Commit f239c4b5 authored by Łukasz Nowak's avatar Łukasz Nowak Committed by Vincent Pelletier

ca: Do not use a 128bits OID arc for caucase internal use

Many software packages do not support 128 bits arcs in OIDs (see
https://misc.daniel-marschall.de/asn.1/oid_facts.html#chap4), use a
registered OID instead.

Certificates emitted using the legacy OID are migrated to the new OID on
renewal.

Mix of work by Vincent Pelletier <vincent@nexedi.com> and
Thomas Gambier <thomas.gambier@nexedi.com> finished by
Lukasz Nowak <luke@nexedi.com>
parent 4291d53e
...@@ -411,14 +411,28 @@ class CertificateAuthority(object): ...@@ -411,14 +411,28 @@ class CertificateAuthority(object):
critical=False, # (no recommendations) critical=False, # (no recommendations)
) )
else: else:
if auto_signed == _AUTO_SIGNED_PASSTHROUGH: policy_list = []
# Caller is asking us to let all through, so do this. for policy in certificate_policies.value:
policy_list = certificate_policies.value if policy.policy_identifier.dotted_string.startswith(
else: utils.CAUCASE_LEGACY_OID_TOP
# Prevent any caucase extension from being smuggled, especiall the ):
# Always migrate CAUCASE_LEGACY_OID_TOP to CAUCASE_OID_TOP
# by copying current policy and replacing its prefix to the new
# OID prefix
identifier_suffix = policy.policy_identifier.dotted_string[
len(utils.CAUCASE_LEGACY_OID_TOP):
]
policy = x509.PolicyInformation(
x509.oid.ObjectIdentifier(utils.CAUCASE_OID_TOP + identifier_suffix),
policy.policy_qualifiers,
)
policy_list.append(policy)
if auto_signed != _AUTO_SIGNED_PASSTHROUGH:
# Prevent any caucase extension from being smuggled, especially the
# "auto-signed" one... # "auto-signed" one...
policy_list = [ policy_list = [
x for x in certificate_policies.value x for x in policy_list
if not x.policy_identifier.dotted_string.startswith( if not x.policy_identifier.dotted_string.startswith(
utils.CAUCASE_OID_TOP, utils.CAUCASE_OID_TOP,
) )
......
...@@ -1281,6 +1281,10 @@ class CaucaseTest(unittest.TestCase): ...@@ -1281,6 +1281,10 @@ class CaucaseTest(unittest.TestCase):
x509.IPAddress(ipaddress.IPv6Network(u'::/64')), x509.IPAddress(ipaddress.IPv6Network(u'::/64')),
]) ])
requested_policies = x509.CertificatePolicies([ requested_policies = x509.CertificatePolicies([
x509.PolicyInformation(
x509.oid.ObjectIdentifier(utils.CAUCASE_LEGACY_OID_RESERVED),
None,
),
x509.PolicyInformation( x509.PolicyInformation(
x509.oid.ObjectIdentifier(utils.CAUCASE_OID_RESERVED), x509.oid.ObjectIdentifier(utils.CAUCASE_OID_RESERVED),
None, None,
......
...@@ -55,8 +55,9 @@ del _checkDefaultDigestsAvailable ...@@ -55,8 +55,9 @@ del _checkDefaultDigestsAvailable
_cryptography_backend = default_backend() _cryptography_backend = default_backend()
# Registration-less OID under 2.25 tree (aka uuid tree) # Registration-less OID under 1.3.6.1.4.1.37476.9000 tree (aka ViaThinkSoft
CAUCASE_OID_TOP = '2.25.285541874270823339875695650038637483517' # tree for open source project: https://oidplus.viathinksoft.com )
CAUCASE_OID_TOP = '1.3.6.1.4.1.37476.9000.70.0'
CAUCASE_OID_AUTO_SIGNED = CAUCASE_OID_TOP + '.0' CAUCASE_OID_AUTO_SIGNED = CAUCASE_OID_TOP + '.0'
# Reserved for tests: no meaning, always stripped but never specificaly # Reserved for tests: no meaning, always stripped but never specificaly
# checked for in the code. # checked for in the code.
...@@ -71,6 +72,16 @@ CAUCASE_POLICY_INFORMATION_AUTO_SIGNED = x509.PolicyInformation( ...@@ -71,6 +72,16 @@ CAUCASE_POLICY_INFORMATION_AUTO_SIGNED = x509.PolicyInformation(
), ),
] ]
) )
# Registration-less OID under 2.25 tree (aka uuid tree)
# Sadly, many implementations break when encountering 128-bits OIDs, making
# these certificates difficult to use.
CAUCASE_LEGACY_OID_TOP = '2.25.285541874270823339875695650038637483517'
CAUCASE_LEGACY_OID_AUTO_SIGNED = CAUCASE_LEGACY_OID_TOP + '.0'
CAUCASE_LEGACY_OID_RESERVED = CAUCASE_LEGACY_OID_TOP + '.999'
_CAUCASE_LEGACY_OID_AUTO_SIGNED = x509.oid.ObjectIdentifier(
CAUCASE_LEGACY_OID_AUTO_SIGNED,
)
def isCertificateAutoSigned(crt): def isCertificateAutoSigned(crt):
""" """
...@@ -90,7 +101,10 @@ def isCertificateAutoSigned(crt): ...@@ -90,7 +101,10 @@ def isCertificateAutoSigned(crt):
pass pass
else: else:
for policy_information in extension.value: for policy_information in extension.value:
if policy_information.policy_identifier == _CAUCASE_OID_AUTO_SIGNED: if policy_information.policy_identifier in (
_CAUCASE_OID_AUTO_SIGNED,
_CAUCASE_LEGACY_OID_AUTO_SIGNED, # BBB
):
return True return True
return False return False
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment