Blame SOURCES/0040-pam-add-prompt-string-for-certificate-authentication.patch

9f2ebf
From 4f09838b50cc771d52c7b00cc47fb3362d8ecda2 Mon Sep 17 00:00:00 2001
9f2ebf
From: Sumit Bose <sbose@redhat.com>
9f2ebf
Date: Mon, 30 Oct 2017 08:03:42 +0100
9f2ebf
Subject: [PATCH 40/46] pam: add prompt string for certificate authentication
9f2ebf
MIME-Version: 1.0
9f2ebf
Content-Type: text/plain; charset=UTF-8
9f2ebf
Content-Transfer-Encoding: 8bit
9f2ebf
9f2ebf
A new certificate attribute is added which contains a string which is
9f2ebf
used in the certificate selection list displayed to the user. The
9f2ebf
Subject-DN of the certificate is used here because it is present in all
9f2ebf
certificate and in general differs for certificate with different usage.
9f2ebf
libsss_certmap is used to extract the subject-DN from the certificate
9f2ebf
and convert it into a string.
9f2ebf
9f2ebf
Related to https://pagure.io/SSSD/sssd/issue/3560
9f2ebf
9f2ebf
Reviewed-by: Fabiano FidĂȘncio <fidencio@redhat.com>
9f2ebf
Tested-by: Scott Poore <spoore@redhat.com>
9f2ebf
(cherry picked from commit 06c2300353faf3983e38fecb1d6afe1f6cc8fe32)
9f2ebf
---
9f2ebf
 Makefile.am                     |  2 ++
9f2ebf
 src/responder/pam/pamsrv_p11.c  | 65 ++++++++++++++++++++++++++++++++++++++++-
9f2ebf
 src/sss_client/pam_sss.c        | 31 ++++++++++++++++----
9f2ebf
 src/tests/cmocka/test_pam_srv.c | 23 +++++++++++++--
9f2ebf
 4 files changed, 111 insertions(+), 10 deletions(-)
9f2ebf
9f2ebf
diff --git a/Makefile.am b/Makefile.am
9f2ebf
index 4ed872a532daf9b934537cc5f64ce77778121e2a..16bcb4efc028b05c1196249245f4f3091b9366af 100644
9f2ebf
--- a/Makefile.am
9f2ebf
+++ b/Makefile.am
9f2ebf
@@ -1400,6 +1400,7 @@ sssd_pam_LDADD = \
9f2ebf
     $(SELINUX_LIBS) \
9f2ebf
     $(PAM_LIBS) \
9f2ebf
     $(SYSTEMD_DAEMON_LIBS) \
9f2ebf
+    libsss_certmap.la \
9f2ebf
     $(SSSD_INTERNAL_LTLIBS) \
9f2ebf
     $(NULL)
9f2ebf
 
9f2ebf
@@ -2423,6 +2424,7 @@ pam_srv_tests_LDADD = \
9f2ebf
     $(SYSTEMD_DAEMON_LIBS) \
9f2ebf
     libsss_test_common.la \
9f2ebf
     libsss_idmap.la \
9f2ebf
+    libsss_certmap.la \
9f2ebf
     $(NULL)
9f2ebf
 
9f2ebf
 EXTRA_responder_get_domains_tests_DEPENDENCIES = \
9f2ebf
diff --git a/src/responder/pam/pamsrv_p11.c b/src/responder/pam/pamsrv_p11.c
9f2ebf
index 4d5572164763ed0b3a842019f820680a4dc2dfdc..5a3eeff0ec977829a9ad8c80b4fc6b2e06857097 100644
9f2ebf
--- a/src/responder/pam/pamsrv_p11.c
9f2ebf
+++ b/src/responder/pam/pamsrv_p11.c
9f2ebf
@@ -26,6 +26,8 @@
9f2ebf
 #include "util/child_common.h"
9f2ebf
 #include "util/strtonum.h"
9f2ebf
 #include "responder/pam/pamsrv.h"
9f2ebf
+#include "lib/certmap/sss_certmap.h"
9f2ebf
+#include "util/crypto/sss_crypto.h"
9f2ebf
 
9f2ebf
 
9f2ebf
 #ifndef SSSD_LIBEXEC_PATH
9f2ebf
@@ -683,6 +685,54 @@ errno_t pam_check_cert_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
9f2ebf
     return EOK;
9f2ebf
 }
9f2ebf
 
9f2ebf
+static char *get_cert_prompt(TALLOC_CTX *mem_ctx, const char *cert)
9f2ebf
+{
9f2ebf
+    int ret;
9f2ebf
+    struct sss_certmap_ctx *ctx = NULL;
9f2ebf
+    unsigned char *der = NULL;
9f2ebf
+    size_t der_size;
9f2ebf
+    char *prompt = NULL;
9f2ebf
+    char *filter = NULL;
9f2ebf
+    char **domains = NULL;
9f2ebf
+
9f2ebf
+    ret = sss_certmap_init(mem_ctx, NULL, NULL, &ctx;;
9f2ebf
+    if (ret != 0) {
9f2ebf
+        DEBUG(SSSDBG_OP_FAILURE, "sss_certmap_init failed.\n");
9f2ebf
+        return NULL;
9f2ebf
+    }
9f2ebf
+
9f2ebf
+    ret = sss_certmap_add_rule(ctx, 10, "KRB5:<ISSUER>.*",
9f2ebf
+                               "LDAP:{subject_dn!nss}", NULL);
9f2ebf
+    if (ret != 0) {
9f2ebf
+        DEBUG(SSSDBG_OP_FAILURE, "sss_certmap_add_rule failed.\n");
9f2ebf
+        goto done;
9f2ebf
+    }
9f2ebf
+
9f2ebf
+    der = sss_base64_decode(mem_ctx, cert, &der_size);
9f2ebf
+    if (der == NULL) {
9f2ebf
+        DEBUG(SSSDBG_OP_FAILURE, "sss_base64_decode failed.\n");
9f2ebf
+        goto done;
9f2ebf
+    }
9f2ebf
+
9f2ebf
+    ret = sss_certmap_get_search_filter(ctx, der, der_size, &filter, &domains);
9f2ebf
+    if (ret != 0) {
9f2ebf
+        DEBUG(SSSDBG_OP_FAILURE, "sss_certmap_get_search_filter failed.\n");
9f2ebf
+        goto done;
9f2ebf
+    }
9f2ebf
+
9f2ebf
+    prompt = talloc_strdup(mem_ctx, filter);
9f2ebf
+    if (prompt == NULL) {
9f2ebf
+        DEBUG(SSSDBG_OP_FAILURE, "talloc_strdup failed.\n");
9f2ebf
+    }
9f2ebf
+
9f2ebf
+done:
9f2ebf
+    sss_certmap_free_filter_and_domains(filter, domains);
9f2ebf
+    sss_certmap_free_ctx(ctx);
9f2ebf
+    talloc_free(der);
9f2ebf
+
9f2ebf
+    return prompt;
9f2ebf
+}
9f2ebf
+
9f2ebf
 static errno_t pack_cert_data(TALLOC_CTX *mem_ctx, const char *sysdb_username,
9f2ebf
                               struct cert_auth_info *cert_info,
9f2ebf
                               uint8_t **_msg, size_t *_msg_len)
9f2ebf
@@ -692,16 +742,24 @@ static errno_t pack_cert_data(TALLOC_CTX *mem_ctx, const char *sysdb_username,
9f2ebf
     const char *token_name;
9f2ebf
     const char *module_name;
9f2ebf
     const char *key_id;
9f2ebf
+    char *prompt;
9f2ebf
     size_t user_len;
9f2ebf
     size_t token_len;
9f2ebf
     size_t module_len;
9f2ebf
     size_t key_id_len;
9f2ebf
+    size_t prompt_len;
9f2ebf
     const char *username = "";
9f2ebf
 
9f2ebf
     if (sysdb_username != NULL) {
9f2ebf
         username = sysdb_username;
9f2ebf
     }
9f2ebf
 
9f2ebf
+    prompt = get_cert_prompt(mem_ctx, sss_cai_get_cert(cert_info));
9f2ebf
+    if (prompt == NULL) {
9f2ebf
+        DEBUG(SSSDBG_OP_FAILURE, "get_cert_prompt failed.\n");
9f2ebf
+        return EIO;
9f2ebf
+    }
9f2ebf
+
9f2ebf
     token_name = sss_cai_get_token_name(cert_info);
9f2ebf
     module_name = sss_cai_get_module_name(cert_info);
9f2ebf
     key_id = sss_cai_get_key_id(cert_info);
9f2ebf
@@ -710,10 +768,12 @@ static errno_t pack_cert_data(TALLOC_CTX *mem_ctx, const char *sysdb_username,
9f2ebf
     token_len = strlen(token_name) + 1;
9f2ebf
     module_len = strlen(module_name) + 1;
9f2ebf
     key_id_len = strlen(key_id) + 1;
9f2ebf
-    msg_len = user_len + token_len + module_len + key_id_len;
9f2ebf
+    prompt_len = strlen(prompt) + 1;
9f2ebf
+    msg_len = user_len + token_len + module_len + key_id_len + prompt_len;
9f2ebf
 
9f2ebf
     msg = talloc_zero_size(mem_ctx, msg_len);
9f2ebf
     if (msg == NULL) {
9f2ebf
+        talloc_free(prompt);
9f2ebf
         DEBUG(SSSDBG_OP_FAILURE, "talloc_zero_size failed.\n");
9f2ebf
         return ENOMEM;
9f2ebf
     }
9f2ebf
@@ -722,6 +782,9 @@ static errno_t pack_cert_data(TALLOC_CTX *mem_ctx, const char *sysdb_username,
9f2ebf
     memcpy(msg + user_len, token_name, token_len);
9f2ebf
     memcpy(msg + user_len + token_len, module_name, module_len);
9f2ebf
     memcpy(msg + user_len + token_len + module_len, key_id, key_id_len);
9f2ebf
+    memcpy(msg + user_len + token_len + module_len + key_id_len,
9f2ebf
+           prompt, prompt_len);
9f2ebf
+    talloc_free(prompt);
9f2ebf
 
9f2ebf
     if (_msg != NULL) {
9f2ebf
         *_msg = msg;
9f2ebf
diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
9f2ebf
index c147d4b3d76443d69e27eb2da042f8eebd1ae6ab..1dc51ea0536a92a63ec2f4d97f65dbb02604dbb3 100644
9f2ebf
--- a/src/sss_client/pam_sss.c
9f2ebf
+++ b/src/sss_client/pam_sss.c
9f2ebf
@@ -129,6 +129,7 @@ struct cert_auth_info {
9f2ebf
     char *token_name;
9f2ebf
     char *module_name;
9f2ebf
     char *key_id;
9f2ebf
+    char *prompt_str;
9f2ebf
     struct cert_auth_info *prev;
9f2ebf
     struct cert_auth_info *next;
9f2ebf
 };
9f2ebf
@@ -140,6 +141,7 @@ static void free_cai(struct cert_auth_info *cai)
9f2ebf
         free(cai->cert);
9f2ebf
         free(cai->token_name);
9f2ebf
         free(cai->key_id);
9f2ebf
+        free(cai->prompt_str);
9f2ebf
         free(cai);
9f2ebf
     }
9f2ebf
 }
9f2ebf
@@ -921,9 +923,25 @@ static int parse_cert_info(struct pam_items *pi, uint8_t *buf, size_t len,
9f2ebf
         goto done;
9f2ebf
     }
9f2ebf
 
9f2ebf
-    D(("cert user: [%s] token name: [%s] module: [%s] key id: [%s]",
9f2ebf
+    offset += strlen(cai->key_id) + 1;
9f2ebf
+    if (offset >= len) {
9f2ebf
+        D(("Cert message size mismatch"));
9f2ebf
+        ret = EINVAL;
9f2ebf
+        goto done;
9f2ebf
+    }
9f2ebf
+
9f2ebf
+    cai->prompt_str = strdup((char *) &buf[*p + offset]);
9f2ebf
+    if (cai->prompt_str == NULL) {
9f2ebf
+        D(("strdup failed"));
9f2ebf
+        ret = ENOMEM;
9f2ebf
+        goto done;
9f2ebf
+    }
9f2ebf
+
9f2ebf
+
9f2ebf
+    D(("cert user: [%s] token name: [%s] module: [%s] key id: [%s] "
9f2ebf
+       "prompt: [%s]",
9f2ebf
        cai->cert_user, cai->token_name, cai->module_name,
9f2ebf
-       cai->key_id));
9f2ebf
+       cai->key_id, cai->prompt_str));
9f2ebf
 
9f2ebf
     DLIST_ADD(pi->cert_list, cai);
9f2ebf
     ret = 0;
9f2ebf
@@ -1543,7 +1561,7 @@ done:
9f2ebf
 #define discard_const(ptr) ((void *)((uintptr_t)(ptr)))
9f2ebf
 #endif
9f2ebf
 
9f2ebf
-#define CERT_SEL_PROMPT_FMT "Certificate: %s"
9f2ebf
+#define CERT_SEL_PROMPT_FMT "%s"
9f2ebf
 #define SEL_TITLE discard_const("Please select a certificate")
9f2ebf
 
9f2ebf
 static int prompt_multi_cert_gdm(pam_handle_t *pamh, struct pam_items *pi)
9f2ebf
@@ -1588,7 +1606,7 @@ static int prompt_multi_cert_gdm(pam_handle_t *pamh, struct pam_items *pi)
9f2ebf
 
9f2ebf
     c = 0;
9f2ebf
     DLIST_FOR_EACH(cai, pi->cert_list) {
9f2ebf
-        ret = asprintf(&prompt, CERT_SEL_PROMPT_FMT, cai->key_id);
9f2ebf
+        ret = asprintf(&prompt, CERT_SEL_PROMPT_FMT, cai->prompt_str);
9f2ebf
         if (ret == -1) {
9f2ebf
             ret = ENOMEM;
9f2ebf
             goto done;
9f2ebf
@@ -1637,9 +1655,10 @@ done:
9f2ebf
 #endif
9f2ebf
 }
9f2ebf
 
9f2ebf
-#define TEXT_CERT_SEL_PROMPT_FMT "%s[%zu] Certificate: %s\n"
9f2ebf
+#define TEXT_CERT_SEL_PROMPT_FMT "%s\n[%zu]:\n%s\n"
9f2ebf
 #define TEXT_SEL_TITLE discard_const("Please select a certificate by typing " \
9f2ebf
                                      "the corresponding number\n")
9f2ebf
+
9f2ebf
 static int prompt_multi_cert(pam_handle_t *pamh, struct pam_items *pi)
9f2ebf
 {
9f2ebf
     int ret;
9f2ebf
@@ -1670,7 +1689,7 @@ static int prompt_multi_cert(pam_handle_t *pamh, struct pam_items *pi)
9f2ebf
     DLIST_FOR_EACH(cai, pi->cert_list) {
9f2ebf
         cert_count++;
9f2ebf
         ret = asprintf(&tmp, TEXT_CERT_SEL_PROMPT_FMT, prompt, cert_count,
9f2ebf
-                                                       cai->key_id);
9f2ebf
+                                                       cai->prompt_str);
9f2ebf
         free(prompt);
9f2ebf
         if (ret == -1) {
9f2ebf
             return ENOMEM;
9f2ebf
diff --git a/src/tests/cmocka/test_pam_srv.c b/src/tests/cmocka/test_pam_srv.c
9f2ebf
index 5c1f621ccead75717d1721714d953d7d4d415d7b..50d3ed005468375ff02c60bebd1c61047ca1c6d4 100644
9f2ebf
--- a/src/tests/cmocka/test_pam_srv.c
9f2ebf
+++ b/src/tests/cmocka/test_pam_srv.c
9f2ebf
@@ -53,6 +53,7 @@
9f2ebf
 #define TEST_TOKEN_NAME "SSSD Test Token"
9f2ebf
 #define TEST_MODULE_NAME "NSS-Internal"
9f2ebf
 #define TEST_KEY_ID "A5EF7DEE625CA5996C8D1BA7D036708161FD49E7"
9f2ebf
+#define TEST_SUBJECT_DN "CN=ipa-devel.ipa.devel,O=IPA.DEVEL"
9f2ebf
 #define TEST_TOKEN_CERT \
9f2ebf
 "MIIECTCCAvGgAwIBAgIBCTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlJUEEu" \
9f2ebf
 "REVWRUwxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xNjA1MjMx" \
9f2ebf
@@ -78,6 +79,7 @@
9f2ebf
 "XyQBwOYRORlnfGyu+Yc9c3E0Wx8Tlznz0lqPR9g="
9f2ebf
 
9f2ebf
 #define TEST2_KEY_ID "C8D60E009EB195D01A7083EE1D5419251AA87C2C"
9f2ebf
+#define TEST2_SUBJECT_DN "CN=IPA RA,O=IPA.DEVEL"
9f2ebf
 #define TEST_TOKEN_2ND_CERT \
9f2ebf
 "MIIDazCCAlOgAwIBAgIBBzANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlJUEEu" \
9f2ebf
 "REVWRUwxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xNjA1MjMx" \
9f2ebf
@@ -831,7 +833,8 @@ static int test_pam_cert_check_gdm_smartcard(uint32_t status, uint8_t *body,
9f2ebf
     assert_int_equal(val, (sizeof("pamuser@"TEST_DOM_NAME)
9f2ebf
                                 + sizeof(TEST_TOKEN_NAME)
9f2ebf
                                 + sizeof(TEST_MODULE_NAME)
9f2ebf
-                                + sizeof(TEST_KEY_ID)));
9f2ebf
+                                + sizeof(TEST_KEY_ID)
9f2ebf
+                                + sizeof(TEST_SUBJECT_DN)));
9f2ebf
 
9f2ebf
     assert_int_equal(*(body + rp + sizeof("pamuser@"TEST_DOM_NAME) - 1), 0);
9f2ebf
     assert_string_equal(body + rp, "pamuser@"TEST_DOM_NAME);
9f2ebf
@@ -849,6 +852,10 @@ static int test_pam_cert_check_gdm_smartcard(uint32_t status, uint8_t *body,
9f2ebf
     assert_string_equal(body + rp, TEST_KEY_ID);
9f2ebf
     rp += sizeof(TEST_KEY_ID);
9f2ebf
 
9f2ebf
+    assert_int_equal(*(body + rp + sizeof(TEST_SUBJECT_DN) - 1), 0);
9f2ebf
+    assert_string_equal(body + rp, TEST_SUBJECT_DN);
9f2ebf
+    rp += sizeof(TEST_SUBJECT_DN);
9f2ebf
+
9f2ebf
     assert_int_equal(rp, blen);
9f2ebf
     return EOK;
9f2ebf
 }
9f2ebf
@@ -893,7 +900,8 @@ static int test_pam_cert_check_ex(uint32_t status, uint8_t *body, size_t blen,
9f2ebf
     assert_int_equal(val, (strlen(name) + 1
9f2ebf
                                 + sizeof(TEST_TOKEN_NAME)
9f2ebf
                                 + sizeof(TEST_MODULE_NAME)
9f2ebf
-                                + sizeof(TEST_KEY_ID)));
9f2ebf
+                                + sizeof(TEST_KEY_ID)
9f2ebf
+                                + sizeof(TEST_SUBJECT_DN)));
9f2ebf
 
9f2ebf
     assert_int_equal(*(body + rp + strlen(name)), 0);
9f2ebf
     assert_string_equal(body + rp, name);
9f2ebf
@@ -911,6 +919,10 @@ static int test_pam_cert_check_ex(uint32_t status, uint8_t *body, size_t blen,
9f2ebf
     assert_string_equal(body + rp, TEST_KEY_ID);
9f2ebf
     rp += sizeof(TEST_KEY_ID);
9f2ebf
 
9f2ebf
+    assert_int_equal(*(body + rp + sizeof(TEST_SUBJECT_DN) - 1), 0);
9f2ebf
+    assert_string_equal(body + rp, TEST_SUBJECT_DN);
9f2ebf
+    rp += sizeof(TEST_SUBJECT_DN);
9f2ebf
+
9f2ebf
     if (name2 != NULL && *name2 != '\0') {
9f2ebf
         SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);
9f2ebf
         assert_int_equal(val, type);
9f2ebf
@@ -919,7 +931,8 @@ static int test_pam_cert_check_ex(uint32_t status, uint8_t *body, size_t blen,
9f2ebf
         assert_int_equal(val, (strlen(name) + 1
9f2ebf
                                     + sizeof(TEST_TOKEN_NAME)
9f2ebf
                                     + sizeof(TEST_MODULE_NAME)
9f2ebf
-                                    + sizeof(TEST2_KEY_ID)));
9f2ebf
+                                    + sizeof(TEST2_KEY_ID)
9f2ebf
+                                    + sizeof(TEST2_SUBJECT_DN)));
9f2ebf
 
9f2ebf
         assert_int_equal(*(body + rp + strlen(name)), 0);
9f2ebf
         assert_string_equal(body + rp, name);
9f2ebf
@@ -936,6 +949,10 @@ static int test_pam_cert_check_ex(uint32_t status, uint8_t *body, size_t blen,
9f2ebf
         assert_int_equal(*(body + rp + sizeof(TEST2_KEY_ID) - 1), 0);
9f2ebf
         assert_string_equal(body + rp, TEST2_KEY_ID);
9f2ebf
         rp += sizeof(TEST2_KEY_ID);
9f2ebf
+
9f2ebf
+        assert_int_equal(*(body + rp + sizeof(TEST2_SUBJECT_DN) - 1), 0);
9f2ebf
+        assert_string_equal(body + rp, TEST2_SUBJECT_DN);
9f2ebf
+        rp += sizeof(TEST2_SUBJECT_DN);
9f2ebf
     }
9f2ebf
 
9f2ebf
     assert_int_equal(rp, blen);
9f2ebf
-- 
9f2ebf
2.13.6
9f2ebf