Mutated X.509 Certificate Chain

proto/asn1-pdu/mutated_x509_chain.proto

@@ -0,0 +1,56 @@
+// Copyright 2020 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+// This protobuf represents an X.509 certificate chain with a set of operations
+// to mutate the chain to create structural relationships between the
+// certificates.
+
+syntax = "proto2";
+
+import "x509_certificate.proto";
+
+package x509_certificate;
+
+message MutatedChain {
+  // A certificate chain comprises a list of certificates.
+  repeated x509_certificate.X509Certificate chain = 1;
+  repeated Operation operations = 2;
+}
+
+// Operation is used to mutate the certificate chain to force structural
+// relationships between the certificates.
+message Operation {
+  oneof types {
+    MutateSignatureOperation mutate_signature_operation = 1;
+  }
+}
+
+message MutateSignatureOperation {
+  // Allow certificate to be valid or invalid for fuzzing.
+  required bool valid = 1;
+  // |index| represents the position of the certificate whose signature will be
+  // mutated.
+  required CertIndex index = 2;
+}
+
+// Contains the positions of the certiciate chain that can be mutated.
+enum CertIndex {
+  CERT_0 = 0;
+  CERT_1 = 1;
+  CERT_2 = 2;
+  CERT_3 = 3;
+  CERT_4 = 4;
+}

proto/asn1-pdu/mutated_x509_chain_to_der.cc

@@ -0,0 +1,85 @@
+// Copyright 2020 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+#include "mutated_x509_chain_to_der.h"
+#include "x509_certificate_to_der.h"
+
+namespace x509_certificate {
+
+// DER encodes each |certificate| in |chain| and returns
+// the encoded certificates in |der|.
+std::vector<std::vector<uint8_t>> EncodeChain(
+    const google::protobuf::RepeatedPtrField<X509Certificate>& chain) {
+  std::vector<std::vector<uint8_t>> der;
+
+  for (const auto& cert : chain) {
+    der.push_back(X509CertificateToDER(cert));
+  }
+
+  return der;
+}
+
+void ApplyOperation(
+    const MutateSignatureOperation& operation,
+    google::protobuf::RepeatedPtrField<X509Certificate>& chain) {
+  // An |operation| on a certiciate cannot be executed if the |index| is greater
+  // than or euqal to the |size| of the certificate chain.
+  if (operation.index() >= chain.size()) {
+    return;
+  }
+
+  auto* signature_value = chain[operation.index()].mutable_signature_value();
+  signature_value->clear_pdu();
+  signature_value->mutable_value()->set_unused_bits(
+      asn1_universal_types::UnusedBits::VAL0);
+  // Represent a valid signature value with 1 and invalid with 0.
+  if (operation.valid()) {
+    signature_value->mutable_value()->set_val("1");
+  } else {
+    signature_value->mutable_value()->set_val("0");
+  }
+}
+
+void ApplyOperation(
+    const Operation& operation,
+    google::protobuf::RepeatedPtrField<X509Certificate>& chain) {
+  switch (operation.types_case()) {
+    case Operation::TypesCase::kMutateSignatureOperation:
+      ApplyOperation(operation.mutate_signature_operation(), chain);
+      break;
+    case Operation::TypesCase::TYPES_NOT_SET:
+      return;
+  }
+}
+
+std::vector<std::vector<uint8_t>> MutatedChainToDER(
+    const MutatedChain& mutated_chain) {
+  auto chain = mutated_chain.chain();
+  auto operations = mutated_chain.operations();
+
+  // If the chain is empty, return immediately to not slow down the fuzzer.
+  if (chain.empty()) {
+    return {{}};
+  }
+
+  for (const auto& operation : operations) {
+    ApplyOperation(operation, chain);
+  }
+
+  return EncodeChain(chain);
+}
+
+}  // namespace x509_certificate

proto/asn1-pdu/mutated_x509_chain_to_der.h

@@ -0,0 +1,34 @@
+// Copyright 2020 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+#ifndef PROTO_ASN1_PDU_MUTATE_X509_CHAIN_H_
+#define PROTO_ASN1_PDU_MUTATE_X509_CHAIN_H_
+
+#include <stdint.h>
+
+#include <vector>
+
+#include "mutated_x509_chain.pb.h"
+
+namespace x509_certificate {
+
+// Applies |operations| to |chain| and returns the DER encoded chain.
+std::vector<std::vector<uint8_t>> MutatedChainToDER(
+    const MutatedChain& mutated_chain);
+
+}  // namespace x509_certificate
+
+#endif  // PROTO_ASN1_PDU_X509_CERTIFICATE_TO_DER_H_