Changeset b888e8b in mod_gnutls

Timestamp:

Nov 1, 2016, 7:20:42 AM (3 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, upstream

Children:

b26a792

Parents:

b34a67e

git-author:

Thomas Klute <thomas2.klute@…> (10/31/16 19:42:11)

git-committer:

Thomas Klute <thomas2.klute@…> (11/01/16 07:20:42)

Message:

New directive GnuTLSOCSPCheckNonce

Some CAs refuse to send nonces in their OCSP responses, probably
because that way they can cache responses. This makes nonce
verification fail, so give the user an option disable it.

Files:

• doc/mod_gnutls_manual.mdwn (modified) (1 diff)
• include/mod_gnutls.h.in (modified) (1 diff)
• src/gnutls_config.c (modified) (2 diffs)
• src/gnutls_ocsp.c (modified) (4 diffs)
• src/gnutls_ocsp.h (modified) (1 diff)
• src/mod_gnutls.c (modified) (1 diff)

doc/mod_gnutls_manual.mdwn

@@ -553 +553 @@
 
 OCSP cache updates are serialized using the `gnutls-ocsp` mutex.
+
+### GnuTLSOCSPCheckNonce
+
+Check the nonce in OCSP responses?
+
+    GnuTLSOCSPCheckNonce [On|Off]
+
+Default: *on*\
+Context: server config, virtual host
+
+Some CAs refuse to send nonces in their OCSP responses, probably
+because that way they can cache responses. If your CA is one of them
+you can use this flag to disable nonce verification. Note that
+`mod_gnutls` will _send_ a nonce either way.
 
 ### GnuTLSOCSPResponseFile

include/mod_gnutls.h.in

@@ -213 +213 @@
     /* Enable OCSP stapling */
     unsigned char ocsp_staple;
+    /* Check nonce in OCSP responses? */
+    unsigned char ocsp_check_nonce;
     /* Read OCSP response for stapling from this file instead of
      * sending a request over HTTP */

src/gnutls_config.c

@@ -1127 +1127 @@
 
     sc->ocsp_staple = GNUTLS_ENABLED_UNSET;
+    sc->ocsp_check_nonce = GNUTLS_ENABLED_UNSET;
     sc->ocsp_response_file = NULL;
     sc->ocsp_mutex = NULL;
@@ -1190 +1191 @@
 
     gnutls_srvconf_merge(ocsp_staple, GNUTLS_ENABLED_UNSET);
+    gnutls_srvconf_merge(ocsp_check_nonce, GNUTLS_ENABLED_UNSET);
     gnutls_srvconf_assign(ocsp_response_file);
     gnutls_srvconf_merge(ocsp_grace_time, MGS_TIMEOUT_UNSET);

src/gnutls_ocsp.c

@@ -83 +83 @@
     else
         sc->ocsp_staple = GNUTLS_ENABLED_FALSE;
+
+    return NULL;
+}
+
+
+
+const char *mgs_set_ocsp_check_nonce(cmd_parms *parms,
+                                     void *dummy __attribute__((unused)),
+                                     const int arg)
+{
+    mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
+        ap_get_module_config(parms->server->module_config, &gnutls_module);
+
+    if (arg)
+        sc->ocsp_check_nonce = GNUTLS_ENABLED_TRUE;
+    else
+        sc->ocsp_check_nonce = GNUTLS_ENABLED_FALSE;
 
     return NULL;
@@ -276 +293 @@
     }
 
-    if (nonce != NULL)
+    /* Even some large CAs do not support nonces, probably because
+     * that way they can cache responses. :-/ */
+    if (nonce != NULL && sc->ocsp_check_nonce)
     {
         gnutls_datum_t resp_nonce;
@@ -617 +636 @@
     {
         gnutls_datum_t req;
-        /* mod_ssl offers an option to enable/disable nonces for
-         * broken responders. If needed at some point, we could do the
-         * same by passing NULL instead of &nonce. */
         int ret = mgs_create_ocsp_request(s, &req, &nonce);
         if (ret == GNUTLS_E_SUCCESS)
@@ -905 +921 @@
     }
 
-    /* set default values for unset timeouts */
+    /* set default values for unset parameters */
+    if (sc->ocsp_check_nonce == GNUTLS_ENABLED_UNSET)
+        sc->ocsp_check_nonce = GNUTLS_ENABLED_TRUE;
     if (sc->ocsp_grace_time == MGS_TIMEOUT_UNSET)
         sc->ocsp_grace_time = apr_time_from_sec(MGS_OCSP_GRACE_TIME);

src/gnutls_ocsp.h

@@ -54 +54 @@
                                      const int arg);
 
+const char *mgs_set_ocsp_check_nonce(cmd_parms *parms,
+                                     void *dummy __attribute__((unused)),
+                                     const int arg);
+
 const char *mgs_store_ocsp_response_path(cmd_parms * parms,
                                          void *dummy __attribute__((unused)),

src/mod_gnutls.c

@@ -275 +275 @@
                  NULL, RSRC_CONF,
                  "Enable OCSP stapling"),
+    AP_INIT_FLAG("GnuTLSOCSPCheckNonce", mgs_set_ocsp_check_nonce,
+                 NULL, RSRC_CONF,
+                 "Check nonce in OCSP responses?"),
     AP_INIT_TAKE1("GnuTLSOCSPResponseFile", mgs_store_ocsp_response_path,
                   NULL, RSRC_CONF,