598 lines
16 KiB
C
598 lines
16 KiB
C
/*
|
|
* Copyright (c) 2022 Kungliga Tekniska Högskolan
|
|
* (Royal Institute of Technology, Stockholm, Sweden).
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
*
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
*
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
*
|
|
* 3. Neither the name of the Institute nor the names of its contributors
|
|
* may be used to endorse or promote products derived from this software
|
|
* without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*/
|
|
#include "kdc_locl.h"
|
|
#include <heim-ipc.h>
|
|
|
|
/*
|
|
* This program implements two things:
|
|
*
|
|
* - a utility for testing the `kdc_authorize_csr()' function and the plugins
|
|
* that uses,
|
|
*
|
|
* and
|
|
*
|
|
* - a server for the IPC authorizer.
|
|
*
|
|
* For the latter, requested certificate SANs and EKUs are authorized by
|
|
* checking for existence of files of the form:
|
|
*
|
|
* /<path>/<princ>/<ext>-<value>
|
|
*
|
|
* where <path> is given as an option.
|
|
*
|
|
* <princ> is a requesting client principal name with all characters other than
|
|
* alphanumeric, '-', '_', and non-leading '.' URL-encoded.
|
|
*
|
|
* <ext> is one of:
|
|
*
|
|
* - pkinit (SAN)
|
|
* - xmpp (SAN)
|
|
* - email (SAN)
|
|
* - ms-upn (SAN)
|
|
* - dnsname (SAN)
|
|
* - eku (EKU OID)
|
|
*
|
|
* and <value> is a display form of the SAN or EKU OID, with SANs URL-encoded
|
|
* just like principal names (see above).
|
|
*
|
|
* OIDs are of the form "1.2.3.4.5".
|
|
*
|
|
* Only digitalSignature and nonRepudiation key usage values are permitted.
|
|
*/
|
|
|
|
static int help_flag;
|
|
static int version_flag;
|
|
static int daemon_flag;
|
|
static int daemon_child_flag = -1;
|
|
static int ignore_flag = 0;
|
|
static int server_flag = 0;
|
|
static const char *app_string = "kdc";
|
|
static const char *socket_dir;
|
|
static const char *authz_dir;
|
|
|
|
struct getargs args[] = {
|
|
{ "help", 'h', arg_flag, &help_flag,
|
|
"Print usage message", NULL },
|
|
{ "version", 'v', arg_flag, &version_flag,
|
|
"Print version", NULL },
|
|
{ "app", 'a', arg_string, &app_string,
|
|
"App to test (kdc or bx509); default: kdc", "APPNAME" },
|
|
{ "socket-dir", 'S', arg_string, &socket_dir,
|
|
"IPC socket directory", "DIR" },
|
|
{ "authorization-dir", 'A', arg_string, &authz_dir,
|
|
"authorization directory", "DIR" },
|
|
{ "server", '\0', arg_flag, &server_flag,
|
|
"Server mode", NULL },
|
|
{ "ignore", 'I', arg_flag, &ignore_flag,
|
|
"ignore requests", NULL },
|
|
{ "daemon", 'd', arg_flag, &daemon_flag,
|
|
"daemonize", NULL },
|
|
{ "daemon-child", '\0', arg_flag, &daemon_child_flag,
|
|
"internal-use-only option", NULL },
|
|
};
|
|
size_t num_args = sizeof(args) / sizeof(args[0]);
|
|
|
|
static int
|
|
usage(int e)
|
|
{
|
|
arg_printusage(args, num_args, NULL, "PATH-TO-DER-CSR PRINCIPAL");
|
|
fprintf(stderr,
|
|
"\tExercise CSR authorization plugins for a given CSR for a\n"
|
|
"\tgiven principal.\n\n"
|
|
"\tServer-mode (--server) looks for files in the \n"
|
|
"\t--authorization-dir DIR directory named:\n"
|
|
"\n"
|
|
"\t\teku=OID\n"
|
|
"\t\tsan_pkinit=PRINCIPAL\n"
|
|
"\t\tsan_ms_upn=PRINCIPAL\n"
|
|
"\t\tsan_dnsname=DOMAINNAME\n"
|
|
"\t\tsan_xmpp=JABBER-ID\n"
|
|
"\t\tsan_email=EMAIL\n"
|
|
"\n"
|
|
"\tClient-mode positional arguments are:\n\n"
|
|
"\t\tPATH-TO-DER-CSR PRETEND-CLIENT-PRINCIPAL [...]\n\n"
|
|
"\twhere {...} are requested features that must be granted\n"
|
|
"\tif the request is only partially authorized.\n\n"
|
|
"\tClient example:\n\t\t%s PKCS10:/tmp/csr.der foo@TEST.H5L.SE\n",
|
|
getprogname());
|
|
exit(e);
|
|
return e;
|
|
}
|
|
|
|
static const char *sysplugin_dirs[] = {
|
|
#ifdef _WIN32
|
|
"$ORIGIN",
|
|
#else
|
|
"$ORIGIN/../lib/plugin/kdc",
|
|
#endif
|
|
#ifdef __APPLE__
|
|
LIBDIR "/plugin/kdc",
|
|
#endif
|
|
NULL
|
|
};
|
|
|
|
static void
|
|
load_plugins(krb5_context context)
|
|
{
|
|
const char * const *dirs = sysplugin_dirs;
|
|
#ifndef _WIN32
|
|
char **cfdirs;
|
|
|
|
cfdirs = krb5_config_get_strings(context, NULL, "kdc", "plugin_dir", NULL);
|
|
if (cfdirs)
|
|
dirs = (const char * const *)cfdirs;
|
|
#endif
|
|
|
|
_krb5_load_plugins(context, "kdc", (const char **)dirs);
|
|
|
|
#ifndef _WIN32
|
|
krb5_config_free_strings(cfdirs);
|
|
#endif
|
|
}
|
|
|
|
static char *string_encode(const char *);
|
|
static int stat_authz(const char *, const char *);
|
|
|
|
static krb5_error_code
|
|
authorize(const char *subject, const char *thing)
|
|
{
|
|
krb5_error_code ret;
|
|
char *s = NULL;
|
|
|
|
s = string_encode(subject);
|
|
if (s == NULL)
|
|
return ENOMEM;
|
|
|
|
ret = stat_authz(s, thing);
|
|
if (ret == ENOENT)
|
|
ret = stat_authz(s, "all");
|
|
if (ret == ENOENT)
|
|
ret = EACCES;
|
|
free(s);
|
|
return ret;
|
|
}
|
|
|
|
static void
|
|
service(void *ctx,
|
|
const heim_octet_string *req,
|
|
const heim_icred cred,
|
|
heim_ipc_complete complete_cb,
|
|
heim_sipc_call complete_cb_data)
|
|
{
|
|
krb5_error_code ret = 0;
|
|
struct rk_strpool *result = NULL;
|
|
krb5_data rep;
|
|
const char *subject;
|
|
char *cmd;
|
|
char *next = NULL;
|
|
char *res = NULL;
|
|
char *tok;
|
|
char *s;
|
|
int none_granted = 1;
|
|
int all_granted = 1;
|
|
int first = 1;
|
|
|
|
/*
|
|
* A krb5_context and log facility for logging would be nice, but this is
|
|
* all just for testing.
|
|
*/
|
|
|
|
(void)ctx;
|
|
|
|
cmd = strndup(req->data, req->length);
|
|
if (cmd == NULL)
|
|
errx(1, "Out of memory");
|
|
|
|
if (strncmp(cmd, "check ", sizeof("check ") - 1) != 0) {
|
|
rep.data = "Invalid request command (must be \"check ...\")";
|
|
rep.length = sizeof("Invalid request command (must be \"check ...\")") - 1;
|
|
(*complete_cb)(complete_cb_data, EINVAL, &rep);
|
|
free(cmd);
|
|
return;
|
|
}
|
|
|
|
s = cmd + sizeof("check ") - 1;
|
|
subject = strtok_r(s, " ", &next);
|
|
s = NULL;
|
|
|
|
while ((tok = strtok_r(s, " ", &next))) {
|
|
int ret2;
|
|
|
|
ret2 = authorize(subject, tok);
|
|
result = rk_strpoolprintf(result, "%s%s:%s",
|
|
first ? "" : ",",
|
|
tok,
|
|
ret2 == 0 ? "granted" : "denied");
|
|
if (ret2 == 0)
|
|
none_granted = 0;
|
|
else
|
|
all_granted = 0;
|
|
|
|
if (ret2 != 0 && ret == 0)
|
|
ret = ret2;
|
|
|
|
first = 0;
|
|
}
|
|
free(cmd);
|
|
|
|
if (ret == 0 && all_granted) {
|
|
rk_strpoolfree(result);
|
|
|
|
rep.data = "granted";
|
|
rep.length = sizeof("granted") - 1;
|
|
(*complete_cb)(complete_cb_data, 0, &rep);
|
|
return;
|
|
}
|
|
|
|
if (none_granted && ignore_flag) {
|
|
rk_strpoolfree(result);
|
|
|
|
rep.data = "ignore";
|
|
rep.length = sizeof("ignore") - 1;
|
|
(*complete_cb)(complete_cb_data, KRB5_PLUGIN_NO_HANDLE, &rep);
|
|
return;
|
|
}
|
|
|
|
s = rk_strpoolcollect(result); /* frees `result' */
|
|
if (s == NULL) {
|
|
rep.data = "denied out-of-memory";
|
|
rep.length = sizeof("denied out-of-memory") - 1;
|
|
(*complete_cb)(complete_cb_data, KRB5_PLUGIN_NO_HANDLE, &rep);
|
|
return;
|
|
}
|
|
|
|
if (asprintf(&res, "denied %s", s) == -1)
|
|
errx(1, "Out of memory");
|
|
if (res == NULL)
|
|
errx(1, "Out of memory");
|
|
|
|
rep.data = res;
|
|
rep.length = strlen(res);
|
|
|
|
(*complete_cb)(complete_cb_data, ret, &rep);
|
|
free(res);
|
|
free(s);
|
|
}
|
|
|
|
static char *
|
|
make_feature_argument(const char *kind,
|
|
hx509_san_type san_type,
|
|
const char *value)
|
|
{
|
|
const char *san_type_str = NULL;
|
|
char *s = NULL;
|
|
|
|
if (strcmp(kind, "san") != 0) {
|
|
if (asprintf(&s, "%s=%s", kind, value) == -1 || s == NULL)
|
|
errx(1, "Out of memory");
|
|
return s;
|
|
}
|
|
|
|
switch (san_type) {
|
|
case HX509_SAN_TYPE_EMAIL:
|
|
san_type_str = "email";
|
|
break;
|
|
case HX509_SAN_TYPE_DNSNAME:
|
|
san_type_str = "dnsname";
|
|
break;
|
|
case HX509_SAN_TYPE_DN:
|
|
san_type_str = "dn";
|
|
break;
|
|
case HX509_SAN_TYPE_REGISTERED_ID:
|
|
san_type_str = "registered_id";
|
|
break;
|
|
case HX509_SAN_TYPE_XMPP:
|
|
san_type_str = "xmpp";
|
|
break;
|
|
case HX509_SAN_TYPE_PKINIT:
|
|
case HX509_SAN_TYPE_MS_UPN:
|
|
san_type_str = "pkinit";
|
|
break;
|
|
case HX509_SAN_TYPE_DNSSRV:
|
|
san_type_str = "dnssrv";
|
|
break;
|
|
default:
|
|
warnx("SAN type not supported");
|
|
return "";
|
|
}
|
|
|
|
if (asprintf(&s, "san_%s=%s", san_type_str, value) == -1 || s == NULL)
|
|
errx(1, "Out of memory");
|
|
return s;
|
|
}
|
|
|
|
int
|
|
main(int argc, char **argv)
|
|
{
|
|
krb5_log_facility *logf;
|
|
krb5_error_code ret;
|
|
krb5_context context;
|
|
hx509_request csr;
|
|
krb5_principal princ = NULL;
|
|
const char *argv0 = argv[0];
|
|
int optidx = 0;
|
|
|
|
setprogname(argv[0]);
|
|
if (getarg(args, num_args, argc, argv, &optidx))
|
|
return usage(1);
|
|
if (help_flag)
|
|
return usage(0);
|
|
if (version_flag) {
|
|
print_version(argv[0]);
|
|
return 0;
|
|
}
|
|
|
|
if ((errno = krb5_init_context(&context)))
|
|
err(1, "Could not initialize krb5_context");
|
|
if ((ret = krb5_initlog(context, argv0, &logf)) ||
|
|
(ret = krb5_addlog_dest(context, logf, "0-5/STDERR")))
|
|
krb5_err(context, 1, ret, "Could not set up logging to stderr");
|
|
load_plugins(context);
|
|
|
|
if (server_flag && daemon_flag)
|
|
daemon_child_flag = roken_detach_prep(argc, argv, "--daemon-child");
|
|
|
|
argc -= optidx;
|
|
argv += optidx;
|
|
|
|
if (socket_dir)
|
|
setenv("HEIM_IPC_DIR", socket_dir, 1);
|
|
|
|
if (server_flag) {
|
|
const char *svc;
|
|
heim_sipc un;
|
|
|
|
rk_pidfile(NULL);
|
|
|
|
svc = krb5_config_get_string(context, NULL,
|
|
app_string ? app_string : "kdc",
|
|
"ipc_csr_authorizer", "service", NULL);
|
|
if (svc == NULL)
|
|
svc = "org.h5l.csr_authorizer";
|
|
|
|
/* `service' is our request handler; `argv' is its callback data */
|
|
ret = heim_sipc_service_unix(svc, service, NULL, &un);
|
|
if (ret)
|
|
krb5_err(context, 1, ret,
|
|
"Could not setup service on Unix domain socket "
|
|
"%s/.heim_%s-socket", socket_dir, svc);
|
|
|
|
roken_detach_finish(NULL, daemon_child_flag);
|
|
|
|
/* Enter the IPC event loop */
|
|
heim_ipc_main();
|
|
return 0;
|
|
}
|
|
|
|
/* Client mode */
|
|
if (argc < 2)
|
|
usage(1);
|
|
|
|
/* Parse the given CSR */
|
|
if ((ret = hx509_request_parse(context->hx509ctx, argv[0], &csr)))
|
|
krb5_err(context, 1, ret, "Could not parse PKCS#10 CSR from %s", argv[0]);
|
|
|
|
/*
|
|
* Parse the client principal that we'll pretend is an authenticated client
|
|
* principal.
|
|
*/
|
|
if ((ret = krb5_parse_name(context, argv[1], &princ)))
|
|
krb5_err(context, 1, ret, "Could not parse principal %s", argv[1]);
|
|
|
|
/* Call the authorizer */
|
|
ret = kdc_authorize_csr(context, app_string, csr, princ);
|
|
|
|
if (ret) {
|
|
unsigned n = hx509_request_count_unauthorized(csr);
|
|
size_t i, k;
|
|
int ret2 = 0;
|
|
int good = -1;
|
|
|
|
/*
|
|
* Check partial approval of SANs.
|
|
*
|
|
* Iterate over the SANs in the request, and for each check if a) it
|
|
* was granted, b) it's on the remainder of our argv[].
|
|
*/
|
|
for (i = 0; ret2 == 0; i++) {
|
|
hx509_san_type san_type;
|
|
char *feature = NULL;
|
|
char *san = NULL;
|
|
int granted;
|
|
|
|
ret2 = hx509_request_get_san(csr, i, &san_type, &san);
|
|
if (ret2)
|
|
break;
|
|
|
|
feature = make_feature_argument("san", san_type, san);
|
|
|
|
granted = hx509_request_san_authorized_p(csr, i);
|
|
for (k = 2; k < argc; k++) {
|
|
if (strcmp(feature, argv[k]) != 0)
|
|
continue;
|
|
|
|
/* The SAN is on our command line */
|
|
if (granted && good == -1)
|
|
good = 1;
|
|
else if (!granted)
|
|
good = 0;
|
|
break;
|
|
}
|
|
|
|
hx509_xfree(san);
|
|
}
|
|
|
|
/* Check partial approval of EKUs */
|
|
for (i = 0; ret2 == 0; i++) {
|
|
char *feature = NULL;
|
|
char *eku = NULL;
|
|
int granted;
|
|
|
|
ret2 = hx509_request_get_eku(csr, i, &eku);
|
|
if (ret2)
|
|
break;
|
|
|
|
feature = make_feature_argument("eku", 0, eku);
|
|
|
|
granted = hx509_request_eku_authorized_p(csr, i);
|
|
for (k = 2; k < argc; k++) {
|
|
if (strcmp(feature, argv[k]) != 0)
|
|
continue;
|
|
|
|
/* The SAN is on our command line */
|
|
if (granted && good == -1)
|
|
good = 1;
|
|
else if (!granted)
|
|
good = 0;
|
|
break;
|
|
}
|
|
|
|
hx509_xfree(eku);
|
|
}
|
|
|
|
if (good != 1) {
|
|
krb5_free_principal(context, princ);
|
|
_krb5_unload_plugins(context, "kdc");
|
|
hx509_request_free(&csr);
|
|
krb5_err(context, 1, ret,
|
|
"Authorization failed with %u rejected features", n);
|
|
}
|
|
}
|
|
|
|
printf("Authorized!\n");
|
|
krb5_free_principal(context, princ);
|
|
_krb5_unload_plugins(context, "kdc");
|
|
krb5_free_context(context);
|
|
hx509_request_free(&csr);
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* string_encode_sz() and string_encode() encode a string to be safe for use as
|
|
* a file name. They function very much like URL encoders, but '~' also gets
|
|
* encoded, and '@', '-', '_', and non-leading '.' do not.
|
|
*
|
|
* A corresponding decoder is not needed.
|
|
*/
|
|
static size_t
|
|
string_encode_sz(const char *in)
|
|
{
|
|
size_t sz = strlen(in);
|
|
int first = 1;
|
|
|
|
while (*in) {
|
|
char c = *(in++);
|
|
|
|
switch (c) {
|
|
case '@':
|
|
case '-':
|
|
case '_':
|
|
break;
|
|
case '.':
|
|
if (first)
|
|
sz += 2;
|
|
break;
|
|
default:
|
|
if (!isalnum(c))
|
|
sz += 2;
|
|
}
|
|
first = 0;
|
|
}
|
|
return sz;
|
|
}
|
|
|
|
static char *
|
|
string_encode(const char *in)
|
|
{
|
|
size_t len = strlen(in);
|
|
size_t sz = string_encode_sz(in);
|
|
size_t i, k;
|
|
char *s;
|
|
int first = 1;
|
|
|
|
if ((s = malloc(sz + 1)) == NULL)
|
|
return NULL;
|
|
s[sz] = '\0';
|
|
|
|
for (i = k = 0; i < len; i++, first = 0) {
|
|
unsigned char c = ((const unsigned char *)in)[i];
|
|
|
|
switch (c) {
|
|
case '@':
|
|
case '-':
|
|
case '_':
|
|
s[k++] = c;
|
|
break;
|
|
case '.':
|
|
if (first) {
|
|
s[k++] = '%';
|
|
s[k++] = "0123456789abcdef"[(c&0xff)>>4];
|
|
s[k++] = "0123456789abcdef"[(c&0x0f)];
|
|
} else {
|
|
s[k++] = c;
|
|
}
|
|
break;
|
|
default:
|
|
if (isalnum(c)) {
|
|
s[k++] = c;
|
|
} else {
|
|
s[k++] = '%';
|
|
s[k++] = "0123456789abcdef"[(c&0xff)>>4];
|
|
s[k++] = "0123456789abcdef"[(c&0x0f)];
|
|
}
|
|
}
|
|
}
|
|
return s;
|
|
}
|
|
|
|
static int
|
|
stat_authz(const char *subject,
|
|
const char *thing)
|
|
{
|
|
struct stat st;
|
|
char *p = NULL;
|
|
int ret;
|
|
|
|
if (authz_dir == NULL)
|
|
return KRB5_PLUGIN_NO_HANDLE;
|
|
if (thing)
|
|
ret = asprintf(&p, "%s/%s/%s", authz_dir, subject, thing);
|
|
else
|
|
ret = asprintf(&p, "%s/%s", authz_dir, subject);
|
|
if (ret == -1 || p == NULL)
|
|
return ENOMEM;
|
|
ret = stat(p, &st);
|
|
free(p);
|
|
return ret == 0 ? 0 : errno;
|
|
}
|