gecko-dev/security/certverifier/CTLogVerifier.cpp

/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "CTLogVerifier.h"

#include <stdint.h>

#include "CTSerialization.h"
#include "hasht.h"
#include "mozilla/ArrayUtils.h"
#include "mozilla/Assertions.h"
#include "pkix/pkixnss.h"
#include "pkixutil.h"

namespace mozilla { namespace ct {

using namespace mozilla::pkix;

// A TrustDomain used to extract the SCT log signature parameters
// given its subjectPublicKeyInfo.
// Only RSASSA-PKCS1v15 with SHA-256 and ECDSA (using the NIST P-256 curve)
// with SHA-256 are allowed.
// RSA keys must be at least 2048 bits.
// See See RFC 6962, Section 2.1.4.
class SignatureParamsTrustDomain final : public TrustDomain
{
public:
  SignatureParamsTrustDomain()
    : mSignatureAlgorithm(DigitallySigned::SignatureAlgorithm::Anonymous)
  {
  }

  Result GetCertTrust(EndEntityOrCA, const CertPolicyId&, Input,
                      TrustLevel&) override
  {
    return Result::FATAL_ERROR_LIBRARY_FAILURE;
  }

  Result FindIssuer(Input, IssuerChecker&, Time) override
  {
    return Result::FATAL_ERROR_LIBRARY_FAILURE;
  }

  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
                         const Input*, const Input*) override
  {
    return Result::FATAL_ERROR_LIBRARY_FAILURE;
  }

  Result IsChainValid(const DERArray&, Time, const CertPolicyId&) override
  {
    return Result::FATAL_ERROR_LIBRARY_FAILURE;
  }

  Result DigestBuf(Input, DigestAlgorithm, uint8_t*, size_t) override
  {
    return Result::FATAL_ERROR_LIBRARY_FAILURE;
  }

  Result CheckSignatureDigestAlgorithm(DigestAlgorithm, EndEntityOrCA,
                                       Time) override
  {
    return Result::FATAL_ERROR_LIBRARY_FAILURE;
  }

  Result CheckECDSACurveIsAcceptable(EndEntityOrCA, NamedCurve curve) override
  {
    MOZ_ASSERT(mSignatureAlgorithm ==
      DigitallySigned::SignatureAlgorithm::Anonymous);
    if (curve != NamedCurve::secp256r1) {
      return Result::ERROR_UNSUPPORTED_ELLIPTIC_CURVE;
    }
    mSignatureAlgorithm = DigitallySigned::SignatureAlgorithm::ECDSA;
    return Success;
  }

  Result VerifyECDSASignedDigest(const SignedDigest&, Input) override
  {
    return Result::FATAL_ERROR_LIBRARY_FAILURE;
  }

  Result CheckRSAPublicKeyModulusSizeInBits(EndEntityOrCA,
                                            unsigned int modulusSizeInBits)
                                            override
  {
    MOZ_ASSERT(mSignatureAlgorithm ==
      DigitallySigned::SignatureAlgorithm::Anonymous);
    // Require RSA keys of at least 2048 bits. See RFC 6962, Section 2.1.4.
    if (modulusSizeInBits < 2048) {
      return Result::ERROR_INADEQUATE_KEY_SIZE;
    }
    mSignatureAlgorithm = DigitallySigned::SignatureAlgorithm::RSA;
    return Success;
  }

  Result VerifyRSAPKCS1SignedDigest(const SignedDigest&, Input) override
  {
    return Result::FATAL_ERROR_LIBRARY_FAILURE;
  }

  Result CheckValidityIsAcceptable(Time, Time, EndEntityOrCA,
                                   KeyPurposeId) override
  {
    return Result::FATAL_ERROR_LIBRARY_FAILURE;
  }

  Result NetscapeStepUpMatchesServerAuth(Time, bool&) override
  {
    return Result::FATAL_ERROR_LIBRARY_FAILURE;
  }

  void NoteAuxiliaryExtension(AuxiliaryExtension, Input) override
  {
  }

  DigitallySigned::SignatureAlgorithm mSignatureAlgorithm;
};


CTLogVerifier::CTLogVerifier()
  : mSignatureAlgorithm(DigitallySigned::SignatureAlgorithm::Anonymous)
  , mOperatorId(-1)
  , mDisqualified(false)
  , mDisqualificationTime(UINT64_MAX)
{
}

Result
CTLogVerifier::Init(Input subjectPublicKeyInfo,
                    CTLogOperatorId operatorId,
                    CTLogStatus logStatus,
                    uint64_t disqualificationTime)
{
  switch (logStatus) {
    case CTLogStatus::Included:
      mDisqualified = false;
      mDisqualificationTime = UINT64_MAX;
      break;
    case CTLogStatus::Disqualified:
      mDisqualified = true;
      mDisqualificationTime = disqualificationTime;
      break;
    case CTLogStatus::Unknown:
    default:
      MOZ_ASSERT_UNREACHABLE("Unsupported CTLogStatus");
      return Result::FATAL_ERROR_INVALID_ARGS;
  }

  SignatureParamsTrustDomain trustDomain;
  Result rv = CheckSubjectPublicKeyInfo(subjectPublicKeyInfo, trustDomain,
                                        EndEntityOrCA::MustBeEndEntity);
  if (rv != Success) {
    return rv;
  }
  mSignatureAlgorithm = trustDomain.mSignatureAlgorithm;

  rv = InputToBuffer(subjectPublicKeyInfo, mSubjectPublicKeyInfo);
  if (rv != Success) {
    return rv;
  }

  if (mSignatureAlgorithm == DigitallySigned::SignatureAlgorithm::ECDSA) {
    SECItem spkiSECItem = {
      siBuffer,
      mSubjectPublicKeyInfo.begin(),
      static_cast<unsigned int>(mSubjectPublicKeyInfo.length())
    };
    UniqueCERTSubjectPublicKeyInfo spki(
      SECKEY_DecodeDERSubjectPublicKeyInfo(&spkiSECItem));
    if (!spki) {
      return MapPRErrorCodeToResult(PR_GetError());
    }
    mPublicECKey.reset(SECKEY_ExtractPublicKey(spki.get()));
    if (!mPublicECKey) {
      return MapPRErrorCodeToResult(PR_GetError());
    }
    UniquePK11SlotInfo slot(PK11_GetInternalSlot());
    if (!slot) {
      return MapPRErrorCodeToResult(PR_GetError());
    }
    CK_OBJECT_HANDLE handle = PK11_ImportPublicKey(slot.get(),
                                                   mPublicECKey.get(), false);
    if (handle == CK_INVALID_HANDLE) {
      return MapPRErrorCodeToResult(PR_GetError());
    }
  } else {
    mPublicECKey.reset(nullptr);
  }

  if (!mKeyId.resizeUninitialized(SHA256_LENGTH)) {
    return Result::FATAL_ERROR_NO_MEMORY;
  }
  rv = DigestBufNSS(subjectPublicKeyInfo, DigestAlgorithm::sha256,
                    mKeyId.begin(), mKeyId.length());
  if (rv != Success) {
    return rv;
  }

  mOperatorId = operatorId;
  return Success;
}

Result
CTLogVerifier::Verify(const LogEntry& entry,
                      const SignedCertificateTimestamp& sct)
{
  if (mKeyId.empty() || sct.logId != mKeyId) {
    return Result::FATAL_ERROR_INVALID_ARGS;
  }
  if (!SignatureParametersMatch(sct.signature)) {
    return Result::FATAL_ERROR_INVALID_ARGS;
  }

  Buffer serializedLogEntry;
  Result rv = EncodeLogEntry(entry, serializedLogEntry);
  if (rv != Success) {
    return rv;
  }

  Input logEntryInput;
  rv = BufferToInput(serializedLogEntry, logEntryInput);
  if (rv != Success) {
    return rv;
  }

  // sct.extensions may be empty.  If it is, sctExtensionsInput will remain in
  // its default state, which is valid but of length 0.
  Input sctExtensionsInput;
  if (sct.extensions.length() > 0) {
    rv = sctExtensionsInput.Init(sct.extensions.begin(),
                                 sct.extensions.length());
    if (rv != Success) {
      return rv;
    }
  }

  Buffer serializedData;
  rv = EncodeV1SCTSignedData(sct.timestamp, logEntryInput, sctExtensionsInput,
                             serializedData);
  if (rv != Success) {
    return rv;
  }
  return VerifySignature(serializedData, sct.signature.signatureData);
}

Result
CTLogVerifier::VerifySignedTreeHead(const SignedTreeHead& sth)
{
  if (!SignatureParametersMatch(sth.signature)) {
    return Result::FATAL_ERROR_INVALID_ARGS;
  }

  Buffer serializedData;
  Result rv = EncodeTreeHeadSignature(sth, serializedData);
  if (rv != Success) {
    return rv;
  }
  return VerifySignature(serializedData, sth.signature.signatureData);
}

bool
CTLogVerifier::SignatureParametersMatch(const DigitallySigned& signature)
{
  return signature.SignatureParametersMatch(
    DigitallySigned::HashAlgorithm::SHA256, mSignatureAlgorithm);
}

static Result
FasterVerifyECDSASignedDigestNSS(const SignedDigest& sd,
                                 UniqueSECKEYPublicKey& pubkey)
{
  MOZ_ASSERT(pubkey);
  if (!pubkey) {
    return Result::FATAL_ERROR_LIBRARY_FAILURE;
  }
  // The signature is encoded as a DER SEQUENCE of two INTEGERs. PK11_Verify
  // expects the signature as only the two integers r and s (so no encoding -
  // just two series of bytes each half as long as SECKEY_SignatureLen(pubkey)).
  // DSAU_DecodeDerSigToLen converts from the former format to the latter.
  SECItem derSignatureSECItem(UnsafeMapInputToSECItem(sd.signature));
  size_t signatureLen = SECKEY_SignatureLen(pubkey.get());
  if (signatureLen == 0) {
    return MapPRErrorCodeToResult(PR_GetError());
  }
  UniqueSECItem signatureSECItem(DSAU_DecodeDerSigToLen(&derSignatureSECItem,
                                                        signatureLen));
  if (!signatureSECItem) {
    return MapPRErrorCodeToResult(PR_GetError());
  }
  SECItem digestSECItem(UnsafeMapInputToSECItem(sd.digest));
  SECStatus srv = PK11_Verify(pubkey.get(), signatureSECItem.get(),
                              &digestSECItem, nullptr);
  if (srv != SECSuccess) {
    return MapPRErrorCodeToResult(PR_GetError());
  }

  return Success;
}

Result
CTLogVerifier::VerifySignature(Input data, Input signature)
{
  uint8_t digest[SHA256_LENGTH];
  Result rv = DigestBufNSS(data, DigestAlgorithm::sha256, digest,
                           ArrayLength(digest));
  if (rv != Success) {
    return rv;
  }

  SignedDigest signedDigest;
  signedDigest.digestAlgorithm = DigestAlgorithm::sha256;
  rv = signedDigest.digest.Init(digest, ArrayLength(digest));
  if (rv != Success) {
    return rv;
  }
  rv = signedDigest.signature.Init(signature);
  if (rv != Success) {
    return rv;
  }

  Input spki;
  rv = BufferToInput(mSubjectPublicKeyInfo, spki);
  if (rv != Success) {
    return rv;
  }

  switch (mSignatureAlgorithm) {
    case DigitallySigned::SignatureAlgorithm::RSA:
      rv = VerifyRSAPKCS1SignedDigestNSS(signedDigest, spki, nullptr);
      break;
    case DigitallySigned::SignatureAlgorithm::ECDSA:
      rv = FasterVerifyECDSASignedDigestNSS(signedDigest, mPublicECKey);
      break;
    // We do not expect new values added to this enum any time soon,
    // so just listing all the available ones seems to be the easiest way
    // to suppress warning C4061 on MSVC (which expects all values of the
    // enum to be explicitly handled).
    case DigitallySigned::SignatureAlgorithm::Anonymous:
    case DigitallySigned::SignatureAlgorithm::DSA:
    default:
      MOZ_ASSERT_UNREACHABLE("RSA/ECDSA expected");
      return Result::FATAL_ERROR_INVALID_ARGS;
  }
  if (rv != Success) {
    if (IsFatalError(rv)) {
      return rv;
    }
    // If the error is non-fatal, we assume the signature was invalid.
    return Result::ERROR_BAD_SIGNATURE;
  }
  return Success;
}

Result
CTLogVerifier::VerifySignature(const Buffer& data, const Buffer& signature)
{
  Input dataInput;
  Result rv = BufferToInput(data, dataInput);
  if (rv != Success) {
    return rv;
  }
  Input signatureInput;
  rv = BufferToInput(signature, signatureInput);
  if (rv != Success) {
    return rv;
  }
  return VerifySignature(dataInput, signatureInput);
}

} } // namespace mozilla::ct