1 /* $OpenBSD: ssh-pkcs11-helper.c,v 1.3 2010/02/24 06:12:53 djm Exp $ */
2 /*
3  * Copyright (c) 2010 Markus Friedl.  All rights reserved.
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include "includes.h"
19 
20 #include <sys/types.h>
21 #ifdef HAVE_SYS_TIME_H
22 # include <sys/time.h>
23 #endif
24 
25 #include "openbsd-compat/sys-queue.h"
26 
27 #include <stdarg.h>
28 #include <string.h>
29 #include <unistd.h>
30 #include <errno.h>
31 
32 #include "xmalloc.h"
33 #include "buffer.h"
34 #include "log.h"
35 #include "misc.h"
36 #include "key.h"
37 #include "authfd.h"
38 #include "ssh-pkcs11.h"
39 
40 #ifdef ENABLE_PKCS11
41 
42 /* borrows code from sftp-server and ssh-agent */
43 
44 struct pkcs11_keyinfo {
45 	Key		*key;
46 	char		*providername;
47 	TAILQ_ENTRY(pkcs11_keyinfo) next;
48 };
49 
50 TAILQ_HEAD(, pkcs11_keyinfo) pkcs11_keylist;
51 
52 #define MAX_MSG_LENGTH		10240 /*XXX*/
53 
54 /* helper */
55 #define get_int()			buffer_get_int(&iqueue);
56 #define get_string(lenp)		buffer_get_string(&iqueue, lenp);
57 
58 /* input and output queue */
59 Buffer iqueue;
60 Buffer oqueue;
61 
62 static void
63 add_key(Key *k, char *name)
64 {
65 	struct pkcs11_keyinfo *ki;
66 
67 	ki = xcalloc(1, sizeof(*ki));
68 	ki->providername = xstrdup(name);
69 	ki->key = k;
70 	TAILQ_INSERT_TAIL(&pkcs11_keylist, ki, next);
71 }
72 
73 static void
74 del_keys_by_name(char *name)
75 {
76 	struct pkcs11_keyinfo *ki, *nxt;
77 
78 	for (ki = TAILQ_FIRST(&pkcs11_keylist); ki; ki = nxt) {
79 		nxt = TAILQ_NEXT(ki, next);
80 		if (!strcmp(ki->providername, name)) {
81 			TAILQ_REMOVE(&pkcs11_keylist, ki, next);
82 			xfree(ki->providername);
83 			key_free(ki->key);
84 			free(ki);
85 		}
86 	}
87 }
88 
89 /* lookup matching 'private' key */
90 static Key *
91 lookup_key(Key *k)
92 {
93 	struct pkcs11_keyinfo *ki;
94 
95 	TAILQ_FOREACH(ki, &pkcs11_keylist, next) {
96 		debug("check %p %s", ki, ki->providername);
97 		if (key_equal(k, ki->key))
98 			return (ki->key);
99 	}
100 	return (NULL);
101 }
102 
103 static void
104 send_msg(Buffer *m)
105 {
106 	int mlen = buffer_len(m);
107 
108 	buffer_put_int(&oqueue, mlen);
109 	buffer_append(&oqueue, buffer_ptr(m), mlen);
110 	buffer_consume(m, mlen);
111 }
112 
113 static void
114 process_add(void)
115 {
116 	char *name, *pin;
117 	Key **keys;
118 	int i, nkeys;
119 	u_char *blob;
120 	u_int blen;
121 	Buffer msg;
122 
123 	buffer_init(&msg);
124 	name = get_string(NULL);
125 	pin = get_string(NULL);
126 	if ((nkeys = pkcs11_add_provider(name, pin, &keys)) > 0) {
127 		buffer_put_char(&msg, SSH2_AGENT_IDENTITIES_ANSWER);
128 		buffer_put_int(&msg, nkeys);
129 		for (i = 0; i < nkeys; i++) {
130 			key_to_blob(keys[i], &blob, &blen);
131 			buffer_put_string(&msg, blob, blen);
132 			buffer_put_cstring(&msg, name);
133 			xfree(blob);
134 			add_key(keys[i], name);
135 		}
136 		xfree(keys);
137 	} else {
138 		buffer_put_char(&msg, SSH_AGENT_FAILURE);
139 	}
140 	xfree(pin);
141 	xfree(name);
142 	send_msg(&msg);
143 	buffer_free(&msg);
144 }
145 
146 static void
147 process_del(void)
148 {
149 	char *name, *pin;
150 	Buffer msg;
151 
152 	buffer_init(&msg);
153 	name = get_string(NULL);
154 	pin = get_string(NULL);
155 	del_keys_by_name(name);
156 	if (pkcs11_del_provider(name) == 0)
157 		 buffer_put_char(&msg, SSH_AGENT_SUCCESS);
158 	else
159 		 buffer_put_char(&msg, SSH_AGENT_FAILURE);
160 	xfree(pin);
161 	xfree(name);
162 	send_msg(&msg);
163 	buffer_free(&msg);
164 }
165 
166 static void
167 process_sign(void)
168 {
169 	u_char *blob, *data, *signature = NULL;
170 	u_int blen, dlen, slen = 0;
171 	int ok = -1, ret;
172 	int __unused flags;
173 	Key *key, *found;
174 	Buffer msg;
175 
176 	blob = get_string(&blen);
177 	data = get_string(&dlen);
178 	flags = get_int(); /* XXX ignore */
179 
180 	if ((key = key_from_blob(blob, blen)) != NULL) {
181 		if ((found = lookup_key(key)) != NULL) {
182 			slen = RSA_size(key->rsa);
183 			signature = xmalloc(slen);
184 			if ((ret = RSA_private_encrypt(dlen, data, signature,
185 			    found->rsa, RSA_PKCS1_PADDING)) != -1) {
186 				slen = ret;
187 				ok = 0;
188 			}
189 		}
190 		key_free(key);
191 	}
192 	buffer_init(&msg);
193 	if (ok == 0) {
194 		buffer_put_char(&msg, SSH2_AGENT_SIGN_RESPONSE);
195 		buffer_put_string(&msg, signature, slen);
196 	} else {
197 		buffer_put_char(&msg, SSH_AGENT_FAILURE);
198 	}
199 	xfree(data);
200 	xfree(blob);
201 	if (signature != NULL)
202 		xfree(signature);
203 	send_msg(&msg);
204 	buffer_free(&msg);
205 }
206 
207 static void
208 process(void)
209 {
210 	u_int msg_len;
211 	u_int buf_len;
212 	u_int consumed;
213 	u_int type;
214 	u_char *cp;
215 
216 	buf_len = buffer_len(&iqueue);
217 	if (buf_len < 5)
218 		return;		/* Incomplete message. */
219 	cp = buffer_ptr(&iqueue);
220 	msg_len = get_u32(cp);
221 	if (msg_len > MAX_MSG_LENGTH) {
222 		error("bad message len %d", msg_len);
223 		cleanup_exit(11);
224 	}
225 	if (buf_len < msg_len + 4)
226 		return;
227 	buffer_consume(&iqueue, 4);
228 	buf_len -= 4;
229 	type = buffer_get_char(&iqueue);
230 	switch (type) {
231 	case SSH_AGENTC_ADD_SMARTCARD_KEY:
232 		debug("process_add");
233 		process_add();
234 		break;
235 	case SSH_AGENTC_REMOVE_SMARTCARD_KEY:
236 		debug("process_del");
237 		process_del();
238 		break;
239 	case SSH2_AGENTC_SIGN_REQUEST:
240 		debug("process_sign");
241 		process_sign();
242 		break;
243 	default:
244 		error("Unknown message %d", type);
245 		break;
246 	}
247 	/* discard the remaining bytes from the current packet */
248 	if (buf_len < buffer_len(&iqueue)) {
249 		error("iqueue grew unexpectedly");
250 		cleanup_exit(255);
251 	}
252 	consumed = buf_len - buffer_len(&iqueue);
253 	if (msg_len < consumed) {
254 		error("msg_len %d < consumed %d", msg_len, consumed);
255 		cleanup_exit(255);
256 	}
257 	if (msg_len > consumed)
258 		buffer_consume(&iqueue, msg_len - consumed);
259 }
260 
261 void
262 cleanup_exit(int i)
263 {
264 	/* XXX */
265 	_exit(i);
266 }
267 
268 int
269 main(int argc, char **argv)
270 {
271 	fd_set *rset, *wset;
272 	int in, out, max, log_stderr = 0;
273 	ssize_t len, olen, set_size;
274 	SyslogFacility log_facility = SYSLOG_FACILITY_AUTH;
275 	LogLevel log_level = SYSLOG_LEVEL_ERROR;
276 	char buf[4*4096];
277 
278 	extern char *optarg;
279 	extern char *__progname;
280 
281 	TAILQ_INIT(&pkcs11_keylist);
282 	pkcs11_init(0);
283 
284 	seed_rng();
285 	__progname = ssh_get_progname(argv[0]);
286 
287 	log_init(__progname, log_level, log_facility, log_stderr);
288 
289 	in = STDIN_FILENO;
290 	out = STDOUT_FILENO;
291 
292 	max = 0;
293 	if (in > max)
294 		max = in;
295 	if (out > max)
296 		max = out;
297 
298 	buffer_init(&iqueue);
299 	buffer_init(&oqueue);
300 
301 	set_size = howmany(max + 1, NFDBITS) * sizeof(fd_mask);
302 	rset = (fd_set *)xmalloc(set_size);
303 	wset = (fd_set *)xmalloc(set_size);
304 
305 	for (;;) {
306 		memset(rset, 0, set_size);
307 		memset(wset, 0, set_size);
308 
309 		/*
310 		 * Ensure that we can read a full buffer and handle
311 		 * the worst-case length packet it can generate,
312 		 * otherwise apply backpressure by stopping reads.
313 		 */
314 		if (buffer_check_alloc(&iqueue, sizeof(buf)) &&
315 		    buffer_check_alloc(&oqueue, MAX_MSG_LENGTH))
316 			FD_SET(in, rset);
317 
318 		olen = buffer_len(&oqueue);
319 		if (olen > 0)
320 			FD_SET(out, wset);
321 
322 		if (select(max+1, rset, wset, NULL, NULL) < 0) {
323 			if (errno == EINTR)
324 				continue;
325 			error("select: %s", strerror(errno));
326 			cleanup_exit(2);
327 		}
328 
329 		/* copy stdin to iqueue */
330 		if (FD_ISSET(in, rset)) {
331 			len = read(in, buf, sizeof buf);
332 			if (len == 0) {
333 				debug("read eof");
334 				cleanup_exit(0);
335 			} else if (len < 0) {
336 				error("read: %s", strerror(errno));
337 				cleanup_exit(1);
338 			} else {
339 				buffer_append(&iqueue, buf, len);
340 			}
341 		}
342 		/* send oqueue to stdout */
343 		if (FD_ISSET(out, wset)) {
344 			len = write(out, buffer_ptr(&oqueue), olen);
345 			if (len < 0) {
346 				error("write: %s", strerror(errno));
347 				cleanup_exit(1);
348 			} else {
349 				buffer_consume(&oqueue, len);
350 			}
351 		}
352 
353 		/*
354 		 * Process requests from client if we can fit the results
355 		 * into the output buffer, otherwise stop processing input
356 		 * and let the output queue drain.
357 		 */
358 		if (buffer_check_alloc(&oqueue, MAX_MSG_LENGTH))
359 			process();
360 	}
361 }
362 #else /* ENABLE_PKCS11 */
363 int
364 main(int argc, char **argv)
365 {
366 	extern char *__progname;
367 
368 	__progname = ssh_get_progname(argv[0]);
369 	log_init(__progname, SYSLOG_LEVEL_ERROR, SYSLOG_FACILITY_AUTH, 0);
370 	fatal("PKCS#11 support disabled at compile time");
371 }
372 #endif /* ENABLE_PKCS11 */
373