search

QubesOS / qubes-issues

The Qubes OS Project issue tracker
https://www.qubes-os.org/doc/issue-tracking/
534 stars 46 forks source link

OCSP proxy for firewallvm #879

Open marmarek opened 9 years ago

marmarek commented 9 years ago

Reported by joanna on 3 Jul 2014 11:54 UTC A typical problem: the user wants to allow only https traffic to select AppVM, yet for most https sites to work correctly (at least those with EV certs) the web browser is expected to also connect over oscp to check the cert. Unfortunately OCSP is HTTP not HTTPS...

Currently I manually look into the cert details where URI to OCSP is written, and then manually add this to the firewall rules. Sometimes I can't get the "green bar" working though...

Migrated-From: https://wiki.qubes-os.org/ticket/879

marmarek commented 9 years ago

Comment by marmarek on 4 Jul 2014 22:45 UTC Some CAs have very sophisticated infrastructure for hosting OCSP, includinga whole server farm, DNS round robin changing every few minutes etc. For example I had to add those rules for verisign (manually in qubes_firewall_user_script!):

#  crl.verisign.net
iptables -I FORWARD -s X -d 199.7.0.190/255.255.0.255 -p tcp --dport 80 -j ACCEPT
#  ocsp.verisign.net
iptables -I FORWARD -s X -d 199.7.0.72/255.255.0.255 -p tcp --dport 80 -j ACCEPT
#  seal.verisign.net
iptables -I FORWARD -s X -d 199.7.0.231/255.255.0.255 -p tcp --dport 443 -j ACCEPT

But apparently it isn't working anymore.

So indeed some proxy would be helpful. Potential problem: how to let the browser use the proxy? It would be the best if it would be used only for OCSP queries, but I'm afraid it isn't possible. Perhaps it should intercept all http traffic (and filter it similar to our yum proxy)?

marmarek commented 9 years ago

Comment by axon on 22 Jul 2014 12:32 UTC What if you just allow HTTP access to the entire CIDR block of the OCSP host in the AppVM's firewall rules?

For example, if your desired EV website is https://twitter.com, whose OCSP URI is http://EVSecure-ocsp.verisign.com, you would allow 23.0.0.0/12 over HTTP in the firewall rules of the AppVM.

This is currently working for me.

andrewdavidwong commented 9 years ago

What if you just allow HTTP access to the entire CIDR block of the OCSP host in the AppVM's firewall rules?

I've been using this workaround for a while now, but it's not entirely reliable, since sometimes the OCSP host IP changes. So, some kind of proxy would be much better, I think.