2
0

ct_sct.c 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388
  1. /*
  2. * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #ifdef OPENSSL_NO_CT
  10. # error "CT disabled"
  11. #endif
  12. #include <openssl/ct.h>
  13. #include <openssl/err.h>
  14. #include <openssl/evp.h>
  15. #include <openssl/tls1.h>
  16. #include <openssl/x509.h>
  17. #include "ct_local.h"
  18. SCT *SCT_new(void)
  19. {
  20. SCT *sct = OPENSSL_zalloc(sizeof(*sct));
  21. if (sct == NULL)
  22. return NULL;
  23. sct->entry_type = CT_LOG_ENTRY_TYPE_NOT_SET;
  24. sct->version = SCT_VERSION_NOT_SET;
  25. return sct;
  26. }
  27. void SCT_free(SCT *sct)
  28. {
  29. if (sct == NULL)
  30. return;
  31. OPENSSL_free(sct->log_id);
  32. OPENSSL_free(sct->ext);
  33. OPENSSL_free(sct->sig);
  34. OPENSSL_free(sct->sct);
  35. OPENSSL_free(sct);
  36. }
  37. void SCT_LIST_free(STACK_OF(SCT) *a)
  38. {
  39. sk_SCT_pop_free(a, SCT_free);
  40. }
  41. int SCT_set_version(SCT *sct, sct_version_t version)
  42. {
  43. if (version != SCT_VERSION_V1) {
  44. ERR_raise(ERR_LIB_CT, CT_R_UNSUPPORTED_VERSION);
  45. return 0;
  46. }
  47. sct->version = version;
  48. sct->validation_status = SCT_VALIDATION_STATUS_NOT_SET;
  49. return 1;
  50. }
  51. int SCT_set_log_entry_type(SCT *sct, ct_log_entry_type_t entry_type)
  52. {
  53. sct->validation_status = SCT_VALIDATION_STATUS_NOT_SET;
  54. switch (entry_type) {
  55. case CT_LOG_ENTRY_TYPE_X509:
  56. case CT_LOG_ENTRY_TYPE_PRECERT:
  57. sct->entry_type = entry_type;
  58. return 1;
  59. case CT_LOG_ENTRY_TYPE_NOT_SET:
  60. break;
  61. }
  62. ERR_raise(ERR_LIB_CT, CT_R_UNSUPPORTED_ENTRY_TYPE);
  63. return 0;
  64. }
  65. int SCT_set0_log_id(SCT *sct, unsigned char *log_id, size_t log_id_len)
  66. {
  67. if (sct->version == SCT_VERSION_V1 && log_id_len != CT_V1_HASHLEN) {
  68. ERR_raise(ERR_LIB_CT, CT_R_INVALID_LOG_ID_LENGTH);
  69. return 0;
  70. }
  71. OPENSSL_free(sct->log_id);
  72. sct->log_id = log_id;
  73. sct->log_id_len = log_id_len;
  74. sct->validation_status = SCT_VALIDATION_STATUS_NOT_SET;
  75. return 1;
  76. }
  77. int SCT_set1_log_id(SCT *sct, const unsigned char *log_id, size_t log_id_len)
  78. {
  79. if (sct->version == SCT_VERSION_V1 && log_id_len != CT_V1_HASHLEN) {
  80. ERR_raise(ERR_LIB_CT, CT_R_INVALID_LOG_ID_LENGTH);
  81. return 0;
  82. }
  83. OPENSSL_free(sct->log_id);
  84. sct->log_id = NULL;
  85. sct->log_id_len = 0;
  86. sct->validation_status = SCT_VALIDATION_STATUS_NOT_SET;
  87. if (log_id != NULL && log_id_len > 0) {
  88. sct->log_id = OPENSSL_memdup(log_id, log_id_len);
  89. if (sct->log_id == NULL)
  90. return 0;
  91. sct->log_id_len = log_id_len;
  92. }
  93. return 1;
  94. }
  95. void SCT_set_timestamp(SCT *sct, uint64_t timestamp)
  96. {
  97. sct->timestamp = timestamp;
  98. sct->validation_status = SCT_VALIDATION_STATUS_NOT_SET;
  99. }
  100. int SCT_set_signature_nid(SCT *sct, int nid)
  101. {
  102. switch (nid) {
  103. case NID_sha256WithRSAEncryption:
  104. sct->hash_alg = TLSEXT_hash_sha256;
  105. sct->sig_alg = TLSEXT_signature_rsa;
  106. sct->validation_status = SCT_VALIDATION_STATUS_NOT_SET;
  107. return 1;
  108. case NID_ecdsa_with_SHA256:
  109. sct->hash_alg = TLSEXT_hash_sha256;
  110. sct->sig_alg = TLSEXT_signature_ecdsa;
  111. sct->validation_status = SCT_VALIDATION_STATUS_NOT_SET;
  112. return 1;
  113. default:
  114. ERR_raise(ERR_LIB_CT, CT_R_UNRECOGNIZED_SIGNATURE_NID);
  115. return 0;
  116. }
  117. }
  118. void SCT_set0_extensions(SCT *sct, unsigned char *ext, size_t ext_len)
  119. {
  120. OPENSSL_free(sct->ext);
  121. sct->ext = ext;
  122. sct->ext_len = ext_len;
  123. sct->validation_status = SCT_VALIDATION_STATUS_NOT_SET;
  124. }
  125. int SCT_set1_extensions(SCT *sct, const unsigned char *ext, size_t ext_len)
  126. {
  127. OPENSSL_free(sct->ext);
  128. sct->ext = NULL;
  129. sct->ext_len = 0;
  130. sct->validation_status = SCT_VALIDATION_STATUS_NOT_SET;
  131. if (ext != NULL && ext_len > 0) {
  132. sct->ext = OPENSSL_memdup(ext, ext_len);
  133. if (sct->ext == NULL)
  134. return 0;
  135. sct->ext_len = ext_len;
  136. }
  137. return 1;
  138. }
  139. void SCT_set0_signature(SCT *sct, unsigned char *sig, size_t sig_len)
  140. {
  141. OPENSSL_free(sct->sig);
  142. sct->sig = sig;
  143. sct->sig_len = sig_len;
  144. sct->validation_status = SCT_VALIDATION_STATUS_NOT_SET;
  145. }
  146. int SCT_set1_signature(SCT *sct, const unsigned char *sig, size_t sig_len)
  147. {
  148. OPENSSL_free(sct->sig);
  149. sct->sig = NULL;
  150. sct->sig_len = 0;
  151. sct->validation_status = SCT_VALIDATION_STATUS_NOT_SET;
  152. if (sig != NULL && sig_len > 0) {
  153. sct->sig = OPENSSL_memdup(sig, sig_len);
  154. if (sct->sig == NULL)
  155. return 0;
  156. sct->sig_len = sig_len;
  157. }
  158. return 1;
  159. }
  160. sct_version_t SCT_get_version(const SCT *sct)
  161. {
  162. return sct->version;
  163. }
  164. ct_log_entry_type_t SCT_get_log_entry_type(const SCT *sct)
  165. {
  166. return sct->entry_type;
  167. }
  168. size_t SCT_get0_log_id(const SCT *sct, unsigned char **log_id)
  169. {
  170. *log_id = sct->log_id;
  171. return sct->log_id_len;
  172. }
  173. uint64_t SCT_get_timestamp(const SCT *sct)
  174. {
  175. return sct->timestamp;
  176. }
  177. int SCT_get_signature_nid(const SCT *sct)
  178. {
  179. if (sct->version == SCT_VERSION_V1) {
  180. if (sct->hash_alg == TLSEXT_hash_sha256) {
  181. switch (sct->sig_alg) {
  182. case TLSEXT_signature_ecdsa:
  183. return NID_ecdsa_with_SHA256;
  184. case TLSEXT_signature_rsa:
  185. return NID_sha256WithRSAEncryption;
  186. default:
  187. return NID_undef;
  188. }
  189. }
  190. }
  191. return NID_undef;
  192. }
  193. size_t SCT_get0_extensions(const SCT *sct, unsigned char **ext)
  194. {
  195. *ext = sct->ext;
  196. return sct->ext_len;
  197. }
  198. size_t SCT_get0_signature(const SCT *sct, unsigned char **sig)
  199. {
  200. *sig = sct->sig;
  201. return sct->sig_len;
  202. }
  203. int SCT_is_complete(const SCT *sct)
  204. {
  205. switch (sct->version) {
  206. case SCT_VERSION_NOT_SET:
  207. return 0;
  208. case SCT_VERSION_V1:
  209. return sct->log_id != NULL && SCT_signature_is_complete(sct);
  210. default:
  211. return sct->sct != NULL; /* Just need cached encoding */
  212. }
  213. }
  214. int SCT_signature_is_complete(const SCT *sct)
  215. {
  216. return SCT_get_signature_nid(sct) != NID_undef &&
  217. sct->sig != NULL && sct->sig_len > 0;
  218. }
  219. sct_source_t SCT_get_source(const SCT *sct)
  220. {
  221. return sct->source;
  222. }
  223. int SCT_set_source(SCT *sct, sct_source_t source)
  224. {
  225. sct->source = source;
  226. sct->validation_status = SCT_VALIDATION_STATUS_NOT_SET;
  227. switch (source) {
  228. case SCT_SOURCE_TLS_EXTENSION:
  229. case SCT_SOURCE_OCSP_STAPLED_RESPONSE:
  230. return SCT_set_log_entry_type(sct, CT_LOG_ENTRY_TYPE_X509);
  231. case SCT_SOURCE_X509V3_EXTENSION:
  232. return SCT_set_log_entry_type(sct, CT_LOG_ENTRY_TYPE_PRECERT);
  233. case SCT_SOURCE_UNKNOWN:
  234. break;
  235. }
  236. /* if we aren't sure, leave the log entry type alone */
  237. return 1;
  238. }
  239. sct_validation_status_t SCT_get_validation_status(const SCT *sct)
  240. {
  241. return sct->validation_status;
  242. }
  243. int SCT_validate(SCT *sct, const CT_POLICY_EVAL_CTX *ctx)
  244. {
  245. int is_sct_valid = -1;
  246. SCT_CTX *sctx = NULL;
  247. X509_PUBKEY *pub = NULL, *log_pkey = NULL;
  248. const CTLOG *log;
  249. /*
  250. * With an unrecognized SCT version we don't know what such an SCT means,
  251. * let alone validate one. So we return validation failure (0).
  252. */
  253. if (sct->version != SCT_VERSION_V1) {
  254. sct->validation_status = SCT_VALIDATION_STATUS_UNKNOWN_VERSION;
  255. return 0;
  256. }
  257. log = CTLOG_STORE_get0_log_by_id(ctx->log_store,
  258. sct->log_id, sct->log_id_len);
  259. /* Similarly, an SCT from an unknown log also cannot be validated. */
  260. if (log == NULL) {
  261. sct->validation_status = SCT_VALIDATION_STATUS_UNKNOWN_LOG;
  262. return 0;
  263. }
  264. sctx = SCT_CTX_new(ctx->libctx, ctx->propq);
  265. if (sctx == NULL)
  266. goto err;
  267. if (X509_PUBKEY_set(&log_pkey, CTLOG_get0_public_key(log)) != 1)
  268. goto err;
  269. if (SCT_CTX_set1_pubkey(sctx, log_pkey) != 1)
  270. goto err;
  271. if (SCT_get_log_entry_type(sct) == CT_LOG_ENTRY_TYPE_PRECERT) {
  272. EVP_PKEY *issuer_pkey;
  273. if (ctx->issuer == NULL) {
  274. sct->validation_status = SCT_VALIDATION_STATUS_UNVERIFIED;
  275. goto end;
  276. }
  277. issuer_pkey = X509_get0_pubkey(ctx->issuer);
  278. if (X509_PUBKEY_set(&pub, issuer_pkey) != 1)
  279. goto err;
  280. if (SCT_CTX_set1_issuer_pubkey(sctx, pub) != 1)
  281. goto err;
  282. }
  283. SCT_CTX_set_time(sctx, ctx->epoch_time_in_ms);
  284. /*
  285. * XXX: Potential for optimization. This repeats some idempotent heavy
  286. * lifting on the certificate for each candidate SCT, and appears to not
  287. * use any information in the SCT itself, only the certificate is
  288. * processed. So it may make more sense to do this just once, perhaps
  289. * associated with the shared (by all SCTs) policy eval ctx.
  290. *
  291. * XXX: Failure here is global (SCT independent) and represents either an
  292. * issue with the certificate (e.g. duplicate extensions) or an out of
  293. * memory condition. When the certificate is incompatible with CT, we just
  294. * mark the SCTs invalid, rather than report a failure to determine the
  295. * validation status. That way, callbacks that want to do "soft" SCT
  296. * processing will not abort handshakes with false positive internal
  297. * errors. Since the function does not distinguish between certificate
  298. * issues (peer's fault) and internal problems (out fault) the safe thing
  299. * to do is to report a validation failure and let the callback or
  300. * application decide what to do.
  301. */
  302. if (SCT_CTX_set1_cert(sctx, ctx->cert, NULL) != 1)
  303. sct->validation_status = SCT_VALIDATION_STATUS_UNVERIFIED;
  304. else
  305. sct->validation_status = SCT_CTX_verify(sctx, sct) == 1 ?
  306. SCT_VALIDATION_STATUS_VALID : SCT_VALIDATION_STATUS_INVALID;
  307. end:
  308. is_sct_valid = sct->validation_status == SCT_VALIDATION_STATUS_VALID;
  309. err:
  310. X509_PUBKEY_free(pub);
  311. X509_PUBKEY_free(log_pkey);
  312. SCT_CTX_free(sctx);
  313. return is_sct_valid;
  314. }
  315. int SCT_LIST_validate(const STACK_OF(SCT) *scts, CT_POLICY_EVAL_CTX *ctx)
  316. {
  317. int are_scts_valid = 1;
  318. int sct_count = scts != NULL ? sk_SCT_num(scts) : 0;
  319. int i;
  320. for (i = 0; i < sct_count; ++i) {
  321. int is_sct_valid = -1;
  322. SCT *sct = sk_SCT_value(scts, i);
  323. if (sct == NULL)
  324. continue;
  325. is_sct_valid = SCT_validate(sct, ctx);
  326. if (is_sct_valid < 0)
  327. return is_sct_valid;
  328. are_scts_valid &= is_sct_valid;
  329. }
  330. return are_scts_valid;
  331. }