Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Wire ACME improvements #1691

Merged
merged 18 commits into from
Feb 7, 2024
Merged

Wire ACME improvements #1691

Show file tree
Hide file tree
Changes from 17 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
6ee0d70
Add check for empty deviceID in target URI template evaluation
hslatman Jan 18, 2024
4d4719a
Change URLs used in DPoP template test
hslatman Jan 24, 2024
79943d2
Merge branch 'wire-acme-extensions' into herman/wire-acme-improvements
hslatman Jan 29, 2024
8a9b1b3
Move Wire option validation to provisioner initialization
hslatman Jan 29, 2024
14e8d47
Skip Wire option validation and initialization if not enabled
hslatman Jan 29, 2024
19feae5
Add test for ACME initialization with Wire challenges
hslatman Jan 31, 2024
cd21f8d
Refactor OIDC verifier instantation to happen only once
hslatman Jan 31, 2024
c579239
Add basic support for OIDC provider instantiation through discovery
hslatman Jan 31, 2024
e6d9208
Merge branch 'wire-acme-extensions' into herman/wire-acme-improvements
hslatman Jan 31, 2024
37a9f36
Merge branch 'wire-acme-extensions' into herman/wire-acme-improvements
hslatman Feb 6, 2024
e153be3
Replace `smallstep/assert` with `stretchr/testify` for ACME provisioner
hslatman Feb 6, 2024
ef657d7
Fix OIDC target
hslatman Feb 6, 2024
c6a6622
Improve test coverage for Wire authorizations
hslatman Feb 6, 2024
2e78301
Simplify the DPoP target provider functionality
hslatman Feb 6, 2024
5d7e533
Add validation of `name` in DPoP token
hslatman Feb 6, 2024
138c101
Add validation for Wire UserID + DeviceID identifiers
hslatman Feb 6, 2024
745017c
Add test for OIDC auto discovery configuration
hslatman Feb 6, 2024
194341e
Address review comments
hslatman Feb 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
121 changes: 81 additions & 40 deletions acme/api/order.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ import (
"crypto/x509"
"encoding/base64"
"encoding/json"
"fmt"
"net"
"net/http"
"strings"
Expand Down Expand Up @@ -49,30 +50,86 @@ func (n *NewOrderRequest) Validate() error {
if id.Value == "" {
return acme.NewError(acme.ErrorMalformedType, "permanent identifier cannot be empty")
}
case acme.WireUser:
_, err := wire.ParseUserID([]byte(id.Value))
if err != nil {
return acme.WrapError(acme.ErrorMalformedType, err, "failed parsing Wire ID")
}
case acme.WireDevice:
wireID, err := wire.ParseDeviceID([]byte(id.Value))
if err != nil {
return acme.WrapError(acme.ErrorMalformedType, err, "failed parsing Wire ID")
}
if _, err := wire.ParseClientID(wireID.ClientID); err != nil {
return acme.WrapError(acme.ErrorMalformedType, err, "invalid Wire client ID %q", wireID.ClientID)
}
case acme.WireUser, acme.WireDevice:
// validation of Wire identifiers is performed in `validateWireIdentifiers`, but
// marked here as known and supported types.
continue
default:
return acme.NewError(acme.ErrorMalformedType, "identifier type unsupported: %s", id.Type)
}
}

// TODO(hs): add some validations for DNS domains?
// TODO(hs): combine the errors from this with allow/deny policy, like example error in https://datatracker.ietf.org/doc/html/rfc8555#section-6.7.1
if err := n.validateWireIdentifiers(); err != nil {
return acme.WrapError(acme.ErrorMalformedType, err, "failed validating Wire identifiers")
}

// TODO(hs): add some validations for DNS domains?
// TODO(hs): combine the errors from this with allow/deny policy, like example error in https://datatracker.ietf.org/doc/html/rfc8555#section-6.7.1

return nil
}

func (n *NewOrderRequest) validateWireIdentifiers() error {
if !n.hasWireIdentifiers() {
return nil
}

userIdentifiers := identifiersOfType(acme.WireUser, n.Identifiers)
deviceIdentifiers := identifiersOfType(acme.WireDevice, n.Identifiers)

if len(userIdentifiers) != 1 {
return fmt.Errorf("expected exactly one Wire UserID identifier; got %d", len(userIdentifiers))
}
if len(deviceIdentifiers) != 1 {
return fmt.Errorf("expected exactly one Wire DeviceID identifier, got %d", len(deviceIdentifiers))
}

wireUserID, err := wire.ParseUserID([]byte(userIdentifiers[0].Value))
if err != nil {
return fmt.Errorf("failed parsing Wire UserID: %w", err)
}

wireDeviceID, err := wire.ParseDeviceID([]byte(deviceIdentifiers[0].Value))
if err != nil {
return fmt.Errorf("failed parsing Wire DeviceID: %w", err)
}
maraino marked this conversation as resolved.
Show resolved Hide resolved
if _, err := wire.ParseClientID(wireDeviceID.ClientID); err != nil {
return fmt.Errorf("invalid Wire client ID %q: %w", wireDeviceID.ClientID, err)
}

switch {
case wireUserID.Domain != wireDeviceID.Domain:
return fmt.Errorf("UserID domain %q does not match DeviceID domain %q", wireUserID.Domain, wireDeviceID.Domain)
case wireUserID.Name != wireDeviceID.Name:
return fmt.Errorf("UserID name %q does not match DeviceID name %q", wireUserID.Name, wireDeviceID.Name)
case wireUserID.Handle != wireDeviceID.Handle:
return fmt.Errorf("UserID handle %q does not match DeviceID handle %q", wireUserID.Handle, wireDeviceID.Handle)
}

return nil
}

// hasWireIdentifiers returns whether the [NewOrderRequest] contains
// Wire identifiers.
func (n *NewOrderRequest) hasWireIdentifiers() bool {
for _, i := range n.Identifiers {
if i.Type == acme.WireUser || i.Type == acme.WireDevice {
return true
}
}
return false
}

// identifiersOfType returns the Identifiers that are of type typ.
func identifiersOfType(typ acme.IdentifierType, ids []acme.Identifier) (result []acme.Identifier) {
for _, id := range ids {
if id.Type == typ {
result = append(result, id)
}
}
return
}

// FinalizeRequest captures the body for a Finalize order request.
type FinalizeRequest struct {
CSR string `json:"csr"`
Expand Down Expand Up @@ -280,44 +337,28 @@ func newAuthorization(ctx context.Context, az *acme.Authorization) error {
var target string
switch az.Identifier.Type {
case acme.WireUser:
wireOptions, err := prov.GetOptions().GetWireOptions()
if err != nil {
return acme.WrapErrorISE(err, "failed getting Wire options")
wireOptions := prov.GetOptions().GetWireOptions()
if wireOptions == nil {
return acme.NewErrorISE("failed getting Wire options")
}
var targetProvider interface{ EvaluateTarget(string) (string, error) }
switch typ {
case acme.WIREOIDC01:
targetProvider = wireOptions.GetOIDCOptions()
default:
return acme.NewError(acme.ErrorMalformedType, "unsupported type %q", typ)
}

target, err = targetProvider.EvaluateTarget("")
target, err = wireOptions.GetOIDCOptions().EvaluateTarget("")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we ever pass the deviceID to these options?

Copy link
Member Author

@hslatman hslatman Feb 6, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need to check this one with Wire, as it may no longer be used after changing to two different identifier types. But maybe they still need it with a UserID instead.

if err != nil {
return acme.WrapError(acme.ErrorMalformedType, err, "invalid Go template registered for 'target'")
}
case acme.WireDevice:
wireID, err := wire.ParseDeviceID([]byte(az.Identifier.Value))
if err != nil {
return acme.WrapError(acme.ErrorMalformedType, err, "failed parsing WireUser")
return acme.WrapError(acme.ErrorMalformedType, err, "failed parsing WireDevice")
}
clientID, err := wire.ParseClientID(wireID.ClientID)
if err != nil {
return acme.WrapError(acme.ErrorMalformedType, err, "failed parsing ClientID")
}
wireOptions, err := prov.GetOptions().GetWireOptions()
if err != nil {
return acme.WrapErrorISE(err, "failed getting Wire options")
wireOptions := prov.GetOptions().GetWireOptions()
if wireOptions == nil {
return acme.NewErrorISE("failed getting Wire options")
}
var targetProvider interface{ EvaluateTarget(string) (string, error) }
switch typ {
case acme.WIREDPOP01:
targetProvider = wireOptions.GetDPOPOptions()
default:
return acme.NewError(acme.ErrorMalformedType, "unsupported type %q", typ)
}

target, err = targetProvider.EvaluateTarget(clientID.DeviceID)
target, err = wireOptions.GetDPOPOptions().EvaluateTarget(clientID.DeviceID)
if err != nil {
return acme.WrapError(acme.ErrorMalformedType, err, "invalid Go template registered for 'target'")
}
Expand Down
Loading
Loading