hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/security/x509/certificate/authority/BaseApprover.java - hadoop - Git at Google

 /*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
  * regarding copyright ownership.  The ASF licenses this file
  * to you under the Apache License, Version 2.0 (the
  * "License"); you may not use this file except in compliance
  * with the License.  You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  *
  */

 package org.apache.hadoop.hdds.security.x509.certificate.authority;

 import org.apache.hadoop.hdds.security.exception.SCMSecurityException;
 import org.apache.hadoop.hdds.security.x509.SecurityConfig;
 import org.apache.hadoop.hdds.security.x509.certificate.authority.PKIProfiles.PKIProfile;
 import org.apache.hadoop.hdds.security.x509.certificates.utils.CertificateSignRequest;
 import org.bouncycastle.asn1.ASN1Encodable;
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
 import org.bouncycastle.asn1.pkcs.Attribute;
 import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
 import org.bouncycastle.asn1.x500.RDN;
 import org.bouncycastle.asn1.x509.Extension;
 import org.bouncycastle.asn1.x509.Extensions;
 import org.bouncycastle.cert.X509CertificateHolder;
 import org.bouncycastle.operator.ContentVerifierProvider;
 import org.bouncycastle.operator.OperatorCreationException;
 import org.bouncycastle.operator.jcajce.JcaContentVerifierProviderBuilder;
 import org.bouncycastle.pkcs.PKCS10CertificationRequest;
 import org.bouncycastle.pkcs.PKCSException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Objects;
 import java.util.concurrent.CompletableFuture;

 /**
  * A base approver class for certificate approvals.
  */
 public abstract class BaseApprover implements CertificateApprover {
   private static final Logger LOG =
       LoggerFactory.getLogger(CertificateApprover.class);
   private final PKIProfile profile;
   private final SecurityConfig securityConfig;

   public BaseApprover(PKIProfile pkiProfile, SecurityConfig config) {
     this.profile = Objects.requireNonNull(pkiProfile);
     this.securityConfig = Objects.requireNonNull(config);
   }

   /**
    * Returns the Security config.
    *
    * @return SecurityConfig
    */
   public SecurityConfig getSecurityConfig() {
     return securityConfig;
   }

   /**
    * Returns the Attribute array that encodes extensions.
    *
    * @param request - Certificate Request
    * @return - An Array of Attributes that encode various extensions requested
    * in this certificate.
    */
   Attribute[] getAttributes(PKCS10CertificationRequest request) {
     Objects.requireNonNull(request);
     return
         request.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
   }

   /**
    * Returns a list of Extensions encoded in a given attribute.
    *
    * @param attribute - Attribute to decode.
    * @return - List of Extensions.
    */
   List<Extensions> getExtensionsList(Attribute attribute) {
     Objects.requireNonNull(attribute);
     List<Extensions> extensionsList = new ArrayList<>();
     for (ASN1Encodable value : attribute.getAttributeValues()) {
       if(value != null) {
         Extensions extensions = Extensions.getInstance(value);
         extensionsList.add(extensions);
       }
     }
     return extensionsList;
   }

   /**
    * Returns the Extension decoded into a Java Collection.
    * @param extensions - A set of Extensions in ASN.1.
    * @return List of Decoded Extensions.
    */
   List<Extension> getIndividualExtension(Extensions extensions) {
     Objects.requireNonNull(extensions);
     List<Extension> extenList = new ArrayList<>();
     for (ASN1ObjectIdentifier id : extensions.getExtensionOIDs()) {
       if (id != null) {
         Extension ext = extensions.getExtension(id);
         if (ext != null) {
           extenList.add(ext);
         }
       }
     }
     return extenList;
   }


   /**
    * This function verifies all extensions in the certificate.
    *
    * @param request - CSR
    * @return - true if the extensions are acceptable by the profile, false
    * otherwise.
    */
   boolean verfiyExtensions(PKCS10CertificationRequest request) {
     Objects.requireNonNull(request);
     /*
      * Inside a CSR we have
      *  1. A list of Attributes
      *    2. Inside each attribute a list of extensions.
      *      3. We need to walk thru the each extension and verify they
      *      are expected and we can put that into a certificate.
      */

     for (Attribute attr : getAttributes(request)) {
       for (Extensions extensionsList : getExtensionsList(attr)) {
         for (Extension extension : getIndividualExtension(extensionsList)) {
           if (!profile.validateExtension(extension)) {
             LOG.error("Failed to verify extension. {}",
                 extension.getExtnId().getId());
             return false;
           }
         }
       }
     }
     return true;
   }

   /**
    * Verifies the Signature on the CSR is valid.
    *
    * @param pkcs10Request - PCKS10 Request.
    * @return True if it is valid, false otherwise.
    * @throws OperatorCreationException - On Error.
    * @throws PKCSException             - on Error.
    */
   boolean verifyPkcs10Request(PKCS10CertificationRequest pkcs10Request)
       throws OperatorCreationException, PKCSException {
     ContentVerifierProvider verifierProvider = new
         JcaContentVerifierProviderBuilder()
         .setProvider(this.securityConfig.getProvider())
         .build(pkcs10Request.getSubjectPublicKeyInfo());
     return
         pkcs10Request.isSignatureValid(verifierProvider);
   }

   /**
    * {@inheritDoc}
    */
   @Override
   public CompletableFuture<X509CertificateHolder> inspectCSR(String csr)
       throws IOException {
     return inspectCSR(CertificateSignRequest.getCertificationRequest(csr));
   }

   /**
    * {@inheritDoc}
    */
   @Override
   public CompletableFuture<X509CertificateHolder>
         inspectCSR(PKCS10CertificationRequest csr) {
     /**
      * The base approver executes the following algorithm to verify that a
      * CSR meets the PKI Profile criteria.
      *
      * 0. For time being (Until we have SCM HA) we will deny all request to
      * become an intermediary CA. So we will not need to verify using CA
      * profile, right now.
      *
      * 1. We verify the proof of possession. That is we verify the entity
      * that sends us the CSR indeed has the private key for the said public key.
      *
      * 2. Then we will verify the RDNs meet the format and the Syntax that
      * PKI profile dictates.
      *
      * 3. Then we decode each and every extension and  ask if the PKI profile
      * approves of these extension requests.
      *
      * 4. If all of these pass, We will return a Future which will point to
      * the Certificate when finished.
      */

     CompletableFuture<X509CertificateHolder> response =
         new CompletableFuture<>();
     try {
       // Step 0: Verify this is not a CA Certificate.
       // Will be done by the Ozone PKI profile for time being.
       // If there are any basicConstraints, they will flagged as not
       // supported for time being.

       // Step 1: Let us verify that Certificate is indeed signed by someone
       // who has access to the private key.
       if (!verifyPkcs10Request(csr)) {
         LOG.error("Failed to verify the signature in CSR.");
         response.completeExceptionally(new SCMSecurityException("Failed to " +
             "verify the CSR."));
       }

       // Step 2: Verify the RDNs are in the correct format.
       // TODO: Ozone Profile does not verify RDN now, so this call will pass.
       for (RDN rdn : csr.getSubject().getRDNs()) {
         if (!profile.validateRDN(rdn)) {
           LOG.error("Failed in verifying RDNs");
           response.completeExceptionally(new SCMSecurityException("Failed to " +
               "verify the RDNs. Please check the subject name."));
         }
       }

       // Step 3: Verify the Extensions.
       if (!verfiyExtensions(csr)) {
         LOG.error("failed in verification of extensions.");
         response.completeExceptionally(new SCMSecurityException("Failed to " +
             "verify extensions."));
       }

     } catch (OperatorCreationException | PKCSException e) {
       LOG.error("Approval Failure.", e);
       response.completeExceptionally(new SCMSecurityException(e));
     }
     return response;
   }


 }
	/*
	* Licensed to the Apache Software Foundation (ASF) under one
	* or more contributor license agreements. See the NOTICE file
	* distributed with this work for additional information
	* regarding copyright ownership. The ASF licenses this file
	* to you under the Apache License, Version 2.0 (the
	* "License"); you may not use this file except in compliance
	* with the License. You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*
	*/

	package org.apache.hadoop.hdds.security.x509.certificate.authority;

	import org.apache.hadoop.hdds.security.exception.SCMSecurityException;
	import org.apache.hadoop.hdds.security.x509.SecurityConfig;
	import org.apache.hadoop.hdds.security.x509.certificate.authority.PKIProfiles.PKIProfile;
	import org.apache.hadoop.hdds.security.x509.certificates.utils.CertificateSignRequest;
	import org.bouncycastle.asn1.ASN1Encodable;
	import org.bouncycastle.asn1.ASN1ObjectIdentifier;
	import org.bouncycastle.asn1.pkcs.Attribute;
	import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
	import org.bouncycastle.asn1.x500.RDN;
	import org.bouncycastle.asn1.x509.Extension;
	import org.bouncycastle.asn1.x509.Extensions;
	import org.bouncycastle.cert.X509CertificateHolder;
	import org.bouncycastle.operator.ContentVerifierProvider;
	import org.bouncycastle.operator.OperatorCreationException;
	import org.bouncycastle.operator.jcajce.JcaContentVerifierProviderBuilder;
	import org.bouncycastle.pkcs.PKCS10CertificationRequest;
	import org.bouncycastle.pkcs.PKCSException;
	import org.slf4j.Logger;
	import org.slf4j.LoggerFactory;

	import java.io.IOException;
	import java.util.ArrayList;
	import java.util.List;
	import java.util.Objects;
	import java.util.concurrent.CompletableFuture;

	/**
	* A base approver class for certificate approvals.
	*/
	public abstract class BaseApprover implements CertificateApprover {
	private static final Logger LOG =
	LoggerFactory.getLogger(CertificateApprover.class);
	private final PKIProfile profile;
	private final SecurityConfig securityConfig;

	public BaseApprover(PKIProfile pkiProfile, SecurityConfig config) {
	this.profile = Objects.requireNonNull(pkiProfile);
	this.securityConfig = Objects.requireNonNull(config);
	}

	/**
	* Returns the Security config.
	*
	* @return SecurityConfig
	*/
	public SecurityConfig getSecurityConfig() {
	return securityConfig;
	}

	/**
	* Returns the Attribute array that encodes extensions.
	*
	* @param request - Certificate Request
	* @return - An Array of Attributes that encode various extensions requested
	* in this certificate.
	*/
	Attribute[] getAttributes(PKCS10CertificationRequest request) {
	Objects.requireNonNull(request);
	return
	request.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
	}

	/**
	* Returns a list of Extensions encoded in a given attribute.
	*
	* @param attribute - Attribute to decode.
	* @return - List of Extensions.
	*/
	List<Extensions> getExtensionsList(Attribute attribute) {
	Objects.requireNonNull(attribute);
	List<Extensions> extensionsList = new ArrayList<>();
	for (ASN1Encodable value : attribute.getAttributeValues()) {
	if(value != null) {
	Extensions extensions = Extensions.getInstance(value);
	extensionsList.add(extensions);
	}
	}
	return extensionsList;
	}

	/**
	* Returns the Extension decoded into a Java Collection.
	* @param extensions - A set of Extensions in ASN.1.
	* @return List of Decoded Extensions.
	*/
	List<Extension> getIndividualExtension(Extensions extensions) {
	Objects.requireNonNull(extensions);
	List<Extension> extenList = new ArrayList<>();
	for (ASN1ObjectIdentifier id : extensions.getExtensionOIDs()) {
	if (id != null) {
	Extension ext = extensions.getExtension(id);
	if (ext != null) {
	extenList.add(ext);
	}
	}
	}
	return extenList;
	}



	/**
	* This function verifies all extensions in the certificate.
	*
	* @param request - CSR
	* @return - true if the extensions are acceptable by the profile, false
	* otherwise.
	*/
	boolean verfiyExtensions(PKCS10CertificationRequest request) {
	Objects.requireNonNull(request);
	/*
	* Inside a CSR we have
	* 1. A list of Attributes
	* 2. Inside each attribute a list of extensions.
	* 3. We need to walk thru the each extension and verify they
	* are expected and we can put that into a certificate.
	*/

	for (Attribute attr : getAttributes(request)) {
	for (Extensions extensionsList : getExtensionsList(attr)) {
	for (Extension extension : getIndividualExtension(extensionsList)) {
	if (!profile.validateExtension(extension)) {
	LOG.error("Failed to verify extension. {}",
	extension.getExtnId().getId());
	return false;
	}
	}
	}
	}
	return true;
	}

	/**
	* Verifies the Signature on the CSR is valid.
	*
	* @param pkcs10Request - PCKS10 Request.
	* @return True if it is valid, false otherwise.
	* @throws OperatorCreationException - On Error.
	* @throws PKCSException - on Error.
	*/
	boolean verifyPkcs10Request(PKCS10CertificationRequest pkcs10Request)
	throws OperatorCreationException, PKCSException {
	ContentVerifierProvider verifierProvider = new
	JcaContentVerifierProviderBuilder()
	.setProvider(this.securityConfig.getProvider())
	.build(pkcs10Request.getSubjectPublicKeyInfo());
	return
	pkcs10Request.isSignatureValid(verifierProvider);
	}

	/**
	* {@inheritDoc}
	*/
	@Override
	public CompletableFuture<X509CertificateHolder> inspectCSR(String csr)
	throws IOException {
	return inspectCSR(CertificateSignRequest.getCertificationRequest(csr));
	}

	/**
	* {@inheritDoc}
	*/
	@Override
	public CompletableFuture<X509CertificateHolder>
	inspectCSR(PKCS10CertificationRequest csr) {
	/**
	* The base approver executes the following algorithm to verify that a
	* CSR meets the PKI Profile criteria.
	*
	* 0. For time being (Until we have SCM HA) we will deny all request to
	* become an intermediary CA. So we will not need to verify using CA
	* profile, right now.
	*
	* 1. We verify the proof of possession. That is we verify the entity
	* that sends us the CSR indeed has the private key for the said public key.
	*
	* 2. Then we will verify the RDNs meet the format and the Syntax that
	* PKI profile dictates.
	*
	* 3. Then we decode each and every extension and ask if the PKI profile
	* approves of these extension requests.
	*
	* 4. If all of these pass, We will return a Future which will point to
	* the Certificate when finished.
	*/

	CompletableFuture<X509CertificateHolder> response =
	new CompletableFuture<>();
	try {
	// Step 0: Verify this is not a CA Certificate.
	// Will be done by the Ozone PKI profile for time being.
	// If there are any basicConstraints, they will flagged as not
	// supported for time being.

	// Step 1: Let us verify that Certificate is indeed signed by someone
	// who has access to the private key.
	if (!verifyPkcs10Request(csr)) {
	LOG.error("Failed to verify the signature in CSR.");
	response.completeExceptionally(new SCMSecurityException("Failed to " +
	"verify the CSR."));
	}

	// Step 2: Verify the RDNs are in the correct format.
	// TODO: Ozone Profile does not verify RDN now, so this call will pass.
	for (RDN rdn : csr.getSubject().getRDNs()) {
	if (!profile.validateRDN(rdn)) {
	LOG.error("Failed in verifying RDNs");
	response.completeExceptionally(new SCMSecurityException("Failed to " +
	"verify the RDNs. Please check the subject name."));
	}
	}

	// Step 3: Verify the Extensions.
	if (!verfiyExtensions(csr)) {
	LOG.error("failed in verification of extensions.");
	response.completeExceptionally(new SCMSecurityException("Failed to " +
	"verify extensions."));
	}

	} catch (OperatorCreationException \| PKCSException e) {
	LOG.error("Approval Failure.", e);
	response.completeExceptionally(new SCMSecurityException(e));
	}
	return response;
	}


	}