001/*
002 * Copyright 2015-2020 the original author or authors
003 *
004 * This software is licensed under the Apache License, Version 2.0,
005 * the GNU Lesser General Public License version 2 or later ("LGPL")
006 * and the WTFPL.
007 * You may choose either license to govern your use of this software only
008 * upon the condition that you accept all of the terms of either
009 * the Apache License 2.0, the LGPL 2.1+ or the WTFPL.
010 */
011package org.minidns.dane;
012
013import org.minidns.dnsmessage.DnsMessage;
014import org.minidns.dnsname.DnsName;
015import org.minidns.dnssec.DnssecClient;
016import org.minidns.dnssec.DnssecQueryResult;
017import org.minidns.dnssec.DnssecUnverifiedReason;
018import org.minidns.record.Data;
019import org.minidns.record.Record;
020import org.minidns.record.TLSA;
021
022import javax.net.ssl.HttpsURLConnection;
023import javax.net.ssl.SSLContext;
024import javax.net.ssl.SSLPeerUnverifiedException;
025import javax.net.ssl.SSLSession;
026import javax.net.ssl.SSLSocket;
027import javax.net.ssl.TrustManager;
028import javax.net.ssl.X509TrustManager;
029
030import java.io.IOException;
031import java.security.KeyManagementException;
032import java.security.MessageDigest;
033import java.security.NoSuchAlgorithmException;
034import java.security.cert.Certificate;
035import java.security.cert.CertificateException;
036import java.security.cert.X509Certificate;
037import java.util.ArrayList;
038import java.util.LinkedList;
039import java.util.List;
040import java.util.logging.Logger;
041
042/**
043 * A helper class to validate the usage of TLSA records.
044 */
045public class DaneVerifier {
046    private static final Logger LOGGER = Logger.getLogger(DaneVerifier.class.getName());
047
048    private final DnssecClient client;
049
050    public DaneVerifier() {
051        this(new DnssecClient());
052    }
053
054    public DaneVerifier(DnssecClient client) {
055        this.client = client;
056    }
057
058    /**
059     * Verifies the certificate chain in an active {@link SSLSocket}. The socket must be connected.
060     *
061     * @param socket A connected {@link SSLSocket} whose certificate chain shall be verified using DANE.
062     * @return Whether the DANE verification is the only requirement according to the TLSA record.
063     * If this method returns {@code false}, additional PKIX validation is required.
064     * @throws CertificateException if the certificate chain provided differs from the one enforced using DANE.
065     */
066    public boolean verify(SSLSocket socket) throws CertificateException {
067        if (!socket.isConnected()) {
068            throw new IllegalStateException("Socket not yet connected.");
069        }
070        return verify(socket.getSession());
071    }
072
073    /**
074     * Verifies the certificate chain in an active {@link SSLSession}.
075     *
076     * @param session An active {@link SSLSession} whose certificate chain shall be verified using DANE.
077     * @return Whether the DANE verification is the only requirement according to the TLSA record.
078     * If this method returns {@code false}, additional PKIX validation is required.
079     * @throws CertificateException if the certificate chain provided differs from the one enforced using DANE.
080     */
081    public boolean verify(SSLSession session) throws CertificateException {
082        try {
083            return verifyCertificateChain(convert(session.getPeerCertificates()), session.getPeerHost(), session.getPeerPort());
084        } catch (SSLPeerUnverifiedException e) {
085            throw new CertificateException("Peer not verified", e);
086        }
087    }
088
089    /**
090     * Verifies a certificate chain to be valid when used with the given connection details using DANE.
091     *
092     * @param chain A certificate chain that should be verified using DANE.
093     * @param hostName The DNS name of the host this certificate chain belongs to.
094     * @param port The port number that was used to reach the server providing the certificate chain in question.
095     * @return Whether the DANE verification is the only requirement according to the TLSA record.
096     * If this method returns {@code false}, additional PKIX validation is required.
097     * @throws CertificateException if the certificate chain provided differs from the one enforced using DANE.
098     */
099    public boolean verifyCertificateChain(X509Certificate[] chain, String hostName, int port) throws CertificateException {
100        DnsName req = DnsName.from("_" + port + "._tcp." + hostName);
101        DnssecQueryResult result;
102        try {
103            result = client.queryDnssec(req, Record.TYPE.TLSA);
104        } catch (IOException e) {
105            throw new RuntimeException(e);
106        }
107        DnsMessage res = result.dnsQueryResult.response;
108        // TODO: We previously used the AD bit here. This allowed non-DNSSEC aware clients to be plugged into
109        // DaneVerifier, which, in turn, allows to use a trusted forward as DNSSEC validator. Is this a good idea?
110        if (!result.isAuthenticData()) {
111            String msg = "Got TLSA response from DNS server, but was not signed properly.";
112            msg += " Reasons:";
113            for (DnssecUnverifiedReason reason : result.getUnverifiedReasons()) {
114                 msg += " " + reason;
115            }
116            LOGGER.info(msg);
117            return false;
118        }
119
120        List<DaneCertificateException.CertificateMismatch> certificateMismatchExceptions = new LinkedList<>();
121        boolean verified = false;
122        for (Record<? extends Data> record : res.answerSection) {
123            if (record.type == Record.TYPE.TLSA && record.name.equals(req)) {
124                TLSA tlsa = (TLSA) record.payloadData;
125                try {
126                    verified |= checkCertificateMatches(chain[0], tlsa, hostName);
127                } catch (DaneCertificateException.CertificateMismatch certificateMismatchException) {
128                    // Record the mismatch and only throw an exception if no
129                    // TLSA RR is able to verify the cert. This allows for TLSA
130                    // certificate rollover.
131                    certificateMismatchExceptions.add(certificateMismatchException);
132                }
133                if (verified) break;
134            }
135        }
136
137        if (!verified && !certificateMismatchExceptions.isEmpty()) {
138            throw new DaneCertificateException.MultipleCertificateMismatchExceptions(certificateMismatchExceptions);
139        }
140
141        return verified;
142    }
143
144    private static boolean checkCertificateMatches(X509Certificate cert, TLSA tlsa, String hostName) throws CertificateException {
145        if (tlsa.certUsage == null) {
146            LOGGER.warning("TLSA certificate usage byte " + tlsa.certUsageByte + " is not supported while verifying " + hostName);
147            return false;
148        }
149
150        switch (tlsa.certUsage) {
151        case serviceCertificateConstraint:
152        case domainIssuedCertificate:
153            break;
154        case caConstraint:
155        case trustAnchorAssertion:
156        default:
157            LOGGER.warning("TLSA certificate usage " + tlsa.certUsage + " (" + tlsa.certUsageByte + ") not supported while verifying " + hostName);
158            return false;
159        }
160
161        if (tlsa.selector == null) {
162            LOGGER.warning("TLSA selector byte " + tlsa.selectorByte + " is not supported while verifying " + hostName);
163            return false;
164        }
165
166        byte[] comp = null;
167        switch (tlsa.selector) {
168            case fullCertificate:
169                comp = cert.getEncoded();
170                break;
171            case subjectPublicKeyInfo:
172                comp = cert.getPublicKey().getEncoded();
173                break;
174            default:
175                LOGGER.warning("TLSA selector " + tlsa.selector + " (" + tlsa.selectorByte + ") not supported while verifying " + hostName);
176                return false;
177        }
178
179        if (tlsa.matchingType == null) {
180            LOGGER.warning("TLSA matching type byte " + tlsa.matchingTypeByte + " is not supported while verifying " + hostName);
181            return false;
182        }
183
184        switch (tlsa.matchingType) {
185            case noHash:
186                break;
187            case sha256:
188                try {
189                    comp = MessageDigest.getInstance("SHA-256").digest(comp);
190                } catch (NoSuchAlgorithmException e) {
191                    throw new CertificateException("Verification using TLSA failed: could not SHA-256 for matching", e);
192                }
193                break;
194            case sha512:
195                try {
196                    comp = MessageDigest.getInstance("SHA-512").digest(comp);
197                } catch (NoSuchAlgorithmException e) {
198                    throw new CertificateException("Verification using TLSA failed: could not SHA-512 for matching", e);
199                }
200                break;
201            default:
202                LOGGER.warning("TLSA matching type " + tlsa.matchingType + " not supported while verifying " + hostName);
203                return false;
204        }
205
206        boolean matches = tlsa.certificateAssociationEquals(comp);
207        if (!matches) {
208            throw new DaneCertificateException.CertificateMismatch(tlsa, comp);
209        }
210
211        // domain issued certificate does not require further verification,
212        // service certificate constraint does.
213        return tlsa.certUsage == TLSA.CertUsage.domainIssuedCertificate;
214    }
215
216    /**
217     * Invokes {@link HttpsURLConnection#connect()} in a DANE verified fashion.
218     * This method must be called before {@link HttpsURLConnection#connect()} is invoked.
219     *
220     * If a SSLSocketFactory was set on this HttpsURLConnection, it will be ignored. You can use
221     * {@link #verifiedConnect(HttpsURLConnection, X509TrustManager)} to inject a custom {@link TrustManager}.
222     *
223     * @param conn connection to be connected.
224     * @return The {@link HttpsURLConnection} after being connected.
225     * @throws IOException when the connection could not be established.
226     * @throws CertificateException if there was an exception while verifying the certificate.
227     */
228    public HttpsURLConnection verifiedConnect(HttpsURLConnection conn) throws IOException, CertificateException {
229        return verifiedConnect(conn, null);
230    }
231
232    /**
233     * Invokes {@link HttpsURLConnection#connect()} in a DANE verified fashion.
234     * This method must be called before {@link HttpsURLConnection#connect()} is invoked.
235     *
236     * If a SSLSocketFactory was set on this HttpsURLConnection, it will be ignored.
237     *
238     * @param conn         connection to be connected.
239     * @param trustManager A non-default {@link TrustManager} to be used.
240     * @return The {@link HttpsURLConnection} after being connected.
241     * @throws IOException when the connection could not be established.
242     * @throws CertificateException if there was an exception while verifying the certificate.
243     */
244    public HttpsURLConnection verifiedConnect(HttpsURLConnection conn, X509TrustManager trustManager) throws IOException, CertificateException {
245        try {
246            SSLContext context = SSLContext.getInstance("TLS");
247            ExpectingTrustManager expectingTrustManager = new ExpectingTrustManager(trustManager);
248            context.init(null, new TrustManager[] {expectingTrustManager}, null);
249            conn.setSSLSocketFactory(context.getSocketFactory());
250            conn.connect();
251            boolean fullyVerified = verifyCertificateChain(convert(conn.getServerCertificates()), conn.getURL().getHost(),
252                    conn.getURL().getPort() < 0 ? conn.getURL().getDefaultPort() : conn.getURL().getPort());
253            // If fullyVerified is true then it's the DANE verification performed by verifiyCertificateChain() is
254            // sufficient to verify the certificate and we ignore possible pending exceptions of ExpectingTrustManager.
255            if (!fullyVerified && expectingTrustManager.hasException()) {
256                throw new IOException("Peer verification failed using PKIX", expectingTrustManager.getException());
257            }
258            return conn;
259        } catch (NoSuchAlgorithmException | KeyManagementException e) {
260            throw new RuntimeException(e);
261        }
262    }
263
264    private static X509Certificate[] convert(Certificate[] certificates) {
265        List<X509Certificate> certs = new ArrayList<>();
266        for (Certificate certificate : certificates) {
267            if (certificate instanceof X509Certificate) {
268                certs.add((X509Certificate) certificate);
269            }
270        }
271        return certs.toArray(new X509Certificate[certs.size()]);
272    }
273}