1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515
|
// Copyright 2021 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifdef UNSAFE_BUFFERS_BUILD
// TODO(crbug.com/374320451): Fix and remove.
#pragma allow_unsafe_buffers
#endif
#include "net/cert/internal/trust_store_win.h"
#include <algorithm>
#include <string_view>
#include "base/containers/span.h"
#include "base/containers/to_vector.h"
#include "base/hash/sha1.h"
#include "base/location.h"
#include "base/logging.h"
#include "base/memory/ptr_util.h"
#include "base/strings/string_number_conversions.h"
#include "base/threading/scoped_blocking_call.h"
#include "net/base/features.h"
#include "net/cert/x509_util.h"
#include "net/cert/x509_util_win.h"
#include "net/third_party/mozilla_win/cert/win_util.h"
#include "third_party/boringssl/src/pki/cert_errors.h"
#include "third_party/boringssl/src/pki/parsed_certificate.h"
namespace net {
namespace {
// Certificates in the Windows roots store may be used as either trust
// anchors or trusted leafs (if self-signed).
constexpr bssl::CertificateTrust kRootCertTrust =
bssl::CertificateTrust::ForTrustAnchorOrLeaf()
.WithEnforceAnchorExpiry()
.WithEnforceAnchorConstraints()
.WithRequireLeafSelfSigned();
// Certificates in the Trusted People store may be trusted leafs (if
// self-signed).
constexpr bssl::CertificateTrust kTrustedPeopleTrust =
bssl::CertificateTrust::ForTrustedLeaf().WithRequireLeafSelfSigned();
// Returns true if the cert can be used for server authentication, based on
// certificate properties.
//
// While there are a variety of certificate properties that can affect how
// trust is computed, the main property is CERT_ENHKEY_USAGE_PROP_ID, which
// is intersected with the certificate's EKU extension (if present).
// The intersection is documented in the Remarks section of
// CertGetEnhancedKeyUsage, and is as follows:
// - No EKU property, and no EKU extension = Trusted for all purpose
// - Either an EKU property, or EKU extension, but not both = Trusted only
// for the listed purposes
// - Both an EKU property and an EKU extension = Trusted for the set
// intersection of the listed purposes
// CertGetEnhancedKeyUsage handles this logic, and if an empty set is
// returned, the distinction between the first and third case can be
// determined by GetLastError() returning CRYPT_E_NOT_FOUND.
//
// See:
// https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-certgetenhancedkeyusage
//
// If we run into any errors reading the certificate properties, we fail
// closed.
bool IsCertTrustedForServerAuth(PCCERT_CONTEXT cert) {
DWORD usage_size = 0;
if (!CertGetEnhancedKeyUsage(cert, 0, nullptr, &usage_size)) {
return false;
}
std::vector<BYTE> usage_bytes(usage_size);
CERT_ENHKEY_USAGE* usage =
reinterpret_cast<CERT_ENHKEY_USAGE*>(usage_bytes.data());
if (!CertGetEnhancedKeyUsage(cert, 0, usage, &usage_size)) {
return false;
}
if (usage->cUsageIdentifier == 0) {
// check GetLastError
HRESULT error_code = GetLastError();
switch (error_code) {
case CRYPT_E_NOT_FOUND:
return true;
case S_OK:
return false;
default:
return false;
}
}
// SAFETY: `usage->rgpszUsageIdentifier` is an array of LPSTR (pointer to null
// terminated string) of length `usage->cUsageIdentifier`.
base::span<LPSTR> usage_identifiers = UNSAFE_BUFFERS(
base::span(usage->rgpszUsageIdentifier, usage->cUsageIdentifier));
for (std::string_view eku : usage_identifiers) {
if ((eku == szOID_PKIX_KP_SERVER_AUTH) ||
(eku == szOID_ANY_ENHANCED_KEY_USAGE)) {
return true;
}
}
return false;
}
void AddCertWithTrust(
PCCERT_CONTEXT cert,
const bssl::CertificateTrust trust,
std::vector<net::PlatformTrustStore::CertWithTrust>* certs) {
certs->push_back(net::PlatformTrustStore::CertWithTrust(
base::ToVector(x509_util::CertContextAsSpan(cert)), trust));
}
} // namespace
TrustStoreWin::CertStores::CertStores() = default;
TrustStoreWin::CertStores::~CertStores() = default;
TrustStoreWin::CertStores::CertStores(CertStores&& other) = default;
TrustStoreWin::CertStores& TrustStoreWin::CertStores::operator=(
CertStores&& other) = default;
// static
TrustStoreWin::CertStores
TrustStoreWin::CertStores::CreateInMemoryStoresForTesting() {
TrustStoreWin::CertStores stores;
stores.roots = crypto::ScopedHCERTSTORE(CertOpenStore(
CERT_STORE_PROV_MEMORY, X509_ASN_ENCODING, NULL, 0, nullptr));
stores.intermediates = crypto::ScopedHCERTSTORE(CertOpenStore(
CERT_STORE_PROV_MEMORY, X509_ASN_ENCODING, NULL, 0, nullptr));
stores.trusted_people = crypto::ScopedHCERTSTORE(CertOpenStore(
CERT_STORE_PROV_MEMORY, X509_ASN_ENCODING, NULL, 0, nullptr));
stores.disallowed = crypto::ScopedHCERTSTORE(CertOpenStore(
CERT_STORE_PROV_MEMORY, X509_ASN_ENCODING, NULL, 0, nullptr));
stores.InitializeAllCertsStore();
return stores;
}
TrustStoreWin::CertStores
TrustStoreWin::CertStores::CreateNullStoresForTesting() {
return TrustStoreWin::CertStores();
}
// static
TrustStoreWin::CertStores TrustStoreWin::CertStores::CreateWithCollections() {
TrustStoreWin::CertStores stores;
stores.roots = crypto::ScopedHCERTSTORE(
CertOpenStore(CERT_STORE_PROV_COLLECTION, 0, NULL, 0, nullptr));
stores.intermediates = crypto::ScopedHCERTSTORE(
CertOpenStore(CERT_STORE_PROV_COLLECTION, 0, NULL, 0, nullptr));
stores.trusted_people = crypto::ScopedHCERTSTORE(
CertOpenStore(CERT_STORE_PROV_COLLECTION, 0, NULL, 0, nullptr));
stores.disallowed = crypto::ScopedHCERTSTORE(
CertOpenStore(CERT_STORE_PROV_COLLECTION, 0, NULL, 0, nullptr));
stores.InitializeAllCertsStore();
return stores;
}
void TrustStoreWin::CertStores::InitializeAllCertsStore() {
all = crypto::ScopedHCERTSTORE(
CertOpenStore(CERT_STORE_PROV_COLLECTION, 0, NULL, 0, nullptr));
if (is_null()) {
return;
}
// Add intermediate and root cert stores to the all_cert_store collection so
// SyncGetIssuersOf will find them. disallowed_cert_store is not added
// because the certs are distrusted; making them non-findable in
// SyncGetIssuersOf helps us fail path-building faster.
// `trusted_people` is not added because it can only contain end-entity
// certs, so checking it for issuers during path building is not necessary.
if (!CertAddStoreToCollection(all.get(), intermediates.get(),
/*dwUpdateFlags=*/0, /*dwPriority=*/0)) {
return;
}
if (!CertAddStoreToCollection(all.get(), roots.get(),
/*dwUpdateFlags=*/0, /*dwPriority=*/0)) {
return;
}
}
class TrustStoreWin::Impl {
public:
// Creates a TrustStoreWin.
Impl() {
base::ScopedBlockingCall scoped_blocking_call(
FROM_HERE, base::BlockingType::MAY_BLOCK);
CertStores stores = CertStores::CreateWithCollections();
if (stores.is_null()) {
// If there was an error initializing the cert store collections, give
// up. The Impl object will still be created but any calls to its public
// methods will return no results.
return;
}
// Grab the user-added roots.
GatherEnterpriseCertsForLocation(stores.roots.get(),
CERT_SYSTEM_STORE_LOCAL_MACHINE, L"ROOT");
GatherEnterpriseCertsForLocation(
stores.roots.get(), CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY,
L"ROOT");
GatherEnterpriseCertsForLocation(stores.roots.get(),
CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE,
L"ROOT");
GatherEnterpriseCertsForLocation(stores.roots.get(),
CERT_SYSTEM_STORE_CURRENT_USER, L"ROOT");
GatherEnterpriseCertsForLocation(
stores.roots.get(), CERT_SYSTEM_STORE_CURRENT_USER_GROUP_POLICY,
L"ROOT");
// Grab the user-added intermediates.
GatherEnterpriseCertsForLocation(stores.intermediates.get(),
CERT_SYSTEM_STORE_LOCAL_MACHINE, L"CA");
GatherEnterpriseCertsForLocation(
stores.intermediates.get(),
CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY, L"CA");
GatherEnterpriseCertsForLocation(stores.intermediates.get(),
CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE,
L"CA");
GatherEnterpriseCertsForLocation(stores.intermediates.get(),
CERT_SYSTEM_STORE_CURRENT_USER, L"CA");
GatherEnterpriseCertsForLocation(
stores.intermediates.get(), CERT_SYSTEM_STORE_CURRENT_USER_GROUP_POLICY,
L"CA");
// Grab the user-added trusted server certs. Trusted end-entity certs are
// only allowed for server auth in the "local machine" store, but not in the
// "current user" store.
GatherEnterpriseCertsForLocation(stores.trusted_people.get(),
CERT_SYSTEM_STORE_LOCAL_MACHINE,
L"TrustedPeople");
GatherEnterpriseCertsForLocation(
stores.trusted_people.get(),
CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY, L"TrustedPeople");
GatherEnterpriseCertsForLocation(stores.trusted_people.get(),
CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE,
L"TrustedPeople");
// Grab the user-added disallowed certs.
GatherEnterpriseCertsForLocation(stores.disallowed.get(),
CERT_SYSTEM_STORE_LOCAL_MACHINE,
L"Disallowed");
GatherEnterpriseCertsForLocation(
stores.disallowed.get(), CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY,
L"Disallowed");
GatherEnterpriseCertsForLocation(stores.disallowed.get(),
CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE,
L"Disallowed");
GatherEnterpriseCertsForLocation(
stores.disallowed.get(), CERT_SYSTEM_STORE_CURRENT_USER, L"Disallowed");
GatherEnterpriseCertsForLocation(
stores.disallowed.get(), CERT_SYSTEM_STORE_CURRENT_USER_GROUP_POLICY,
L"Disallowed");
// Auto-sync all of the cert stores to get updates to the cert store.
// Auto-syncing on all_certs_store seems to work to resync the nested
// stores, although the docs at
// https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-certcontrolstore
// are somewhat unclear. If and when root store changes are linked to
// clearing various caches, this should be replaced with
// CERT_STORE_CTRL_NOTIFY_CHANGE and CERT_STORE_CTRL_RESYNC.
if (!CertControlStore(stores.all.get(), 0, CERT_STORE_CTRL_AUTO_RESYNC,
0) ||
!CertControlStore(stores.trusted_people.get(), 0,
CERT_STORE_CTRL_AUTO_RESYNC, 0) ||
!CertControlStore(stores.disallowed.get(), 0,
CERT_STORE_CTRL_AUTO_RESYNC, 0)) {
PLOG(ERROR) << "Error enabling CERT_STORE_CTRL_AUTO_RESYNC";
}
root_cert_store_ = std::move(stores.roots);
intermediate_cert_store_ = std::move(stores.intermediates);
trusted_people_cert_store_ = std::move(stores.trusted_people);
disallowed_cert_store_ = std::move(stores.disallowed);
all_certs_store_ = std::move(stores.all);
}
Impl(CertStores stores)
: root_cert_store_(std::move(stores.roots)),
intermediate_cert_store_(std::move(stores.intermediates)),
all_certs_store_(std::move(stores.all)),
trusted_people_cert_store_(std::move(stores.trusted_people)),
disallowed_cert_store_(std::move(stores.disallowed)) {}
~Impl() = default;
Impl(const Impl& other) = delete;
Impl& operator=(const Impl& other) = delete;
void SyncGetIssuersOf(const bssl::ParsedCertificate* cert,
bssl::ParsedCertificateList* issuers) {
if (!root_cert_store_.get() || !intermediate_cert_store_.get() ||
!trusted_people_cert_store_.get() || !all_certs_store_.get() ||
!disallowed_cert_store_.get()) {
return;
}
base::span<const uint8_t> issuer_span = cert->issuer_tlv();
CERT_NAME_BLOB cert_issuer_blob;
cert_issuer_blob.cbData = static_cast<DWORD>(issuer_span.size());
cert_issuer_blob.pbData = const_cast<uint8_t*>(issuer_span.data());
PCCERT_CONTEXT cert_from_store = nullptr;
while ((cert_from_store = CertFindCertificateInStore(
all_certs_store_.get(), X509_ASN_ENCODING, 0,
CERT_FIND_SUBJECT_NAME, &cert_issuer_blob, cert_from_store))) {
bssl::UniquePtr<CRYPTO_BUFFER> der_crypto = x509_util::CreateCryptoBuffer(
x509_util::CertContextAsSpan(cert_from_store));
bssl::CertErrors errors;
bssl::ParsedCertificate::CreateAndAddToVector(
std::move(der_crypto), x509_util::DefaultParseCertificateOptions(),
issuers, &errors);
}
}
bssl::CertificateTrust GetTrust(const bssl::ParsedCertificate* cert) {
if (!root_cert_store_.get() || !intermediate_cert_store_.get() ||
!trusted_people_cert_store_.get() || !all_certs_store_.get() ||
!disallowed_cert_store_.get()) {
return bssl::CertificateTrust::ForUnspecified();
}
base::span<const uint8_t> cert_span = cert->der_cert();
base::SHA1Digest cert_hash = base::SHA1Hash(cert_span);
CRYPT_HASH_BLOB cert_hash_blob;
cert_hash_blob.cbData = static_cast<DWORD>(cert_hash.size());
cert_hash_blob.pbData = cert_hash.data();
PCCERT_CONTEXT cert_from_store = nullptr;
// Check Disallowed store first.
while ((cert_from_store = CertFindCertificateInStore(
disallowed_cert_store_.get(), X509_ASN_ENCODING, 0,
CERT_FIND_SHA1_HASH, &cert_hash_blob, cert_from_store))) {
base::span<const uint8_t> cert_from_store_span =
x509_util::CertContextAsSpan(cert_from_store);
// If a cert is in the windows distruted store, it is considered
// distrusted for all purporses. EKU isn't checked. See crbug.com/1355961.
if (std::ranges::equal(cert_span, cert_from_store_span)) {
return bssl::CertificateTrust::ForDistrusted();
}
}
while ((cert_from_store = CertFindCertificateInStore(
root_cert_store_.get(), X509_ASN_ENCODING, 0,
CERT_FIND_SHA1_HASH, &cert_hash_blob, cert_from_store))) {
base::span<const uint8_t> cert_from_store_span =
x509_util::CertContextAsSpan(cert_from_store);
if (std::ranges::equal(cert_span, cert_from_store_span)) {
// If we find at least one version of the cert that is trusted for TLS
// Server Auth, we will trust the cert.
if (IsCertTrustedForServerAuth(cert_from_store)) {
return kRootCertTrust;
}
}
}
while ((cert_from_store = CertFindCertificateInStore(
trusted_people_cert_store_.get(), X509_ASN_ENCODING, 0,
CERT_FIND_SHA1_HASH, &cert_hash_blob, cert_from_store))) {
base::span<const uint8_t> cert_from_store_span =
x509_util::CertContextAsSpan(cert_from_store);
if (std::ranges::equal(cert_span, cert_from_store_span)) {
// If we find at least one version of the cert that is trusted for TLS
// Server Auth, we will trust the cert.
if (IsCertTrustedForServerAuth(cert_from_store)) {
return kTrustedPeopleTrust;
}
}
}
// If we fall through here, we've either
//
// (a) found the cert but it is not usable for server auth. Treat this as
// Unspecified trust. Originally this was treated as Distrusted, but
// this is inconsistent with how the Windows verifier works, which is to
// union all of the EKU usages for all instances of the cert, whereas
// sending back Distrusted would not do that.
//
// or
//
// (b) Haven't found the cert. Tell everyone Unspecified.
return bssl::CertificateTrust::ForUnspecified();
}
std::vector<net::PlatformTrustStore::CertWithTrust> GetAllUserAddedCerts() {
std::vector<net::PlatformTrustStore::CertWithTrust> certs;
if (!root_cert_store_.get() || !intermediate_cert_store_.get() ||
!trusted_people_cert_store_.get() || !all_certs_store_.get() ||
!disallowed_cert_store_.get()) {
return certs;
}
PCCERT_CONTEXT cert_from_store = nullptr;
while ((cert_from_store = CertEnumCertificatesInStore(
disallowed_cert_store_.get(), cert_from_store))) {
AddCertWithTrust(cert_from_store, bssl::CertificateTrust::ForDistrusted(),
&certs);
}
while ((cert_from_store = CertEnumCertificatesInStore(
trusted_people_cert_store_.get(), cert_from_store))) {
if (IsCertTrustedForServerAuth(cert_from_store)) {
AddCertWithTrust(cert_from_store, kTrustedPeopleTrust, &certs);
}
}
while ((cert_from_store = CertEnumCertificatesInStore(
root_cert_store_.get(), cert_from_store))) {
if (IsCertTrustedForServerAuth(cert_from_store)) {
AddCertWithTrust(cert_from_store, kRootCertTrust, &certs);
}
}
while ((cert_from_store = CertEnumCertificatesInStore(
intermediate_cert_store_.get(), cert_from_store))) {
AddCertWithTrust(cert_from_store,
bssl::CertificateTrust::ForUnspecified(), &certs);
}
return certs;
}
private:
// Cert Collection containing all user-added trust anchors.
crypto::ScopedHCERTSTORE root_cert_store_;
// Cert Collection containing all user-added intermediates.
crypto::ScopedHCERTSTORE intermediate_cert_store_;
// Cert Collection for searching via SyncGetIssuersOf()
crypto::ScopedHCERTSTORE all_certs_store_;
// Cert Collection containing all user-added trust leafs.
crypto::ScopedHCERTSTORE trusted_people_cert_store_;
// Cert Collection for all disallowed certs.
crypto::ScopedHCERTSTORE disallowed_cert_store_;
};
// TODO(crbug.com/40784681): support CTLs.
TrustStoreWin::TrustStoreWin() = default;
void TrustStoreWin::InitializeStores() {
// Don't need return value
MaybeInitializeAndGetImpl();
}
TrustStoreWin::Impl* TrustStoreWin::MaybeInitializeAndGetImpl() {
base::AutoLock lock(init_lock_);
if (!impl_) {
impl_ = std::make_unique<TrustStoreWin::Impl>();
}
return impl_.get();
}
std::unique_ptr<TrustStoreWin> TrustStoreWin::CreateForTesting(
CertStores stores) {
return base::WrapUnique(new TrustStoreWin(
std::make_unique<TrustStoreWin::Impl>(std::move(stores))));
}
TrustStoreWin::TrustStoreWin(std::unique_ptr<Impl> impl)
: impl_(std::move(impl)) {}
TrustStoreWin::~TrustStoreWin() = default;
void TrustStoreWin::SyncGetIssuersOf(const bssl::ParsedCertificate* cert,
bssl::ParsedCertificateList* issuers) {
MaybeInitializeAndGetImpl()->SyncGetIssuersOf(cert, issuers);
}
// As documented in IsCertTrustedForServerAuth(), on Windows, the
// set of extended key usages present in a certificate can be further
// scoped down by user setting; effectively, disabling a given EKU for
// a given intermediate or root.
//
// Windows uses this during path building when filtering the EKUs; if it
// encounters this property, it uses the combined EKUs to determine
// whether to continue path building, but doesn't treat the certificate
// as affirmatively revoked/distrusted.
//
// This behaviour is replicated here by returning Unspecified trust if
// we find instances of the cert that do not have the correct EKUs set
// for TLS Server Auth. This allows path building to continue and allows
// us to later trust the cert if it is present in Chrome Root Store.
//
// Windows does have some idiosyncrasies here, which result in the
// following treatment:
//
// - If a certificate is in the Disallowed store, it is distrusted for
// all purposes regardless of any EKUs that are set.
// - If a certificate is in the ROOT store, and usable for TLS Server Auth,
// then it's trusted.
// - If a certificate is in the root store, and lacks the EKU, then continue
// path building, but don't treat it as trusted (aka Unspecified).
// - If we can't find the cert anywhere, then continue path
// building, but don't treat it as trusted (aka Unspecified).
//
// If a certificate is found multiple times in the ROOT store, it is trusted
// for TLS server auth if any instance of the certificate found
// is usable for TLS server auth.
bssl::CertificateTrust TrustStoreWin::GetTrust(
const bssl::ParsedCertificate* cert) {
return MaybeInitializeAndGetImpl()->GetTrust(cert);
}
std::vector<net::PlatformTrustStore::CertWithTrust>
TrustStoreWin::GetAllUserAddedCerts() {
return MaybeInitializeAndGetImpl()->GetAllUserAddedCerts();
}
} // namespace net
|