source: libabac/abac_verifier.c @ 63dcd99

abac0-leak
Last change on this file since 63dcd99 was f43e42c, checked in by Mei <mei@…>, 11 years ago

Merge branch 'abac0-mei' of git://abac.deterlab.net/abac

  • Property mode set to 100644
File size: 10.5 KB
Line 
1
2/* abac_verifier.c */
3#include <assert.h>
4#include <string.h>
5
6#include "libabac_common.h"
7#include "abac.h"
8#include "abac_list.h"
9#include "abac_util.h"
10
11struct _abac_id_cert_t {
12    char *keyid; // using cert's keyid
13    abac_id_t *cert;
14};
15
16struct _abac_credential_t {
17    abac_role_t *head;
18    abac_role_t *tail;
19    abac_id_t *issuer; /* Acme of Acme.customer <- Coyote */
20    abac_attribute_t *cert;
21
22    int refcount;
23};
24
25extern int abac_id_pass_privkey_from_id(abac_id_t *to_id, abac_id_t *from_id);
26extern char *make_pem_from_naked_pem(char *naked_pem);
27
28/***********************************************************************/
29// convert a chunk to a lowercase binary string
30// malloc's the string
31/*** not used,
32static char *_chunk_to_string(abac_chunk_t chunk) {
33    int i;
34
35    char *ret = abac_xmalloc(chunk.len * 2 + 1);
36
37    for (i = 0; i < chunk.len; ++i)
38        sprintf(ret + 2 * i, "%02x", chunk.ptr[i]);
39
40    return ret;
41}
42***/
43
44// verify that cert was issued by issuer
45// cert and issuer can be the same, in which case the self-sig is validated
46/*** not used
47static int _verify_cert(abac_id_t *cert) {
48
49    assert(cert);
50    if(!abac_id_still_valid(cert))
51        return 0;
52    return 1;
53}
54***/
55
56/**
57 * Init the verifier subsystem.
58 */
59void abac_verifier_init(void) {
60    init_openssl();
61    init_xmlsec();
62}
63
64/**
65 * Uninitialize the system, free up any allocated memory.
66 */
67void abac_verifier_deinit(void) {
68    deinit_xmlsec();
69    deinit_openssl();
70}
71
72static abac_id_cert_t *_lookup_cert(abac_list_t *id_certs, char *keyid)
73{
74    abac_id_cert_t *id_cert=NULL;
75    if(id_certs != NULL) {
76        abac_list_foreach(id_certs, id_cert,
77            if(strcmp(keyid,id_cert->keyid)==0)
78               return id_cert;
79        );
80    }
81    return NULL;
82}
83
84/**
85 * Load an ID certificate.
86 */
87static int _load_id(abac_list_t *id_certs, abac_id_t *cert, 
88        abac_keyid_map_t *km) {
89    abac_id_cert_t *id_cert = NULL;
90    char *keyid = NULL;
91    char *nick = NULL;
92    int ret;
93
94    assert(cert);
95
96    // get the key ID
97    keyid = abac_id_keyid(cert);
98
99    // if we already have this cert 'error' with success
100    id_cert=_lookup_cert(id_certs, keyid);
101
102    if (id_cert != NULL) {
103        /* special case, if
104           existing id does not have private key and
105           incoming does, then need to bring that bit of
106           information in */
107           if(abac_id_has_privkey(cert) && 
108                       !abac_id_has_privkey(id_cert->cert)) {
109               abac_id_pass_privkey_from_id(id_cert->cert, cert);
110           }
111        ret = ABAC_CERT_SUCCESS;
112        goto error;
113    }
114
115    ret = abac_id_still_valid(cert);
116    if (!ret) {
117        ret = ABAC_CERT_INVALID;
118        goto error;
119    }
120
121    // success, add the key to the map of certificates
122    id_cert = abac_xmalloc(sizeof(abac_id_cert_t));
123    id_cert->keyid = abac_xstrdup(keyid);
124    id_cert->cert = cert;
125    abac_list_add(id_certs, id_cert); 
126    /* Add the new id and issuer to the keyid <-> name map */
127    if ( km && keyid && cert ) {
128        if ( (nick= abac_id_issuer(cert)) ) {
129            /* If the issuer starts with /CN=, as many do,
130             * trim the /CN= off */
131            if (!strncmp(nick, "/CN=", 4) && strlen(nick) > 4) 
132                abac_keyid_map_add_nickname(km, keyid, nick+4);
133            else
134                abac_keyid_map_add_nickname(km, keyid, nick);
135            free(nick);
136        }
137    }
138
139
140    return ABAC_CERT_SUCCESS;
141
142error:
143    // No one owns cert, so delete it.
144    if (cert != NULL) free(cert);
145    if (keyid != NULL) free(keyid);
146    return ret;
147}
148
149abac_id_t *abac_verifier_lookup_id(abac_list_t *id_certs, char *keyid)
150{
151    abac_id_cert_t *id_cert=_lookup_cert(id_certs,keyid);
152    if(id_cert == NULL) return NULL;
153    return id_cert->cert;
154}
155
156/**
157 * Load an ID cert from a file.
158 */
159int abac_verifier_load_id_file(abac_list_t *id_certs, char *filename,
160        abac_keyid_map_t *km) {
161    // load the cert
162    abac_id_t *cert = abac_id_from_file(filename);
163
164    if (cert == NULL)
165        return ABAC_CERT_INVALID;
166
167    return _load_id(id_certs,cert, km);
168}
169
170/**
171 * Load an ID cert from a chunk.
172 */
173int abac_verifier_load_id_chunk(abac_list_t *id_certs,abac_chunk_t chunk, 
174        abac_keyid_map_t *km) {
175
176    // load the cert
177    abac_id_t *cert= abac_id_from_chunk(chunk);
178
179    if (cert == NULL)
180        return ABAC_CERT_INVALID;
181    return _load_id(id_certs,cert, km);
182}
183
184/**
185 * Load an ID cert from a char ptr of a X509 pem data
186 * this is called from parse_privilege(..)
187 */
188int abac_verifier_load_id_chars(abac_list_t *id_certs,char *naked_pem, 
189        abac_keyid_map_t *km) {
190    /* if id_certs is NULL, don't even try to load it */
191    if(id_certs == NULL) return ABAC_CERT_SUCCESS;
192    /* make a well formed pem from this */
193    char *new_naked_pem=abac_xstrdup(naked_pem);
194    char *pem=make_pem_from_naked_pem(new_naked_pem);
195    int len=strlen(pem);
196    abac_chunk_t chunk = { pem, len }; 
197    free(new_naked_pem);
198    return abac_verifier_load_id_chunk(id_certs,chunk, km);
199}
200/**
201 * Load an attribute cert.
202 * Returns true only if the certificate is valid and is issued by the proper
203 * authority.
204 */
205static int _load_attribute_cert(abac_list_t *id_certs,abac_attribute_t *cert, 
206        abac_credential_t **cred_ret, abac_keyid_map_t *km) {
207    abac_role_t *head_role = NULL;
208    abac_role_t *tail_role = NULL;
209    abac_id_cert_t *issuer=NULL;
210    abac_keyid_map_t *local_names = NULL;
211    int ret;
212
213    char *attr_string=abac_attribute_role_string(cert);
214
215    if(attr_string == NULL) {
216       ret = ABAC_CERT_INVALID;
217       goto error;
218    }
219
220    // split into head/tail parts
221    char *head_tail[2];
222    ret = 2;
223    abac_split(attr_string, "<-", head_tail, &ret);
224    if (ret != 2) {
225        ret = ABAC_CERT_INVALID;
226        goto error;
227    }
228
229    // must be a role
230    head_role = abac_role_from_string(head_tail[0]);
231    if (head_role == NULL) goto error;
232    if (!abac_role_is_role(head_role)) {
233        ret = ABAC_CERT_INVALID;
234        goto error;
235    }
236
237    // make sure the tail's valid too
238    tail_role = abac_role_from_string(head_tail[1]);
239    if (tail_role == NULL) {
240        ret = ABAC_CERT_INVALID;
241        goto error;
242    }
243
244    char *principal = abac_role_principal(head_role);
245    issuer=_lookup_cert(id_certs,principal);
246    if (issuer == NULL) {
247        ret = ABAC_CERT_MISSING_ISSUER;
248        goto error;
249    }
250
251    // check if issuer is still valid
252    if (!abac_id_still_valid(issuer->cert)) {
253        ret = ABAC_CERT_INVALID_ISSUER;
254        goto error;
255    }
256
257    // make sure principal match up with keyid
258    if(!abac_id_has_keyid(issuer->cert,principal)) {
259        ret = ABAC_CERT_BAD_PRINCIPAL;
260        goto error;
261    }
262
263    if ( (local_names = abac_attribute_get_keyid_map(cert)) && km ) 
264        abac_keyid_map_merge(km, local_names, 1);
265   
266    // at this point we know we have a good attribute cert
267    abac_credential_t *cred = abac_xmalloc(sizeof(abac_credential_t));
268    cred->head = head_role;
269    cred->tail = tail_role;
270    cred->cert = cert;
271    /* acme's cert */
272    cred->issuer = abac_id_dup(issuer->cert);
273    cred->refcount = 1;
274    *cred_ret = cred;
275
276    return ABAC_CERT_SUCCESS;
277
278error:
279    if (head_role != NULL) abac_role_free(head_role);
280    if (tail_role != NULL) abac_role_free(tail_role);
281
282    return ret;
283}
284
285static int _load_attribute_certs(abac_list_t *id_certs,abac_list_t *attr_list, 
286        abac_list_t *cred_list, abac_keyid_map_t *km) {
287
288    int sz=abac_list_size(attr_list);
289    abac_credential_t *cred_ret=NULL;
290    abac_attribute_t *attr;
291    if(sz) { 
292        abac_list_foreach(attr_list, attr,
293            int ret=_load_attribute_cert(id_certs, attr, &cred_ret, km);
294            if(ret==ABAC_CERT_SUCCESS) {
295                abac_list_add(cred_list, cred_ret);
296            }
297        );
298    }
299    return sz;
300}
301
302/**
303 * Load an attribute cert from a file.
304 */
305int abac_verifier_load_attribute_cert_file(abac_list_t *id_certs,char *filename, abac_list_t *cred_list, abac_keyid_map_t *km) {
306
307    // load the cert
308    abac_list_t *attr_list = abac_attribute_certs_from_file(id_certs,filename);
309
310    if (abac_list_size(attr_list) == 0)
311        return ABAC_CERT_INVALID;
312
313    int ret=_load_attribute_certs(id_certs,attr_list, cred_list, km);
314
315    if(ret) return ABAC_CERT_SUCCESS;
316        return ABAC_CERT_INVALID;
317}
318
319/**
320 * Load an attribute cert from a chunk.
321 */
322int abac_verifier_load_attribute_cert_chunk(abac_list_t *id_certs,abac_chunk_t chunk, abac_list_t *cred_list, abac_keyid_map_t *km) {
323
324    // load the cert
325    abac_list_t *attr_list = abac_attribute_certs_from_chunk(id_certs,chunk);
326
327    if (abac_list_size(attr_list) == 0)
328        return ABAC_CERT_INVALID;
329
330    int ret=_load_attribute_certs(id_certs,attr_list,cred_list, km);
331
332    if(ret) return ABAC_CERT_SUCCESS;
333        return ABAC_CERT_INVALID;
334}
335
336/**
337 * Return the head role.
338 */
339abac_role_t *abac_credential_head(abac_credential_t *cred) {
340    return cred->head;
341}
342
343/**
344 * Return the tail role.
345 */
346abac_role_t *abac_credential_tail(abac_credential_t *cred) {
347    return cred->tail;
348}
349
350/**
351 * Return the xml chunk of the attribute cert.
352 */
353abac_chunk_t abac_credential_attribute_cert(abac_credential_t *cred) {
354    assert(cred); assert(cred->cert);
355    return abac_attribute_cert(cred->cert);
356}
357
358/**
359 * Return the chunk of the issuer cert.
360 */
361abac_chunk_t abac_credential_issuer_cert(abac_credential_t *cred) {
362    assert(cred); assert(cred->issuer);
363    abac_chunk_t ret= abac_id_in_PEM(cred->issuer);
364    return ret;
365}
366
367/**
368 * Increase the ref count of a credential.
369 */
370abac_credential_t *abac_credential_dup(abac_credential_t *cred) {
371    assert(cred != NULL);
372
373    ++cred->refcount;
374    return cred;
375}
376
377abac_id_cert_t *abac_id_cert_dup(abac_id_cert_t *id_cert) {
378    assert(id_cert != NULL && id_cert->keyid!=NULL);
379
380    abac_id_cert_t *new_cert = abac_xmalloc(sizeof(abac_id_cert_t));
381    new_cert->keyid=abac_xstrdup(id_cert->keyid);
382    new_cert->cert=abac_id_dup(id_cert->cert);
383 
384    return new_cert;
385}
386
387
388/**
389 * Decrease the reference count of a credential, freeing it when it reaches 0.
390 */
391void abac_credential_free(abac_credential_t *cred) {
392    if (cred == NULL)
393        return;
394
395    --cred->refcount;
396    if (cred->refcount > 0)
397        return;
398
399    abac_role_free(cred->head);
400    abac_role_free(cred->tail);
401    abac_attribute_free(cred->cert);
402    abac_id_free(cred->issuer);
403
404    free(cred);
405}
406
407/**
408 * remove an id cert, (not reference counted, so abac_id_certs are
409 * deep-copied)
410 */
411void abac_id_cert_free(abac_id_cert_t *id_cert) {
412    if (id_cert==NULL)
413        return;
414
415    abac_id_free(id_cert->cert);
416    if(id_cert->keyid) free(id_cert->keyid);
417    free(id_cert);
418}
419
420char *abac_id_cert_keyid(abac_id_cert_t *id_cert)
421{
422    assert(id_cert);
423    return id_cert->keyid;
424}
425
426char *abac_id_cert_cn(abac_id_cert_t *id_cert)
427{
428    assert(id_cert);
429    return abac_id_cn(id_cert->cert);
430}
431
432
433
Note: See TracBrowser for help on using the repository browser.