From 40519afbb7b21bcb6dc4a0d75ae72fc72e7511ec Mon Sep 17 00:00:00 2001 From: Hannes Mehnert Date: Sun, 28 Oct 2018 20:50:10 +0100 Subject: [PATCH] issue policy_add commands by vmmd_tls for certificate chain --- app/vmmd_tls.ml | 68 ++++++++++++++++++++++++++++---------- src/vmm_tls.ml | 86 +++++++++++++++++++++++++++++++++---------------- src/vmm_tls.mli | 5 +-- 3 files changed, 113 insertions(+), 46 deletions(-) diff --git a/app/vmmd_tls.ml b/app/vmmd_tls.ml index 49f8b8c..2d5cc65 100644 --- a/app/vmmd_tls.ml +++ b/app/vmmd_tls.ml @@ -55,6 +55,7 @@ let process fd tls = Vmm_lwt.read_wire fd >>= function | Error _ -> Lwt.return (Error (`Msg "read error")) | Ok wire -> + (* TODO check version *) Logs.debug (fun m -> m "proxying %a" Vmm_commands.pp_wire wire) ; Vmm_tls_lwt.write_tls tls wire >|= function | Ok () -> Ok () @@ -66,26 +67,59 @@ let handle ca (tls, addr) = | Error (`Msg m) -> Vmm_tls_lwt.close tls >>= fun () -> Lwt.fail_with m - | Ok (name, cmd) -> + | Ok (name, policies, cmd) -> let sock, next = Vmm_commands.endpoint cmd in connect (Vmm_core.socket_path sock) >>= fun fd -> - let wire = - let header = Vmm_commands.{version = my_version ; sequence = !command ; id = name } in - command := Int64.succ !command ; - (header, `Command cmd) - in - Vmm_lwt.write_wire fd wire >>= function - | Error `Exception -> - Vmm_tls_lwt.close tls >>= fun () -> - Vmm_lwt.safe_close fd >>= fun () -> - Lwt.return (Error (`Msg "couldn't write")) + (match sock with + | `Vmmd -> + Lwt_list.fold_left_s (fun r (id, policy) -> + match r with + | Error (`Msg msg) -> Lwt.return (Error (`Msg msg)) + | Ok () -> + Logs.debug (fun m -> m "adding policy for %a: %a" Vmm_core.pp_id id Vmm_core.pp_policy policy) ; + let header = Vmm_commands.{version = my_version ; sequence = !command ; id } in + command := Int64.succ !command ; + Vmm_lwt.write_wire fd (header, `Command (`Policy_cmd (`Policy_add policy))) >>= function + | Error `Exception -> Lwt.return (Error (`Msg "failed to write policy")) + | Ok () -> + Vmm_lwt.read_wire fd >|= function + | Error _ -> Error (`Msg "read error") + | Ok (_, `Success _) -> Ok () + | Ok _ -> + (* TODO check version *) + Error (`Msg ("expected success, received something else when adding policy"))) + (Ok ()) policies + | _ -> Lwt.return (Ok ())) >>= function + | Error (`Msg msg) -> + begin + Logs.debug (fun m -> m "error while applying policies %s" msg) ; + let wire = + let header = Vmm_commands.{version = my_version ; sequence = 0L ; id = name } in + header, `Failure msg + in + Vmm_tls_lwt.write_tls tls wire >>= fun _ -> + Vmm_tls_lwt.close tls >>= fun () -> + Vmm_lwt.safe_close fd >>= fun () -> + Lwt.fail_with msg + end | Ok () -> - (match next with - | `Read -> read fd tls - | `End -> process fd tls) >>= fun res -> - Vmm_tls_lwt.close tls >>= fun () -> - Vmm_lwt.safe_close fd >|= fun () -> - res + let wire = + let header = Vmm_commands.{version = my_version ; sequence = !command ; id = name } in + command := Int64.succ !command ; + (header, `Command cmd) + in + Vmm_lwt.write_wire fd wire >>= function + | Error `Exception -> + Vmm_tls_lwt.close tls >>= fun () -> + Vmm_lwt.safe_close fd >>= fun () -> + Lwt.return (Error (`Msg "couldn't write")) + | Ok () -> + (match next with + | `Read -> read fd tls + | `End -> process fd tls) >>= fun res -> + Vmm_tls_lwt.close tls >>= fun () -> + Vmm_lwt.safe_close fd >|= fun () -> + res let server_socket port = let open Lwt_unix in diff --git a/src/vmm_tls.ml b/src/vmm_tls.ml index df68224..864d010 100644 --- a/src/vmm_tls.ml +++ b/src/vmm_tls.ml @@ -4,17 +4,22 @@ open Rresult open Rresult.R.Infix (* we skip all non-albatross certificates *) +let cert_name cert = + match X509.Extension.unsupported cert Vmm_asn.oid with + | None -> None + | Some _ -> + let data = X509.common_name_to_string cert in + (* if the common name is empty, skip [useful for vmmc_bistro at least] + TODO: document properly and investigate potential security issue with + multi-tenant system (likely ca should ensure to never sign a delegation + with empty common name) *) + if data = "" then None else Some data + let name chain = List.fold_left (fun acc cert -> - match X509.Extension.unsupported cert Vmm_asn.oid with + match cert_name cert with | None -> acc - | Some _ -> - let data = X509.common_name_to_string cert in - (* if the common name is empty, skip [useful for vmmc_bistro at least] - TODO: document properly and investigate potential security issue with - multi-tenant system (likely ca should ensure to never sign a delegation - with empty common name) *) - if data = "" then acc else data :: acc) + | Some data -> data :: acc) [] chain (* this separates the leaf and top-level certificate from the chain, @@ -27,15 +32,15 @@ let separate_chain = function let wire_command_of_cert version cert = match X509.Extension.unsupported cert Vmm_asn.oid with - | None -> R.error_msgf "albatross OID is not present in certificate (%a)" Asn.OID.pp Vmm_asn.oid + | None -> Error `Not_present | Some (_, data) -> - Vmm_asn.cert_extension_of_cstruct data >>= fun (v, wire) -> - if not (Vmm_commands.version_eq v version) then - R.error_msgf "unexpected version %a (expected %a)" - Vmm_commands.pp_version v - Vmm_commands.pp_version version - else - Ok wire + match Vmm_asn.cert_extension_of_cstruct data with + | Error (`Msg p) -> Error (`Parse p) + | Ok (v, wire) -> + if not (Vmm_commands.version_eq v version) then + Error (`Version v) + else + Ok wire (* let check_policy = (* get names and static resources *) @@ -50,6 +55,26 @@ let wire_command_of_cert version cert = check_policies vm_config (List.map snd policies) >>= fun () -> *) +let extract_policies version chain = + List.fold_left (fun acc cert -> + match acc, wire_command_of_cert version cert with + | Error e, _ -> Error e + | Ok acc, Error `Not_present -> Ok acc + | Ok _, Error (`Parse msg) -> Error (`Msg msg) + | Ok _, Error (`Version received) -> + R.error_msgf "unexpected version %a (expected %a)" + Vmm_commands.pp_version received + Vmm_commands.pp_version version + | Ok (prefix, acc), Ok (`Policy_cmd (`Policy_add p)) -> + let name = match cert_name cert with + | None -> prefix + | Some x -> x :: prefix + in + Ok (name, (name, p) :: acc) + | _, Ok wire -> + R.error_msgf "unexpected wire %a" Vmm_commands.pp wire) + (Ok ([], [])) chain + let handle _addr version chain = separate_chain chain >>= fun (leaf, rest) -> let name = name chain in @@ -57,15 +82,22 @@ let handle _addr version chain = (X509.common_name_to_string leaf) Fmt.(list ~sep:(unit " -> ") string) (List.map X509.common_name_to_string rest)) ; - (* TODO: inspect top-level-cert of chain. *) + extract_policies version rest >>= fun (_, policies) -> (* TODO: logging let login_hdr, login_ev = Log.hdr name, `Login addr in *) - (* TODO: update policies (parse chain for policy, and apply them)! *) - wire_command_of_cert version leaf >>= fun wire -> - (* we only allow some commands via certificate *) - match wire with - | `Console_cmd (`Console_subscribe _) - | `Stats_cmd `Stats_subscribe - | `Log_cmd (`Log_subscribe _) - | `Vm_cmd _ - | `Policy_cmd _ -> Ok (name, wire) (* TODO policy_cmd is special (via delegation chain) *) - | _ -> Error (`Msg "unexpected command") + match wire_command_of_cert version leaf with + | Error (`Parse p) -> Error (`Msg p) + | Error (`Not_present) -> + Error (`Msg "leaf certificate does not contain an albatross extension") + | Error (`Version received) -> + R.error_msgf "unexpected version %a (expected %a)" + Vmm_commands.pp_version received + Vmm_commands.pp_version version + | Ok wire -> + (* we only allow some commands via certificate *) + match wire with + | `Console_cmd (`Console_subscribe _) + | `Stats_cmd `Stats_subscribe + | `Log_cmd (`Log_subscribe _) + | `Vm_cmd _ + | `Policy_cmd `Policy_info -> Ok (name, policies, wire) + | _ -> Error (`Msg "unexpected command") diff --git a/src/vmm_tls.mli b/src/vmm_tls.mli index 6505d41..61b5674 100644 --- a/src/vmm_tls.mli +++ b/src/vmm_tls.mli @@ -1,9 +1,10 @@ (* (c) 2018 Hannes Mehnert, all rights reserved *) val wire_command_of_cert : Vmm_commands.version -> X509.t -> - (Vmm_commands.t, [> `Msg of string ]) result + (Vmm_commands.t, [> `Parse of string | `Not_present | `Version of Vmm_commands.version ]) result val handle : 'a -> Vmm_commands.version -> X509.t list -> - (string list * Vmm_commands.t, [> `Msg of string ]) Result.result + (string list * (Vmm_core.id * Vmm_core.policy) list * Vmm_commands.t, + [> `Msg of string ]) Result.result