Add option to stop chain validation when a trusted path is found

This option allows the Merkle Tree CA to validate cross-signed bootstrap
chains, where the final cert in the chain is not necessarily trusted.
This option is disabled for CT where every cert in the submitted chain
needs to be part of the validated path.

Also enforce path length constraints in validate_chain_lax. RFC 6962
doesn't mention invalid path length constraints as a reason to reject a
certificate chain, but it is required in RFC 9162. Seems fine to reject
these chains in CT. For MTC we do want to enforce this check.

Author: lukevalenta

crates/mtc_api/src/lib.rs

@@ -40,7 +40,7 @@ use x509_cert::{
     time::Validity,
     Certificate, TbsCertificate,
 };
-use x509_util::{validate_chain_lax, CertPool};
+use x509_util::{validate_chain_lax, CertPool, ValidationOptions};
 
 // The OID to use for experimentaion. Eventually, we'll switch to "1.3.6.1.5.5.7.TBD1.TBD2"
 // as described in <https://www.ietf.org/archive/id/draft-davidben-tls-merkle-tree-certs-05.html#name-log-ids>.
@@ -639,7 +639,17 @@ pub fn validate_correspondence(
     // Run the validation logic with the above validation hook. We do
     // not give `validate_chain_lax` a window for the `not_after` validity,
     // since validity is checked within the validator hook.
-    validate_chain_lax(raw_chain, roots, None, None, validator_hook).map_err(|e| match e {
+    validate_chain_lax(
+        raw_chain,
+        roots,
+        &ValidationOptions {
+            stop_on_first_trusted_cert: true,
+            not_after_start: None,
+            not_after_end: None,
+        },
+        validator_hook,
+    )
+    .map_err(|e| match e {
         x509_util::HookOrValidationError::Validation(ve) => ve.into(),
         x509_util::HookOrValidationError::Hook(he) => he,
     })
@@ -742,7 +752,16 @@ pub fn validate_chain(
     // Run the validation and return the hook-constructed pending entry. We do
     // not give `validate_chain_lax` a window for the `not_after` validity,
     // since validity is checked within the validator hook.
-    let pending_entry = validate_chain_lax(raw_chain, roots, None, None, validator_hook);
+    let pending_entry = validate_chain_lax(
+        raw_chain,
+        roots,
+        &ValidationOptions {
+            stop_on_first_trusted_cert: true,
+            not_after_start: None,
+            not_after_end: None,
+        },
+        validator_hook,
+    );
     pending_entry.map_err(|e| match e {
         x509_util::HookOrValidationError::Validation(ve) => ve.into(),
         x509_util::HookOrValidationError::Hook(he) => he,

crates/static_ct_api/src/lib.rs

@@ -33,6 +33,8 @@ pub enum StaticCTError {
     UnknownType,
     #[error("trailing data")]
     TrailingData,
+    #[error("invalid certificate chain per CT")]
+    InvalidChain,
     #[error("invalid leaf certificate per CT")]
     InvalidLeaf,
     #[error("CT poison extension is not critical or invalid")]

crates/static_ct_api/src/rfc6962.rs

@@ -41,7 +41,7 @@ use x509_cert::{
     },
     impl_newtype, Certificate, TbsCertificate,
 };
-use x509_util::{validate_chain_lax, CertPool};
+use x509_util::{validate_chain_lax, CertPool, ValidationOptions};
 
 // Data structures for the [Static CT Submission APIs](https://github.com/C2SP/C2SP/blob/main/static-ct-api.md#submission-apis),
 // a subset of the APIs from [RFC 6962](https://datatracker.ietf.org/doc/html/rfc6962).
@@ -164,8 +164,11 @@ pub fn partially_validate_chain(
     let pending_entry = validate_chain_lax(
         raw_chain,
         roots,
-        not_after_start,
-        not_after_end,
+        &ValidationOptions {
+            stop_on_first_trusted_cert: false,
+            not_after_start,
+            not_after_end,
+        },
         validator_hook,
     );
     pending_entry.map_err(|e| match e {
@@ -352,14 +355,8 @@ mod tests {
         ($name:ident; $($root_file:expr),+; $($chain_file:expr),+; $not_after_start:expr; $not_after_end:expr; $expect_precert:expr; $require_server_auth_eku:expr; $want_err:expr; $want_chain_len:expr) => {
             #[test]
             fn $name() {
-                let mut roots = Vec::new();
-                $(
-                    roots.append(&mut Certificate::load_pem_chain(include_bytes!($root_file)).unwrap());
-                )*
-                let mut chain = Vec::new();
-                $(
-                    chain.append(&mut Certificate::load_pem_chain(include_bytes!($chain_file)).unwrap());
-                )*
+                let roots = x509_util::build_chain!($($root_file),*);
+                let chain = x509_util::build_chain!($($chain_file),*);
 
                 let result = partially_validate_chain(
                         &x509_util::certs_to_bytes(&chain).unwrap(),
@@ -400,6 +397,11 @@ mod tests {
 
     test_validate_chain!(leaf_as_accepted_root; "../tests/leaf-signed-by-fake-intermediate-cert.pem"; "../tests/leaf-signed-by-fake-intermediate-cert.pem"; None; None; false; true; false; 0);
 
+    test_validate_chain!(valid_chain_inc_root;  "../../static_ct_api/tests/fake-ca-cert.pem"; "../tests/leaf-signed-by-fake-intermediate-cert.pem", "../tests/fake-intermediate-cert.pem", "../tests/fake-ca-cert.pem"; None; None; false; true; false; 2);
+
+    // CT does not allow extra certs at the end of the chain.
+    test_validate_chain!(unrelated_cert_after_chain_inc_root;  "../../static_ct_api/tests/fake-ca-cert.pem"; "../tests/leaf-signed-by-fake-intermediate-cert.pem", "../tests/fake-intermediate-cert.pem", "../tests/fake-ca-cert.pem", "../tests/test-cert.pem"; None; None; false; true; true; 0);
+
     #[test]
     fn test_build_precert_tbs() {
         let precert_chain =