Support RespondToUnauthenticatedClients PATCH
RespondToUnauthenticatedClients allows users to explicitly select mTLS
as their only authentication mechanism, thus significantly reducing
their code exposure to unauthenticated clients.
From the Redfish specification
```
The RespondToUnauthenticatedClients property within the
ClientCertificate property within the MFA property of the AccountService
resource controls the response behavior when an invalid certificate is
provided by the client.
• If the property contains true or is not
supported by the service, the service shall not fail the TLS handshake.
This is to allow the service to send error messages or unauthenticated
resources to the client.
• If the property contains false , the service
shall fail the TLS handshake.
```
This commit implements that behavior.
This also has some added benefits in that we no longer have to check the
filesystem for every connection, as TLS is controlled explicitly, and
not whether or not a root cert is in place.
Note, this also implements a TODO to disable cookie auth when using
mTLS. Clients can still use IsAuthenticated to determine if they are
authenticated on request.
Tested:
Run scripts/generate_auth_certs.py to set up a root certificate and
client certificate. This verifies that mTLS as optional has not been
broken. Script succeeds.
```
PATCH /redfish/v1/AccountService
{"MultiFactorAuth": {"ClientCertificate": {"RespondToUnauthenticatedClients": false}}}
```
GET /redfish/v1
without a client certificate now fails with an ssl verification error
GET /redfish/v1
with a client certificate returns the result
```
PATCH /redfish/v1/AccountService
{"MultiFactorAuth": {"ClientCertificate": {"RespondToUnauthenticatedClients": false}}}
With certificate returns non mTLS functionality.
```
Change-Id: I5a9d6d6b1698bff83ab62b1f760afed6555849c9
Signed-off-by: Ed Tanous <ed@tanous.net>
diff --git a/http/http_connection.hpp b/http/http_connection.hpp
index 2050afd..e591455 100644
--- a/http/http_connection.hpp
+++ b/http/http_connection.hpp
@@ -63,18 +63,13 @@
public:
Connection(Handler* handlerIn, boost::asio::steady_timer&& timerIn,
std::function<std::string()>& getCachedDateStrF,
- Adaptor adaptorIn) :
+ Adaptor&& adaptorIn) :
adaptor(std::move(adaptorIn)),
handler(handlerIn), timer(std::move(timerIn)),
getCachedDateStr(getCachedDateStrF)
{
initParser();
- if constexpr (BMCWEB_MUTUAL_TLS_AUTH)
- {
- prepareMutualTls();
- }
-
connectionCount++;
BMCWEB_LOG_DEBUG("{} Connection created, total {}", logPtr(this),
@@ -99,55 +94,61 @@
bool tlsVerifyCallback(bool preverified,
boost::asio::ssl::verify_context& ctx)
{
- // We always return true to allow full auth flow for resources that
- // don't require auth
+ BMCWEB_LOG_DEBUG("{} tlsVerifyCallback called with preverified {}",
+ logPtr(this), preverified);
if (preverified)
{
mtlsSession = verifyMtlsUser(ip, ctx);
if (mtlsSession)
{
- BMCWEB_LOG_DEBUG("{} Generating TLS session: {}", logPtr(this),
+ BMCWEB_LOG_DEBUG("{} Generated TLS session: {}", logPtr(this),
mtlsSession->uniqueId);
}
}
+ const persistent_data::AuthConfigMethods& c =
+ persistent_data::SessionStore::getInstance().getAuthMethodsConfig();
+ if (c.tlsStrict)
+ {
+ return preverified;
+ }
+ // If tls strict mode is disabled
+ // We always return true to allow full auth flow for resources that
+ // don't require auth
return true;
}
- void prepareMutualTls()
+ bool prepareMutualTls()
{
if constexpr (IsTls<Adaptor>::value)
{
- std::error_code error;
- std::filesystem::path caPath(ensuressl::trustStorePath);
- auto caAvailable = !std::filesystem::is_empty(caPath, error);
- caAvailable = caAvailable && !error;
- if (caAvailable && persistent_data::SessionStore::getInstance()
- .getAuthMethodsConfig()
- .tls)
- {
- adaptor.set_verify_mode(boost::asio::ssl::verify_peer);
- std::string id = "bmcweb";
+ BMCWEB_LOG_DEBUG("prepareMutualTls");
- const char* cStr = id.c_str();
- // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast)
- const auto* idC = reinterpret_cast<const unsigned char*>(cStr);
- int ret = SSL_set_session_id_context(
- adaptor.native_handle(), idC,
- static_cast<unsigned int>(id.length()));
- if (ret == 0)
- {
- BMCWEB_LOG_ERROR("{} failed to set SSL id", logPtr(this));
- }
+ constexpr std::string_view id = "bmcweb";
+
+ const char* idPtr = id.data();
+ const auto* idCPtr = std::bit_cast<const unsigned char*>(idPtr);
+ auto idLen = static_cast<unsigned int>(id.length());
+ int ret = SSL_set_session_id_context(adaptor.native_handle(),
+ idCPtr, idLen);
+ if (ret == 0)
+ {
+ BMCWEB_LOG_ERROR("{} failed to set SSL id", logPtr(this));
+ return false;
}
- adaptor.set_verify_callback(
- std::bind_front(&self_type::tlsVerifyCallback, this));
- }
- }
+ BMCWEB_LOG_DEBUG("set_verify_callback");
- Adaptor& socket()
- {
- return adaptor;
+ boost::system::error_code ec;
+ adaptor.set_verify_callback(
+ std::bind_front(&self_type::tlsVerifyCallback, this), ec);
+ if (ec)
+ {
+ BMCWEB_LOG_ERROR("Failed to set verify callback {}", ec);
+ return false;
+ }
+ }
+
+ return true;
}
void start()
@@ -161,6 +162,15 @@
return;
}
+ if constexpr (BMCWEB_MUTUAL_TLS_AUTH)
+ {
+ if (!prepareMutualTls())
+ {
+ BMCWEB_LOG_ERROR("{} Failed to prepare mTLS", logPtr(this));
+ return;
+ }
+ }
+
startDeadline();
readClientIp();
@@ -332,6 +342,13 @@
void hardClose()
{
+ if (mtlsSession != nullptr)
+ {
+ BMCWEB_LOG_DEBUG("{} Removing TLS session: {}", logPtr(this),
+ mtlsSession->uniqueId);
+ persistent_data::SessionStore::getInstance().removeSession(
+ mtlsSession);
+ }
BMCWEB_LOG_DEBUG("{} Closing socket", logPtr(this));
boost::beast::get_lowest_layer(adaptor).close();
}
@@ -350,13 +367,7 @@
void gracefulClose()
{
BMCWEB_LOG_DEBUG("{} Socket close requested", logPtr(this));
- if (mtlsSession != nullptr)
- {
- BMCWEB_LOG_DEBUG("{} Removing TLS session: {}", logPtr(this),
- mtlsSession->uniqueId);
- persistent_data::SessionStore::getInstance().removeSession(
- mtlsSession);
- }
+
if constexpr (IsTls<Adaptor>::value)
{
adaptor.async_shutdown(std::bind_front(
@@ -517,14 +528,14 @@
return;
}
- if constexpr (!std::is_same_v<Adaptor, boost::beast::test::stream>)
+ constexpr bool isTest =
+ std::is_same_v<Adaptor, boost::beast::test::stream>;
+
+ if constexpr (!BMCWEB_INSECURE_DISABLE_AUTH && !isTest)
{
- if constexpr (!BMCWEB_INSECURE_DISABLE_AUTH)
- {
- boost::beast::http::verb method = parser->get().method();
- userSession = crow::authentication::authenticate(
- ip, res, method, parser->get().base(), mtlsSession);
- }
+ boost::beast::http::verb method = parser->get().method();
+ userSession = crow::authentication::authenticate(
+ ip, res, method, parser->get().base(), mtlsSession);
}
std::string_view expect =