blob: 69c0df333c2ef5b170425181fe1d260b8bb36c5d [file] [log] [blame]
/*
* Copyright (C) 2012 Michael Brown <mbrown@fensystems.co.uk>.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as
* published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*
* You can also choose to distribute this program under the terms of
* the Unmodified Binary Distribution Licence (as given in the file
* COPYING.UBDL), provided that you have satisfied its requirements.
*/
FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
#include <string.h>
#include <stdio.h>
#include <errno.h>
#include <ipxe/refcnt.h>
#include <ipxe/malloc.h>
#include <ipxe/interface.h>
#include <ipxe/xfer.h>
#include <ipxe/open.h>
#include <ipxe/iobuf.h>
#include <ipxe/xferbuf.h>
#include <ipxe/process.h>
#include <ipxe/x509.h>
#include <ipxe/settings.h>
#include <ipxe/dhcp.h>
#include <ipxe/base64.h>
#include <ipxe/crc32.h>
#include <ipxe/ocsp.h>
#include <ipxe/job.h>
#include <ipxe/validator.h>
#include <config/crypto.h>
/** @file
*
* Certificate validator
*
*/
struct validator;
/** A certificate validator action */
struct validator_action {
/** Name */
const char *name;
/** Action to take upon completed transfer */
void ( * done ) ( struct validator *validator, int rc );
};
/** A certificate validator */
struct validator {
/** Reference count */
struct refcnt refcnt;
/** Job control interface */
struct interface job;
/** Data transfer interface */
struct interface xfer;
/** Process */
struct process process;
/** Most relevant status code
*
* The cross-signed certificate mechanism may attempt several
* downloads as it works its way up the provided partial chain
* to locate a suitable cross-signed certificate with which to
* complete the chain.
*
* Some of these download or validation attempts may fail for
* uninteresting reasons (i.e. because a cross-signed
* certificate has never existed for that link in the chain).
*
* We must therefore keep track of the most relevant error
* that has occurred, in order to be able to report a
* meaningful overall status to the user.
*
* As a concrete example: consider the case of an expired OCSP
* signer for an intermediate certificate. This will cause
* OCSP validation to fail for that intermediate certificate,
* and this is the error that should eventually be reported to
* the user. We do not want to instead report the
* uninteresting fact that no cross-signed certificate was
* found for the remaining links in the chain, nor do we want
* to report just a generic "OCSP required" error.
*
* We record the most relevant status code whenever a
* definitely relevant error occurs, and clear it whenever we
* successfully make forward progress (e.g. by completing
* OCSP, or by adding new cross-signed certificates).
*
* When we subsequently attempt to validate the chain, we
* report the most relevant error status code (if recorded),
* otherwise we report the validation error itself.
*/
int rc;
/** Root of trust (or NULL to use default) */
struct x509_root *root;
/** X.509 certificate chain */
struct x509_chain *chain;
/** OCSP check */
struct ocsp_check *ocsp;
/** Data buffer */
struct xfer_buffer buffer;
/** Current action */
const struct validator_action *action;
/** Current certificate (for progress reporting)
*
* This will always be present within the certificate chain
* and so this pointer does not hold a reference to the
* certificate.
*/
struct x509_certificate *cert;
/** Current link within certificate chain */
struct x509_link *link;
};
/**
* Get validator name (for debug messages)
*
* @v validator Certificate validator
* @ret name Validator name
*/
static const char * validator_name ( struct validator *validator ) {
/* Use name of first certificate in chain */
return x509_name ( x509_first ( validator->chain ) );
}
/**
* Free certificate validator
*
* @v refcnt Reference count
*/
static void validator_free ( struct refcnt *refcnt ) {
struct validator *validator =
container_of ( refcnt, struct validator, refcnt );
DBGC2 ( validator, "VALIDATOR %p \"%s\" freed\n",
validator, validator_name ( validator ) );
x509_root_put ( validator->root );
x509_chain_put ( validator->chain );
ocsp_put ( validator->ocsp );
xferbuf_free ( &validator->buffer );
free ( validator );
}
/**
* Mark certificate validation as finished
*
* @v validator Certificate validator
* @v rc Reason for finishing
*/
static void validator_finished ( struct validator *validator, int rc ) {
/* Remove process */
process_del ( &validator->process );
/* Close all interfaces */
intf_shutdown ( &validator->xfer, rc );
intf_shutdown ( &validator->job, rc );
}
/****************************************************************************
*
* Job control interface
*
*/
/**
* Report job progress
*
* @v validator Certificate validator
* @v progress Progress report to fill in
* @ret ongoing_rc Ongoing job status code (if known)
*/
static int validator_progress ( struct validator *validator,
struct job_progress *progress ) {
/* Report current action, if applicable */
if ( validator->action ) {
snprintf ( progress->message, sizeof ( progress->message ),
"%s %s", validator->action->name,
x509_name ( validator->cert ) );
}
return 0;
}
/** Certificate validator job control interface operations */
static struct interface_operation validator_job_operations[] = {
INTF_OP ( job_progress, struct validator *, validator_progress ),
INTF_OP ( intf_close, struct validator *, validator_finished ),
};
/** Certificate validator job control interface descriptor */
static struct interface_descriptor validator_job_desc =
INTF_DESC ( struct validator, job, validator_job_operations );
/****************************************************************************
*
* Cross-signing certificates
*
*/
/** Cross-signed certificate source setting */
const struct setting crosscert_setting __setting ( SETTING_CRYPTO, crosscert )={
.name = "crosscert",
.description = "Cross-signed certificate source",
.tag = DHCP_EB_CROSS_CERT,
.type = &setting_type_string,
};
/** Default cross-signed certificate source */
static const char crosscert_default[] = CROSSCERT;
/**
* Append cross-signing certificates to certificate chain
*
* @v validator Certificate validator
* @v rc Completion status code
* @ret rc Return status code
*/
static void validator_append ( struct validator *validator, int rc ) {
struct asn1_cursor cursor;
struct x509_chain *certs;
struct x509_certificate *cert;
struct x509_link *link;
struct x509_link *prev;
/* Check for errors */
if ( rc != 0 ) {
DBGC ( validator, "VALIDATOR %p \"%s\" could not download ",
validator, validator_name ( validator ) );
DBGC ( validator, "\"%s\" cross-signature: %s\n",
x509_name ( validator->cert ), strerror ( rc ) );
/* If the overall validation is going to fail, then we
* will end up attempting multiple downloads for
* non-existent cross-signed certificates as we work
* our way up the certificate chain. Do not record
* these as relevant errors, since we want to
* eventually report whichever much more relevant
* error occurred previously.
*/
goto err_irrelevant;
}
DBGC ( validator, "VALIDATOR %p \"%s\" downloaded ",
validator, validator_name ( validator ) );
DBGC ( validator, "\"%s\" cross-signature\n",
x509_name ( validator->cert ) );
/* Allocate certificate list */
certs = x509_alloc_chain();
if ( ! certs ) {
rc = -ENOMEM;
goto err_alloc_certs;
}
/* Initialise cursor */
cursor.data = validator->buffer.data;
cursor.len = validator->buffer.len;
/* Enter certificateSet */
if ( ( rc = asn1_enter ( &cursor, ASN1_SET ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p \"%s\" could not enter "
"certificateSet: %s\n", validator,
validator_name ( validator ), strerror ( rc ) );
goto err_certificateset;
}
/* Add each certificate to list */
while ( cursor.len ) {
/* Add certificate to list */
if ( ( rc = x509_append_raw ( certs, cursor.data,
cursor.len ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p \"%s\" could not "
"append certificate: %s\n", validator,
validator_name ( validator ), strerror ( rc) );
DBGC_HDA ( validator, 0, cursor.data, cursor.len );
goto err_append_raw;
}
cert = x509_last ( certs );
DBGC ( validator, "VALIDATOR %p \"%s\" found certificate ",
validator, validator_name ( validator ) );
DBGC ( validator, "%s\n", x509_name ( cert ) );
/* Move to next certificate */
asn1_skip_any ( &cursor );
}
/* Truncate existing certificate chain at current link */
link = validator->link;
assert ( link->flags & X509_LINK_FL_CROSSED );
x509_truncate ( validator->chain, link );
/* Append certificates to chain */
if ( ( rc = x509_auto_append ( validator->chain, certs ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p \"%s\" could not append "
"certificates: %s\n", validator,
validator_name ( validator ), strerror ( rc ) );
goto err_auto_append;
}
/* Record that a cross-signed certificate download has already
* been performed for all but the last of the appended
* certificates. (It may be necessary to perform a further
* download to complete the chain, if this download did not
* extend all the way to a root of trust.)
*/
prev = NULL;
list_for_each_entry_continue ( link, &validator->chain->links, list ) {
if ( prev )
prev->flags |= X509_LINK_FL_CROSSED;
prev = link;
}
/* Success */
rc = 0;
err_auto_append:
err_append_raw:
err_certificateset:
x509_chain_put ( certs );
err_alloc_certs:
validator->rc = rc;
err_irrelevant:
/* Do not record irrelevant errors */
return;
}
/** Cross-signing certificate download validator action */
static const struct validator_action validator_crosscert = {
.name = "XCRT",
.done = validator_append,
};
/**
* Start download of cross-signing certificate
*
* @v validator Certificate validator
* @v link Link in certificate chain
* @ret rc Return status code
*/
static int validator_start_download ( struct validator *validator,
struct x509_link *link ) {
struct x509_certificate *cert = link->cert;
const struct asn1_cursor *issuer = &cert->issuer.raw;
const char *crosscert;
char *crosscert_copy;
char *uri_string;
size_t uri_string_len;
uint32_t crc;
int len;
int rc;
/* Determine cross-signed certificate source */
fetch_string_setting_copy ( NULL, &crosscert_setting, &crosscert_copy );
crosscert = ( crosscert_copy ? crosscert_copy : crosscert_default );
if ( ! crosscert[0] ) {
rc = -EINVAL;
goto err_check_uri_string;
}
/* Allocate URI string */
uri_string_len = ( strlen ( crosscert ) + 22 /* "/%08x.der?subject=" */
+ base64_encoded_len ( issuer->len ) + 1 /* NUL */ );
uri_string = zalloc ( uri_string_len );
if ( ! uri_string ) {
rc = -ENOMEM;
goto err_alloc_uri_string;
}
/* Generate CRC32 */
crc = crc32_le ( 0xffffffffUL, issuer->data, issuer->len );
/* Generate URI string */
len = snprintf ( uri_string, uri_string_len, "%s/%08x.der?subject=",
crosscert, crc );
base64_encode ( issuer->data, issuer->len, ( uri_string + len ),
( uri_string_len - len ) );
DBGC ( validator, "VALIDATOR %p \"%s\" downloading ",
validator, validator_name ( validator ) );
DBGC ( validator, "\"%s\" cross-signature from %s\n",
x509_name ( cert ), uri_string );
/* Set completion handler */
validator->action = &validator_crosscert;
validator->cert = cert;
validator->link = link;
/* Open URI */
if ( ( rc = xfer_open_uri_string ( &validator->xfer,
uri_string ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p \"%s\" could not open %s: "
"%s\n", validator, validator_name ( validator ),
uri_string, strerror ( rc ) );
goto err_open_uri_string;
}
/* Free temporary allocations */
free ( uri_string );
free ( crosscert_copy );
/* Success */
return 0;
intf_restart ( &validator->xfer, rc );
err_open_uri_string:
free ( uri_string );
err_alloc_uri_string:
err_check_uri_string:
free ( crosscert_copy );
validator->rc = rc;
return rc;
}
/****************************************************************************
*
* OCSP checks
*
*/
/**
* Validate OCSP response
*
* @v validator Certificate validator
* @v rc Completion status code
*/
static void validator_ocsp_validate ( struct validator *validator, int rc ) {
const void *data = validator->buffer.data;
size_t len = validator->buffer.len;
time_t now;
/* Check for errors */
if ( rc != 0 ) {
DBGC ( validator, "VALIDATOR %p \"%s\" could not fetch OCSP "
"response: %s\n", validator,
validator_name ( validator ), strerror ( rc ) );
goto err_status;
}
/* Record OCSP response */
if ( ( rc = ocsp_response ( validator->ocsp, data, len ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p \"%s\" could not record OCSP "
"response: %s\n", validator,
validator_name ( validator ), strerror ( rc ) );
goto err_response;
}
/* Validate OCSP response */
now = time ( NULL );
if ( ( rc = ocsp_validate ( validator->ocsp, now ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p \"%s\" could not validate "
"OCSP response: %s\n", validator,
validator_name ( validator ), strerror ( rc ) );
goto err_validate;
}
/* Success */
DBGC ( validator, "VALIDATOR %p \"%s\" checked ",
validator, validator_name ( validator ) );
DBGC ( validator, "\"%s\" via OCSP\n", x509_name ( validator->cert ) );
err_validate:
err_response:
err_status:
ocsp_put ( validator->ocsp );
validator->ocsp = NULL;
validator->rc = rc;
}
/** OCSP validator action */
static const struct validator_action validator_ocsp = {
.name = "OCSP",
.done = validator_ocsp_validate,
};
/**
* Start OCSP check
*
* @v validator Certificate validator
* @v cert Certificate to check
* @v issuer Issuing certificate
* @ret rc Return status code
*/
static int validator_start_ocsp ( struct validator *validator,
struct x509_certificate *cert,
struct x509_certificate *issuer ) {
const char *uri_string;
int rc;
/* Create OCSP check */
assert ( validator->ocsp == NULL );
if ( ( rc = ocsp_check ( cert, issuer, &validator->ocsp ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p \"%s\" could not create OCSP "
"check: %s\n", validator, validator_name ( validator ),
strerror ( rc ) );
goto err_check;
}
/* Set completion handler */
validator->action = &validator_ocsp;
validator->cert = cert;
/* Open URI */
uri_string = validator->ocsp->uri_string;
DBGC ( validator, "VALIDATOR %p \"%s\" checking ",
validator, validator_name ( validator ) );
DBGC ( validator, "\"%s\" via %s\n",
x509_name ( cert ), uri_string );
if ( ( rc = xfer_open_uri_string ( &validator->xfer,
uri_string ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p \"%s\" could not open %s: "
"%s\n", validator, validator_name ( validator ),
uri_string, strerror ( rc ) );
goto err_open;
}
return 0;
intf_restart ( &validator->xfer, rc );
err_open:
ocsp_put ( validator->ocsp );
validator->ocsp = NULL;
err_check:
validator->rc = rc;
return rc;
}
/****************************************************************************
*
* Data transfer interface
*
*/
/**
* Close data transfer interface
*
* @v validator Certificate validator
* @v rc Reason for close
*/
static void validator_xfer_close ( struct validator *validator, int rc ) {
/* Close data transfer interface */
intf_restart ( &validator->xfer, rc );
DBGC2 ( validator, "VALIDATOR %p \"%s\" transfer complete\n",
validator, validator_name ( validator ) );
/* Process completed download */
assert ( validator->action != NULL );
validator->action->done ( validator, rc );
/* Free downloaded data */
xferbuf_free ( &validator->buffer );
/* Resume validation process */
process_add ( &validator->process );
}
/**
* Receive data
*
* @v validator Certificate validator
* @v iobuf I/O buffer
* @v meta Data transfer metadata
* @ret rc Return status code
*/
static int validator_xfer_deliver ( struct validator *validator,
struct io_buffer *iobuf,
struct xfer_metadata *meta ) {
int rc;
/* Add data to buffer */
if ( ( rc = xferbuf_deliver ( &validator->buffer, iob_disown ( iobuf ),
meta ) ) != 0 ) {
DBGC ( validator, "VALIDATOR %p \"%s\" could not receive "
"data: %s\n", validator, validator_name ( validator ),
strerror ( rc ) );
validator_xfer_close ( validator, rc );
return rc;
}
return 0;
}
/** Certificate validator data transfer interface operations */
static struct interface_operation validator_xfer_operations[] = {
INTF_OP ( xfer_deliver, struct validator *, validator_xfer_deliver ),
INTF_OP ( intf_close, struct validator *, validator_xfer_close ),
};
/** Certificate validator data transfer interface descriptor */
static struct interface_descriptor validator_xfer_desc =
INTF_DESC ( struct validator, xfer, validator_xfer_operations );
/****************************************************************************
*
* Validation process
*
*/
/**
* Certificate validation process
*
* @v validator Certificate validator
*/
static void validator_step ( struct validator *validator ) {
struct x509_chain *chain = validator->chain;
struct x509_link *link;
struct x509_link *prev;
struct x509_certificate *cert;
time_t now;
int rc;
/* Try validating chain. Try even if the chain is incomplete,
* since certificates may already have been validated
* previously.
*/
now = time ( NULL );
if ( ( rc = x509_validate_chain ( chain, now, NULL,
validator->root ) ) == 0 ) {
DBGC ( validator, "VALIDATOR %p \"%s\" validated\n",
validator, validator_name ( validator ) );
validator_finished ( validator, 0 );
return;
}
DBGC ( validator, "VALIDATOR %p \"%s\" not yet valid: %s\n",
validator, validator_name ( validator ), strerror ( rc ) );
/* Record as the most relevant error, if no more relevant
* error has already been recorded.
*/
if ( validator->rc == 0 )
validator->rc = rc;
/* Find the first valid link in the chain, if any
*
* There is no point in attempting OCSP or cross-signed
* certificate downloads for certificates after the first
* valid link in the chain, since they cannot make a
* difference to the overall validation of the chain.
*/
prev = NULL;
list_for_each_entry ( link, &chain->links, list ) {
/* Dump link information (for debugging) */
DBGC ( validator, "VALIDATOR %p \"%s\" has link ",
validator, validator_name ( validator ) );
DBGC ( validator, "\"%s\"%s%s%s%s%s\n",
x509_name ( link->cert ),
( ocsp_required ( link->cert ) ? " [NEEDOCSP]" : "" ),
( ( link->flags & X509_LINK_FL_OCSPED ) ?
" [OCSPED]" : "" ),
( ( link->flags & X509_LINK_FL_CROSSED ) ?
" [CROSSED]" : "" ),
( x509_is_self_signed ( link->cert ) ? " [SELF]" : "" ),
( x509_is_valid ( link->cert, validator->root ) ?
" [VALID]" : "" ) );
/* Stop at first valid link */
if ( x509_is_valid ( link->cert, validator->root ) )
break;
prev = link;
}
/* If this link is the issuer for a certificate that is
* pending an OCSP check attempt, then start OCSP to validate
* that certificate.
*
* If OCSP is not required for the issued certificate, or has
* already been attempted, or if we were unable to start OCSP
* for any reason, then proceed to attempting a cross-signed
* certificate download (which may end up replacing this
* issuer anyway).
*/
if ( ( ! list_is_head_entry ( link, &chain->links, list ) ) &&
( ! ( link->flags & X509_LINK_FL_OCSPED ) ) &&
( prev != NULL ) && ocsp_required ( prev->cert ) ) {
/* Mark OCSP as attempted with this issuer */
link->flags |= X509_LINK_FL_OCSPED;
/* Start OCSP */
if ( ( rc = validator_start_ocsp ( validator, prev->cert,
link->cert ) ) == 0 ) {
/* Sleep until OCSP is complete */
return;
}
}
/* Work back up the chain (starting from the already
* identified first valid link, if any) to find a not-yet
* valid certificate for which we could attempt to download a
* cross-signed certificate chain.
*/
list_for_each_entry_continue_reverse ( link, &chain->links, list ) {
cert = link->cert;
/* Sanity check */
assert ( ! x509_is_valid ( cert, validator->root ) );
/* Skip self-signed certificates (cannot be cross-signed) */
if ( x509_is_self_signed ( cert ) )
continue;
/* Skip previously attempted cross-signed downloads */
if ( link->flags & X509_LINK_FL_CROSSED )
continue;
/* Mark cross-signed certificate download as attempted */
link->flags |= X509_LINK_FL_CROSSED;
/* Start cross-signed certificate download */
if ( ( rc = validator_start_download ( validator,
link ) ) == 0 ) {
/* Sleep until download is complete */
return;
}
}
/* Nothing more to try: fail the validation */
validator_finished ( validator, validator->rc );
}
/** Certificate validator process descriptor */
static struct process_descriptor validator_process_desc =
PROC_DESC_ONCE ( struct validator, process, validator_step );
/****************************************************************************
*
* Instantiator
*
*/
/**
* Instantiate a certificate validator
*
* @v job Job control interface
* @v chain X.509 certificate chain
* @v root Root of trust, or NULL to use default
* @ret rc Return status code
*/
int create_validator ( struct interface *job, struct x509_chain *chain,
struct x509_root *root ) {
struct validator *validator;
int rc;
/* Sanity check */
if ( ! chain ) {
rc = -EINVAL;
goto err_sanity;
}
/* Allocate and initialise structure */
validator = zalloc ( sizeof ( *validator ) );
if ( ! validator ) {
rc = -ENOMEM;
goto err_alloc;
}
ref_init ( &validator->refcnt, validator_free );
intf_init ( &validator->job, &validator_job_desc,
&validator->refcnt );
intf_init ( &validator->xfer, &validator_xfer_desc,
&validator->refcnt );
process_init ( &validator->process, &validator_process_desc,
&validator->refcnt );
validator->root = x509_root_get ( root );
validator->chain = x509_chain_get ( chain );
xferbuf_malloc_init ( &validator->buffer );
/* Attach parent interface, mortalise self, and return */
intf_plug_plug ( &validator->job, job );
ref_put ( &validator->refcnt );
DBGC2 ( validator, "VALIDATOR %p \"%s\" validating X509 chain %p\n",
validator, validator_name ( validator ), validator->chain );
return 0;
validator_finished ( validator, rc );
ref_put ( &validator->refcnt );
err_alloc:
err_sanity:
return rc;
}