|
13 | 13 | #include "util.h" |
14 | 14 | #include "util-inl.h" |
15 | 15 | #include "v8.h" |
| 16 | +// CNNIC Hash WhiteList is taken from |
| 17 | +// https://hg.mozilla.org/mozilla-central/raw-file/98820360ab66/security/ |
| 18 | +// certverifier/CNNICHashWhitelist.inc |
| 19 | +#include "CNNICHashWhitelist.inc" |
16 | 20 |
|
17 | 21 | #include <errno.h> |
18 | 22 | #include <stdlib.h> |
@@ -84,6 +88,34 @@ using v8::V8; |
84 | 88 | using v8::Value; |
85 | 89 |
|
86 | 90 |
|
| 91 | +// Subject DER of CNNIC ROOT CA and CNNIC EV ROOT CA are taken from |
| 92 | +// https://hg.mozilla.org/mozilla-central/file/98820360ab66/security/ |
| 93 | +// certverifier/NSSCertDBTrustDomain.cpp#l672 |
| 94 | +// C = CN, O = CNNIC, CN = CNNIC ROOT |
| 95 | +static const uint8_t CNNIC_ROOT_CA_SUBJECT_DATA[] = |
| 96 | + "\x30\x32\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x43\x4E\x31\x0E\x30" |
| 97 | + "\x0C\x06\x03\x55\x04\x0A\x13\x05\x43\x4E\x4E\x49\x43\x31\x13\x30\x11\x06" |
| 98 | + "\x03\x55\x04\x03\x13\x0A\x43\x4E\x4E\x49\x43\x20\x52\x4F\x4F\x54"; |
| 99 | +static const uint8_t* cnnic_p = CNNIC_ROOT_CA_SUBJECT_DATA; |
| 100 | +static X509_NAME* cnnic_name = |
| 101 | + d2i_X509_NAME(nullptr, &cnnic_p, sizeof(CNNIC_ROOT_CA_SUBJECT_DATA)-1); |
| 102 | + |
| 103 | +// C = CN, O = China Internet Network Information Center, CN = China |
| 104 | +// Internet Network Information Center EV Certificates Root |
| 105 | +static const uint8_t CNNIC_EV_ROOT_CA_SUBJECT_DATA[] = |
| 106 | + "\x30\x81\x8A\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x43\x4E\x31\x32" |
| 107 | + "\x30\x30\x06\x03\x55\x04\x0A\x0C\x29\x43\x68\x69\x6E\x61\x20\x49\x6E\x74" |
| 108 | + "\x65\x72\x6E\x65\x74\x20\x4E\x65\x74\x77\x6F\x72\x6B\x20\x49\x6E\x66\x6F" |
| 109 | + "\x72\x6D\x61\x74\x69\x6F\x6E\x20\x43\x65\x6E\x74\x65\x72\x31\x47\x30\x45" |
| 110 | + "\x06\x03\x55\x04\x03\x0C\x3E\x43\x68\x69\x6E\x61\x20\x49\x6E\x74\x65\x72" |
| 111 | + "\x6E\x65\x74\x20\x4E\x65\x74\x77\x6F\x72\x6B\x20\x49\x6E\x66\x6F\x72\x6D" |
| 112 | + "\x61\x74\x69\x6F\x6E\x20\x43\x65\x6E\x74\x65\x72\x20\x45\x56\x20\x43\x65" |
| 113 | + "\x72\x74\x69\x66\x69\x63\x61\x74\x65\x73\x20\x52\x6F\x6F\x74"; |
| 114 | +static const uint8_t* cnnic_ev_p = CNNIC_EV_ROOT_CA_SUBJECT_DATA; |
| 115 | +static X509_NAME *cnnic_ev_name = |
| 116 | + d2i_X509_NAME(nullptr, &cnnic_ev_p, |
| 117 | + sizeof(CNNIC_EV_ROOT_CA_SUBJECT_DATA)-1); |
| 118 | + |
87 | 119 | // Forcibly clear OpenSSL's error stack on return. This stops stale errors |
88 | 120 | // from popping up later in the lifecycle of crypto operations where they |
89 | 121 | // would cause spurious failures. It's a rather blunt method, though. |
@@ -2210,49 +2242,91 @@ void Connection::Initialize(Environment* env, Handle<Object> target) { |
2210 | 2242 | } |
2211 | 2243 |
|
2212 | 2244 |
|
2213 | | -int VerifyCallback(int preverify_ok, X509_STORE_CTX* ctx) { |
2214 | | - // Quoting SSL_set_verify(3ssl): |
2215 | | - // |
2216 | | - // The VerifyCallback function is used to control the behaviour when |
2217 | | - // the SSL_VERIFY_PEER flag is set. It must be supplied by the |
2218 | | - // application and receives two arguments: preverify_ok indicates, |
2219 | | - // whether the verification of the certificate in question was passed |
2220 | | - // (preverify_ok=1) or not (preverify_ok=0). x509_ctx is a pointer to |
2221 | | - // the complete context used for the certificate chain verification. |
2222 | | - // |
2223 | | - // The certificate chain is checked starting with the deepest nesting |
2224 | | - // level (the root CA certificate) and worked upward to the peer's |
2225 | | - // certificate. At each level signatures and issuer attributes are |
2226 | | - // checked. Whenever a verification error is found, the error number is |
2227 | | - // stored in x509_ctx and VerifyCallback is called with preverify_ok=0. |
2228 | | - // By applying X509_CTX_store_* functions VerifyCallback can locate the |
2229 | | - // certificate in question and perform additional steps (see EXAMPLES). |
2230 | | - // If no error is found for a certificate, VerifyCallback is called |
2231 | | - // with preverify_ok=1 before advancing to the next level. |
2232 | | - // |
2233 | | - // The return value of VerifyCallback controls the strategy of the |
2234 | | - // further verification process. If VerifyCallback returns 0, the |
2235 | | - // verification process is immediately stopped with "verification |
2236 | | - // failed" state. If SSL_VERIFY_PEER is set, a verification failure |
2237 | | - // alert is sent to the peer and the TLS/SSL handshake is terminated. If |
2238 | | - // VerifyCallback returns 1, the verification process is continued. If |
2239 | | - // VerifyCallback always returns 1, the TLS/SSL handshake will not be |
2240 | | - // terminated with respect to verification failures and the connection |
2241 | | - // will be established. The calling process can however retrieve the |
2242 | | - // error code of the last verification error using |
2243 | | - // SSL_get_verify_result(3) or by maintaining its own error storage |
2244 | | - // managed by VerifyCallback. |
2245 | | - // |
2246 | | - // If no VerifyCallback is specified, the default callback will be |
2247 | | - // used. Its return value is identical to preverify_ok, so that any |
2248 | | - // verification failure will lead to a termination of the TLS/SSL |
2249 | | - // handshake with an alert message, if SSL_VERIFY_PEER is set. |
2250 | | - // |
2251 | | - // Since we cannot perform I/O quickly enough in this callback, we ignore |
2252 | | - // all preverify_ok errors and let the handshake continue. It is |
2253 | | - // imparative that the user use Connection::VerifyError after the |
2254 | | - // 'secure' callback has been made. |
2255 | | - return 1; |
| 2245 | +inline int compar(const void* a, const void* b) { |
| 2246 | + return memcmp(a, b, CNNIC_WHITELIST_HASH_LEN); |
| 2247 | +} |
| 2248 | + |
| 2249 | + |
| 2250 | +inline int IsSelfSigned(X509* cert) { |
| 2251 | + return X509_NAME_cmp(X509_get_subject_name(cert), |
| 2252 | + X509_get_issuer_name(cert)) == 0; |
| 2253 | +} |
| 2254 | + |
| 2255 | + |
| 2256 | +inline X509* FindRoot(STACK_OF(X509)* sk) { |
| 2257 | + for (int i = 0; i < sk_X509_num(sk); i++) { |
| 2258 | + X509* cert = sk_X509_value(sk, i); |
| 2259 | + if (IsSelfSigned(cert)) |
| 2260 | + return cert; |
| 2261 | + } |
| 2262 | + return nullptr; |
| 2263 | +} |
| 2264 | + |
| 2265 | + |
| 2266 | +// Whitelist check for certs issued by CNNIC. See |
| 2267 | +// https://blog.mozilla.org/security/2015/04/02 |
| 2268 | +// /distrusting-new-cnnic-certificates/ |
| 2269 | +inline CheckResult CheckWhitelistedServerCert(X509_STORE_CTX* ctx) { |
| 2270 | + unsigned char hash[CNNIC_WHITELIST_HASH_LEN]; |
| 2271 | + unsigned int hashlen = CNNIC_WHITELIST_HASH_LEN; |
| 2272 | + |
| 2273 | + STACK_OF(X509)* chain = X509_STORE_CTX_get1_chain(ctx); |
| 2274 | + CHECK_NE(chain, nullptr); |
| 2275 | + CHECK_GT(sk_X509_num(chain), 0); |
| 2276 | + |
| 2277 | + // Take the last cert as root at the first time. |
| 2278 | + X509* root_cert = sk_X509_value(chain, sk_X509_num(chain)-1); |
| 2279 | + X509_NAME* root_name = X509_get_subject_name(root_cert); |
| 2280 | + |
| 2281 | + if (!IsSelfSigned(root_cert)) { |
| 2282 | + root_cert = FindRoot(chain); |
| 2283 | + CHECK_NE(root_cert, nullptr); |
| 2284 | + root_name = X509_get_subject_name(root_cert); |
| 2285 | + } |
| 2286 | + |
| 2287 | + // When the cert is issued from either CNNNIC ROOT CA or CNNNIC EV |
| 2288 | + // ROOT CA, check a hash of its leaf cert if it is in the whitelist. |
| 2289 | + if (X509_NAME_cmp(root_name, cnnic_name) == 0 || |
| 2290 | + X509_NAME_cmp(root_name, cnnic_ev_name) == 0) { |
| 2291 | + X509* leaf_cert = sk_X509_value(chain, 0); |
| 2292 | + int ret = X509_digest(leaf_cert, EVP_sha256(), hash, |
| 2293 | + &hashlen); |
| 2294 | + CHECK(ret); |
| 2295 | + |
| 2296 | + void* result = bsearch(hash, WhitelistedCNNICHashes, |
| 2297 | + ARRAY_SIZE(WhitelistedCNNICHashes), |
| 2298 | + CNNIC_WHITELIST_HASH_LEN, compar); |
| 2299 | + if (result == nullptr) { |
| 2300 | + sk_X509_pop_free(chain, X509_free); |
| 2301 | + return CHECK_CERT_REVOKED; |
| 2302 | + } |
| 2303 | + } |
| 2304 | + |
| 2305 | + sk_X509_pop_free(chain, X509_free); |
| 2306 | + return CHECK_OK; |
| 2307 | +} |
| 2308 | + |
| 2309 | + |
| 2310 | +inline int VerifyCallback(int preverify_ok, X509_STORE_CTX* ctx) { |
| 2311 | + // Failure on verification of the cert is handled in |
| 2312 | + // Connection::VerifyError. |
| 2313 | + if (preverify_ok == 0) |
| 2314 | + return 1; |
| 2315 | + |
| 2316 | + // Server does not need to check the whitelist. |
| 2317 | + SSL* ssl = static_cast<SSL*>( |
| 2318 | + X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx())); |
| 2319 | + |
| 2320 | + if (SSL_is_server(ssl)) |
| 2321 | + return 1; |
| 2322 | + |
| 2323 | + // Client needs to check if the server cert is listed in the |
| 2324 | + // whitelist when it is issued by the specific rootCAs. |
| 2325 | + CheckResult ret = CheckWhitelistedServerCert(ctx); |
| 2326 | + if (ret == CHECK_CERT_REVOKED) |
| 2327 | + X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REVOKED); |
| 2328 | + |
| 2329 | + return ret; |
2256 | 2330 | } |
2257 | 2331 |
|
2258 | 2332 |
|
|
0 commit comments