open-vault/command/pki_verify_sign.go

// Copyright (c) HashiCorp, Inc.
// SPDX-License-Identifier: MPL-2.0

package command

import (
	"bytes"
	"crypto/x509"
	"encoding/json"
	"fmt"
	"strconv"
	"strings"

	"github.com/hashicorp/vault/command/healthcheck"

	"github.com/ghodss/yaml"
	"github.com/hashicorp/vault/api"
	"github.com/ryanuber/columnize"
)

type PKIVerifySignCommand struct {
	*BaseCommand

	flagConfig          string
	flagReturnIndicator string
	flagDefaultDisabled bool
	flagList            bool
}

func (c *PKIVerifySignCommand) Synopsis() string {
	return "Check whether one certificate validates another specified certificate"
}

func (c *PKIVerifySignCommand) Help() string {
	helpText := `
Usage: vault pki verify-sign POSSIBLE-ISSUER POSSIBLE-ISSUED

  Verifies whether the listed issuer has signed the listed issued certificate.

  POSSIBLE-ISSUER and POSSIBLE-ISSUED are the fully name-spaced path to
  an issuer certificate, for instance: 'ns1/mount1/issuer/issuerName/json'.

  Returns five fields of information:

    - signature_match: was the key of the issuer used to sign the issued.
    - path_match: the possible issuer appears in the valid certificate chain
	  of the issued.
    - key_id_match: does the key-id of the issuer match the key_id of the
	  subject.
    - subject_match: does the subject name of the issuer match the issuer
	  subject of the issued.
    - trust_match: if someone trusted the parent issuer, is the chain
	  provided sufficient to trust the child issued.

` + c.Flags().Help()
	return strings.TrimSpace(helpText)
}

func (c *PKIVerifySignCommand) Flags() *FlagSets {
	set := c.flagSet(FlagSetHTTP | FlagSetOutputFormat)
	return set
}

func (c *PKIVerifySignCommand) Run(args []string) int {
	f := c.Flags()
	if err := f.Parse(args); err != nil {
		c.UI.Error(err.Error())
		return 1
	}

	args = f.Args()

	if len(args) < 2 {
		if len(args) == 0 {
			c.UI.Error("Not enough arguments (expected potential issuer and issued, got nothing)")
		} else {
			c.UI.Error("Not enough arguments (expected both potential issuer and issued, got only one)")
		}
		return 1
	} else if len(args) > 2 {
		c.UI.Error(fmt.Sprintf("Too many arguments (expected only potential issuer and issued, got %d arguments)", len(args)))
		for _, arg := range args {
			if strings.HasPrefix(arg, "-") {
				c.UI.Warn(fmt.Sprintf("Options (%v) must be specified before positional arguments (%v)", arg, args[0]))
				break
			}
		}
		return 1
	}

	issuer := sanitizePath(args[0])
	issued := sanitizePath(args[1])

	client, err := c.Client()
	if err != nil {
		c.UI.Error(fmt.Sprintf("Failed to obtain client: %s", err))
		return 1
	}

	issuerResp, err := readIssuer(client, issuer)
	if err != nil {
		c.UI.Error(fmt.Sprintf("Failed to read issuer: %s: %s", issuer, err.Error()))
		return 1
	}

	results, err := verifySignBetween(client, issuerResp, issued)
	if err != nil {
		c.UI.Error(fmt.Sprintf("Failed to run verification: %v", err))
		return pkiRetUsage
	}

	c.outputResults(results, issuer, issued)

	return 0
}

func verifySignBetween(client *api.Client, issuerResp *issuerResponse, issuedPath string) (map[string]bool, error) {
	// Note that this eats warnings

	issuerCert := issuerResp.certificate
	issuerKeyId := issuerCert.SubjectKeyId

	// Fetch and Parse the Potential Issued Cert
	issuedCertBundle, err := readIssuer(client, issuedPath)
	if err != nil {
		return nil, fmt.Errorf("error: unable to fetch issuer %v: %w", issuedPath, err)
	}
	parentKeyId := issuedCertBundle.certificate.AuthorityKeyId

	// Check the Chain-Match
	rootCertPool := x509.NewCertPool()
	rootCertPool.AddCert(issuerCert)
	checkTrustPathOptions := x509.VerifyOptions{
		Roots: rootCertPool,
	}
	trust := false
	trusts, err := issuedCertBundle.certificate.Verify(checkTrustPathOptions)
	if err != nil && !strings.Contains(err.Error(), "certificate signed by unknown authority") {
		return nil, err
	} else if err == nil {
		for _, chain := range trusts {
			// Output of this Should Only Have One Trust with Chain of Length Two (Child followed by Parent)
			for _, cert := range chain {
				if issuedCertBundle.certificate.Equal(cert) {
					trust = true
					break
				}
			}
		}
	}

	pathMatch := false
	for _, cert := range issuedCertBundle.caChain {
		if bytes.Equal(cert.Raw, issuerCert.Raw) {
			pathMatch = true
			break
		}
	}

	signatureMatch := false
	err = issuedCertBundle.certificate.CheckSignatureFrom(issuerCert)
	if err == nil {
		signatureMatch = true
	}

	result := map[string]bool{
		// This comparison isn't strictly correct, despite a standard ordering these are sets
		"subject_match":   bytes.Equal(issuerCert.RawSubject, issuedCertBundle.certificate.RawIssuer),
		"path_match":      pathMatch,
		"trust_match":     trust, // TODO: Refactor into a reasonable function
		"key_id_match":    bytes.Equal(parentKeyId, issuerKeyId),
		"signature_match": signatureMatch,
	}

	return result, nil
}

type issuerResponse struct {
	keyId       string
	certificate *x509.Certificate
	caChain     []*x509.Certificate
}

func readIssuer(client *api.Client, issuerPath string) (*issuerResponse, error) {
	issuerResp, err := client.Logical().Read(issuerPath)
	if err != nil {
		return nil, err
	}
	issuerCertPem, err := requireStrRespField(issuerResp, "certificate")
	if err != nil {
		return nil, err
	}
	issuerCert, err := healthcheck.ParsePEMCert(issuerCertPem)
	if err != nil {
		return nil, fmt.Errorf("unable to parse issuer %v's certificate: %w", issuerPath, err)
	}

	caChainPem, err := requireStrListRespField(issuerResp, "ca_chain")
	if err != nil {
		return nil, fmt.Errorf("unable to parse issuer %v's CA chain: %w", issuerPath, err)
	}

	var caChain []*x509.Certificate
	for _, pem := range caChainPem {
		trimmedPem := strings.TrimSpace(pem)
		if trimmedPem == "" {
			continue
		}
		cert, err := healthcheck.ParsePEMCert(trimmedPem)
		if err != nil {
			return nil, err
		}
		caChain = append(caChain, cert)
	}

	keyId := optStrRespField(issuerResp, "key_id")

	return &issuerResponse{
		keyId:       keyId,
		certificate: issuerCert,
		caChain:     caChain,
	}, nil
}

func optStrRespField(resp *api.Secret, reqField string) string {
	if resp == nil || resp.Data == nil {
		return ""
	}
	if val, present := resp.Data[reqField]; !present {
		return ""
	} else if strVal, castOk := val.(string); !castOk || strVal == "" {
		return ""
	} else {
		return strVal
	}
}

func requireStrRespField(resp *api.Secret, reqField string) (string, error) {
	if resp == nil || resp.Data == nil {
		return "", fmt.Errorf("nil response received, %s field unavailable", reqField)
	}
	if val, present := resp.Data[reqField]; !present {
		return "", fmt.Errorf("response did not contain field: %s", reqField)
	} else if strVal, castOk := val.(string); !castOk || strVal == "" {
		return "", fmt.Errorf("field %s value was blank or not a string: %v", reqField, val)
	} else {
		return strVal, nil
	}
}

func requireStrListRespField(resp *api.Secret, reqField string) ([]string, error) {
	if resp == nil || resp.Data == nil {
		return nil, fmt.Errorf("nil response received, %s field unavailable", reqField)
	}
	if val, present := resp.Data[reqField]; !present {
		return nil, fmt.Errorf("response did not contain field: %s", reqField)
	} else {
		return healthcheck.StringList(val)
	}
}

func (c *PKIVerifySignCommand) outputResults(results map[string]bool, potentialParent, potentialChild string) error {
	switch Format(c.UI) {
	case "", "table":
		return c.outputResultsTable(results, potentialParent, potentialChild)
	case "json":
		return c.outputResultsJSON(results)
	case "yaml":
		return c.outputResultsYAML(results)
	default:
		return fmt.Errorf("unknown output format: %v", Format(c.UI))
	}
}

func (c *PKIVerifySignCommand) outputResultsTable(results map[string]bool, potentialParent, potentialChild string) error {
	c.UI.Output("issuer:" + potentialParent)
	c.UI.Output("issued:" + potentialChild + "\n")
	data := []string{"field" + hopeDelim + "value"}
	for field, finding := range results {
		row := field + hopeDelim + strconv.FormatBool(finding)
		data = append(data, row)
	}
	c.UI.Output(tableOutput(data, &columnize.Config{
		Delim: hopeDelim,
	}))
	c.UI.Output("\n")

	return nil
}

func (c *PKIVerifySignCommand) outputResultsJSON(results map[string]bool) error {
	bytes, err := json.MarshalIndent(results, "", "  ")
	if err != nil {
		return err
	}

	c.UI.Output(string(bytes))
	return nil
}

func (c *PKIVerifySignCommand) outputResultsYAML(results map[string]bool) error {
	bytes, err := yaml.Marshal(results)
	if err != nil {
		return err
	}

	c.UI.Output(string(bytes))
	return nil
}