cert_verify_proc.h 9.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_CERT_CERT_VERIFY_PROC_H_
  5. #define NET_CERT_CERT_VERIFY_PROC_H_
  6. #include <string>
  7. #include <vector>
  8. #include "base/feature_list.h"
  9. #include "base/gtest_prod_util.h"
  10. #include "base/memory/ref_counted.h"
  11. #include "build/build_config.h"
  12. #include "crypto/crypto_buildflags.h"
  13. #include "net/base/hash_value.h"
  14. #include "net/base/net_export.h"
  15. namespace net {
  16. class CertNetFetcher;
  17. class CertVerifyResult;
  18. class CRLSet;
  19. class NetLogWithSource;
  20. class X509Certificate;
  21. class ChromeRootStoreData;
  22. typedef std::vector<scoped_refptr<X509Certificate>> CertificateList;
  23. // Class to perform certificate path building and verification for various
  24. // certificate uses. All methods of this class must be thread-safe, as they
  25. // may be called from various non-joinable worker threads.
  26. class NET_EXPORT CertVerifyProc
  27. : public base::RefCountedThreadSafe<CertVerifyProc> {
  28. public:
  29. enum VerifyFlags {
  30. // If set, enables online revocation checking via CRLs and OCSP for the
  31. // certificate chain.
  32. VERIFY_REV_CHECKING_ENABLED = 1 << 0,
  33. // If set, this is equivalent to VERIFY_REV_CHECKING_ENABLED, in that it
  34. // enables online revocation checking via CRLs or OCSP, but only
  35. // for certificates issued by non-public trust anchors. Failure to check
  36. // revocation is treated as a hard failure.
  37. // Note: If VERIFY_CERT_IO_ENABLE is not also supplied, certificates
  38. // that chain to local trust anchors will likely fail - for example, due to
  39. // lacking fresh cached revocation issue (Windows) or because OCSP stapling
  40. // can only provide information for the leaf, and not for any
  41. // intermediates.
  42. VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS = 1 << 1,
  43. // If set, certificates with SHA-1 signatures will be allowed, but only if
  44. // they are issued by non-public trust anchors.
  45. VERIFY_ENABLE_SHA1_LOCAL_ANCHORS = 1 << 2,
  46. // If set, disables the policy enforcement described at
  47. // https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html
  48. VERIFY_DISABLE_SYMANTEC_ENFORCEMENT = 1 << 3,
  49. };
  50. // These values are persisted to logs. Entries should not be renumbered and
  51. // numeric values should never be reused.
  52. enum class NameNormalizationResult {
  53. kError = 0,
  54. kByteEqual = 1,
  55. kNormalized = 2,
  56. kChainLengthOne = 3,
  57. kMaxValue = kChainLengthOne
  58. };
  59. // These values are persisted to logs. Entries should not be renumbered and
  60. // numeric values should never be reused.
  61. enum class EKUStatus {
  62. kInvalid = 0,
  63. kNoEKU = 1,
  64. kAnyEKU = 2,
  65. kServerAuthOnly = 3,
  66. kServerAuthAndClientAuthOnly = 4,
  67. kServerAuthAndOthers = 5,
  68. kOther = 6,
  69. kMaxValue = kOther
  70. };
  71. #if !(BUILDFLAG(IS_FUCHSIA) || BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS))
  72. // Creates and returns a CertVerifyProc that uses the system verifier.
  73. // |cert_net_fetcher| may not be used, depending on the implementation.
  74. static scoped_refptr<CertVerifyProc> CreateSystemVerifyProc(
  75. scoped_refptr<CertNetFetcher> cert_net_fetcher);
  76. #endif
  77. #if BUILDFLAG(IS_FUCHSIA) || BUILDFLAG(USE_NSS_CERTS) || BUILDFLAG(IS_MAC)
  78. // Creates and returns a CertVerifyProcBuiltin using the SSL SystemTrustStore.
  79. static scoped_refptr<CertVerifyProc> CreateBuiltinVerifyProc(
  80. scoped_refptr<CertNetFetcher> cert_net_fetcher);
  81. #endif
  82. CertVerifyProc(const CertVerifyProc&) = delete;
  83. CertVerifyProc& operator=(const CertVerifyProc&) = delete;
  84. // Verifies the certificate against the given hostname as an SSL server
  85. // certificate. Returns OK if successful or an error code upon failure.
  86. //
  87. // The |*verify_result| structure, including the |verify_result->cert_status|
  88. // bitmask, is always filled out regardless of the return value. If the
  89. // certificate has multiple errors, the corresponding status flags are set in
  90. // |verify_result->cert_status|, and the error code for the most serious
  91. // error is returned.
  92. //
  93. // |ocsp_response|, if non-empty, is a stapled OCSP response to use.
  94. //
  95. // |sct_list|, if non-empty, is a SignedCertificateTimestampList from the TLS
  96. // extension as described in RFC6962 section 3.3.1.
  97. //
  98. // |flags| is bitwise OR'd of VerifyFlags:
  99. //
  100. // If VERIFY_REV_CHECKING_ENABLED is set in |flags|, online certificate
  101. // revocation checking is performed (i.e. OCSP and downloading CRLs). CRLSet
  102. // based revocation checking is always enabled, regardless of this flag, if
  103. // |crl_set| is given.
  104. //
  105. // |crl_set|, which is required, points to an CRLSet structure which can be
  106. // used to avoid revocation checks over the network. If you do not have one
  107. // handy, use CRLSet::BuiltinCRLSet().
  108. //
  109. // |additional_trust_anchors| lists certificates that can be trusted when
  110. // building a certificate chain, in addition to the anchors known to the
  111. // implementation.
  112. int Verify(X509Certificate* cert,
  113. const std::string& hostname,
  114. const std::string& ocsp_response,
  115. const std::string& sct_list,
  116. int flags,
  117. CRLSet* crl_set,
  118. const CertificateList& additional_trust_anchors,
  119. CertVerifyResult* verify_result,
  120. const NetLogWithSource& net_log);
  121. // Returns true if the implementation supports passing additional trust
  122. // anchors to the Verify() call. The |additional_trust_anchors| parameter
  123. // passed to Verify() is ignored when this returns false.
  124. virtual bool SupportsAdditionalTrustAnchors() const = 0;
  125. protected:
  126. CertVerifyProc();
  127. virtual ~CertVerifyProc();
  128. // Record a histogram of whether Name normalization was used in verifying the
  129. // chain. This should only be called for successfully validated chains.
  130. static void LogNameNormalizationResult(const std::string& histogram_suffix,
  131. NameNormalizationResult result);
  132. // Record a histogram of whether Name normalization was used in verifying the
  133. // chain. This should only be called for successfully validated chains.
  134. static void LogNameNormalizationMetrics(const std::string& histogram_suffix,
  135. X509Certificate* verified_cert,
  136. bool is_issued_by_known_root);
  137. private:
  138. friend class base::RefCountedThreadSafe<CertVerifyProc>;
  139. FRIEND_TEST_ALL_PREFIXES(CertVerifyProcTest, DigiNotarCerts);
  140. FRIEND_TEST_ALL_PREFIXES(CertVerifyProcTest, TestHasTooLongValidity);
  141. FRIEND_TEST_ALL_PREFIXES(CertVerifyProcTest,
  142. VerifyRejectsSHA1AfterDeprecationLegacyMode);
  143. FRIEND_TEST_ALL_PREFIXES(CertVerifyProcTest, SymantecCertsRejected);
  144. // Performs the actual verification using the desired underlying
  145. //
  146. // On entry, |verify_result| will be default-initialized as a successful
  147. // validation, with |verify_result->verified_cert| set to |cert|.
  148. //
  149. // Implementations are expected to fill in all applicable fields, excluding:
  150. //
  151. // * ocsp_result
  152. // * has_sha1
  153. // * has_sha1_leaf
  154. //
  155. // which will be filled in by |Verify()|. If an error code is returned,
  156. // |verify_result->cert_status| should be non-zero, indicating an
  157. // error occurred.
  158. //
  159. // On success, net::OK should be returned, with |verify_result| updated to
  160. // reflect the successfully verified chain.
  161. virtual int VerifyInternal(X509Certificate* cert,
  162. const std::string& hostname,
  163. const std::string& ocsp_response,
  164. const std::string& sct_list,
  165. int flags,
  166. CRLSet* crl_set,
  167. const CertificateList& additional_trust_anchors,
  168. CertVerifyResult* verify_result,
  169. const NetLogWithSource& net_log) = 0;
  170. // HasNameConstraintsViolation returns true iff one of |public_key_hashes|
  171. // (which are hashes of SubjectPublicKeyInfo structures) has name constraints
  172. // imposed on it and the names in |dns_names| are not permitted.
  173. static bool HasNameConstraintsViolation(
  174. const HashValueVector& public_key_hashes,
  175. const std::string& common_name,
  176. const std::vector<std::string>& dns_names,
  177. const std::vector<std::string>& ip_addrs);
  178. // The CA/Browser Forum's Baseline Requirements specify maximum validity
  179. // periods (https://cabforum.org/baseline-requirements-documents/).
  180. //
  181. // For certificates issued after 1 July 2012: 60 months.
  182. // For certificates issued after 1 April 2015: 39 months.
  183. // For certificates issued after 1 March 2018: 825 days.
  184. //
  185. // For certificates issued before the BRs took effect, there were no
  186. // guidelines, but clamp them at a maximum of 10 year validity, with the
  187. // requirement they expire within 7 years after the effective date of the BRs
  188. // (i.e. by 1 July 2019).
  189. static bool HasTooLongValidity(const X509Certificate& cert);
  190. };
  191. // Factory for creating new CertVerifyProcs when they need to be updated.
  192. class NET_EXPORT CertVerifyProcFactory
  193. : public base::RefCountedThreadSafe<CertVerifyProcFactory> {
  194. public:
  195. // Create a new CertVerifyProc that uses the passed in ChromeRootStoreData.
  196. virtual scoped_refptr<CertVerifyProc> CreateCertVerifyProc(
  197. scoped_refptr<CertNetFetcher> cert_net_fetcher,
  198. const ChromeRootStoreData* root_store_data) = 0;
  199. protected:
  200. virtual ~CertVerifyProcFactory() = default;
  201. private:
  202. friend class base::RefCountedThreadSafe<CertVerifyProcFactory>;
  203. };
  204. } // namespace net
  205. #endif // NET_CERT_CERT_VERIFY_PROC_H_