mirror of
https://github.com/zeek/zeek.git
synced 2025-10-14 04:28:20 +00:00
Merge remote-tracking branch 'origin/topic/johanna/ocsp-sct-validate'
Closes #1830. * origin/topic/johanna/ocsp-sct-validate: (82 commits) Tiny script changes for SSL. Update CT Log list SSL: Update OCSP/SCT scripts and documentation. Revert "add parameter 'status_type' to event ssl_stapled_ocsp" Revert "parse multiple OCSP stapling responses" SCT: Fix script error when mime type of file unknown. SCT: another memory leak in SCT parsing. SCT validation: fix small memory leak (public keys were not freed) Change end-of-connection handling for validation OCSP/TLS/SCT: Fix a number of test failures. SCT Validate: make caching a bit less aggressive. SSL: Fix type of ssl validation result TLS-SCT: compile on old versions of OpenSSL (1.0.1...) SCT: Add caching support for validation SCT: Add signed certificate timestamp validation script. SCT: Allow verification of SCTs in Certs. SCT: only compare correct OID/NID for Cert/OCSP. SCT: add validation of proofs for extensions and OCSP. SCT: pass timestamp as uint64 instead of time Add CT log information to Bro ...
This commit is contained in:
Robin Sommer
commit
faa4150154
86 changed files with 2672 additions and 445 deletions
43
testing/btest/scripts/base/protocols/ssl/ocsp-http-get.test
Normal file
43
testing/btest/scripts/base/protocols/ssl/ocsp-http-get.test
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
# This tests a normal OCSP request sent through HTTP GET
|
||||
|
||||
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-http-get.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff ocsp.log
|
||||
# @TEST-EXEC: btest-diff .stdout
|
||||
|
||||
@load files/x509/log-ocsp
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REQUEST, "application/ocsp-request");
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response");
|
||||
}
|
||||
|
||||
event ocsp_extension(f: fa_file, ext: X509::Extension, global_resp: bool)
|
||||
{
|
||||
print "extension: ", ext, global_resp;
|
||||
}
|
||||
|
||||
event ocsp_request(f: fa_file, version: count, requestorName: string)
|
||||
{
|
||||
print "request", version, requestorName;
|
||||
}
|
||||
|
||||
event ocsp_request_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string)
|
||||
{
|
||||
print "request cert", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber;
|
||||
}
|
||||
|
||||
event ocsp_response_status(f: fa_file, status: string)
|
||||
{
|
||||
print "ocsp_response_status", status;
|
||||
}
|
||||
|
||||
event ocsp_response_bytes(f: fa_file, resp_ref: opaque of ocsp_resp, status: string, version: count, responderId: string, producedAt: time, signatureAlgorithm: string, certs: x509_opaque_vector)
|
||||
{
|
||||
print "ocsp_response_bytes", status, version, responderId, producedAt, signatureAlgorithm;
|
||||
}
|
||||
|
||||
event ocsp_response_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string, certStatus: string, revoketime: time, revokereason: string, thisUpdate: time, nextUpdate: time)
|
||||
{
|
||||
print "ocsp_response_certificate", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber, certStatus, revoketime, revokereason, thisUpdate, nextUpdate;
|
||||
}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
# This tests a OCSP request missing response
|
||||
|
||||
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-request-only.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff .stdout
|
||||
|
||||
@load files/x509/log-ocsp
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REQUEST, "application/ocsp-request");
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response");
|
||||
}
|
||||
|
||||
event ocsp_extension(f: fa_file, ext: X509::Extension, global_resp: bool)
|
||||
{
|
||||
print "extension: ", ext, global_resp;
|
||||
}
|
||||
|
||||
event ocsp_request(f: fa_file, version: count, requestorName: string)
|
||||
{
|
||||
print "request", version, requestorName;
|
||||
}
|
||||
|
||||
event ocsp_request_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string)
|
||||
{
|
||||
print "request cert", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber;
|
||||
}
|
||||
|
||||
event ocsp_response_status(f: fa_file, status: string)
|
||||
{
|
||||
print "ocsp_response_status", status;
|
||||
}
|
||||
|
||||
event ocsp_response_bytes(f: fa_file, resp_ref: opaque of ocsp_resp, status: string, version: count, responderId: string, producedAt: time, signatureAlgorithm: string, certs: x509_opaque_vector)
|
||||
{
|
||||
print "ocsp_response_bytes", status, version, responderId, producedAt, signatureAlgorithm;
|
||||
}
|
||||
|
||||
event ocsp_response_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string, certStatus: string, revoketime: time, revokereason: string, thisUpdate: time, nextUpdate: time)
|
||||
{
|
||||
print "ocsp_response_certificate", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber, certStatus, revoketime, revokereason, thisUpdate, nextUpdate;
|
||||
}
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
# This tests a pair of normal OCSP request and response
|
||||
|
||||
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-request-response.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff ocsp.log
|
||||
# @TEST-EXEC: btest-diff .stdout
|
||||
|
||||
@load files/x509/log-ocsp
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REQUEST, "application/ocsp-request");
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response");
|
||||
}
|
||||
|
||||
event ocsp_extension(f: fa_file, ext: X509::Extension, global_resp: bool)
|
||||
{
|
||||
print "extension: ", ext, global_resp;
|
||||
}
|
||||
|
||||
event ocsp_request(f: fa_file, version: count, requestorName: string)
|
||||
{
|
||||
print "request", version, requestorName;
|
||||
}
|
||||
|
||||
event ocsp_request_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string)
|
||||
{
|
||||
print "request cert", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber;
|
||||
}
|
||||
|
||||
event ocsp_response_status(f: fa_file, status: string)
|
||||
{
|
||||
print "ocsp_response_status", status;
|
||||
}
|
||||
|
||||
event ocsp_response_bytes(f: fa_file, resp_ref: opaque of ocsp_resp, status: string, version: count, responderId: string, producedAt: time, signatureAlgorithm: string, certs: x509_opaque_vector)
|
||||
{
|
||||
print "ocsp_response_bytes", status, version, responderId, producedAt, signatureAlgorithm;
|
||||
}
|
||||
|
||||
event ocsp_response_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string, certStatus: string, revoketime: time, revokereason: string, thisUpdate: time, nextUpdate: time)
|
||||
{
|
||||
print "ocsp_response_certificate", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber, certStatus, revoketime, revokereason, thisUpdate, nextUpdate;
|
||||
}
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
# This tests a normal OCSP response missing request
|
||||
|
||||
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-response-only.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff ocsp.log
|
||||
# @TEST-EXEC: btest-diff .stdout
|
||||
|
||||
@load files/x509/log-ocsp
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REQUEST, "application/ocsp-request");
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response");
|
||||
}
|
||||
|
||||
event ocsp_extension(f: fa_file, ext: X509::Extension, global_resp: bool)
|
||||
{
|
||||
print "extension: ", ext, global_resp;
|
||||
}
|
||||
|
||||
event ocsp_request(f: fa_file, version: count, requestorName: string)
|
||||
{
|
||||
print "request", version, requestorName;
|
||||
}
|
||||
|
||||
event ocsp_request_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string)
|
||||
{
|
||||
print "request cert", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber;
|
||||
}
|
||||
|
||||
event ocsp_response_status(f: fa_file, status: string)
|
||||
{
|
||||
print "ocsp_response_status", status;
|
||||
}
|
||||
|
||||
event ocsp_response_bytes(f: fa_file, resp_ref: opaque of ocsp_resp, status: string, version: count, responderId: string, producedAt: time, signatureAlgorithm: string, certs: x509_opaque_vector)
|
||||
{
|
||||
print "ocsp_response_bytes", status, version, responderId, producedAt, signatureAlgorithm;
|
||||
}
|
||||
|
||||
event ocsp_response_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string, certStatus: string, revoketime: time, revokereason: string, thisUpdate: time, nextUpdate: time)
|
||||
{
|
||||
print "ocsp_response_certificate", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber, certStatus, revoketime, revokereason, thisUpdate, nextUpdate;
|
||||
}
|
||||
43
testing/btest/scripts/base/protocols/ssl/ocsp-revoked.test
Normal file
43
testing/btest/scripts/base/protocols/ssl/ocsp-revoked.test
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
# This tests OCSP response with revocation
|
||||
|
||||
# @TEST-EXEC: bro -C -r $TRACES/tls/ocsp-revoked.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff ocsp.log
|
||||
# @TEST-EXEC: btest-diff .stdout
|
||||
|
||||
@load files/x509/log-ocsp
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REQUEST, "application/ocsp-request");
|
||||
Files::register_for_mime_type(Files::ANALYZER_OCSP_REPLY, "application/ocsp-response");
|
||||
}
|
||||
|
||||
event ocsp_extension(f: fa_file, ext: X509::Extension, global_resp: bool)
|
||||
{
|
||||
print "extension: ", ext, global_resp;
|
||||
}
|
||||
|
||||
event ocsp_request(f: fa_file, version: count, requestorName: string)
|
||||
{
|
||||
print "request", version, requestorName;
|
||||
}
|
||||
|
||||
event ocsp_request_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string)
|
||||
{
|
||||
print "request cert", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber;
|
||||
}
|
||||
|
||||
event ocsp_response_status(f: fa_file, status: string)
|
||||
{
|
||||
print "ocsp_response_status", status;
|
||||
}
|
||||
|
||||
event ocsp_response_bytes(f: fa_file, resp_ref: opaque of ocsp_resp, status: string, version: count, responderId: string, producedAt: time, signatureAlgorithm: string, certs: x509_opaque_vector)
|
||||
{
|
||||
print "ocsp_response_bytes", status, version, responderId, producedAt, signatureAlgorithm;
|
||||
}
|
||||
|
||||
event ocsp_response_certificate(f: fa_file, hashAlgorithm: string, issuerNameHash: string, issuerKeyHash: string, serialNumber: string, certStatus: string, revoketime: time, revokereason: string, thisUpdate: time, nextUpdate: time)
|
||||
{
|
||||
print "ocsp_response_certificate", hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber, certStatus, revoketime, revokereason, thisUpdate, nextUpdate;
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/tls/signed_certificate_timestamp.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff .stdout
|
||||
|
||||
export {
|
||||
type LogInfo: record {
|
||||
version: count;
|
||||
logid: string;
|
||||
timestamp: count;
|
||||
sig_alg: count;
|
||||
hash_alg: count;
|
||||
signature: string;
|
||||
};
|
||||
}
|
||||
|
||||
redef record SSL::Info += {
|
||||
ct_proofs: vector of LogInfo &default=vector();
|
||||
};
|
||||
|
||||
event ssl_extension_signed_certificate_timestamp(c: connection, is_orig: bool, version: count, logid: string, timestamp: count, signature_and_hashalgorithm: SSL::SignatureAndHashAlgorithm, signature: string)
|
||||
{
|
||||
print version, SSL::ct_logs[logid]$description, double_to_time(timestamp/1000.0), signature_and_hashalgorithm;
|
||||
c$ssl$ct_proofs[|c$ssl$ct_proofs|] = LogInfo($version=version, $logid=logid, $timestamp=timestamp, $sig_alg=signature_and_hashalgorithm$SignatureAlgorithm, $hash_alg=signature_and_hashalgorithm$HashAlgorithm, $signature=signature);
|
||||
}
|
||||
|
||||
event ssl_established(c: connection)
|
||||
{
|
||||
if ( ! c$ssl?$cert_chain || |c$ssl$cert_chain| == 0 || ! c$ssl$cert_chain[0]?$x509 )
|
||||
return;
|
||||
|
||||
local cert = c$ssl$cert_chain[0]$x509$handle;
|
||||
|
||||
for ( i in c$ssl$ct_proofs )
|
||||
{
|
||||
local log = c$ssl$ct_proofs[i];
|
||||
|
||||
print "Verify of", SSL::ct_logs[log$logid]$description, sct_verify(cert, log$logid, SSL::ct_logs[log$logid]$key, log$signature, log$timestamp, log$hash_alg);
|
||||
print "Bad verify of", SSL::ct_logs[log$logid]$description, sct_verify(cert, log$logid, SSL::ct_logs[log$logid]$key, log$signature, log$timestamp+1, log$hash_alg);
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue