1 // Copyright 2012 The Chromium Authors 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef NET_CERT_CERT_VERIFY_PROC_H_ 6 #define NET_CERT_CERT_VERIFY_PROC_H_ 7 8 #include <string> 9 #include <vector> 10 11 #include "base/feature_list.h" 12 #include "base/gtest_prod_util.h" 13 #include "base/memory/ref_counted.h" 14 #include "build/build_config.h" 15 #include "crypto/crypto_buildflags.h" 16 #include "net/base/hash_value.h" 17 #include "net/base/net_export.h" 18 #include "net/net_buildflags.h" 19 20 #if BUILDFLAG(CHROME_ROOT_STORE_SUPPORTED) 21 #include "net/cert/internal/trust_store_chrome.h" 22 #endif 23 24 namespace net { 25 26 class CertNetFetcher; 27 class CertVerifyResult; 28 class CRLSet; 29 class NetLogWithSource; 30 class X509Certificate; 31 typedef std::vector<scoped_refptr<X509Certificate>> CertificateList; 32 33 // Class to perform certificate path building and verification for various 34 // certificate uses. All methods of this class must be thread-safe, as they 35 // may be called from various non-joinable worker threads. 36 class NET_EXPORT CertVerifyProc 37 : public base::RefCountedThreadSafe<CertVerifyProc> { 38 public: 39 enum VerifyFlags { 40 // If set, enables online revocation checking via CRLs and OCSP for the 41 // certificate chain. 42 // Note: has no effect if VERIFY_DISABLE_NETWORK_FETCHES is set. 43 VERIFY_REV_CHECKING_ENABLED = 1 << 0, 44 45 // If set, this is equivalent to VERIFY_REV_CHECKING_ENABLED, in that it 46 // enables online revocation checking via CRLs or OCSP, but only 47 // for certificates issued by non-public trust anchors. Failure to check 48 // revocation is treated as a hard failure. 49 // Note: has no effect if VERIFY_DISABLE_NETWORK_FETCHES is set. 50 VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS = 1 << 1, 51 52 // If set, certificates with SHA-1 signatures will be allowed, but only if 53 // they are issued by non-public trust anchors. 54 VERIFY_ENABLE_SHA1_LOCAL_ANCHORS = 1 << 2, 55 56 // If set, disables the policy enforcement described at 57 // https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html 58 VERIFY_DISABLE_SYMANTEC_ENFORCEMENT = 1 << 3, 59 60 // Disable network fetches during verification. This will override 61 // VERIFY_REV_CHECKING_ENABLED and 62 // VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS if they are also specified. 63 // (Note that this entirely disables the online revocation/AIA code paths. 64 // Theoretically we could still check for cached results.) 65 VERIFY_DISABLE_NETWORK_FETCHES = 1 << 4, 66 67 // Also update GetNetConstants() in net/log/net_log_util.cc when updating 68 // this enum. 69 VERIFY_FLAGS_LAST = VERIFY_DISABLE_NETWORK_FETCHES 70 }; 71 72 // The set factory parameters that are variable over time, but are expected to 73 // be consistent between multiple verifiers that are created. For example, 74 // CertNetFetcher is not in this struct as it is expected that different 75 // verifiers will have different net fetchers. (There is no technical 76 // restriction against creating different verifiers with different ImplParams, 77 // structuring the parameters this way just makes some APIs more convenient 78 // for the common case.) 79 struct NET_EXPORT ImplParams { 80 ImplParams(); 81 ~ImplParams(); 82 ImplParams(const ImplParams&); 83 ImplParams& operator=(const ImplParams& other); 84 ImplParams(ImplParams&&); 85 ImplParams& operator=(ImplParams&& other); 86 87 scoped_refptr<CRLSet> crl_set; 88 #if BUILDFLAG(CHROME_ROOT_STORE_SUPPORTED) 89 absl::optional<net::ChromeRootStoreData> root_store_data; 90 #endif 91 #if BUILDFLAG(CHROME_ROOT_STORE_OPTIONAL) 92 bool use_chrome_root_store; 93 #endif 94 }; 95 96 // The set of parameters that are variable over time and can differ between 97 // different verifiers created by a CertVerifierProcFactory. 98 struct NET_EXPORT InstanceParams { 99 InstanceParams(); 100 ~InstanceParams(); 101 InstanceParams(const InstanceParams&); 102 InstanceParams& operator=(const InstanceParams& other); 103 InstanceParams(InstanceParams&&); 104 InstanceParams& operator=(InstanceParams&& other); 105 106 // TODO(crbug.com/1477317): store these as ParsedCertificateList here so 107 // that it only needs to be done once since the same InstanceParams can be 108 // used to create a CertVerifyProc multiple times. 109 110 // Additional trust anchors to consider during path validation. Ordinarily, 111 // implementations of CertVerifier use trust anchors from the configured 112 // system store. This is implementation-specific plumbing for passing 113 // additional anchors through. 114 CertificateList additional_trust_anchors; 115 116 // Additional temporary certs to consider as intermediates during path 117 // validation. Ordinarily, implementations of CertVerifier use intermediate 118 // certs from the configured system store. This is implementation-specific 119 // plumbing for passing additional intermediates through. 120 CertificateList additional_untrusted_authorities; 121 }; 122 123 // These values are persisted to logs. Entries should not be renumbered and 124 // numeric values should never be reused. 125 enum class NameNormalizationResult { 126 kError = 0, 127 kByteEqual = 1, 128 kNormalized = 2, 129 kChainLengthOne = 3, 130 kMaxValue = kChainLengthOne 131 }; 132 133 #if !(BUILDFLAG(IS_FUCHSIA) || BUILDFLAG(IS_LINUX) || \ 134 BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(CHROME_ROOT_STORE_ONLY)) 135 // Creates and returns a CertVerifyProc that uses the system verifier. 136 // |cert_net_fetcher| may not be used, depending on the implementation. 137 static scoped_refptr<CertVerifyProc> CreateSystemVerifyProc( 138 scoped_refptr<CertNetFetcher> cert_net_fetcher, 139 scoped_refptr<CRLSet> crl_set); 140 #endif 141 142 #if BUILDFLAG(IS_FUCHSIA) 143 // Creates and returns a CertVerifyProcBuiltin using the SSL SystemTrustStore. 144 static scoped_refptr<CertVerifyProc> CreateBuiltinVerifyProc( 145 scoped_refptr<CertNetFetcher> cert_net_fetcher, 146 scoped_refptr<CRLSet> crl_set, 147 const InstanceParams instance_params); 148 #endif 149 150 #if BUILDFLAG(CHROME_ROOT_STORE_SUPPORTED) 151 // Creates and returns a CertVerifyProcBuiltin using the Chrome Root Store 152 // SystemTrustStore and the given |root_store_data|, which may be nullptr to 153 // use the default. 154 static scoped_refptr<CertVerifyProc> CreateBuiltinWithChromeRootStore( 155 scoped_refptr<CertNetFetcher> cert_net_fetcher, 156 scoped_refptr<CRLSet> crl_set, 157 const ChromeRootStoreData* root_store_data, 158 const InstanceParams instance_params); 159 #endif 160 161 CertVerifyProc(const CertVerifyProc&) = delete; 162 CertVerifyProc& operator=(const CertVerifyProc&) = delete; 163 164 // Verifies the certificate against the given hostname as an SSL server 165 // certificate. Returns OK if successful or an error code upon failure. 166 // 167 // The |*verify_result| structure, including the |verify_result->cert_status| 168 // bitmask, is always filled out regardless of the return value. If the 169 // certificate has multiple errors, the corresponding status flags are set in 170 // |verify_result->cert_status|, and the error code for the most serious 171 // error is returned. 172 // 173 // |ocsp_response|, if non-empty, is a stapled OCSP response to use. 174 // 175 // |sct_list|, if non-empty, is a SignedCertificateTimestampList from the TLS 176 // extension as described in RFC6962 section 3.3.1. 177 // 178 // |flags| is bitwise OR'd of VerifyFlags: 179 // 180 // If VERIFY_REV_CHECKING_ENABLED is set in |flags|, online certificate 181 // revocation checking is performed (i.e. OCSP and downloading CRLs). CRLSet 182 // based revocation checking is always enabled, regardless of this flag. 183 int Verify(X509Certificate* cert, 184 const std::string& hostname, 185 const std::string& ocsp_response, 186 const std::string& sct_list, 187 int flags, 188 CertVerifyResult* verify_result, 189 const NetLogWithSource& net_log); 190 191 protected: 192 explicit CertVerifyProc(scoped_refptr<CRLSet> crl_set); 193 virtual ~CertVerifyProc(); 194 crl_set()195 CRLSet* crl_set() const { return crl_set_.get(); } 196 197 // Record a histogram of whether Name normalization was used in verifying the 198 // chain. This should only be called for successfully validated chains. 199 static void LogNameNormalizationResult(const std::string& histogram_suffix, 200 NameNormalizationResult result); 201 202 // Record a histogram of whether Name normalization was used in verifying the 203 // chain. This should only be called for successfully validated chains. 204 static void LogNameNormalizationMetrics(const std::string& histogram_suffix, 205 X509Certificate* verified_cert, 206 bool is_issued_by_known_root); 207 208 private: 209 friend class base::RefCountedThreadSafe<CertVerifyProc>; 210 FRIEND_TEST_ALL_PREFIXES(CertVerifyProcTest, DigiNotarCerts); 211 FRIEND_TEST_ALL_PREFIXES(CertVerifyProcTest, TestHasTooLongValidity); 212 FRIEND_TEST_ALL_PREFIXES(CertVerifyProcTest, 213 VerifyRejectsSHA1AfterDeprecationLegacyMode); 214 FRIEND_TEST_ALL_PREFIXES(CertVerifyProcTest, SymantecCertsRejected); 215 216 // Performs the actual verification using the desired underlying 217 // 218 // On entry, |verify_result| will be default-initialized as a successful 219 // validation, with |verify_result->verified_cert| set to |cert|. 220 // 221 // Implementations are expected to fill in all applicable fields, excluding: 222 // 223 // * ocsp_result 224 // * has_sha1 225 // 226 // which will be filled in by |Verify()|. If an error code is returned, 227 // |verify_result->cert_status| should be non-zero, indicating an 228 // error occurred. 229 // 230 // On success, net::OK should be returned, with |verify_result| updated to 231 // reflect the successfully verified chain. 232 virtual int VerifyInternal(X509Certificate* cert, 233 const std::string& hostname, 234 const std::string& ocsp_response, 235 const std::string& sct_list, 236 int flags, 237 CertVerifyResult* verify_result, 238 const NetLogWithSource& net_log) = 0; 239 240 // HasNameConstraintsViolation returns true iff one of |public_key_hashes| 241 // (which are hashes of SubjectPublicKeyInfo structures) has name constraints 242 // imposed on it and the names in |dns_names| are not permitted. 243 static bool HasNameConstraintsViolation( 244 const HashValueVector& public_key_hashes, 245 const std::string& common_name, 246 const std::vector<std::string>& dns_names, 247 const std::vector<std::string>& ip_addrs); 248 249 // Checks the validity period of the certificate against the maximum 250 // allowable validity period for publicly trusted certificates. Returns true 251 // if the validity period is too long. 252 static bool HasTooLongValidity(const X509Certificate& cert); 253 254 const scoped_refptr<CRLSet> crl_set_; 255 }; 256 257 // Factory for creating new CertVerifyProcs when they need to be updated. 258 class NET_EXPORT CertVerifyProcFactory 259 : public base::RefCountedThreadSafe<CertVerifyProcFactory> { 260 public: 261 262 // Create a new CertVerifyProc that uses the passed in CRLSet and 263 // ChromeRootStoreData. 264 virtual scoped_refptr<CertVerifyProc> CreateCertVerifyProc( 265 scoped_refptr<CertNetFetcher> cert_net_fetcher, 266 const CertVerifyProc::ImplParams& impl_params, 267 const CertVerifyProc::InstanceParams& instance_params) = 0; 268 269 protected: 270 virtual ~CertVerifyProcFactory() = default; 271 272 private: 273 friend class base::RefCountedThreadSafe<CertVerifyProcFactory>; 274 }; 275 276 } // namespace net 277 278 #endif // NET_CERT_CERT_VERIFY_PROC_H_ 279