2019-03-05 22:28:32 +00:00
|
|
|
package provisioner
|
|
|
|
|
|
|
|
import (
|
2022-08-23 19:43:48 +00:00
|
|
|
"crypto/sha1" //nolint:gosec // not used for cryptographic security
|
2019-03-06 22:50:13 +00:00
|
|
|
"crypto/x509"
|
|
|
|
"encoding/asn1"
|
|
|
|
"encoding/binary"
|
|
|
|
"encoding/hex"
|
|
|
|
"fmt"
|
|
|
|
"net/url"
|
|
|
|
"sort"
|
|
|
|
"strings"
|
2019-03-05 22:28:32 +00:00
|
|
|
"sync"
|
|
|
|
|
2021-05-03 19:48:20 +00:00
|
|
|
"github.com/smallstep/certificates/authority/admin"
|
2020-08-24 21:44:11 +00:00
|
|
|
"go.step.sm/crypto/jose"
|
2019-03-05 22:28:32 +00:00
|
|
|
)
|
|
|
|
|
2019-03-06 22:50:13 +00:00
|
|
|
// DefaultProvisionersLimit is the default limit for listing provisioners.
|
|
|
|
const DefaultProvisionersLimit = 20
|
|
|
|
|
|
|
|
// DefaultProvisionersMax is the maximum limit for listing provisioners.
|
|
|
|
const DefaultProvisionersMax = 100
|
|
|
|
|
|
|
|
type uidProvisioner struct {
|
2019-03-07 21:07:39 +00:00
|
|
|
provisioner Interface
|
2019-03-06 22:50:13 +00:00
|
|
|
uid string
|
|
|
|
}
|
|
|
|
|
|
|
|
type provisionerSlice []uidProvisioner
|
|
|
|
|
|
|
|
func (p provisionerSlice) Len() int { return len(p) }
|
|
|
|
func (p provisionerSlice) Less(i, j int) bool { return p[i].uid < p[j].uid }
|
|
|
|
func (p provisionerSlice) Swap(i, j int) { p[i], p[j] = p[j], p[i] }
|
|
|
|
|
2019-05-08 22:39:50 +00:00
|
|
|
// loadByTokenPayload is a payload used to extract the id used to load the
|
|
|
|
// provisioner.
|
|
|
|
type loadByTokenPayload struct {
|
|
|
|
jose.Claims
|
2021-08-30 23:37:29 +00:00
|
|
|
Email string `json:"email"` // OIDC email
|
|
|
|
AuthorizedParty string `json:"azp"` // OIDC client id
|
|
|
|
TenantID string `json:"tid"` // Microsoft Azure tenant id
|
2019-05-08 22:39:50 +00:00
|
|
|
}
|
|
|
|
|
2019-03-05 22:28:32 +00:00
|
|
|
// Collection is a memory map of provisioners.
|
|
|
|
type Collection struct {
|
2019-03-06 22:50:13 +00:00
|
|
|
byID *sync.Map
|
|
|
|
byKey *sync.Map
|
2021-05-18 04:07:25 +00:00
|
|
|
byName *sync.Map
|
2021-05-20 01:23:20 +00:00
|
|
|
byTokenID *sync.Map
|
2019-03-06 22:50:13 +00:00
|
|
|
sorted provisionerSlice
|
2019-03-05 08:07:13 +00:00
|
|
|
audiences Audiences
|
2019-03-05 22:28:32 +00:00
|
|
|
}
|
|
|
|
|
2019-03-06 22:50:13 +00:00
|
|
|
// NewCollection initializes a collection of provisioners. The given list of
|
|
|
|
// audiences are the audiences used by the JWT provisioner.
|
2019-03-05 08:07:13 +00:00
|
|
|
func NewCollection(audiences Audiences) *Collection {
|
2019-03-05 22:28:32 +00:00
|
|
|
return &Collection{
|
2019-03-06 22:50:13 +00:00
|
|
|
byID: new(sync.Map),
|
|
|
|
byKey: new(sync.Map),
|
2021-05-18 04:07:25 +00:00
|
|
|
byName: new(sync.Map),
|
2021-05-20 01:23:20 +00:00
|
|
|
byTokenID: new(sync.Map),
|
2019-03-06 22:50:13 +00:00
|
|
|
audiences: audiences,
|
2019-03-05 22:28:32 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Load a provisioner by the ID.
|
2019-03-07 21:07:39 +00:00
|
|
|
func (c *Collection) Load(id string) (Interface, bool) {
|
2019-03-05 22:45:57 +00:00
|
|
|
return loadProvisioner(c.byID, id)
|
|
|
|
}
|
|
|
|
|
2021-05-18 04:07:25 +00:00
|
|
|
// LoadByName a provisioner by name.
|
|
|
|
func (c *Collection) LoadByName(name string) (Interface, bool) {
|
|
|
|
return loadProvisioner(c.byName, name)
|
|
|
|
}
|
|
|
|
|
2021-05-20 01:23:20 +00:00
|
|
|
// LoadByTokenID a provisioner by identifier found in token.
|
|
|
|
// For different provisioner types this identifier may be found in in different
|
|
|
|
// attributes of the token.
|
|
|
|
func (c *Collection) LoadByTokenID(tokenProvisionerID string) (Interface, bool) {
|
|
|
|
return loadProvisioner(c.byTokenID, tokenProvisionerID)
|
|
|
|
}
|
|
|
|
|
2019-03-06 22:50:13 +00:00
|
|
|
// LoadByToken parses the token claims and loads the provisioner associated.
|
2019-03-07 21:07:39 +00:00
|
|
|
func (c *Collection) LoadByToken(token *jose.JSONWebToken, claims *jose.Claims) (Interface, bool) {
|
2019-06-04 00:19:44 +00:00
|
|
|
var audiences []string
|
|
|
|
// Get all audiences with the given fragment
|
|
|
|
fragment := extractFragment(claims.Audience)
|
|
|
|
if fragment == "" {
|
|
|
|
audiences = c.audiences.All()
|
|
|
|
} else {
|
|
|
|
audiences = c.audiences.WithFragment(fragment).All()
|
|
|
|
}
|
|
|
|
|
2019-03-06 22:50:13 +00:00
|
|
|
// match with server audiences
|
2019-06-04 00:19:44 +00:00
|
|
|
if matchesAudience(claims.Audience, audiences) {
|
2019-12-20 21:30:05 +00:00
|
|
|
// Use fragment to get provisioner name (GCP, AWS, SSHPOP)
|
2019-06-04 00:19:44 +00:00
|
|
|
if fragment != "" {
|
2021-05-20 01:23:20 +00:00
|
|
|
return c.LoadByTokenID(fragment)
|
2019-06-04 00:19:44 +00:00
|
|
|
}
|
2019-03-06 22:50:13 +00:00
|
|
|
// If matches with stored audiences it will be a JWT token (default), and
|
|
|
|
// the id would be <issuer>:<kid>.
|
2021-05-20 01:23:20 +00:00
|
|
|
// TODO: is this ok?
|
|
|
|
return c.LoadByTokenID(claims.Issuer + ":" + token.Headers[0].KeyID)
|
2019-03-06 22:50:13 +00:00
|
|
|
}
|
|
|
|
|
2019-05-08 22:39:50 +00:00
|
|
|
// The ID will be just the clientID stored in azp, aud or tid.
|
|
|
|
var payload loadByTokenPayload
|
2019-03-06 22:50:13 +00:00
|
|
|
if err := token.UnsafeClaimsWithoutVerification(&payload); err != nil {
|
|
|
|
return nil, false
|
|
|
|
}
|
2019-10-18 20:52:28 +00:00
|
|
|
|
|
|
|
// Kubernetes Service Account tokens.
|
2020-09-01 03:56:00 +00:00
|
|
|
if payload.Issuer == k8sSAIssuer {
|
2021-05-20 01:23:20 +00:00
|
|
|
if p, ok := c.LoadByTokenID(K8sSAID); ok {
|
2019-10-18 20:52:28 +00:00
|
|
|
return p, ok
|
|
|
|
}
|
|
|
|
// Kubernetes service account provisioner not found
|
|
|
|
return nil, false
|
|
|
|
}
|
|
|
|
|
|
|
|
// Audience is required for non k8sSA tokens.
|
2019-03-06 22:50:13 +00:00
|
|
|
if len(payload.Audience) == 0 {
|
|
|
|
return nil, false
|
|
|
|
}
|
2019-10-18 20:52:28 +00:00
|
|
|
|
2019-04-18 00:28:21 +00:00
|
|
|
// Try with azp (OIDC)
|
2024-03-12 21:29:55 +00:00
|
|
|
if payload.AuthorizedParty != "" {
|
2021-05-20 01:23:20 +00:00
|
|
|
if p, ok := c.LoadByTokenID(payload.AuthorizedParty); ok {
|
2019-04-18 00:28:21 +00:00
|
|
|
return p, ok
|
|
|
|
}
|
2019-03-06 22:50:13 +00:00
|
|
|
}
|
2021-08-30 23:37:29 +00:00
|
|
|
// Try with tid (Azure, Azure OIDC)
|
2019-05-08 22:39:50 +00:00
|
|
|
if payload.TenantID != "" {
|
2021-08-30 23:37:29 +00:00
|
|
|
// Try to load an OIDC provisioner first.
|
|
|
|
if payload.Email != "" {
|
|
|
|
if p, ok := c.LoadByTokenID(payload.Audience[0]); ok {
|
|
|
|
return p, ok
|
|
|
|
}
|
|
|
|
}
|
|
|
|
// Try to load an Azure provisioner.
|
2021-05-20 01:23:20 +00:00
|
|
|
if p, ok := c.LoadByTokenID(payload.TenantID); ok {
|
2019-05-08 22:39:50 +00:00
|
|
|
return p, ok
|
|
|
|
}
|
|
|
|
}
|
2021-08-30 23:37:29 +00:00
|
|
|
|
2019-06-06 22:24:15 +00:00
|
|
|
// Fallback to aud
|
2021-05-20 01:23:20 +00:00
|
|
|
return c.LoadByTokenID(payload.Audience[0])
|
2019-03-06 22:50:13 +00:00
|
|
|
}
|
|
|
|
|
2019-03-08 00:05:13 +00:00
|
|
|
// LoadByCertificate looks for the provisioner extension and extracts the
|
2019-03-06 22:50:13 +00:00
|
|
|
// proper id to load the provisioner.
|
2019-03-07 21:07:39 +00:00
|
|
|
func (c *Collection) LoadByCertificate(cert *x509.Certificate) (Interface, bool) {
|
2019-03-06 22:50:13 +00:00
|
|
|
for _, e := range cert.Extensions {
|
2022-03-11 22:59:42 +00:00
|
|
|
if e.Id.Equal(StepOIDProvisioner) {
|
|
|
|
var provisioner extensionASN1
|
2019-03-06 22:50:13 +00:00
|
|
|
if _, err := asn1.Unmarshal(e.Value, &provisioner); err != nil {
|
|
|
|
return nil, false
|
|
|
|
}
|
2021-05-03 19:48:20 +00:00
|
|
|
return c.LoadByName(string(provisioner.Name))
|
2019-03-06 22:50:13 +00:00
|
|
|
}
|
|
|
|
}
|
2019-03-08 00:05:13 +00:00
|
|
|
|
|
|
|
// Default to noop provisioner if an extension is not found. This allows to
|
|
|
|
// accept a renewal of a cert without the provisioner extension.
|
|
|
|
return &noop{}, true
|
2019-03-06 22:50:13 +00:00
|
|
|
}
|
|
|
|
|
2019-03-13 18:26:18 +00:00
|
|
|
// LoadEncryptedKey returns an encrypted key by indexed by KeyID. At this moment
|
|
|
|
// only JWK encrypted keys are indexed by KeyID.
|
2019-03-06 22:50:13 +00:00
|
|
|
func (c *Collection) LoadEncryptedKey(keyID string) (string, bool) {
|
|
|
|
p, ok := loadProvisioner(c.byKey, keyID)
|
|
|
|
if !ok {
|
|
|
|
return "", false
|
|
|
|
}
|
|
|
|
_, key, ok := p.GetEncryptedKey()
|
|
|
|
return key, ok
|
2019-03-05 22:28:32 +00:00
|
|
|
}
|
|
|
|
|
2019-03-13 18:26:18 +00:00
|
|
|
// Store adds a provisioner to the collection and enforces the uniqueness of
|
|
|
|
// provisioner IDs.
|
2019-03-07 21:07:39 +00:00
|
|
|
func (c *Collection) Store(p Interface) error {
|
2019-03-06 22:50:13 +00:00
|
|
|
// Store provisioner always in byID. ID must be unique.
|
2019-05-27 00:41:10 +00:00
|
|
|
if _, loaded := c.byID.LoadOrStore(p.GetID(), p); loaded {
|
2021-05-03 19:48:20 +00:00
|
|
|
return admin.NewError(admin.ErrorBadRequestType,
|
|
|
|
"cannot add multiple provisioners with the same id")
|
2019-03-05 22:28:32 +00:00
|
|
|
}
|
2021-05-18 04:07:25 +00:00
|
|
|
// Store provisioner always by name.
|
|
|
|
if _, loaded := c.byName.LoadOrStore(p.GetName(), p); loaded {
|
|
|
|
c.byID.Delete(p.GetID())
|
2021-05-03 19:48:20 +00:00
|
|
|
return admin.NewError(admin.ErrorBadRequestType,
|
|
|
|
"cannot add multiple provisioners with the same name")
|
2021-05-18 04:07:25 +00:00
|
|
|
}
|
2021-05-20 01:23:20 +00:00
|
|
|
// Store provisioner always by ID presented in token.
|
|
|
|
if _, loaded := c.byTokenID.LoadOrStore(p.GetIDForToken(), p); loaded {
|
|
|
|
c.byID.Delete(p.GetID())
|
|
|
|
c.byName.Delete(p.GetName())
|
2021-05-03 19:48:20 +00:00
|
|
|
return admin.NewError(admin.ErrorBadRequestType,
|
|
|
|
"cannot add multiple provisioners with the same token identifier")
|
2021-05-20 01:23:20 +00:00
|
|
|
}
|
2019-03-06 22:50:13 +00:00
|
|
|
|
2019-03-13 18:26:18 +00:00
|
|
|
// Store provisioner in byKey if EncryptedKey is defined.
|
2019-03-06 22:50:13 +00:00
|
|
|
if kid, _, ok := p.GetEncryptedKey(); ok {
|
|
|
|
c.byKey.Store(kid, p)
|
2019-03-05 22:45:57 +00:00
|
|
|
}
|
2019-03-06 22:50:13 +00:00
|
|
|
|
|
|
|
// Store sorted provisioners.
|
|
|
|
// Use the first 4 bytes (32bit) of the sum to insert the order
|
|
|
|
// Using big endian format to get the strings sorted:
|
|
|
|
// 0x00000000, 0x00000001, 0x00000002, ...
|
|
|
|
bi := make([]byte, 4)
|
2019-03-08 20:19:44 +00:00
|
|
|
sum := provisionerSum(p)
|
2019-03-06 22:50:13 +00:00
|
|
|
binary.BigEndian.PutUint32(bi, uint32(c.sorted.Len()))
|
|
|
|
sum[0], sum[1], sum[2], sum[3] = bi[0], bi[1], bi[2], bi[3]
|
|
|
|
c.sorted = append(c.sorted, uidProvisioner{
|
|
|
|
provisioner: p,
|
|
|
|
uid: hex.EncodeToString(sum),
|
|
|
|
})
|
2019-03-08 20:19:44 +00:00
|
|
|
sort.Sort(c.sorted)
|
2019-03-05 22:28:32 +00:00
|
|
|
return nil
|
|
|
|
}
|
2019-03-05 22:45:57 +00:00
|
|
|
|
2021-05-03 19:48:20 +00:00
|
|
|
// Remove deletes an provisioner from all associated collections and lists.
|
|
|
|
func (c *Collection) Remove(id string) error {
|
|
|
|
prov, ok := c.Load(id)
|
|
|
|
if !ok {
|
|
|
|
return admin.NewError(admin.ErrorNotFoundType, "provisioner %s not found", id)
|
|
|
|
}
|
|
|
|
|
|
|
|
var found bool
|
|
|
|
for i, elem := range c.sorted {
|
2021-10-08 18:59:57 +00:00
|
|
|
if elem.provisioner.GetID() != id {
|
|
|
|
continue
|
2021-05-03 19:48:20 +00:00
|
|
|
}
|
2021-10-08 18:59:57 +00:00
|
|
|
// Remove index in sorted list
|
|
|
|
copy(c.sorted[i:], c.sorted[i+1:]) // Shift a[i+1:] left one index.
|
|
|
|
c.sorted[len(c.sorted)-1] = uidProvisioner{} // Erase last element (write zero value).
|
|
|
|
c.sorted = c.sorted[:len(c.sorted)-1] // Truncate slice.
|
|
|
|
found = true
|
|
|
|
break
|
2021-05-03 19:48:20 +00:00
|
|
|
}
|
|
|
|
if !found {
|
|
|
|
return admin.NewError(admin.ErrorNotFoundType, "provisioner %s not found in sorted list", prov.GetName())
|
|
|
|
}
|
|
|
|
|
|
|
|
c.byID.Delete(id)
|
|
|
|
c.byName.Delete(prov.GetName())
|
|
|
|
c.byTokenID.Delete(prov.GetIDForToken())
|
|
|
|
if kid, _, ok := prov.GetEncryptedKey(); ok {
|
|
|
|
c.byKey.Delete(kid)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Update updates the given provisioner in all related lists and collections.
|
|
|
|
func (c *Collection) Update(nu Interface) error {
|
|
|
|
old, ok := c.Load(nu.GetID())
|
|
|
|
if !ok {
|
|
|
|
return admin.NewError(admin.ErrorNotFoundType, "provisioner %s not found", nu.GetID())
|
|
|
|
}
|
|
|
|
|
|
|
|
if old.GetName() != nu.GetName() {
|
|
|
|
if _, ok := c.LoadByName(nu.GetName()); ok {
|
|
|
|
return admin.NewError(admin.ErrorBadRequestType,
|
|
|
|
"provisioner with name %s already exists", nu.GetName())
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if old.GetIDForToken() != nu.GetIDForToken() {
|
|
|
|
if _, ok := c.LoadByTokenID(nu.GetIDForToken()); ok {
|
|
|
|
return admin.NewError(admin.ErrorBadRequestType,
|
|
|
|
"provisioner with Token ID %s already exists", nu.GetIDForToken())
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := c.Remove(old.GetID()); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return c.Store(nu)
|
|
|
|
}
|
|
|
|
|
2019-03-06 22:50:13 +00:00
|
|
|
// Find implements pagination on a list of sorted provisioners.
|
2019-03-07 21:07:39 +00:00
|
|
|
func (c *Collection) Find(cursor string, limit int) (List, string) {
|
2019-03-06 22:50:13 +00:00
|
|
|
switch {
|
|
|
|
case limit <= 0:
|
|
|
|
limit = DefaultProvisionersLimit
|
|
|
|
case limit > DefaultProvisionersMax:
|
|
|
|
limit = DefaultProvisionersMax
|
|
|
|
}
|
|
|
|
|
|
|
|
n := c.sorted.Len()
|
|
|
|
cursor = fmt.Sprintf("%040s", cursor)
|
|
|
|
i := sort.Search(n, func(i int) bool { return c.sorted[i].uid >= cursor })
|
|
|
|
|
2019-03-07 21:07:39 +00:00
|
|
|
slice := List{}
|
2019-03-06 22:50:13 +00:00
|
|
|
for ; i < n && len(slice) < limit; i++ {
|
|
|
|
slice = append(slice, c.sorted[i].provisioner)
|
|
|
|
}
|
|
|
|
|
|
|
|
if i < n {
|
|
|
|
return slice, strings.TrimLeft(c.sorted[i].uid, "0")
|
|
|
|
}
|
|
|
|
return slice, ""
|
|
|
|
}
|
|
|
|
|
2019-03-07 21:07:39 +00:00
|
|
|
func loadProvisioner(m *sync.Map, key string) (Interface, bool) {
|
2019-03-06 22:50:13 +00:00
|
|
|
i, ok := m.Load(key)
|
2019-03-05 22:45:57 +00:00
|
|
|
if !ok {
|
|
|
|
return nil, false
|
|
|
|
}
|
2019-03-07 21:07:39 +00:00
|
|
|
p, ok := i.(Interface)
|
2019-03-05 22:45:57 +00:00
|
|
|
if !ok {
|
|
|
|
return nil, false
|
|
|
|
}
|
|
|
|
return p, true
|
|
|
|
}
|
2019-03-06 22:50:13 +00:00
|
|
|
|
|
|
|
// provisionerSum returns the SHA1 of the provisioners ID. From this we will
|
|
|
|
// create the unique and sorted id.
|
2019-03-08 20:19:44 +00:00
|
|
|
func provisionerSum(p Interface) []byte {
|
2022-08-23 19:43:48 +00:00
|
|
|
//nolint:gosec // not used for cryptographic security
|
2019-03-06 22:50:13 +00:00
|
|
|
sum := sha1.Sum([]byte(p.GetID()))
|
2019-03-08 20:19:44 +00:00
|
|
|
return sum[:]
|
2019-03-06 22:50:13 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// matchesAudience returns true if A and B share at least one element.
|
|
|
|
func matchesAudience(as, bs []string) bool {
|
|
|
|
if len(bs) == 0 || len(as) == 0 {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, b := range bs {
|
|
|
|
for _, a := range as {
|
|
|
|
if b == a || stripPort(a) == stripPort(b) {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
// stripPort attempts to strip the port from the given url. If parsing the url
|
|
|
|
// produces errors it will just return the passed argument.
|
|
|
|
func stripPort(rawurl string) string {
|
|
|
|
u, err := url.Parse(rawurl)
|
|
|
|
if err != nil {
|
|
|
|
return rawurl
|
|
|
|
}
|
|
|
|
u.Host = u.Hostname()
|
|
|
|
return u.String()
|
|
|
|
}
|
2019-06-04 00:19:44 +00:00
|
|
|
|
2019-06-07 18:24:56 +00:00
|
|
|
// extractFragment extracts the first fragment of an audience url.
|
2019-06-04 00:19:44 +00:00
|
|
|
func extractFragment(audience []string) string {
|
|
|
|
for _, s := range audience {
|
|
|
|
if u, err := url.Parse(s); err == nil && u.Fragment != "" {
|
|
|
|
return u.Fragment
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return ""
|
|
|
|
}
|