fix various issues in x509_vfy.c and v3_purp.c related to #1418 and the respective documentation #10587

DDvO · 2019-12-07T20:56:02Z

Fixes #1418. See discussion there.

documentation is added or updated
tests are added or updated

crypto/x509/v3_purp.c

bernd-edlinger · 2019-12-08T18:14:30Z

The similarity to #7943 is remarkable 😃

DDvO · 2019-12-08T20:27:52Z

The similarity to #7943 is remarkable smiley

@bernd-edlinger, indeed the improvement to x509v3_cache_extensions() is essentially the same, except that your code is slightly nicer, so I've adopted it.
If I had been aware of that PR or if it had been finished and merged meanwhile I would not have had to re-discover that fix. On the bright side, you can take my PR as an approval of that portion of your PR ;-)

BTW, I'm not convinced of the other half of PR #7943 (the change you proposed on check_ca()), to which I've commented there.

DDvO · 2019-12-08T20:50:20Z

This PR should obsolete #7918.

mattcaswell · 2019-12-09T09:42:07Z

@vdukhovni

t8m · 2019-12-09T17:13:00Z

Would you please amend the commit message so it is more descriptive? Also it would make sense to squash at this point and/or split the patches if there are multiple unrelated issues fixed.
I suppose we would want a cherry-pick to 1.1.1 branch as well.

DDvO · 2019-12-10T09:33:09Z

@t8m, yep, I'll do a cleanup pass, squashing commits and putting more text in the commit(s) that remain after (at least partly) squashing. Hope you saw that there are already descriptions at issue discussion level, in particular #1418 (comment).

I'll also try to separate concerns, which I fear is only partially possible, so likely the new commits each representing a specific (sub-)issue will need to be hierarchical, i.e., not split-able into independent PRs.

Cherry-picking to 1.1.1 l presume should be no problem, but likely best done after this PR has been reviewed and is stable/approved.

BTW, @bernd-edlinger, your change request is already fulfilled.

crypto/x509/v3_purp.c

crypto/x509/x509_vfy.c

doc/man3/X509_STORE_CTX_get_error.pod

doc/man3/X509_VERIFY_PARAM_set_flags.pod

kroeckx · 2019-12-12T21:42:35Z

Maybe it's useful to have some self-issued certs that are not self-signed? And one that has a keyUsage without the keyCertSig. And maybe some other variants.

kroeckx · 2019-12-12T21:56:35Z

I don't understand the logic behind -partial_chain. If a certificate is trusted, why does it matter that it's self-signed or not? But I guess that's not something this PR should change.

vdukhovni · 2019-12-12T22:45:53Z

Maybe it's useful to have some self-issued certs that are not self-signed? And one that has a keyUsage without the keyCertSig. And maybe some other variants.

Only with partial_chain. Otherwise, self-issued certs are not trust-anchors. Trust-anchors need to be self-signed.

vdukhovni · 2019-12-12T22:49:05Z

I don't understand the logic behind -partial_chain. If a certificate is trusted, why does it matter that it's self-signed or not? But I guess that's not something this PR should change.

The logic allows intermediate certificates to be added to the trust store, without them being trusted, they just represent better versions of the issuer for chain construction.

Windows has an "intermediate certificate store" for this, but OpenSSL does not. We could in principle require all trust-anchors to be stored as "TRUSTED CERTIFICATE" objects with suitable auxiliary trust EKUs, but that's hard to do without major compatibility breakage.

vdukhovni · 2019-12-12T22:50:13Z

Maybe it's useful to have some self-issued certs that are not self-signed? And one that has a keyUsage without the keyCertSig. And maybe some other variants.

CAs should generally have keyCertSig, whether they're self-issued, cross (intermediate) or self-signed.

DDvO · 2019-12-14T14:58:39Z

Maybe it's useful to have some self-issued certs that are not self-signed? And one that has a keyUsage without the keyCertSig.

We already have an example of such an interesting cert among the test certs: test/certs/ee-ed25519.pem. It is just self-issued (but not self-signed) and has just keyAgreement as its keyUsage.

You may have noticed that in this PR I've extended the so far single test case for it in test/recipes/25-test_verify.t:

    # ED25519 certificate from draft-ietf-curdle-pkix-04
    ok(verify("ee-ed25519", "sslserver", ["root-ed25519"], []),
       "accept ED25519 ee cert signature w trusted ED25519 self-signed cert");

by four further ones:

    ok(!verify("root-ed25519", "sslserver", ["ee-ed25519"], []),
       "fail trusted ED25519-signed self-issued cert non-match");

    ok(verify("root-ed25519", "sslserver", ["root-ed25519"], []),
       "accept trusted ED25519 self-signed cert");

    ok(!verify("ee-ed25519", "sslserver", ["ee-ed25519"], []),
       "fail trusted ED25519-signed self-issued cert");

    ok(verify("ee-ed25519", "sslserver", ["ee-ed25519"], [], "-partial_chain"),
       "accept last-resort direct leaf match ED25519-signed self-issued cert");

where in the last one provides a concrete example of the usefulness of -partial_chain (or X509_V_FLAG_PARTIAL_CHAIN, respectively) and for the hint I added to doc/man3/X509_STORE_CTX_get_error.pod and doc/man1/openssl-verify.pod discussed above:

To enable using trusted self-issued but not self-signed certificates
the B<-partial_chain> option may be set.

DDvO · 2019-12-24T11:45:59Z

Thanks to all how have taken part so far in discussing this PR!

I've just finished all action items (including two change requests) that came up this way:

refactored the code to avoid redundancies and increase readability and maintainability
retained the original (partly strange) semantics of the API function X509_check_issued()
improved the wording of the new documentation texts and comments
reverted that part of the changes to build_chain() that did not really make sense and
re-structured the PR into a series of pretty self-contained commits with better descriptions

Moreover, I've

added a small optimization and safety precaution in find_issuer() of x509_vfy.c
added a further test case with a cert by @Forkest demonstrating successful fix of self-signed certificate seems not to be detected if keyUsage extension is present and does not assert the keyCertSig bit #1418

…a1 == NULL'

vdukhovni

Looks OK to me now.

vdukhovni · 2020-06-30T09:04:17Z

Looks OK to me now.

However, my review is for master only. There should be a separate PR for 1.1.1 (if desired), and ideally much smaller. This PR looks much too expansive for a stable release. If there's a minimal change that's compelling for 1.1.1, I'll consider that.

DDvO · 2020-06-30T09:12:43Z

Looks OK to me now.

Thanks a lot @vdukhovni!
Very glad that this is through finally.

However, my review is for master only. There should be a separate PR for 1.1.1 (if desired), and ideally much smaller. This PR looks much too expansive for a stable release. If there's a minimal change that's compelling for 1.1.1, I'll consider that.

I agree. I will come up with a somewhat minimal backport.
According to users' comments not only in #1418 it looks like there is high demand also for a backport to the LTS version.

…d certs etc. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from #10587)

This prepares some corrections and improves readability (coding style). Among others, it adds the static function check_sig_alg_match() and the internal functions x509_likely_issued() and x509_signing_allowed(). Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from #10587)

by adding CA basic constraints, CA key usage, and key IDs to the cert and by add -partial_chain to the verify call that trusts this cert Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from #10587)

…ssed X25519 certs Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from #10587)

candidate issuer cert cannot be the same as the subject cert 'x' Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from #10587)

…k_issued() Move check that cert signing is allowed from x509v3_cache_extensions() to where it belongs: internal_verify(), generalize it for proxy cert signing. Correct and simplify check_issued(), now checking self-issued (not: self-signed). Add test case to 25-test_verify.t that demonstrates successful fix Fixes #1418 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from #10587)

… X509_verify.pod Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from #10587)

Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from #10587)

…a1 == NULL' Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from #10587)

DDvO · 2020-07-01T09:21:31Z

Pushed - thanks again @vdukhovni and all others who took part discussing this, also on #1418.

openssl-machine · 2020-07-02T09:00:32Z

24 hours has passed since 'approval: done' was set, but as this PR has been updated in that time the label 'approval: ready to merge' is not being automatically set. Please review the updates and set the label manually.

t8m · 2020-07-02T16:21:12Z

This is already merged.

…k_issued() Move check that cert signing is allowed from x509v3_cache_extensions() to where it belongs: internal_verify(), generalize it for proxy cert signing. Correct and simplify check_issued(), now checking self-issued (not: self-signed). Add test case to 25-test_verify.t that demonstrates successful fix. As prerequisites, this adds the static function check_sig_alg_match() and the internal functions x509_likely_issued() and x509_signing_allowed(). This is a backport of the core of PR openssl#10587. Fixes openssl#1418

…k_issued() Move check that cert signing is allowed from x509v3_cache_extensions() to where it belongs: internal_verify(), generalize it for proxy cert signing. Correct and simplify check_issued(), now checking self-issued (not: self-signed). Add test case to 25-test_verify.t that demonstrates successful fix. As prerequisites, this adds the static function check_sig_alg_match() and the internal functions x509_likely_issued() and x509_signing_allowed(). This is a backport of the core of PR #10587. Fixes #1418 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from #12357)

This was referenced Dec 7, 2019

WIP: Fix keyCertSign checks #7918

Open

self-signed certificate seems not to be detected if keyUsage extension is present and does not assert the keyCertSig bit #1418

Closed

DDvO force-pushed the fix_x509_vfy_issue_1418 branch from ba0d852 to 34f5f35 Compare December 8, 2019 10:01

DDvO changed the title ~~fix confusions and obscure bugs in x509_vfy.c and v3_purp.c~~ WIP: fix confusions and obscure bugs in x509_vfy.c and v3_purp.c Dec 8, 2019

bernd-edlinger requested changes Dec 8, 2019

View reviewed changes

crypto/x509/v3_purp.c Outdated Show resolved Hide resolved

DDvO force-pushed the fix_x509_vfy_issue_1418 branch from 63988a6 to e41dd9e Compare December 8, 2019 19:50

DDvO changed the title ~~WIP: fix confusions and obscure bugs in x509_vfy.c and v3_purp.c~~ fix confusions and obscure bugs in x509_vfy.c and v3_purp.c Dec 8, 2019

DDvO mentioned this pull request Dec 8, 2019

CI test failed with self-signed.badssl.com/104.154.89.105 drwetter/testssl.sh#431

Closed

t8m added branch: 1.1.1 Merge to OpenSSL_1_1_1-stable branch branch: master Merge to master branch approval: review pending This pull request needs review by a committer labels Dec 9, 2019

t8m reviewed Dec 10, 2019

View reviewed changes

crypto/x509/v3_purp.c Show resolved Hide resolved

vdukhovni requested changes Dec 12, 2019

View reviewed changes

richsalz mentioned this pull request Dec 20, 2019

Add -DOPENSSL_BUILDING_OPENSSL to our builds #10666

Closed

DDvO mentioned this pull request Dec 24, 2019

Export the certificate chain construction functionality of build_chain() #10696

Closed

DDvO force-pushed the fix_x509_vfy_issue_1418 branch from 313035f to c85c05e Compare December 25, 2019 19:36

DDvO changed the title ~~fix confusions and obscure bugs in x509_vfy.c and v3_purp.c~~ fix various issues in x509_vfy.c and v3_purp.c related to #1418 and the respective documentation Dec 25, 2019

Add X509_self_signed(), extending and improving documenation and tests

834d505

DDvO force-pushed the fix_x509_vfy_issue_1418 branch 2 times, most recently from a89aa3c to 7862695 Compare June 30, 2020 05:46

X509v3_cache_extensions(): Improve coding style and doc, fix case 'sh…

ab88738

…a1 == NULL'

DDvO force-pushed the fix_x509_vfy_issue_1418 branch from 7862695 to ab88738 Compare June 30, 2020 08:07

vdukhovni approved these changes Jun 30, 2020

View reviewed changes

DDvO added approval: done This pull request has the required number of approvals and removed approval: review pending This pull request needs review by a committer labels Jul 1, 2020

openssl-machine pushed a commit that referenced this pull request Jul 1, 2020

Improve documentation, layout, and code comments regarding self-issue…

ade0873

…d certs etc. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from #10587)

openssl-machine pushed a commit that referenced this pull request Jul 1, 2020

Add four more verify test cases on the self-signed Ed25519 and self-i…

da1f88b

…ssed X25519 certs Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from #10587)

openssl-machine pushed a commit that referenced this pull request Jul 1, 2020

Optimization and safety precaution in find_issuer() of x509_vfy.c:

d18c7ad

candidate issuer cert cannot be the same as the subject cert 'x' Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from #10587)

openssl-machine pushed a commit that referenced this pull request Jul 1, 2020

Move doc of X509{,_REQ,_CRL}_verify{,_ex}() from X509_sign.pod to new…

4cec750

… X509_verify.pod Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from #10587)

openssl-machine pushed a commit that referenced this pull request Jul 1, 2020

Add X509_self_signed(), extending and improving documenation and tests

0d8dbb5

Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from #10587)

openssl-machine pushed a commit that referenced this pull request Jul 1, 2020

X509v3_cache_extensions(): Improve coding style and doc, fix case 'sh…

b4cb949

…a1 == NULL' Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from #10587)

DDvO mentioned this pull request Jul 2, 2020

Improve key usage checks in internal_verify() and backport fix of issue 1418 to v1.1.1 #12357

Closed

2 tasks

t8m closed this Jul 2, 2020

kaduk mentioned this pull request Nov 29, 2020

OpenSSL 1.1.1h is no longer reporting expired root CAs when using "verify" #13471

Closed

mattcaswell mentioned this pull request Jan 25, 2021

Verify of certificate chain using RSA-PSS keys fails starting with 1.1.1h #13931

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix various issues in x509_vfy.c and v3_purp.c related to #1418 and the respective documentation #10587

fix various issues in x509_vfy.c and v3_purp.c related to #1418 and the respective documentation #10587

DDvO commented Dec 7, 2019

bernd-edlinger commented Dec 8, 2019

DDvO commented Dec 8, 2019 •

edited

Loading

DDvO commented Dec 8, 2019

mattcaswell commented Dec 9, 2019

t8m commented Dec 9, 2019

DDvO commented Dec 10, 2019 •

edited

Loading

kroeckx commented Dec 12, 2019

kroeckx commented Dec 12, 2019

vdukhovni commented Dec 12, 2019

vdukhovni commented Dec 12, 2019

vdukhovni commented Dec 12, 2019

DDvO commented Dec 14, 2019

DDvO commented Dec 24, 2019 •

edited

Loading

vdukhovni left a comment

vdukhovni commented Jun 30, 2020

DDvO commented Jun 30, 2020 •

edited

Loading

DDvO commented Jul 1, 2020

openssl-machine commented Jul 2, 2020

t8m commented Jul 2, 2020

fix various issues in x509_vfy.c and v3_purp.c related to #1418 and the respective documentation #10587

fix various issues in x509_vfy.c and v3_purp.c related to #1418 and the respective documentation #10587

Conversation

DDvO commented Dec 7, 2019

bernd-edlinger commented Dec 8, 2019

DDvO commented Dec 8, 2019 • edited Loading

DDvO commented Dec 8, 2019

mattcaswell commented Dec 9, 2019

t8m commented Dec 9, 2019

DDvO commented Dec 10, 2019 • edited Loading

kroeckx commented Dec 12, 2019

kroeckx commented Dec 12, 2019

vdukhovni commented Dec 12, 2019

vdukhovni commented Dec 12, 2019

vdukhovni commented Dec 12, 2019

DDvO commented Dec 14, 2019

DDvO commented Dec 24, 2019 • edited Loading

vdukhovni left a comment

Choose a reason for hiding this comment

vdukhovni commented Jun 30, 2020

DDvO commented Jun 30, 2020 • edited Loading

DDvO commented Jul 1, 2020

openssl-machine commented Jul 2, 2020

t8m commented Jul 2, 2020

DDvO commented Dec 8, 2019 •

edited

Loading

DDvO commented Dec 10, 2019 •

edited

Loading

DDvO commented Dec 24, 2019 •

edited

Loading

DDvO commented Jun 30, 2020 •

edited

Loading