From 0956c8149f11921ed427d67b10bb9b6c4b97df48 Mon Sep 17 00:00:00 2001

From: Sumit Bose <sbose@redhat.com>

Date: Thu, 2 Feb 2017 12:32:13 +0100

Subject: [PATCH] IPA certauth plugin

This patch add a certauth plugin which allows the IPA server to support

PKINIT for certificates which do not include a special SAN extension

which contains a Kerberos principal but allow other mappings with the

help of SSSD's certmap library.

Related to https://pagure.io/freeipa/issue/4905

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

Reviewed-By: David Kupka <dkupka@redhat.com>

---

 daemons/ipa-kdb/Makefile.am        |  24 ++-

 daemons/ipa-kdb/ipa-certauth.in    |   5 +

 daemons/ipa-kdb/ipa_kdb.c          |   2 +

 daemons/ipa-kdb/ipa_kdb.exports    |   1 +

 daemons/ipa-kdb/ipa_kdb.h          |   5 +

 daemons/ipa-kdb/ipa_kdb_certauth.c | 398 +++++++++++++++++++++++++++++++++++++

 freeipa.spec.in                    |   2 +

 server.m4                          |  13 ++

 8 files changed, 449 insertions(+), 1 deletion(-)

 create mode 100644 daemons/ipa-kdb/ipa-certauth.in

 create mode 100644 daemons/ipa-kdb/ipa_kdb_certauth.c

diff --git a/daemons/ipa-kdb/Makefile.am b/daemons/ipa-kdb/Makefile.am

index 6a2caa0637bf076c796b50efc92412062524f35f..715666e779a4fa64c2c0f71767f09efb19b5f908 100644

--- a/daemons/ipa-kdb/Makefile.am

+++ b/daemons/ipa-kdb/Makefile.am

@@ -18,6 +18,7 @@ AM_CPPFLAGS =						\

 	$(WARN_CFLAGS)					\

 	$(NDRPAC_CFLAGS)				\

 	$(NSS_CFLAGS)					\

+	$(SSSCERTMAP_CFLAGS)				\

 	$(NULL)

 plugindir = $(libdir)/krb5/plugins/kdb

@@ -39,6 +40,20 @@ ipadb_la_SOURCES = 		\

 	ipa_kdb_audit_as.c	\

 	$(NULL)

+if BUILD_IPA_CERTAUTH_PLUGIN

+ipadb_la_SOURCES += ipa_kdb_certauth.c

+

+

+%: %.in

+	sed \

+		-e 's|@plugindir@|$(plugindir)|g' \

+		'$(srcdir)/$@.in' >$@

+

+krb5confdir = $(sysconfdir)/krb5.conf.d

+krb5conf_DATA = ipa-certauth

+CLEANFILES = $(krb5conf_DATA)

+endif

+

 ipadb_la_LDFLAGS = 		\

 	-avoid-version 		\

 	-module			\

@@ -50,6 +65,7 @@ ipadb_la_LIBADD = 		\

 	$(NDRPAC_LIBS)		\

 	$(UNISTRING_LIBS)	\

 	$(NSS_LIBS)             \

+	$(SSSCERTMAP_LIBS)	\

 	$(top_builddir)/util/libutil.la	\

 	$(NULL)

@@ -70,6 +86,11 @@ ipa_kdb_tests_SOURCES =        \

        ipa_kdb_delegation.c    \

        ipa_kdb_audit_as.c      \

        $(NULL)

+

+if BUILD_IPA_CERTAUTH_PLUGIN

+ipa_kdb_tests_SOURCES += ipa_kdb_certauth.c

+endif

+

 ipa_kdb_tests_CFLAGS = $(CMOCKA_CFLAGS)

 ipa_kdb_tests_LDADD =          \

        $(CMOCKA_LIBS)          \

@@ -78,12 +99,13 @@ ipa_kdb_tests_LDADD =          \

        $(NDRPAC_LIBS)          \

        $(UNISTRING_LIBS)       \

        $(NSS_LIBS)             \

+       $(SSSCERTMAP_LIBS)      \

        $(top_builddir)/util/libutil.la	\

        -lkdb5                  \

        -lsss_idmap             \

        $(NULL)

-dist_noinst_DATA = ipa_kdb.exports

+dist_noinst_DATA = ipa_kdb.exports ipa-certauth.in

 clean-local:

 	rm -f tests/.dirstamp

diff --git a/daemons/ipa-kdb/ipa-certauth.in b/daemons/ipa-kdb/ipa-certauth.in

new file mode 100644

index 0000000000000000000000000000000000000000..eda89a26f02fbea449eb754b232b8115904acd21

--- /dev/null

+++ b/daemons/ipa-kdb/ipa-certauth.in

@@ -0,0 +1,5 @@

+[plugins]

+ certauth = {

+  module = ipakdb:@plugindir@/ipadb.so

+  enable_only = ipakdb

+ }

diff --git a/daemons/ipa-kdb/ipa_kdb.c b/daemons/ipa-kdb/ipa_kdb.c

index c19b7c40e2e88173ab8367a3ef1d7f46245fd174..a961e4e57cf5379eb237551d56e3bc8dc82d952d 100644

--- a/daemons/ipa-kdb/ipa_kdb.c

+++ b/daemons/ipa-kdb/ipa_kdb.c

@@ -67,6 +67,8 @@ static void ipadb_context_free(krb5_context kcontext,

         }

         free(cfg->authz_data);

+        ipa_certauth_free_moddata(&((*ctx)->certauth_moddata));

+

         free(*ctx);

         *ctx = NULL;

     }

diff --git a/daemons/ipa-kdb/ipa_kdb.exports b/daemons/ipa-kdb/ipa_kdb.exports

index d2c3f30246cc7ebcba02a9ec5d134e604fa0dbb9..27ce92d2edd741245061a5f4ee9275169440c932 100644

--- a/daemons/ipa-kdb/ipa_kdb.exports

+++ b/daemons/ipa-kdb/ipa_kdb.exports

@@ -3,6 +3,7 @@ EXPORTED {

 	# public symbols

 	global:

 		kdb_function_table;

+		certauth_ipakdb_initvt;

 	# everything else is local

 	local:

diff --git a/daemons/ipa-kdb/ipa_kdb.h b/daemons/ipa-kdb/ipa_kdb.h

index 72f2675809a3267cce30bc06c77335697c7287ad..632c1979d15e88aec86d5e408ed6c7017d8362b8 100644

--- a/daemons/ipa-kdb/ipa_kdb.h

+++ b/daemons/ipa-kdb/ipa_kdb.h

@@ -40,6 +40,7 @@

 #include <arpa/inet.h>

 #include <endian.h>

 #include <unistd.h>

+#include <krb5/certauth_plugin.h>

 #include "ipa_krb5.h"

 #include "ipa_pwd.h"

@@ -111,6 +112,7 @@ struct ipadb_context {

     krb5_key_salt_tuple *def_encs;

     int n_def_encs;

     struct ipadb_mspac *mspac;

+    krb5_certauth_moddata certauth_moddata;

     /* Don't access this directly, use ipadb_get_global_config(). */

     struct ipadb_global_config config;

@@ -331,3 +333,6 @@ ipadb_get_global_config(struct ipadb_context *ipactx);

 int ipadb_get_enc_salt_types(struct ipadb_context *ipactx, LDAPMessage *entry,

                              char *attr, krb5_key_salt_tuple **enc_salt_types,

                              int *n_enc_salt_types);

+

+/* CERTAUTH PLUGIN */

+void ipa_certauth_free_moddata(krb5_certauth_moddata *moddata);

diff --git a/daemons/ipa-kdb/ipa_kdb_certauth.c b/daemons/ipa-kdb/ipa_kdb_certauth.c

new file mode 100644

index 0000000000000000000000000000000000000000..a53a2ce4e7ceb06ec8de117cdbca2666fdb5a97a

--- /dev/null

+++ b/daemons/ipa-kdb/ipa_kdb_certauth.c

@@ -0,0 +1,398 @@

+/** BEGIN COPYRIGHT BLOCK

+ * This program is free software; you can redistribute it and/or modify

+ * it under the terms of the GNU General Public License as published by

+ * the Free Software Foundation, either version 3 of the License, or

+ * (at your option) any later version.

+ *

+ * This program is distributed in the hope that it will be useful,

+ * but WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+ * GNU General Public License for more details.

+ *

+ * You should have received a copy of the GNU General Public License

+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.

+ *

+ * Additional permission under GPLv3 section 7:

+ *

+ * In the following paragraph, "GPL" means the GNU General Public

+ * License, version 3 or any later version, and "Non-GPL Code" means

+ * code that is governed neither by the GPL nor a license

+ * compatible with the GPL.

+ *

+ * You may link the code of this Program with Non-GPL Code and convey

+ * linked combinations including the two, provided that such Non-GPL

+ * Code only links to the code of this Program through those well

+ * defined interfaces identified in the file named EXCEPTION found in

+ * the source code files (the "Approved Interfaces"). The files of

+ * Non-GPL Code may instantiate templates or use macros or inline

+ * functions from the Approved Interfaces without causing the resulting

+ * work to be covered by the GPL. Only the copyright holders of this

+ * Program may make changes or additions to the list of Approved

+ * Interfaces.

+ *

+ * Authors:

+ * Sumit Bose <sbose@redhat.com>

+ *

+ * Copyright (C) 2017 Red Hat, Inc.

+ * All rights reserved.

+ * END COPYRIGHT BLOCK **/

+

+#include <errno.h>

+//#include <krb5/certauth_plugin.h>

+#include <syslog.h>

+#include <sss_certmap.h>

+

+#include "util/ipa_krb5.h"

+#include "ipa_kdb.h"

+

+#define IPA_OC_CERTMAP_RULE "ipaCertMapRule"

+#define IPA_CERTMAP_MAPRULE "ipaCertMapMapRule"

+#define IPA_CERTMAP_MATCHRULE "ipaCertMapMatchRule"

+#define IPA_CERTMAP_PRIORITY "ipaCertMapPriority"

+#define IPA_ENABLED_FLAG "ipaEnabledFlag"

+#define IPA_TRUE_VALUE "TRUE"

+#define IPA_ASSOCIATED_DOMAIN "associatedDomain"

+

+#define OBJECTCLASS "objectClass"

+

+#define CERTMAP_FILTER "(&("OBJECTCLASS"="IPA_OC_CERTMAP_RULE")" \

+                              "("IPA_ENABLED_FLAG"="IPA_TRUE_VALUE"))"

+

+#ifndef discard_const

+#define discard_const(ptr) ((void *)((uintptr_t)(ptr)))

+#endif

+

+

+struct krb5_certauth_moddata_st {

+    char *local_domain;

+    struct sss_certmap_ctx *sss_certmap_ctx;

+    struct ipadb_context *ipactx;

+};

+

+void ipa_certmap_debug(void *private,

+                       const char *file, long line,

+                       const char *function,

+                       const char *format, ...)

+{

+    va_list ap;

+    char str[255] = { 0 };

+

+    va_start(ap, format);

+    vsnprintf(str, sizeof(str)-1, format, ap);

+    va_end(ap);

+    krb5_klog_syslog(LOG_INFO, str);

+}

+

+void ipa_certauth_free_moddata(krb5_certauth_moddata *moddata)

+{

+    if (moddata == NULL || *moddata == NULL) {

+        return;

+    }

+

+    free((*moddata)->local_domain);

+    (*moddata)->local_domain = NULL;

+    sss_certmap_free_ctx((*moddata)->sss_certmap_ctx);

+    (*moddata)->sss_certmap_ctx = NULL;

+

+    free(*moddata);

+

+    return;

+}

+

+static krb5_error_code ipa_get_init_data(krb5_context kcontext,

+                                         krb5_certauth_moddata moddata_out)

+{

+    int ret;

+    struct sss_certmap_ctx *ctx = NULL;

+    struct ipadb_context *ipactx;

+    krb5_error_code kerr;

+    char *basedn = NULL;

+    LDAPMessage *result = NULL;

+    LDAPMessage *le;

+    LDAP *lc;

+    size_t c;

+    uint32_t prio;

+    char *map_rule = NULL;

+    char *match_rule = NULL;

+    char **domains = NULL;

+

+    const char *certmap_attrs[] = { OBJECTCLASS,

+                                    IPA_CERTMAP_PRIORITY,

+                                    IPA_CERTMAP_MATCHRULE,

+                                    IPA_CERTMAP_MAPRULE,

+                                    IPA_ASSOCIATED_DOMAIN,

+                                    IPA_ENABLED_FLAG,

+                                    NULL};

+

+

+    krb5_klog_syslog(LOG_INFO, "Initializing IPA certauth plugin.");

+

+    ipactx = ipadb_get_context(kcontext);

+    if (ipactx == NULL) {

+        return KRB5_KDB_DBNOTINITED;

+    }

+

+    if (ipactx->certauth_moddata == NULL) {

+        ret = asprintf(&basedn, "cn=certmap,%s", ipactx->base);

+        if (ret == -1) {

+            return ENOMEM;

+        }

+

+        kerr = ipadb_simple_search(ipactx,basedn, LDAP_SCOPE_SUBTREE,

+                                   CERTMAP_FILTER, discard_const(certmap_attrs),

+                                   &result);

+        if (kerr != 0 && kerr != KRB5_KDB_NOENTRY) {

+            goto done;

+        }

+

+        ret = sss_certmap_init(NULL, ipa_certmap_debug, NULL, &ctx;;

+        if (ret != 0) {

+            return ret;

+        }

+

+        if (kerr == KRB5_KDB_NOENTRY) {

+            ret = sss_certmap_add_rule(ctx, SSS_CERTMAP_MIN_PRIO,

+                                       NULL, NULL, NULL);

+            if (ret != 0) {

+                goto done;

+            }

+        } else {

+            lc = ipactx->lcontext;

+

+            for (le = ldap_first_entry(lc, result); le;

+                                                 le = ldap_next_entry(lc, le)) {

+                prio = SSS_CERTMAP_MIN_PRIO;

+                ret = ipadb_ldap_attr_to_uint32(lc, le, IPA_CERTMAP_PRIORITY,

+                                                &prio;;

+                if (ret != 0 && ret != ENOENT) {

+                    goto done;

+                }

+

+                free(map_rule);

+                map_rule = NULL;

+                ret = ipadb_ldap_attr_to_str(lc, le, IPA_CERTMAP_MAPRULE,

+                                             &map_rule);

+                if (ret != 0 && ret != ENOENT) {

+                    goto done;

+                }

+

+                free(match_rule);

+                match_rule = NULL;

+                ret = ipadb_ldap_attr_to_str(lc, le, IPA_CERTMAP_MATCHRULE,

+                                             &match_rule);

+                if (ret != 0 && ret != ENOENT) {

+                    goto done;

+                }

+

+                if (domains != NULL) {

+                    for (c = 0; domains[c] != NULL; c++) {

+                        free(domains[c]);

+                    }

+                    free(domains);

+                    domains = NULL;

+                }

+                ret = ipadb_ldap_attr_to_strlist(lc, le, IPA_ASSOCIATED_DOMAIN,

+                                                 &domains);

+                if (ret != 0 && ret != ENOENT) {

+                    goto done;

+                }

+

+                ret = sss_certmap_add_rule(ctx, prio, match_rule, map_rule,

+                                           (const char **) domains);

+                if (ret != 0) {

+                    goto done;

+                }

+            }

+        }

+

+        ipactx->certauth_moddata = moddata_out;

+

+        if (ipactx->realm != NULL) {

+            ipactx->certauth_moddata->local_domain = strdup(ipactx->realm);

+            if (ipactx->certauth_moddata->local_domain == NULL) {

+                free(ipactx->certauth_moddata);

+                ipactx->certauth_moddata = NULL;

+                ret = ENOMEM;

+                goto done;

+            }

+        }

+

+        ipactx->certauth_moddata->sss_certmap_ctx = ctx;

+        ipactx->certauth_moddata->ipactx = ipactx;

+

+    }

+

+    ret = 0;

+

+done:

+    ldap_msgfree(result);

+    free(basedn);

+    free(map_rule);

+    free(match_rule);

+    if (domains != NULL) {

+        for (c = 0; domains[c] != NULL; c++) {

+            free(domains[c]);

+        }

+        free(domains);

+        domains = NULL;

+    }

+

+    if (ret != 0) {

+        sss_certmap_free_ctx(ctx);

+    }

+

+    return ret;

+}

+

+static krb5_error_code ipa_certauth_authorize(krb5_context context,

+                                              krb5_certauth_moddata moddata,

+                                              const uint8_t *cert,

+                                              size_t cert_len,

+                                              krb5_const_principal princ,

+                                              const void *opts,

+                                              const krb5_db_entry *db_entry,

+                                              char ***authinds_out)

+{

+    char *cert_filter = NULL;

+    char **domains = NULL;

+    int ret;

+    size_t c;

+    char *principal = NULL;

+    LDAPMessage *res = NULL;

+    krb5_error_code kerr;

+    LDAPMessage *lentry;

+

+    if (moddata == NULL) {

+        return KRB5_PLUGIN_NO_HANDLE;

+    }

+

+    if (moddata->sss_certmap_ctx == NULL) {

+        kerr = ipa_get_init_data(context, moddata);

+        if (kerr != 0) {

+            krb5_klog_syslog(LOG_ERR, "Failed to init certmapping data");

+            return KRB5_PLUGIN_NO_HANDLE;

+        }

+    }

+

+    ret = krb5_unparse_name(context, princ, &principal);

+    if (ret != 0) {

+        ret = KRB5KDC_ERR_CERTIFICATE_MISMATCH;

+        goto done;

+    }

+    krb5_klog_syslog(LOG_INFO, "Doing certauth authorize for [%s]", principal);

+

+    ret = sss_certmap_get_search_filter(moddata->sss_certmap_ctx,

+                                        cert, cert_len,

+                                        &cert_filter, &domains);

+    if (ret != 0) {

+        if (ret == ENOENT) {

+            ret = KRB5KDC_ERR_CERTIFICATE_MISMATCH;

+        }

+        goto done;

+    }

+    krb5_klog_syslog(LOG_INFO, "Got cert filter [%s]", cert_filter);

+

+    /* If there are no domains assigned the rule will apply to the local

+     * domain only. */

+    if (domains != NULL) {

+

+        if (moddata->local_domain == NULL) {

+        /* We don't know our own domain name, in general this should not

+         * happen. But to be fault tolerant we allow matching rule which

+         * do not have a domain assigned. */

+

+            ret = KRB5KDC_ERR_CERTIFICATE_MISMATCH;

+            goto done;

+        }

+

+        for (c = 0; domains[c] != NULL; c++) {

+            if (strcasecmp(domains[c], moddata->local_domain) == 0) {

+                break;

+            }

+        }

+

+        /* Our domain was not in the list */

+        if (domains[c] == NULL) {

+            ret = KRB5KDC_ERR_CERTIFICATE_MISMATCH;

+            goto done;

+        }

+    }

+

+    kerr = ipadb_fetch_principals_with_extra_filter(moddata->ipactx,

+                                                    KRB5_KDB_FLAG_ALIAS_OK,

+                                                    principal,

+                                                    cert_filter,

+                                                    &res;;

+    if (kerr != 0) {

+        krb5_klog_syslog(LOG_ERR, "Search failed [%d]", kerr);

+        ret = KRB5KDC_ERR_CERTIFICATE_MISMATCH;

+        goto done;

+    }

+

+    kerr = ipadb_find_principal(context, KRB5_KDB_FLAG_ALIAS_OK, res,

+                                &principal, &lentry);

+    if (kerr == KRB5_KDB_NOENTRY) {

+        krb5_klog_syslog(LOG_INFO, "No matching entry found");

+        ret = KRB5KDC_ERR_CERTIFICATE_MISMATCH;

+        goto done;

+    } else if (kerr != 0) {

+        krb5_klog_syslog(LOG_ERR, "ipadb_find_principal failed [%d]", kerr);

+        ret = KRB5KDC_ERR_CERTIFICATE_MISMATCH;

+        goto done;

+    }

+

+    /* TODO: add more tests ? */

+

+    ret = 0;

+

+done:

+    sss_certmap_free_filter_and_domains(cert_filter, domains);

+    krb5_free_unparsed_name(context, principal);

+    ldap_msgfree(res);

+

+    return ret;

+}

+

+static krb5_error_code ipa_certauth_init(krb5_context kcontext,

+                                         krb5_certauth_moddata *moddata_out)

+{

+    struct krb5_certauth_moddata_st *certauth_moddata;

+

+    certauth_moddata = calloc(1, sizeof(struct krb5_certauth_moddata_st));

+    if (certauth_moddata == NULL) {

+        return ENOMEM;

+    }

+

+    *moddata_out = certauth_moddata;

+

+    return 0;

+}

+

+static void ipa_certauth_fini(krb5_context context,

+                              krb5_certauth_moddata moddata_out)

+{

+    krb5_klog_syslog(LOG_INFO, "IPA certauth plugin un-loaded.");

+    return;

+}

+

+

+krb5_error_code certauth_ipakdb_initvt(krb5_context context,

+                                          int maj_ver, int min_ver,

+                                          krb5_plugin_vtable vtable)

+{

+    krb5_certauth_vtable vt;

+

+    if (maj_ver != 1) {

+        return KRB5_PLUGIN_VER_NOTSUPP;

+    }

+

+    vt = (krb5_certauth_vtable) vtable;

+

+    vt->name = "ipakdb";

+    vt->authorize = ipa_certauth_authorize;

+    vt->init = ipa_certauth_init;

+    vt->fini = ipa_certauth_fini;

+    /* currently we do not return authentication indicators */

+    vt->free_ind = NULL;

+    return 0;

+}

diff --git a/freeipa.spec.in b/freeipa.spec.in

index f776b34af88cc8ccd02da0713cb6eaca161c99f5..18291a5793a6b69dcd719f42e80e1652169e5e1d 100644

--- a/freeipa.spec.in

+++ b/freeipa.spec.in

@@ -120,6 +120,7 @@ BuildRequires:  libtalloc-devel

 BuildRequires:  libtevent-devel

 BuildRequires:  libuuid-devel

 BuildRequires:  libsss_idmap-devel

+BuildRequires:  libsss_certmap-devel

 # 1.14.0: sss_nss_getnamebycert (https://fedorahosted.org/sssd/ticket/2897)

 BuildRequires:  libsss_nss_idmap-devel >= 1.14.0

 BuildRequires:  rhino

@@ -1164,6 +1165,7 @@ fi

 %attr(0755,root,root) %{_libexecdir}/ipa/oddjob/org.freeipa.server.conncheck

 %config(noreplace) %{_sysconfdir}/dbus-1/system.d/org.freeipa.server.conf

 %config(noreplace) %{_sysconfdir}/oddjobd.conf.d/ipa-server.conf

+%config(noreplace) %{_sysconfdir}/krb5.conf.d/ipa-certauth

 %dir %{_libexecdir}/ipa/certmonger

 %attr(755,root,root) %{_libexecdir}/ipa/certmonger/*

 # NOTE: systemd specific section

diff --git a/server.m4 b/server.m4

index 92b5cdd3a6ff90b70a9002360ff3d3aec5053392..7b2e94df91a4803849e496142788a4ed87ef487d 100644

--- a/server.m4

+++ b/server.m4

@@ -30,6 +30,19 @@ dnl -- sss_idmap is needed by the extdom exop --

 PKG_CHECK_MODULES([SSSIDMAP], [sss_idmap])

 PKG_CHECK_MODULES([SSSNSSIDMAP], [sss_nss_idmap >= 1.13.90])

+dnl -- sss_certmap and certauth.h are needed by the IPA KDB certauth plugin --

+PKG_CHECK_EXISTS([sss_certmap],

+                 [PKG_CHECK_MODULES([SSSCERTMAP], [sss_certmap])],

+                 [AC_MSG_NOTICE([sss_certmap not found])])

+AC_CHECK_HEADER([krb5/certauth_plugin.h],

+                [have_certauth_plugin=yes],

+                [have_certauth_plugin=no])

+AM_CONDITIONAL([BUILD_IPA_CERTAUTH_PLUGIN],

+               [test x$have_certauth_plugin = xyes -a x"$SSSCERTMAP_LIBS" != x])

+AM_COND_IF([BUILD_IPA_CERTAUTH_PLUGIN],

+           [AC_MSG_NOTICE([Build IPA KDB certauth plugin])],

+           [AC_MSG_WARN([Cannot build IPA KDB certauth plugin])])

+

 dnl ---------------------------------------------------------------------------

 dnl - Check for KRB5 krad

 dnl ---------------------------------------------------------------------------

-- 

2.12.1