/* * Copyright (c) 2019 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * 3. Neither the name of the Institute nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ #include "krb5_locl.h" #include #include #include "../hx509/hx_locl.h" /* XXX find a better way */ #include "hx509-private.h" /* * This file implements a client for the kx509 protocol -- a Kerberized online * CA that can issue a Certificate to a client that authenticates using * Kerberos. * * The kx509 protocol is the inverse of PKINIT. Whereas PKINIT allows users * with PKIX credentials to acquire Kerberos credentials, the kx509 protocol * allows users with Kerberos credentials to acquire PKIX credentials. * * I.e., kx509 is a bridge, just like PKINIT. * * The kx509 protocol is very simple, and very limited. * * A request consists of a DER-encoded Kx509Request message prefixed with four * bytes identifying the protocol (see `version_2_0' below). * * A Kx509Request message contains an AP-REQ, a public key, and an HMAC of the * public key made with the session key of the AP-REQ's ticket. * * The service principal can be either kca_service/hostname.fqdn or * krbtgt/REALM (a Heimdal innovation). * * If a request is missing a public key, then the request is a probe intended * to discover whether the service is enabled, thus helping the client avoid * a possibly-slow private key generation operation. * * The response is a DER-encoded Kx509Response also prefixed with * `version_2_0', and contains: an optional error code and error text, an * optional certificate (for the success case), and an optional HMAC of those * fields that is present when the service was able to verify the AP-REQ. * * Limitations: * * - no proof of possession for the public key * - only RSA keys are supported * - no way to express options (e.g., what KUs, EKUs, or SANs are desired) * - no sub-session key usage * - no reflection protection other than the HMAC's forgery protection and the * fact that the client could tell that a reflected attack isn't success * * Future directions: * * - Since the public key field of the request is an OCTET STRING, we could * send a CSR, or even an expired certificate (possibly self-signed, * possibly one issued earlier) that can serve as a template. * * This solves the first three limitations, as it allows the client to * demonstrate proof of possession, allows arbitrary public key types, and * allows the client to express desires about the to-be-issued certificate. * * - Use the AP-REQ's Authenticator's sub-session key for the HMAC, and derive * per-direction sub-sub-keys. * * - We might design a new protocol that better fits the RFC4120 KDC message * framework. */ static const unsigned char version_2_0[4] = {0 , 0, 2, 0}; struct krb5_kx509_req_ctx_data { krb5_auth_context ac; krb5_data given_csr; hx509_request csr; Kx509CSRPlus csr_plus; char *realm; /* Realm to which to send request */ krb5_keyblock *hmac_key; /* For HMAC validation */ hx509_private_key *keys; hx509_private_key priv_key; unsigned int expect_chain; }; /** * Create a kx509 request context. * * @param context The Kerberos library context * @param out Where to place the kx509 request context * * @return A krb5 error code. */ krb5_error_code krb5_kx509_ctx_init(krb5_context context, krb5_kx509_req_ctx *out) { krb5_kx509_req_ctx ctx; krb5_error_code ret; hx509_name name = NULL; ALLOC(ctx, 1); if (ctx == NULL) return krb5_enomem(context); ctx->given_csr.data = NULL; ctx->priv_key = NULL; ctx->hmac_key = NULL; ctx->realm = NULL; ctx->keys = NULL; ctx->csr = NULL; ret = hx509_request_init(context->hx509ctx, &ctx->csr); if (ret == 0) ret = hx509_parse_name(context->hx509ctx, "", &name); if (ret == 0) ret = hx509_request_set_name(context->hx509ctx, ctx->csr, name); if (ret == 0) ret = krb5_auth_con_init(context, &ctx->ac); if (name) hx509_name_free(&name); if (ret == 0) *out = ctx; else krb5_kx509_ctx_free(context, &ctx); return ret; } /** * Free a kx509 request context. * * @param context The Kerberos library context * @param ctxp Pointer to krb5 request context to free * * @return A krb5 error code. */ void krb5_kx509_ctx_free(krb5_context context, krb5_kx509_req_ctx *ctxp) { krb5_kx509_req_ctx ctx = *ctxp; *ctxp = NULL; if (ctx == NULL) return; krb5_free_keyblock(context, ctx->hmac_key); krb5_auth_con_free(context, ctx->ac); free_Kx509CSRPlus(&ctx->csr_plus); free(ctx->realm); hx509_request_free(&ctx->csr); krb5_data_free(&ctx->given_csr); hx509_private_key_free(&ctx->priv_key); _hx509_certs_keys_free(context->hx509ctx, ctx->keys); free(ctx); } /** * Set a realm to send kx509 request to, if different from the client's. * * @param context The Kerberos library context * @param ctx The kx509 request context * @param realm Realm name * * @return A krb5 error code. */ krb5_error_code krb5_kx509_ctx_set_realm(krb5_context context, krb5_kx509_req_ctx kx509_ctx, const char *realm) { return ((kx509_ctx->realm = strdup(realm)) == NULL) ? krb5_enomem(context) : 0; } /** * Sets a CSR for a kx509 request. * * Normally kx509 will generate a CSR (and even a private key for it) * automatically. If a CSR is given then kx509 will use it instead of * generating one. * * @param context The Kerberos library context * @param ctx The kx509 request context * @param csr_der A DER-encoded PKCS#10 CSR * * @return A krb5 error code. */ krb5_error_code krb5_kx509_ctx_set_csr_der(krb5_context context, krb5_kx509_req_ctx ctx, krb5_data *csr_der) { krb5_data_free(&ctx->given_csr); return krb5_data_copy(&ctx->given_csr, csr_der->data, csr_der->length); } /** * Adds an EKU as an additional desired Certificate Extension or in the CSR if * the caller does not set a CSR. * * @param context The Kerberos library context * @param ctx The kx509 request context * @param oids A string representation of an OID * * @return A krb5 error code. */ krb5_error_code krb5_kx509_ctx_add_eku(krb5_context context, krb5_kx509_req_ctx kx509_ctx, const char *oids) { krb5_error_code ret; heim_oid oid; ret = der_parse_heim_oid(oids, NULL, &oid); if (ret == 0) hx509_request_add_eku(context->hx509ctx, kx509_ctx->csr, &oid); der_free_oid(&oid); return ret; } /** * Adds a dNSName SAN (domainname, hostname) as an additional desired * Certificate Extension or in the CSR if the caller does not set a CSR. * * @param context The Kerberos library context * @param ctx The kx509 request context * @param dname A string containing a DNS domainname * * @return A krb5 error code. */ krb5_error_code krb5_kx509_ctx_add_san_dns_name(krb5_context context, krb5_kx509_req_ctx kx509_ctx, const char *dname) { return hx509_request_add_dns_name(context->hx509ctx, kx509_ctx->csr, dname); } /** * Adds an xmppAddr SAN (jabber address) as an additional desired Certificate * Extension or in the CSR if the caller does not set a CSR. * * @param context The Kerberos library context * @param ctx The kx509 request context * @param jid A string containing a Jabber address * * @return A krb5 error code. */ krb5_error_code krb5_kx509_ctx_add_san_xmpp(krb5_context context, krb5_kx509_req_ctx kx509_ctx, const char *jid) { return hx509_request_add_xmpp_name(context->hx509ctx, kx509_ctx->csr, jid); } /** * Adds an rfc822Name SAN (e-mail address) as an additional desired Certificate * Extension or in the CSR if the caller does not set a CSR. * * @param context The Kerberos library context * @param ctx The kx509 request context * @param email A string containing an e-mail address * * @return A krb5 error code. */ krb5_error_code krb5_kx509_ctx_add_san_rfc822Name(krb5_context context, krb5_kx509_req_ctx kx509_ctx, const char *email) { return hx509_request_add_email(context->hx509ctx, kx509_ctx->csr, email); } /** * Adds an pkinit SAN (Kerberos principal name) as an additional desired * Certificate Extension or in the CSR if the caller does not set a CSR. * * @param context The Kerberos library context * @param ctx The kx509 request context * @param pname A string containing a representation of a Kerberos principal * name * * @return A krb5 error code. */ krb5_error_code krb5_kx509_ctx_add_san_pkinit(krb5_context context, krb5_kx509_req_ctx kx509_ctx, const char *pname) { return hx509_request_add_pkinit(context->hx509ctx, kx509_ctx->csr, pname); } /** * Adds a Microsoft-style UPN (user principal name) as an additional desired * Certificate Extension or in the CSR if the caller does not set a CSR. * * @param context The Kerberos library context * @param ctx The kx509 request context * @param upn A string containing a representation of a UPN * * @return A krb5 error code. */ krb5_error_code krb5_kx509_ctx_add_san_ms_upn(krb5_context context, krb5_kx509_req_ctx kx509_ctx, const char *upn) { return hx509_request_add_ms_upn_name(context->hx509ctx, kx509_ctx->csr, upn); } /** * Adds an registeredID SAN (OID) as an additional desired Certificate * Extension or in the CSR if the caller does not set a CSR. * * @param context The Kerberos library context * @param ctx The kx509 request context * @param oids A string representation of an OID * * @return A krb5 error code. */ krb5_error_code krb5_kx509_ctx_add_san_registeredID(krb5_context context, krb5_kx509_req_ctx kx509_ctx, const char *oids) { krb5_error_code ret; heim_oid oid; ret = der_parse_heim_oid(oids, NULL, &oid); if (ret == 0) hx509_request_add_registered(context->hx509ctx, kx509_ctx->csr, &oid); der_free_oid(&oid); return ret; } static krb5_error_code load_priv_key(krb5_context context, krb5_kx509_req_ctx kx509_ctx, const char *fn) { hx509_private_key *keys = NULL; hx509_certs certs = NULL; krb5_error_code ret; ret = hx509_certs_init(context->hx509ctx, fn, 0, NULL, &certs); if (ret == ENOENT) return 0; if (ret == 0) ret = _hx509_certs_keys_get(context->hx509ctx, certs, &keys); if (ret == 0 && keys[0] == NULL) ret = ENOENT; if (ret == 0) kx509_ctx->priv_key = _hx509_private_key_ref(keys[0]); if (ret) { char *emsg = hx509_get_error_string(context->hx509ctx, ret); krb5_set_error_message(context, ret, "Could not load private key " "from %s for kx509: %s", fn, emsg); hx509_free_error_string(emsg); } hx509_certs_free(&certs); return ret; } /** * Set a private key. * * @param context The Kerberos library context * @param ctx The kx509 request context * @param store The name of a PKIX credential store * * @return A krb5 error code. */ krb5_error_code krb5_kx509_ctx_set_key(krb5_context context, krb5_kx509_req_ctx kx509_ctx, const char *store) { SubjectPublicKeyInfo key; krb5_error_code ret; memset(&key, 0, sizeof(key)); hx509_private_key_free(&kx509_ctx->priv_key); _hx509_certs_keys_free(context->hx509ctx, kx509_ctx->keys); kx509_ctx->keys = NULL; ret = load_priv_key(context, kx509_ctx, store); if (ret == 0) ret = hx509_private_key2SPKI(context->hx509ctx, kx509_ctx->priv_key, &key); if (ret == 0) ret = hx509_request_set_SubjectPublicKeyInfo(context->hx509ctx, kx509_ctx->csr, &key); free_SubjectPublicKeyInfo(&key); return ret; } static krb5_error_code gen_priv_key(krb5_context context, const char *gen_type, unsigned long gen_bits, hx509_private_key *key) { struct hx509_generate_private_context *key_gen_ctx = NULL; krb5_error_code ret; _krb5_debug(context, 1, "kx509: gen priv key"); if (strcmp(gen_type, "rsa") != 0) { krb5_set_error_message(context, ENOTSUP, "Key type %s is not " "supported for kx509; only \"rsa\" is " "supported for kx509 at this time", gen_type); return ENOTSUP; } ret = _hx509_generate_private_key_init(context->hx509ctx, ASN1_OID_ID_PKCS1_RSAENCRYPTION, &key_gen_ctx); if (ret == 0) ret = _hx509_generate_private_key_bits(context->hx509ctx, key_gen_ctx, gen_bits); if (ret == 0) ret = _hx509_generate_private_key(context->hx509ctx, key_gen_ctx, key); _hx509_generate_private_key_free(&key_gen_ctx); if (ret) { char *emsg = hx509_get_error_string(context->hx509ctx, ret); krb5_set_error_message(context, ret, "Could not generate a private key: %s", emsg); hx509_free_error_string(emsg); } return ret; } /** * Generate a private key. * * @param context The Kerberos library context * @param ctx The kx509 request context * @param gen_type The type of key (default: rsa) * @param gen_bits The size of the key (for non-ECC, really, for RSA) * * @return A krb5 error code. */ krb5_error_code krb5_kx509_ctx_gen_key(krb5_context context, krb5_kx509_req_ctx kx509_ctx, const char *gen_type, int gen_bits) { SubjectPublicKeyInfo key; krb5_error_code ret; memset(&key, 0, sizeof(key)); if (gen_type == NULL) { gen_type = krb5_config_get_string_default(context, NULL, "rsa", "libdefaults", "kx509_gen_key_type", NULL); } if (gen_bits == 0) { /* * The key size is really only for non-ECC, of which we'll only support * RSA. For ECC key sizes will either be implied by the `key_type' or * will have to be a magic value that allows us to pick from some small * set of curves (e.g., 255 == Curve25519). */ gen_bits = krb5_config_get_int_default(context, NULL, 2048, "libdefaults", "kx509_gen_rsa_key_size", NULL); } hx509_private_key_free(&kx509_ctx->priv_key); _hx509_certs_keys_free(context->hx509ctx, kx509_ctx->keys); kx509_ctx->keys = NULL; ret = gen_priv_key(context, gen_type, gen_bits, &kx509_ctx->priv_key); if (ret == 0) ret = hx509_private_key2SPKI(context->hx509ctx, kx509_ctx->priv_key, &key); if (ret == 0) ret = hx509_request_set_SubjectPublicKeyInfo(context->hx509ctx, kx509_ctx->csr, &key); free_SubjectPublicKeyInfo(&key); return ret; } /* Set a cc config entry indicating that the kx509 service is not available */ static void store_kx509_disabled(krb5_context context, const char *realm, krb5_ccache cc) { krb5_data data; if (!cc) return; data.data = (void *)(uintptr_t)realm; data.length = strlen(realm); krb5_cc_set_config(context, cc, NULL, "kx509_service_realm", &data); data.data = "disabled"; data.length = strlen(data.data); krb5_cc_set_config(context, cc, NULL, "kx509_service_status", &data); } static int KRB5_CALLCONV certs_export_func(hx509_context context, void *d, hx509_cert c) { heim_octet_string os; Certificates *cs = d; Certificate c2; int ret; ret = hx509_cert_binary(context, c, &os); if (ret) return ret; ret = decode_Certificate(os.data, os.length, &c2, NULL); der_free_octet_string(&os); if (ret) return ret; ret = add_Certificates(cs, &c2); free_Certificate(&c2); return ret; } static krb5_error_code certs_export(hx509_context context, hx509_certs certs, heim_octet_string *out) { Certificates cs; size_t len; int ret; cs.len = 0; cs.val = 0; ret = hx509_certs_iter_f(context, certs, certs_export_func, &cs); if (ret == 0) ASN1_MALLOC_ENCODE(Certificates, out->data, out->length, &cs, &len, ret); free_Certificates(&cs); return ret; } /* Store the private key and certificate where requested */ static krb5_error_code store(krb5_context context, const char *hx509_store, const char *realm, krb5_ccache cc, hx509_private_key key, hx509_cert cert, hx509_certs chain) { heim_octet_string hdata; krb5_error_code ret = 0; krb5_data data; krb5_clear_error_message(context); if (cc) { /* Record the realm we used */ data.data = (void *)(uintptr_t)realm; data.length = strlen(realm); krb5_cc_set_config(context, cc, NULL, "kx509_service_realm", &data); /* Serialize and store the certificate in the ccache */ ret = hx509_cert_binary(context->hx509ctx, cert, &hdata); if (ret == 0) ret = krb5_cc_set_config(context, cc, NULL, "kx509cert", &hdata); der_free_octet_string(&hdata); if (ret == 0 && key) { /* * Serialized and store the key in the ccache. Use PKCS#8 so that we * store the algorithm OID too, which is needed in order to be able to * read the private key back. */ if (ret == 0) ret = _hx509_private_key_export(context->hx509ctx, key, HX509_KEY_FORMAT_PKCS8, &hdata); if (ret == 0) ret = krb5_cc_set_config(context, cc, NULL, "kx509key", &hdata); der_free_octet_string(&hdata); if (ret) krb5_set_error_message(context, ret, "Could not store kx509 " "private key and certificate in ccache %s", krb5_cc_get_name(context, cc)); } if (ret == 0 && chain) { ret = certs_export(context->hx509ctx, chain, &hdata); if (ret == 0) ret = krb5_cc_set_config(context, cc, NULL, "kx509cert-chain", &hdata); der_free_octet_string(&hdata); } } /* Store the private key and cert in an hx509 store */ if (hx509_store != NULL) { hx509_certs certs; if (key) _hx509_cert_assign_key(cert, key); /* store both in the same store */ ret = hx509_certs_init(context->hx509ctx, hx509_store, HX509_CERTS_CREATE, NULL, &certs); if (ret == 0) ret = hx509_certs_add(context->hx509ctx, certs, cert); if (ret == 0 && chain != NULL) ret = hx509_certs_merge(context->hx509ctx, certs, chain); if (ret == 0) ret = hx509_certs_store(context->hx509ctx, certs, 0, NULL); hx509_certs_free(&certs); if (ret) krb5_prepend_error_message(context, ret, "Could not store kx509 " "private key and certificate in key " "store %s", hx509_store); } /* Store the name of the hx509 store in the ccache too */ if (cc && hx509_store) { data.data = (void *)(uintptr_t)hx509_store; data.length = strlen(hx509_store); (void) krb5_cc_set_config(context, cc, NULL, "kx509store", &data); } return ret; } /* Make a Kx509CSRPlus or a raw SPKI */ static krb5_error_code mk_kx509_req_body(krb5_context context, krb5_kx509_req_ctx kx509_ctx, krb5_data *out) { krb5_error_code ret; size_t len; if (krb5_config_get_bool_default(context, NULL, FALSE, "realms", kx509_ctx->realm, "kx509_req_use_raw_spki", NULL)) { SubjectPublicKeyInfo spki; /* Interop with old kx509 servers, send a raw SPKI, not a CSR */ out->data = NULL; out->length = 0; memset(&spki, 0, sizeof(spki)); ret = hx509_private_key2SPKI(context->hx509ctx, kx509_ctx->priv_key, &spki); if (ret == 0) { out->length = spki.subjectPublicKey.length >> 3; out->data = spki.subjectPublicKey.data; } kx509_ctx->expect_chain = 0; return ret; } /* * New kx509 servers use a CSR for proof of possession, and send back a * chain of certificates, with the issued certificate first. */ kx509_ctx->expect_chain = 1; if (kx509_ctx->given_csr.length) { krb5_data exts_der; exts_der.data = NULL; exts_der.length = 0; /* Use the given CSR */ ret = der_copy_octet_string(&kx509_ctx->given_csr, &kx509_ctx->csr_plus.csr); /* * Extract the desired Certificate Extensions from our internal * as-yet-unsigned CSR, then decode them into place in the * Kx509CSRPlus. */ if (ret == 0) ret = hx509_request_get_exts(context->hx509ctx, kx509_ctx->csr, &exts_der); if (ret == 0 && exts_der.data && exts_der.length && (kx509_ctx->csr_plus.exts = calloc(1, sizeof (kx509_ctx->csr_plus.exts[0]))) == NULL) ret = krb5_enomem(context); if (ret == 0 && exts_der.data && exts_der.length) ret = decode_Extensions(exts_der.data, exts_der.length, kx509_ctx->csr_plus.exts, NULL); krb5_data_free(&exts_der); } else { /* * Sign and use our internal CSR, which will carry all our desired * Certificate Extensions as an extReq CSR Attribute. */ ret = hx509_request_to_pkcs10(context->hx509ctx, kx509_ctx->csr, kx509_ctx->priv_key, &kx509_ctx->csr_plus.csr); } if (ret == 0) ASN1_MALLOC_ENCODE(Kx509CSRPlus, out->data, out->length, &kx509_ctx->csr_plus, &len, ret); return ret; } static krb5_error_code get_start_realm(krb5_context context, krb5_ccache cc, krb5_const_principal princ, char **out) { krb5_error_code ret; krb5_data d; ret = krb5_cc_get_config(context, cc, NULL, "start_realm", &d); if (ret == 0) { *out = strndup(d.data, d.length); krb5_data_free(&d); } else if (princ) { *out = strdup(krb5_principal_get_realm(context, princ)); } else { krb5_principal ccprinc = NULL; ret = krb5_cc_get_principal(context, cc, &ccprinc); if (ret) return ret; *out = strdup(krb5_principal_get_realm(context, ccprinc)); krb5_free_principal(context, ccprinc); } return (*out) ? 0 : krb5_enomem(context); } /* * Make a request, which is a DER-encoded Kx509Request with version_2_0 * prefixed to it. * * If no private key is given, then a probe request will be made. */ static krb5_error_code mk_kx509_req(krb5_context context, krb5_kx509_req_ctx kx509_ctx, krb5_ccache incc, hx509_private_key private_key, krb5_data *req) { unsigned char digest[SHA_DIGEST_LENGTH]; SubjectPublicKeyInfo spki; struct Kx509Request kx509_req; krb5_data pre_req; krb5_error_code ret = 0; krb5_creds this_cred; krb5_creds *cred = NULL; HMAC_CTX ctx; const char *hostname; char *start_realm = NULL; size_t len = 0; krb5_data_zero(&pre_req); memset(&spki, 0, sizeof(spki)); memset(&this_cred, 0, sizeof(this_cred)); memset(&kx509_req, 0, sizeof(kx509_req)); kx509_req.pk_hash.data = digest; kx509_req.pk_hash.length = SHA_DIGEST_LENGTH; if (private_key || kx509_ctx->given_csr.data) { /* Encode the CSR or public key for use in the request */ ret = mk_kx509_req_body(context, kx509_ctx, &kx509_req.pk_key); } else { /* Probe */ kx509_req.pk_key.data = NULL; kx509_req.pk_key.length = 0; } if (ret == 0) ret = krb5_cc_get_principal(context, incc, &this_cred.client); if (ret == 0) ret = get_start_realm(context, incc, this_cred.client, &start_realm); if (ret == 0 && kx509_ctx->realm == NULL) ret = krb5_kx509_ctx_set_realm(context, kx509_ctx, start_realm); if (ret == 0) { /* * The kx509 protocol as deployed uses kca_service/kdc_hostname, but * this is inconvenient in libkrb5: we want to be able to use the * send_to_kdc machinery, and since the Heimdal KDC is also the kx509 * service, we want not to have to specify kx509 hosts separately from * KDCs. * * We'd much rather use krbtgt/CLIENT_REALM@REQUESTED_REALM. What * we do is assume all KDCs for `realm' support the kx509 service and * then sendto the KDCs for that realm while using a hostbased service * if still desired. * * Note that upstairs we try to get the start_realm cc config, so if * realm wasn't given to krb5_kx509_ext(), then it should be set to * that already unless there's no start_realm cc config, in which case * we'll use the ccache's default client principal's realm. */ hostname = krb5_config_get_string(context, NULL, "realms", kx509_ctx->realm, "kx509_hostname", NULL); if (hostname == NULL) hostname = krb5_config_get_string(context, NULL, "libdefaults", "kx509_hostname", NULL); if (hostname) { ret = krb5_sname_to_principal(context, hostname, "kca_service", KRB5_NT_SRV_HST, &this_cred.server); if (ret == 0) ret = krb5_principal_set_realm(context, this_cred.server, kx509_ctx->realm); } else { ret = krb5_make_principal(context, &this_cred.server, start_realm, KRB5_TGS_NAME, kx509_ctx->realm, NULL); } } /* Make the AP-REQ and extract the HMAC key */ if (ret == 0) ret = krb5_get_credentials(context, 0, incc, &this_cred, &cred); if (ret == 0) ret = krb5_mk_req_extended(context, &kx509_ctx->ac, AP_OPTS_USE_SUBKEY, NULL, cred, &kx509_req.authenticator); krb5_free_keyblock(context, kx509_ctx->hmac_key); kx509_ctx->hmac_key = NULL; if (ret == 0) ret = krb5_auth_con_getkey(context, kx509_ctx->ac, &kx509_ctx->hmac_key); if (ret) goto out; /* Add the the key and HMAC to the message */ HMAC_CTX_init(&ctx); if (HMAC_Init_ex(&ctx, kx509_ctx->hmac_key->keyvalue.data, kx509_ctx->hmac_key->keyvalue.length, EVP_sha1(), NULL) == 0) { HMAC_CTX_cleanup(&ctx); ret = krb5_enomem(context); } else { HMAC_Update(&ctx, version_2_0, sizeof(version_2_0)); if (private_key || kx509_ctx->given_csr.data) { HMAC_Update(&ctx, kx509_req.pk_key.data, kx509_req.pk_key.length); } else { /* Probe */ HMAC_Update(&ctx, kx509_req.authenticator.data, kx509_req.authenticator.length); } HMAC_Final(&ctx, kx509_req.pk_hash.data, 0); HMAC_CTX_cleanup(&ctx); } /* Encode the message, prefix `version_2_0', output the result */ if (ret == 0) ASN1_MALLOC_ENCODE(Kx509Request, pre_req.data, pre_req.length, &kx509_req, &len, ret); if (ret == 0) ret = krb5_data_alloc(req, pre_req.length + sizeof(version_2_0)); if (ret == 0) { memcpy(req->data, version_2_0, sizeof(version_2_0)); memcpy(((unsigned char *)req->data) + sizeof(version_2_0), pre_req.data, pre_req.length); } out: free(start_realm); free(pre_req.data); krb5_free_creds(context, cred); kx509_req.pk_hash.data = NULL; kx509_req.pk_hash.length = 0; free_Kx509Request(&kx509_req); free_SubjectPublicKeyInfo(&spki); krb5_free_cred_contents(context, &this_cred); if (ret == 0 && req->length != len + sizeof(version_2_0)) { krb5_data_free(req); krb5_set_error_message(context, ret = ERANGE, "Could not make a kx509 request"); } return ret; } static krb5_error_code rd_chain(krb5_context context, heim_octet_string *d, hx509_cert *cert, hx509_certs *chain, heim_error_t *herr) { krb5_error_code ret; Certificates certs; size_t i, len; *cert = NULL; *chain = NULL; if ((ret = decode_Certificates(d->data, d->length, &certs, &len))) return ret; if (certs.len == 0) { *herr = heim_error_create(EINVAL, "Server sent empty Certificate list"); return EINVAL; } *cert = hx509_cert_init(context->hx509ctx, &certs.val[0], herr); if (*cert == NULL) { free_Certificates(&certs); return errno; } if (certs.len == 1) _krb5_debug(context, 1, "kx509 server sent certificate but no chain"); else _krb5_debug(context, 1, "kx509 server sent %llu certificates", (unsigned long long)certs.len); ret = hx509_certs_init(context->hx509ctx, "MEMORY:anonymous", HX509_CERTS_CREATE, NULL, chain); if (ret) { hx509_cert_free(*cert); *cert = NULL; free_Certificates(&certs); return ret; } for (i = 1; ret == 0 && i < certs.len; i++) { hx509_cert c = hx509_cert_init(context->hx509ctx, &certs.val[i], herr); if (c == NULL) ret = errno; else ret = hx509_certs_add(context->hx509ctx, *chain, c); hx509_cert_free(c); } free_Certificates(&certs); if (ret) { hx509_certs_free(chain); hx509_cert_free(*cert); *cert = NULL; } return ret; } /* Parse and validate a kx509 reply */ static krb5_error_code rd_kx509_resp(krb5_context context, krb5_kx509_req_ctx kx509_ctx, krb5_data *rep, hx509_cert *cert, hx509_certs *chain) { unsigned char digest[SHA_DIGEST_LENGTH]; Kx509Response r; krb5_error_code code = 0; krb5_error_code ret = 0; heim_string_t hestr; heim_error_t herr = NULL; const char *estr; HMAC_CTX ctx; size_t hdr_len = sizeof(version_2_0); size_t len; *cert = NULL; *chain = NULL; /* Strip `version_2_0' prefix */ if (rep->length < hdr_len || memcmp(rep->data, version_2_0, hdr_len) != 0) { krb5_set_error_message(context, ENOTSUP, "KDC does not support kx509 protocol"); return ENOTSUP; /* XXX */ } /* Decode */ ret = decode_Kx509Response(((unsigned char *)rep->data) + 4, rep->length - 4, &r, &len); if (ret == 0 && len + hdr_len != rep->length) ret = EINVAL; /* XXX */ if (ret) { krb5_set_error_message(context, ret, "kx509 response is not valid"); return ret; } HMAC_CTX_init(&ctx); if (HMAC_Init_ex(&ctx, kx509_ctx->hmac_key->keyvalue.data, kx509_ctx->hmac_key->keyvalue.length, EVP_sha1(), NULL) == 0) { free_Kx509Response(&r); HMAC_CTX_cleanup(&ctx); return krb5_enomem(context); } HMAC_Update(&ctx, version_2_0, sizeof(version_2_0)); { int32_t t = r.error_code; unsigned char encint[sizeof(t) + 1]; size_t k; /* * RFC6717 says this about how the error-code is included in the HMAC: * * o DER representation of the error-code exclusive of the tag and * length, if it is present. * * So we use der_put_integer(), which encodes from the right. * * RFC6717 does not constrain the error-code's range. We assume it to * be a 32-bit, signed integer, for which we'll need no more than 5 * bytes. */ ret = der_put_integer(&encint[sizeof(encint) - 1], sizeof(encint), &t, &k); if (ret == 0) HMAC_Update(&ctx, &encint[sizeof(encint)] - k, k); /* Normalize error code */ if (r.error_code == 0) { code = 0; /* No error */ } else if (r.error_code < 0) { code = KRB5KRB_ERR_GENERIC; /* ??? */ } else if (r.error_code <= KX509_ERR_SRV_OVERLOADED - ERROR_TABLE_BASE_kx59) { /* * RFC6717 (kx509) error code. These are actually not used on the * wire in any existing implementations that we are aware of. Just * in case, however, we'll map these. */ code = KX509_ERR_CLNT_FATAL + r.error_code; } else if (r.error_code < kx509_krb5_error_base) { /* Unknown error codes */ code = KRB5KRB_ERR_GENERIC; } else { /* * Heimdal-specific enhancement to RFC6171: Kerberos wire protocol * error codes. */ code = KRB5KDC_ERR_NONE + r.error_code - kx509_krb5_error_base; if (code >= KRB5_ERR_RCSID) code = KRB5KRB_ERR_GENERIC; if (code == KRB5KDC_ERR_NONE) code = 0; } } if (r.certificate) HMAC_Update(&ctx, r.certificate->data, r.certificate->length); if (r.e_text) HMAC_Update(&ctx, *r.e_text, strlen(*r.e_text)); HMAC_Final(&ctx, &digest, 0); HMAC_CTX_cleanup(&ctx); if (r.hash == NULL) { /* * No HMAC -> unauthenticated [error] response. * * Do not output any certificate. */ free_Kx509Response(&r); return code; } /* * WARNING: We do not validate that `r.certificate' is a DER-encoded * Certificate, not here, and we don't use a different HMAC key * for the response than for the request. * * If ever we start sending a Certificate as the Kx509Request * pk-key field, then we'll have a reflection attack. As the * Certificate we'd send in that case will be expired, the * reflection attack would be just a DoS. */ if (r.hash->length != sizeof(digest) || ct_memcmp(r.hash->data, digest, sizeof(digest)) != 0) { krb5_set_error_message(context, KRB5KDC_ERR_PREAUTH_FAILED, "kx509 response MAC mismatch"); free_Kx509Response(&r); return KRB5KRB_AP_ERR_BAD_INTEGRITY; } if (r.certificate == NULL) { /* Authenticated response, either an error or probe success */ free_Kx509Response(&r); if (code != KRB5KDC_ERR_POLICY && kx509_ctx->priv_key == NULL) return 0; /* Probe success */ return code ? code : KRB5KDC_ERR_POLICY; /* Not a probe -> must fail */ } /* Import the certificate payload */ if (kx509_ctx->expect_chain) { ret = rd_chain(context, r.certificate, cert, chain, &herr); } else { *cert = hx509_cert_init_data(context->hx509ctx, r.certificate->data, r.certificate->length, &herr); if (!*cert) ret = errno; } free_Kx509Response(&r); if (*cert) { heim_release(herr); return 0; } hestr = herr ? heim_error_copy_string(herr) : NULL; estr = hestr ? heim_string_get_utf8(hestr) : "(no error message)"; krb5_set_error_message(context, ret, "Could not parse certificate " "produced by kx509 KDC: %s (%ld)", estr, herr ? (long)heim_error_get_code(herr) : 0L); heim_release(hestr); heim_release(herr); return HEIM_PKINIT_CERTIFICATE_INVALID; /* XXX */ } /* * Make a request, send it, get the response, parse it, and store the * private key and certificate. */ static krb5_error_code kx509_core(krb5_context context, krb5_kx509_req_ctx kx509_ctx, krb5_ccache incc, const char *hx509_store, krb5_ccache outcc) { krb5_error_code ret; hx509_certs chain = NULL; hx509_cert cert = NULL; krb5_data req, resp; krb5_data_zero(&req); krb5_data_zero(&resp); /* Make the kx509 request */ ret = mk_kx509_req(context, kx509_ctx, incc, kx509_ctx->priv_key, &req); /* Send the kx509 request and get the response */ if (ret == 0) ret = krb5_sendto_context(context, NULL, &req, kx509_ctx->realm, &resp); if (ret == 0) ret = rd_kx509_resp(context, kx509_ctx, &resp, &cert, &chain); /* Store the key and cert! */ if (ret == 0 && cert && (kx509_ctx->priv_key || kx509_ctx->given_csr.data)) ret = store(context, hx509_store, kx509_ctx->realm, outcc, kx509_ctx->priv_key, cert, chain); else if (ret == KRB5KDC_ERR_POLICY) /* Probe failed -> record that the realm does not support kx509 */ store_kx509_disabled(context, kx509_ctx->realm, outcc); hx509_certs_free(&chain); hx509_cert_free(cert); krb5_data_free(&resp); krb5_data_free(&req); return ret; } /** * Use the kx509 v2 protocol to get a certificate for the client principal. * * Given a private key this function will get a certificate. If no private key * is given, one will be generated. * * The private key and certificate will be stored in the given PKIX credential * store (e.g, "PEM-FILE:/path/to/file.pem") and/or given output ccache. When * stored in a ccache, the DER-encoded Certificate will be stored as the data * payload of a "cc config" named "kx509cert", while the key will be stored as * a DER-encoded PKCS#8 PrivateKeyInfo in a cc config named "kx509key". * * @param context The Kerberos library context * @param kx509_ctx A kx509 request context * @param incc A credential cache (if NULL use default ccache) * @param hx509_store An PKIX credential store into which to store the private * key and certificate (e.g, "PEM-FILE:/path/to/file.pem") * @param outcc A ccache into which to store the private key and certificate * (mandatory) * * @return A krb5 error code. */ KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kx509_ext(krb5_context context, krb5_kx509_req_ctx kx509_ctx, krb5_ccache incc, const char *hx509_store, krb5_ccache outcc) { krb5_ccache def_cc = NULL; krb5_error_code ret; if (incc == NULL) { if ((ret = krb5_cc_default(context, &def_cc))) return ret; incc = def_cc; } if (kx509_ctx->realm == NULL && (ret = get_start_realm(context, incc, NULL, &kx509_ctx->realm))) { if (def_cc) krb5_cc_close(context, def_cc); return ret; } if (kx509_ctx->priv_key || kx509_ctx->given_csr.data) { /* If given a private key, use it */ ret = kx509_core(context, kx509_ctx, incc, hx509_store, outcc); if (def_cc) krb5_cc_close(context, def_cc); return ret; } /* * No private key given, so we generate one. * * However, before taking the hit for generating a keypair we probe to see * if we're likely to succeeed. */ /* Probe == call kx509_core() w/o a private key */ ret = kx509_core(context, kx509_ctx, incc, NULL, outcc); if (ret == 0 && kx509_ctx->given_csr.data == NULL) ret = krb5_kx509_ctx_gen_key(context, kx509_ctx, NULL, 0); if (ret == 0) ret = kx509_core(context, kx509_ctx, incc, hx509_store, outcc); if (def_cc) krb5_cc_close(context, def_cc); return ret; } /** * Generates a public key and uses the kx509 v2 protocol to get a certificate * for that key and the client principal's subject name. * * The private key and certificate will be stored in the given ccache, and also * in a corresponding PKIX credential store if one is configured via * [libdefaults] kx509_store. * * XXX NOTE: Dicey feature here... Review carefully! * * @param context The Kerberos library context * @param cc A credential cache * @param realm A realm from which to get the certificate (uses the client * principal's realm if NULL) * * @return A krb5 error code. */ KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kx509(krb5_context context, krb5_ccache cc, const char *realm) { krb5_kx509_req_ctx kx509_ctx; krb5_error_code ret; const char *defcc; char *ccache_full_name = NULL; char *store_exp = NULL; ret = krb5_kx509_ctx_init(context, &kx509_ctx); if (ret) return ret; if (realm) ret = krb5_kx509_ctx_set_realm(context, kx509_ctx, realm); /* * The idea is that IF we are asked to do kx509 w/ creds from a default * ccache THEN we should store the kx509 certificate (if we get one) and * private key in the default hx509 store for kx509. * * Ideally we could have HTTP user-agents and/or TLS libraries look for * client certificates and private keys in that default hx509 store. * * Of course, those user-agents / libraries should be configured to use * those credentials with specific hostnames/domainnames, not the entire * Internet, as the latter leaks the user's identity to the world. * * So we check if the full name for `cc' is the same as that of the default * ccache name, and if so we get the [libdefaults] kx509_store string and * expand it, then use it. */ if (ret == 0 && (defcc = krb5_cc_configured_default_name(context)) && krb5_cc_get_full_name(context, cc, &ccache_full_name) == 0 && strcmp(defcc, ccache_full_name) == 0) { /* Find an hx509 store */ const char *store = krb5_config_get_string(context, NULL, "libdefaults", "kx509_store", NULL); if (store) ret = _krb5_expand_path_tokens(context, store, 1, &store_exp); /* * If there's a private key in the store already, we'll use it, else * we'll let krb5_kx509_ext() generate one, so we ignore this return * value: */ (void) krb5_kx509_ctx_set_key(context, kx509_ctx, store); } /* * If we did settle on a default hx509 store, we'll use it for reading the * private key from (if it exists) as well as for storing the certificate * (and private key) into, which may save us some key generation cycles. */ if (ret == 0) ret = krb5_kx509_ext(context, kx509_ctx, cc, store_exp, cc); krb5_kx509_ctx_free(context, &kx509_ctx); free(ccache_full_name); free(store_exp); return ret; }