refactor trusted cert cache to support multi root usage with root list subsets

Author: bigbrett

src/wh_server_cert.c

@@ -88,54 +88,76 @@ static int _UnlockVerifyCache(whCertVerifyCacheContext* cache)
 #endif
 }
 
-/* Internal slot scan, must be called with the cache lock held. */
-static int _LookupUnlocked(const whCertVerifyCacheContext* cache,
-                           whNvmId rootNvmId, const uint8_t* hash)
+/* Returns 1 if every element of `subset` appears in `superset`. The arrays
+ * are unsorted but bounded by WOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS, so the
+ * O(N*M) scan is fine. */
+static int _IsSubsetOf(const whNvmId* subset, uint16_t subsetCount,
+                       const whNvmId* superset, uint16_t supersetCount)
+{
+    uint16_t i, j;
+    int      found;
+    for (i = 0; i < subsetCount; i++) {
+        found = 0;
+        for (j = 0; j < supersetCount; j++) {
+            if (subset[i] == superset[j]) {
+                found = 1;
+                break;
+            }
+        }
+        if (!found) {
+            return 0;
+        }
+    }
+    return 1;
+}
+
+/* Internal slot scan, must be called with the cache lock held. Hit if any
+ * committed slot's stored root set is a subset of the supplied root set
+ * AND its hash matches. */
+static int _LookupSubsetUnlocked(const whCertVerifyCacheContext* cache,
+                                 const whNvmId* rootNvmIds, uint16_t numRoots,
+                                 const uint8_t* hash)
 {
     int i;
     for (i = 0; i < WOLFHSM_CFG_CERT_VERIFY_CACHE_COUNT; i++) {
         const whCertVerifyCacheSlot* slot = &cache->slots[i];
-        if (slot->committed && (slot->rootNvmId == rootNvmId) &&
-            (memcmp(slot->hash, hash, WH_CERT_VERIFY_CACHE_HASH_LEN) == 0)) {
+        if (slot->committed &&
+            (memcmp(slot->hash, hash, WH_CERT_VERIFY_CACHE_HASH_LEN) == 0) &&
+            _IsSubsetOf(slot->rootNvmIds, slot->numRoots, rootNvmIds,
+                        numRoots)) {
             return WH_ERROR_OK;
         }
     }
     return WH_ERROR_NOTFOUND;
 }
 
-int wh_Server_CertVerifyCache_Lookup(whServerContext* server, whNvmId rootNvmId,
-                                     const uint8_t* hash)
+/* Internal exact-match scan for insert dedup. Two sets of equal size are
+ * equal iff one is a subset of the other, so reuse _IsSubsetOf with a size
+ * check rather than sorting. */
+static int _HasExactSlotUnlocked(const whCertVerifyCacheContext* cache,
+                                 const whNvmId* rootNvmIds, uint16_t numRoots,
+                                 const uint8_t* hash)
 {
-    whCertVerifyCacheContext* cache;
-    int                       rc;
-    int                       found;
-
-    if ((server == NULL) || (hash == NULL)) {
-        return WH_ERROR_BADARGS;
-    }
-    cache = _GetVerifyCache(server);
-    if (cache == NULL) {
-        return WH_ERROR_BADARGS;
-    }
-
-    rc = _LockVerifyCache(cache);
-    if (rc != WH_ERROR_OK) {
-        return rc;
+    int i;
+    for (i = 0; i < WOLFHSM_CFG_CERT_VERIFY_CACHE_COUNT; i++) {
+        const whCertVerifyCacheSlot* slot = &cache->slots[i];
+        if (slot->committed && (slot->numRoots == numRoots) &&
+            (memcmp(slot->hash, hash, WH_CERT_VERIFY_CACHE_HASH_LEN) == 0) &&
+            _IsSubsetOf(slot->rootNvmIds, slot->numRoots, rootNvmIds,
+                        numRoots)) {
+            return 1;
+        }
     }
-    found = _LookupUnlocked(cache, rootNvmId, hash);
-    (void)_UnlockVerifyCache(cache);
-    return found;
+    return 0;
 }
 
-int wh_Server_CertVerifyCache_LookupAnyRoot(whServerContext* server,
-                                            const whNvmId*   rootNvmIds,
-                                            uint16_t         numRoots,
-                                            const uint8_t*   hash)
+int wh_Server_CertVerifyCache_Lookup(whServerContext* server,
+                                     const whNvmId*   rootNvmIds,
+                                     uint16_t numRoots, const uint8_t* hash)
 {
     whCertVerifyCacheContext* cache;
     int                       rc;
-    int                       found = WH_ERROR_NOTFOUND;
-    uint16_t                  i;
+    int                       found;
 
     if ((server == NULL) || (hash == NULL) || (rootNvmIds == NULL) ||
         (numRoots == 0)) {
@@ -150,30 +172,23 @@ int wh_Server_CertVerifyCache_LookupAnyRoot(whServerContext* server,
     if (rc != WH_ERROR_OK) {
         return rc;
     }
-    /* Hit if the cert is cached under ANY of the supplied roots. The
-     * binding to a real root preserves the security property that
-     * cache hits cannot bypass trust-anchor checks: if the cached
-     * binding root is in the supplied set, the cached verify was
-     * anchored to a root the caller currently trusts. */
-    for (i = 0; i < numRoots; i++) {
-        if (_LookupUnlocked(cache, rootNvmIds[i], hash) == WH_ERROR_OK) {
-            found = WH_ERROR_OK;
-            break;
-        }
-    }
+    found = _LookupSubsetUnlocked(cache, rootNvmIds, numRoots, hash);
     (void)_UnlockVerifyCache(cache);
     return found;
 }
 
 void wh_Server_CertVerifyCache_Insert(whServerContext* server,
-                                      whNvmId rootNvmId, const uint8_t* hash)
+                                      const whNvmId*   rootNvmIds,
+                                      uint16_t numRoots, const uint8_t* hash)
 {
     whCertVerifyCacheContext* cache;
     whCertVerifyCacheSlot*    slot;
     uint16_t                  idx;
+    uint16_t                  k;
     int                       rc;
 
-    if ((server == NULL) || (hash == NULL)) {
+    if ((server == NULL) || (hash == NULL) || (rootNvmIds == NULL) ||
+        (numRoots == 0) || (numRoots > WOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS)) {
         return;
     }
     cache = _GetVerifyCache(server);
@@ -185,12 +200,17 @@ void wh_Server_CertVerifyCache_Insert(whServerContext* server,
     if (rc != WH_ERROR_OK) {
         return;
     }
-    /* Dedup under the lock so concurrent inserts of the same hash collapse to
-     * a single slot. */
-    if (_LookupUnlocked(cache, rootNvmId, hash) != WH_ERROR_OK) {
-        idx             = cache->writeIdx;
-        slot            = &cache->slots[idx];
-        slot->rootNvmId = rootNvmId;
+    /* Dedup on exact (set, hash) match under the lock so concurrent inserts
+     * of the same verify collapse to a single slot. Differing-set entries
+     * for the same hash coexist: each is an independent claim about a
+     * distinct verify, and dropping either could lose hit coverage. */
+    if (!_HasExactSlotUnlocked(cache, rootNvmIds, numRoots, hash)) {
+        idx            = cache->writeIdx;
+        slot           = &cache->slots[idx];
+        slot->numRoots = (uint8_t)numRoots;
+        for (k = 0; k < numRoots; k++) {
+            slot->rootNvmIds[k] = rootNvmIds[k];
+        }
         memcpy(slot->hash, hash, WH_CERT_VERIFY_CACHE_HASH_LEN);
         slot->committed = 1;
         cache->writeIdx =
@@ -243,13 +263,22 @@ void wh_Server_CertVerifyCache_EvictRoot(whServerContext* server,
     if (rc != WH_ERROR_OK) {
         return;
     }
-    /* Walk every slot and zero those bound to the affected root. writeIdx is
-     * left alone: the FIFO ring is sparse but still well-formed, and pruning
-     * here would otherwise need to compact entries belonging to other roots. */
+    /* Drop any slot whose stored root set contains the evicted root. We
+     * cannot safely strip the root from the set and keep the entry: the
+     * original verify may have anchored at the now-departed root, so the
+     * remaining set is no longer a sound claim. writeIdx is left alone:
+     * the FIFO ring is sparse but still well-formed, and pruning here
+     * would otherwise need to compact entries belonging to other roots. */
     for (i = 0; i < WOLFHSM_CFG_CERT_VERIFY_CACHE_COUNT; i++) {
         whCertVerifyCacheSlot* slot = &cache->slots[i];
-        if (slot->committed && (slot->rootNvmId == rootNvmId)) {
-            memset(slot, 0, sizeof(*slot));
+        if (slot->committed) {
+            uint16_t k;
+            for (k = 0; k < slot->numRoots; k++) {
+                if (slot->rootNvmIds[k] == rootNvmId) {
+                    memset(slot, 0, sizeof(*slot));
+                    break;
+                }
+            }
         }
     }
     (void)_UnlockVerifyCache(cache);
@@ -299,15 +328,6 @@ _verifyChainAgainstCmStore(whServerContext* server, WOLFSSL_CERT_MANAGER* cm,
 #ifdef WOLFHSM_CFG_CERTIFICATE_VERIFY_CACHE
     uint8_t certHash[WH_CERT_VERIFY_CACHE_HASH_LEN];
     int     hashed = 0;
-    /* Single-root callers know which root anchors the verify and can both
-     * read and write the cache under that root binding. Multi-root callers
-     * cannot identify the anchoring root post-verify, so the cache is
-     * read-only for them: lookups OR across the supplied roots (a hit
-     * means the cert was previously verified under a root the caller
-     * currently trusts), but no entries are inserted. The cache is still
-     * populated by single-root verifies, which multi-root verifies can
-     * benefit from. */
-    int     boundCacheMode = (numRoots == 1);
 #else
     (void)trustedRootNvmIds;
     (void)numRoots;
@@ -349,17 +369,9 @@ _verifyChainAgainstCmStore(whServerContext* server, WOLFSSL_CERT_MANAGER* cm,
         }
         hashed = 1;
         {
-            int hit;
-            if (boundCacheMode) {
-                hit = (wh_Server_CertVerifyCache_Lookup(
-                           server, trustedRootNvmIds[0], certHash) ==
-                       WH_ERROR_OK);
-            }
-            else {
-                hit = (wh_Server_CertVerifyCache_LookupAnyRoot(
+            int hit = (wh_Server_CertVerifyCache_Lookup(
                            server, trustedRootNvmIds, numRoots, certHash) ==
                        WH_ERROR_OK);
-            }
             if (hit) {
                 rc = WOLFSSL_SUCCESS;
             }
@@ -449,27 +461,26 @@ _verifyChainAgainstCmStore(whServerContext* server, WOLFSSL_CERT_MANAGER* cm,
                 }
             }
 #ifdef WOLFHSM_CFG_CERTIFICATE_VERIFY_CACHE
-            /* Only insert CA certs into the verify cache, and only in
-             * single-root (bound) mode. Two restrictions:
-             *
-             * - Leaves are not cached: a cache hit on a leaf cert during a
-             *   future "leaf alone" verify would short-circuit the wolfSSL
-             *   signature check that would otherwise have failed (the
-             *   leaf's issuer is not in the cert manager when the leaf is
-             *   supplied without its intermediates). CA caching is sound
-             *   because the chain walk loads each verified CA into the
-             *   cert manager before the next cert is processed.
+            /* Insert only CA certs into the verify cache. Leaves are not
+             * cached: a cache hit on a leaf during a future "leaf alone"
+             * verify would short-circuit the wolfSSL signature check that
+             * would otherwise have failed (the leaf's issuer is not in the
+             * cert manager when the leaf is supplied without its
+             * intermediates). CA caching is sound because the chain walk
+             * loads each verified CA into the cert manager before the next
+             * cert is processed.
              *
-             * - Multi-root verifies do not insert: the anchoring root
-             *   cannot be identified post-verify, and inserting under any
-             *   non-anchoring root from the supplied set could be matched
-             *   by a future single-root verify under that wrong root,
-             *   causing a false positive. Multi-root callers still
-             *   benefit from cache entries populated by single-root
-             *   verifies via the OR-across-roots lookup above. */
-            if (hashed && dc.isCA && boundCacheMode) {
-                wh_Server_CertVerifyCache_Insert(server, trustedRootNvmIds[0],
-                                                 certHash);
+             * The slot's binding is the loaded root set passed in. Under
+             * subset-lookup semantics, a future verify hits this entry
+             * only when its loaded set is a superset, which by X.509
+             * verify monotonicity guarantees the cached chain still
+             * validates. Single-root callers produce one-element entries
+             * (broadest reuse); multi-root callers produce wider entries
+             * that are still useful when later traffic presents at least
+             * the same roots. */
+            if (hashed && dc.isCA) {
+                wh_Server_CertVerifyCache_Insert(server, trustedRootNvmIds,
+                                                 numRoots, certHash);
             }
 #endif
             wc_FreeDecodedCert(&dc);