verify.c

Go to the documentation of this file.

/*
 *   This program is free software; you can redistribute it and/or modify
 *   it under the terms of the GNU General Public License as published by
 *   the Free Software Foundation; either version 2 of the License, or
 *   (at your option) any later version.
 *
 *   This program is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *   GNU General Public License for more details.
 *
 *   You should have received a copy of the GNU General Public License
 *   along with this program; if not, write to the Free Software
 *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
 */
 
/**
 * $Id: d14b1103fe9eda9a3fea20448c416204bb2ea887 $
 *
 * @file tls/verify.c
 * @brief Expose certificate OIDs as attributes, and call validation virtual
 *      server to check cert is valid.
 *
 * @copyright 2001 hereUare Communications, Inc. (raghud@hereuare.com)
 * @copyright 2003 Alan DeKok (aland@freeradius.org)
 * @copyright 2006-2016 The FreeRADIUS server project
 */
#ifdef WITH_TLS
#define LOG_PREFIX "tls"
 
#include <freeradius-devel/server/exec.h>
#include <freeradius-devel/server/pair.h>
#include <freeradius-devel/tls/log.h>
#include <freeradius-devel/unlang/function.h>
#include <freeradius-devel/unlang/subrequest.h>
#include <freeradius-devel/util/debug.h>
#include <freeradius-devel/util/strerror.h>
#include <freeradius-devel/util/syserror.h>
 
#include "attrs.h"
#include "base.h"
 
/** Check to see if a verification operation should apply to a certificate
 *
 * @param[in] depth     starting at 0.
 *                      Certificate 0 is the leaf cert (i.e. the client or server cert);
 * @param[in] untrusted The number of untrusted certificates.
 * @param[in] mode      to check
 * @return
 *      - true if a given validation check should apply.
 **     - false if a validation check should not apply.
 */
static inline CC_HINT(always_inline)
bool verify_applies(fr_tls_verify_mode_t mode, int depth, int untrusted)
{
        if (mode == FR_TLS_VERIFY_MODE_ALL) return true;
        if (mode == FR_TLS_VERIFY_MODE_DISABLED) return false;
 
        if ((mode & FR_TLS_VERIFY_MODE_LEAF) && (depth == 0)) return true;
        if ((mode & FR_TLS_VERIFY_MODE_ISSUER) && (depth == 1)) return true;
        if ((mode & FR_TLS_VERIFY_MODE_UNTRUSTED) && (depth < untrusted)) return true;
 
        return false;
}
 
DIAG_OFF(DIAG_UNKNOWN_PRAGMAS)
DIAG_OFF(used-but-marked-unused)        /* fix spurious warnings for sk macros */
 
/** Print verbose humanly readable messages about why certificate validation failed
 *
 */
static void tls_verify_error_detail(request_t *request, SSL_CTX *ctx, int err)
{
        X509_STORE      *store = SSL_CTX_get_ex_data(ctx, FR_TLS_EX_CTX_INDEX_VERIFY_STORE);
 
        switch (err) {
        /*
         *      We linked the provided cert to at least one
         *      other in a chain, but the chain doesn't terminate
         *      in a root CA.
         */
        case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
                FALL_THROUGH;
 
        /*
         *      We failed to link the provided cert to any
         *      other local certificates in the chain.
         */
        case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
                RDEBUG2("Static certificates in verification store are");
                if (RDEBUG_ENABLED2) {
                        RINDENT();
                        fr_tls_x509_objects_log(request, L_DBG, X509_STORE_get0_objects(store));
                        REXDENT();
                }
                break;
 
        default:
                break;
        }
}
 
/** Validates a certificate using custom logic
 *
 * Before trusting a certificate, we make sure that the certificate is
 * 'valid'. There are several checks we perform to verify its validity.
 *
 *   1. Verify the certificate's signature, and verifying that the certificate has
 *      been issued by a trusted Certificate Authority (this is done for us by OpenSSL).
 *
 *   2. Verify that the certificate is valid for the present date (i.e. it is being
 *      presented within its validity dates).
 *
 *   3. Verify that the certificate has not been revoked by its issuing Certificate
 *      Authority, by checking with respect to a Certificate Revocation List (CRL).
 *
 * @note This callback will be called multiple times based on the depth of the root
 *      certificate chain.
 *
 * @note As a byproduct of validation, various OIDs will be extracted from the
 *      certificates, and inserted into the session-state list as fr_pair_t.
 *
 * @param ok            preverify ok.  1 if true, 0 if false.
 * @param x509_ctx      containing certs to verify.
 * @return
 *      - 0 if not valid.
 *      - 1 if valid.
 */
int fr_tls_verify_cert_cb(int ok, X509_STORE_CTX *x509_ctx)
{
        X509                    *cert;
 
        SSL_CTX                 *ssl_ctx;
        SSL                     *ssl;
        fr_tls_session_t        *tls_session;
        int                     err, depth;
        fr_tls_conf_t           *conf;
        int                     my_ok = ok;
        int                     untrusted;
 
        request_t               *request;
        fr_pair_t               *container = NULL;
        fr_pair_t               *depth_pair;
 
        cert = X509_STORE_CTX_get_current_cert(x509_ctx);
        err = X509_STORE_CTX_get_error(x509_ctx);
        depth = X509_STORE_CTX_get_error_depth(x509_ctx);
        untrusted = X509_STORE_CTX_get_num_untrusted(x509_ctx);
 
        /*
         *      Retrieve the pointer to the SSL of the connection currently treated
         *      and the application specific data stored into the SSL object.
         */
        ssl = X509_STORE_CTX_get_ex_data(x509_ctx, SSL_get_ex_data_X509_STORE_CTX_idx());
        ssl_ctx = SSL_get_SSL_CTX(ssl);
        conf = fr_tls_session_conf(ssl);
        tls_session = talloc_get_type_abort(SSL_get_ex_data(ssl, FR_TLS_EX_INDEX_TLS_SESSION), fr_tls_session_t);
        request = fr_tls_session_request(tls_session->ssl);
 
        /*
         *      If this error appears it suggests
         *      that OpenSSL is trying to perform post-handshake
         *      certificate validation which we don't support.
         */
        if (!tls_session->can_pause) {
                fr_assert_msg("Unexpected call to %s. "
                              "tls_session_async_handshake_cont must be in call stack", __FUNCTION__);
                return 0;
        }
 
        /*
         *      Bail out as quickly as possible, producing
         *      as few errors as possible.
         */
        if (unlang_request_is_cancelled(request)) {
                X509_STORE_CTX_set_error(x509_ctx, 0);
                return 1;
        }
 
        /*
         *      Find or add the chain depth attribute and record the greatest depth we see + 1,
         *      as depth is zero based.
         */
        if (unlikely(fr_pair_find_or_append_by_da(request->session_state_ctx, &depth_pair, &request->session_state_pairs,
                                         attr_tls_certificate_chain_depth) < 0)) {
                RERROR("Failed to add certificate chain depth pair");
                return 0;
        }
        if (depth_pair->vp_uint32 < ((uint32_t)depth) + 1) depth_pair->vp_uint32 = (uint32_t)depth + 1;
 
        if (RDEBUG_ENABLED3) {
                char            subject[2048];
                STACK_OF(X509)  *our_chain;
                int             i;
 
                our_chain = X509_STORE_CTX_get0_chain(x509_ctx);
                RDEBUG3("Certificate chain - %i cert(s) untrusted", untrusted);
                for (i = sk_X509_num(our_chain); i > 0 ; i--) {
                        X509 *this_cert = sk_X509_value(our_chain, i - 1);
 
                        X509_NAME_oneline(X509_get_subject_name(this_cert), subject, sizeof(subject));
                        subject[sizeof(subject) - 1] = '\0';
 
                        RDEBUG3("%s [%i] %s", this_cert == cert ? ">" : " ", i - 1, subject);
                }
        }
 
        /*
         *      See if the user has disabled verification for
         *      this certificate.  If they have, force verification
         *      to succeed.
         */
        if (!my_ok) {
                char const *p = X509_verify_cert_error_string(err);
                if (!verify_applies(conf->verify.mode, depth, untrusted)) {
                        RDEBUG2("Ignoring verification error - %s (%i)", p, err);
                        tls_verify_error_detail(request, ssl_ctx, err);
 
                        my_ok = 1;
                        X509_STORE_CTX_set_error(x509_ctx, 0);
                } else {
                        RERROR("Verification error - %s (%i)", p, err);
                        tls_verify_error_detail(request, ssl_ctx, err);
                        goto done;
                }
        }
 
        if (verify_applies(conf->verify.attribute_mode, depth, untrusted) &&
            (!(container = fr_pair_find_by_da_idx(&request->session_state_pairs, attr_tls_certificate, depth)) ||
             fr_pair_list_empty(&container->vp_group))) {
                if (!container) {
                        unsigned int i;
 
                        /*
                         *      Build a stack of container attributes.
                         *
                         *      OpenSSL passes us the deepest certificate
                         *      first, so we need to build out sufficient
                         *      TLS-Certificate container TLVs so the TLS-Certificate
                         *      indexes match the attribute depth.
                         */
                        for (i = fr_pair_count_by_da(&request->session_state_pairs, attr_tls_certificate);
                             i <= (unsigned int)depth;
                             i++) {
                                MEM(container = fr_pair_afrom_da(request->session_state_ctx, attr_tls_certificate));
                                fr_pair_append(&request->session_state_pairs, container);
                        }
                }
 
#ifdef STATIC_ANALYZER
                /*
                 *      Container can never be NULL, because if container
                 *      was previously NULL, i will be <= depth.
                 */
                if (!fr_cond_assert(container)) {
                        my_ok = 0;
                        goto done;
                }
#endif
                /*
                 *      If we fail to populate the cert attributes,
                 *      trash all instances in the session-state list
                 *      and cause validation to fail.
                 */
                if (fr_tls_session_pairs_from_x509_cert(&container->vp_group, container,
                                                        request, cert, conf->verify.der_decode) < 0) {
                        fr_pair_delete_by_da(&request->session_state_pairs, attr_tls_certificate);
                        if (conf->verify.der_decode) {
                                fr_pair_delete_by_da(&request->session_state_pairs, attr_der_certificate);
                        }
                        my_ok = 0;
                        goto done;
                }
 
                log_request_pair(L_DBG_LVL_2, request, NULL, container, "session-state.");
        }
done:
        /*
         *      If verification hasn't already failed
         *      and we're meant to verify this cert
         *      then call the virtual server.
         *
         *      We only call the virtual server for
         *      the certificate at depth 0 as all
         *      other certificate attributes should
         *      have been added by this point.
         */
        if (my_ok && (depth == 0)) {
                if (conf->verify_certificate && tls_session->verify_client_cert) {
                        RDEBUG2("Requesting certificate validation");
 
                        /*
                         *      This sets the validation state of the tls_session
                         *      so that when we call ASYNC_pause_job(), and execution
                         *      jumps back to tls_session_async_handshake_cont
                         *      (just under SSL_read())
                         *      the code there knows what job it needs to push onto
                         *      the unlang stack.
                         */
                        fr_tls_verify_cert_request(tls_session, SSL_session_reused(tls_session->ssl));
 
                        /*
                         *      Jumps back to SSL_read() in session.c
                         *
                         *      Be aware that if the request is cancelled
                         *      whatever was meant to be done during the
                         *      time we yielded may not have been completed.
                         */
                        ASYNC_pause_job();
 
                        /*
                         *      Just try and bail out as quickly as possible.
                         */
                        if (unlang_request_is_cancelled(request)) {
                                X509_STORE_CTX_set_error(x509_ctx, 0);
                                fr_tls_verify_cert_reset(tls_session);
                                return 1;
                        }
 
 
                        /*
                         *      If we couldn't validate the certificate
                         *      then validation overall fails.
                         */
                        if (!fr_tls_verify_cert_result(tls_session)) {
                                REDEBUG("Certificate validation failed");
                                my_ok = 0;
                                X509_STORE_CTX_set_error(x509_ctx, X509_V_ERR_APPLICATION_VERIFICATION);
                        }
                }
        }
 
        tls_session->client_cert_ok = (my_ok > 0);
        RDEBUG2("[verify] = %s", my_ok ? "ok" : "invalid");
 
        return my_ok;
}
DIAG_ON(used-but-marked-unused)
DIAG_ON(DIAG_UNKNOWN_PRAGMAS)
 
/** Revalidates the client's certificate chain
 *
 * Wraps the fr_tls_verify_cert_cb callback, allowing us to use the same
 * validation logic whenever we need to.
 *
 * @note Only use so far is forcing the chain to be re-validated on session
 *      resumption.
 *
 * @return
 *      - 1 if the chain could be validated.
 *      - 0 if the chain failed validation.
 */
int fr_tls_verify_cert_chain(request_t *request, SSL *ssl)
{
        int             err;
        int             verify;
        int             ret = 1;
 
        SSL_CTX         *ssl_ctx;
        STACK_OF(X509)  *chain;
        X509            *cert;
        X509_STORE      *store;
        X509_STORE_CTX  *store_ctx;
 
        /*
         *      If there's no client certificate, we just return OK.
         */
        cert = SSL_get0_peer_certificate(ssl);                  /* Does not increase ref count */
        if (!cert) return 1;
 
        ssl_ctx = SSL_get_SSL_CTX(ssl);
        store_ctx = X509_STORE_CTX_new();
        if (unlikely(store_ctx == NULL)) {
                REDEBUG("Failed allocating X509_STORE_CTX");
                return 0;
        }
 
        chain = SSL_get_peer_cert_chain(ssl);                   /* Does not increase ref count */
        store = SSL_CTX_get_ex_data(ssl_ctx, FR_TLS_EX_CTX_INDEX_VERIFY_STORE); /* Gets the verification store */
 
        /*
         *      This sets up a store_ctx for doing peer certificate verification.
         *
         *      store_ctx       - Is the ctx to initialise
         *      store           - Is an X509_STORE of implicitly
         *                        trusted certificates.  Here we're using
         *                        the verify store that was created when we
         *                        allocated the SSL_CTX.
         *      cert            - Is the certificate to validate.
         *      chain           - Is any other certificates the peer provided
         *                        us in order to build a chain from a trusted
         *                        root or intermediary to its leaf (cert).
         *
         *      Note: SSL_CTX_get_cert_store() returns the ctx->cert_store, which
         *      is not the same as the verification cert store.
         */
        if (unlikely(X509_STORE_CTX_init(store_ctx, store, cert, chain) != 1)) {
                REDEBUG("Failed initialising X509_STORE_CTX");
                X509_STORE_CTX_free(store_ctx);
                return 0;
        }
 
        X509_STORE_CTX_set_ex_data(store_ctx, SSL_get_ex_data_X509_STORE_CTX_idx(), ssl);
        X509_STORE_CTX_set_verify_cb(store_ctx, fr_tls_verify_cert_cb);
 
        verify = X509_verify_cert(store_ctx);
        if (verify != 1) {
                err = X509_STORE_CTX_get_error(store_ctx);
 
                if (err != X509_V_OK) {
                        REDEBUG("Failed re-validating resumed session: %s", X509_verify_cert_error_string(err));
                        ret = 0;
                }
        }
 
        X509_STORE_CTX_free(store_ctx);
 
        return ret;
}
 
/** Process the result of `verify certificate { ... }`
 *
 */
static unlang_action_t tls_verify_client_cert_result(request_t *request, void *uctx)
{
        fr_tls_session_t        *tls_session = talloc_get_type_abort(uctx, fr_tls_session_t);
        fr_pair_t               *vp, *next;
 
        fr_assert(tls_session->validate.state == FR_TLS_VALIDATION_REQUESTED);
 
        vp = fr_pair_find_by_da(&request->reply_pairs, NULL, attr_tls_packet_type);
        if (!vp || (vp->vp_uint32 != enum_tls_packet_type_success->vb_uint32)) {
                REDEBUG("Failed (re-)validating certificates");
 
                /*
                 *      Hoist any instances of Module-Failure-Message from the subrequest
                 *      so they can be used for logging failures.
                 */
                vp = fr_pair_find_by_da(&request->request_pairs, NULL, attr_module_failure_message);
                while (vp && request->parent) {
                        next = fr_pair_find_by_da(&request->request_pairs, vp, attr_module_failure_message);
                        fr_pair_remove(&request->request_pairs, vp);
                        fr_pair_steal_append(request->parent->request_ctx, &request->parent->request_pairs, vp);
                        vp = next;
                }
 
                tls_session->validate.state = FR_TLS_VALIDATION_FAILED;
                return UNLANG_ACTION_CALCULATE_RESULT;
        }
 
        tls_session->validate.state = FR_TLS_VALIDATION_SUCCESS;
 
        RDEBUG2("Certificates (re-)validated");
 
        return UNLANG_ACTION_CALCULATE_RESULT;
}
 
/** Push a `verify certificate { ... }` call into the current request, using a subrequest
 *
 * @param[in] request           The current request.
 * @param[in] tls_session       The current TLS session.
 * @return
 *      - UNLANG_ACTION_CALCULATE_RESULT on noop.
 *      - UNLANG_ACTION_PUSHED_CHILD on success.
 *      - UNLANG_ACTION_FAIL on failure.
 */
static unlang_action_t tls_verify_client_cert_push(request_t *request, fr_tls_session_t *tls_session)
{
        fr_tls_conf_t           *conf = fr_tls_session_conf(tls_session->ssl);
        request_t               *child;
        fr_pair_t               *vp;
        unlang_action_t         ua;
 
        MEM(child = unlang_subrequest_alloc(request, dict_tls));
        request = child;
 
        /*
         *      Add extra pairs to the subrequest
         */
        fr_tls_session_extra_pairs_copy_to_child(child, tls_session);
 
        /*
         *      Setup the child request for loading
         *      session resumption data.
         */
        MEM(pair_prepend_request(&vp, attr_tls_packet_type) >= 0);
        vp->vp_uint32 = enum_tls_packet_type_verify_certificate->vb_uint32;
 
        /*
         *      Copy certificate pairs to the child session state
         */
        vp = NULL;
        while ((vp = fr_pair_find_by_da(&request->parent->session_state_pairs, vp, attr_tls_certificate))) {
                fr_pair_append(&request->session_state_pairs, fr_pair_copy(request->session_state_ctx, vp));
        }
        if (conf->verify.der_decode) {
                while ((vp = fr_pair_find_by_da(&request->parent->session_state_pairs, vp, attr_der_certificate))) {
                        fr_pair_append(&request->session_state_pairs, fr_pair_copy(request->session_state_ctx, vp));
                }
        }
 
        MEM(pair_append_request(&vp, attr_tls_session_resumed) >= 0);
        vp->vp_bool = tls_session->validate.resumed;
 
        /*
         *      Allocate a child, and set it up to call
         *      the TLS virtual server.
         */
        ua = fr_tls_call_push(child, tls_verify_client_cert_result, conf, tls_session, false);
        if (ua < 0) {
                PERROR("Failed calling TLS virtual server");
                talloc_free(child);
                return UNLANG_ACTION_FAIL;
        }
 
        return ua;
}
 
/** Clear any previous validation result
 *
 * Should be called by the validation requestor to get the result and reset
 * the validation state.
 *
 * @return
 *      - true if the certificate chain was validated.
 *      - false if the certificate chain failed validation.
 */
bool fr_tls_verify_cert_result(fr_tls_session_t *tls_session)
{
        bool result;
 
        fr_assert(tls_session->validate.state != FR_TLS_VALIDATION_INIT);
 
        result = tls_session->validate.state == FR_TLS_VALIDATION_SUCCESS;
 
        tls_session->validate.state = FR_TLS_VALIDATION_INIT;
        tls_session->validate.resumed = false;
 
        return result;
}
 
/** Reset the verification state
 *
 */
void fr_tls_verify_cert_reset(fr_tls_session_t *tls_session)
{
        tls_session->validate.state = FR_TLS_VALIDATION_INIT;
        tls_session->validate.resumed  = false;
}
 
/** Setup a verification request
 *
 */
void fr_tls_verify_cert_request(fr_tls_session_t *tls_session, bool session_resumed)
{
        fr_assert(tls_session->validate.state == FR_TLS_VALIDATION_INIT);
 
        tls_session->validate.state = FR_TLS_VALIDATION_REQUESTED;
        tls_session->validate.resumed = session_resumed;
}
 
/** Push a `verify certificate { ... }` section
 *
 * @param[in] request           The current request.
 * @param[in] tls_session       The current TLS session.
 * @return
 *      - UNLANG_ACTION_CALCULATE_RESULT        - No pending actions
 *      - UNLANG_ACTION_PUSHED_CHILD            - Pending operations to evaluate.
 */
unlang_action_t fr_tls_verify_cert_pending_push(request_t *request, fr_tls_session_t *tls_session)
{
        if (tls_session->validate.state == FR_TLS_VALIDATION_REQUESTED) {
                return tls_verify_client_cert_push(request, tls_session);
        }
 
        return UNLANG_ACTION_CALCULATE_RESULT;
}
#endif /* WITH_TLS */