Changeset 87d7f89 in mod_gnutls

Timestamp:

Apr 4, 2020, 1:07:28 PM (3 years ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, main, master, proxy-ticket

Children:

ee35a9f

Parents:

e932ba5

Message:

Send OCSP nonce only if GnuTLSOCSPCheckNonce is enabled

Files:

• doc/mod_gnutls_manual.md (modified) (2 diffs)
• src/gnutls_ocsp.c (modified) (2 diffs)

doc/mod_gnutls_manual.md

@@ -640 +640 @@
 ### GnuTLSOCSPCheckNonce
 
-Check the nonce in OCSP responses?
+Send nonces in OCSP requests and verify them in responses.
 
     GnuTLSOCSPCheckNonce [On|Off]
@@ -647 +647 @@
 Context: server config, virtual host
 
-Most CAs do not to send nonces in their OCSP responses, probably
-because that way they can cache responses, which is [explicitly
-allowed by RFC
-6960](https://tools.ietf.org/html/rfc6960#section-2.5). You can enable
-`GnuTLSOCSPCheckNonce` to enforce nonce validation if your CA is one
-that supports OCSP nonces. Note that `mod_gnutls` will _send_ a nonce
-either way.
+If `GnuTLSOCSPCheckNonce` is enabled, `mod_gnutls` will send nonces in
+OCSP requests and verify them in responses. Responses without a nonce
+or with a mismatching one will be considered invalid and discarded.
+
+This option is disabled by default because many CAs do not support the
+OCSP nonce extension. The likely reason for that is the use of
+pre-produced responses, as described in [RFC 6960, Section
+2.5](https://tools.ietf.org/html/rfc6960#section-2.5).
 
 ### GnuTLSOCSPResponseFile

src/gnutls_ocsp.c

@@ -213 +213 @@
     }
 
-    ret = gnutls_ocsp_req_randomize_nonce(r);
-    if (ret != GNUTLS_E_SUCCESS)
-    {
-        ap_log_error(APLOG_MARK, APLOG_ERR, APR_EGENERAL, s,
-                     "OCSP nonce creation failed: %s (%d)",
-                     gnutls_strerror(ret), ret);
-        gnutls_ocsp_req_deinit(r);
-        return ret;
-    }
-
     if (nonce != NULL)
     {
+        ret = gnutls_ocsp_req_randomize_nonce(r);
+        if (ret != GNUTLS_E_SUCCESS)
+        {
+            ap_log_error(APLOG_MARK, APLOG_ERR, APR_EGENERAL, s,
+                         "OCSP nonce creation failed: %s (%d)",
+                         gnutls_strerror(ret), ret);
+            gnutls_ocsp_req_deinit(r);
+            return ret;
+        }
+
         ret = gnutls_ocsp_req_get_nonce(r, NULL, nonce);
         if (ret != GNUTLS_E_SUCCESS)
@@ -706 +706 @@
     {
         gnutls_datum_t req;
-        int ret = mgs_create_ocsp_request(s, req_data, &req, &nonce);
+        int ret = mgs_create_ocsp_request(s, req_data, &req,
+                                          sc->ocsp_check_nonce ? &nonce : NULL);
         if (ret == GNUTLS_E_SUCCESS)
         {