0.103.16: reject cert paths containing distrusted SPKIs

.github/workflows/ci.yml

@@ -293,10 +293,10 @@ jobs:
       - name: Install rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
-          targets: "$NOSTD_TARGET"
+          targets: ${{ env.NOSTD_TARGET }}
 
       - name: check no-std mode
-        run: cargo check --locked --target $NOSTD_TARGET ${{ matrix.features  }}
+        run: cargo check --locked --target "$NOSTD_TARGET" ${{ matrix.features  }}
 
   feature-powerset:
     name: Feature Powerset

Cargo.toml

@@ -21,7 +21,7 @@ license = "ISC"
 name = "rustls-webpki"
 readme = "README.md"
 repository = "https://github.com/rustls/webpki"
-version = "0.103.15"
+version = "0.103.16"
 
 include = [
     "Cargo.toml",

src/end_entity.rs

@@ -116,6 +116,7 @@ impl EndEntityCert<'_> {
             trust_anchors,
             intermediate_certs,
             revocation,
+            distrusted_spkis: verify_cert::DISTRUSTED_SPKIS,
         }
         .build_chain(self, time, verify_path)
     }

src/error.rs

@@ -38,6 +38,9 @@ pub enum Error {
     /// A CA certificate is being used as an end-entity certificate.
     CaUsedAsEndEntity,
 
+    /// A certificate's public key is explicitly distrusted.
+    CertDistrusted,
+
     /// The certificate is expired; i.e. the time it is being validated for is
     /// later than the certificate's notAfter time.
     CertExpired {
@@ -292,7 +295,10 @@ impl Error {
             // Errors related to certificate validity
             Self::CertNotValidYet { .. } | Self::CertExpired { .. } => 290,
             Self::CertNotValidForName(_) => 280,
-            Self::CertRevoked | Self::UnknownRevocationStatus | Self::CrlExpired { .. } => 270,
+            Self::CertDistrusted
+            | Self::CertRevoked
+            | Self::UnknownRevocationStatus
+            | Self::CrlExpired { .. } => 270,
             Self::InvalidCrlSignatureForPublicKey | Self::InvalidSignatureForPublicKey => 260,
             Self::SignatureAlgorithmMismatch => 250,
             Self::EmptyEkuExtension => 245,

src/verify_cert.rs

@@ -34,6 +34,7 @@ pub(crate) struct ChainOptions<'a, 'p, V> {
     pub(crate) trust_anchors: &'p [TrustAnchor<'p>],
     pub(crate) intermediate_certs: &'p [CertificateDer<'p>],
     pub(crate) revocation: Option<RevocationOptions<'a>>,
+    pub(crate) distrusted_spkis: &'a [&'a [u8]],
 }
 
 impl<'a, 'p: 'a, V: ExtendedKeyUsageValidator> ChainOptions<'a, 'p, V> {
@@ -58,6 +59,13 @@ impl<'a, 'p: 'a, V: ExtendedKeyUsageValidator> ChainOptions<'a, 'p, V> {
         sub_ca_count: usize,
         budget: &mut Budget,
     ) -> Result<&'p TrustAnchor<'p>, ControlFlow<Error, Error>> {
+        if self
+            .distrusted_spkis
+            .contains(&path.head().spki.as_slice_less_safe())
+        {
+            return Err(Error::CertDistrusted.into());
+        }
+
         let role = path.node().role();
 
         check_issuer_independent_properties(path.head(), time, role, sub_ca_count, &self.eku)?;
@@ -71,7 +79,12 @@ impl<'a, 'p: 'a, V: ExtendedKeyUsageValidator> ChainOptions<'a, 'p, V> {
                     return Err(Error::UnknownIssuer.into());
                 }
 
-                // TODO: check_distrust(trust_anchor_subject, trust_anchor_spki)?;
+                if self
+                    .distrusted_spkis
+                    .contains(&trust_anchor.subject_public_key_info.as_ref())
+                {
+                    return Err(Error::CertDistrusted.into());
+                }
 
                 let node = path.node();
                 self.check_signed_chain(&node, time, trust_anchor, budget)?;
@@ -900,6 +913,18 @@ pub(crate) enum Role {
     EndEntity,
 }
 
+// SPKI SEQUENCE contents (without tag/length) that should invalidate any path containing them.
+pub(crate) const DISTRUSTED_SPKIS: &[&[u8]] = &[
+    include_bytes!("data/distrusted/EMDVTLSCAG3B.spki.der"),
+    include_bytes!("data/distrusted/EMDVTLSCAG3C.spki.der"),
+    include_bytes!("data/distrusted/EMEVTLSCAG3B.spki.der"),
+    include_bytes!("data/distrusted/EMEVTLSCAG3C.spki.der"),
+    include_bytes!("data/distrusted/EMOVTLSCAG3B.spki.der"),
+    include_bytes!("data/distrusted/EMOVTLSCAG3C.spki.der"),
+    include_bytes!("data/distrusted/EMOVCSCAG3B.spki.der"),
+    include_bytes!("data/distrusted/EMOVCSCAG3C.spki.der"),
+];
+
 #[cfg(all(test, feature = "alloc", any(feature = "ring", feature = "aws-lc-rs")))]
 mod tests {
     use alloc::borrow::ToOwned;
@@ -1205,6 +1230,130 @@ mod tests {
         assert_eq!(path_intermediates[1].issuer(), trust_anchor_cert.subject());
     }
 
+    #[test]
+    fn distrusted_spki() {
+        fn verify(
+            ee_cert: &EndEntityCert<'_>,
+            intermediates: &[CertificateDer<'_>],
+            trust_anchors: &[TrustAnchor<'_>],
+            distrusted_spkis: &[&[u8]],
+        ) -> Result<usize, Error> {
+            use core::time::Duration;
+
+            ChainOptions {
+                eku: KeyUsage::server_auth(),
+                supported_sig_algs: crate::ALL_VERIFICATION_ALGS,
+                trust_anchors,
+                intermediate_certs: intermediates,
+                revocation: None,
+                distrusted_spkis,
+            }
+            .build_chain(
+                ee_cert,
+                UnixTime::since_unix_epoch(Duration::from_secs(0x1fed_f00d)),
+                None,
+            )
+            .map(|path| path.intermediate_certificates().count())
+        }
+
+        let root = make_issuer("Root");
+        let trust_anchors = &[anchor_from_trusted_cert(root.der()).unwrap()];
+        let issuing_intermediate = make_intermediate("Issuing Intermediate", &root);
+        let unrelated = make_intermediate("Intermediate", &root);
+
+        let params = issuer_params("Intermediate");
+        let key = KeyPair::generate_for(test_utils::RCGEN_SIGNATURE_ALG).unwrap();
+        // Issue the same SPKI under two different issuers to test cross-signing.
+        let intermediate = params.signed_by(&key, &issuing_intermediate).unwrap();
+        let cross_signed = params.signed_by(&key, &root).unwrap();
+        let ee = make_end_entity(&Issuer::new(params, key));
+        let ee_cert = EndEntityCert::try_from(ee.cert.der()).unwrap();
+        let intermediates = &[
+            unrelated.der().clone(),
+            intermediate.der().clone(),
+            issuing_intermediate.der().clone(),
+        ];
+        assert_eq!(
+            verify(&ee_cert, intermediates, trust_anchors, DISTRUSTED_SPKIS),
+            Ok(2)
+        );
+
+        // Distrusting any certificate in the path, including the root or leaf, rejects the chain.
+        for cert in [
+            root.der(),
+            issuing_intermediate.der(),
+            intermediate.der(),
+            ee.cert.der(),
+        ] {
+            assert_eq!(
+                verify(
+                    &ee_cert,
+                    intermediates,
+                    trust_anchors,
+                    &[anchor_from_trusted_cert(cert)
+                        .unwrap()
+                        .subject_public_key_info
+                        .as_ref()]
+                ),
+                Err(Error::CertDistrusted)
+            );
+        }
+
+        // Distrusting an unused intermediate leaves the valid path usable.
+        assert_eq!(
+            verify(
+                &ee_cert,
+                intermediates,
+                trust_anchors,
+                &[anchor_from_trusted_cert(unrelated.der())
+                    .unwrap()
+                    .subject_public_key_info
+                    .as_ref()]
+            ),
+            Ok(2)
+        );
+
+        // A different cross-sign provides a valid path around the distrusted issuer.
+        let intermediates = &[
+            intermediate.der().clone(),
+            issuing_intermediate.der().clone(),
+            cross_signed.der().clone(),
+        ];
+        let issuer_spki = anchor_from_trusted_cert(issuing_intermediate.der()).unwrap();
+        assert_eq!(
+            verify(
+                &ee_cert,
+                intermediates,
+                trust_anchors,
+                &[issuer_spki.subject_public_key_info.as_ref()]
+            ),
+            Ok(1)
+        );
+
+        // Distrusting the shared SPKI rejects the original certificate and its cross-sign.
+        let intermediate_spki = anchor_from_trusted_cert(intermediate.der()).unwrap();
+        assert_eq!(
+            verify(
+                &ee_cert,
+                intermediates,
+                trust_anchors,
+                &[intermediate_spki.subject_public_key_info.as_ref()]
+            ),
+            Err(Error::CertDistrusted)
+        );
+
+        // Reject a distrusted intermediate before searching for its issuer.
+        assert_eq!(
+            verify(
+                &ee_cert,
+                &[intermediate.der().clone()],
+                &[],
+                &[intermediate_spki.subject_public_key_info.as_ref()]
+            ),
+            Err(Error::CertDistrusted)
+        );
+    }
+
     fn make_intermediate(
         org_name: impl Into<String>,
         issuer: &Issuer<'_, impl SigningKey>,
@@ -1357,6 +1506,7 @@ mod tests {
             trust_anchors,
             intermediate_certs,
             revocation: None,
+            distrusted_spkis: DISTRUSTED_SPKIS,
         };
 
         match opts.build_chain_inner(