denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'ocsp-fixes'

Browse Source 
Fixes a regression with handling OCSP error responses and adds a new
option to specify the length of nonces in OCSP requests.  Also adds some
other improvements for OCSP handling and fuzzers for OCSP
requests/responses.

Closes strongswan/strongswan#2011
This commit is contained in:
Tobias Brunner
2023-11-24 17:44:45 +01:00
parent da45cf9f38 9c4846cdbe
commit b4a9058b61
11 changed files with 185 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/options/charon.opt
+7
View File
@@ -302,6 +302,13 @@ charon.nbns1
charon.nbns2
WINS servers assigned to peer via configuration payload (CP).
charon.ocsp_nonce_len = 32
Length of nonces in OCSP requests (1-32).
Length of nonces in OCSP requests. According to RFC 8954, valid values are
between 1 and 32, with new clients required to use 32. Some servers might
not support that so lowering the value to e.g. 16 might be necessary.
charon.port = 500
UDP port used locally. If set to 0 a random port will be allocated.
fuzz/.gitignore
+2
View File
@@ -1,5 +1,7 @@
fuzz_certs
fuzz_crls
fuzz_ocsp_req
fuzz_ocsp_rsp
fuzz_ids
fuzz_pa_tnc
fuzz_pb_tnc
fuzz/Makefile.am
+8 -1
View File
@@ -25,7 +25,8 @@ pb_tnc_ldflags = \
$(top_builddir)/src/libtncif/.libs/libtncif.a \
$(fuzz_ldflags)
FUZZ_TARGETS=fuzz_certs fuzz_crls fuzz_ids fuzz_pa_tnc fuzz_pb_tnc
FUZZ_TARGETS=fuzz_certs fuzz_crls fuzz_ocsp_req fuzz_ocsp_rsp \
fuzz_ids fuzz_pa_tnc fuzz_pb_tnc
all-local: $(FUZZ_TARGETS)
@@ -37,6 +38,12 @@ fuzz_certs: fuzz_certs.c ${libfuzzer}
fuzz_crls: fuzz_crls.c ${libfuzzer}
$(CC) $(AM_CPPFLAGS) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
fuzz_ocsp_req: fuzz_ocsp_req.c ${libfuzzer}
$(CC) $(AM_CPPFLAGS) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
fuzz_ocsp_rsp: fuzz_ocsp_rsp.c ${libfuzzer}
$(CC) $(AM_CPPFLAGS) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
fuzz_ids: fuzz_ids.c ${libfuzzer}
$(CC) $(AM_CPPFLAGS) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
fuzz/fuzz_ocsp_req.c
+41
View File
@@ -0,0 +1,41 @@
/*
* Copyright (C) 2023 Tobias Brunner
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include <library.h>
#include <utils/debug.h>
int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
{
certificate_t *cert;
chunk_t chunk;
dbg_default_set_level(-1);
library_init(NULL, "fuzz_ocsp_req");
plugin_loader_add_plugindirs(PLUGINDIR, PLUGINS);
if (!lib->plugins->load(lib->plugins, PLUGINS))
{
return 1;
}
chunk = chunk_create((u_char*)buf, len);
cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509_OCSP_REQUEST,
BUILD_BLOB, chunk, BUILD_END);
DESTROY_IF(cert);
lib->plugins->unload(lib->plugins);
library_deinit();
return 0;
}
fuzz/fuzz_ocsp_rsp.c
+41
View File
@@ -0,0 +1,41 @@
/*
* Copyright (C) 2023 Tobias Brunner
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include <library.h>
#include <utils/debug.h>
int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
{
certificate_t *cert;
chunk_t chunk;
dbg_default_set_level(-1);
library_init(NULL, "fuzz_ocsp_rsp");
plugin_loader_add_plugindirs(PLUGINDIR, PLUGINS);
if (!lib->plugins->load(lib->plugins, PLUGINS))
{
return 1;
}
chunk = chunk_create((u_char*)buf, len);
cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509_OCSP_RESPONSE,
BUILD_BLOB, chunk, BUILD_END);
DESTROY_IF(cert);
lib->plugins->unload(lib->plugins);
library_deinit();
return 0;
}
src/libstrongswan/credentials/certificates/certificate_printer.c
+5
View File
@@ -558,6 +558,11 @@ static void print_ocsp_response(private_certificate_printer_t *this,
fprintf(f, "\n");
}
enumerator->destroy(enumerator);
if (first)
{
fprintf(f, "(none)\n");
}
}
}
src/libstrongswan/credentials/certificates/ocsp_response.h
+7
View File
@@ -56,6 +56,13 @@ struct ocsp_response_t {
*/
certificate_t certificate;
/**
* Get general status of this OCSP response.
*
* @return OCSP status
*/
ocsp_status_t (*get_ocsp_status)(ocsp_response_t *this);
/**
* Get the nonce received with this OCSP response.
*
src/libstrongswan/plugins/revocation/revocation_validator.c
+7 -1
View File
@@ -121,8 +121,14 @@ static certificate_t *fetch_ocsp(char *url, certificate_t *subject,
request->destroy(request);
return NULL;
}
ocsp_request = (ocsp_request_t*)request;
ocsp_response = (ocsp_response_t*)response;
if (ocsp_response->get_ocsp_status(ocsp_response) != OCSP_SUCCESSFUL)
{
response->destroy(response);
request->destroy(request);
return NULL;
}
ocsp_request = (ocsp_request_t*)request;
if (ocsp_response->get_nonce(ocsp_response).len &&
!chunk_equals_const(ocsp_request->get_nonce(ocsp_request),
ocsp_response->get_nonce(ocsp_response)))
src/libstrongswan/plugins/x509/x509_ocsp_request.c
+5 -1
View File
@@ -205,9 +205,13 @@ static chunk_t build_requestList(private_x509_ocsp_request_t *this)
static chunk_t build_nonce(private_x509_ocsp_request_t *this)
{
rng_t *rng;
int nonce_len;
nonce_len = lib->settings->get_int(lib->settings, "%s.ocsp_nonce_len",
NONCE_LEN, lib->ns);
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (!rng || !rng->allocate_bytes(rng, NONCE_LEN, &this->nonce))
if (!rng || !rng->allocate_bytes(rng, max(1, nonce_len), &this->nonce))
{
DBG1(DBG_LIB, "failed to create RNG");
DESTROY_IF(rng);
src/libstrongswan/plugins/x509/x509_ocsp_response.c
+57 -47
View File
@@ -263,6 +263,12 @@ METHOD(ocsp_response_t, create_response_enumerator, enumerator_t*,
filter, NULL, NULL);
}
METHOD(ocsp_response_t, get_ocsp_status, ocsp_status_t,
private_x509_ocsp_response_t *this)
{
return this->ocsp_status;
}
METHOD(ocsp_response_t, get_nonce, chunk_t,
private_x509_ocsp_response_t *this)
{
@@ -612,49 +618,49 @@ static bool build_basicOCSPResponse(private_x509_ocsp_response_t *this,
* ASN.1 definition of basicResponse
*/
static const asn1Object_t basicResponseObjects[] = {
{ 0, "BasicOCSPResponse", ASN1_SEQUENCE, ASN1_NONE }, /* 0 */
{ 1, "tbsResponseData", ASN1_SEQUENCE, ASN1_OBJ }, /* 1 */
{ 2, "versionContext", ASN1_CONTEXT_C_0, ASN1_NONE |
ASN1_DEF }, /* 2 */
{ 3, "version", ASN1_INTEGER, ASN1_BODY }, /* 3 */
{ 2, "responderIdContext", ASN1_CONTEXT_C_1, ASN1_OPT }, /* 4 */
{ 3, "responderIdByName", ASN1_SEQUENCE, ASN1_OBJ }, /* 5 */
{ 2, "end choice", ASN1_EOC, ASN1_END }, /* 6 */
{ 2, "responderIdContext", ASN1_CONTEXT_C_2, ASN1_OPT }, /* 7 */
{ 3, "responderIdByKey", ASN1_OCTET_STRING, ASN1_BODY }, /* 8 */
{ 2, "end choice", ASN1_EOC, ASN1_END }, /* 9 */
{ 2, "producedAt", ASN1_GENERALIZEDTIME, ASN1_BODY }, /* 10 */
{ 2, "responses", ASN1_SEQUENCE, ASN1_OBJ }, /* 11 */
{ 2, "responseExtensionsContext", ASN1_CONTEXT_C_1, ASN1_OPT }, /* 12 */
{ 3, "responseExtensions", ASN1_SEQUENCE, ASN1_LOOP }, /* 13 */
{ 4, "extension", ASN1_SEQUENCE, ASN1_NONE }, /* 14 */
{ 5, "extnID", ASN1_OID, ASN1_BODY }, /* 15 */
{ 5, "critical", ASN1_BOOLEAN, ASN1_BODY |
ASN1_DEF }, /* 16 */
{ 5, "extnValue", ASN1_OCTET_STRING, ASN1_BODY }, /* 17 */
{ 3, "end loop", ASN1_EOC, ASN1_END }, /* 18 */
{ 2, "end opt", ASN1_EOC, ASN1_END }, /* 19 */
{ 1, "signatureAlgorithm", ASN1_EOC, ASN1_RAW }, /* 20 */
{ 1, "signature", ASN1_BIT_STRING, ASN1_BODY }, /* 21 */
{ 1, "certsContext", ASN1_CONTEXT_C_0, ASN1_OPT }, /* 22 */
{ 2, "certs", ASN1_SEQUENCE, ASN1_LOOP }, /* 23 */
{ 3, "certificate", ASN1_SEQUENCE, ASN1_RAW }, /* 24 */
{ 2, "end loop", ASN1_EOC, ASN1_END }, /* 25 */
{ 1, "end opt", ASN1_EOC, ASN1_END }, /* 26 */
{ 0, "exit", ASN1_EOC, ASN1_EXIT }
{ 0, "BasicOCSPResponse", ASN1_SEQUENCE, ASN1_NONE }, /* 0 */
{ 1, "tbsResponseData", ASN1_SEQUENCE, ASN1_OBJ }, /* 1 */
{ 2, "versionContext", ASN1_CONTEXT_C_0, ASN1_NONE|ASN1_DEF }, /* 2 */
{ 3, "version", ASN1_INTEGER, ASN1_BODY }, /* 3 */
{ 2, "responderId", ASN1_EOC, ASN1_CHOICE }, /* 4 */
{ 3, "responderIdContext", ASN1_CONTEXT_C_1, ASN1_OPT }, /* 5 */
{ 4, "responderIdByName", ASN1_SEQUENCE, ASN1_OBJ }, /* 6 */
{ 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 7 */
{ 3, "responderIdContext", ASN1_CONTEXT_C_2, ASN1_OPT }, /* 8 */
{ 4, "responderIdByKey", ASN1_OCTET_STRING, ASN1_BODY }, /* 9 */
{ 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 10 */
{ 2, "end choices", ASN1_EOC, ASN1_END|ASN1_CHOICE }, /* 11 */
{ 2, "producedAt", ASN1_GENERALIZEDTIME, ASN1_BODY }, /* 12 */
{ 2, "responses", ASN1_SEQUENCE, ASN1_OBJ }, /* 13 */
{ 2, "responseExtensionsContext", ASN1_CONTEXT_C_1, ASN1_OPT }, /* 14 */
{ 3, "responseExtensions", ASN1_SEQUENCE, ASN1_LOOP }, /* 15 */
{ 4, "extension", ASN1_SEQUENCE, ASN1_NONE }, /* 16 */
{ 5, "extnID", ASN1_OID, ASN1_BODY }, /* 17 */
{ 5, "critical", ASN1_BOOLEAN, ASN1_BODY | ASN1_DEF }, /* 18 */
{ 5, "extnValue", ASN1_OCTET_STRING, ASN1_BODY }, /* 19 */
{ 3, "end loop", ASN1_EOC, ASN1_END }, /* 20 */
{ 2, "end opt", ASN1_EOC, ASN1_END }, /* 21 */
{ 1, "signatureAlgorithm", ASN1_EOC, ASN1_RAW }, /* 22 */
{ 1, "signature", ASN1_BIT_STRING, ASN1_BODY }, /* 23 */
{ 1, "certsContext", ASN1_CONTEXT_C_0, ASN1_OPT }, /* 24 */
{ 2, "certs", ASN1_SEQUENCE, ASN1_LOOP }, /* 25 */
{ 3, "certificate", ASN1_SEQUENCE, ASN1_RAW }, /* 26 */
{ 2, "end loop", ASN1_EOC, ASN1_END }, /* 27 */
{ 1, "end opt", ASN1_EOC, ASN1_END }, /* 28 */
{ 0, "exit", ASN1_EOC, ASN1_EXIT }
};
#define BASIC_RESPONSE_TBS_DATA 1
#define BASIC_RESPONSE_VERSION 3
#define BASIC_RESPONSE_ID_BY_NAME 5
#define BASIC_RESPONSE_ID_BY_KEY 8
#define BASIC_RESPONSE_PRODUCED_AT 10
#define BASIC_RESPONSE_RESPONSES 11
#define BASIC_RESPONSE_EXT_ID 15
#define BASIC_RESPONSE_CRITICAL 16
#define BASIC_RESPONSE_EXT_VALUE 17
#define BASIC_RESPONSE_ALGORITHM 20
#define BASIC_RESPONSE_SIGNATURE 21
#define BASIC_RESPONSE_CERTIFICATE 24
#define BASIC_RESPONSE_ID_BY_NAME 6
#define BASIC_RESPONSE_ID_BY_KEY 9
#define BASIC_RESPONSE_PRODUCED_AT 12
#define BASIC_RESPONSE_RESPONSES 13
#define BASIC_RESPONSE_EXT_ID 17
#define BASIC_RESPONSE_CRITICAL 18
#define BASIC_RESPONSE_EXT_VALUE 19
#define BASIC_RESPONSE_ALGORITHM 22
#define BASIC_RESPONSE_SIGNATURE 23
#define BASIC_RESPONSE_CERTIFICATE 26
/**
* Parse a basicOCSPResponse
@@ -756,11 +762,6 @@ end:
parser->destroy(parser);
if (success)
{
if (!this->responderId)
{
this->responderId = identification_create_from_encoding(ID_ANY,
chunk_empty);
}
success = parse_responses(this, responses, responses_level);
}
return success;
@@ -826,6 +827,10 @@ static bool parse_OCSPResponse(private_x509_ocsp_response_t *this)
switch (objectID)
{
case OCSP_RESPONSE_STATUS:
if (object.len != 1)
{
goto end;
}
this->ocsp_status = (ocsp_status_t)*object.ptr;
switch (this->ocsp_status)
{
@@ -878,7 +883,11 @@ METHOD(certificate_t, get_issuer, identification_t*,
METHOD(certificate_t, has_issuer, id_match_t,
private_x509_ocsp_response_t *this, identification_t *issuer)
{
return this->responderId->matches(this->responderId, issuer);
if (this->responderId)
{
return this->responderId->matches(this->responderId, issuer);
}
return ID_MATCH_NONE;
}
METHOD(certificate_t, issued_by, bool,
@@ -889,7 +898,7 @@ METHOD(certificate_t, issued_by, bool,
bool valid;
x509_t *x509 = (x509_t*)issuer;
if (issuer->get_type(issuer) != CERT_X509)
if (issuer->get_type(issuer) != CERT_X509 || !this->responderId)
{
return FALSE;
}
@@ -1050,6 +1059,7 @@ static private_x509_ocsp_response_t *create_empty()
.get_ref = _get_ref,
.destroy = _destroy,
},
.get_ocsp_status = _get_ocsp_status,
.get_nonce = _get_nonce,
.get_status = _get_status,
.create_cert_enumerator = _create_cert_enumerator,
src/pki/commands/ocsp.c
+5
View File
@@ -528,6 +528,11 @@ gen:
ocsp_status = OCSP_INTERNALERROR;
}
}
else
{
DBG1(DBG_APP, "no signer certificate found");
ocsp_status = OCSP_INTERNALERROR;
}
DBG1(DBG_APP, "ocspResponseStatus: %N", ocsp_status_names, ocsp_status);
enumerator = responses->create_enumerator(responses);