kdc/simple_csr_authorizer.c

   1 /*
   2  * Copyright (c) 2019 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 /*
  35  * This plugin authorizes requested certificate SANs and EKUs by checking for
  36  * existence of files of the form:
  37  *
  38  *
  39  *      /<path>/<princ>/<ext>-<value>
  40  *
  41  * where <path> is the value of:
  42  *
  43  *      [kdc] simple_csr_authorizer_directory = PATH
  44  *
  45  * <princ> is a requesting client principal name with all characters other than
  46  * alphanumeric, '-', '_', and non-leading '.' URL-encoded.
  47  *
  48  * <ext> is one of:
  49  *
  50  *  - pkinit        (SAN)
  51  *  - xmpt          (SAN)
  52  *  - emailt        (SAN)
  53  *  - ms-upt        (SAN)
  54  *  - dnsnamt       (SAN)
  55  *  - eku           (EKU OID)
  56  *
  57  * and <value> is a display form of the SAN or EKU OID, with SANs URL-encoded
  58  * just like principal names (see above).
  59  *
  60  * OIDs are of the form "1.2.3.4.5".
  61  *
  62  * Only digitalSignature and nonRepudiation key usage values are permitted.
  63  */
  64 #define _GNU_SOURCE 1
  65
  66 #include <sys/types.h>
  67 #include <sys/stat.h>
  68 #include <ctype.h>
  69 #include <errno.h>
  70 #include <stdlib.h>
  71 #include <stdio.h>
  72 #include <string.h>
  73 #include <unistd.h>
  74
  75 #include <roken.h>
  76 #include <krb5.h>
  77 #include <hx509.h>
  78 #include <kdc.h>
  79 #include <common_plugin.h>
  80 #include <csr_authorizer_plugin.h>
  81
  82 /*
  83  * string_encode_sz() and string_encode() encode a string to be safe for use as
  84  * a file name.  They function very much like URL encoders, but '~' also gets
  85  * encoded, and '@', '-', '_', and non-leading '.' do not.
  86  *
  87  * A corresponding decoder is not needed.
  88  */
  89 static size_t
  90 string_encode_sz(const char *in)
  91 {
  92     size_t sz = strlen(in);
  93     int first = 1;
  94
  95     while (*in) {
  96         char c = *(in++);
  97
  98         switch (c) {
  99         case '@':
 100         case '-':
 101         case '_':
 102             break;
 103         case '.':
 104             if (first)
 105                 sz += 2;
 106             break;
 107         default:
 108             if (!isalnum(c))
 109                 sz += 2;
 110         }
 111         first = 0;
 112     }
 113     return sz;
 114 }
 115
 116 static char *
 117 string_encode(const char *in)
 118 {
 119     size_t len = strlen(in);
 120     size_t sz = string_encode_sz(in);
 121     size_t i, k;
 122     char *s;
 123     int first = 1;
 124
 125     if ((s = malloc(sz + 1)) == NULL)
 126         return NULL;
 127     s[sz] = '\0';
 128
 129     for (i = k = 0; i < len; i++, first = 0) {
 130         unsigned char c = ((const unsigned char *)in)[i];
 131
 132         switch (c) {
 133         case '@':
 134         case '-':
 135         case '_':
 136             s[k++] = c;
 137             break;
 138         case '.':
 139             if (first) {
 140                 s[k++] = '%';
 141                 s[k++] = "0123456789abcdef"[(c&0xff)>>4];
 142                 s[k++] = "0123456789abcdef"[(c&0x0f)];
 143             } else {
 144                 s[k++] = c;
 145             }
 146             break;
 147         default:
 148             if (isalnum(c)) {
 149                 s[k++] = c;
 150             } else  {
 151                 s[k++] = '%';
 152                 s[k++] = "0123456789abcdef"[(c&0xff)>>4];
 153                 s[k++] = "0123456789abcdef"[(c&0x0f)];
 154             }
 155         }
 156     }
 157     return s;
 158 }
 159
 160 static void
 161 frees(char **s)
 162 {
 163     free(*s);
 164     *s = NULL;
 165 }
 166
 167 static KRB5_LIB_CALL krb5_error_code
 168 authorize(void *ctx,
 169           krb5_context context,
 170           const char *app,
 171           hx509_request csr,
 172           krb5_const_principal client,
 173           krb5_boolean *result)
 174 {
 175     krb5_error_code ret;
 176     hx509_context hx509ctx = NULL;
 177     KeyUsage ku;
 178     const char *d;
 179     size_t i;
 180     char *princ = NULL;
 181     char *s = NULL;
 182
 183     if ((d = krb5_config_get_string(context, NULL, app ? app : "kdc",
 184                                     "simple_csr_authorizer_directory",
 185                                     NULL)) == NULL)
 186         return KRB5_PLUGIN_NO_HANDLE;
 187
 188     if ((ret = hx509_context_init(&hx509ctx)))
 189         return ret;
 190
 191     if ((ret = krb5_unparse_name(context, client, &princ)))
 192         goto out;
 193
 194     s = string_encode(princ);
 195     free(princ);
 196     princ = NULL;
 197     if (s == NULL)
 198         goto enomem;
 199
 200     princ = s;
 201     s = NULL;
 202
 203     for (i = 0; ret == 0; i++) {
 204         hx509_san_type san_type;
 205         struct stat st;
 206         const char *prefix;
 207         char *san;
 208         char *p;
 209
 210         ret = hx509_request_get_san(csr, i, &san_type, &s);
 211         if (ret)
 212             break;
 213         switch (san_type) {
 214         case HX509_SAN_TYPE_EMAIL:
 215             prefix = "email";
 216             break;
 217         case HX509_SAN_TYPE_DNSNAME:
 218             prefix = "dnsname";
 219             break;
 220         case HX509_SAN_TYPE_XMPP:
 221             prefix = "xmpp";
 222             break;
 223         case HX509_SAN_TYPE_PKINIT:
 224             prefix = "pkinit";
 225             break;
 226         case HX509_SAN_TYPE_MS_UPN:
 227             prefix = "ms-upn";
 228             break;
 229         default:
 230             ret = ENOTSUP;
 231             break;
 232         }
 233         if (ret)
 234             break;
 235
 236         if ((san = string_encode(s)) == NULL ||
 237             asprintf(&p, "%s/%s/%s-%s", d, princ, prefix, san) == -1 ||
 238             p == NULL) {
 239             free(san);
 240             goto enomem;
 241         }
 242         ret = stat(p, &st) == -1 ? errno : 0;
 243         free(san);
 244         free(p);
 245         frees(&s);
 246         if (ret)
 247             goto skip;
 248         ret = hx509_request_authorize_san(csr, i);
 249     }
 250     frees(&s);
 251     if (ret == HX509_NO_ITEM)
 252         ret = 0;
 253     if (ret)
 254         goto out;
 255
 256     for (i = 0; ret == 0; i++) {
 257         struct stat st;
 258         char *p;
 259
 260         ret = hx509_request_get_eku(csr, i, &s);
 261         if (ret)
 262             break;
 263         if (asprintf(&p, "%s/%s/eku-%s", d, princ, s) == -1 || p == NULL)
 264             goto enomem;
 265         ret = stat(p, &st) == -1 ? errno : 0;
 266         free(p);
 267         frees(&s);
 268         if (ret)
 269             goto skip;
 270         ret = hx509_request_authorize_eku(csr, i);
 271     }
 272     if (ret == HX509_NO_ITEM)
 273         ret = 0;
 274     if (ret)
 275         goto out;
 276
 277     ku = int2KeyUsage(0);
 278     ku.digitalSignature = 1;
 279     ku.nonRepudiation = 1;
 280     hx509_request_authorize_ku(csr, ku);
 281
 282     *result = TRUE;
 283     ret = 0;
 284     goto out;
 285
 286 skip:
 287     /* Allow another plugin to get a crack at this */
 288     ret = KRB5_PLUGIN_NO_HANDLE;
 289     goto out;
 290
 291 enomem:
 292     ret = krb5_enomem(context);
 293     goto out;
 294
 295 out:
 296     hx509_context_free(&hx509ctx);
 297     free(princ);
 298     free(s);
 299     return ret;
 300 }
 301
 302 static KRB5_LIB_CALL krb5_error_code
 303 simple_csr_authorizer_init(krb5_context context, void **c)
 304 {
 305     *c = NULL;
 306     return 0;
 307 }
 308
 309 static KRB5_LIB_CALL void
 310 simple_csr_authorizer_fini(void *c)
 311 {
 312 }
 313
 314 static krb5plugin_csr_authorizer_ftable plug_desc =
 315     { 1, simple_csr_authorizer_init, simple_csr_authorizer_fini, authorize };
 316
 317 static krb5plugin_csr_authorizer_ftable *plugs[] = { &plug_desc };
 318
 319 static uintptr_t
 320 simple_csr_authorizer_get_instance(const char *libname)
 321 {
 322     if (strcmp(libname, "krb5") == 0)
 323         return krb5_get_instance(libname);
 324     if (strcmp(libname, "kdc") == 0)
 325         return kdc_get_instance(libname);
 326     if (strcmp(libname, "hx509") == 0)
 327         return hx509_get_instance(libname);
 328     return 0;
 329 }
 330
 331 krb5_plugin_load_ft kdc_csr_authorizer_plugin_load;
 332
 333 krb5_error_code KRB5_CALLCONV
 334 kdc_csr_authorizer_plugin_load(heim_pcontext context,
 335                                krb5_get_instance_func_t *get_instance,
 336                                size_t *num_plugins,
 337                                krb5_plugin_common_ftable_cp **plugins)
 338 {
 339     *get_instance = simple_csr_authorizer_get_instance;
 340     *num_plugins = sizeof(plugs) / sizeof(plugs[0]);
 341     *plugins = (krb5_plugin_common_ftable_cp *)plugs;
 342     return 0;
 343 }