tangd.c

/* vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: */
/*
 * Copyright (c) 2016 Red Hat, Inc.
 * Author: Nathaniel McCallum <npmccallum@redhat.com>
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

#include "http.h"

#include <sys/types.h>
#include <sys/stat.h>
#include <limits.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdbool.h>
#include <string.h>
#include <unistd.h>

#include <jose/jose.h>
#include "keys.h"

struct tang_config {
    char *jwkdir;
    char *authorization_dir;
};

static void
str_cleanup(char **str)
{
    if (str)
        free(*str);
}

static int
adv(enum http_method method, const char *path, const char *body,
    regmatch_t matches[], void *misc)
{
    __attribute__((cleanup(str_cleanup))) char *adv = NULL;
    __attribute__((cleanup(str_cleanup))) char *thp = NULL;
    __attribute__((cleanup(cleanup_tang_keys_info))) struct tang_keys_info *tki = NULL;
    json_auto_t *jws = NULL;
    struct tang_config *tangcfg = misc;

    tki = read_keys(tangcfg->jwkdir);
    if (!tki || tki->m_keys_count == 0) {
        return http_reply(HTTP_STATUS_INTERNAL_SERVER_ERROR, NULL);
    }

    if (matches[1].rm_so < matches[1].rm_eo) {
        size_t size = matches[1].rm_eo - matches[1].rm_so;
        thp = strndup(&path[matches[1].rm_so], size);
        if (!thp)
            return http_reply(HTTP_STATUS_INTERNAL_SERVER_ERROR, NULL);
    }

    jws = find_jws(tki, thp);
    if (!jws) {
        return http_reply(HTTP_STATUS_NOT_FOUND, NULL);
    }

    adv = json_dumps(jws, 0);
    if (!adv)
        return http_reply(HTTP_STATUS_INTERNAL_SERVER_ERROR, NULL);

    return http_reply(HTTP_STATUS_OK,
                      "Content-Type: application/jose+json\r\n"
                      "Content-Length: %zu\r\n"
                      "\r\n%s", strlen(adv), adv);
}


static bool check_rec_authorization(const char *authdir, const char *thp)
{
    char auth_file[PATH_MAX+1];
    snprintf(auth_file, PATH_MAX, "%s/%s", authdir, thp);

    if (access(auth_file, F_OK | R_OK) != 0) {
        fprintf(stderr, " ** WARNING ** Authorization check failed for %s\n", thp);
        return false;
    }
    return true;
}


static int
rec(enum http_method method, const char *path, const char *body,
    regmatch_t matches[], void *misc)
{
    __attribute__((cleanup(str_cleanup))) char *enc = NULL;
    __attribute__((cleanup(str_cleanup))) char *thp = NULL;
    __attribute__((cleanup(cleanup_tang_keys_info))) struct tang_keys_info *tki = NULL;
    size_t size = matches[1].rm_eo - matches[1].rm_so;
    struct tang_config *tangcfg = misc;
    json_auto_t *jwk = NULL;
    json_auto_t *req = NULL;
    json_auto_t *rep = NULL;
    const char *alg = NULL;
    const char *kty = NULL;
    const char *d = NULL;

    /*
     * Parse and validate the request JWK
     */

    req = json_loads(body, 0, NULL);
    if (!req)
        return http_reply(HTTP_STATUS_BAD_REQUEST, NULL);

    if (!jose_jwk_prm(NULL, req, false, "deriveKey"))
        return http_reply(HTTP_STATUS_FORBIDDEN, NULL);

    if (json_unpack(req, "{s:s,s?s}", "kty", &kty, "alg", &alg) < 0)
        return http_reply(HTTP_STATUS_BAD_REQUEST, NULL);

    if (strcmp(kty, "EC") != 0)
        return http_reply(HTTP_STATUS_BAD_REQUEST, NULL);

    if (alg && strcmp(alg, "ECMR") != 0)
        return http_reply(HTTP_STATUS_BAD_REQUEST, NULL);

    /*
     * Parse and validate the server-side JWK
     */
    tki = read_keys(tangcfg->jwkdir);
    if (!tki || tki->m_keys_count == 0) {
        return http_reply(HTTP_STATUS_INTERNAL_SERVER_ERROR, NULL);
    }

    thp = strndup(&path[matches[1].rm_so], size);
    if (!thp)
        return http_reply(HTTP_STATUS_INTERNAL_SERVER_ERROR, NULL);

    jwk = find_jwk(tki, thp);
    if (!jwk)
        return http_reply(HTTP_STATUS_NOT_FOUND, NULL);

    /* If a authorization directory is given, check if the client thp is authorized */
    if (tangcfg->authorization_dir
        && !check_rec_authorization(tangcfg->authorization_dir, thp))
    {
        return http_reply(HTTP_STATUS_FORBIDDEN, NULL);
    }

    if (!jose_jwk_prm(NULL, jwk, true, "deriveKey"))
        return http_reply(HTTP_STATUS_FORBIDDEN, NULL);

    if (json_unpack(jwk, "{s:s,s?s}", "d", &d, "alg", &alg) < 0)
        return http_reply(HTTP_STATUS_FORBIDDEN, NULL);

    if (alg && strcmp(alg, "ECMR") != 0)
        return http_reply(HTTP_STATUS_FORBIDDEN, NULL);

    /*
     * Perform the exchange and return
     */
    rep = jose_jwk_exc(NULL, jwk, req);
    if (!rep)
        return http_reply(HTTP_STATUS_BAD_REQUEST, NULL);

    if (json_object_set_new(rep, "alg", json_string("ECMR")) < 0)
        return http_reply(HTTP_STATUS_INTERNAL_SERVER_ERROR, NULL);

    if (json_object_set_new(rep, "key_ops", json_pack("[s]", "deriveKey")) < 0)
        return http_reply(HTTP_STATUS_INTERNAL_SERVER_ERROR, NULL);

    enc = json_dumps(rep, JSON_SORT_KEYS | JSON_COMPACT);
    if (!enc)
        return http_reply(HTTP_STATUS_INTERNAL_SERVER_ERROR, NULL);

    return http_reply(HTTP_STATUS_OK,
                      "Content-Type: application/jwk+json\r\n"
                      "Content-Length: %zu\r\n"
                      "\r\n%s", strlen(enc), enc);
}

static struct http_dispatch dispatch[] = {
    { adv, 1 << HTTP_GET,  2, "^/+adv/+([0-9A-Za-z_-]+)$" },
    { adv, 1 << HTTP_GET,  2, "^/+adv/*$" },
    { rec, 1 << HTTP_POST, 2, "^/+rec/+([0-9A-Za-z_-]+)$" },
    {}
};

static bool check_directory(const char *path)
{
    struct stat st = {};

    if (stat(path, &st) != 0) {
        fprintf(stderr, "Error calling stat() on path: %s: %m\n", path);
        return false;
    }

    if (!S_ISDIR(st.st_mode)) {
        fprintf(stderr, "Path is not a directory: %s\n", path);
        return false;
    }
    return true;
}


int
main(int argc, char *argv[])
{
    if (argc <= 1 || argc >= 4) {
        fprintf(stderr, "Usage: %s <jwkdir> [<authorization_dir>]\n", argv[0]);
        return EXIT_FAILURE;
    }

    if (!check_directory(argv[1])) {
        return EXIT_FAILURE;
    }

    struct tang_config tangcfg = { .jwkdir = argv[1], .authorization_dir = NULL };
     if (argc == 3) {
        if (!check_directory(argv[2])) {
            return EXIT_FAILURE;
        }
        tangcfg.authorization_dir = argv[2];
    }

    struct http_state state = { .dispatch = dispatch, .misc = &tangcfg };
    struct http_parser parser = { .data = &state };
    char req[4096] = {};
    size_t rcvd = 0;
    int r = 0;

    http_parser_init(&parser, HTTP_REQUEST);

    for (;;) {
        r = read(STDIN_FILENO, &req[rcvd], sizeof(req) - rcvd - 1);
        if (r == 0)
            return rcvd > 0 ? EXIT_FAILURE : EXIT_SUCCESS;
        if (r < 0)
            return EXIT_FAILURE;

        rcvd += r;

        r = http_parser_execute(&parser, &http_settings, req, rcvd);
        if (parser.http_errno != 0) {
            fprintf(stderr, "HTTP Parsing Error: %s\n",
                    http_errno_description(parser.http_errno));
            return EXIT_SUCCESS;
        }

        memmove(req, &req[r], rcvd - r);
        rcvd -= r;
    }

    return EXIT_SUCCESS;
}