certificates/acme/api/account.go

384 lines
11 KiB
Go
Raw Normal View History

2019-05-27 00:41:10 +00:00
package api
import (
"context"
2019-05-27 00:41:10 +00:00
"encoding/json"
"net/http"
2021-03-06 21:06:43 +00:00
"github.com/go-chi/chi"
2019-05-27 00:41:10 +00:00
"github.com/smallstep/certificates/acme"
"github.com/smallstep/certificates/api"
"github.com/smallstep/certificates/logging"
"go.step.sm/crypto/jose"
2019-05-27 00:41:10 +00:00
)
// ExternalAccountBinding represents the ACME externalAccountBinding JWS
type ExternalAccountBinding struct {
Protected string `json:"protected"`
Payload string `json:"payload"`
Sig string `json:"signature"`
}
2019-05-27 00:41:10 +00:00
// NewAccountRequest represents the payload for a new account request.
type NewAccountRequest struct {
Contact []string `json:"contact"`
OnlyReturnExisting bool `json:"onlyReturnExisting"`
TermsOfServiceAgreed bool `json:"termsOfServiceAgreed"`
ExternalAccountBinding *ExternalAccountBinding `json:"externalAccountBinding,omitempty"`
2019-05-27 00:41:10 +00:00
}
func validateContacts(cs []string) error {
for _, c := range cs {
if c == "" {
2021-03-03 23:16:25 +00:00
return acme.NewError(acme.ErrorMalformedType, "contact cannot be empty string")
2019-05-27 00:41:10 +00:00
}
}
return nil
}
// Validate validates a new-account request body.
func (n *NewAccountRequest) Validate() error {
if n.OnlyReturnExisting && len(n.Contact) > 0 {
2021-03-03 23:16:25 +00:00
return acme.NewError(acme.ErrorMalformedType, "incompatible input; onlyReturnExisting must be alone")
2019-05-27 00:41:10 +00:00
}
return validateContacts(n.Contact)
}
// UpdateAccountRequest represents an update-account request.
type UpdateAccountRequest struct {
2021-03-05 07:10:46 +00:00
Contact []string `json:"contact"`
Status acme.Status `json:"status"`
2019-05-27 00:41:10 +00:00
}
// Validate validates a update-account request body.
func (u *UpdateAccountRequest) Validate() error {
switch {
case len(u.Status) > 0 && len(u.Contact) > 0:
2021-03-03 23:16:25 +00:00
return acme.NewError(acme.ErrorMalformedType, "incompatible input; contact and "+
"status updates are mutually exclusive")
2019-05-27 00:41:10 +00:00
case len(u.Contact) > 0:
if err := validateContacts(u.Contact); err != nil {
return err
}
return nil
case len(u.Status) > 0:
2021-03-05 07:10:46 +00:00
if u.Status != acme.StatusDeactivated {
2021-03-03 23:16:25 +00:00
return acme.NewError(acme.ErrorMalformedType, "cannot update account "+
"status to %s, only deactivated", u.Status)
2019-05-27 00:41:10 +00:00
}
return nil
default:
// According to the ACME spec (https://tools.ietf.org/html/rfc8555#section-7.3.2)
// accountUpdate should ignore any fields not recognized by the server.
return nil
2019-05-27 00:41:10 +00:00
}
}
// NewAccount is the handler resource for creating new ACME accounts.
func (h *Handler) NewAccount(w http.ResponseWriter, r *http.Request) {
2021-03-05 07:14:56 +00:00
ctx := r.Context()
payload, err := payloadFromContext(ctx)
2019-05-27 00:41:10 +00:00
if err != nil {
api.WriteError(w, err)
return
}
var nar NewAccountRequest
if err := json.Unmarshal(payload.value, &nar); err != nil {
2021-03-05 07:10:46 +00:00
api.WriteError(w, acme.WrapError(acme.ErrorMalformedType, err,
2021-03-03 23:16:25 +00:00
"failed to unmarshal new-account request payload"))
2019-05-27 00:41:10 +00:00
return
}
if err := nar.Validate(); err != nil {
api.WriteError(w, err)
return
}
prov, err := acmeProvisionerFromContext(ctx)
if err != nil {
api.WriteError(w, err)
return
}
2019-05-27 00:41:10 +00:00
httpStatus := http.StatusCreated
acc, err := accountFromContext(ctx)
2019-05-27 00:41:10 +00:00
if err != nil {
acmeErr, ok := err.(*acme.Error)
if !ok || acmeErr.Status != http.StatusBadRequest {
2019-05-27 00:41:10 +00:00
// Something went wrong ...
api.WriteError(w, err)
return
}
// Account does not exist //
if nar.OnlyReturnExisting {
2021-03-03 23:16:25 +00:00
api.WriteError(w, acme.NewError(acme.ErrorAccountDoesNotExistType,
"account does not exist"))
2019-05-27 00:41:10 +00:00
return
}
2021-03-05 07:14:56 +00:00
jwk, err := jwkFromContext(ctx)
2019-05-27 00:41:10 +00:00
if err != nil {
api.WriteError(w, err)
return
}
eak, err := h.validateExternalAccountBinding(ctx, &nar)
if err != nil {
api.WriteError(w, err)
return
}
acc = &acme.Account{
2019-05-27 00:41:10 +00:00
Key: jwk,
Contact: nar.Contact,
2021-03-01 06:49:20 +00:00
Status: acme.StatusValid,
2021-03-05 07:10:46 +00:00
}
2021-03-05 07:14:56 +00:00
if err := h.db.CreateAccount(ctx, acc); err != nil {
2021-03-05 07:10:46 +00:00
api.WriteError(w, acme.WrapErrorISE(err, "error creating account"))
2019-05-27 00:41:10 +00:00
return
}
2021-07-22 21:48:41 +00:00
if eak != nil { // means that we have a (valid) External Account Binding key that should be bound, updated and sent in the response
err := eak.BindTo(acc)
if err != nil {
api.WriteError(w, err)
return
}
if err := h.db.UpdateExternalAccountKey(ctx, prov.Name, eak); err != nil {
api.WriteError(w, acme.WrapErrorISE(err, "error updating external account binding key"))
return
}
acc.ExternalAccountBinding = nar.ExternalAccountBinding
}
2019-05-27 00:41:10 +00:00
} else {
2021-07-22 21:48:41 +00:00
// Account exists
2019-05-27 00:41:10 +00:00
httpStatus = http.StatusOK
}
2021-03-05 07:10:46 +00:00
h.linker.LinkAccount(ctx, acc)
w.Header().Set("Location", h.linker.GetLink(r.Context(), AccountLinkType, acc.ID))
2019-05-27 00:41:10 +00:00
api.JSONStatus(w, acc, httpStatus)
}
// GetOrUpdateAccount is the api for updating an ACME account.
func (h *Handler) GetOrUpdateAccount(w http.ResponseWriter, r *http.Request) {
2021-03-05 07:14:56 +00:00
ctx := r.Context()
acc, err := accountFromContext(ctx)
2019-05-27 00:41:10 +00:00
if err != nil {
api.WriteError(w, err)
return
}
2021-03-05 07:14:56 +00:00
payload, err := payloadFromContext(ctx)
2019-05-27 00:41:10 +00:00
if err != nil {
api.WriteError(w, err)
return
}
// If PostAsGet just respond with the account, otherwise process like a
// normal Post request.
2019-05-27 00:41:10 +00:00
if !payload.isPostAsGet {
var uar UpdateAccountRequest
if err := json.Unmarshal(payload.value, &uar); err != nil {
2021-03-05 07:10:46 +00:00
api.WriteError(w, acme.WrapError(acme.ErrorMalformedType, err,
2021-03-03 23:16:25 +00:00
"failed to unmarshal new-account request payload"))
2019-05-27 00:41:10 +00:00
return
}
if err := uar.Validate(); err != nil {
api.WriteError(w, err)
return
}
2021-03-12 08:16:48 +00:00
if len(uar.Status) > 0 || len(uar.Contact) > 0 {
if len(uar.Status) > 0 {
acc.Status = uar.Status
} else if len(uar.Contact) > 0 {
acc.Contact = uar.Contact
}
if err := h.db.UpdateAccount(ctx, acc); err != nil {
api.WriteError(w, acme.WrapErrorISE(err, "error updating account"))
return
}
2019-05-27 00:41:10 +00:00
}
}
2021-03-05 07:10:46 +00:00
h.linker.LinkAccount(ctx, acc)
w.Header().Set("Location", h.linker.GetLink(ctx, AccountLinkType, acc.ID))
2019-05-27 00:41:10 +00:00
api.JSON(w, acc)
}
func logOrdersByAccount(w http.ResponseWriter, oids []string) {
if rl, ok := w.(logging.ResponseLogger); ok {
m := map[string]interface{}{
"orders": oids,
}
rl.WithFields(m)
}
}
// GetOrdersByAccountID ACME api for retrieving the list of order urls belonging to an account.
func (h *Handler) GetOrdersByAccountID(w http.ResponseWriter, r *http.Request) {
2021-03-06 21:06:43 +00:00
ctx := r.Context()
acc, err := accountFromContext(ctx)
if err != nil {
api.WriteError(w, err)
return
}
accID := chi.URLParam(r, "accID")
if acc.ID != accID {
api.WriteError(w, acme.NewError(acme.ErrorUnauthorizedType, "account ID '%s' does not match url param '%s'", acc.ID, accID))
return
}
orders, err := h.db.GetOrdersByAccountID(ctx, acc.ID)
if err != nil {
api.WriteError(w, err)
return
}
h.linker.LinkOrdersByAccountID(ctx, orders)
api.JSON(w, orders)
logOrdersByAccount(w, orders)
2019-05-27 00:41:10 +00:00
}
// validateExternalAccountBinding validates the externalAccountBinding property in a call to new-account.
func (h *Handler) validateExternalAccountBinding(ctx context.Context, nar *NewAccountRequest) (*acme.ExternalAccountKey, error) {
2021-07-22 21:48:41 +00:00
acmeProv, err := acmeProvisionerFromContext(ctx)
if err != nil {
2021-07-22 21:48:41 +00:00
return nil, acme.WrapErrorISE(err, "could not load ACME provisioner from context")
}
2021-07-22 21:48:41 +00:00
if !acmeProv.RequireEAB {
return nil, nil
}
if nar.ExternalAccountBinding == nil {
return nil, acme.NewError(acme.ErrorExternalAccountRequiredType, "no external account binding provided")
}
eabJSONBytes, err := json.Marshal(nar.ExternalAccountBinding)
if err != nil {
2021-09-16 21:09:24 +00:00
return nil, acme.WrapErrorISE(err, "error marshaling externalAccountBinding into bytes")
}
eabJWS, err := jose.ParseJWS(string(eabJSONBytes))
if err != nil {
return nil, acme.WrapErrorISE(err, "error parsing externalAccountBinding jws")
}
// TODO(hs): implement strategy pattern to allow for different ways of verification (i.e. webhook call) based on configuration?
keyID, acmeErr := validateEABJWS(ctx, eabJWS)
if acmeErr != nil {
return nil, acmeErr
}
externalAccountKey, err := h.db.GetExternalAccountKey(ctx, acmeProv.Name, keyID)
if err != nil {
if _, ok := err.(*acme.Error); ok {
return nil, acme.WrapError(acme.ErrorUnauthorizedType, err, "the field 'kid' references an unknown key")
}
return nil, acme.WrapErrorISE(err, "error retrieving external account key")
}
2021-07-22 21:48:41 +00:00
if externalAccountKey.AlreadyBound() {
return nil, acme.NewError(acme.ErrorUnauthorizedType, "external account binding key with id '%s' was already bound to account '%s' on %s", keyID, externalAccountKey.AccountID, externalAccountKey.BoundAt)
}
payload, err := eabJWS.Verify(externalAccountKey.KeyBytes)
if err != nil {
return nil, acme.WrapErrorISE(err, "error verifying externalAccountBinding signature")
}
jwk, err := jwkFromContext(ctx)
if err != nil {
return nil, err
}
var payloadJWK *jose.JSONWebKey
2021-07-17 18:29:12 +00:00
err = json.Unmarshal(payload, &payloadJWK)
if err != nil {
2021-07-17 18:39:12 +00:00
return nil, acme.WrapError(acme.ErrorMalformedType, err, "error unmarshaling payload into jwk")
}
2021-07-17 18:29:12 +00:00
if !keysAreEqual(jwk, payloadJWK) {
return nil, acme.NewError(acme.ErrorUnauthorizedType, "keys in jws and eab payload do not match")
}
return externalAccountKey, nil
}
2021-07-17 18:29:12 +00:00
// keysAreEqual performs an equality check on two JWKs by comparing
// the (base64 encoding) of the Key IDs.
func keysAreEqual(x, y *jose.JSONWebKey) bool {
2021-07-17 18:29:12 +00:00
if x == nil || y == nil {
return false
}
digestX, errX := acme.KeyToID(x)
digestY, errY := acme.KeyToID(y)
if errX != nil || errY != nil {
return false
}
return digestX == digestY
}
// validateEABJWS verifies the contents of the External Account Binding JWS.
// The protected header of the JWS MUST meet the following criteria:
// o The "alg" field MUST indicate a MAC-based algorithm
// o The "kid" field MUST contain the key identifier provided by the CA
// o The "nonce" field MUST NOT be present
// o The "url" field MUST be set to the same value as the outer JWS
func validateEABJWS(ctx context.Context, jws *jose.JSONWebSignature) (string, *acme.Error) {
if jws == nil {
return "", acme.NewErrorISE("no JWS provided")
}
if len(jws.Signatures) != 1 {
return "", acme.NewError(acme.ErrorMalformedType, "JWS must have one signature")
}
header := jws.Signatures[0].Protected
algorithm := header.Algorithm
keyID := header.KeyID
nonce := header.Nonce
if !(algorithm == jose.HS256 || algorithm == jose.HS384 || algorithm == jose.HS512) {
return "", acme.NewError(acme.ErrorMalformedType, "'alg' field set to invalid algorithm '%s'", algorithm)
}
if keyID == "" {
return "", acme.NewError(acme.ErrorMalformedType, "'kid' field is required")
}
if nonce != "" {
return "", acme.NewError(acme.ErrorMalformedType, "'nonce' must not be present")
}
jwsURL, ok := header.ExtraHeaders["url"]
if !ok {
return "", acme.NewError(acme.ErrorMalformedType, "'url' field is required")
}
outerJWS, err := jwsFromContext(ctx)
if err != nil {
return "", acme.WrapErrorISE(err, "could not retrieve outer JWS from context")
}
if len(outerJWS.Signatures) != 1 {
return "", acme.NewError(acme.ErrorMalformedType, "outer JWS must have one signature")
}
outerJWSURL, ok := outerJWS.Signatures[0].Protected.ExtraHeaders["url"]
if !ok {
return "", acme.NewError(acme.ErrorMalformedType, "'url' field must be set in outer JWS")
}
if jwsURL != outerJWSURL {
return "", acme.NewError(acme.ErrorMalformedType, "'url' field is not the same value as the outer JWS")
}
return keyID, nil
}