source: libabac/abac_verifier.c @ 1324a63

abac0-leakabac0-meicompt_changesgec13mei-idmei-rt0-nmei_rt0mei_rt2mei_rt2_fix_1meiyap-rt1meiyap1rt2tvf-new-xml
Last change on this file since 1324a63 was 1324a63, checked in by Mike Ryan <mikeryan@…>, 14 years ago

get rid of annoying debug warnings

  • Property mode set to 100644
File size: 8.2 KB
Line 
1#include <assert.h>
2
3#include <library.h>
4#include <credentials/certificates/certificate.h>
5#include <credentials/certificates/x509.h>
6#include <credentials/certificates/ac.h>
7
8#include "abac_verifier.h"
9
10#include "abac_util.h"
11
12typedef struct _abac_id_cert_t {
13    char *keyid;
14    certificate_t *cert;
15
16    UT_hash_handle hh;
17} abac_id_cert_t;
18
19struct _abac_credential_t {
20    abac_role_t *head;
21    abac_role_t *tail;
22    certificate_t *cert;
23    certificate_t *issuer;
24};
25
26abac_id_cert_t *id_certs = NULL;
27
28// convert a chunk to a lowercase binary string
29// malloc's the string
30static char *_chunk_to_string(chunk_t chunk) {
31    int i;
32
33    char *ret = abac_xmalloc(chunk.len * 2 + 1);
34
35    for (i = 0; i < chunk.len; ++i)
36        sprintf(ret + 2 * i, "%02x", chunk.ptr[i]);
37
38    return ret;
39}
40
41// verify that cert was issued by issuer
42// cert and issuer can be the same, in which case the self-sig is validated
43static int _verify_signature(certificate_t *issuer, certificate_t *cert) {
44    // XXX make sure this checks signature
45    if (cert->issued_by(cert, issuer))
46        if (cert->get_validity(cert, NULL, NULL, NULL))
47            return 1;
48    return 0;
49}
50
51/**
52 * Init the verifier subsystem.
53 */
54void abac_verifier_init(void) {
55    atexit(library_deinit);
56
57    // silence all debugging
58    dbg_default_set_level(-1);
59
60    if (!library_init(NULL))
61        exit(SS_RC_LIBSTRONGSWAN_INTEGRITY);
62
63    if (!lib->plugins->load(lib->plugins, NULL,
64            lib->settings->get_str(lib->settings, "pki.load", PLUGINS)))
65        exit(SS_RC_INITIALIZATION_FAILED);
66}
67
68/**
69 * Uninitialize the system, free up any allocated memory.
70 */
71void abac_verifier_deinit(void) {
72    abac_id_cert_t *id;
73
74    while ((id = id_certs) != NULL) {
75        HASH_DEL(id_certs, id);
76
77        free(id->keyid);
78        id->cert->destroy(id->cert);
79        free(id);
80    }
81}
82
83/**
84 * Load an ID certificate.
85 */
86static int _load_id(certificate_t *cert) {
87    public_key_t *public = NULL;
88    char *keyid = NULL;
89    chunk_t id;
90    int ret;
91
92    assert(cert != NULL);
93
94    // get the cert's pub key
95    public = cert->get_public_key(cert);
96    if (public == NULL) {
97        ret = ABAC_CERT_INVALID;
98        goto error;
99    }
100
101    // get the pubkey's fingerprint
102    ret = public->get_fingerprint(
103        public,
104        KEY_ID_PUBKEY_INFO_SHA1, &id
105    );
106    if (!ret) {
107        ret = ABAC_CERT_INVALID;
108        goto error;
109    }
110
111    // validate sig
112    ret = _verify_signature(cert, cert);
113    if (!ret) {
114        ret = ABAC_CERT_BAD_SIG;
115        goto error;
116    }
117
118    keyid = _chunk_to_string(id);
119
120    // success, add the key to the map of certificates
121    abac_id_cert_t *id_cert = abac_xmalloc(sizeof(abac_id_cert_t));
122    id_cert->keyid = keyid;
123    id_cert->cert = cert;
124    HASH_ADD_KEYPTR(hh, id_certs, id_cert->keyid, strlen(id_cert->keyid), id_cert);
125
126    public->destroy(public);
127
128    return ABAC_CERT_SUCCESS;
129
130error:
131    if (public != NULL) public->destroy(public);
132
133    return ret;
134}
135
136/**
137 * Load an ID cert from a file.
138 */
139int abac_verifier_load_id_file(char *filename) {
140    // load the cert
141    certificate_t *cert = lib->creds->create(
142        lib->creds, CRED_CERTIFICATE, CERT_X509,
143        BUILD_FROM_FILE, filename,
144        BUILD_X509_FLAG, X509_AA, // attribute authority, dumb
145        BUILD_END
146    );
147    if (cert == NULL)
148        return ABAC_CERT_INVALID;
149    return _load_id(cert);
150}
151
152/**
153 * Load an ID cert from a chunk.
154 */
155int abac_verifier_load_id_chunk(chunk_t chunk) {
156    // load the cert
157    certificate_t *cert = lib->creds->create(
158        lib->creds, CRED_CERTIFICATE, CERT_X509,
159        BUILD_BLOB_ASN1_DER, chunk,
160        BUILD_X509_FLAG, X509_AA, // attribute authority, dumb
161        BUILD_END
162    );
163    if (cert == NULL)
164        return ABAC_CERT_INVALID;
165    return _load_id(cert);
166}
167
168/**
169 * Load an attribute cert.
170 * Returns true only if the certificate is valid and is issued by the proper
171 * authority.
172 */
173static int _load_attribute_cert(certificate_t *cert, abac_credential_t **cred_ret) {
174    ietf_attributes_t *attr_cert = NULL;
175    abac_role_t *head_role = NULL;
176    abac_role_t *tail_role = NULL;
177    abac_id_cert_t *issuer;
178    int ret;
179
180    // get the attr
181    ac_t *ac = (ac_t *)cert;
182    attr_cert = ac->get_groups(ac);
183    if (attr_cert == NULL) {
184        ret = ABAC_CERT_INVALID;
185        goto error;
186    }
187
188    char *attr_string = attr_cert->get_string(attr_cert);
189    if (attr_string == NULL) {
190        ret = ABAC_CERT_INVALID;
191        goto error;
192    }
193
194    // split into head/tail parts
195    char head[256], tail[256];
196    ret = sscanf(attr_string, "%255s <- %255s", head, tail);
197    if (ret != 2) {
198        ret = ABAC_CERT_INVALID;
199        goto error;
200    }
201
202    // must be a role
203    head_role = abac_role_from_string(head);
204    if (head_role == NULL) goto error;
205    if (!abac_role_is_role(head_role)) {
206        ret = ABAC_CERT_INVALID;
207        goto error;
208    }
209
210    // make sure the tail role is valid
211    tail_role = abac_role_from_string(tail);
212    if (tail_role == NULL) {
213        ret = ABAC_CERT_INVALID;
214        goto error;
215    }
216
217    // get the issuer based on keyid
218    char *principal = abac_role_principal(head_role);
219    HASH_FIND_STR(id_certs, principal, issuer);
220    if (issuer == NULL) {
221        ret = ABAC_CERT_MISSING_ISSUER;
222        goto error;
223    }
224
225    // make sure the issuer's signed it
226    ret = _verify_signature(issuer->cert, cert);
227    if (!ret) {
228        ret = ABAC_CERT_BAD_SIG;
229        goto error;
230    }
231
232    // at this point we know we have a good attribute cert
233    abac_credential_t *cred = abac_xmalloc(sizeof(abac_credential_t));
234    cred->head = head_role;
235    cred->tail = tail_role;
236    cred->cert = cert;
237    cred->issuer = issuer->cert->get_ref(issuer->cert);
238    *cred_ret = cred;
239
240    // free up some crap
241    attr_cert->destroy(attr_cert);
242
243    return ABAC_CERT_SUCCESS;
244
245error:
246    if (cert != NULL) cert->destroy(cert);
247    if (attr_cert != NULL) attr_cert->destroy(attr_cert);
248    if (head_role != NULL) abac_role_free(head_role);
249    if (tail_role != NULL) abac_role_free(tail_role);
250
251    return ret;
252}
253
254/**
255 * Load an attribute cert from a file.
256 */
257int abac_verifier_load_attribute_cert_file(char *filename, abac_credential_t **cred) {
258    // load the cert
259    certificate_t *cert = lib->creds->create(
260        lib->creds, CRED_CERTIFICATE, CERT_X509_AC,
261        BUILD_FROM_FILE, filename,
262        BUILD_END
263    );
264    if (cert == NULL)
265        return ABAC_CERT_INVALID;
266    return _load_attribute_cert(cert, cred);
267}
268
269/**
270 * Load an attribute cert from a chunk.
271 */
272int abac_verifier_load_attribute_cert_chunk(chunk_t chunk, abac_credential_t **cred) {
273    // load the cert
274    certificate_t *cert = lib->creds->create(
275        lib->creds, CRED_CERTIFICATE, CERT_X509_AC,
276        BUILD_BLOB_ASN1_DER, chunk,
277        BUILD_END
278    );
279    if (cert == NULL)
280        return ABAC_CERT_INVALID;
281    return _load_attribute_cert(cert, cred);
282}
283
284/**
285 * Return the head role.
286 */
287abac_role_t *abac_credential_head(abac_credential_t *cred) {
288    return cred->head;
289}
290
291/**
292 * Return the tail role.
293 */
294abac_role_t *abac_credential_tail(abac_credential_t *cred) {
295    return cred->tail;
296}
297
298/**
299 * Return the encoding of the attribute cert.
300 */
301abac_chunk_t abac_credential_attribute_cert(abac_credential_t *cred) {
302    chunk_t encoding = cred->cert->get_encoding(cred->cert);
303    abac_chunk_t ret = { encoding.ptr, encoding.len };
304    return ret;
305}
306
307/**
308 * Return the encoding of the issuer cert.
309 */
310abac_chunk_t abac_credential_issuer_cert(abac_credential_t *cred) {
311    chunk_t encoding = cred->issuer->get_encoding(cred->issuer);
312    abac_chunk_t ret = { encoding.ptr, encoding.len };
313    return ret;
314}
315
316/**
317 * Copy a credential.
318 */
319abac_credential_t *abac_credential_dup(abac_credential_t *cred) {
320    assert(cred != NULL);
321
322    abac_credential_t *clone = abac_xmalloc(sizeof(abac_credential_t));
323
324    clone->head = abac_role_dup(cred->head);
325    clone->tail = abac_role_dup(cred->tail);
326    clone->cert = cred->cert->get_ref(cred->cert);
327    clone->issuer = cred->issuer->get_ref(cred->issuer);
328
329    return clone;
330}
331
332/**
333 * Free a credential.
334 */
335void abac_credential_free(abac_credential_t *cred) {
336    if (cred == NULL)
337        return;
338
339    abac_role_free(cred->head);
340    abac_role_free(cred->tail);
341    cred->cert->destroy(cred->cert);
342    cred->issuer->destroy(cred->issuer); // reference counted
343
344    free(cred);
345}
Note: See TracBrowser for help on using the repository browser.