Add nonce checks to OCSP lookups

Author: markt-asf

native/src/sslutils.c

@@ -950,6 +950,9 @@ static OCSP_REQUEST *get_ocsp_request(X509 *cert, X509 *issuer)
         return NULL;
     }
 
+    // Add a nonce to protect against replay attacks
+    OCSP_request_add1_nonce(ocsp_req, NULL, -1);
+
     return ocsp_req;
 }
 
@@ -1006,7 +1009,8 @@ static OCSP_RESPONSE *get_ocsp_response(apr_pool_t *p, char *url, OCSP_REQUEST *
 /* Process the OCSP_RESPONSE and returns the corresponding
    answer according to the status.
 */
-static int process_ocsp_response(OCSP_RESPONSE *ocsp_resp, X509 *cert, X509 *issuer)
+static int process_ocsp_response(OCSP_REQUEST *ocsp_req, OCSP_RESPONSE *ocsp_resp, X509 *cert, X509 *issuer,
+        X509_STORE_CTX *ctx)
 {
     int r, o = V_OCSP_CERTSTATUS_UNKNOWN, i;
     OCSP_BASICRESP *bs;
@@ -1018,7 +1022,13 @@ static int process_ocsp_response(OCSP_RESPONSE *ocsp_resp, X509 *cert, X509 *iss
     if (r != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
         return OCSP_STATUS_UNKNOWN;
     }
+    
     bs = OCSP_response_get1_basic(ocsp_resp);
+    if (OCSP_check_nonce(ocsp_req, bs) == 0) {
+        X509_STORE_CTX_set_error(ctx, X509_V_ERR_OCSP_RESP_INVALID);
+        o = OCSP_STATUS_UNKNOWN;
+        goto clean_bs;
+    }
 
     certid = OCSP_cert_to_id(NULL, cert, issuer);
     if (certid == NULL) {
@@ -1037,6 +1047,7 @@ static int process_ocsp_response(OCSP_RESPONSE *ocsp_resp, X509 *cert, X509 *iss
 
     /* we clean up */
     OCSP_CERTID_free(certid);
+clean_bs:
     OCSP_BASICRESP_free(bs);
     return o;
 }
@@ -1072,7 +1083,7 @@ static int ssl_ocsp_request(X509 *cert, X509 *issuer, X509_STORE_CTX *ctx)
         if (req != NULL) {
             resp = get_ocsp_response(p, ocsp_urls[0], req);
             if (resp != NULL) {
-                rv = process_ocsp_response(resp, cert, issuer);
+                rv = process_ocsp_response(req, resp, cert, issuer, ctx);
             } else {
                 /* correct error code for application errors? */
                 X509_STORE_CTX_set_error(ctx, X509_V_ERR_APPLICATION_VERIFICATION);

xdocs/miscellaneous/changelog.xml

@@ -37,6 +37,10 @@
       The Windows binaries are now built with OCSP support enabled by default.
       (markt)
     </update>
+    <add>
+      Include a nonce with OCSP requests and check the nonce, if any, in the
+      OCSP response. (markt)
+    </add>
   </changelog>
 </section>
 <section name="Changes in 2.0.9">