];
}
NSLog(@"%d", length);
NSLog(@"%@", hex);


PCCERT_CONTEXT pCertContext;
HCERTSTORE hSystemStore;

if((hSystemStore = CertOpenStore(CERT_STORE_PROV_SYSTEM,0, NULL, CERT_SYSTEM_STORE_CURRENT_USER, L"MY"))) {
NSLog(@"Opened the MY system store.");
}


//новый контекст для нашего сертификата
if((pCertContext = CertCreateCertificateContext(MY_ENCODING_TYPE , container, length))) {
NSLog(@"A new certificate has been created");
}
else {
NSLog(@"A new certificate could not be created");
}


CRYPT_KEY_PROV_INFO kpi;
ZeroMemory(&kpi, sizeof(kpi));

kpi.pwszContainerName = (wchar_t*)[[NSString stringWithFormat:@"%s", (char*)ContName] cStringUsingEncoding:NSUTF32LittleEndianStringEncoding];
kpi.pwszProvName = (wchar_t*)[[NSString stringWithFormat:@"%s", CP_KC1_GR3410_2001_PROV] cStringUsingEncoding:NSUTF32LittleEndianStringEncoding];
kpi.dwProvType = PROV_GOST_2001_DH;
kpi.dwFlags = 0;
kpi.dwKeySpec = AT_UECSYMMETRICKEY;
kpi.cProvParam = 0;
kpi.rgProvParam = 0;


//прописываем параметры ключевого контейнера для сертификата
if (!CertSetCertificateContextProperty(pCertContext ,CERT_KEY_PROV_INFO_PROP_ID, NULL, &kpi)) {
CryptDestroyKey(UserKey);
CryptReleaseContext(hCryptProv, 0);
}

NSLog(@"Private key container name setting success!");

//добавляем сертификат в хранилище
// CERT_STORE_ADD_REPLACE_EXISTING
if(!CertAddCertificateContextToStore(hSystemStore, pCertContext, CERT_STORE_ADD_REPLACE_EXISTING, NULL)) {
NSLog(@"Error adding cert to store!");
NSLog(@"%d", CSP_GetLastError());
}

//CertDeleteCertificateFromStore(pCertContext);
CertCloseStore(hSystemStore, CERT_CLOSE_STORE_FORCE_FLAG);
}
} else {
NSLog(@"%d", CSP_GetLastError());
}
}
}


EnumCerts(RDN, notBefore, notAfter, thumbprint);
NSLog(@"Certificates total count: %li",thumbprint.size());
for(int i = 0; i < thumbprint.size(); ++i){
NSLog(@"%i. %s", i, thumbprint[i].c_str());
}
Вверх
Offline meremin  
#2 Оставлено : 15 апреля 2014 г. 19:21:11(UTC)
meremin

Статус: Новичок

Группы: Участники
Зарегистрирован: 07.04.2014(UTC)
Сообщений: 9
Российская Федерация
Откуда: Москва
Лог из консоли устройства

Цитата:

Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.531182 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: 19:18:57.537352 support_an_fopen:83 p:2554 t:0x0x3bcf3641 support_an_fopen("/private/var/mobile/Applications/17AC5925-4733-4ECA-B493-7A24356F3989/Documents/cprocsp/users/global.ini", "rb") = 0x0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.557491 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.566402 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.574821 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.581083 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.588268 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.596386 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.605256 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.613495 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.622236 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(libcpcvcert.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.626739 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.632911 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(libcpcvcert.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.637754 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.644699 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(libcpcvcert.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.651371 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.658463 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.663386 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.668077 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.675989 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(/opt/cprocsp/lib/amd64/librdrcpet.dylib, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.682834 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(/opt/cprocsp/lib/amd64/librdrcpet.dylib, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.690985 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(librdrrtsupcp.dylib, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.699285 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(librdrrtsupcp.dylib, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.707258 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.721538 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.728322 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.736039 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.742499 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.750143 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.758431 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.767288 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.775487 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.783375 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(libcpcvcert.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.787245 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.793508 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(libcpcvcert.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.797487 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.803760 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(libcpcvcert.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.810216 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.816248 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.821116 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.825969 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.833686 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(/opt/cprocsp/lib/amd64/librdrcpet.dylib, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.839855 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(/opt/cprocsp/lib/amd64/librdrcpet.dylib, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.848157 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(librdrrtsupcp.dylib, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.855925 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(librdrrtsupcp.dylib, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:57 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:57.864188 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.270171 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.283195 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.290888 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.296902 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.303975 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.312407 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.321194 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.329831 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.337705 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(libcpcvcert.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.341608 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.347858 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(libcpcvcert.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.351737 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.358634 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(libcpcvcert.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.365371 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.371621 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.376364 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.381413 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.390768 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(/opt/cprocsp/lib/amd64/librdrcpet.dylib, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.397534 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(/opt/cprocsp/lib/amd64/librdrcpet.dylib, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.405927 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(librdrrtsupcp.dylib, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.414212 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(librdrrtsupcp.dylib, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:18:58 Admins-iPad cpcsp[2554] <Error>: sup_lib 19:18:58.422570 support_n_dlopen:45 p:2554 t:0x0x3bcf3641 support_n_dlopen(dummy.so, 6) = 0x0 fail No such file or directory(2)
Apr 15 19:19:04 Admins-iPad cpcsp[2554] <Error>: capi20: 0x53d3000: :243 CryptAcquireCertificatePrivateKey () export public key failed!
Apr 15 19:19:04 Admins-iPad cpcsp[2554] <Error>: libssp: 0x53d3000: :683 SSPCPAcquireProvider AcquireContext failed!
Apr 15 19:19:04 Admins-iPad cpcsp[2554] <Error>: libssp: 0x53d3000: :3816 AddToMessageLog CryptoPro TLS. Error 0x8009000d calling CSP: Key does not exist.
Apr 15 19:19:04 Admins-iPad cpcsp[2554] <Error>: libssp: 0x53d3000: :3094 CPSSPCreateCredentials failed to acquire provider!
Apr 15 19:19:04 Admins-iPad cpcsp[2554] <Error>: libssp: 0x53d3000: :1319 CPDeleteSecurityContext bad context pointer!
Apr 15 19:19:10 Admins-iPad cpcsp[2554] <Error>: capi20: 0x53d3000: :243 CryptAcquireCertificatePrivateKey () export public key failed!
Apr 15 19:19:10 Admins-iPad cpcsp[2554] <Error>: libssp: 0x53d3000: :683 SSPCPAcquireProvider AcquireContext failed!
Apr 15 19:19:10 Admins-iPad cpcsp[2554] <Error>: libssp: 0x53d3000: :3816 AddToMessageLog CryptoPro TLS. Error 0x8009000d calling CSP: Key does not exist.
Apr 15 19:19:10 Admins-iPad cpcsp[2554] <Error>: libssp: 0x53d3000: :3094 CPSSPCreateCredentials failed to acquire provider!
Apr 15 19:19:10 Admins-iPad cpcsp[2554] <Error>: libssp: 0x53d3000: :1319 CPDeleteSecurityContext bad context pointer!
Apr 15 19:19:16 Admins-iPad cpcsp[2554] <Error>: capi20: 0x54d7000: :243 CryptAcquireCertificatePrivateKey () export public key failed!
Apr 15 19:19:16 Admins-iPad cpcsp[2554] <Error>: libssp: 0x54d7000: :683 SSPCPAcquireProvider AcquireContext failed!
Apr 15 19:19:16 Admins-iPad cpcsp[2554] <Error>: libssp: 0x54d7000: :3816 AddToMessageLog CryptoPro TLS. Error 0x8009000d calling CSP: Key does not exist.
Apr 15 19:19:16 Admins-iPad cpcsp[2554] <Error>: libssp: 0x54d7000: :3094 CPSSPCreateCredentials failed to acquire provider!
Apr 15 19:19:16 Admins-iPad cpcsp[2554] <Error>: libssp: 0x54d7000: :1319 CPDeleteSecurityContext bad context pointer!
Вверх
Offline meremin  
#3 Оставлено : 16 апреля 2014 г. 19:50:03(UTC)
meremin

Статус: Новичок

Группы: Участники
Зарегистрирован: 07.04.2014(UTC)
Сообщений: 9
Российская Федерация
Откуда: Москва
Есть тут кто?
Вверх
Offline Татьяна  
#4 Оставлено : 17 апреля 2014 г. 13:30:31(UTC)
Татьяна

Статус: Сотрудник

Группы: Участники
Зарегистрирован: 06.02.2008(UTC)
Сообщений: 1,491
Откуда: Крипто-Про

Поблагодарили: 40 раз в 37 постах
опишите подробнее, как вы делали

>В хранилише MY создал сертификат с ссылкой на приватный ключ на карте.

судя по логу, не удается найти закрытый ключ по сертификату.
Татьяна
ООО Крипто-Про
Вверх
Offline meremin  
#5 Оставлено : 17 апреля 2014 г. 13:49:01(UTC)
meremin

Статус: Новичок

Группы: Участники
Зарегистрирован: 07.04.2014(UTC)
Сообщений: 9
Российская Федерация
Откуда: Москва
Татьяна, добрый день

Код я отписал в первом посте.

Код на создание сертификата в MY

Цитата:
HCRYPTPROV hCryptProv = 0;
//получаем контейнер (для тестового примера он у нас один)
if(CryptAcquireContext(
&hCryptProv,
NULL,
CP_KC1_GR3410_2001_PROV,
PROV_GOST_2001_DH,
CRYPT_VERIFYCONTEXT))
{
NSLog(@"A cryptcontext with the key container has been acquired.\n");
DWORD size = 1024;
BYTE* ContName = (BYTE*)malloc(1024);
DWORD fParam = CRYPT_FIRST;
while (CryptGetProvParam(hCryptProv, PP_ENUMCONTAINERS, ContName, &size, fParam) ) {
fParam = CRYPT_NEXT;
NSLog(@"Container name: %s\n", (char*) ContName );
}

if (hCryptProv != 0) {
CryptReleaseContext(hCryptProv, 0);
}
//открываем контейнер
if(CryptAcquireContext(&hCryptProv, (char*)ContName,CP_KC1_GR3410_2001_PROV, PROV_GOST_2001_DH, 0)) {
NSLog(@"Container opened!");
HCRYPTKEY UserKey;
if (CryptGetUserKey(hCryptProv, AT_KEYEXCHANGE, &UserKey)) {
NSLog(@"Key opened!");
DWORD length;
//забираем кодированный сертификат
if (CryptGetKeyParam(UserKey, KP_CERTIFICATE, NULL, &length, 0)) {
BYTE *container = (BYTE*) malloc(length * sizeof(BYTE));
CryptGetKeyParam(UserKey, KP_CERTIFICATE, container, &length, 0);

//выводим сертификат в лог в формате der
NSMutableString *hex = [NSMutableString string];
for (int i=0; i < length; i++) {
[hex appendFormat:@"%02x ", container[i]];
}
NSLog(@"%d", length);
NSLog(@"%@", hex);


PCCERT_CONTEXT pCertContext;
HCERTSTORE hSystemStore;

if((hSystemStore = CertOpenStore(CERT_STORE_PROV_SYSTEM,0, NULL, CERT_SYSTEM_STORE_CURRENT_USER, L"MY"))) {
NSLog(@"Opened the MY system store.");
}


//новый контекст для нашего сертификата
if((pCertContext = CertCreateCertificateContext(MY_ENCODING_TYPE , container, length))) {
NSLog(@"A new certificate has been created");
}
else {
NSLog(@"A new certificate could not be created");
}


CRYPT_KEY_PROV_INFO kpi;
ZeroMemory(&kpi, sizeof(kpi));

kpi.pwszContainerName = (wchar_t*)[[NSString stringWithFormat:@"%s", (char*)ContName] cStringUsingEncoding:NSUTF32LittleEndianStringEncoding];
kpi.pwszProvName = (wchar_t*)[[NSString stringWithFormat:@"%s", CP_KC1_GR3410_2001_PROV] cStringUsingEncoding:NSUTF32LittleEndianStringEncoding];
kpi.dwProvType = PROV_GOST_2001_DH;
kpi.dwFlags = 0;
kpi.dwKeySpec = AT_UECSYMMETRICKEY;
kpi.cProvParam = 0;
kpi.rgProvParam = 0;


//прописываем параметры ключевого контейнера для сертификата
if (!CertSetCertificateContextProperty(pCertContext ,CERT_KEY_PROV_INFO_PROP_ID, NULL, &kpi)) {
CryptDestroyKey(UserKey);
CryptReleaseContext(hCryptProv, 0);
}

NSLog(@"Private key container name setting success!");

//добавляем сертификат в хранилище
// CERT_STORE_ADD_REPLACE_EXISTING
if(!CertAddCertificateContextToStore(hSystemStore, pCertContext, CERT_STORE_ADD_REPLACE_EXISTING, NULL)) {
NSLog(@"Error adding cert to store!");
NSLog(@"%d", CSP_GetLastError());
}

//CertDeleteCertificateFromStore(pCertContext);
CertCloseStore(hSystemStore, CERT_CLOSE_STORE_FORCE_FLAG);
}
} else {
NSLog(@"%d", CSP_GetLastError());
}
}
}


EnumCerts(RDN, notBefore, notAfter, thumbprint);
NSLog(@"Certificates total count: %li",thumbprint.size());
for(int i = 0; i < thumbprint.size(); ++i){
NSLog(@"%i. %s", i, thumbprint[i].c_str());
}
Вверх
Offline Татьяна  
#6 Оставлено : 17 апреля 2014 г. 14:07:37(UTC)
Татьяна

Статус: Сотрудник

Группы: Участники
Зарегистрирован: 06.02.2008(UTC)
Сообщений: 1,491
Откуда: Крипто-Про

Поблагодарили: 40 раз в 37 постах
> kpi.dwKeySpec = AT_UECSYMMETRICKEY;
это неправильно
должно быть AT_KEYEXCHANGE
Татьяна
ООО Крипто-Про
Вверх
Offline Татьяна  
#7 Оставлено : 17 апреля 2014 г. 14:10:08(UTC)
Татьяна

Статус: Сотрудник

Группы: Участники
Зарегистрирован: 06.02.2008(UTC)
Сообщений: 1,491
Откуда: Крипто-Про

Поблагодарили: 40 раз в 37 постах
имя контейнера в CRYPT_KEY_PROV_INFO должно быть в формате unique, можно его получить при помощи GetProvParam PP_UNIQUE_CONTAINER
Татьяна
ООО Крипто-Про
Вверх
Offline meremin  
#8 Оставлено : 17 апреля 2014 г. 14:25:50(UTC)
meremin

Статус: Новичок

Группы: Участники
Зарегистрирован: 07.04.2014(UTC)
Сообщений: 9
Российская Федерация
Откуда: Москва
Татьяна, спасибо за ответ.

Теперь запрашивает пин код контейнера. После чего такая ошибка:

pr 17 14:23:14 Admins-iPad cpcsp[3184] <Error>: libssp: 0x533d000: :3816 AddToMessageLog CryptoPro TLS. Used certificate is not valid. TrustStatus: 0x20
Вверх
Offline Татьяна  
#9 Оставлено : 17 апреля 2014 г. 14:46:59(UTC)
Татьяна

Статус: Сотрудник

Группы: Участники
Зарегистрирован: 06.02.2008(UTC)
Сообщений: 1,491
Откуда: Крипто-Про

Поблагодарили: 40 раз в 37 постах
http://msdn.microsoft.co...377590%28v=vs.85%29.aspx

CERT_TRUST_IS_UNTRUSTED_ROOT
0x00000020
The certificate or certificate chain is based on an untrusted root.

а корневой сертификат установлен? и для клиентского и для серверного сертификата?
Татьяна
ООО Крипто-Про
Вверх
Offline meremin  
#10 Оставлено : 17 апреля 2014 г. 14:53:51(UTC)
meremin

Статус: Новичок

Группы: Участники
Зарегистрирован: 07.04.2014(UTC)
Сообщений: 9
Российская Федерация
Откуда: Москва
Я провобовал авторизовываться на сервере через IE с тойже картой. Все ок.

На IPad я устанавливал корневой сертификат тестового УЦ в профили устройства, правильно? Или надо тоже через API в хранилище MY ?
Вверх
RSS Лента  Atom Лента
Пользователи, просматривающие эту тему
Guest
2 Страницы12>
Быстрый переход  
Вы не можете создавать новые темы в этом форуме.
Вы не можете отвечать в этом форуме.
Вы не можете удалять Ваши сообщения в этом форуме.
Вы не можете редактировать Ваши сообщения в этом форуме.
Вы не можете создавать опросы в этом форуме.
Вы не можете голосовать в этом форуме.

Privacy Policy | Форум YAF.NET | YAF.NET © 2003-2025, Yet Another Forum.NET