2019-05-27 00:41:10 +00:00
|
|
|
package provisioner
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
|
|
|
"crypto/x509"
|
2022-09-15 21:45:14 +00:00
|
|
|
"encoding/pem"
|
2022-03-24 13:55:40 +00:00
|
|
|
"fmt"
|
2022-01-03 11:25:24 +00:00
|
|
|
"net"
|
2022-08-24 00:11:40 +00:00
|
|
|
"strings"
|
2020-05-20 01:44:55 +00:00
|
|
|
"time"
|
2019-05-27 00:41:10 +00:00
|
|
|
|
|
|
|
"github.com/pkg/errors"
|
|
|
|
)
|
|
|
|
|
2022-09-08 19:34:06 +00:00
|
|
|
// ACMEChallenge represents the supported acme challenges.
|
|
|
|
type ACMEChallenge string
|
|
|
|
|
2022-09-08 19:49:16 +00:00
|
|
|
// nolint:revive // better names
|
2022-09-08 19:34:06 +00:00
|
|
|
const (
|
|
|
|
// HTTP_01 is the http-01 ACME challenge.
|
|
|
|
HTTP_01 ACMEChallenge = "http-01"
|
|
|
|
// DNS_01 is the dns-01 ACME challenge.
|
|
|
|
DNS_01 ACMEChallenge = "dns-01"
|
|
|
|
// TLS_ALPN_01 is the tls-alpn-01 ACME challenge.
|
|
|
|
TLS_ALPN_01 ACMEChallenge = "tls-alpn-01"
|
|
|
|
// DEVICE_ATTEST_01 is the device-attest-01 ACME challenge.
|
|
|
|
DEVICE_ATTEST_01 ACMEChallenge = "device-attest-01"
|
|
|
|
)
|
|
|
|
|
|
|
|
// String returns a normalized version of the challenge.
|
|
|
|
func (c ACMEChallenge) String() string {
|
|
|
|
return strings.ToLower(string(c))
|
|
|
|
}
|
|
|
|
|
|
|
|
// Validate returns an error if the acme challenge is not a valid one.
|
|
|
|
func (c ACMEChallenge) Validate() error {
|
|
|
|
switch ACMEChallenge(c.String()) {
|
|
|
|
case HTTP_01, DNS_01, TLS_ALPN_01, DEVICE_ATTEST_01:
|
|
|
|
return nil
|
|
|
|
default:
|
|
|
|
return fmt.Errorf("acme challenge %q is not supported", c)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-09-09 17:57:32 +00:00
|
|
|
// ACMEAttestationFormat represents the format used on a device-attest-01
|
|
|
|
// challenge.
|
2022-09-09 00:16:50 +00:00
|
|
|
type ACMEAttestationFormat string
|
|
|
|
|
|
|
|
const (
|
|
|
|
// APPLE is the format used to enable device-attest-01 on apple devices.
|
|
|
|
APPLE ACMEAttestationFormat = "apple"
|
|
|
|
|
|
|
|
// STEP is the format used to enable device-attest-01 on devices that
|
|
|
|
// provide attestation certificates like the PIV interface on YubiKeys.
|
|
|
|
//
|
|
|
|
// TODO(mariano): should we rename this to something else.
|
|
|
|
STEP ACMEAttestationFormat = "step"
|
|
|
|
|
|
|
|
// TPM is the format used to enable device-attest-01 on TPMs.
|
|
|
|
TPM ACMEAttestationFormat = "tpm"
|
|
|
|
)
|
|
|
|
|
|
|
|
// String returns a normalized version of the attestation format.
|
|
|
|
func (f ACMEAttestationFormat) String() string {
|
|
|
|
return strings.ToLower(string(f))
|
|
|
|
}
|
|
|
|
|
|
|
|
// Validate returns an error if the attestation format is not a valid one.
|
|
|
|
func (f ACMEAttestationFormat) Validate() error {
|
|
|
|
switch ACMEAttestationFormat(f.String()) {
|
|
|
|
case APPLE, STEP, TPM:
|
|
|
|
return nil
|
|
|
|
default:
|
|
|
|
return fmt.Errorf("acme attestation format %q is not supported", f)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-05-27 00:41:10 +00:00
|
|
|
// ACME is the acme provisioner type, an entity that can authorize the ACME
|
|
|
|
// provisioning flow.
|
|
|
|
type ACME struct {
|
2019-10-28 18:50:43 +00:00
|
|
|
*base
|
2021-08-10 10:39:11 +00:00
|
|
|
ID string `json:"-"`
|
|
|
|
Type string `json:"type"`
|
|
|
|
Name string `json:"name"`
|
|
|
|
ForceCN bool `json:"forceCN,omitempty"`
|
|
|
|
// RequireEAB makes the provisioner require ACME EAB to be provided
|
|
|
|
// by clients when creating a new Account. If set to true, the provided
|
|
|
|
// EAB will be verified. If set to false and an EAB is provided, it is
|
|
|
|
// not verified. Defaults to false.
|
2022-08-24 00:11:40 +00:00
|
|
|
RequireEAB bool `json:"requireEAB,omitempty"`
|
|
|
|
// Challenges contains the enabled challenges for this provisioner. If this
|
|
|
|
// value is not set the default http-01, dns-01 and tls-alpn-01 challenges
|
|
|
|
// will be enabled, device-attest-01 will be disabled.
|
2022-09-08 19:34:06 +00:00
|
|
|
Challenges []ACMEChallenge `json:"challenges,omitempty"`
|
2022-09-09 00:16:50 +00:00
|
|
|
// AttestationFormats contains the enabled attestation formats for this
|
|
|
|
// provisioner. If this value is not set the default apple, step and tpm
|
|
|
|
// will be used.
|
|
|
|
AttestationFormats []ACMEAttestationFormat `json:"attestationFormats,omitempty"`
|
2022-09-15 22:50:04 +00:00
|
|
|
// AttestationRoots contains a bundle of root certificates in PEM format
|
|
|
|
// that will be used to verify the attestation certificates. If provided,
|
|
|
|
// this bundle will be used even for well-known CAs like Apple and Yubico.
|
|
|
|
AttestationRoots []byte `json:"attestationRoots,omitempty"`
|
|
|
|
Claims *Claims `json:"claims,omitempty"`
|
|
|
|
Options *Options `json:"options,omitempty"`
|
2022-09-15 21:45:14 +00:00
|
|
|
attestationRootPool *x509.CertPool
|
2022-09-15 22:50:04 +00:00
|
|
|
ctl *Controller
|
2019-05-27 00:41:10 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// GetID returns the provisioner unique identifier.
|
|
|
|
func (p ACME) GetID() string {
|
2021-05-20 01:23:20 +00:00
|
|
|
if p.ID != "" {
|
|
|
|
return p.ID
|
|
|
|
}
|
|
|
|
return p.GetIDForToken()
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetIDForToken returns an identifier that will be used to load the provisioner
|
|
|
|
// from a token.
|
|
|
|
func (p *ACME) GetIDForToken() string {
|
2019-05-27 00:41:10 +00:00
|
|
|
return "acme/" + p.Name
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetTokenID returns the identifier of the token.
|
|
|
|
func (p *ACME) GetTokenID(ott string) (string, error) {
|
|
|
|
return "", errors.New("acme provisioner does not implement GetTokenID")
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetName returns the name of the provisioner.
|
|
|
|
func (p *ACME) GetName() string {
|
|
|
|
return p.Name
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetType returns the type of provisioner.
|
|
|
|
func (p *ACME) GetType() Type {
|
|
|
|
return TypeACME
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetEncryptedKey returns the base provisioner encrypted key if it's defined.
|
|
|
|
func (p *ACME) GetEncryptedKey() (string, string, bool) {
|
|
|
|
return "", "", false
|
|
|
|
}
|
|
|
|
|
2020-07-16 00:30:29 +00:00
|
|
|
// GetOptions returns the configured provisioner options.
|
2020-07-23 01:24:45 +00:00
|
|
|
func (p *ACME) GetOptions() *Options {
|
2020-07-16 00:30:29 +00:00
|
|
|
return p.Options
|
|
|
|
}
|
|
|
|
|
2020-05-20 01:44:55 +00:00
|
|
|
// DefaultTLSCertDuration returns the default TLS cert duration enforced by
|
|
|
|
// the provisioner.
|
|
|
|
func (p *ACME) DefaultTLSCertDuration() time.Duration {
|
2022-03-10 02:43:45 +00:00
|
|
|
return p.ctl.Claimer.DefaultTLSCertDuration()
|
2020-05-20 01:44:55 +00:00
|
|
|
}
|
|
|
|
|
2022-01-03 11:25:24 +00:00
|
|
|
// Init initializes and validates the fields of an ACME type.
|
2019-05-27 00:41:10 +00:00
|
|
|
func (p *ACME) Init(config Config) (err error) {
|
|
|
|
switch {
|
|
|
|
case p.Type == "":
|
|
|
|
return errors.New("provisioner type cannot be empty")
|
|
|
|
case p.Name == "":
|
|
|
|
return errors.New("provisioner name cannot be empty")
|
|
|
|
}
|
|
|
|
|
2022-09-08 19:34:06 +00:00
|
|
|
for _, c := range p.Challenges {
|
|
|
|
if err := c.Validate(); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
2022-09-09 00:16:50 +00:00
|
|
|
for _, f := range p.AttestationFormats {
|
|
|
|
if err := f.Validate(); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
2022-09-08 19:34:06 +00:00
|
|
|
|
2022-09-15 22:50:04 +00:00
|
|
|
// Parse attestation roots.
|
|
|
|
// The pool will be nil if the there are not roots.
|
|
|
|
if rest := p.AttestationRoots; len(rest) > 0 {
|
|
|
|
var block *pem.Block
|
|
|
|
var hasCert bool
|
|
|
|
p.attestationRootPool = x509.NewCertPool()
|
|
|
|
for rest != nil {
|
|
|
|
block, rest = pem.Decode(rest)
|
|
|
|
if block == nil {
|
|
|
|
break
|
|
|
|
}
|
|
|
|
cert, err := x509.ParseCertificate(block.Bytes)
|
|
|
|
if err != nil {
|
|
|
|
return errors.New("error parsing attestationRoots: malformed certificate")
|
|
|
|
}
|
|
|
|
p.attestationRootPool.AddCert(cert)
|
|
|
|
hasCert = true
|
2022-09-15 21:45:14 +00:00
|
|
|
}
|
2022-09-15 22:50:04 +00:00
|
|
|
if !hasCert {
|
|
|
|
return errors.New("error parsing attestationRoots: no certificates found")
|
2022-09-15 21:45:14 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-04-21 23:20:38 +00:00
|
|
|
p.ctl, err = NewController(p, p.Claims, config, p.Options)
|
2022-03-10 02:43:45 +00:00
|
|
|
return
|
2022-01-03 11:25:24 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// ACMEIdentifierType encodes ACME Identifier types
|
|
|
|
type ACMEIdentifierType string
|
|
|
|
|
|
|
|
const (
|
|
|
|
// IP is the ACME ip identifier type
|
|
|
|
IP ACMEIdentifierType = "ip"
|
|
|
|
// DNS is the ACME dns identifier type
|
|
|
|
DNS ACMEIdentifierType = "dns"
|
|
|
|
)
|
|
|
|
|
|
|
|
// ACMEIdentifier encodes ACME Order Identifiers
|
|
|
|
type ACMEIdentifier struct {
|
|
|
|
Type ACMEIdentifierType
|
|
|
|
Value string
|
|
|
|
}
|
|
|
|
|
2022-03-08 13:17:59 +00:00
|
|
|
// AuthorizeOrderIdentifier verifies the provisioner is allowed to issue a
|
|
|
|
// certificate for an ACME Order Identifier.
|
|
|
|
func (p *ACME) AuthorizeOrderIdentifier(ctx context.Context, identifier ACMEIdentifier) error {
|
2022-01-03 11:25:24 +00:00
|
|
|
|
2022-05-05 10:32:53 +00:00
|
|
|
x509Policy := p.ctl.getPolicy().getX509()
|
2022-04-21 23:20:38 +00:00
|
|
|
|
2022-03-08 13:17:59 +00:00
|
|
|
// identifier is allowed if no policy is configured
|
2022-04-21 23:20:38 +00:00
|
|
|
if x509Policy == nil {
|
2022-01-03 11:25:24 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-01-03 14:32:58 +00:00
|
|
|
// assuming only valid identifiers (IP or DNS) are provided
|
2022-01-03 11:25:24 +00:00
|
|
|
var err error
|
2022-03-08 13:17:59 +00:00
|
|
|
switch identifier.Type {
|
|
|
|
case IP:
|
2022-04-26 11:12:16 +00:00
|
|
|
err = x509Policy.IsIPAllowed(net.ParseIP(identifier.Value))
|
2022-03-08 13:17:59 +00:00
|
|
|
case DNS:
|
2022-04-26 11:12:16 +00:00
|
|
|
err = x509Policy.IsDNSAllowed(identifier.Value)
|
2022-03-24 13:55:40 +00:00
|
|
|
default:
|
|
|
|
err = fmt.Errorf("invalid ACME identifier type '%s' provided", identifier.Type)
|
2022-01-03 11:25:24 +00:00
|
|
|
}
|
|
|
|
|
2019-05-27 00:41:10 +00:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2019-10-28 18:50:43 +00:00
|
|
|
// AuthorizeSign does not do any validation, because all validation is handled
|
|
|
|
// in the ACME protocol. This method returns a list of modifiers / constraints
|
|
|
|
// on the resulting certificate.
|
|
|
|
func (p *ACME) AuthorizeSign(ctx context.Context, token string) ([]SignOption, error) {
|
2022-01-03 11:25:24 +00:00
|
|
|
opts := []SignOption{
|
2022-04-08 14:10:26 +00:00
|
|
|
p,
|
2019-09-05 01:31:09 +00:00
|
|
|
// modifiers / withOptions
|
2019-05-27 00:41:10 +00:00
|
|
|
newProvisionerExtensionOption(TypeACME, p.Name, ""),
|
2020-05-17 17:23:13 +00:00
|
|
|
newForceCNOption(p.ForceCN),
|
2022-03-10 02:43:45 +00:00
|
|
|
profileDefaultDuration(p.ctl.Claimer.DefaultTLSCertDuration()),
|
2019-09-05 01:31:09 +00:00
|
|
|
// validators
|
2019-05-27 00:41:10 +00:00
|
|
|
defaultPublicKeyValidator{},
|
2022-03-10 02:43:45 +00:00
|
|
|
newValidityValidator(p.ctl.Claimer.MinTLSCertDuration(), p.ctl.Claimer.MaxTLSCertDuration()),
|
2022-05-05 10:32:53 +00:00
|
|
|
newX509NamePolicyValidator(p.ctl.getPolicy().getX509()),
|
2022-01-03 11:25:24 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return opts, nil
|
2019-05-27 00:41:10 +00:00
|
|
|
}
|
|
|
|
|
2021-07-09 22:28:31 +00:00
|
|
|
// AuthorizeRevoke is called just before the certificate is to be revoked by
|
|
|
|
// the CA. It can be used to authorize revocation of a certificate. It
|
|
|
|
// currently is a no-op.
|
2021-11-28 20:20:57 +00:00
|
|
|
// TODO(hs): add configuration option that toggles revocation? Or change function signature to make it more useful?
|
2021-07-09 22:28:31 +00:00
|
|
|
// Or move certain logic out of the Revoke API to here? Would likely involve some more stuff in the ctx.
|
|
|
|
func (p *ACME) AuthorizeRevoke(ctx context.Context, token string) error {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2019-10-28 18:50:43 +00:00
|
|
|
// AuthorizeRenew returns an error if the renewal is disabled.
|
|
|
|
// NOTE: This method does not actually validate the certificate or check it's
|
|
|
|
// revocation status. Just confirms that the provisioner that created the
|
|
|
|
// certificate was configured to allow renewals.
|
|
|
|
func (p *ACME) AuthorizeRenew(ctx context.Context, cert *x509.Certificate) error {
|
2022-03-10 02:43:45 +00:00
|
|
|
return p.ctl.AuthorizeRenew(ctx, cert)
|
2019-05-27 00:41:10 +00:00
|
|
|
}
|
2022-08-24 00:11:40 +00:00
|
|
|
|
2022-09-08 20:22:35 +00:00
|
|
|
// IsChallengeEnabled checks if the given challenge is enabled. By default
|
2022-08-24 00:11:40 +00:00
|
|
|
// http-01, dns-01 and tls-alpn-01 are enabled, to disable any of them the
|
|
|
|
// Challenge provisioner property should have at least one element.
|
2022-09-08 20:22:35 +00:00
|
|
|
func (p *ACME) IsChallengeEnabled(ctx context.Context, challenge ACMEChallenge) bool {
|
2022-09-08 19:34:06 +00:00
|
|
|
enabledChallenges := []ACMEChallenge{
|
|
|
|
HTTP_01, DNS_01, TLS_ALPN_01,
|
2022-08-24 00:11:40 +00:00
|
|
|
}
|
|
|
|
if len(p.Challenges) > 0 {
|
|
|
|
enabledChallenges = p.Challenges
|
|
|
|
}
|
|
|
|
for _, ch := range enabledChallenges {
|
2022-09-08 19:34:06 +00:00
|
|
|
if strings.EqualFold(string(ch), string(challenge)) {
|
2022-09-08 20:22:35 +00:00
|
|
|
return true
|
2022-08-24 00:11:40 +00:00
|
|
|
}
|
|
|
|
}
|
2022-09-08 20:22:35 +00:00
|
|
|
return false
|
2022-08-24 00:11:40 +00:00
|
|
|
}
|
2022-09-09 00:16:50 +00:00
|
|
|
|
|
|
|
// IsAttestationFormatEnabled checks if the given attestation format is enabled.
|
|
|
|
// By default apple, step and tpm are enabled, to disable any of them the
|
|
|
|
// AttestationFormat provisioner property should have at least one element.
|
|
|
|
func (p *ACME) IsAttestationFormatEnabled(ctx context.Context, format ACMEAttestationFormat) bool {
|
|
|
|
enabledFormats := []ACMEAttestationFormat{
|
|
|
|
APPLE, STEP, TPM,
|
|
|
|
}
|
|
|
|
if len(p.AttestationFormats) > 0 {
|
|
|
|
enabledFormats = p.AttestationFormats
|
|
|
|
}
|
|
|
|
for _, f := range enabledFormats {
|
|
|
|
if strings.EqualFold(string(f), string(format)) {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return false
|
|
|
|
}
|
2022-09-15 21:45:14 +00:00
|
|
|
|
2022-09-15 22:50:04 +00:00
|
|
|
// GetAttestationRoots returns certificate pool with the configured attestation
|
|
|
|
// roots and reports if the pool contains at least one certificate.
|
|
|
|
//
|
|
|
|
// TODO(hs): we may not want to expose the root pool like this; call into an
|
|
|
|
// interface function instead to authorize?
|
|
|
|
func (p *ACME) GetAttestationRoots() (*x509.CertPool, bool) {
|
|
|
|
return p.attestationRootPool, p.attestationRootPool != nil
|
2022-09-15 21:45:14 +00:00
|
|
|
}
|