From 66c05083bf71585d45289d18b2ca93f72296f5d5 Mon Sep 17 00:00:00 2001 From: Sun Yimin Date: Wed, 6 Mar 2024 13:02:56 +0800 Subject: [PATCH] smx509: implement SetFallbackRoots #211 --- smx509/parser.go | 6 +-- smx509/root.go | 47 ++++++++++++++++++- smx509/root_test.go | 108 ++++++++++++++++++++++++++++++++++++++++++++ smx509/verify.go | 5 +- 4 files changed, 161 insertions(+), 5 deletions(-) create mode 100644 smx509/root_test.go diff --git a/smx509/parser.go b/smx509/parser.go index 57e3b51..1cb25a4 100644 --- a/smx509/parser.go +++ b/smx509/parser.go @@ -376,17 +376,17 @@ func parseKeyUsageExtension(der cryptobyte.String) (KeyUsage, error) { func parseBasicConstraintsExtension(der cryptobyte.String) (bool, int, error) { var isCA bool if !der.ReadASN1(&der, cryptobyte_asn1.SEQUENCE) { - return false, 0, errors.New("x509: invalid basic constraints a") + return false, 0, errors.New("x509: invalid basic constraints") } if der.PeekASN1Tag(cryptobyte_asn1.BOOLEAN) { if !der.ReadASN1Boolean(&isCA) { - return false, 0, errors.New("x509: invalid basic constraints b") + return false, 0, errors.New("x509: invalid basic constraints") } } maxPathLen := -1 if der.PeekASN1Tag(cryptobyte_asn1.INTEGER) { if !der.ReadASN1Integer(&maxPathLen) { - return false, 0, errors.New("x509: invalid basic constraints c") + return false, 0, errors.New("x509: invalid basic constraints") } } diff --git a/smx509/root.go b/smx509/root.go index 743dfb0..97725ec 100644 --- a/smx509/root.go +++ b/smx509/root.go @@ -1,21 +1,66 @@ package smx509 -import "sync" +import ( + "sync" + + "github.com/emmansun/gmsm/internal/godebug" +) var ( once sync.Once + systemRootsMu sync.RWMutex systemRoots *CertPool systemRootsErr error + fallbacksSet bool ) func systemRootsPool() *CertPool { once.Do(initSystemRoots) + systemRootsMu.RLock() + defer systemRootsMu.RUnlock() return systemRoots } func initSystemRoots() { + systemRootsMu.Lock() + defer systemRootsMu.Unlock() systemRoots, systemRootsErr = loadSystemRoots() if systemRootsErr != nil { systemRoots = nil } } + +// SetFallbackRoots sets the roots to use during certificate verification, if no +// custom roots are specified and a platform verifier or a system certificate +// pool is not available (for instance in a container which does not have a root +// certificate bundle). SetFallbackRoots will panic if roots is nil. +// +// SetFallbackRoots may only be called once, if called multiple times it will +// panic. +// +// The fallback behavior can be forced on all platforms, even when there is a +// system certificate pool, by setting GODEBUG=x509usefallbackroots=1 (note that +// on Windows and macOS this will disable usage of the platform verification +// APIs and cause the pure Go verifier to be used). Setting +// x509usefallbackroots=1 without calling SetFallbackRoots has no effect. +func SetFallbackRoots(roots *CertPool) { + if roots == nil { + panic("roots must be non-nil") + } + + // trigger initSystemRoots if it hasn't already been called before we + // take the lock + _ = systemRootsPool() + + systemRootsMu.Lock() + defer systemRootsMu.Unlock() + + if fallbacksSet { + panic("SetFallbackRoots has already been called") + } + fallbacksSet = true + if systemRoots != nil && (systemRoots.len() > 0 || systemRoots.systemPool) && (godebug.Get("x509usefallbackroots") != "1") { + return + } + systemRoots, systemRootsErr = roots, nil +} diff --git a/smx509/root_test.go b/smx509/root_test.go new file mode 100644 index 0000000..f954645 --- /dev/null +++ b/smx509/root_test.go @@ -0,0 +1,108 @@ +// Copyright 2022 The Go Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +package smx509 + +import ( + "testing" +) + +func TestFallbackPanic(t *testing.T) { + defer func() { + if recover() == nil { + t.Fatal("Multiple calls to SetFallbackRoots should panic") + } + }() + SetFallbackRoots(nil) + SetFallbackRoots(nil) +} + +func TestFallback(t *testing.T) { + // call systemRootsPool so that the sync.Once is triggered, and we can + // manipulate systemRoots without worrying about our working being overwritten + systemRootsPool() + if systemRoots != nil { + originalSystemRoots := *systemRoots + defer func() { systemRoots = &originalSystemRoots }() + } + + tests := []struct { + name string + systemRoots *CertPool + systemPool bool + poolContent []*Certificate + forceFallback bool + returnsFallback bool + }{ + { + name: "nil systemRoots", + returnsFallback: true, + }, + { + name: "empty systemRoots", + systemRoots: NewCertPool(), + returnsFallback: true, + }, + { + name: "empty systemRoots system pool", + systemRoots: NewCertPool(), + systemPool: true, + }, + { + name: "filled systemRoots system pool", + systemRoots: NewCertPool(), + poolContent: []*Certificate{{}}, + systemPool: true, + }, + { + name: "filled systemRoots", + systemRoots: NewCertPool(), + poolContent: []*Certificate{{}}, + }, + { + name: "filled systemRoots, force fallback", + systemRoots: NewCertPool(), + poolContent: []*Certificate{{}}, + forceFallback: true, + returnsFallback: true, + }, + { + name: "filled systemRoot system pool, force fallback", + systemRoots: NewCertPool(), + poolContent: []*Certificate{{}}, + systemPool: true, + forceFallback: true, + returnsFallback: true, + }, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + fallbacksSet = false + systemRoots = tc.systemRoots + if systemRoots != nil { + systemRoots.systemPool = tc.systemPool + } + for _, c := range tc.poolContent { + systemRoots.AddCert(c) + } + if tc.forceFallback { + t.Setenv("GODEBUG", "x509usefallbackroots=1") + } else { + t.Setenv("GODEBUG", "x509usefallbackroots=0") + } + + fallbackPool := NewCertPool() + SetFallbackRoots(fallbackPool) + + systemPoolIsFallback := systemRoots == fallbackPool + + if tc.returnsFallback && !systemPoolIsFallback { + t.Error("systemRoots was not set to fallback pool") + } else if !tc.returnsFallback && systemPoolIsFallback { + t.Error("systemRoots was set to fallback pool when it shouldn't have been") + } + }) + } +} diff --git a/smx509/verify.go b/smx509/verify.go index 84fada9..fdc1b68 100644 --- a/smx509/verify.go +++ b/smx509/verify.go @@ -643,7 +643,10 @@ func (c *Certificate) Verify(opts VerifyOptions) (chains [][]*Certificate, err e // Use platform verifiers, where available, if Roots is from SystemCertPool. if runtime.GOOS == "windows" { - if opts.Roots == nil { + // Don't use the system verifier if the system pool was replaced with a non-system pool, + // i.e. if SetFallbackRoots was called with x509usefallbackroots=1. + systemPool := systemRootsPool() + if opts.Roots == nil && (systemPool == nil || systemPool.systemPool) { return c.systemVerify(&opts) } if opts.Roots != nil && opts.Roots.systemPool {