BishopFox/sliver
1
0 Fork 0
mirror of https://github.com/BishopFox/sliver.git synced 2026-11-08 08:04:14 -10:00
Code Issues Packages Projects Releases 1 Wiki Activity

restrict operator certificates to SHA256 to fix grpcio bugs (#1877)

Browse Source
This commit is contained in:
Tim Makram Ghatas committed 2025-04-10 18:45:40 +02:00
1 parent f4a2ba536c
commit d07aae4d0b
4 files changed
+13 -7
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

server/certs/ca.go
+1 -1
View File
@@ -60,7 +60,7 @@ func GenerateCertificateAuthority(caType string, commonName string) (*x509.Certi
certFilePath := filepath.Join(storageDir, fmt.Sprintf("%s-ca-cert.pem", caType))
if _, err := os.Stat(certFilePath); os.IsNotExist(err) {
certsLog.Infof("Generating certificate authority for '%s'", caType)
cert, key := GenerateECCCertificate(caType, commonName, true, false)
cert, key := GenerateECCCertificate(caType, commonName, true, false, false)
SaveCertificateAuthority(caType, cert, key)
}
cert, key, err := GetCertificateAuthority(caType)
server/certs/certs.go
+8 -2
View File
@@ -135,7 +135,7 @@ func RemoveCertificate(caType string, keyType string, commonName string) error {
// GenerateECCCertificate - Generate a TLS certificate with the given parameters
// We choose some reasonable defaults like Curve, Key Size, ValidFor, etc.
// Returns two strings `cert` and `key` (PEM Encoded).
func GenerateECCCertificate(caType string, commonName string, isCA bool, isClient bool) ([]byte, []byte) {
func GenerateECCCertificate(caType string, commonName string, isCA bool, isClient bool, isOperator bool) ([]byte, []byte) {
certsLog.Infof("Generating TLS certificate (ECC) for '%s' ...", commonName)
@@ -143,7 +143,13 @@ func GenerateECCCertificate(caType string, commonName string, isCA bool, isClien
var err error
// Generate private key
curves := []elliptic.Curve{elliptic.P521(), elliptic.P384(), elliptic.P256()}
var curves []elliptic.Curve
if isOperator {
curves = []elliptic.Curve{elliptic.P256()}
} else {
curves = []elliptic.Curve{elliptic.P521(), elliptic.P384(), elliptic.P256()}
}
curve := curves[randomInt(len(curves))]
privateKey, err = ecdsa.GenerateKey(curve, rand.Reader)
if err != nil {
server/certs/mtls.go
+2 -2
View File
@@ -26,14 +26,14 @@ const (
// MtlsC2ServerGenerateECCCertificate - Generate a server certificate signed with a given CA
func MtlsC2ServerGenerateECCCertificate(host string) ([]byte, []byte, error) {
cert, key := GenerateECCCertificate(MtlsServerCA, host, false, false)
cert, key := GenerateECCCertificate(MtlsServerCA, host, false, false, false)
err := saveCertificate(MtlsServerCA, ECCKey, host, cert, key)
return cert, key, err
}
// MtlsC2ImplantGenerateECCCertificate - Generate a server certificate signed with a given CA
func MtlsC2ImplantGenerateECCCertificate(name string) ([]byte, []byte, error) {
cert, key := GenerateECCCertificate(MtlsImplantCA, name, false, true)
cert, key := GenerateECCCertificate(MtlsImplantCA, name, false, true, false)
err := saveCertificate(MtlsImplantCA, ECCKey, name, cert, key)
return cert, key, err
}
server/certs/operators.go
+2 -2
View File
@@ -37,7 +37,7 @@ const (
// OperatorClientGenerateCertificate - Generate a certificate signed with a given CA
func OperatorClientGenerateCertificate(operator string) ([]byte, []byte, error) {
cert, key := GenerateECCCertificate(OperatorCA, operator, false, true)
cert, key := GenerateECCCertificate(OperatorCA, operator, false, true, true)
err := saveCertificate(OperatorCA, ECCKey, fmt.Sprintf("%s.%s", clientNamespace, operator), cert, key)
return cert, key, err
}
@@ -59,7 +59,7 @@ func OperatorServerGetCertificate(hostname string) ([]byte, []byte, error) {
// OperatorServerGenerateCertificate - Generate a certificate signed with a given CA
func OperatorServerGenerateCertificate(hostname string) ([]byte, []byte, error) {
cert, key := GenerateECCCertificate(OperatorCA, hostname, false, false)
cert, key := GenerateECCCertificate(OperatorCA, hostname, false, false, true)
err := saveCertificate(OperatorCA, ECCKey, fmt.Sprintf("%s.%s", serverNamespace, hostname), cert, key)
return cert, key, err
}