github.com/x04/go/src@v0.0.0-20200202162449-3d481ceb3525/crypto/x509/verify.go (about) 1 // Copyright 2011 The Go Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style 3 // license that can be found in the LICENSE file. 4 5 package x509 6 7 import ( 8 "github.com/x04/go/src/bytes" 9 "github.com/x04/go/src/errors" 10 "github.com/x04/go/src/fmt" 11 "github.com/x04/go/src/net" 12 "github.com/x04/go/src/net/url" 13 "github.com/x04/go/src/os" 14 "github.com/x04/go/src/reflect" 15 "github.com/x04/go/src/runtime" 16 "github.com/x04/go/src/strings" 17 "github.com/x04/go/src/time" 18 "github.com/x04/go/src/unicode/utf8" 19 ) 20 21 // ignoreCN disables interpreting Common Name as a hostname. See issue 24151. 22 var ignoreCN = strings.Contains(os.Getenv("GODEBUG"), "x509ignoreCN=1") 23 24 type InvalidReason int 25 26 const ( 27 // NotAuthorizedToSign results when a certificate is signed by another 28 // which isn't marked as a CA certificate. 29 NotAuthorizedToSign InvalidReason = iota 30 // Expired results when a certificate has expired, based on the time 31 // given in the VerifyOptions. 32 Expired 33 // CANotAuthorizedForThisName results when an intermediate or root 34 // certificate has a name constraint which doesn't permit a DNS or 35 // other name (including IP address) in the leaf certificate. 36 CANotAuthorizedForThisName 37 // TooManyIntermediates results when a path length constraint is 38 // violated. 39 TooManyIntermediates 40 // IncompatibleUsage results when the certificate's key usage indicates 41 // that it may only be used for a different purpose. 42 IncompatibleUsage 43 // NameMismatch results when the subject name of a parent certificate 44 // does not match the issuer name in the child. 45 NameMismatch 46 // NameConstraintsWithoutSANs results when a leaf certificate doesn't 47 // contain a Subject Alternative Name extension, but a CA certificate 48 // contains name constraints, and the Common Name can be interpreted as 49 // a hostname. 50 // 51 // You can avoid this error by setting the experimental GODEBUG environment 52 // variable to "x509ignoreCN=1", disabling Common Name matching entirely. 53 // This behavior might become the default in the future. 54 NameConstraintsWithoutSANs 55 // UnconstrainedName results when a CA certificate contains permitted 56 // name constraints, but leaf certificate contains a name of an 57 // unsupported or unconstrained type. 58 UnconstrainedName 59 // TooManyConstraints results when the number of comparison operations 60 // needed to check a certificate exceeds the limit set by 61 // VerifyOptions.MaxConstraintComparisions. This limit exists to 62 // prevent pathological certificates can consuming excessive amounts of 63 // CPU time to verify. 64 TooManyConstraints 65 // CANotAuthorizedForExtKeyUsage results when an intermediate or root 66 // certificate does not permit a requested extended key usage. 67 CANotAuthorizedForExtKeyUsage 68 ) 69 70 // CertificateInvalidError results when an odd error occurs. Users of this 71 // library probably want to handle all these errors uniformly. 72 type CertificateInvalidError struct { 73 Cert *Certificate 74 Reason InvalidReason 75 Detail string 76 } 77 78 func (e CertificateInvalidError) Error() string { 79 switch e.Reason { 80 case NotAuthorizedToSign: 81 return "x509: certificate is not authorized to sign other certificates" 82 case Expired: 83 return "x509: certificate has expired or is not yet valid: " + e.Detail 84 case CANotAuthorizedForThisName: 85 return "x509: a root or intermediate certificate is not authorized to sign for this name: " + e.Detail 86 case CANotAuthorizedForExtKeyUsage: 87 return "x509: a root or intermediate certificate is not authorized for an extended key usage: " + e.Detail 88 case TooManyIntermediates: 89 return "x509: too many intermediates for path length constraint" 90 case IncompatibleUsage: 91 return "x509: certificate specifies an incompatible key usage" 92 case NameMismatch: 93 return "x509: issuer name does not match subject from issuing certificate" 94 case NameConstraintsWithoutSANs: 95 return "x509: issuer has name constraints but leaf doesn't have a SAN extension" 96 case UnconstrainedName: 97 return "x509: issuer has name constraints but leaf contains unknown or unconstrained name: " + e.Detail 98 } 99 return "x509: unknown error" 100 } 101 102 // HostnameError results when the set of authorized names doesn't match the 103 // requested name. 104 type HostnameError struct { 105 Certificate *Certificate 106 Host string 107 } 108 109 func (h HostnameError) Error() string { 110 c := h.Certificate 111 112 if !c.hasSANExtension() && !validHostname(c.Subject.CommonName) && 113 matchHostnames(toLowerCaseASCII(c.Subject.CommonName), toLowerCaseASCII(h.Host)) { 114 // This would have validated, if it weren't for the validHostname check on Common Name. 115 return "x509: Common Name is not a valid hostname: " + c.Subject.CommonName 116 } 117 118 var valid string 119 if ip := net.ParseIP(h.Host); ip != nil { 120 // Trying to validate an IP 121 if len(c.IPAddresses) == 0 { 122 return "x509: cannot validate certificate for " + h.Host + " because it doesn't contain any IP SANs" 123 } 124 for _, san := range c.IPAddresses { 125 if len(valid) > 0 { 126 valid += ", " 127 } 128 valid += san.String() 129 } 130 } else { 131 if c.commonNameAsHostname() { 132 valid = c.Subject.CommonName 133 } else { 134 valid = strings.Join(c.DNSNames, ", ") 135 } 136 } 137 138 if len(valid) == 0 { 139 return "x509: certificate is not valid for any names, but wanted to match " + h.Host 140 } 141 return "x509: certificate is valid for " + valid + ", not " + h.Host 142 } 143 144 // UnknownAuthorityError results when the certificate issuer is unknown 145 type UnknownAuthorityError struct { 146 Cert *Certificate 147 // hintErr contains an error that may be helpful in determining why an 148 // authority wasn't found. 149 hintErr error 150 // hintCert contains a possible authority certificate that was rejected 151 // because of the error in hintErr. 152 hintCert *Certificate 153 } 154 155 func (e UnknownAuthorityError) Error() string { 156 s := "x509: certificate signed by unknown authority" 157 if e.hintErr != nil { 158 certName := e.hintCert.Subject.CommonName 159 if len(certName) == 0 { 160 if len(e.hintCert.Subject.Organization) > 0 { 161 certName = e.hintCert.Subject.Organization[0] 162 } else { 163 certName = "serial:" + e.hintCert.SerialNumber.String() 164 } 165 } 166 s += fmt.Sprintf(" (possibly because of %q while trying to verify candidate authority certificate %q)", e.hintErr, certName) 167 } 168 return s 169 } 170 171 // SystemRootsError results when we fail to load the system root certificates. 172 type SystemRootsError struct { 173 Err error 174 } 175 176 func (se SystemRootsError) Error() string { 177 msg := "x509: failed to load system roots and no roots provided" 178 if se.Err != nil { 179 return msg + "; " + se.Err.Error() 180 } 181 return msg 182 } 183 184 // errNotParsed is returned when a certificate without ASN.1 contents is 185 // verified. Platform-specific verification needs the ASN.1 contents. 186 var errNotParsed = errors.New("x509: missing ASN.1 contents; use ParseCertificate") 187 188 // VerifyOptions contains parameters for Certificate.Verify. It's a structure 189 // because other PKIX verification APIs have ended up needing many options. 190 type VerifyOptions struct { 191 DNSName string 192 Intermediates *CertPool 193 Roots *CertPool // if nil, the system roots are used 194 CurrentTime time.Time // if zero, the current time is used 195 // KeyUsage specifies which Extended Key Usage values are acceptable. A leaf 196 // certificate is accepted if it contains any of the listed values. An empty 197 // list means ExtKeyUsageServerAuth. To accept any key usage, include 198 // ExtKeyUsageAny. 199 // 200 // Certificate chains are required to nest these extended key usage values. 201 // (This matches the Windows CryptoAPI behavior, but not the spec.) 202 KeyUsages []ExtKeyUsage 203 // MaxConstraintComparisions is the maximum number of comparisons to 204 // perform when checking a given certificate's name constraints. If 205 // zero, a sensible default is used. This limit prevents pathological 206 // certificates from consuming excessive amounts of CPU time when 207 // validating. 208 MaxConstraintComparisions int 209 } 210 211 const ( 212 leafCertificate = iota 213 intermediateCertificate 214 rootCertificate 215 ) 216 217 // rfc2821Mailbox represents a “mailbox” (which is an email address to most 218 // people) by breaking it into the “local” (i.e. before the '@') and “domain” 219 // parts. 220 type rfc2821Mailbox struct { 221 local, domain string 222 } 223 224 // parseRFC2821Mailbox parses an email address into local and domain parts, 225 // based on the ABNF for a “Mailbox” from RFC 2821. According to RFC 5280, 226 // Section 4.2.1.6 that's correct for an rfc822Name from a certificate: “The 227 // format of an rfc822Name is a "Mailbox" as defined in RFC 2821, Section 4.1.2”. 228 func parseRFC2821Mailbox(in string) (mailbox rfc2821Mailbox, ok bool) { 229 if len(in) == 0 { 230 return mailbox, false 231 } 232 233 localPartBytes := make([]byte, 0, len(in)/2) 234 235 if in[0] == '"' { 236 // Quoted-string = DQUOTE *qcontent DQUOTE 237 // non-whitespace-control = %d1-8 / %d11 / %d12 / %d14-31 / %d127 238 // qcontent = qtext / quoted-pair 239 // qtext = non-whitespace-control / 240 // %d33 / %d35-91 / %d93-126 241 // quoted-pair = ("\" text) / obs-qp 242 // text = %d1-9 / %d11 / %d12 / %d14-127 / obs-text 243 // 244 // (Names beginning with “obs-” are the obsolete syntax from RFC 2822, 245 // Section 4. Since it has been 16 years, we no longer accept that.) 246 in = in[1:] 247 QuotedString: 248 for { 249 if len(in) == 0 { 250 return mailbox, false 251 } 252 c := in[0] 253 in = in[1:] 254 255 switch { 256 case c == '"': 257 break QuotedString 258 259 case c == '\\': 260 // quoted-pair 261 if len(in) == 0 { 262 return mailbox, false 263 } 264 if in[0] == 11 || 265 in[0] == 12 || 266 (1 <= in[0] && in[0] <= 9) || 267 (14 <= in[0] && in[0] <= 127) { 268 localPartBytes = append(localPartBytes, in[0]) 269 in = in[1:] 270 } else { 271 return mailbox, false 272 } 273 274 case c == 11 || 275 c == 12 || 276 // Space (char 32) is not allowed based on the 277 // BNF, but RFC 3696 gives an example that 278 // assumes that it is. Several “verified” 279 // errata continue to argue about this point. 280 // We choose to accept it. 281 c == 32 || 282 c == 33 || 283 c == 127 || 284 (1 <= c && c <= 8) || 285 (14 <= c && c <= 31) || 286 (35 <= c && c <= 91) || 287 (93 <= c && c <= 126): 288 // qtext 289 localPartBytes = append(localPartBytes, c) 290 291 default: 292 return mailbox, false 293 } 294 } 295 } else { 296 // Atom ("." Atom)* 297 NextChar: 298 for len(in) > 0 { 299 // atext from RFC 2822, Section 3.2.4 300 c := in[0] 301 302 switch { 303 case c == '\\': 304 // Examples given in RFC 3696 suggest that 305 // escaped characters can appear outside of a 306 // quoted string. Several “verified” errata 307 // continue to argue the point. We choose to 308 // accept it. 309 in = in[1:] 310 if len(in) == 0 { 311 return mailbox, false 312 } 313 fallthrough 314 315 case ('0' <= c && c <= '9') || 316 ('a' <= c && c <= 'z') || 317 ('A' <= c && c <= 'Z') || 318 c == '!' || c == '#' || c == '$' || c == '%' || 319 c == '&' || c == '\'' || c == '*' || c == '+' || 320 c == '-' || c == '/' || c == '=' || c == '?' || 321 c == '^' || c == '_' || c == '`' || c == '{' || 322 c == '|' || c == '}' || c == '~' || c == '.': 323 localPartBytes = append(localPartBytes, in[0]) 324 in = in[1:] 325 326 default: 327 break NextChar 328 } 329 } 330 331 if len(localPartBytes) == 0 { 332 return mailbox, false 333 } 334 335 // From RFC 3696, Section 3: 336 // “period (".") may also appear, but may not be used to start 337 // or end the local part, nor may two or more consecutive 338 // periods appear.” 339 twoDots := []byte{'.', '.'} 340 if localPartBytes[0] == '.' || 341 localPartBytes[len(localPartBytes)-1] == '.' || 342 bytes.Contains(localPartBytes, twoDots) { 343 return mailbox, false 344 } 345 } 346 347 if len(in) == 0 || in[0] != '@' { 348 return mailbox, false 349 } 350 in = in[1:] 351 352 // The RFC species a format for domains, but that's known to be 353 // violated in practice so we accept that anything after an '@' is the 354 // domain part. 355 if _, ok := domainToReverseLabels(in); !ok { 356 return mailbox, false 357 } 358 359 mailbox.local = string(localPartBytes) 360 mailbox.domain = in 361 return mailbox, true 362 } 363 364 // domainToReverseLabels converts a textual domain name like foo.example.com to 365 // the list of labels in reverse order, e.g. ["com", "example", "foo"]. 366 func domainToReverseLabels(domain string) (reverseLabels []string, ok bool) { 367 for len(domain) > 0 { 368 if i := strings.LastIndexByte(domain, '.'); i == -1 { 369 reverseLabels = append(reverseLabels, domain) 370 domain = "" 371 } else { 372 reverseLabels = append(reverseLabels, domain[i+1:]) 373 domain = domain[:i] 374 } 375 } 376 377 if len(reverseLabels) > 0 && len(reverseLabels[0]) == 0 { 378 // An empty label at the end indicates an absolute value. 379 return nil, false 380 } 381 382 for _, label := range reverseLabels { 383 if len(label) == 0 { 384 // Empty labels are otherwise invalid. 385 return nil, false 386 } 387 388 for _, c := range label { 389 if c < 33 || c > 126 { 390 // Invalid character. 391 return nil, false 392 } 393 } 394 } 395 396 return reverseLabels, true 397 } 398 399 func matchEmailConstraint(mailbox rfc2821Mailbox, constraint string) (bool, error) { 400 // If the constraint contains an @, then it specifies an exact mailbox 401 // name. 402 if strings.Contains(constraint, "@") { 403 constraintMailbox, ok := parseRFC2821Mailbox(constraint) 404 if !ok { 405 return false, fmt.Errorf("x509: internal error: cannot parse constraint %q", constraint) 406 } 407 return mailbox.local == constraintMailbox.local && strings.EqualFold(mailbox.domain, constraintMailbox.domain), nil 408 } 409 410 // Otherwise the constraint is like a DNS constraint of the domain part 411 // of the mailbox. 412 return matchDomainConstraint(mailbox.domain, constraint) 413 } 414 415 func matchURIConstraint(uri *url.URL, constraint string) (bool, error) { 416 // From RFC 5280, Section 4.2.1.10: 417 // “a uniformResourceIdentifier that does not include an authority 418 // component with a host name specified as a fully qualified domain 419 // name (e.g., if the URI either does not include an authority 420 // component or includes an authority component in which the host name 421 // is specified as an IP address), then the application MUST reject the 422 // certificate.” 423 424 host := uri.Host 425 if len(host) == 0 { 426 return false, fmt.Errorf("URI with empty host (%q) cannot be matched against constraints", uri.String()) 427 } 428 429 if strings.Contains(host, ":") && !strings.HasSuffix(host, "]") { 430 var err error 431 host, _, err = net.SplitHostPort(uri.Host) 432 if err != nil { 433 return false, err 434 } 435 } 436 437 if strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]") || 438 net.ParseIP(host) != nil { 439 return false, fmt.Errorf("URI with IP (%q) cannot be matched against constraints", uri.String()) 440 } 441 442 return matchDomainConstraint(host, constraint) 443 } 444 445 func matchIPConstraint(ip net.IP, constraint *net.IPNet) (bool, error) { 446 if len(ip) != len(constraint.IP) { 447 return false, nil 448 } 449 450 for i := range ip { 451 if mask := constraint.Mask[i]; ip[i]&mask != constraint.IP[i]&mask { 452 return false, nil 453 } 454 } 455 456 return true, nil 457 } 458 459 func matchDomainConstraint(domain, constraint string) (bool, error) { 460 // The meaning of zero length constraints is not specified, but this 461 // code follows NSS and accepts them as matching everything. 462 if len(constraint) == 0 { 463 return true, nil 464 } 465 466 domainLabels, ok := domainToReverseLabels(domain) 467 if !ok { 468 return false, fmt.Errorf("x509: internal error: cannot parse domain %q", domain) 469 } 470 471 // RFC 5280 says that a leading period in a domain name means that at 472 // least one label must be prepended, but only for URI and email 473 // constraints, not DNS constraints. The code also supports that 474 // behaviour for DNS constraints. 475 476 mustHaveSubdomains := false 477 if constraint[0] == '.' { 478 mustHaveSubdomains = true 479 constraint = constraint[1:] 480 } 481 482 constraintLabels, ok := domainToReverseLabels(constraint) 483 if !ok { 484 return false, fmt.Errorf("x509: internal error: cannot parse domain %q", constraint) 485 } 486 487 if len(domainLabels) < len(constraintLabels) || 488 (mustHaveSubdomains && len(domainLabels) == len(constraintLabels)) { 489 return false, nil 490 } 491 492 for i, constraintLabel := range constraintLabels { 493 if !strings.EqualFold(constraintLabel, domainLabels[i]) { 494 return false, nil 495 } 496 } 497 498 return true, nil 499 } 500 501 // checkNameConstraints checks that c permits a child certificate to claim the 502 // given name, of type nameType. The argument parsedName contains the parsed 503 // form of name, suitable for passing to the match function. The total number 504 // of comparisons is tracked in the given count and should not exceed the given 505 // limit. 506 func (c *Certificate) checkNameConstraints(count *int, 507 maxConstraintComparisons int, 508 nameType string, 509 name string, 510 parsedName interface{}, 511 match func(parsedName, constraint interface{}) (match bool, err error), 512 permitted, excluded interface{}) error { 513 514 excludedValue := reflect.ValueOf(excluded) 515 516 *count += excludedValue.Len() 517 if *count > maxConstraintComparisons { 518 return CertificateInvalidError{c, TooManyConstraints, ""} 519 } 520 521 for i := 0; i < excludedValue.Len(); i++ { 522 constraint := excludedValue.Index(i).Interface() 523 match, err := match(parsedName, constraint) 524 if err != nil { 525 return CertificateInvalidError{c, CANotAuthorizedForThisName, err.Error()} 526 } 527 528 if match { 529 return CertificateInvalidError{c, CANotAuthorizedForThisName, fmt.Sprintf("%s %q is excluded by constraint %q", nameType, name, constraint)} 530 } 531 } 532 533 permittedValue := reflect.ValueOf(permitted) 534 535 *count += permittedValue.Len() 536 if *count > maxConstraintComparisons { 537 return CertificateInvalidError{c, TooManyConstraints, ""} 538 } 539 540 ok := true 541 for i := 0; i < permittedValue.Len(); i++ { 542 constraint := permittedValue.Index(i).Interface() 543 544 var err error 545 if ok, err = match(parsedName, constraint); err != nil { 546 return CertificateInvalidError{c, CANotAuthorizedForThisName, err.Error()} 547 } 548 549 if ok { 550 break 551 } 552 } 553 554 if !ok { 555 return CertificateInvalidError{c, CANotAuthorizedForThisName, fmt.Sprintf("%s %q is not permitted by any constraint", nameType, name)} 556 } 557 558 return nil 559 } 560 561 // isValid performs validity checks on c given that it is a candidate to append 562 // to the chain in currentChain. 563 func (c *Certificate) isValid(certType int, currentChain []*Certificate, opts *VerifyOptions) error { 564 if len(c.UnhandledCriticalExtensions) > 0 { 565 return UnhandledCriticalExtension{} 566 } 567 568 if len(currentChain) > 0 { 569 child := currentChain[len(currentChain)-1] 570 if !bytes.Equal(child.RawIssuer, c.RawSubject) { 571 return CertificateInvalidError{c, NameMismatch, ""} 572 } 573 } 574 575 now := opts.CurrentTime 576 if now.IsZero() { 577 now = time.Now() 578 } 579 if now.Before(c.NotBefore) { 580 return CertificateInvalidError{ 581 Cert: c, 582 Reason: Expired, 583 Detail: fmt.Sprintf("current time %s is before %s", now.Format(time.RFC3339), c.NotBefore.Format(time.RFC3339)), 584 } 585 } else if now.After(c.NotAfter) { 586 return CertificateInvalidError{ 587 Cert: c, 588 Reason: Expired, 589 Detail: fmt.Sprintf("current time %s is after %s", now.Format(time.RFC3339), c.NotAfter.Format(time.RFC3339)), 590 } 591 } 592 593 maxConstraintComparisons := opts.MaxConstraintComparisions 594 if maxConstraintComparisons == 0 { 595 maxConstraintComparisons = 250000 596 } 597 comparisonCount := 0 598 599 var leaf *Certificate 600 if certType == intermediateCertificate || certType == rootCertificate { 601 if len(currentChain) == 0 { 602 return errors.New("x509: internal error: empty chain when appending CA cert") 603 } 604 leaf = currentChain[0] 605 } 606 607 checkNameConstraints := (certType == intermediateCertificate || certType == rootCertificate) && c.hasNameConstraints() 608 if checkNameConstraints && leaf.commonNameAsHostname() { 609 // This is the deprecated, legacy case of depending on the commonName as 610 // a hostname. We don't enforce name constraints against the CN, but 611 // VerifyHostname will look for hostnames in there if there are no SANs. 612 // In order to ensure VerifyHostname will not accept an unchecked name, 613 // return an error here. 614 return CertificateInvalidError{c, NameConstraintsWithoutSANs, ""} 615 } else if checkNameConstraints && leaf.hasSANExtension() { 616 err := forEachSAN(leaf.getSANExtension(), func(tag int, data []byte) error { 617 switch tag { 618 case nameTypeEmail: 619 name := string(data) 620 mailbox, ok := parseRFC2821Mailbox(name) 621 if !ok { 622 return fmt.Errorf("x509: cannot parse rfc822Name %q", mailbox) 623 } 624 625 if err := c.checkNameConstraints(&comparisonCount, maxConstraintComparisons, "email address", name, mailbox, 626 func(parsedName, constraint interface{}) (bool, error) { 627 return matchEmailConstraint(parsedName.(rfc2821Mailbox), constraint.(string)) 628 }, c.PermittedEmailAddresses, c.ExcludedEmailAddresses); err != nil { 629 return err 630 } 631 632 case nameTypeDNS: 633 name := string(data) 634 if _, ok := domainToReverseLabels(name); !ok { 635 return fmt.Errorf("x509: cannot parse dnsName %q", name) 636 } 637 638 if err := c.checkNameConstraints(&comparisonCount, maxConstraintComparisons, "DNS name", name, name, 639 func(parsedName, constraint interface{}) (bool, error) { 640 return matchDomainConstraint(parsedName.(string), constraint.(string)) 641 }, c.PermittedDNSDomains, c.ExcludedDNSDomains); err != nil { 642 return err 643 } 644 645 case nameTypeURI: 646 name := string(data) 647 uri, err := url.Parse(name) 648 if err != nil { 649 return fmt.Errorf("x509: internal error: URI SAN %q failed to parse", name) 650 } 651 652 if err := c.checkNameConstraints(&comparisonCount, maxConstraintComparisons, "URI", name, uri, 653 func(parsedName, constraint interface{}) (bool, error) { 654 return matchURIConstraint(parsedName.(*url.URL), constraint.(string)) 655 }, c.PermittedURIDomains, c.ExcludedURIDomains); err != nil { 656 return err 657 } 658 659 case nameTypeIP: 660 ip := net.IP(data) 661 if l := len(ip); l != net.IPv4len && l != net.IPv6len { 662 return fmt.Errorf("x509: internal error: IP SAN %x failed to parse", data) 663 } 664 665 if err := c.checkNameConstraints(&comparisonCount, maxConstraintComparisons, "IP address", ip.String(), ip, 666 func(parsedName, constraint interface{}) (bool, error) { 667 return matchIPConstraint(parsedName.(net.IP), constraint.(*net.IPNet)) 668 }, c.PermittedIPRanges, c.ExcludedIPRanges); err != nil { 669 return err 670 } 671 672 default: 673 // Unknown SAN types are ignored. 674 } 675 676 return nil 677 }) 678 679 if err != nil { 680 return err 681 } 682 } 683 684 // KeyUsage status flags are ignored. From Engineering Security, Peter 685 // Gutmann: A European government CA marked its signing certificates as 686 // being valid for encryption only, but no-one noticed. Another 687 // European CA marked its signature keys as not being valid for 688 // signatures. A different CA marked its own trusted root certificate 689 // as being invalid for certificate signing. Another national CA 690 // distributed a certificate to be used to encrypt data for the 691 // country’s tax authority that was marked as only being usable for 692 // digital signatures but not for encryption. Yet another CA reversed 693 // the order of the bit flags in the keyUsage due to confusion over 694 // encoding endianness, essentially setting a random keyUsage in 695 // certificates that it issued. Another CA created a self-invalidating 696 // certificate by adding a certificate policy statement stipulating 697 // that the certificate had to be used strictly as specified in the 698 // keyUsage, and a keyUsage containing a flag indicating that the RSA 699 // encryption key could only be used for Diffie-Hellman key agreement. 700 701 if certType == intermediateCertificate && (!c.BasicConstraintsValid || !c.IsCA) { 702 return CertificateInvalidError{c, NotAuthorizedToSign, ""} 703 } 704 705 if c.BasicConstraintsValid && c.MaxPathLen >= 0 { 706 numIntermediates := len(currentChain) - 1 707 if numIntermediates > c.MaxPathLen { 708 return CertificateInvalidError{c, TooManyIntermediates, ""} 709 } 710 } 711 712 return nil 713 } 714 715 // Verify attempts to verify c by building one or more chains from c to a 716 // certificate in opts.Roots, using certificates in opts.Intermediates if 717 // needed. If successful, it returns one or more chains where the first 718 // element of the chain is c and the last element is from opts.Roots. 719 // 720 // If opts.Roots is nil and system roots are unavailable the returned error 721 // will be of type SystemRootsError. 722 // 723 // Name constraints in the intermediates will be applied to all names claimed 724 // in the chain, not just opts.DNSName. Thus it is invalid for a leaf to claim 725 // example.com if an intermediate doesn't permit it, even if example.com is not 726 // the name being validated. Note that DirectoryName constraints are not 727 // supported. 728 // 729 // Extended Key Usage values are enforced down a chain, so an intermediate or 730 // root that enumerates EKUs prevents a leaf from asserting an EKU not in that 731 // list. 732 // 733 // WARNING: this function doesn't do any revocation checking. 734 func (c *Certificate) Verify(opts VerifyOptions) (chains [][]*Certificate, err error) { 735 // Platform-specific verification needs the ASN.1 contents so 736 // this makes the behavior consistent across platforms. 737 if len(c.Raw) == 0 { 738 return nil, errNotParsed 739 } 740 if opts.Intermediates != nil { 741 for _, intermediate := range opts.Intermediates.certs { 742 if len(intermediate.Raw) == 0 { 743 return nil, errNotParsed 744 } 745 } 746 } 747 748 // Use Windows's own verification and chain building. 749 if opts.Roots == nil && runtime.GOOS == "windows" { 750 return c.systemVerify(&opts) 751 } 752 753 if opts.Roots == nil { 754 opts.Roots = systemRootsPool() 755 if opts.Roots == nil { 756 return nil, SystemRootsError{systemRootsErr} 757 } 758 } 759 760 err = c.isValid(leafCertificate, nil, &opts) 761 if err != nil { 762 return 763 } 764 765 if len(opts.DNSName) > 0 { 766 err = c.VerifyHostname(opts.DNSName) 767 if err != nil { 768 return 769 } 770 } 771 772 var candidateChains [][]*Certificate 773 if opts.Roots.contains(c) { 774 candidateChains = append(candidateChains, []*Certificate{c}) 775 } else { 776 if candidateChains, err = c.buildChains(nil, []*Certificate{c}, nil, &opts); err != nil { 777 return nil, err 778 } 779 } 780 781 keyUsages := opts.KeyUsages 782 if len(keyUsages) == 0 { 783 keyUsages = []ExtKeyUsage{ExtKeyUsageServerAuth} 784 } 785 786 // If any key usage is acceptable then we're done. 787 for _, usage := range keyUsages { 788 if usage == ExtKeyUsageAny { 789 return candidateChains, nil 790 } 791 } 792 793 for _, candidate := range candidateChains { 794 if checkChainForKeyUsage(candidate, keyUsages) { 795 chains = append(chains, candidate) 796 } 797 } 798 799 if len(chains) == 0 { 800 return nil, CertificateInvalidError{c, IncompatibleUsage, ""} 801 } 802 803 return chains, nil 804 } 805 806 func appendToFreshChain(chain []*Certificate, cert *Certificate) []*Certificate { 807 n := make([]*Certificate, len(chain)+1) 808 copy(n, chain) 809 n[len(chain)] = cert 810 return n 811 } 812 813 // maxChainSignatureChecks is the maximum number of CheckSignatureFrom calls 814 // that an invocation of buildChains will (tranistively) make. Most chains are 815 // less than 15 certificates long, so this leaves space for multiple chains and 816 // for failed checks due to different intermediates having the same Subject. 817 const maxChainSignatureChecks = 100 818 819 func (c *Certificate) buildChains(cache map[*Certificate][][]*Certificate, currentChain []*Certificate, sigChecks *int, opts *VerifyOptions) (chains [][]*Certificate, err error) { 820 var ( 821 hintErr error 822 hintCert *Certificate 823 ) 824 825 considerCandidate := func(certType int, candidate *Certificate) { 826 for _, cert := range currentChain { 827 if cert.Equal(candidate) { 828 return 829 } 830 } 831 832 if sigChecks == nil { 833 sigChecks = new(int) 834 } 835 *sigChecks++ 836 if *sigChecks > maxChainSignatureChecks { 837 err = errors.New("x509: signature check attempts limit reached while verifying certificate chain") 838 return 839 } 840 841 if err := c.CheckSignatureFrom(candidate); err != nil { 842 if hintErr == nil { 843 hintErr = err 844 hintCert = candidate 845 } 846 return 847 } 848 849 err = candidate.isValid(certType, currentChain, opts) 850 if err != nil { 851 return 852 } 853 854 switch certType { 855 case rootCertificate: 856 chains = append(chains, appendToFreshChain(currentChain, candidate)) 857 case intermediateCertificate: 858 if cache == nil { 859 cache = make(map[*Certificate][][]*Certificate) 860 } 861 childChains, ok := cache[candidate] 862 if !ok { 863 childChains, err = candidate.buildChains(cache, appendToFreshChain(currentChain, candidate), sigChecks, opts) 864 cache[candidate] = childChains 865 } 866 chains = append(chains, childChains...) 867 } 868 } 869 870 for _, rootNum := range opts.Roots.findPotentialParents(c) { 871 considerCandidate(rootCertificate, opts.Roots.certs[rootNum]) 872 } 873 for _, intermediateNum := range opts.Intermediates.findPotentialParents(c) { 874 considerCandidate(intermediateCertificate, opts.Intermediates.certs[intermediateNum]) 875 } 876 877 if len(chains) > 0 { 878 err = nil 879 } 880 if len(chains) == 0 && err == nil { 881 err = UnknownAuthorityError{c, hintErr, hintCert} 882 } 883 884 return 885 } 886 887 // validHostname reports whether host is a valid hostname that can be matched or 888 // matched against according to RFC 6125 2.2, with some leniency to accommodate 889 // legacy values. 890 func validHostname(host string) bool { 891 host = strings.TrimSuffix(host, ".") 892 893 if len(host) == 0 { 894 return false 895 } 896 897 for i, part := range strings.Split(host, ".") { 898 if part == "" { 899 // Empty label. 900 return false 901 } 902 if i == 0 && part == "*" { 903 // Only allow full left-most wildcards, as those are the only ones 904 // we match, and matching literal '*' characters is probably never 905 // the expected behavior. 906 continue 907 } 908 for j, c := range part { 909 if 'a' <= c && c <= 'z' { 910 continue 911 } 912 if '0' <= c && c <= '9' { 913 continue 914 } 915 if 'A' <= c && c <= 'Z' { 916 continue 917 } 918 if c == '-' && j != 0 { 919 continue 920 } 921 if c == '_' || c == ':' { 922 // Not valid characters in hostnames, but commonly 923 // found in deployments outside the WebPKI. 924 continue 925 } 926 return false 927 } 928 } 929 930 return true 931 } 932 933 // commonNameAsHostname reports whether the Common Name field should be 934 // considered the hostname that the certificate is valid for. This is a legacy 935 // behavior, disabled if the Subject Alt Name extension is present. 936 // 937 // It applies the strict validHostname check to the Common Name field, so that 938 // certificates without SANs can still be validated against CAs with name 939 // constraints if there is no risk the CN would be matched as a hostname. 940 // See NameConstraintsWithoutSANs and issue 24151. 941 func (c *Certificate) commonNameAsHostname() bool { 942 return !ignoreCN && !c.hasSANExtension() && validHostname(c.Subject.CommonName) 943 } 944 945 func matchHostnames(pattern, host string) bool { 946 host = strings.TrimSuffix(host, ".") 947 pattern = strings.TrimSuffix(pattern, ".") 948 949 if len(pattern) == 0 || len(host) == 0 { 950 return false 951 } 952 953 patternParts := strings.Split(pattern, ".") 954 hostParts := strings.Split(host, ".") 955 956 if len(patternParts) != len(hostParts) { 957 return false 958 } 959 960 for i, patternPart := range patternParts { 961 if i == 0 && patternPart == "*" { 962 continue 963 } 964 if patternPart != hostParts[i] { 965 return false 966 } 967 } 968 969 return true 970 } 971 972 // toLowerCaseASCII returns a lower-case version of in. See RFC 6125 6.4.1. We use 973 // an explicitly ASCII function to avoid any sharp corners resulting from 974 // performing Unicode operations on DNS labels. 975 func toLowerCaseASCII(in string) string { 976 // If the string is already lower-case then there's nothing to do. 977 isAlreadyLowerCase := true 978 for _, c := range in { 979 if c == utf8.RuneError { 980 // If we get a UTF-8 error then there might be 981 // upper-case ASCII bytes in the invalid sequence. 982 isAlreadyLowerCase = false 983 break 984 } 985 if 'A' <= c && c <= 'Z' { 986 isAlreadyLowerCase = false 987 break 988 } 989 } 990 991 if isAlreadyLowerCase { 992 return in 993 } 994 995 out := []byte(in) 996 for i, c := range out { 997 if 'A' <= c && c <= 'Z' { 998 out[i] += 'a' - 'A' 999 } 1000 } 1001 return string(out) 1002 } 1003 1004 // VerifyHostname returns nil if c is a valid certificate for the named host. 1005 // Otherwise it returns an error describing the mismatch. 1006 func (c *Certificate) VerifyHostname(h string) error { 1007 // IP addresses may be written in [ ]. 1008 candidateIP := h 1009 if len(h) >= 3 && h[0] == '[' && h[len(h)-1] == ']' { 1010 candidateIP = h[1 : len(h)-1] 1011 } 1012 if ip := net.ParseIP(candidateIP); ip != nil { 1013 // We only match IP addresses against IP SANs. 1014 // See RFC 6125, Appendix B.2. 1015 for _, candidate := range c.IPAddresses { 1016 if ip.Equal(candidate) { 1017 return nil 1018 } 1019 } 1020 return HostnameError{c, candidateIP} 1021 } 1022 1023 lowered := toLowerCaseASCII(h) 1024 1025 if c.commonNameAsHostname() { 1026 if matchHostnames(toLowerCaseASCII(c.Subject.CommonName), lowered) { 1027 return nil 1028 } 1029 } else { 1030 for _, match := range c.DNSNames { 1031 if matchHostnames(toLowerCaseASCII(match), lowered) { 1032 return nil 1033 } 1034 } 1035 } 1036 1037 return HostnameError{c, h} 1038 } 1039 1040 func checkChainForKeyUsage(chain []*Certificate, keyUsages []ExtKeyUsage) bool { 1041 usages := make([]ExtKeyUsage, len(keyUsages)) 1042 copy(usages, keyUsages) 1043 1044 if len(chain) == 0 { 1045 return false 1046 } 1047 1048 usagesRemaining := len(usages) 1049 1050 // We walk down the list and cross out any usages that aren't supported 1051 // by each certificate. If we cross out all the usages, then the chain 1052 // is unacceptable. 1053 1054 NextCert: 1055 for i := len(chain) - 1; i >= 0; i-- { 1056 cert := chain[i] 1057 if len(cert.ExtKeyUsage) == 0 && len(cert.UnknownExtKeyUsage) == 0 { 1058 // The certificate doesn't have any extended key usage specified. 1059 continue 1060 } 1061 1062 for _, usage := range cert.ExtKeyUsage { 1063 if usage == ExtKeyUsageAny { 1064 // The certificate is explicitly good for any usage. 1065 continue NextCert 1066 } 1067 } 1068 1069 const invalidUsage ExtKeyUsage = -1 1070 1071 NextRequestedUsage: 1072 for i, requestedUsage := range usages { 1073 if requestedUsage == invalidUsage { 1074 continue 1075 } 1076 1077 for _, usage := range cert.ExtKeyUsage { 1078 if requestedUsage == usage { 1079 continue NextRequestedUsage 1080 } else if requestedUsage == ExtKeyUsageServerAuth && 1081 (usage == ExtKeyUsageNetscapeServerGatedCrypto || 1082 usage == ExtKeyUsageMicrosoftServerGatedCrypto) { 1083 // In order to support COMODO 1084 // certificate chains, we have to 1085 // accept Netscape or Microsoft SGC 1086 // usages as equal to ServerAuth. 1087 continue NextRequestedUsage 1088 } 1089 } 1090 1091 usages[i] = invalidUsage 1092 usagesRemaining-- 1093 if usagesRemaining == 0 { 1094 return false 1095 } 1096 } 1097 } 1098 1099 return true 1100 }