Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

wfe2: Check nonce length #7045

Merged
merged 6 commits into from
Aug 22, 2023
Merged

wfe2: Check nonce length #7045

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
afb003c
wfe2: Check nonce length
pgporada Aug 21, 2023
a9ee42c
Revert unnecessary white space changes
pgporada Aug 21, 2023
2bb8bfe
Add comment to shortNonce
pgporada Aug 21, 2023
63cc123
Change operator to less than or equal
pgporada Aug 21, 2023
75e9498
Fix test
pgporada Aug 21, 2023
e284ab9
Fix wording, again
pgporada Aug 21, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions wfe2/verify.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,6 +191,9 @@ func (wfe *WebFrontEndImpl) validPOSTRequest(request *http.Request) *probs.Probl
// the nonce redemption service.
func nonceWellFormed(nonceHeader string, prefixLen int) *probs.ProblemDetails {
errBadNonce := probs.BadNonce(fmt.Sprintf("JWS has an invalid anti-replay nonce: %q", nonceHeader))
if len(nonceHeader) < prefixLen {
pgporada marked this conversation as resolved.
Show resolved Hide resolved
return errBadNonce
}
body, err := base64.RawURLEncoding.DecodeString(nonceHeader[prefixLen:])
if err != nil {
// Nonce was not valid base64url.
Expand Down
65 changes: 56 additions & 9 deletions wfe2/verify_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -268,6 +268,39 @@ func (rs requestSigner) malformedNonce() *jose.JSONWebSignature {
return parsedJWS
}

// shortNonce returns an otherwise well-signed request with a nonce shorter than
// the prefix length.
func (rs requestSigner) shortNonce() *jose.JSONWebSignature {
privateKey := loadKey(rs.t, []byte(test1KeyPrivatePEM))
jwk := &jose.JSONWebKey{
Key: privateKey,
Algorithm: keyAlgForKey(rs.t, privateKey),
KeyID: "http://localhost/acme/acct/1",
}
signerKey := jose.SigningKey{
Key: jwk,
Algorithm: jose.RS256,
}

opts := &jose.SignerOptions{
NonceSource: badNonceProvider{shortNonce: true},
ExtraHeaders: map[jose.HeaderKey]interface{}{
"url": "https://example.com/acme/foo",
},
}

signer, err := jose.NewSigner(signerKey, opts)
test.AssertNotError(rs.t, err, "Failed to make signer")
jws, err := signer.Sign([]byte(""))
test.AssertNotError(rs.t, err, "Failed to sign req")

body := jws.FullSerialize()
parsedJWS, err := jose.ParseSigned(body)
test.AssertNotError(rs.t, err, "Failed to parse generated JWS")

return parsedJWS
}

func TestRejectsNone(t *testing.T) {
noneJWSBody := `
{
Expand Down Expand Up @@ -576,15 +609,15 @@ func TestEnforceJWSAuthType(t *testing.T) {
conflictJWSBody := `
{
"header": {
"alg": "RS256",
"alg": "RS256",
"jwk": {
"e": "AQAB",
"kty": "RSA",
"e": "AQAB",
"kty": "RSA",
"n": "ppbqGaMFnnq9TeMUryR6WW4Lr5WMgp46KlBXZkNaGDNQoifWt6LheeR5j9MgYkIFU7Z8Jw5-bpJzuBeEVwb-yHGh4Umwo_qKtvAJd44iLjBmhBSxq-OSe6P5hX1LGCByEZlYCyoy98zOtio8VK_XyS5VoOXqchCzBXYf32ksVUTrtH1jSlamKHGz0Q0pRKIsA2fLqkE_MD3jP6wUDD6ExMw_tKYLx21lGcK41WSrRpDH-kcZo1QdgCy2ceNzaliBX1eHmKG0-H8tY4tPQudk-oHQmWTdvUIiHO6gSKMGDZNWv6bq74VTCsRfUEAkuWhqUhgRSGzlvlZ24wjHv5Qdlw"
}
},
"protected": "eyJub25jZSI6ICJibTl1WTJVIiwgInVybCI6ICJodHRwOi8vbG9jYWxob3N0L3Rlc3QiLCAia2lkIjogInRlc3RrZXkifQ",
"payload": "Zm9v",
},
"protected": "eyJub25jZSI6ICJibTl1WTJVIiwgInVybCI6ICJodHRwOi8vbG9jYWxob3N0L3Rlc3QiLCAia2lkIjogInRlc3RrZXkifQ",
"payload": "Zm9v",
"signature": "ghTIjrhiRl2pQ09vAkUUBbF5KziJdhzOTB-okM9SPRzU8Hyj0W1H5JA1Zoc-A-LuJGNAtYYHWqMw1SeZbT0l9FHcbMPeWDaJNkHS9jz5_g_Oyol8vcrWur2GDtB2Jgw6APtZKrbuGATbrF7g41Wijk6Kk9GXDoCnlfOQOhHhsrFFcWlCPLG-03TtKD6EBBoVBhmlp8DRLs7YguWRZ6jWNaEX-1WiRntBmhLqoqQFtvZxCBw_PRuaRw_RZBd1x2_BNYqEdOmVNC43UHMSJg3y_3yrPo905ur09aUTscf-C_m4Sa4M0FuDKn3bQ_pFrtz-aCCq6rcTIyxYpDqNvHMT2Q"
}
`
Expand Down Expand Up @@ -666,13 +699,17 @@ func TestEnforceJWSAuthType(t *testing.T) {
}

type badNonceProvider struct {
malformed bool
malformed bool
shortNonce bool
}

func (b badNonceProvider) Nonce() (string, error) {
if b.malformed {
return "im-a-nonce", nil
}
if b.shortNonce {
return "wow", nil
pgporada marked this conversation as resolved.
Show resolved Hide resolved
}
if os.Getenv("BOULDER_CONFIG_DIR") != "test/config-next" {
// TODO(#6610): Remove this.
return "mlol3ov77I5Ui-cdaY_k8IcjK58FvbG0y_BCRrx5rGQ8rjA", nil
Expand Down Expand Up @@ -715,6 +752,16 @@ func TestValidNonce(t *testing.T) {
},
ErrorStatType: "JWSMalformedNonce",
},
{
Name: "Canned nonce shorter than prefixLength in JWS",
JWS: signer.shortNonce(),
ExpectedResult: &probs.ProblemDetails{
Type: probs.BadNonceProblem,
Detail: "JWS has an invalid anti-replay nonce: \"wow\"",
HTTPStatus: http.StatusBadRequest,
},
ErrorStatType: "JWSMalformedNonce",
},
{
Name: "Invalid nonce in JWS (test/config)",
JWS: signer.invalidNonce(),
Expand Down Expand Up @@ -963,15 +1010,15 @@ func TestParseJWSRequest(t *testing.T) {
"alg": "RS256",
"kid": "unprotected key id"
},
"protected": "eyJub25jZSI6ICJibTl1WTJVIiwgInVybCI6ICJodHRwOi8vbG9jYWxob3N0L3Rlc3QiLCAia2lkIjogInRlc3RrZXkifQ",
"protected": "eyJub25jZSI6ICJibTl1WTJVIiwgInVybCI6ICJodHRwOi8vbG9jYWxob3N0L3Rlc3QiLCAia2lkIjogInRlc3RrZXkifQ",
pgporada marked this conversation as resolved.
Show resolved Hide resolved
"payload": "Zm9v",
"signature": "PKWWclRsiHF4bm-nmpxDez6Y_3Mdtu263YeYklbGYt1EiMOLiKY_dr_EqhUUKAKEWysFLO-hQLXVU7kVkHeYWQFFOA18oFgcZgkSF2Pr3DNZrVj9e2gl0eZ2i2jk6X5GYPt1lIfok_DrL92wrxEKGcrmxqXXGm0JgP6Al2VGapKZK2HaYbCHoGvtzNmzUX9rC21sKewq5CquJRvTmvQp5bmU7Q9KeafGibFr0jl6IA3W5LBGgf6xftuUtEVEbKmKaKtaG7tXsQH1mIVOPUZZoLWz9sWJSFLmV0QSXm3ZHV0DrOhLfcADbOCoQBMeGdseBQZuUO541A3BEKGv2Aikjw"
}
`

wrongSignaturesFieldJWSBody := `
{
"protected": "eyJub25jZSI6ICJibTl1WTJVIiwgInVybCI6ICJodHRwOi8vbG9jYWxob3N0L3Rlc3QiLCAia2lkIjogInRlc3RrZXkifQ",
"protected": "eyJub25jZSI6ICJibTl1WTJVIiwgInVybCI6ICJodHRwOi8vbG9jYWxob3N0L3Rlc3QiLCAia2lkIjogInRlc3RrZXkifQ",
"payload": "Zm9v",
"signatures": ["PKWWclRsiHF4bm-nmpxDez6Y_3Mdtu263YeYklbGYt1EiMOLiKY_dr_EqhUUKAKEWysFLO-hQLXVU7kVkHeYWQFFOA18oFgcZgkSF2Pr3DNZrVj9e2gl0eZ2i2jk6X5GYPt1lIfok_DrL92wrxEKGcrmxqXXGm0JgP6Al2VGapKZK2HaYbCHoGvtzNmzUX9rC21sKewq5CquJRvTmvQp5bmU7Q9KeafGibFr0jl6IA3W5LBGgf6xftuUtEVEbKmKaKtaG7tXsQH1mIVOPUZZoLWz9sWJSFLmV0QSXm3ZHV0DrOhLfcADbOCoQBMeGdseBQZuUO541A3BEKGv2Aikjw"]
}
Expand Down