Add Code Signing lints for EKU, Key Usage, RSA Key Size and CRLDistributionPoints

v3/lint/source.go

@@ -35,6 +35,7 @@ const (
 	RFC6962                       LintSource = "RFC6962"
 	RFC8813                       LintSource = "RFC8813"
 	CABFBaselineRequirements      LintSource = "CABF_BR"
+	CABFCSBaselineRequirements    LintSource = "CABF_CS_BR"
 	CABFSMIMEBaselineRequirements LintSource = "CABF_SMIME_BR"
 	CABFEVGuidelines              LintSource = "CABF_EV"
 	MozillaRootStorePolicy        LintSource = "Mozilla"

v3/lints/cabf_cs_br/lint_cs_crl_distribution_points.go

@@ -0,0 +1,56 @@
+package cabf_cs_br
+
+import (
+	"strings"
+
+	"github.com/zmap/zcrypto/x509"
+	"github.com/zmap/zlint/v3/lint"
+	"github.com/zmap/zlint/v3/util"
+)
+
+/*7.1.2.3 b. cRLDistributionPoints
+This extension MUST be present. It MUST NOT be marked critical, and it MUST contain the
+HTTP URL of the CA’s CRL service*/
+
+func init() {
+	lint.RegisterCertificateLint(&lint.CertificateLint{
+		LintMetadata: lint.LintMetadata{
+			Name:          "e_cs_crl_distribution_points",
+			Description:   "This extension MUST be present. It MUST NOT be marked critical.",
+			Citation:      "CABF CS BRs 7.1.2.3.b",
+			Source:        lint.CABFCSBaselineRequirements,
+			EffectiveDate: util.CABF_CS_BRs_1_2_Date,
+		},
+		Lint: NewCrlDistributionPoints,
+	})
+}
+
+type crlDistributionPoints struct{}
+
+func NewCrlDistributionPoints() lint.LintInterface {
+	return &crlDistributionPoints{}
+}
+
+func (l *crlDistributionPoints) CheckApplies(c *x509.Certificate) bool {
+	return util.IsCodeSigning(c.PolicyIdentifiers) && util.IsSubscriberCert(c)
+}
+
+func (l *crlDistributionPoints) Execute(c *x509.Certificate) *lint.LintResult {
+	cdp := util.GetExtFromCert(c, util.CrlDistOID)
+	if cdp == nil || cdp.Critical {
+		return &lint.LintResult{
+			Status:  lint.Error,
+			Details: "The cRLDistributionPoints extension MUST be present. It MUST NOT be marked critical"}
+	}
+
+	// MUST contain the HTTP URL of the CA’s CRL service
+	for _, uri := range c.CRLDistributionPoints {
+		if !strings.HasPrefix(uri, "http://") {
+			return &lint.LintResult{Status: lint.Error, Details: "cRLDistributionPoints MUST contain the HTTP URL of the CA's CRL service"}
+		}
+	}
+
+	return &lint.LintResult{
+		Status: lint.Pass,
+	}
+}

v3/lints/cabf_cs_br/lint_cs_crl_distribution_points_test.go

@@ -0,0 +1,40 @@
+package cabf_cs_br
+
+import (
+	"testing"
+
+	"github.com/zmap/zlint/v3/lint"
+	"github.com/zmap/zlint/v3/test"
+)
+
+func TestCsCrlDistributionPoints(t *testing.T) {
+	testCases := []struct {
+		Name           string
+		InputFilename  string
+		ExpectedResult lint.LintStatus
+	}{
+		{
+			Name:           "pass - code signing certificate with CRLDistributionPoints",
+			InputFilename:  "code_signing/validCodeSigningCertificate.pem",
+			ExpectedResult: lint.Pass,
+		},
+		{
+			Name:           "fail - code signing certificate without CRLDistributionPoints",
+			InputFilename:  "code_signing/noCrldpIncluded.pem",
+			ExpectedResult: lint.Error,
+		},
+		{
+			Name:           "fail - code signing certificate with CRLDistributionPoints without http",
+			InputFilename:  "code_signing/crlDpNoHttp.pem",
+			ExpectedResult: lint.Error,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.Name, func(t *testing.T) {
+			result := test.TestLint("e_cs_crl_distribution_points", tc.InputFilename)
+			if result.Status != tc.ExpectedResult {
+				t.Errorf("expected result %v was %v - details: %v", tc.ExpectedResult, result.Status, result.Details)
+			}
+		})
+	}
+}

v3/lints/cabf_cs_br/lint_cs_eku_required.go

@@ -0,0 +1,83 @@
+package cabf_cs_br
+
+import (
+	"fmt"
+
+	"github.com/zmap/zcrypto/x509"
+
+	"github.com/zmap/zlint/v3/lint"
+	"github.com/zmap/zlint/v3/util"
+)
+
+/* 7.1.2.3 Code signing and Timestamp Certificate
+f. extKeyUsage
+If the Certificate is a Code Signing Certificate, then id-kp-codeSigning MUST be present
+and the following EKUs MAY be present:
+	• Lifetime Signing OID (1.3.6.1.4.1.311.10.3.13)
+	• id-kp-emailProtection
+	• Document Signing (1.3.6.1.4.1.311.3.10.3.12)
+
+If the Certificate is a Timestamp Certificate, then id-kp-timeStamping MUST be present
+and MUST be marked critical.
+Additionally, the following EKUs MUST NOT be present:
+	• anyExtendedKeyUsage
+	• id-kp-serverAuth
+
+Other values SHOULD NOT be present. If any other value is present, the CA MUST have a
+business agreement with a Platform vendor requiring that EKU in order to issue a
+Platform‐specific code signing certificate with that EKU.
+*/
+
+func init() {
+	lint.RegisterCertificateLint(&lint.CertificateLint{
+		LintMetadata: lint.LintMetadata{
+			Name:          "e_cs_eku_required",
+			Description:   "If the Certificate is a Code Signing Certificate, then id-kp-codeSigning MUST be present",
+			Citation:      "CABF CS BRs 7.1.2.3.f",
+			Source:        lint.CABFCSBaselineRequirements,
+			EffectiveDate: util.CABF_CS_BRs_1_2_Date,
+		},
+		Lint: NewCsEKURequired,
+	})
+}
+
+type csEKURequired struct{}
+
+func NewCsEKURequired() lint.LintInterface {
+	return &csEKURequired{}
+}
+
+func (l *csEKURequired) CheckApplies(c *x509.Certificate) bool {
+	return util.IsCodeSigning(c.PolicyIdentifiers) && util.IsSubscriberCert(c)
+}
+
+func (l *csEKURequired) Execute(c *x509.Certificate) *lint.LintResult {
+	prohibitedEKUs := map[x509.ExtKeyUsage]struct{}{
+		x509.ExtKeyUsageAny:        {},
+		x509.ExtKeyUsageServerAuth: {},
+	}
+
+	hasCodeSigningEKU := false
+
+	for _, eku := range c.ExtKeyUsage {
+		if eku == x509.ExtKeyUsageCodeSigning {
+			hasCodeSigningEKU = true
+		}
+
+		if _, isProhibited := prohibitedEKUs[eku]; isProhibited {
+			return &lint.LintResult{
+				Status:  lint.Error,
+				Details: fmt.Sprintf("Code Signing certificate includes prohibited EKU: %v", eku),
+			}
+		}
+	}
+
+	if !hasCodeSigningEKU {
+		return &lint.LintResult{
+			Status:  lint.Error,
+			Details: "Code Signing certificate missing required Code Signing EKU",
+		}
+	}
+
+	return &lint.LintResult{Status: lint.Pass}
+}

v3/lints/cabf_cs_br/lint_cs_eku_required_test.go

@@ -0,0 +1,40 @@
+package cabf_cs_br
+
+import (
+	"testing"
+
+	"github.com/zmap/zlint/v3/lint"
+	"github.com/zmap/zlint/v3/test"
+)
+
+func TestCsEKUCheck(t *testing.T) {
+	testCases := []struct {
+		Name           string
+		InputFilename  string
+		ExpectedResult lint.LintStatus
+	}{
+		{
+			Name:           "pass - valid code signing certificate with required EKU",
+			InputFilename:  "code_signing/validCodeSigningCertificate.pem",
+			ExpectedResult: lint.Pass,
+		},
+		{
+			Name:           "fail - code signing certificate without required EKU",
+			InputFilename:  "code_signing/noRequiredCodeSigningEKU.pem",
+			ExpectedResult: lint.Error,
+		},
+		{
+			Name:           "fail - code signing certificate with prohibited EKU",
+			InputFilename:  "code_signing/containsProhibitedEKU.pem",
+			ExpectedResult: lint.Error,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.Name, func(t *testing.T) {
+			result := test.TestLint("e_cs_eku_required", tc.InputFilename)
+			if result.Status != tc.ExpectedResult {
+				t.Errorf("expected result %v was %v - details: %v", tc.ExpectedResult, result.Status, result.Details)
+			}
+		})
+	}
+}

v3/lints/cabf_cs_br/lint_cs_key_usage_required.go

@@ -0,0 +1,72 @@
+package cabf_cs_br
+
+import (
+	"github.com/zmap/zcrypto/x509"
+
+	"github.com/zmap/zlint/v3/lint"
+	"github.com/zmap/zlint/v3/util"
+)
+
+/* 7.1.2.3 Code signing and Timestamp Certificate
+e. keyUsage
+This extension MUST be present and MUST be marked critical.
+The bit position for digitalSignature MUST be set. Bit positions for keyCertSign and
+cRLSign MUST NOT be set. All other bit positions SHOULD NOT be set.
+*/
+
+func init() {
+	lint.RegisterCertificateLint(&lint.CertificateLint{
+		LintMetadata: lint.LintMetadata{
+			Name:          "e_cs_key_usage_required",
+			Description:   "This extension MUST be present and MUST be marked critical. The bit position for digitalSignature MUST be set.",
+			Citation:      "CABF CS BRs 7.1.2.3e",
+			Source:        lint.CABFCSBaselineRequirements,
+			EffectiveDate: util.CABF_CS_BRs_1_2_Date,
+		},
+		Lint: NewCsKeyUsageRequired,
+	})
+}
+
+type csKeyUsageRequired struct{}
+
+func NewCsKeyUsageRequired() lint.LintInterface {
+	return &csKeyUsageRequired{}
+}
+
+func (l *csKeyUsageRequired) CheckApplies(c *x509.Certificate) bool {
+	return util.IsCodeSigning(c.PolicyIdentifiers) && util.IsSubscriberCert(c)
+}
+
+func (l *csKeyUsageRequired) Execute(c *x509.Certificate) *lint.LintResult {
+	ku := util.GetExtFromCert(c, util.KeyUsageOID)
+	if ku == nil || !ku.Critical {
+		return &lint.LintResult{
+			Status:  lint.Error,
+			Details: "Key usage extension MUST be present and MUST be marked critical",
+		}
+	}
+
+	if (c.KeyUsage & x509.KeyUsageDigitalSignature) == 0 {
+		return &lint.LintResult{
+			Status:  lint.Error,
+			Details: "Code Signing certificate must have digitalSignature key usage",
+		}
+	}
+
+	// keyCertSign and cRLSign bits MUST NOT be set.
+	if (c.KeyUsage & (x509.KeyUsageCertSign | x509.KeyUsageCRLSign)) != 0 {
+		return &lint.LintResult{
+			Status:  lint.Error,
+			Details: "keyCertSign and cRLSign key usages MUST NOT be set",
+		}
+	}
+
+	// All other bit positions SHOULD NOT be set.
+	if c.KeyUsage & ^x509.KeyUsageDigitalSignature != 0 {
+		return &lint.LintResult{
+			Status:  lint.Warn,
+			Details: "Only digitalSignature key usage is recommended. Other key usages SHOULD NOT be set."}
+	}
+
+	return &lint.LintResult{Status: lint.Pass}
+}

v3/lints/cabf_cs_br/lint_cs_key_usage_required_test.go

@@ -0,0 +1,45 @@
+package cabf_cs_br
+
+import (
+	"testing"
+
+	"github.com/zmap/zlint/v3/lint"
+	"github.com/zmap/zlint/v3/test"
+)
+
+func TestCsKeyUsageCheck(t *testing.T) {
+	testCases := []struct {
+		Name           string
+		InputFilename  string
+		ExpectedResult lint.LintStatus
+	}{
+		{
+			Name:           "pass - valid code signing certificate with digital signature key usage",
+			InputFilename:  "code_signing/validCodeSigningCertificate.pem",
+			ExpectedResult: lint.Pass,
+		},
+		{
+			Name:           "fail - code signing certificate without required key usage",
+			InputFilename:  "code_signing/noDigitalSignatureKeyUsage.pem",
+			ExpectedResult: lint.Error,
+		},
+		{
+			Name:           "fail - code signing certificate with prohibited key usage",
+			InputFilename:  "code_signing/containsProhibitedKeyUsage.pem",
+			ExpectedResult: lint.Error,
+		},
+		{
+			Name:           "warn - code signing certificate with not recommended key usage",
+			InputFilename:  "code_signing/containsNotRecommendedKeyUsage.pem",
+			ExpectedResult: lint.Warn,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.Name, func(t *testing.T) {
+			result := test.TestLint("e_cs_key_usage_required", tc.InputFilename)
+			if result.Status != tc.ExpectedResult {
+				t.Errorf("expected result %v was %v - details: %v", tc.ExpectedResult, result.Status, result.Details)
+			}
+		})
+	}
+}