2018-10-05 21:48:36 +00:00
|
|
|
package authority
|
|
|
|
|
|
|
|
import (
|
2019-07-29 19:34:27 +00:00
|
|
|
"context"
|
2018-11-01 22:43:24 +00:00
|
|
|
"crypto/x509"
|
2018-10-05 21:48:36 +00:00
|
|
|
"net/http"
|
2019-03-18 17:59:36 +00:00
|
|
|
"strings"
|
2018-10-05 21:48:36 +00:00
|
|
|
|
|
|
|
"github.com/pkg/errors"
|
2019-03-06 23:04:28 +00:00
|
|
|
"github.com/smallstep/certificates/authority/provisioner"
|
|
|
|
"github.com/smallstep/cli/jose"
|
2018-10-05 21:48:36 +00:00
|
|
|
)
|
|
|
|
|
2019-03-06 23:04:28 +00:00
|
|
|
// Claims extends jose.Claims with step attributes.
|
2019-01-30 23:36:42 +00:00
|
|
|
type Claims struct {
|
2019-03-06 23:04:28 +00:00
|
|
|
jose.Claims
|
2019-03-07 01:00:45 +00:00
|
|
|
SANs []string `json:"sans,omitempty"`
|
|
|
|
Email string `json:"email,omitempty"`
|
|
|
|
Nonce string `json:"nonce,omitempty"`
|
2019-01-30 23:36:42 +00:00
|
|
|
}
|
|
|
|
|
2019-11-20 19:51:25 +00:00
|
|
|
type skipTokenReuseKey struct{}
|
|
|
|
|
|
|
|
// NewContextWithSkipTokenReuse creates a new context from ctx and attaches a
|
|
|
|
// value to skip the token reuse.
|
|
|
|
func NewContextWithSkipTokenReuse(ctx context.Context) context.Context {
|
|
|
|
return context.WithValue(ctx, skipTokenReuseKey{}, true)
|
|
|
|
}
|
|
|
|
|
|
|
|
// SkipTokenReuseFromContext returns if the token reuse needs to be ignored.
|
|
|
|
func SkipTokenReuseFromContext(ctx context.Context) bool {
|
|
|
|
m, _ := ctx.Value(skipTokenReuseKey{}).(bool)
|
|
|
|
return m
|
|
|
|
}
|
|
|
|
|
2019-03-05 08:07:13 +00:00
|
|
|
// authorizeToken parses the token and returns the provisioner used to generate
|
|
|
|
// the token. This method enforces the One-Time use policy (tokens can only be
|
|
|
|
// used once).
|
2019-11-20 19:51:25 +00:00
|
|
|
func (a *Authority) authorizeToken(ctx context.Context, ott string) (provisioner.Interface, error) {
|
2019-03-06 23:04:28 +00:00
|
|
|
var errContext = map[string]interface{}{"ott": ott}
|
2018-10-05 21:48:36 +00:00
|
|
|
|
|
|
|
// Validate payload
|
2019-03-06 23:04:28 +00:00
|
|
|
token, err := jose.ParseSigned(ott)
|
2018-10-05 21:48:36 +00:00
|
|
|
if err != nil {
|
2019-03-05 08:07:13 +00:00
|
|
|
return nil, &apiError{errors.Wrapf(err, "authorizeToken: error parsing token"),
|
2018-10-05 21:48:36 +00:00
|
|
|
http.StatusUnauthorized, errContext}
|
|
|
|
}
|
|
|
|
|
2018-10-30 01:00:30 +00:00
|
|
|
// Get claims w/out verification. We need to look up the provisioner
|
|
|
|
// key in order to verify the claims and we need the issuer from the claims
|
|
|
|
// before we can look up the provisioner.
|
2019-03-07 01:00:45 +00:00
|
|
|
var claims Claims
|
2018-10-30 01:00:30 +00:00
|
|
|
if err = token.UnsafeClaimsWithoutVerification(&claims); err != nil {
|
2019-03-05 08:07:13 +00:00
|
|
|
return nil, &apiError{errors.Wrap(err, "authorizeToken"), http.StatusUnauthorized, errContext}
|
2018-10-30 01:00:30 +00:00
|
|
|
}
|
2018-10-05 21:48:36 +00:00
|
|
|
|
2019-03-05 08:07:13 +00:00
|
|
|
// TODO: use new persistence layer abstraction.
|
2018-10-25 01:59:48 +00:00
|
|
|
// Do not accept tokens issued before the start of the ca.
|
|
|
|
// This check is meant as a stopgap solution to the current lack of a persistence layer.
|
|
|
|
if a.config.AuthorityConfig != nil && !a.config.AuthorityConfig.DisableIssuedAtCheck {
|
2019-04-05 19:54:23 +00:00
|
|
|
if claims.IssuedAt != nil && claims.IssuedAt.Time().Before(a.startTime) {
|
2019-04-10 21:00:36 +00:00
|
|
|
return nil, &apiError{errors.New("authorizeToken: token issued before the bootstrap of certificate authority"),
|
2018-10-25 01:59:48 +00:00
|
|
|
http.StatusUnauthorized, errContext}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-03-07 01:37:49 +00:00
|
|
|
// This method will also validate the audiences for JWK provisioners.
|
2019-03-07 01:00:45 +00:00
|
|
|
p, ok := a.provisioners.LoadByToken(token, &claims.Claims)
|
2019-03-06 23:04:28 +00:00
|
|
|
if !ok {
|
2019-03-18 17:59:36 +00:00
|
|
|
return nil, &apiError{
|
2019-03-05 08:07:13 +00:00
|
|
|
errors.Errorf("authorizeToken: provisioner not found or invalid audience (%s)", strings.Join(claims.Audience, ", ")),
|
2018-10-05 21:48:36 +00:00
|
|
|
http.StatusUnauthorized, errContext}
|
|
|
|
}
|
2018-10-19 05:26:39 +00:00
|
|
|
|
2019-11-20 19:51:25 +00:00
|
|
|
// Store the token to protect against reuse unless it's skipped.
|
|
|
|
if !SkipTokenReuseFromContext(ctx) {
|
|
|
|
if reuseKey, err := p.GetTokenID(ott); err == nil {
|
|
|
|
ok, err := a.db.UseToken(reuseKey, ott)
|
|
|
|
if err != nil {
|
|
|
|
return nil, &apiError{errors.Wrap(err, "authorizeToken: failed when checking if token already used"),
|
|
|
|
http.StatusInternalServerError, errContext}
|
|
|
|
}
|
|
|
|
if !ok {
|
|
|
|
return nil, &apiError{errors.Errorf("authorizeToken: token already used"), http.StatusUnauthorized, errContext}
|
|
|
|
}
|
2019-03-07 01:00:45 +00:00
|
|
|
}
|
|
|
|
}
|
2019-03-06 23:04:28 +00:00
|
|
|
|
2019-03-05 08:07:13 +00:00
|
|
|
return p, nil
|
|
|
|
}
|
|
|
|
|
2019-07-29 19:34:27 +00:00
|
|
|
// Authorize grabs the method from the context and authorizes a signature
|
|
|
|
// request by validating the one-time-token.
|
|
|
|
func (a *Authority) Authorize(ctx context.Context, ott string) ([]provisioner.SignOption, error) {
|
2019-07-29 18:56:14 +00:00
|
|
|
var errContext = apiCtx{"ott": ott}
|
2019-07-29 19:34:27 +00:00
|
|
|
switch m := provisioner.MethodFromContext(ctx); m {
|
2019-08-01 22:04:56 +00:00
|
|
|
case provisioner.SignMethod:
|
|
|
|
return a.authorizeSign(ctx, ott)
|
2019-10-28 18:50:43 +00:00
|
|
|
case provisioner.RevokeMethod:
|
|
|
|
return nil, a.authorizeRevoke(ctx, ott)
|
2019-08-01 22:04:56 +00:00
|
|
|
case provisioner.SignSSHMethod:
|
|
|
|
if a.sshCAHostCertSignKey == nil && a.sshCAUserCertSignKey == nil {
|
|
|
|
return nil, &apiError{errors.New("authorize: ssh signing is not enabled"), http.StatusNotImplemented, errContext}
|
2019-07-29 19:34:27 +00:00
|
|
|
}
|
2019-10-28 18:50:43 +00:00
|
|
|
return a.authorizeSSHSign(ctx, ott)
|
|
|
|
case provisioner.RenewSSHMethod:
|
|
|
|
if a.sshCAHostCertSignKey == nil && a.sshCAUserCertSignKey == nil {
|
|
|
|
return nil, &apiError{errors.New("authorize: ssh signing is not enabled"), http.StatusNotImplemented, errContext}
|
|
|
|
}
|
|
|
|
if _, err := a.authorizeSSHRenew(ctx, ott); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return nil, nil
|
|
|
|
case provisioner.RevokeSSHMethod:
|
|
|
|
return nil, a.authorizeSSHRevoke(ctx, ott)
|
|
|
|
case provisioner.RekeySSHMethod:
|
|
|
|
if a.sshCAHostCertSignKey == nil && a.sshCAUserCertSignKey == nil {
|
|
|
|
return nil, &apiError{errors.New("authorize: ssh signing is not enabled"), http.StatusNotImplemented, errContext}
|
|
|
|
}
|
|
|
|
_, opts, err := a.authorizeSSHRekey(ctx, ott)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return opts, nil
|
2019-07-29 19:34:27 +00:00
|
|
|
default:
|
|
|
|
return nil, &apiError{errors.Errorf("authorize: method %d is not supported", m), http.StatusInternalServerError, errContext}
|
2019-03-09 02:05:11 +00:00
|
|
|
}
|
2019-07-29 19:34:27 +00:00
|
|
|
}
|
2019-03-09 02:05:11 +00:00
|
|
|
|
2019-08-01 22:04:56 +00:00
|
|
|
// authorizeSign loads the provisioner from the token, checks that it has not
|
2019-09-09 04:05:36 +00:00
|
|
|
// been used again and calls the provisioner AuthorizeSign method. Returns a
|
2019-08-01 22:04:56 +00:00
|
|
|
// list of methods to apply to the signing flow.
|
|
|
|
func (a *Authority) authorizeSign(ctx context.Context, ott string) ([]provisioner.SignOption, error) {
|
|
|
|
var errContext = apiCtx{"ott": ott}
|
2019-11-20 19:51:25 +00:00
|
|
|
p, err := a.authorizeToken(ctx, ott)
|
2019-08-01 22:04:56 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, &apiError{errors.Wrap(err, "authorizeSign"), http.StatusUnauthorized, errContext}
|
|
|
|
}
|
|
|
|
opts, err := p.AuthorizeSign(ctx, ott)
|
|
|
|
if err != nil {
|
|
|
|
return nil, &apiError{errors.Wrap(err, "authorizeSign"), http.StatusUnauthorized, errContext}
|
|
|
|
}
|
|
|
|
return opts, nil
|
|
|
|
}
|
|
|
|
|
2019-07-29 19:34:27 +00:00
|
|
|
// AuthorizeSign authorizes a signature request by validating and authenticating
|
|
|
|
// a OTT that must be sent w/ the request.
|
2019-09-09 04:05:36 +00:00
|
|
|
//
|
|
|
|
// NOTE: This method is deprecated and should not be used. We make it available
|
|
|
|
// in the short term os as not to break existing clients.
|
2019-07-29 19:34:27 +00:00
|
|
|
func (a *Authority) AuthorizeSign(ott string) ([]provisioner.SignOption, error) {
|
|
|
|
ctx := provisioner.NewContextWithMethod(context.Background(), provisioner.SignMethod)
|
|
|
|
return a.Authorize(ctx, ott)
|
2018-10-05 21:48:36 +00:00
|
|
|
}
|
2018-11-01 22:43:24 +00:00
|
|
|
|
2019-03-05 08:07:13 +00:00
|
|
|
// authorizeRevoke authorizes a revocation request by validating and authenticating
|
|
|
|
// the RevokeOptions POSTed with the request.
|
|
|
|
// Returns a tuple of the provisioner ID and error, if one occurred.
|
2019-10-28 18:50:43 +00:00
|
|
|
func (a *Authority) authorizeRevoke(ctx context.Context, token string) error {
|
|
|
|
errContext := map[string]interface{}{"ott": token}
|
2019-03-05 08:07:13 +00:00
|
|
|
|
2019-11-20 19:51:25 +00:00
|
|
|
p, err := a.authorizeToken(ctx, token)
|
2019-10-28 18:50:43 +00:00
|
|
|
if err != nil {
|
|
|
|
return &apiError{errors.Wrap(err, "authorizeRevoke"), http.StatusUnauthorized, errContext}
|
2019-03-05 08:07:13 +00:00
|
|
|
}
|
2019-10-28 18:50:43 +00:00
|
|
|
if err = p.AuthorizeSSHRevoke(ctx, token); err != nil {
|
|
|
|
return &apiError{errors.Wrap(err, "authorizeRevoke"), http.StatusUnauthorized, errContext}
|
|
|
|
}
|
|
|
|
return nil
|
2019-03-05 08:07:13 +00:00
|
|
|
}
|
|
|
|
|
2019-10-28 18:50:43 +00:00
|
|
|
// authorizeRenewl tries to locate the step provisioner extension, and checks
|
2018-11-01 22:43:24 +00:00
|
|
|
// if for the configured provisioner, the renewal is enabled or not. If the
|
|
|
|
// extra extension cannot be found, authorize the renewal by default.
|
|
|
|
//
|
|
|
|
// TODO(mariano): should we authorize by default?
|
2019-10-28 18:50:43 +00:00
|
|
|
func (a *Authority) authorizeRenew(crt *x509.Certificate) error {
|
2018-11-01 22:43:24 +00:00
|
|
|
errContext := map[string]interface{}{"serialNumber": crt.SerialNumber.String()}
|
2019-03-05 08:07:13 +00:00
|
|
|
|
|
|
|
// Check the passive revocation table.
|
|
|
|
isRevoked, err := a.db.IsRevoked(crt.SerialNumber.String())
|
|
|
|
if err != nil {
|
|
|
|
return &apiError{
|
|
|
|
err: errors.Wrap(err, "renew"),
|
|
|
|
code: http.StatusInternalServerError,
|
|
|
|
context: errContext,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if isRevoked {
|
|
|
|
return &apiError{
|
|
|
|
err: errors.New("renew: certificate has been revoked"),
|
|
|
|
code: http.StatusUnauthorized,
|
|
|
|
context: errContext,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-03-06 23:04:28 +00:00
|
|
|
p, ok := a.provisioners.LoadByCertificate(crt)
|
|
|
|
if !ok {
|
|
|
|
return &apiError{
|
2019-03-05 08:07:13 +00:00
|
|
|
err: errors.New("renew: provisioner not found"),
|
2019-03-06 23:04:28 +00:00
|
|
|
code: http.StatusUnauthorized,
|
|
|
|
context: errContext,
|
|
|
|
}
|
|
|
|
}
|
2019-10-28 18:50:43 +00:00
|
|
|
if err := p.AuthorizeRenew(context.Background(), crt); err != nil {
|
2019-03-06 23:04:28 +00:00
|
|
|
return &apiError{
|
2019-03-05 08:07:13 +00:00
|
|
|
err: errors.Wrap(err, "renew"),
|
2019-03-06 23:04:28 +00:00
|
|
|
code: http.StatusUnauthorized,
|
|
|
|
context: errContext,
|
2018-11-01 22:43:24 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|