ssl_seclevel.c revision 1.10 
1/*	$OpenBSD: ssl_seclevel.c,v 1.10 2022/06/29 21:19:21 tb Exp $ */
2/*
3 * Copyright (c) 2020 Theo Buehler <tb@openbsd.org>
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#include <stddef.h>
19
20#include <openssl/asn1.h>
21#include <openssl/dh.h>
22#include <openssl/evp.h>
23#include <openssl/obj_mac.h>
24#include <openssl/objects.h>
25#include <openssl/ossl_typ.h>
26#include <openssl/ssl.h>
27#include <openssl/tls1.h>
28#include <openssl/x509.h>
29#include <openssl/x509v3.h>
30
31#include "ssl_locl.h"
32
33static int
34ssl_security_normalize_level(const SSL_CTX *ctx, const SSL *ssl, int *out_level)
35{
36	int security_level;
37
38	if (ctx != NULL)
39		security_level = SSL_CTX_get_security_level(ctx);
40	else
41		security_level = SSL_get_security_level(ssl);
42
43	if (security_level < 0)
44		security_level = 0;
45	if (security_level > 5)
46		security_level = 5;
47
48	*out_level = security_level;
49
50	return 1;
51}
52
53static int
54ssl_security_level_to_minimum_bits(int security_level, int *out_minimum_bits)
55{
56	if (security_level < 0)
57		return 0;
58
59	if (security_level == 0)
60		*out_minimum_bits = 0;
61	else if (security_level == 1)
62		*out_minimum_bits = 80;
63	else if (security_level == 2)
64		*out_minimum_bits = 112;
65	else if (security_level == 3)
66		*out_minimum_bits = 128;
67	else if (security_level == 4)
68		*out_minimum_bits = 192;
69	else if (security_level >= 5)
70		*out_minimum_bits = 256;
71
72	return 1;
73}
74
75static int
76ssl_security_level_and_minimum_bits(const SSL_CTX *ctx, const SSL *ssl,
77    int *out_level, int *out_minimum_bits)
78{
79	int security_level = 0, minimum_bits = 0;
80
81	if (!ssl_security_normalize_level(ctx, ssl, &security_level))
82		return 0;
83	if (!ssl_security_level_to_minimum_bits(security_level, &minimum_bits))
84		return 0;
85
86	if (out_level != NULL)
87		*out_level = security_level;
88	if (out_minimum_bits != NULL)
89		*out_minimum_bits = minimum_bits;
90
91	return 1;
92}
93
94static int
95ssl_security_secop_cipher(const SSL_CTX *ctx, const SSL *ssl, int bits,
96    void *arg)
97{
98	const SSL_CIPHER *cipher = arg;
99	int security_level, minimum_bits;
100
101	if (!ssl_security_level_and_minimum_bits(ctx, ssl, &security_level,
102	    &minimum_bits))
103		return 0;
104
105	if (security_level <= 0)
106		return 1;
107
108	if (bits < minimum_bits)
109		return 0;
110
111	/* No unauthenticated ciphersuites. */
112	if (cipher->algorithm_auth & SSL_aNULL)
113		return 0;
114
115	if (security_level <= 1)
116		return 1;
117
118	if (cipher->algorithm_enc == SSL_RC4)
119		return 0;
120
121	if (security_level <= 2)
122		return 1;
123
124	/* Security level >= 3 requires a cipher with forward secrecy. */
125	if ((cipher->algorithm_mkey & (SSL_kDHE | SSL_kECDHE)) == 0 &&
126	    cipher->algorithm_ssl != SSL_TLSV1_3)
127		return 0;
128
129	return 1;
130}
131
132static int
133ssl_security_secop_version(const SSL_CTX *ctx, const SSL *ssl, int version)
134{
135	int min_version = TLS1_2_VERSION;
136	int security_level;
137
138	if (!ssl_security_level_and_minimum_bits(ctx, ssl, &security_level, NULL))
139		return 0;
140
141	if (security_level < 4)
142		min_version = TLS1_1_VERSION;
143	if (security_level < 3)
144		min_version = TLS1_VERSION;
145
146	return ssl_tls_version(version) >= min_version;
147}
148
149static int
150ssl_security_secop_compression(const SSL_CTX *ctx, const SSL *ssl)
151{
152	return 0;
153}
154
155static int
156ssl_security_secop_tickets(const SSL_CTX *ctx, const SSL *ssl)
157{
158	int security_level;
159
160	if (!ssl_security_level_and_minimum_bits(ctx, ssl, &security_level, NULL))
161		return 0;
162
163	return security_level < 3;
164}
165
166static int
167ssl_security_secop_tmp_dh(const SSL_CTX *ctx, const SSL *ssl, int bits)
168{
169	int security_level, minimum_bits;
170
171	if (!ssl_security_level_and_minimum_bits(ctx, ssl, &security_level,
172	    &minimum_bits))
173		return 0;
174
175	/* Disallow DHE keys weaker than 1024 bits even at security level 0. */
176	if (security_level <= 0 && bits < 80)
177		return 0;
178
179	return bits >= minimum_bits;
180}
181
182static int
183ssl_security_secop_default(const SSL_CTX *ctx, const SSL *ssl, int bits)
184{
185	int minimum_bits;
186
187	if (!ssl_security_level_and_minimum_bits(ctx, ssl, NULL, &minimum_bits))
188		return 0;
189
190	return bits >= minimum_bits;
191}
192
193int
194ssl_security_default_cb(const SSL *ssl, const SSL_CTX *ctx, int op, int bits,
195    int version, void *cipher, void *ex_data)
196{
197	switch (op) {
198	case SSL_SECOP_CIPHER_SUPPORTED:
199	case SSL_SECOP_CIPHER_SHARED:
200	case SSL_SECOP_CIPHER_CHECK:
201		return ssl_security_secop_cipher(ctx, ssl, bits, cipher);
202	case SSL_SECOP_VERSION:
203		return ssl_security_secop_version(ctx, ssl, version);
204	case SSL_SECOP_COMPRESSION:
205		return ssl_security_secop_compression(ctx, ssl);
206	case SSL_SECOP_TICKET:
207		return ssl_security_secop_tickets(ctx, ssl);
208	case SSL_SECOP_TMP_DH:
209		return ssl_security_secop_tmp_dh(ctx, ssl, bits);
210	default:
211		return ssl_security_secop_default(ctx, ssl, bits);
212	}
213}
214
215int
216ssl_security_dummy_cb(const SSL *ssl, const SSL_CTX *ctx, int op, int bits,
217    int version, void *cipher, void *ex_data)
218{
219	return 1;
220}
221
222int
223ssl_ctx_security(const SSL_CTX *ctx, int op, int bits, int nid, void *other)
224{
225	return ctx->internal->cert->security_cb(NULL, ctx, op, bits, nid, other,
226	    ctx->internal->cert->security_ex_data);
227}
228
229int
230ssl_security(const SSL *ssl, int op, int bits, int nid, void *other)
231{
232	return ssl->cert->security_cb(ssl, NULL, op, bits, nid, other,
233	    ssl->cert->security_ex_data);
234}
235
236int
237ssl_ctx_security_dh(const SSL_CTX *ctx, DH *dh)
238{
239#if defined(LIBRESSL_HAS_SECURITY_LEVEL)
240	return ssl_ctx_security(ctx, SSL_SECOP_TMP_DH, DH_security_bits(dh), 0,
241	    dh);
242#else
243	return 1;
244#endif
245}
246
247int
248ssl_security_dh(const SSL *ssl, DH *dh)
249{
250#if defined(LIBRESSL_HAS_SECURITY_LEVEL)
251	return ssl_security(ssl, SSL_SECOP_TMP_DH, DH_security_bits(dh), 0, dh);
252#else
253	return 1;
254#endif
255}
256
257#if defined(LIBRESSL_HAS_SECURITY_LEVEL)
258static int
259ssl_cert_pubkey_security_bits(const X509 *x509)
260{
261	EVP_PKEY *pkey;
262
263	if ((pkey = X509_get0_pubkey(x509)) == NULL)
264		return -1;
265
266	/*
267	 * XXX: DSA_security_bits() returns -1 on keys without parameters and
268	 * cause the default security callback to fail.
269	 */
270
271	return EVP_PKEY_security_bits(pkey);
272}
273
274static int
275ssl_security_cert_key(const SSL_CTX *ctx, const SSL *ssl, X509 *x509, int op)
276{
277	int security_bits;
278
279	security_bits = ssl_cert_pubkey_security_bits(x509);
280
281	if (ssl != NULL)
282		return ssl_security(ssl, op, security_bits, 0, x509);
283
284	return ssl_ctx_security(ctx, op, security_bits, 0, x509);
285}
286
287static int
288ssl_cert_signature_md_nid(X509 *x509)
289{
290	int md_nid, signature_nid;
291
292	if ((signature_nid = X509_get_signature_nid(x509)) == NID_undef)
293		return NID_undef;
294
295	if (!OBJ_find_sigid_algs(signature_nid, &md_nid, NULL))
296		return NID_undef;
297
298	return md_nid;
299}
300
301static int
302ssl_cert_md_nid_security_bits(int md_nid)
303{
304	const EVP_MD *md;
305
306	if (md_nid == NID_undef)
307		return -1;
308
309	if ((md = EVP_get_digestbynid(md_nid)) == NULL)
310		return -1;
311
312	/* Assume 4 bits of collision resistance for each hash octet. */
313	return EVP_MD_size(md) * 4;
314}
315
316static int
317ssl_security_cert_sig(const SSL_CTX *ctx, const SSL *ssl, X509 *x509, int op)
318{
319	int md_nid, security_bits;
320
321	/* Don't check signature if self signed. */
322	if ((X509_get_extension_flags(x509) & EXFLAG_SS) != 0)
323		return 1;
324
325	md_nid = ssl_cert_signature_md_nid(x509);
326	security_bits = ssl_cert_md_nid_security_bits(md_nid);
327
328	if (ssl != NULL)
329		return ssl_security(ssl, op, security_bits, md_nid, x509);
330
331	return ssl_ctx_security(ctx, op, security_bits, md_nid, x509);
332}
333#endif
334
335int
336ssl_security_cert(const SSL_CTX *ctx, const SSL *ssl, X509 *x509,
337    int is_ee, int *out_error)
338{
339#if defined(LIBRESSL_HAS_SECURITY_LEVEL)
340	int key_error, operation;
341
342	*out_error = 0;
343
344	if (is_ee) {
345		operation = SSL_SECOP_EE_KEY;
346		key_error = SSL_R_EE_KEY_TOO_SMALL;
347	} else {
348		operation = SSL_SECOP_CA_KEY;
349		key_error = SSL_R_CA_KEY_TOO_SMALL;
350	}
351
352	if (!ssl_security_cert_key(ctx, ssl, x509, operation)) {
353		*out_error = key_error;
354		return 0;
355	}
356
357	if (!ssl_security_cert_sig(ctx, ssl, x509, SSL_SECOP_CA_MD)) {
358		*out_error = SSL_R_CA_MD_TOO_WEAK;
359		return 0;
360	}
361
362#endif
363	return 1;
364}
365
366/*
367 * Check security of a chain. If |sk| includes the end entity certificate
368 * then |x509| must be NULL.
369 */
370int
371ssl_security_cert_chain(const SSL *ssl, STACK_OF(X509) *sk, X509 *x509,
372    int *out_error)
373{
374	int start_idx = 0;
375	int is_ee;
376	int i;
377
378	if (x509 == NULL) {
379		x509 = sk_X509_value(sk, 0);
380		start_idx = 1;
381	}
382
383	if (!ssl_security_cert(NULL, ssl, x509, is_ee = 1, out_error))
384		return 0;
385
386	for (i = start_idx; i < sk_X509_num(sk); i++) {
387		x509 = sk_X509_value(sk, i);
388
389		if (!ssl_security_cert(NULL, ssl, x509, is_ee = 0,
390		    out_error))
391			return 0;
392	}
393
394	return 1;
395}
396