@blamejs/pki 0.6.0 → 0.6.2

package/lib/path-validate.js

@@ -33,6 +33,7 @@
 var webcrypto = require("./webcrypto");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
+var ct = require("./ct");
 var errors = require("./framework-error");
 var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
@@ -1278,17 +1279,73 @@ function validateCriticalExtensionStructure(cert) {
 // inputs appear together. A grep of one function would have shipped a list missing four real
 // options and rejected callers that work today.
 var _VALIDATE_OPTS = {
-  checkPurpose: 1, historicalMode: 1, initialAnyPolicyInhibit: 1, initialExcludedSubtrees: 1,
-  initialExplicitPolicy: 1, initialPermittedSubtrees: 1, initialPolicyMappingInhibit: 1,
-  maxPathCerts: 1, maxPolicyNodes: 1, requireRevocation: 1, requiredEku: 1, revocationChecker: 1,
-  softFail: 1, time: 1, trustAnchor: 1, userInitialPolicySet: 1, verifier: 1
+  checkPurpose: 1, ctLogList: 1, ctPolicy: 1, historicalMode: 1, initialAnyPolicyInhibit: 1,
+  initialExcludedSubtrees: 1, initialExplicitPolicy: 1, initialPermittedSubtrees: 1,
+  initialPolicyMappingInhibit: 1, maxPathCerts: 1, maxPolicyNodes: 1, requireRevocation: 1,
+  requiredEku: 1, revocationChecker: 1, softFail: 1, time: 1, trustAnchor: 1,
+  userInitialPolicySet: 1, verifier: 1
 };
 
+// The opt-in Certificate Transparency gate (RFC 6962). When opts.ctLogList is supplied, the target's
+// embedded SCTs are verified against the trusted log-list and the caller's CT policy, and the verdict is
+// recorded on the target's checks. Fail-closed: a target that declares a CT policy but carries no
+// SCT-list extension is refused. Reached only through opts.ctLogList, so every existing caller is
+// unaffected. The SCT-list extension OID is looked up through the shared registry, never a literal.
+var OID_SCT_LIST = oid.byName("signedCertificateTimestampList");
+async function ctGateCheck(leaf, certs, anchor, ctLogList, ctPolicy, n, at) {
+  var exts = leaf.extensions || [], sctExt = null;
+  for (var i = 0; i < exts.length; i++) {
+    if (exts[i] && (exts[i].oid === OID_SCT_LIST || exts[i].name === "signedCertificateTimestampList")) { sctExt = exts[i]; break; }
+  }
+  if (sctExt == null) return { name: "ct", ok: false, code: "path/ct-required" };
+  // The leaf's issuer contributes issuerKeyHash: the certificate that signed it (certs[n-2] in the
+  // anchor->target order), or the anchor itself when the target is validated directly beneath it.
+  var issuer = n >= 2 ? certs[n - 2] : { subjectPublicKeyInfo: { bytes: anchor.publicKey } };
+  var entry, list;
+  try {
+    entry = ct.x509CertEntry(leaf, issuer);
+    list = ct.parseSctList(sctExt.value);
+  } catch (e) {
+    return { name: "ct", ok: false, code: pathCode(e, "path/ct-required") };
+  }
+  // verifySctList throws only for a mis-shaped caller configuration (a bad ctPolicy threshold value, a
+  // ctLogList that is not a parseLogList result): that is the caller's error, surfaced at the path
+  // boundary as path/bad-input rather than leaking the ct/* domain code of a layer they did not call.
+  // verifySctList throws only for a mis-shaped caller configuration (a bad ctPolicy threshold value, a
+  // ctLogList that is not a parseLogList result): that is the caller's error, surfaced at the path
+  // boundary as path/bad-input rather than leaking the ct/* domain code of a layer they did not call.
+  var verdict;
+  try {
+    verdict = await ct.verifySctList(entry, list, ctLogList,
+      { minScts: ctPolicy.minScts, minOperators: ctPolicy.minOperators, certNotAfter: leaf.validity.notAfter, at: at });
+  } catch (e) {
+    if (e && e.isPkiError) throw E("path/bad-input", "validate: the CT policy or log-list is invalid (" + (e.code || "ct/bad-input") + "): " + e.message);
+    throw e;
+  }
+  return { name: "ct", ok: verdict.policyOk === true, code: verdict.policyOk ? undefined : "path/ct-policy-not-met" };
+}
+
 async function validate(path, opts) {
   opts = guard.identifier.optionsObject(opts, E, "path/bad-input", "validate: opts");
   guard.identifier.assertKnownKeys(opts, _VALIDATE_OPTS, E, "path/bad-input",
     "pki.path.validate has an unknown option. The anchor here is `trustAnchor`, singular; " +
     "pki.path.build takes `trustAnchors`. The unknown option was: ");
+  // A CT policy without a log-list cannot be enforced -- refuse it at entry rather than silently
+  // skipping the CT gate and returning a valid path the caller believes was CT-checked (fail-closed).
+  if (opts.ctPolicy != null && opts.ctLogList == null) throw E("path/bad-input", "validate: opts.ctPolicy requires opts.ctLogList (the trusted CT log-list to verify the certificate's SCTs against)");
+  // Validate the CT policy's KEYS at entry: a misspelled key (e.g. `minSCTs`) would otherwise read as
+  // undefined and silently default to the RFC floor of 1, applying a weaker policy than the caller asked
+  // for. The values are validated by verifySctList when the gate runs.
+  // Validate the whole CT configuration at entry, independent of whether the target carries an SCT
+  // extension, so a malformed policy or log-list is always path/bad-input -- never masked as a
+  // per-certificate path/ct-required just because the target happens to lack SCTs.
+  if (opts.ctLogList != null) {
+    if (typeof opts.ctLogList !== "object" || opts.ctLogList.byLogId == null) throw E("path/bad-input", "validate: opts.ctLogList must be a pki.ct.parseLogList result");
+    var ctp = guard.identifier.optionsObject(opts.ctPolicy, E, "path/bad-input", "validate: opts.ctPolicy");
+    guard.identifier.assertKnownKeys(ctp, { minScts: 1, minOperators: 1 }, E, "path/bad-input", "validate: opts.ctPolicy has an unknown key (the CT policy keys are minScts / minOperators): ");
+    if (ctp.minScts != null && (typeof ctp.minScts !== "number" || !intrinsic.isInteger(ctp.minScts) || ctp.minScts < 1)) throw E("path/bad-input", "validate: opts.ctPolicy.minScts must be a positive integer");
+    if (ctp.minOperators != null && (typeof ctp.minOperators !== "number" || !intrinsic.isInteger(ctp.minOperators) || ctp.minOperators < 1)) throw E("path/bad-input", "validate: opts.ctPolicy.minOperators must be a positive integer");
+  }
   if (!intrinsic.isArray(path)) throw E("path/bad-input", "validate: path must be an array of certificates");
   // Bound the per-cert asymmetric-verify work BEFORE parsing an untrusted bundle
   // (the policy-tree cap guards CVE-2023-0464-style blow-up; this guards linear
@@ -1607,6 +1664,15 @@ async function validate(path, opts) {
     failed = true;
   }
 
+  // Opt-in CT gate: verify the target's embedded SCTs and record the verdict on its checks (RFC 6962).
+  if (opts.ctLogList != null) {
+    var ctCheck = await ctGateCheck(certs[n - 1], certs, anchor, opts.ctLogList, opts.ctPolicy || {}, n, opts.time);
+    var target = null;
+    for (var tr = 0; tr < state.results.length; tr++) { if (state.results[tr].index === n - 1) { target = state.results[tr]; break; } }
+    if (target) intrinsic.push(target.checks, ctCheck);
+    if (!ctCheck.ok) failed = true;
+  }
+
   return {
     valid: !failed,
     // What the revocation rule and the anchor's own trust metadata actually decided. `valid` alone