1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "net/quic/crypto/proof_verifier_chromium.h"
6
7 #include "base/bind.h"
8 #include "base/bind_helpers.h"
9 #include "base/callback_helpers.h"
10 #include "base/compiler_specific.h"
11 #include "base/logging.h"
12 #include "base/metrics/histogram.h"
13 #include "base/stl_util.h"
14 #include "base/strings/stringprintf.h"
15 #include "crypto/signature_verifier.h"
16 #include "net/base/net_errors.h"
17 #include "net/base/net_log.h"
18 #include "net/cert/asn1_util.h"
19 #include "net/cert/cert_status_flags.h"
20 #include "net/cert/cert_verifier.h"
21 #include "net/cert/cert_verify_result.h"
22 #include "net/cert/single_request_cert_verifier.h"
23 #include "net/cert/x509_certificate.h"
24 #include "net/cert/x509_util.h"
25 #include "net/http/transport_security_state.h"
26 #include "net/quic/crypto/crypto_protocol.h"
27 #include "net/ssl/ssl_config_service.h"
28
29 using base::StringPiece;
30 using base::StringPrintf;
31 using std::string;
32 using std::vector;
33
34 namespace net {
35
Clone() const36 ProofVerifyDetails* ProofVerifyDetailsChromium::Clone() const {
37 ProofVerifyDetailsChromium* other = new ProofVerifyDetailsChromium;
38 other->cert_verify_result = cert_verify_result;
39 return other;
40 }
41
42 // A Job handles the verification of a single proof. It is owned by the
43 // ProofVerifier. If the verification can not complete synchronously, it
44 // will notify the ProofVerifier upon completion.
45 class ProofVerifierChromium::Job {
46 public:
47 Job(ProofVerifierChromium* proof_verifier,
48 CertVerifier* cert_verifier,
49 TransportSecurityState* transport_security_state,
50 const BoundNetLog& net_log);
51
52 // Starts the proof verification. If |QUIC_PENDING| is returned, then
53 // |callback| will be invoked asynchronously when the verification completes.
54 QuicAsyncStatus VerifyProof(const std::string& hostname,
55 const std::string& server_config,
56 const std::vector<std::string>& certs,
57 const std::string& signature,
58 std::string* error_details,
59 scoped_ptr<ProofVerifyDetails>* verify_details,
60 ProofVerifierCallback* callback);
61
62 private:
63 enum State {
64 STATE_NONE,
65 STATE_VERIFY_CERT,
66 STATE_VERIFY_CERT_COMPLETE,
67 };
68
69 int DoLoop(int last_io_result);
70 void OnIOComplete(int result);
71 int DoVerifyCert(int result);
72 int DoVerifyCertComplete(int result);
73
74 bool VerifySignature(const std::string& signed_data,
75 const std::string& signature,
76 const std::string& cert);
77
78 // Proof verifier to notify when this jobs completes.
79 ProofVerifierChromium* proof_verifier_;
80
81 // The underlying verifier used for verifying certificates.
82 scoped_ptr<SingleRequestCertVerifier> verifier_;
83
84 TransportSecurityState* transport_security_state_;
85
86 // |hostname| specifies the hostname for which |certs| is a valid chain.
87 std::string hostname_;
88
89 scoped_ptr<ProofVerifierCallback> callback_;
90 scoped_ptr<ProofVerifyDetailsChromium> verify_details_;
91 std::string error_details_;
92
93 // X509Certificate from a chain of DER encoded certificates.
94 scoped_refptr<X509Certificate> cert_;
95
96 State next_state_;
97
98 BoundNetLog net_log_;
99
100 DISALLOW_COPY_AND_ASSIGN(Job);
101 };
102
Job(ProofVerifierChromium * proof_verifier,CertVerifier * cert_verifier,TransportSecurityState * transport_security_state,const BoundNetLog & net_log)103 ProofVerifierChromium::Job::Job(
104 ProofVerifierChromium* proof_verifier,
105 CertVerifier* cert_verifier,
106 TransportSecurityState* transport_security_state,
107 const BoundNetLog& net_log)
108 : proof_verifier_(proof_verifier),
109 verifier_(new SingleRequestCertVerifier(cert_verifier)),
110 transport_security_state_(transport_security_state),
111 next_state_(STATE_NONE),
112 net_log_(net_log) {
113 }
114
VerifyProof(const string & hostname,const string & server_config,const vector<string> & certs,const string & signature,std::string * error_details,scoped_ptr<ProofVerifyDetails> * verify_details,ProofVerifierCallback * callback)115 QuicAsyncStatus ProofVerifierChromium::Job::VerifyProof(
116 const string& hostname,
117 const string& server_config,
118 const vector<string>& certs,
119 const string& signature,
120 std::string* error_details,
121 scoped_ptr<ProofVerifyDetails>* verify_details,
122 ProofVerifierCallback* callback) {
123 DCHECK(error_details);
124 DCHECK(verify_details);
125 DCHECK(callback);
126
127 error_details->clear();
128
129 if (STATE_NONE != next_state_) {
130 *error_details = "Certificate is already set and VerifyProof has begun";
131 DLOG(DFATAL) << *error_details;
132 return QUIC_FAILURE;
133 }
134
135 verify_details_.reset(new ProofVerifyDetailsChromium);
136
137 if (certs.empty()) {
138 *error_details = "Failed to create certificate chain. Certs are empty.";
139 DLOG(WARNING) << *error_details;
140 verify_details_->cert_verify_result.cert_status = CERT_STATUS_INVALID;
141 *verify_details = verify_details_.Pass();
142 return QUIC_FAILURE;
143 }
144
145 // Convert certs to X509Certificate.
146 vector<StringPiece> cert_pieces(certs.size());
147 for (unsigned i = 0; i < certs.size(); i++) {
148 cert_pieces[i] = base::StringPiece(certs[i]);
149 }
150 cert_ = X509Certificate::CreateFromDERCertChain(cert_pieces);
151 if (!cert_.get()) {
152 *error_details = "Failed to create certificate chain";
153 DLOG(WARNING) << *error_details;
154 verify_details_->cert_verify_result.cert_status = CERT_STATUS_INVALID;
155 *verify_details = verify_details_.Pass();
156 return QUIC_FAILURE;
157 }
158
159 // We call VerifySignature first to avoid copying of server_config and
160 // signature.
161 if (!VerifySignature(server_config, signature, certs[0])) {
162 *error_details = "Failed to verify signature of server config";
163 DLOG(WARNING) << *error_details;
164 verify_details_->cert_verify_result.cert_status = CERT_STATUS_INVALID;
165 *verify_details = verify_details_.Pass();
166 return QUIC_FAILURE;
167 }
168
169 hostname_ = hostname;
170
171 next_state_ = STATE_VERIFY_CERT;
172 switch (DoLoop(OK)) {
173 case OK:
174 *verify_details = verify_details_.Pass();
175 return QUIC_SUCCESS;
176 case ERR_IO_PENDING:
177 callback_.reset(callback);
178 return QUIC_PENDING;
179 default:
180 *error_details = error_details_;
181 *verify_details = verify_details_.Pass();
182 return QUIC_FAILURE;
183 }
184 }
185
DoLoop(int last_result)186 int ProofVerifierChromium::Job::DoLoop(int last_result) {
187 int rv = last_result;
188 do {
189 State state = next_state_;
190 next_state_ = STATE_NONE;
191 switch (state) {
192 case STATE_VERIFY_CERT:
193 DCHECK(rv == OK);
194 rv = DoVerifyCert(rv);
195 break;
196 case STATE_VERIFY_CERT_COMPLETE:
197 rv = DoVerifyCertComplete(rv);
198 break;
199 case STATE_NONE:
200 default:
201 rv = ERR_UNEXPECTED;
202 LOG(DFATAL) << "unexpected state " << state;
203 break;
204 }
205 } while (rv != ERR_IO_PENDING && next_state_ != STATE_NONE);
206 return rv;
207 }
208
OnIOComplete(int result)209 void ProofVerifierChromium::Job::OnIOComplete(int result) {
210 int rv = DoLoop(result);
211 if (rv != ERR_IO_PENDING) {
212 scoped_ptr<ProofVerifierCallback> callback(callback_.Pass());
213 // Callback expects ProofVerifyDetails not ProofVerifyDetailsChromium.
214 scoped_ptr<ProofVerifyDetails> verify_details(verify_details_.Pass());
215 callback->Run(rv == OK, error_details_, &verify_details);
216 // Will delete |this|.
217 proof_verifier_->OnJobComplete(this);
218 }
219 }
220
DoVerifyCert(int result)221 int ProofVerifierChromium::Job::DoVerifyCert(int result) {
222 next_state_ = STATE_VERIFY_CERT_COMPLETE;
223
224 int flags = 0;
225 return verifier_->Verify(
226 cert_.get(),
227 hostname_,
228 flags,
229 SSLConfigService::GetCRLSet().get(),
230 &verify_details_->cert_verify_result,
231 base::Bind(&ProofVerifierChromium::Job::OnIOComplete,
232 base::Unretained(this)),
233 net_log_);
234 }
235
DoVerifyCertComplete(int result)236 int ProofVerifierChromium::Job::DoVerifyCertComplete(int result) {
237 verifier_.reset();
238
239 const CertVerifyResult& cert_verify_result =
240 verify_details_->cert_verify_result;
241 const CertStatus cert_status = cert_verify_result.cert_status;
242 if (transport_security_state_ &&
243 (result == OK ||
244 (IsCertificateError(result) && IsCertStatusMinorError(cert_status))) &&
245 !transport_security_state_->CheckPublicKeyPins(
246 hostname_,
247 cert_verify_result.is_issued_by_known_root,
248 cert_verify_result.public_key_hashes,
249 &verify_details_->pinning_failure_log)) {
250 result = ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN;
251 }
252
253 if (result != OK) {
254 std::string error_string = ErrorToString(result);
255 error_details_ = StringPrintf("Failed to verify certificate chain: %s",
256 error_string.c_str());
257 DLOG(WARNING) << error_details_;
258 }
259
260 // Exit DoLoop and return the result to the caller to VerifyProof.
261 DCHECK_EQ(STATE_NONE, next_state_);
262 return result;
263 }
264
VerifySignature(const string & signed_data,const string & signature,const string & cert)265 bool ProofVerifierChromium::Job::VerifySignature(const string& signed_data,
266 const string& signature,
267 const string& cert) {
268 StringPiece spki;
269 if (!asn1::ExtractSPKIFromDERCert(cert, &spki)) {
270 DLOG(WARNING) << "ExtractSPKIFromDERCert failed";
271 return false;
272 }
273
274 crypto::SignatureVerifier verifier;
275
276 size_t size_bits;
277 X509Certificate::PublicKeyType type;
278 X509Certificate::GetPublicKeyInfo(cert_->os_cert_handle(), &size_bits,
279 &type);
280 if (type == X509Certificate::kPublicKeyTypeRSA) {
281 crypto::SignatureVerifier::HashAlgorithm hash_alg =
282 crypto::SignatureVerifier::SHA256;
283 crypto::SignatureVerifier::HashAlgorithm mask_hash_alg = hash_alg;
284 unsigned int hash_len = 32; // 32 is the length of a SHA-256 hash.
285
286 bool ok = verifier.VerifyInitRSAPSS(
287 hash_alg, mask_hash_alg, hash_len,
288 reinterpret_cast<const uint8*>(signature.data()), signature.size(),
289 reinterpret_cast<const uint8*>(spki.data()), spki.size());
290 if (!ok) {
291 DLOG(WARNING) << "VerifyInitRSAPSS failed";
292 return false;
293 }
294 } else if (type == X509Certificate::kPublicKeyTypeECDSA) {
295 // This is the algorithm ID for ECDSA with SHA-256. Parameters are ABSENT.
296 // RFC 5758:
297 // ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
298 // us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 2 }
299 // ...
300 // When the ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with-SHA384, or
301 // ecdsa-with-SHA512 algorithm identifier appears in the algorithm field
302 // as an AlgorithmIdentifier, the encoding MUST omit the parameters
303 // field. That is, the AlgorithmIdentifier SHALL be a SEQUENCE of one
304 // component, the OID ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with-
305 // SHA384, or ecdsa-with-SHA512.
306 // See also RFC 5480, Appendix A.
307 static const uint8 kECDSAWithSHA256AlgorithmID[] = {
308 0x30, 0x0a,
309 0x06, 0x08,
310 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02,
311 };
312
313 if (!verifier.VerifyInit(
314 kECDSAWithSHA256AlgorithmID, sizeof(kECDSAWithSHA256AlgorithmID),
315 reinterpret_cast<const uint8*>(signature.data()),
316 signature.size(),
317 reinterpret_cast<const uint8*>(spki.data()),
318 spki.size())) {
319 DLOG(WARNING) << "VerifyInit failed";
320 return false;
321 }
322 } else {
323 LOG(ERROR) << "Unsupported public key type " << type;
324 return false;
325 }
326
327 verifier.VerifyUpdate(reinterpret_cast<const uint8*>(kProofSignatureLabel),
328 sizeof(kProofSignatureLabel));
329 verifier.VerifyUpdate(reinterpret_cast<const uint8*>(signed_data.data()),
330 signed_data.size());
331
332 if (!verifier.VerifyFinal()) {
333 DLOG(WARNING) << "VerifyFinal failed";
334 return false;
335 }
336
337 DVLOG(1) << "VerifyFinal success";
338 return true;
339 }
340
ProofVerifierChromium(CertVerifier * cert_verifier,TransportSecurityState * transport_security_state)341 ProofVerifierChromium::ProofVerifierChromium(
342 CertVerifier* cert_verifier,
343 TransportSecurityState* transport_security_state)
344 : cert_verifier_(cert_verifier),
345 transport_security_state_(transport_security_state) {
346 }
347
~ProofVerifierChromium()348 ProofVerifierChromium::~ProofVerifierChromium() {
349 STLDeleteElements(&active_jobs_);
350 }
351
VerifyProof(const std::string & hostname,const std::string & server_config,const std::vector<std::string> & certs,const std::string & signature,const ProofVerifyContext * verify_context,std::string * error_details,scoped_ptr<ProofVerifyDetails> * verify_details,ProofVerifierCallback * callback)352 QuicAsyncStatus ProofVerifierChromium::VerifyProof(
353 const std::string& hostname,
354 const std::string& server_config,
355 const std::vector<std::string>& certs,
356 const std::string& signature,
357 const ProofVerifyContext* verify_context,
358 std::string* error_details,
359 scoped_ptr<ProofVerifyDetails>* verify_details,
360 ProofVerifierCallback* callback) {
361 if (!verify_context) {
362 *error_details = "Missing context";
363 return QUIC_FAILURE;
364 }
365 const ProofVerifyContextChromium* chromium_context =
366 reinterpret_cast<const ProofVerifyContextChromium*>(verify_context);
367 scoped_ptr<Job> job(new Job(this,
368 cert_verifier_,
369 transport_security_state_,
370 chromium_context->net_log));
371 QuicAsyncStatus status = job->VerifyProof(hostname, server_config, certs,
372 signature, error_details,
373 verify_details, callback);
374 if (status == QUIC_PENDING) {
375 active_jobs_.insert(job.release());
376 }
377 return status;
378 }
379
OnJobComplete(Job * job)380 void ProofVerifierChromium::OnJobComplete(Job* job) {
381 active_jobs_.erase(job);
382 delete job;
383 }
384
385 } // namespace net
386