2022-03-24 15:08:23 +00:00
|
|
|
// Package api implements a SCEP HTTP server.
|
2021-02-12 16:02:39 +00:00
|
|
|
package api
|
2021-02-12 11:03:08 +00:00
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
|
|
|
"crypto/x509"
|
|
|
|
"encoding/base64"
|
2022-03-24 12:58:50 +00:00
|
|
|
"errors"
|
|
|
|
"fmt"
|
2021-02-12 11:03:08 +00:00
|
|
|
"io"
|
|
|
|
"net/http"
|
2021-03-05 11:40:42 +00:00
|
|
|
"net/url"
|
2021-02-12 11:03:08 +00:00
|
|
|
"strings"
|
|
|
|
|
2021-03-05 11:40:42 +00:00
|
|
|
"github.com/go-chi/chi"
|
2022-03-22 12:31:18 +00:00
|
|
|
microscep "github.com/micromdm/scep/v2/scep"
|
|
|
|
"go.mozilla.org/pkcs7"
|
2023-04-28 15:15:05 +00:00
|
|
|
"go.step.sm/linkedca"
|
2022-03-22 12:31:18 +00:00
|
|
|
|
2021-02-12 11:03:08 +00:00
|
|
|
"github.com/smallstep/certificates/api"
|
2022-03-22 12:31:18 +00:00
|
|
|
"github.com/smallstep/certificates/api/log"
|
2021-02-12 11:03:08 +00:00
|
|
|
"github.com/smallstep/certificates/authority/provisioner"
|
2021-02-12 16:02:39 +00:00
|
|
|
"github.com/smallstep/certificates/scep"
|
2023-04-28 13:47:22 +00:00
|
|
|
"github.com/smallstep/certificates/scep/api/webhook"
|
2021-02-12 11:03:08 +00:00
|
|
|
)
|
|
|
|
|
2021-02-12 16:02:39 +00:00
|
|
|
const (
|
|
|
|
opnGetCACert = "GetCACert"
|
|
|
|
opnGetCACaps = "GetCACaps"
|
|
|
|
opnPKIOperation = "PKIOperation"
|
2021-02-25 23:32:21 +00:00
|
|
|
|
|
|
|
// TODO: add other (more optional) operations and handling
|
2021-02-12 16:02:39 +00:00
|
|
|
)
|
|
|
|
|
2021-02-26 23:34:50 +00:00
|
|
|
const maxPayloadSize = 2 << 20
|
|
|
|
|
2022-03-24 12:58:50 +00:00
|
|
|
// request is a SCEP server request.
|
|
|
|
type request struct {
|
2021-02-12 16:02:39 +00:00
|
|
|
Operation string
|
|
|
|
Message []byte
|
|
|
|
}
|
|
|
|
|
2022-05-03 01:47:47 +00:00
|
|
|
// Response is a SCEP server Response.
|
|
|
|
type Response struct {
|
2021-02-26 23:34:50 +00:00
|
|
|
Operation string
|
|
|
|
CACertNum int
|
|
|
|
Data []byte
|
|
|
|
Certificate *x509.Certificate
|
2021-05-06 22:23:09 +00:00
|
|
|
Error error
|
2021-02-12 16:02:39 +00:00
|
|
|
}
|
|
|
|
|
2022-03-24 12:58:50 +00:00
|
|
|
// handler is the SCEP request handler.
|
2022-05-05 02:20:34 +00:00
|
|
|
type handler struct {
|
|
|
|
auth *scep.Authority
|
|
|
|
}
|
2022-04-28 01:06:27 +00:00
|
|
|
|
|
|
|
// Route traffic and implement the Router interface.
|
|
|
|
//
|
|
|
|
// Deprecated: use scep.Route(r api.Router)
|
|
|
|
func (h *handler) Route(r api.Router) {
|
2022-05-05 02:20:34 +00:00
|
|
|
route(r, func(next http.HandlerFunc) http.HandlerFunc {
|
|
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
ctx := scep.NewContext(r.Context(), h.auth)
|
|
|
|
next(w, r.WithContext(ctx))
|
|
|
|
}
|
|
|
|
})
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
2021-02-12 16:02:39 +00:00
|
|
|
// New returns a new SCEP API router.
|
2022-04-28 01:06:27 +00:00
|
|
|
//
|
|
|
|
// Deprecated: use scep.Route(r api.Router)
|
2022-03-24 15:08:23 +00:00
|
|
|
func New(auth *scep.Authority) api.RouterHandler {
|
2022-05-05 02:20:34 +00:00
|
|
|
return &handler{auth: auth}
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Route traffic and implement the Router interface.
|
2022-04-28 01:06:27 +00:00
|
|
|
func Route(r api.Router) {
|
2022-05-05 02:20:34 +00:00
|
|
|
route(r, nil)
|
|
|
|
}
|
|
|
|
|
|
|
|
func route(r api.Router, middleware func(next http.HandlerFunc) http.HandlerFunc) {
|
|
|
|
getHandler := lookupProvisioner(Get)
|
|
|
|
postHandler := lookupProvisioner(Post)
|
|
|
|
|
|
|
|
// For backward compatibility.
|
|
|
|
if middleware != nil {
|
|
|
|
getHandler = middleware(getHandler)
|
|
|
|
postHandler = middleware(postHandler)
|
|
|
|
}
|
|
|
|
|
|
|
|
r.MethodFunc(http.MethodGet, "/{provisionerName}/*", getHandler)
|
|
|
|
r.MethodFunc(http.MethodGet, "/{provisionerName}", getHandler)
|
|
|
|
r.MethodFunc(http.MethodPost, "/{provisionerName}/*", postHandler)
|
|
|
|
r.MethodFunc(http.MethodPost, "/{provisionerName}", postHandler)
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
2021-02-26 23:34:50 +00:00
|
|
|
// Get handles all SCEP GET requests
|
2022-04-28 01:06:27 +00:00
|
|
|
func Get(w http.ResponseWriter, r *http.Request) {
|
2022-03-24 12:58:50 +00:00
|
|
|
req, err := decodeRequest(r)
|
2021-02-12 11:03:08 +00:00
|
|
|
if err != nil {
|
2022-03-24 12:58:50 +00:00
|
|
|
fail(w, fmt.Errorf("invalid scep get request: %w", err))
|
2021-02-26 23:34:50 +00:00
|
|
|
return
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
2021-02-26 23:34:50 +00:00
|
|
|
ctx := r.Context()
|
2022-05-03 01:47:47 +00:00
|
|
|
var res Response
|
2021-02-12 11:03:08 +00:00
|
|
|
|
2022-03-24 12:58:50 +00:00
|
|
|
switch req.Operation {
|
2021-02-12 11:03:08 +00:00
|
|
|
case opnGetCACert:
|
2022-04-28 01:06:27 +00:00
|
|
|
res, err = GetCACert(ctx)
|
2021-02-12 11:03:08 +00:00
|
|
|
case opnGetCACaps:
|
2022-04-28 01:06:27 +00:00
|
|
|
res, err = GetCACaps(ctx)
|
2021-02-12 11:03:08 +00:00
|
|
|
case opnPKIOperation:
|
2022-05-13 00:39:36 +00:00
|
|
|
res, err = PKIOperation(ctx, req)
|
2021-02-12 11:03:08 +00:00
|
|
|
default:
|
2022-03-24 12:58:50 +00:00
|
|
|
err = fmt.Errorf("unknown operation: %s", req.Operation)
|
2021-02-26 23:34:50 +00:00
|
|
|
}
|
2021-02-12 11:03:08 +00:00
|
|
|
|
2021-02-26 23:34:50 +00:00
|
|
|
if err != nil {
|
2022-03-24 12:58:50 +00:00
|
|
|
fail(w, fmt.Errorf("scep get request failed: %w", err))
|
2021-02-26 23:34:50 +00:00
|
|
|
return
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
2021-02-26 23:34:50 +00:00
|
|
|
|
2022-03-24 12:58:50 +00:00
|
|
|
writeResponse(w, res)
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
2021-02-26 23:34:50 +00:00
|
|
|
// Post handles all SCEP POST requests
|
2022-04-28 01:06:27 +00:00
|
|
|
func Post(w http.ResponseWriter, r *http.Request) {
|
2022-03-24 12:58:50 +00:00
|
|
|
req, err := decodeRequest(r)
|
2021-02-12 11:03:08 +00:00
|
|
|
if err != nil {
|
2022-03-24 12:58:50 +00:00
|
|
|
fail(w, fmt.Errorf("invalid scep post request: %w", err))
|
2021-02-26 23:34:50 +00:00
|
|
|
return
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
2022-05-03 01:47:47 +00:00
|
|
|
var res Response
|
2022-03-24 12:58:50 +00:00
|
|
|
switch req.Operation {
|
2021-02-12 11:03:08 +00:00
|
|
|
case opnPKIOperation:
|
2022-04-28 01:06:27 +00:00
|
|
|
res, err = PKIOperation(r.Context(), req)
|
2021-02-12 11:03:08 +00:00
|
|
|
default:
|
2022-03-24 12:58:50 +00:00
|
|
|
err = fmt.Errorf("unknown operation: %s", req.Operation)
|
2021-02-26 23:34:50 +00:00
|
|
|
}
|
2021-02-12 11:03:08 +00:00
|
|
|
|
2021-02-26 23:34:50 +00:00
|
|
|
if err != nil {
|
2022-03-24 12:58:50 +00:00
|
|
|
fail(w, fmt.Errorf("scep post request failed: %w", err))
|
2021-02-26 23:34:50 +00:00
|
|
|
return
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
2022-03-24 12:58:50 +00:00
|
|
|
writeResponse(w, res)
|
2021-02-26 23:34:50 +00:00
|
|
|
}
|
2021-02-12 11:03:08 +00:00
|
|
|
|
2022-03-24 12:58:50 +00:00
|
|
|
func decodeRequest(r *http.Request) (request, error) {
|
2021-02-12 11:03:08 +00:00
|
|
|
defer r.Body.Close()
|
|
|
|
|
|
|
|
method := r.Method
|
|
|
|
query := r.URL.Query()
|
|
|
|
|
|
|
|
var operation string
|
|
|
|
if _, ok := query["operation"]; ok {
|
|
|
|
operation = query.Get("operation")
|
|
|
|
}
|
|
|
|
|
|
|
|
switch method {
|
|
|
|
case http.MethodGet:
|
|
|
|
switch operation {
|
|
|
|
case opnGetCACert, opnGetCACaps:
|
2022-03-24 12:58:50 +00:00
|
|
|
return request{
|
2021-02-12 11:03:08 +00:00
|
|
|
Operation: operation,
|
|
|
|
Message: []byte{},
|
|
|
|
}, nil
|
|
|
|
case opnPKIOperation:
|
|
|
|
var message string
|
|
|
|
if _, ok := query["message"]; ok {
|
|
|
|
message = query.Get("message")
|
|
|
|
}
|
2022-05-01 20:29:17 +00:00
|
|
|
// TODO: verify this; right type of encoding? Needs additional transformations?
|
|
|
|
decodedMessage, err := base64.StdEncoding.DecodeString(message)
|
2021-02-12 11:03:08 +00:00
|
|
|
if err != nil {
|
2022-03-24 12:58:50 +00:00
|
|
|
return request{}, err
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
2022-03-24 12:58:50 +00:00
|
|
|
return request{
|
2021-02-12 11:03:08 +00:00
|
|
|
Operation: operation,
|
|
|
|
Message: decodedMessage,
|
|
|
|
}, nil
|
|
|
|
default:
|
2022-03-24 12:58:50 +00:00
|
|
|
return request{}, fmt.Errorf("unsupported operation: %s", operation)
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
case http.MethodPost:
|
2021-11-12 23:46:34 +00:00
|
|
|
body, err := io.ReadAll(io.LimitReader(r.Body, maxPayloadSize))
|
2021-02-12 11:03:08 +00:00
|
|
|
if err != nil {
|
2022-03-24 12:58:50 +00:00
|
|
|
return request{}, err
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
2022-03-24 12:58:50 +00:00
|
|
|
return request{
|
2021-02-12 11:03:08 +00:00
|
|
|
Operation: operation,
|
|
|
|
Message: body,
|
|
|
|
}, nil
|
|
|
|
default:
|
2022-03-24 12:58:50 +00:00
|
|
|
return request{}, fmt.Errorf("unsupported method: %s", method)
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// lookupProvisioner loads the provisioner associated with the request.
|
|
|
|
// Responds 404 if the provisioner does not exist.
|
2022-04-28 01:06:27 +00:00
|
|
|
func lookupProvisioner(next http.HandlerFunc) http.HandlerFunc {
|
2021-02-12 11:03:08 +00:00
|
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
2022-01-21 15:07:31 +00:00
|
|
|
name := chi.URLParam(r, "provisionerName")
|
|
|
|
provisionerName, err := url.PathUnescape(name)
|
2021-03-05 11:40:42 +00:00
|
|
|
if err != nil {
|
2022-03-24 12:58:50 +00:00
|
|
|
fail(w, fmt.Errorf("error url unescaping provisioner name '%s'", name))
|
2021-03-05 11:40:42 +00:00
|
|
|
return
|
|
|
|
}
|
2021-02-19 10:01:19 +00:00
|
|
|
|
2022-04-28 01:06:27 +00:00
|
|
|
ctx := r.Context()
|
|
|
|
auth := scep.MustFromContext(ctx)
|
|
|
|
p, err := auth.LoadProvisionerByName(provisionerName)
|
2021-02-12 11:03:08 +00:00
|
|
|
if err != nil {
|
2022-03-24 12:58:50 +00:00
|
|
|
fail(w, err)
|
2021-02-12 11:03:08 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2021-10-08 18:59:57 +00:00
|
|
|
prov, ok := p.(*provisioner.SCEP)
|
2021-02-12 11:03:08 +00:00
|
|
|
if !ok {
|
2022-03-24 12:58:50 +00:00
|
|
|
fail(w, errors.New("provisioner must be of type SCEP"))
|
2021-02-12 11:03:08 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2021-10-08 18:59:57 +00:00
|
|
|
ctx = context.WithValue(ctx, scep.ProvisionerContextKey, scep.Provisioner(prov))
|
2021-02-12 11:03:08 +00:00
|
|
|
next(w, r.WithContext(ctx))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-02-26 23:34:50 +00:00
|
|
|
// GetCACert returns the CA certificates in a SCEP response
|
2022-05-03 01:47:47 +00:00
|
|
|
func GetCACert(ctx context.Context) (Response, error) {
|
2022-04-28 01:06:27 +00:00
|
|
|
auth := scep.MustFromContext(ctx)
|
|
|
|
certs, err := auth.GetCACertificates(ctx)
|
2021-02-12 11:03:08 +00:00
|
|
|
if err != nil {
|
2022-05-03 01:47:47 +00:00
|
|
|
return Response{}, err
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if len(certs) == 0 {
|
2022-05-03 01:47:47 +00:00
|
|
|
return Response{}, errors.New("missing CA cert")
|
2021-02-26 23:34:50 +00:00
|
|
|
}
|
|
|
|
|
2022-05-03 01:47:47 +00:00
|
|
|
res := Response{
|
2021-03-06 23:30:37 +00:00
|
|
|
Operation: opnGetCACert,
|
|
|
|
CACertNum: len(certs),
|
|
|
|
}
|
2021-02-26 23:34:50 +00:00
|
|
|
|
|
|
|
if len(certs) == 1 {
|
2022-03-24 12:58:50 +00:00
|
|
|
res.Data = certs[0].Raw
|
2021-02-12 11:03:08 +00:00
|
|
|
} else {
|
2021-03-21 15:42:41 +00:00
|
|
|
// create degenerate pkcs7 certificate structure, according to
|
|
|
|
// https://tools.ietf.org/html/rfc8894#section-4.2.1.2, because
|
|
|
|
// not signed or encrypted data has to be returned.
|
2021-02-12 11:03:08 +00:00
|
|
|
data, err := microscep.DegenerateCertificates(certs)
|
2021-02-26 23:34:50 +00:00
|
|
|
if err != nil {
|
2022-05-03 01:47:47 +00:00
|
|
|
return Response{}, err
|
2021-02-26 23:34:50 +00:00
|
|
|
}
|
2022-03-24 12:58:50 +00:00
|
|
|
res.Data = data
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
2022-03-24 12:58:50 +00:00
|
|
|
return res, nil
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
2021-02-26 23:34:50 +00:00
|
|
|
// GetCACaps returns the CA capabilities in a SCEP response
|
2022-05-03 01:47:47 +00:00
|
|
|
func GetCACaps(ctx context.Context) (Response, error) {
|
2022-04-28 01:06:27 +00:00
|
|
|
auth := scep.MustFromContext(ctx)
|
|
|
|
caps := auth.GetCACaps(ctx)
|
2021-02-12 11:03:08 +00:00
|
|
|
|
2022-05-03 01:47:47 +00:00
|
|
|
res := Response{
|
2021-03-06 23:50:00 +00:00
|
|
|
Operation: opnGetCACaps,
|
|
|
|
Data: formatCapabilities(caps),
|
|
|
|
}
|
2021-02-12 11:03:08 +00:00
|
|
|
|
2022-03-24 12:58:50 +00:00
|
|
|
return res, nil
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
2021-02-26 23:34:50 +00:00
|
|
|
// PKIOperation performs PKI operations and returns a SCEP response
|
2022-05-03 01:47:47 +00:00
|
|
|
func PKIOperation(ctx context.Context, req request) (Response, error) {
|
2021-03-06 22:24:49 +00:00
|
|
|
// parse the message using microscep implementation
|
2022-03-24 12:58:50 +00:00
|
|
|
microMsg, err := microscep.ParsePKIMessage(req.Message)
|
2021-02-12 11:03:08 +00:00
|
|
|
if err != nil {
|
2021-03-10 20:13:05 +00:00
|
|
|
// return the error, because we can't use the msg for creating a CertRep
|
2022-05-03 01:47:47 +00:00
|
|
|
return Response{}, err
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
2021-03-10 20:13:05 +00:00
|
|
|
// this is essentially doing the same as microscep.ParsePKIMessage, but
|
|
|
|
// gives us access to the p7 itself in scep.PKIMessage. Essentially a small
|
|
|
|
// wrapper for the microscep implementation.
|
2021-03-06 22:24:49 +00:00
|
|
|
p7, err := pkcs7.Parse(microMsg.Raw)
|
|
|
|
if err != nil {
|
2022-05-03 01:47:47 +00:00
|
|
|
return Response{}, err
|
2021-03-06 22:24:49 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// copy over properties to our internal PKIMessage
|
2021-02-26 17:07:50 +00:00
|
|
|
msg := &scep.PKIMessage{
|
|
|
|
TransactionID: microMsg.TransactionID,
|
|
|
|
MessageType: microMsg.MessageType,
|
|
|
|
SenderNonce: microMsg.SenderNonce,
|
|
|
|
Raw: microMsg.Raw,
|
2021-03-06 22:24:49 +00:00
|
|
|
P7: p7,
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
2022-04-28 01:06:27 +00:00
|
|
|
auth := scep.MustFromContext(ctx)
|
|
|
|
if err := auth.DecryptPKIEnvelope(ctx, msg); err != nil {
|
2022-05-03 01:47:47 +00:00
|
|
|
return Response{}, err
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
2021-03-10 20:13:05 +00:00
|
|
|
// NOTE: at this point we have sufficient information for returning nicely signed CertReps
|
|
|
|
csr := msg.CSRReqMessage.CSR
|
|
|
|
|
2023-04-28 13:47:22 +00:00
|
|
|
prov, err := scep.ProvisionerFromContext(ctx) // TODO(hs): should this be retrieved in the API?
|
|
|
|
if err != nil {
|
|
|
|
return Response{}, err
|
|
|
|
}
|
|
|
|
|
|
|
|
const checkMethodWebhook string = "webhook"
|
2023-04-28 15:15:05 +00:00
|
|
|
checkMethod := ""
|
|
|
|
for _, wh := range prov.GetOptions().GetWebhooks() {
|
|
|
|
// if there's at least one webhook for validating SCEP challenges, the
|
|
|
|
// webhook will be used to perform challenge validation.
|
|
|
|
if wh.Kind == linkedca.Webhook_SCEPCHALLENGE.String() {
|
|
|
|
checkMethod = checkMethodWebhook
|
|
|
|
break
|
|
|
|
}
|
|
|
|
}
|
2023-04-28 13:47:22 +00:00
|
|
|
|
2022-01-14 09:48:23 +00:00
|
|
|
// NOTE: we're blocking the RenewalReq if the challenge does not match, because otherwise we don't have any authentication.
|
|
|
|
// The macOS SCEP client performs renewals using PKCSreq. The CertNanny SCEP client will use PKCSreq with challenge too, it seems,
|
|
|
|
// even if using the renewal flow as described in the README.md. MicroMDM SCEP client also only does PKCSreq by default, unless
|
|
|
|
// a certificate exists; then it will use RenewalReq. Adding the challenge check here may be a small breaking change for clients.
|
|
|
|
// We'll have to see how it works out.
|
|
|
|
if msg.MessageType == microscep.PKCSReq || msg.MessageType == microscep.RenewalReq {
|
2023-04-28 13:47:22 +00:00
|
|
|
// TODO(hs): might be nice use strategy pattern implementation; maybe behind the
|
|
|
|
// auth.MatchChallengePassword interface/method. Will need to think about methods
|
|
|
|
// that don't just check the password, but do different things on success and
|
|
|
|
// failure too.
|
|
|
|
switch checkMethod {
|
|
|
|
case checkMethodWebhook:
|
2023-04-28 15:15:05 +00:00
|
|
|
c, err := webhook.New(prov.GetOptions().GetWebhooks())
|
2023-04-28 13:47:22 +00:00
|
|
|
if err != nil {
|
|
|
|
return createFailureResponse(ctx, csr, msg, microscep.BadRequest, errors.New("failed creating SCEP validation webhook controller"))
|
|
|
|
}
|
2023-04-28 15:15:05 +00:00
|
|
|
if err := c.Validate(msg.CSRReqMessage.ChallengePassword); err != nil {
|
2023-04-28 13:47:22 +00:00
|
|
|
return createFailureResponse(ctx, csr, msg, microscep.BadRequest, errors.New("failed validating challenge password"))
|
|
|
|
}
|
|
|
|
default:
|
|
|
|
challengeMatches, err := auth.MatchChallengePassword(ctx, msg.CSRReqMessage.ChallengePassword)
|
|
|
|
if err != nil {
|
|
|
|
return createFailureResponse(ctx, csr, msg, microscep.BadRequest, errors.New("error when checking password"))
|
|
|
|
}
|
|
|
|
if !challengeMatches {
|
|
|
|
// TODO: can this be returned safely to the client? In the end, if the password was correct, that gains a bit of info too.
|
|
|
|
return createFailureResponse(ctx, csr, msg, microscep.BadRequest, errors.New("wrong chalenge password provided"))
|
|
|
|
}
|
2021-03-06 23:30:37 +00:00
|
|
|
}
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
2022-01-14 09:48:23 +00:00
|
|
|
// TODO: authorize renewal: we can authorize renewals with the challenge password (if reusable secrets are used).
|
|
|
|
// Renewals OPTIONALLY include the challenge if the existing cert is used as authentication, but client SHOULD omit the challenge.
|
|
|
|
// This means that for renewal requests we should check the certificate provided to be signed before by the CA. We could
|
|
|
|
// enforce use of the challenge if we want too. That way we could be more flexible in terms of authentication scheme (i.e. reusing
|
|
|
|
// tokens from other provisioners, calling a webhook, storing multiple secrets, allowing them to be multi-use, etc).
|
|
|
|
// Authentication by the (self-signed) certificate with an optional challenge is required; supporting renewals incl. verification
|
|
|
|
// of the client cert is not.
|
2021-03-10 21:20:02 +00:00
|
|
|
|
2022-04-28 01:06:27 +00:00
|
|
|
certRep, err := auth.SignCSR(ctx, csr, msg)
|
2021-02-12 11:03:08 +00:00
|
|
|
if err != nil {
|
2022-04-28 01:06:27 +00:00
|
|
|
return createFailureResponse(ctx, csr, msg, microscep.BadRequest, fmt.Errorf("error when signing new certificate: %w", err))
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
2022-05-03 01:47:47 +00:00
|
|
|
res := Response{
|
2021-03-06 23:30:37 +00:00
|
|
|
Operation: opnPKIOperation,
|
|
|
|
Data: certRep.Raw,
|
|
|
|
Certificate: certRep.Certificate,
|
|
|
|
}
|
2021-02-12 16:02:39 +00:00
|
|
|
|
2022-03-24 12:58:50 +00:00
|
|
|
return res, nil
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func formatCapabilities(caps []string) []byte {
|
2021-02-19 11:06:24 +00:00
|
|
|
return []byte(strings.Join(caps, "\r\n"))
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
2022-03-24 12:58:50 +00:00
|
|
|
// writeResponse writes a SCEP response back to the SCEP client.
|
2022-05-03 01:47:47 +00:00
|
|
|
func writeResponse(w http.ResponseWriter, res Response) {
|
2022-03-24 12:58:50 +00:00
|
|
|
if res.Error != nil {
|
|
|
|
log.Error(w, res.Error)
|
2021-05-06 22:23:09 +00:00
|
|
|
}
|
|
|
|
|
2022-03-24 12:58:50 +00:00
|
|
|
if res.Certificate != nil {
|
|
|
|
api.LogCertificate(w, res.Certificate)
|
2021-03-10 20:13:05 +00:00
|
|
|
}
|
|
|
|
|
2022-03-24 12:58:50 +00:00
|
|
|
w.Header().Set("Content-Type", contentHeader(res))
|
|
|
|
_, _ = w.Write(res.Data)
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
|
2022-03-24 12:58:50 +00:00
|
|
|
func fail(w http.ResponseWriter, err error) {
|
|
|
|
log.Error(w, err)
|
|
|
|
|
|
|
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
2021-02-26 23:34:50 +00:00
|
|
|
}
|
2021-02-12 11:03:08 +00:00
|
|
|
|
2022-05-03 01:47:47 +00:00
|
|
|
func createFailureResponse(ctx context.Context, csr *x509.CertificateRequest, msg *scep.PKIMessage, info microscep.FailInfo, failError error) (Response, error) {
|
2022-04-28 01:06:27 +00:00
|
|
|
auth := scep.MustFromContext(ctx)
|
|
|
|
certRepMsg, err := auth.CreateFailureResponse(ctx, csr, msg, scep.FailInfoName(info), failError.Error())
|
2021-03-10 20:13:05 +00:00
|
|
|
if err != nil {
|
2022-05-03 01:47:47 +00:00
|
|
|
return Response{}, err
|
2021-03-10 20:13:05 +00:00
|
|
|
}
|
2022-05-03 01:47:47 +00:00
|
|
|
return Response{
|
2021-03-10 20:13:05 +00:00
|
|
|
Operation: opnPKIOperation,
|
|
|
|
Data: certRepMsg.Raw,
|
2021-05-06 22:23:09 +00:00
|
|
|
Error: failError,
|
2021-03-10 20:13:05 +00:00
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
|
2022-05-03 01:47:47 +00:00
|
|
|
func contentHeader(r Response) string {
|
2021-02-26 23:34:50 +00:00
|
|
|
switch r.Operation {
|
2022-03-24 15:08:23 +00:00
|
|
|
default:
|
|
|
|
return "text/plain"
|
2021-02-12 11:03:08 +00:00
|
|
|
case opnGetCACert:
|
2021-02-26 23:34:50 +00:00
|
|
|
if r.CACertNum > 1 {
|
2022-03-24 15:08:23 +00:00
|
|
|
return "application/x-x509-ca-ra-cert"
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
2022-03-24 15:08:23 +00:00
|
|
|
return "application/x-x509-ca-cert"
|
2021-02-12 11:03:08 +00:00
|
|
|
case opnPKIOperation:
|
2022-03-24 15:08:23 +00:00
|
|
|
return "application/x-pki-message"
|
2021-02-12 11:03:08 +00:00
|
|
|
}
|
|
|
|
}
|