oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

kx509: Add CSR support

Browse Source 
This commit adds support for proof of posession to the kx509 protocol by
using PKCS#10 CSRs.

This allows conveyance of extReq CSR attributes requesting desired
Certificate Extensions.
This commit is contained in:
Nicolas Williams
2019-07-15 23:27:30 -05:00
parent c838abdf1a
commit dfada0ccad
16 changed files with 1690 additions and 457 deletions
Download Patch File Download Diff File Expand all files Collapse all files

599
kdc/kx509.c
View File

@@ -43,7 +43,7 @@
* This file implements the kx509 service.
*
* The protocol, its shortcomings, and its future are described in
* lib/krb5/hx509.c.
* lib/krb5/hx509.c. See also lib/asn1/kx509.asn1.
*
* The service handles requests, decides whether to issue a certificate, and
* does so by populating a "template" to generate a TBSCertificate and signing
@@ -57,8 +57,8 @@
* Besides future protocol improvements described in lib/krb5/hx509.c, here is
* a list of KDC functionality we'd like to add:
*
* - support templates as strings in configuration?
* - lookup an hx509 template for the client principal in its HDB entry
* - support templates as strings (rather than filenames) in configuration?
* - lookup an hx509 template for the client principal in its HDB entry?
* - lookup subjectName, SANs for a principal in its HDB entry
* - lookup a host-based client principal's HDB entry and add its canonical
* name / aliases as dNSName SANs
@@ -76,6 +76,23 @@
static const unsigned char version_2_0[4] = {0 , 0, 2, 0};
typedef struct kx509_req_context {
krb5_kdc_configuration *config;
const struct Kx509Request *req;
Kx509CSRPlus csr_plus;
krb5_auth_context ac;
const char *realm; /* XXX Confusion: is this crealm or srealm? */
char *sname;
char *cname;
struct sockaddr *addr;
const char *from;
krb5_keyblock *key;
hx509_request csr;
krb5_data *reply;
unsigned int have_auth_data:1; /* Relevant authz data in the AP-REQ */
unsigned int send_chain:1; /* Client expects a full chain */
} *kx509_req_context;
/*
* Taste the request to see if it's a kx509 request.
*/
@@ -150,6 +167,37 @@ verify_req_hash(krb5_context context,
return 0;
}
/* Wrapper around kdc_log() that adds contextual information */
static void
kx509_log(krb5_context context,
kx509_req_context reqctx,
int level,
const char *fmt,
...)
{
va_list ap;
char *msg;
va_start(ap, fmt);
if (vasprintf(&msg, fmt, ap) == -1 || msg == NULL) {
kdc_log(context, reqctx->config, level,
"Out of memory while formatting log message");
va_end(ap);
va_start(ap, fmt);
kdc_vlog(context, reqctx->config, level, fmt, ap);
va_end(ap);
return;
}
va_end(ap);
kdc_log(context, reqctx->config, level,
"kx509 %s (from %s for %s, service %s)", msg,
reqctx->from ? reqctx->from : "<unknown>",
reqctx->cname ? reqctx->cname : "<unknown-client-principal>",
reqctx->sname ? reqctx->sname : "<unknown-service-principal>");
free(msg);
}
/*
* Set the HMAC in the response.
*/
@@ -206,6 +254,22 @@ calculate_reply_hash(krb5_context context,
return 0;
}
/*
* Lookup the principal's HDB entry, authorize the requested extensions, add
* authorized extensions to the `tbs', and indicate whether to add any of the
* EKUs/SANs we'd normally add automatically.
*/
static krb5_error_code
get_hdb_ekus_and_sans(krb5_context context,
kx509_req_context reqctx,
krb5_principal principal,
hx509_ca_tbs tbs,
int *add_auto_exts)
{
*add_auto_exts = 1;
return ENOTSUP;
}
/*
* Finds a template in the configuration that is appropriate to the form of the
* client principal. Also sets some variables in `env' and adds some SANs to
@@ -222,7 +286,7 @@ calculate_reply_hash(krb5_context context,
*/
static krb5_error_code
get_template(krb5_context context,
krb5_kdc_configuration *config,
kx509_req_context reqctx,
krb5_principal principal,
const char *princ_no_realm,
const char *princ,
@@ -230,13 +294,20 @@ get_template(krb5_context context,
hx509_env *env,
hx509_ca_tbs tbs)
{
krb5_error_code ret = KRB5KDC_ERR_POLICY;
unsigned int ncomp = krb5_principal_get_num_comp(context, principal);
const char *crealm = krb5_principal_get_realm(context, principal);
const char *kx509_template = NULL;
const char *comp0, *comp1, *comp2;
char *domain = NULL;
char *email = NULL;
krb5_error_code ret = KRB5KDC_ERR_POLICY;
int add_auto_exts = 1;
/* Populate extensions from CSR / HDB entry as requested and permitted */
ret = get_hdb_ekus_and_sans(context, reqctx, principal, tbs,
&add_auto_exts);
if (ret != 0 && ret != ENOTSUP)
return ret;
if (ncomp == 1) {
/* 1-component, user principal */
@@ -246,7 +317,7 @@ get_template(krb5_context context,
crealm, "kx509_template",
NULL);
if (kx509_template == NULL)
kx509_template = config->kx509_template;
kx509_template = reqctx->config->kx509_template;
if (kx509_template == NULL)
goto out;
@@ -264,7 +335,7 @@ get_template(krb5_context context,
* XXX Dicey feature! Maybe this should be a string param whose value
* is the domainname to use for the email address.
*/
if (ret == 0 &&
if (ret == 0 && add_auto_exts &&
get_bool_param(context, FALSE, crealm, "kx509_include_email_san")) {
char *p;
@@ -319,7 +390,7 @@ get_template(krb5_context context,
if (ret == 0 && ncomp == 3)
ret = hx509_env_add(context->hx509ctx, env, "principal-domain-name", comp2);
if (ret == 0 &&
if (ret == 0 && add_auto_exts &&
get_bool_param(context, FALSE, crealm,
"kx509_include_dnsname_san")) {
ret = hx509_ca_tbs_add_san_hostname(context->hx509ctx, tbs, comp1);
@@ -342,13 +413,13 @@ get_template(krb5_context context,
"kx509_templates",
config_label, comp0, NULL);
if (kx509_template == NULL) {
kdc_log(context, config, 0, "kx509 template not found for %s",
kdc_log(context, reqctx->config, 0, "kx509 template not found for %s",
princ);
ret = KRB5KDC_ERR_POLICY;
goto out;
}
} else {
kdc_log(context, config, 0, "kx509 client %s has too many components!",
kdc_log(context, reqctx->config, 0, "kx509 client %s has too many components!",
princ);
ret = KRB5KDC_ERR_POLICY;
}
@@ -360,13 +431,60 @@ out:
return ret;
}
static int
chain_add1_func(hx509_context context, void *d, hx509_cert c)
{
heim_octet_string os;
Certificates *cs = d;
Certificate c2;
int ret;
ret = hx509_cert_binary(context, c, &os);
if (ret)
return ret;
ret = decode_Certificate(os.data, os.length, &c2, NULL);
der_free_octet_string(&os);
if (ret)
return ret;
ret = add_Certificates(cs, &c2);
free_Certificate(&c2);
return ret;
}
static krb5_error_code
encode_cert_and_chain(hx509_context hx509ctx,
hx509_cert cert,
const char *chain_store,
krb5_data *out)
{
krb5_error_code ret;
Certificates cs;
hx509_certs certs = NULL;
size_t len;
cs.len = 0;
cs.val = 0;
ret = chain_add1_func(hx509ctx, &cs, cert);
if (ret == 0)
ret = hx509_certs_init(hx509ctx, chain_store, 0, NULL, &certs);
if (ret == 0)
ret = hx509_certs_iter_f(hx509ctx, certs, chain_add1_func, &cs);
hx509_certs_free(&certs);
if (ret == 0)
ASN1_MALLOC_ENCODE(Certificates, out->data, out->length,
&cs, &len, ret);
free_Certificates(&cs);
return ret;
}
/*
* Build a certifate for `principal´ that will expire at `endtime´.
*/
static krb5_error_code
build_certificate(krb5_context context,
krb5_kdc_configuration *config,
const krb5_data *key,
kx509_req_context reqctx,
time_t endtime,
krb5_principal principal,
krb5_data *certificate)
@@ -390,11 +508,11 @@ build_certificate(krb5_context context,
kx509_ca = krb5_config_get_string(context, NULL, "kdc", "realms", crealm,
"kx509_ca", NULL);
if (kx509_ca == NULL)
kx509_ca = config->kx509_ca;
kx509_ca = reqctx->config->kx509_ca;
if (kx509_ca == NULL) {
ret = KRB5KDC_ERR_POLICY;
kdc_log(context, config, 0, "No kx509 CA credential specified for "
"realm %s", crealm);
kdc_log(context, reqctx->config, 0,
"No kx509 CA credential specified for realm %s", crealm);
goto out;
}
@@ -409,18 +527,19 @@ build_certificate(krb5_context context,
goto out;
/* Get a template and set things in `env' and `tbs' as appropriate */
ret = get_template(context, config, principal, name, princ,
ret = get_template(context, reqctx, principal, name, princ,
&kx509_template, &env, tbs);
if (ret)
goto out;
if (kx509_template == NULL) {
kdc_log(context, config, 0, "No kx509 certificate template specified");
kdc_log(context, reqctx->config, 0,
"No kx509 certificate template specified");
ret = KRB5KDC_ERR_POLICY;
goto out;
}
kdc_log(context, config, 0, "Issuing kx509 certificate to %s using "
"template %s", princ, kx509_template);
kdc_log(context, reqctx->config, 0, "Issuing kx509 certificate to %s "
"using template %s", princ, kx509_template);
/*
* Populate additional template "env" variables
@@ -442,7 +561,8 @@ build_certificate(krb5_context context,
ret = hx509_certs_init(context->hx509ctx, kx509_ca, 0, NULL, &certs);
if (ret) {
kdc_log(context, config, 0, "Failed to load CA %s", kx509_ca);
kdc_log(context, reqctx->config, 0,
"Failed to load CA %s", kx509_ca);
goto out;
}
ret = hx509_query_alloc(context->hx509ctx, &q);
@@ -458,7 +578,8 @@ build_certificate(krb5_context context,
hx509_query_free(context->hx509ctx, q);
hx509_certs_free(&certs);
if (ret) {
kdc_log(context, config, 0, "Failed to find a CA in %s", kx509_ca);
kdc_log(context, reqctx->config, 0,
"Failed to find a CA in %s", kx509_ca);
goto out;
}
}
@@ -466,22 +587,13 @@ build_certificate(krb5_context context,
/* Populate the subject public key in the TBS context */
{
SubjectPublicKeyInfo spki;
heim_any any;
memset(&spki, 0, sizeof(spki));
spki.subjectPublicKey.data = key->data;
spki.subjectPublicKey.length = key->length * 8;
ret = der_copy_oid(&asn1_oid_id_pkcs1_rsaEncryption,
&spki.algorithm.algorithm);
any.data = "\x05\x00";
any.length = 2;
spki.algorithm.parameters = &any;
ret = hx509_ca_tbs_set_spki(context->hx509ctx, tbs, &spki);
der_free_oid(&spki.algorithm.algorithm);
ret = hx509_request_get_SubjectPublicKeyInfo(context->hx509ctx,
reqctx->csr,
&spki);
if (ret == 0)
ret = hx509_ca_tbs_set_spki(context->hx509ctx, tbs, &spki);
free_SubjectPublicKeyInfo(&spki);
if (ret)
goto out;
}
@@ -497,18 +609,18 @@ build_certificate(krb5_context context,
ret = hx509_get_one_cert(context->hx509ctx, certs, &template);
hx509_certs_free(&certs);
if (ret) {
kdc_log(context, config, 0, "Failed to load template from %s",
kx509_template);
kdc_log(context, reqctx->config, 0,
"Failed to load template from %s", kx509_template);
goto out;
}
/*
* Only take the subjectName, the keyUsage, and EKUs from the template
* certificate.
*/
ret = hx509_ca_tbs_set_template(context->hx509ctx, tbs,
HX509_CA_TEMPLATE_SUBJECT|
HX509_CA_TEMPLATE_KU|
HX509_CA_TEMPLATE_SUBJECT |
HX509_CA_TEMPLATE_KU |
HX509_CA_TEMPLATE_EKU,
template);
hx509_cert_free(template);
@@ -518,7 +630,7 @@ build_certificate(krb5_context context,
/*
* Add other SANs.
*
*
* Adding an id-pkinit-san means the client can use the certificate to
* initiate PKINIT. That might seem odd, but it enables a sort of PKIX
* credential delegation by allowing forwarded Kerberos tickets to be
@@ -528,6 +640,9 @@ build_certificate(krb5_context context,
* PKIX (w/ softtoken) -> Kerberos ->
* PKIX (w/ softtoken) -> Kerberos ->
* ...
*
* Note that we may not have added the PKINIT EKU -- that depends on the
* template, and host-based service templates might well not include it.
*/
if (ret == 0 &&
get_bool_param(context, TRUE, crealm, "kx509_include_pkinit_san")) {
@@ -536,22 +651,30 @@ build_certificate(krb5_context context,
goto out;
}
/*
* Note that we set the certificate's end time to the client's *Ticket*'s
* end time. For server certs this may not always be appropriate. We
* might want to have a configurable setting for this, in which case maybe
* we should move this to get_template().
*/
hx509_ca_tbs_set_notAfter(context->hx509ctx, tbs, endtime);
/* Finally, expand the subjectName in the TBS context and sign to issue */
/* Expand the subjectName template in the TBS */
hx509_ca_tbs_subject_expand(context->hx509ctx, tbs, env);
hx509_env_free(&env);
/* All done with the TBS, sign/issue the certificate */
ret = hx509_ca_sign(context->hx509ctx, tbs, signer, &cert);
if (ret)
goto out;
/* Encode and output the certificate */
ret = hx509_cert_binary(context->hx509ctx, cert, certificate);
if (reqctx->send_chain)
ret = encode_cert_and_chain(context->hx509ctx, cert, kx509_ca, certificate);
else
ret = hx509_cert_binary(context->hx509ctx, cert, certificate);
out:
if (ret)
kdc_log(context, config, 0, "Failed to build a certificate for %s",
princ);
krb5_xfree(name);
krb5_xfree(princ);
if (env)
@@ -568,7 +691,7 @@ out:
/* Check that a krbtgt's second component is a local realm */
static krb5_error_code
is_local_realm(krb5_context context,
krb5_kdc_configuration *config,
kx509_req_context reqctx,
const char *realm)
{
krb5_error_code ret;
@@ -580,8 +703,8 @@ is_local_realm(krb5_context context,
if (ret)
return ret;
if (ret == 0)
ret = _kdc_db_fetch(context, config, tgs, HDB_F_GET_KRBTGT, NULL, NULL,
&ent);
ret = _kdc_db_fetch(context, reqctx->config, tgs, HDB_F_GET_KRBTGT,
NULL, NULL, &ent);
if (ent)
_kdc_free_ent(context, ent);
krb5_free_principal(context, tgs);
@@ -598,7 +721,7 @@ is_local_realm(krb5_context context,
*
* We allow cross-realm requests.
*
* XXX Maybe x-realm support should be configurable. Requiring INITIAL tickets
* Maybe x-realm support should be configurable. Requiring INITIAL tickets
* does NOT preclude x-realm support! (Cross-realm TGTs can be INITIAL.)
*
* Support for specific client realms is configurable by configuring issuer
@@ -606,10 +729,9 @@ is_local_realm(krb5_context context,
* default. But maybe we should have an explicit configuration parameter
* to enable support for clients from different realms than the service.
*/
krb5_error_code
static krb5_error_code
kdc_kx509_verify_service_principal(krb5_context context,
krb5_kdc_configuration *config,
const char *cname,
kx509_req_context reqctx,
krb5_principal sprincipal)
{
krb5_error_code ret = 0;
@@ -624,8 +746,8 @@ kdc_kx509_verify_service_principal(krb5_context context,
if (strcmp(krb5_principal_get_comp_string(context, sprincipal, 0),
KRB5_TGS_NAME) == 0) {
const char *r = krb5_principal_get_comp_string(context, sprincipal, 1);
if ((ret = is_local_realm(context, config, r)))
kdc_log(context, config, 0, "client used wrong krbtgt for kx509");
if ((ret = is_local_realm(context, reqctx, r)))
kx509_log(context, reqctx, 0, "client used wrong krbtgt for kx509");
goto out;
}
@@ -653,10 +775,8 @@ err:
goto out;
ret = KRB5KDC_ERR_SERVER_NOMATCH;
krb5_set_error_message(context, ret,
"User %s used wrong Kx509 service "
"principal, expected: %s",
cname, expected);
kx509_log(context, reqctx, 0, "client used wrong kx509 service principal "
"(expected %s)", expected);
out:
krb5_xfree(expected);
@@ -667,39 +787,37 @@ out:
static krb5_error_code
encode_reply(krb5_context context,
krb5_kdc_configuration *config,
krb5_data *reply,
kx509_req_context reqctx,
Kx509Response *r)
{
krb5_error_code ret;
krb5_data data;
size_t size;
reply->data = NULL;
reply->length = 0;
reqctx->reply->data = NULL;
reqctx->reply->length = 0;
ASN1_MALLOC_ENCODE(Kx509Response, data.data, data.length, r, &size, ret);
if (ret) {
kdc_log(context, config, 0, "Failed to encode kx509 reply");
kdc_log(context, reqctx->config, 0, "Failed to encode kx509 reply");
return ret;
}
if (size != data.length)
krb5_abortx(context, "ASN1 internal error");
ret = krb5_data_alloc(reply, data.length + sizeof(version_2_0));
ret = krb5_data_alloc(reqctx->reply, data.length + sizeof(version_2_0));
if (ret == 0) {
memcpy(reply->data, version_2_0, sizeof(version_2_0));
memcpy(((unsigned char *)reply->data) + sizeof(version_2_0),
memcpy(reqctx->reply->data, version_2_0, sizeof(version_2_0));
memcpy(((unsigned char *)reqctx->reply->data) + sizeof(version_2_0),
data.data, data.length);
}
free(data.data);
return ret;
}
/* Make an error response, and log the error message as well */
static krb5_error_code
mk_error_response(krb5_context context,
krb5_kdc_configuration *config,
krb5_keyblock *key,
krb5_data *reply,
kx509_req_context reqctx,
int32_t code,
const char *fmt,
...)
@@ -712,7 +830,7 @@ mk_error_response(krb5_context context,
char *freeme1 = NULL;
va_list ap;
if (!config->enable_kx509)
if (!reqctx->config->enable_kx509)
code = KRB5KDC_ERR_POLICY;
/* Make sure we only send RFC4120 and friends wire protocol error codes */
@@ -736,13 +854,13 @@ mk_error_response(krb5_context context,
msg = freeme0;
va_end(ap);
if (!config->enable_kx509 &&
if (!reqctx->config->enable_kx509 &&
asprintf(&freeme1, "kx509 service is disabled (%s)", msg) > -1 &&
freeme1 != NULL) {
msg = freeme1;
}
kdc_log(context, config, 0, "%s", msg);
kdc_log(context, reqctx->config, 0, "%s", msg);
rep.hash = NULL;
rep.certificate = NULL;
@@ -750,15 +868,15 @@ mk_error_response(krb5_context context,
if (ALLOC(rep.e_text))
*rep.e_text = (void *)(uintptr_t)msg;
if (key) {
if (reqctx->key) {
if (ALLOC(rep.hash) != NULL &&
calculate_reply_hash(context, key, &rep)) {
calculate_reply_hash(context, reqctx->key, &rep)) {
free(rep.hash);
rep.hash = NULL;
}
}
if ((ret2 = encode_reply(context, config, reply, &rep)))
if ((ret2 = encode_reply(context, reqctx, &rep)))
ret = ret2;
if (rep.hash)
krb5_data_free(rep.hash);
@@ -769,6 +887,159 @@ mk_error_response(krb5_context context,
return ret;
}
/* Wrap a bare public (RSA) key with a CSR (not signed it, since we can't) */
static krb5_error_code
make_csr(krb5_context context, kx509_req_context reqctx, krb5_data *key)
{
krb5_error_code ret;
SubjectPublicKeyInfo spki;
heim_any any;
ret = hx509_request_init(context->hx509ctx, &reqctx->csr);
if (ret)
return ret;
memset(&spki, 0, sizeof(spki));
spki.subjectPublicKey.data = key->data;
spki.subjectPublicKey.length = key->length * 8;
ret = der_copy_oid(&asn1_oid_id_pkcs1_rsaEncryption,
&spki.algorithm.algorithm);
any.data = "\x05\x00";
any.length = 2;
spki.algorithm.parameters = &any;
if (ret == 0)
ret = hx509_request_set_SubjectPublicKeyInfo(context->hx509ctx,
reqctx->csr, &spki);
der_free_oid(&spki.algorithm.algorithm);
if (ret)
hx509_request_free(&reqctx->csr);
/*
* TODO: Move a lot of the templating stuff here so we can let clients
* leave out extensions they don't want.
*/
return ret;
}
/* Update a CSR with desired Certificate Extensions */
static krb5_error_code
update_csr(krb5_context context, kx509_req_context reqctx, Extensions *exts)
{
krb5_error_code ret = 0;
size_t i, k;
if (exts == NULL)
return 0;
for (i = 0; ret == 0 && i < exts->len; i++) {
Extension *e = &exts->val[i];
if (der_heim_oid_cmp(&e->extnID, &asn1_oid_id_x509_ce_keyUsage) == 0) {
KeyUsage ku;
ret = decode_KeyUsage(e->extnValue.data, e->extnValue.length, &ku,
NULL);
if (ret)
return ret;
ret = hx509_request_set_ku(context->hx509ctx, reqctx->csr, ku);
} else if (der_heim_oid_cmp(&e->extnID,
&asn1_oid_id_x509_ce_extKeyUsage) == 0) {
ExtKeyUsage eku;
ret = decode_ExtKeyUsage(e->extnValue.data, e->extnValue.length,
&eku, NULL);
for (k = 0; ret == 0 && k < eku.len; k++) {
ret = hx509_request_add_eku(context->hx509ctx, reqctx->csr,
&eku.val[k]);
}
free_ExtKeyUsage(&eku);
} else if (der_heim_oid_cmp(&e->extnID,
&asn1_oid_id_x509_ce_subjectAltName) == 0) {
GeneralNames san;
ret = decode_GeneralNames(e->extnValue.data, e->extnValue.length,
&san, NULL);
for (k = 0; ret == 0 && k < san.len; k++)
ret = hx509_request_add_GeneralName(context->hx509ctx,
reqctx->csr, &san.val[k]);
free_GeneralNames(&san);
}
}
if (ret)
kx509_log(context, reqctx, 0,
"request has bad desired certificate extensions");
return ret;
}
/*
* Parse the `pk_key' from the request as a CSR or raw public key, and if the
* latter, wrap it in a non-signed CSR.
*/
static krb5_error_code
get_csr(krb5_context context, kx509_req_context reqctx)
{
krb5_error_code ret;
RSAPublicKey rsapkey;
heim_octet_string pk_key = reqctx->req->pk_key;
size_t size;
ret = decode_Kx509CSRPlus(pk_key.data, pk_key.length, &reqctx->csr_plus,
&size);
if (ret == 0) {
reqctx->send_chain = 1;
if (reqctx->csr_plus.authz_datas.len)
reqctx->have_auth_data = 1;
/* Parse CSR */
ret = hx509_request_parse_der(context->hx509ctx, &reqctx->csr_plus.csr,
&reqctx->csr);
if (ret)
kx509_log(context, reqctx, 0, "invalid CSR");
/*
* Handle any additional Certificate Extensions requested out of band
* of the CSR.
*/
if (ret == 0)
return update_csr(context, reqctx, reqctx->csr_plus.exts);
return ret;
}
reqctx->send_chain = 0;
/* Check if proof of possession is required by configuration */
if (!get_bool_param(context, FALSE, reqctx->realm, "require_csr"))
return mk_error_response(context, reqctx, KX509_STATUS_CLIENT_USE_CSR,
"CSRs required but client did not send one");
/* Attempt to decode pk_key as RSAPublicKey */
ret = decode_RSAPublicKey(reqctx->req->pk_key.data,
reqctx->req->pk_key.length,
&rsapkey, &size);
free_RSAPublicKey(&rsapkey);
if (ret == 0 && size == reqctx->req->pk_key.length)
return make_csr(context, reqctx, &pk_key); /* Make pretend CSR */
/* Not an RSAPublicKey or garbage follows it */
if (ret == 0)
kx509_log(context, reqctx, 0, "request has garbage after key");
return mk_error_response(context, reqctx, KRB5KDC_ERR_NULL_KEY,
"Could not decode CSR or RSA subject public key");
}
/* Stub for later work */
static krb5_error_code
verify_auth_data(krb5_context context,
struct kx509_req_context *reqctx,
krb5_principal cprincipal,
krb5_principal *actual_cprincipal)
{
return EACCES;
}
/*
* Process a request, produce a reply.
*/
@@ -782,13 +1053,29 @@ _kdc_do_kx509(krb5_context context,
krb5_error_code ret;
krb5_ticket *ticket = NULL;
krb5_flags ap_req_options;
krb5_auth_context ac = NULL;
krb5_principal actual_cprincipal = NULL;
krb5_principal cprincipal = NULL;
krb5_principal sprincipal = NULL;
krb5_keytab id = NULL;
krb5_principal sprincipal = NULL, cprincipal = NULL;
char *sname = NULL;
char *cname = NULL;
Kx509Response rep;
krb5_keyblock *key = NULL;
struct kx509_req_context reqctx;
int is_probe = 0;
memset(&reqctx, 0, sizeof(reqctx));
reqctx.csr_plus.authz_datas.val = NULL;
reqctx.csr_plus.csr.data = NULL;
reqctx.csr_plus.exts = NULL;
reqctx.config = config;
reqctx.sname = NULL;
reqctx.cname = NULL;
reqctx.realm = NULL;
reqctx.reply = reply;
reqctx.from = from;
reqctx.addr = addr;
reqctx.key = NULL;
reqctx.csr = NULL;
reqctx.req = req;
reqctx.ac = NULL;
/*
* In order to support authenticated error messages we defer checking
@@ -798,7 +1085,6 @@ _kdc_do_kx509(krb5_context context,
krb5_data_zero(reply);
memset(&rep, 0, sizeof(rep));
kdc_log(context, config, 0, "Kx509 request from %s", from);
if (req->authenticator.length == 0) {
/*
@@ -807,8 +1093,9 @@ _kdc_do_kx509(krb5_context context,
* mk_error_response() will check whether the service is enabled and
* possibly change the error code and message.
*/
ret = mk_error_response(context, config, key, reply,
KRB5KDC_ERR_NULL_KEY,
is_probe = 1;
kx509_log(context, &reqctx, 0, "unauthenticated probe request");
ret = mk_error_response(context, &reqctx, KRB5KDC_ERR_NULL_KEY,
"kx509 service is available");
goto out;
}
@@ -816,22 +1103,22 @@ _kdc_do_kx509(krb5_context context,
/* Consume the AP-REQ */
ret = krb5_kt_resolve(context, "HDBGET:", &id);
if (ret) {
mk_error_response(context, config, key, reply,
KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN,
"Can't open database for digest");
ret = mk_error_response(context, &reqctx,
KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN,
"Can't open HDB/keytab for kx509");
goto out;
}
ret = krb5_rd_req(context,
&ac,
&reqctx.ac,
&req->authenticator,
NULL,
id,
&ap_req_options,
&ticket);
if (ret == 0)
ret = krb5_auth_con_getkey(context, ac, &key);
if (ret == 0 && key == NULL)
ret = krb5_auth_con_getkey(context, reqctx.ac, &reqctx.key);
if (ret == 0 && reqctx.key == NULL)
ret = KRB5KDC_ERR_NULL_KEY;
/*
* Provided we got the session key, errors past this point will be
@@ -840,9 +1127,8 @@ _kdc_do_kx509(krb5_context context,
if (ret == 0)
ret = krb5_ticket_get_client(context, ticket, &cprincipal);
if (ret) {
mk_error_response(context, config, key, reply, ret,
"Could not get Ticket client principal from %s",
from);
ret = mk_error_response(context, &reqctx, ret,
"authentication failed");
goto out;
}
@@ -852,40 +1138,34 @@ _kdc_do_kx509(krb5_context context,
!get_bool_param(context, TRUE,
krb5_principal_get_realm(context, cprincipal),
"require_initial_kca_tickets")) {
ret = mk_error_response(context, config, key, reply,
KRB5KDC_ERR_POLICY, /* XXX */
"kx509 client %s used non-INITIAL tickets, "
"but kx509 service is configured to require "
"INITIAL tickets", from);
ret = mk_error_response(context, &reqctx, KRB5KDC_ERR_POLICY, /* XXX */
"client used non-INITIAL tickets, but kx509"
"kx509 service is configured to require "
"INITIAL tickets");
goto out;
}
ret = krb5_unparse_name(context, cprincipal, &cname);
ret = krb5_unparse_name(context, cprincipal, &reqctx.cname);
/* Check that the service name is a valid kx509 service name */
if (ret == 0)
ret = krb5_ticket_get_server(context, ticket, &sprincipal);
if (ret == 0)
ret = krb5_unparse_name(context, sprincipal, &sname);
reqctx.realm = krb5_principal_get_realm(context, sprincipal);
if (ret == 0)
ret = krb5_unparse_name(context, sprincipal, &reqctx.sname);
if (ret == 0)
ret = kdc_kx509_verify_service_principal(context, config, cname,
sprincipal);
ret = kdc_kx509_verify_service_principal(context, &reqctx, sprincipal);
if (ret) {
mk_error_response(context, config, key, reply, ret, "kx509 client %s from "
"%s used incorrect service name (%s) for kx509 "
"service",
cname ? cname : "<could not unparse>", from,
sname ? sname : "<could not unparse>");
mk_error_response(context, &reqctx, ret,
"client used incorrect service name");
goto out;
}
/* Authenticate the rest of the request */
ret = verify_req_hash(context, req, key);
ret = verify_req_hash(context, req, reqctx.key);
if (ret) {
mk_error_response(context, config, key, reply, ret, "Incorrect HMAC "
"for kx509 request for client %s from %s for %s",
cname, from, sname);
mk_error_response(context, &reqctx, ret, "Incorrect request HMAC");
goto out;
}
@@ -896,35 +1176,23 @@ _kdc_do_kx509(krb5_context context,
* mk_error_response() will check whether the service is enabled and
* possibly change the error code and message.
*/
ret = mk_error_response(context, config, key, reply, 0,
"kx509 probe request");
is_probe = 1;
ret = mk_error_response(context, &reqctx, 0,
"kx509 authenticated probe request");
goto out;
}
/*
* Verify that the key is a DER-encoded RSA key
*
* TODO: Try decoding `req->pk_key' as a DER-encoded CSR, or as a
* DER-encoded Certificate (and check that the subject key signed the
* thing).
*
* That will add proof-of-possesion.
*
* That will also add algorithm agility.
*/
{
RSAPublicKey rsapkey;
size_t rsapkeysize;
/* Extract and parse CSR or a DER-encoded RSA public key */
ret = get_csr(context, &reqctx);
if (ret)
goto out;
ret = decode_RSAPublicKey(req->pk_key.data, req->pk_key.length,
&rsapkey, &rsapkeysize);
free_RSAPublicKey(&rsapkey);
if (ret || rsapkeysize != req->pk_key.length) {
ret = KRB5KDC_ERR_NULL_KEY;
mk_error_response(context, config, key, reply, ret,
"Could not decode RSA subject public key for "
"kx509 client %s from %s for %s", cname, from,
sname);
if (reqctx.have_auth_data) {
ret = verify_auth_data(context, &reqctx, cprincipal,
&actual_cprincipal);
if (ret) {
ret = mk_error_response(context, &reqctx, ret,
"authorization data validation failure");
goto out;
}
}
@@ -932,49 +1200,44 @@ _kdc_do_kx509(krb5_context context,
ALLOC(rep.hash);
ALLOC(rep.certificate);
if (rep.certificate == NULL || rep.hash == NULL) {
ret = mk_error_response(context, config, key, reply, ENOMEM,
"Could allocate memory for response for kx509 "
"client %s from %s for %s",
cname, from, sname);
ret = mk_error_response(context, &reqctx, ENOMEM,
"could allocate memory for response");
goto out;
}
/* Issue the certificate */
krb5_data_zero(rep.hash);
krb5_data_zero(rep.certificate);
ret = build_certificate(context, config, &req->pk_key,
ret = build_certificate(context, &reqctx,
krb5_ticket_get_endtime(context, ticket),
cprincipal, rep.certificate);
actual_cprincipal ? actual_cprincipal : cprincipal,
rep.certificate);
if (ret) {
mk_error_response(context, config, key, reply, ret, "Failed to build "
"certificate for kx509 client %s from %s for %s",
cname, from, sname);
mk_error_response(context, &reqctx, ret, "Failed to build certificate");
goto out;
}
/* Authenticate the response */
ret = calculate_reply_hash(context, key, &rep);
ret = calculate_reply_hash(context, reqctx.key, &rep);
if (ret) {
mk_error_response(context, config, key, reply, ret, "Failed to HMAC "
"certificate for kx509 client %s from %s for %s",
cname, from, sname);
mk_error_response(context, &reqctx, ret,
"Failed to compute response HMAC");
goto out;
}
/* Encode and output reply */
ret = encode_reply(context, config, reply, &rep);
ret = encode_reply(context, &reqctx, &rep);
if (ret)
mk_error_response(context, config, key, reply, ret, "Could not encode "
"kx509 response to client %s from %s for %s", cname,
from, sname);
/* Can't send an error message either in this case, surely */
kx509_log(context, &reqctx, 0, "Could not encode response");
out:
if (ret == 0)
kdc_log(context, config, 0, "Successful Kx509 request for %s", cname);
if (ac)
krb5_auth_con_free(context, ac);
if (ret)
krb5_warn(context, ret, "Kx509 request from %s failed", from);
if (ret == 0 && !is_probe)
kx509_log(context, &reqctx, 0, "Issued certificate");
else
kx509_log(context, &reqctx, 0, "Did not issue certificate");
if (reqctx.ac)
krb5_auth_con_free(context, reqctx.ac);
if (ticket)
krb5_free_ticket(context, ticket);
if (id)
@@ -983,12 +1246,16 @@ out:
krb5_free_principal(context, sprincipal);
if (cprincipal)
krb5_free_principal(context, cprincipal);
if (key)
krb5_free_keyblock (context, key);
if (sname)
free(sname);
if (cname)
free(cname);
if (actual_cprincipal)
krb5_free_principal(context, actual_cprincipal);
if (reqctx.key)
krb5_free_keyblock (context, reqctx.key);
if (reqctx.sname)
free(reqctx.sname);
if (reqctx.cname)
free(reqctx.cname);
hx509_request_free(&reqctx.csr);
free_Kx509CSRPlus(&reqctx.csr_plus);
free_Kx509Response(&rep);
return ret;