Skip to content

WFE: checkAlgorithm never reachable from WFE #8088

@orangepizza

Description

@orangepizza

only place can raise BadSignatureAlgorithmError is checkAlgorithm
https://github.com/letsencrypt/boulder/blob/main/wfe2/verify.go#L76
but because parseJWS dosen't call that function but using upstream error warped by malformed, because it jose.ParseSigned with whitelist of algorithms so anything outside of it will error out.

parsedJWS, err := jose.ParseSigned(bodyStr, getSupportedAlgs())

this cause malformed error on any jose verification error, include bad key type.
https://github.com/letsencrypt/boulder/blob/main/wfe2/verify.go#L347

but because WFE keyrollover calles parseJWS on innerJWS before validKeyRollover, parseJWS's malformed code hits and errors out, never get to checkAlgorithm about innerJWS
https://github.com/letsencrypt/boulder/blob/main/wfe2/wfe.go#L1869

this happens on other types of wfe requests too, because
wfe.parseJWSRequest called before wfe.validJWSForAccount / wfe.validSelfAuthenticatedJWS in validPOSTForAccount/validSelfAuthenticatedPOST
and parseJWSRequest -> parseJWS chain happens and short-circuit with malformed error because , and checkAlgorithm never called.

https://github.com/letsencrypt/boulder/blob/main/wfe2/verify.go#L619
https://github.com/letsencrypt/boulder/blob/main/wfe2/verify.go#L701

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions