1 /* $OpenBSD: sshkey.c,v 1.56 2017/08/12 06:42:52 djm Exp $ */ 2 /* 3 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 4 * Copyright (c) 2008 Alexander von Gernler. All rights reserved. 5 * Copyright (c) 2010,2011 Damien Miller. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 #include "includes.h" 29 30 #include <sys/types.h> 31 #include <netinet/in.h> 32 33 #ifdef WITH_OPENSSL 34 #include <openssl/evp.h> 35 #include <openssl/err.h> 36 #include <openssl/pem.h> 37 #endif 38 39 #include "crypto_api.h" 40 41 #include <errno.h> 42 #include <limits.h> 43 #include <stdio.h> 44 #include <string.h> 45 #include <resolv.h> 46 #ifdef HAVE_UTIL_H 47 #include <util.h> 48 #endif /* HAVE_UTIL_H */ 49 50 #include "ssh2.h" 51 #include "ssherr.h" 52 #include "misc.h" 53 #include "sshbuf.h" 54 #include "cipher.h" 55 #include "digest.h" 56 #define SSHKEY_INTERNAL 57 #include "sshkey.h" 58 #include "match.h" 59 60 /* openssh private key file format */ 61 #define MARK_BEGIN "-----BEGIN OPENSSH PRIVATE KEY-----\n" 62 #define MARK_END "-----END OPENSSH PRIVATE KEY-----\n" 63 #define MARK_BEGIN_LEN (sizeof(MARK_BEGIN) - 1) 64 #define MARK_END_LEN (sizeof(MARK_END) - 1) 65 #define KDFNAME "bcrypt" 66 #define AUTH_MAGIC "openssh-key-v1" 67 #define SALT_LEN 16 68 #define DEFAULT_CIPHERNAME "aes256-ctr" 69 #define DEFAULT_ROUNDS 16 70 71 /* Version identification string for SSH v1 identity files. */ 72 #define LEGACY_BEGIN "SSH PRIVATE KEY FILE FORMAT 1.1\n" 73 74 static int sshkey_from_blob_internal(struct sshbuf *buf, 75 struct sshkey **keyp, int allow_cert); 76 77 /* Supported key types */ 78 struct keytype { 79 const char *name; 80 const char *shortname; 81 int type; 82 int nid; 83 int cert; 84 int sigonly; 85 }; 86 static const struct keytype keytypes[] = { 87 { "ssh-ed25519", "ED25519", KEY_ED25519, 0, 0, 0 }, 88 { "ssh-ed25519-cert-v01@openssh.com", "ED25519-CERT", 89 KEY_ED25519_CERT, 0, 1, 0 }, 90 #ifdef WITH_OPENSSL 91 { "ssh-rsa", "RSA", KEY_RSA, 0, 0, 0 }, 92 { "rsa-sha2-256", "RSA", KEY_RSA, 0, 0, 1 }, 93 { "rsa-sha2-512", "RSA", KEY_RSA, 0, 0, 1 }, 94 { "ssh-dss", "DSA", KEY_DSA, 0, 0, 0 }, 95 # ifdef OPENSSL_HAS_ECC 96 { "ecdsa-sha2-nistp256", "ECDSA", KEY_ECDSA, NID_X9_62_prime256v1, 0, 0 }, 97 { "ecdsa-sha2-nistp384", "ECDSA", KEY_ECDSA, NID_secp384r1, 0, 0 }, 98 # ifdef OPENSSL_HAS_NISTP521 99 { "ecdsa-sha2-nistp521", "ECDSA", KEY_ECDSA, NID_secp521r1, 0, 0 }, 100 # endif /* OPENSSL_HAS_NISTP521 */ 101 # endif /* OPENSSL_HAS_ECC */ 102 { "ssh-rsa-cert-v01@openssh.com", "RSA-CERT", KEY_RSA_CERT, 0, 1, 0 }, 103 { "ssh-dss-cert-v01@openssh.com", "DSA-CERT", KEY_DSA_CERT, 0, 1, 0 }, 104 # ifdef OPENSSL_HAS_ECC 105 { "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ECDSA-CERT", 106 KEY_ECDSA_CERT, NID_X9_62_prime256v1, 1, 0 }, 107 { "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ECDSA-CERT", 108 KEY_ECDSA_CERT, NID_secp384r1, 1, 0 }, 109 # ifdef OPENSSL_HAS_NISTP521 110 { "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ECDSA-CERT", 111 KEY_ECDSA_CERT, NID_secp521r1, 1, 0 }, 112 # endif /* OPENSSL_HAS_NISTP521 */ 113 # endif /* OPENSSL_HAS_ECC */ 114 #endif /* WITH_OPENSSL */ 115 { NULL, NULL, -1, -1, 0, 0 } 116 }; 117 118 const char * 119 sshkey_type(const struct sshkey *k) 120 { 121 const struct keytype *kt; 122 123 for (kt = keytypes; kt->type != -1; kt++) { 124 if (kt->type == k->type) 125 return kt->shortname; 126 } 127 return "unknown"; 128 } 129 130 static const char * 131 sshkey_ssh_name_from_type_nid(int type, int nid) 132 { 133 const struct keytype *kt; 134 135 for (kt = keytypes; kt->type != -1; kt++) { 136 if (kt->type == type && (kt->nid == 0 || kt->nid == nid)) 137 return kt->name; 138 } 139 return "ssh-unknown"; 140 } 141 142 int 143 sshkey_type_is_cert(int type) 144 { 145 const struct keytype *kt; 146 147 for (kt = keytypes; kt->type != -1; kt++) { 148 if (kt->type == type) 149 return kt->cert; 150 } 151 return 0; 152 } 153 154 const char * 155 sshkey_ssh_name(const struct sshkey *k) 156 { 157 return sshkey_ssh_name_from_type_nid(k->type, k->ecdsa_nid); 158 } 159 160 const char * 161 sshkey_ssh_name_plain(const struct sshkey *k) 162 { 163 return sshkey_ssh_name_from_type_nid(sshkey_type_plain(k->type), 164 k->ecdsa_nid); 165 } 166 167 int 168 sshkey_type_from_name(const char *name) 169 { 170 const struct keytype *kt; 171 172 for (kt = keytypes; kt->type != -1; kt++) { 173 /* Only allow shortname matches for plain key types */ 174 if ((kt->name != NULL && strcmp(name, kt->name) == 0) || 175 (!kt->cert && strcasecmp(kt->shortname, name) == 0)) 176 return kt->type; 177 } 178 return KEY_UNSPEC; 179 } 180 181 int 182 sshkey_ecdsa_nid_from_name(const char *name) 183 { 184 const struct keytype *kt; 185 186 for (kt = keytypes; kt->type != -1; kt++) { 187 if (kt->type != KEY_ECDSA && kt->type != KEY_ECDSA_CERT) 188 continue; 189 if (kt->name != NULL && strcmp(name, kt->name) == 0) 190 return kt->nid; 191 } 192 return -1; 193 } 194 195 char * 196 sshkey_alg_list(int certs_only, int plain_only, int include_sigonly, char sep) 197 { 198 char *tmp, *ret = NULL; 199 size_t nlen, rlen = 0; 200 const struct keytype *kt; 201 202 for (kt = keytypes; kt->type != -1; kt++) { 203 if (kt->name == NULL) 204 continue; 205 if (!include_sigonly && kt->sigonly) 206 continue; 207 if ((certs_only && !kt->cert) || (plain_only && kt->cert)) 208 continue; 209 if (ret != NULL) 210 ret[rlen++] = sep; 211 nlen = strlen(kt->name); 212 if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) { 213 free(ret); 214 return NULL; 215 } 216 ret = tmp; 217 memcpy(ret + rlen, kt->name, nlen + 1); 218 rlen += nlen; 219 } 220 return ret; 221 } 222 223 int 224 sshkey_names_valid2(const char *names, int allow_wildcard) 225 { 226 char *s, *cp, *p; 227 const struct keytype *kt; 228 int type; 229 230 if (names == NULL || strcmp(names, "") == 0) 231 return 0; 232 if ((s = cp = strdup(names)) == NULL) 233 return 0; 234 for ((p = strsep(&cp, ",")); p && *p != '\0'; 235 (p = strsep(&cp, ","))) { 236 type = sshkey_type_from_name(p); 237 if (type == KEY_UNSPEC) { 238 if (allow_wildcard) { 239 /* 240 * Try matching key types against the string. 241 * If any has a positive or negative match then 242 * the component is accepted. 243 */ 244 for (kt = keytypes; kt->type != -1; kt++) { 245 if (match_pattern_list(kt->name, 246 p, 0) != 0) 247 break; 248 } 249 if (kt->type != -1) 250 continue; 251 } 252 free(s); 253 return 0; 254 } 255 } 256 free(s); 257 return 1; 258 } 259 260 u_int 261 sshkey_size(const struct sshkey *k) 262 { 263 switch (k->type) { 264 #ifdef WITH_OPENSSL 265 case KEY_RSA: 266 case KEY_RSA_CERT: 267 return BN_num_bits(k->rsa->n); 268 case KEY_DSA: 269 case KEY_DSA_CERT: 270 return BN_num_bits(k->dsa->p); 271 case KEY_ECDSA: 272 case KEY_ECDSA_CERT: 273 return sshkey_curve_nid_to_bits(k->ecdsa_nid); 274 #endif /* WITH_OPENSSL */ 275 case KEY_ED25519: 276 case KEY_ED25519_CERT: 277 return 256; /* XXX */ 278 } 279 return 0; 280 } 281 282 static int 283 sshkey_type_is_valid_ca(int type) 284 { 285 switch (type) { 286 case KEY_RSA: 287 case KEY_DSA: 288 case KEY_ECDSA: 289 case KEY_ED25519: 290 return 1; 291 default: 292 return 0; 293 } 294 } 295 296 int 297 sshkey_is_cert(const struct sshkey *k) 298 { 299 if (k == NULL) 300 return 0; 301 return sshkey_type_is_cert(k->type); 302 } 303 304 /* Return the cert-less equivalent to a certified key type */ 305 int 306 sshkey_type_plain(int type) 307 { 308 switch (type) { 309 case KEY_RSA_CERT: 310 return KEY_RSA; 311 case KEY_DSA_CERT: 312 return KEY_DSA; 313 case KEY_ECDSA_CERT: 314 return KEY_ECDSA; 315 case KEY_ED25519_CERT: 316 return KEY_ED25519; 317 default: 318 return type; 319 } 320 } 321 322 #ifdef WITH_OPENSSL 323 /* XXX: these are really begging for a table-driven approach */ 324 int 325 sshkey_curve_name_to_nid(const char *name) 326 { 327 if (strcmp(name, "nistp256") == 0) 328 return NID_X9_62_prime256v1; 329 else if (strcmp(name, "nistp384") == 0) 330 return NID_secp384r1; 331 # ifdef OPENSSL_HAS_NISTP521 332 else if (strcmp(name, "nistp521") == 0) 333 return NID_secp521r1; 334 # endif /* OPENSSL_HAS_NISTP521 */ 335 else 336 return -1; 337 } 338 339 u_int 340 sshkey_curve_nid_to_bits(int nid) 341 { 342 switch (nid) { 343 case NID_X9_62_prime256v1: 344 return 256; 345 case NID_secp384r1: 346 return 384; 347 # ifdef OPENSSL_HAS_NISTP521 348 case NID_secp521r1: 349 return 521; 350 # endif /* OPENSSL_HAS_NISTP521 */ 351 default: 352 return 0; 353 } 354 } 355 356 int 357 sshkey_ecdsa_bits_to_nid(int bits) 358 { 359 switch (bits) { 360 case 256: 361 return NID_X9_62_prime256v1; 362 case 384: 363 return NID_secp384r1; 364 # ifdef OPENSSL_HAS_NISTP521 365 case 521: 366 return NID_secp521r1; 367 # endif /* OPENSSL_HAS_NISTP521 */ 368 default: 369 return -1; 370 } 371 } 372 373 const char * 374 sshkey_curve_nid_to_name(int nid) 375 { 376 switch (nid) { 377 case NID_X9_62_prime256v1: 378 return "nistp256"; 379 case NID_secp384r1: 380 return "nistp384"; 381 # ifdef OPENSSL_HAS_NISTP521 382 case NID_secp521r1: 383 return "nistp521"; 384 # endif /* OPENSSL_HAS_NISTP521 */ 385 default: 386 return NULL; 387 } 388 } 389 390 int 391 sshkey_ec_nid_to_hash_alg(int nid) 392 { 393 int kbits = sshkey_curve_nid_to_bits(nid); 394 395 if (kbits <= 0) 396 return -1; 397 398 /* RFC5656 section 6.2.1 */ 399 if (kbits <= 256) 400 return SSH_DIGEST_SHA256; 401 else if (kbits <= 384) 402 return SSH_DIGEST_SHA384; 403 else 404 return SSH_DIGEST_SHA512; 405 } 406 #endif /* WITH_OPENSSL */ 407 408 static void 409 cert_free(struct sshkey_cert *cert) 410 { 411 u_int i; 412 413 if (cert == NULL) 414 return; 415 sshbuf_free(cert->certblob); 416 sshbuf_free(cert->critical); 417 sshbuf_free(cert->extensions); 418 free(cert->key_id); 419 for (i = 0; i < cert->nprincipals; i++) 420 free(cert->principals[i]); 421 free(cert->principals); 422 sshkey_free(cert->signature_key); 423 explicit_bzero(cert, sizeof(*cert)); 424 free(cert); 425 } 426 427 static struct sshkey_cert * 428 cert_new(void) 429 { 430 struct sshkey_cert *cert; 431 432 if ((cert = calloc(1, sizeof(*cert))) == NULL) 433 return NULL; 434 if ((cert->certblob = sshbuf_new()) == NULL || 435 (cert->critical = sshbuf_new()) == NULL || 436 (cert->extensions = sshbuf_new()) == NULL) { 437 cert_free(cert); 438 return NULL; 439 } 440 cert->key_id = NULL; 441 cert->principals = NULL; 442 cert->signature_key = NULL; 443 return cert; 444 } 445 446 struct sshkey * 447 sshkey_new(int type) 448 { 449 struct sshkey *k; 450 #ifdef WITH_OPENSSL 451 RSA *rsa; 452 DSA *dsa; 453 #endif /* WITH_OPENSSL */ 454 455 if ((k = calloc(1, sizeof(*k))) == NULL) 456 return NULL; 457 k->type = type; 458 k->ecdsa = NULL; 459 k->ecdsa_nid = -1; 460 k->dsa = NULL; 461 k->rsa = NULL; 462 k->cert = NULL; 463 k->ed25519_sk = NULL; 464 k->ed25519_pk = NULL; 465 switch (k->type) { 466 #ifdef WITH_OPENSSL 467 case KEY_RSA: 468 case KEY_RSA_CERT: 469 if ((rsa = RSA_new()) == NULL || 470 (rsa->n = BN_new()) == NULL || 471 (rsa->e = BN_new()) == NULL) { 472 if (rsa != NULL) 473 RSA_free(rsa); 474 free(k); 475 return NULL; 476 } 477 k->rsa = rsa; 478 break; 479 case KEY_DSA: 480 case KEY_DSA_CERT: 481 if ((dsa = DSA_new()) == NULL || 482 (dsa->p = BN_new()) == NULL || 483 (dsa->q = BN_new()) == NULL || 484 (dsa->g = BN_new()) == NULL || 485 (dsa->pub_key = BN_new()) == NULL) { 486 if (dsa != NULL) 487 DSA_free(dsa); 488 free(k); 489 return NULL; 490 } 491 k->dsa = dsa; 492 break; 493 case KEY_ECDSA: 494 case KEY_ECDSA_CERT: 495 /* Cannot do anything until we know the group */ 496 break; 497 #endif /* WITH_OPENSSL */ 498 case KEY_ED25519: 499 case KEY_ED25519_CERT: 500 /* no need to prealloc */ 501 break; 502 case KEY_UNSPEC: 503 break; 504 default: 505 free(k); 506 return NULL; 507 } 508 509 if (sshkey_is_cert(k)) { 510 if ((k->cert = cert_new()) == NULL) { 511 sshkey_free(k); 512 return NULL; 513 } 514 } 515 516 return k; 517 } 518 519 int 520 sshkey_add_private(struct sshkey *k) 521 { 522 switch (k->type) { 523 #ifdef WITH_OPENSSL 524 case KEY_RSA: 525 case KEY_RSA_CERT: 526 #define bn_maybe_alloc_failed(p) (p == NULL && (p = BN_new()) == NULL) 527 if (bn_maybe_alloc_failed(k->rsa->d) || 528 bn_maybe_alloc_failed(k->rsa->iqmp) || 529 bn_maybe_alloc_failed(k->rsa->q) || 530 bn_maybe_alloc_failed(k->rsa->p) || 531 bn_maybe_alloc_failed(k->rsa->dmq1) || 532 bn_maybe_alloc_failed(k->rsa->dmp1)) 533 return SSH_ERR_ALLOC_FAIL; 534 break; 535 case KEY_DSA: 536 case KEY_DSA_CERT: 537 if (bn_maybe_alloc_failed(k->dsa->priv_key)) 538 return SSH_ERR_ALLOC_FAIL; 539 break; 540 #undef bn_maybe_alloc_failed 541 case KEY_ECDSA: 542 case KEY_ECDSA_CERT: 543 /* Cannot do anything until we know the group */ 544 break; 545 #endif /* WITH_OPENSSL */ 546 case KEY_ED25519: 547 case KEY_ED25519_CERT: 548 /* no need to prealloc */ 549 break; 550 case KEY_UNSPEC: 551 break; 552 default: 553 return SSH_ERR_INVALID_ARGUMENT; 554 } 555 return 0; 556 } 557 558 struct sshkey * 559 sshkey_new_private(int type) 560 { 561 struct sshkey *k = sshkey_new(type); 562 563 if (k == NULL) 564 return NULL; 565 if (sshkey_add_private(k) != 0) { 566 sshkey_free(k); 567 return NULL; 568 } 569 return k; 570 } 571 572 void 573 sshkey_free(struct sshkey *k) 574 { 575 if (k == NULL) 576 return; 577 switch (k->type) { 578 #ifdef WITH_OPENSSL 579 case KEY_RSA: 580 case KEY_RSA_CERT: 581 if (k->rsa != NULL) 582 RSA_free(k->rsa); 583 k->rsa = NULL; 584 break; 585 case KEY_DSA: 586 case KEY_DSA_CERT: 587 if (k->dsa != NULL) 588 DSA_free(k->dsa); 589 k->dsa = NULL; 590 break; 591 # ifdef OPENSSL_HAS_ECC 592 case KEY_ECDSA: 593 case KEY_ECDSA_CERT: 594 if (k->ecdsa != NULL) 595 EC_KEY_free(k->ecdsa); 596 k->ecdsa = NULL; 597 break; 598 # endif /* OPENSSL_HAS_ECC */ 599 #endif /* WITH_OPENSSL */ 600 case KEY_ED25519: 601 case KEY_ED25519_CERT: 602 if (k->ed25519_pk) { 603 explicit_bzero(k->ed25519_pk, ED25519_PK_SZ); 604 free(k->ed25519_pk); 605 k->ed25519_pk = NULL; 606 } 607 if (k->ed25519_sk) { 608 explicit_bzero(k->ed25519_sk, ED25519_SK_SZ); 609 free(k->ed25519_sk); 610 k->ed25519_sk = NULL; 611 } 612 break; 613 case KEY_UNSPEC: 614 break; 615 default: 616 break; 617 } 618 if (sshkey_is_cert(k)) 619 cert_free(k->cert); 620 explicit_bzero(k, sizeof(*k)); 621 free(k); 622 } 623 624 static int 625 cert_compare(struct sshkey_cert *a, struct sshkey_cert *b) 626 { 627 if (a == NULL && b == NULL) 628 return 1; 629 if (a == NULL || b == NULL) 630 return 0; 631 if (sshbuf_len(a->certblob) != sshbuf_len(b->certblob)) 632 return 0; 633 if (timingsafe_bcmp(sshbuf_ptr(a->certblob), sshbuf_ptr(b->certblob), 634 sshbuf_len(a->certblob)) != 0) 635 return 0; 636 return 1; 637 } 638 639 /* 640 * Compare public portions of key only, allowing comparisons between 641 * certificates and plain keys too. 642 */ 643 int 644 sshkey_equal_public(const struct sshkey *a, const struct sshkey *b) 645 { 646 #if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) 647 BN_CTX *bnctx; 648 #endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */ 649 650 if (a == NULL || b == NULL || 651 sshkey_type_plain(a->type) != sshkey_type_plain(b->type)) 652 return 0; 653 654 switch (a->type) { 655 #ifdef WITH_OPENSSL 656 case KEY_RSA_CERT: 657 case KEY_RSA: 658 return a->rsa != NULL && b->rsa != NULL && 659 BN_cmp(a->rsa->e, b->rsa->e) == 0 && 660 BN_cmp(a->rsa->n, b->rsa->n) == 0; 661 case KEY_DSA_CERT: 662 case KEY_DSA: 663 return a->dsa != NULL && b->dsa != NULL && 664 BN_cmp(a->dsa->p, b->dsa->p) == 0 && 665 BN_cmp(a->dsa->q, b->dsa->q) == 0 && 666 BN_cmp(a->dsa->g, b->dsa->g) == 0 && 667 BN_cmp(a->dsa->pub_key, b->dsa->pub_key) == 0; 668 # ifdef OPENSSL_HAS_ECC 669 case KEY_ECDSA_CERT: 670 case KEY_ECDSA: 671 if (a->ecdsa == NULL || b->ecdsa == NULL || 672 EC_KEY_get0_public_key(a->ecdsa) == NULL || 673 EC_KEY_get0_public_key(b->ecdsa) == NULL) 674 return 0; 675 if ((bnctx = BN_CTX_new()) == NULL) 676 return 0; 677 if (EC_GROUP_cmp(EC_KEY_get0_group(a->ecdsa), 678 EC_KEY_get0_group(b->ecdsa), bnctx) != 0 || 679 EC_POINT_cmp(EC_KEY_get0_group(a->ecdsa), 680 EC_KEY_get0_public_key(a->ecdsa), 681 EC_KEY_get0_public_key(b->ecdsa), bnctx) != 0) { 682 BN_CTX_free(bnctx); 683 return 0; 684 } 685 BN_CTX_free(bnctx); 686 return 1; 687 # endif /* OPENSSL_HAS_ECC */ 688 #endif /* WITH_OPENSSL */ 689 case KEY_ED25519: 690 case KEY_ED25519_CERT: 691 return a->ed25519_pk != NULL && b->ed25519_pk != NULL && 692 memcmp(a->ed25519_pk, b->ed25519_pk, ED25519_PK_SZ) == 0; 693 default: 694 return 0; 695 } 696 /* NOTREACHED */ 697 } 698 699 int 700 sshkey_equal(const struct sshkey *a, const struct sshkey *b) 701 { 702 if (a == NULL || b == NULL || a->type != b->type) 703 return 0; 704 if (sshkey_is_cert(a)) { 705 if (!cert_compare(a->cert, b->cert)) 706 return 0; 707 } 708 return sshkey_equal_public(a, b); 709 } 710 711 static int 712 to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain) 713 { 714 int type, ret = SSH_ERR_INTERNAL_ERROR; 715 const char *typename; 716 717 if (key == NULL) 718 return SSH_ERR_INVALID_ARGUMENT; 719 720 if (sshkey_is_cert(key)) { 721 if (key->cert == NULL) 722 return SSH_ERR_EXPECTED_CERT; 723 if (sshbuf_len(key->cert->certblob) == 0) 724 return SSH_ERR_KEY_LACKS_CERTBLOB; 725 } 726 type = force_plain ? sshkey_type_plain(key->type) : key->type; 727 typename = sshkey_ssh_name_from_type_nid(type, key->ecdsa_nid); 728 729 switch (type) { 730 #ifdef WITH_OPENSSL 731 case KEY_DSA_CERT: 732 case KEY_ECDSA_CERT: 733 case KEY_RSA_CERT: 734 #endif /* WITH_OPENSSL */ 735 case KEY_ED25519_CERT: 736 /* Use the existing blob */ 737 /* XXX modified flag? */ 738 if ((ret = sshbuf_putb(b, key->cert->certblob)) != 0) 739 return ret; 740 break; 741 #ifdef WITH_OPENSSL 742 case KEY_DSA: 743 if (key->dsa == NULL) 744 return SSH_ERR_INVALID_ARGUMENT; 745 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 746 (ret = sshbuf_put_bignum2(b, key->dsa->p)) != 0 || 747 (ret = sshbuf_put_bignum2(b, key->dsa->q)) != 0 || 748 (ret = sshbuf_put_bignum2(b, key->dsa->g)) != 0 || 749 (ret = sshbuf_put_bignum2(b, key->dsa->pub_key)) != 0) 750 return ret; 751 break; 752 # ifdef OPENSSL_HAS_ECC 753 case KEY_ECDSA: 754 if (key->ecdsa == NULL) 755 return SSH_ERR_INVALID_ARGUMENT; 756 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 757 (ret = sshbuf_put_cstring(b, 758 sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || 759 (ret = sshbuf_put_eckey(b, key->ecdsa)) != 0) 760 return ret; 761 break; 762 # endif 763 case KEY_RSA: 764 if (key->rsa == NULL) 765 return SSH_ERR_INVALID_ARGUMENT; 766 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 767 (ret = sshbuf_put_bignum2(b, key->rsa->e)) != 0 || 768 (ret = sshbuf_put_bignum2(b, key->rsa->n)) != 0) 769 return ret; 770 break; 771 #endif /* WITH_OPENSSL */ 772 case KEY_ED25519: 773 if (key->ed25519_pk == NULL) 774 return SSH_ERR_INVALID_ARGUMENT; 775 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 776 (ret = sshbuf_put_string(b, 777 key->ed25519_pk, ED25519_PK_SZ)) != 0) 778 return ret; 779 break; 780 default: 781 return SSH_ERR_KEY_TYPE_UNKNOWN; 782 } 783 return 0; 784 } 785 786 int 787 sshkey_putb(const struct sshkey *key, struct sshbuf *b) 788 { 789 return to_blob_buf(key, b, 0); 790 } 791 792 int 793 sshkey_puts(const struct sshkey *key, struct sshbuf *b) 794 { 795 struct sshbuf *tmp; 796 int r; 797 798 if ((tmp = sshbuf_new()) == NULL) 799 return SSH_ERR_ALLOC_FAIL; 800 r = to_blob_buf(key, tmp, 0); 801 if (r == 0) 802 r = sshbuf_put_stringb(b, tmp); 803 sshbuf_free(tmp); 804 return r; 805 } 806 807 int 808 sshkey_putb_plain(const struct sshkey *key, struct sshbuf *b) 809 { 810 return to_blob_buf(key, b, 1); 811 } 812 813 static int 814 to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp, int force_plain) 815 { 816 int ret = SSH_ERR_INTERNAL_ERROR; 817 size_t len; 818 struct sshbuf *b = NULL; 819 820 if (lenp != NULL) 821 *lenp = 0; 822 if (blobp != NULL) 823 *blobp = NULL; 824 if ((b = sshbuf_new()) == NULL) 825 return SSH_ERR_ALLOC_FAIL; 826 if ((ret = to_blob_buf(key, b, force_plain)) != 0) 827 goto out; 828 len = sshbuf_len(b); 829 if (lenp != NULL) 830 *lenp = len; 831 if (blobp != NULL) { 832 if ((*blobp = malloc(len)) == NULL) { 833 ret = SSH_ERR_ALLOC_FAIL; 834 goto out; 835 } 836 memcpy(*blobp, sshbuf_ptr(b), len); 837 } 838 ret = 0; 839 out: 840 sshbuf_free(b); 841 return ret; 842 } 843 844 int 845 sshkey_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp) 846 { 847 return to_blob(key, blobp, lenp, 0); 848 } 849 850 int 851 sshkey_plain_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp) 852 { 853 return to_blob(key, blobp, lenp, 1); 854 } 855 856 int 857 sshkey_fingerprint_raw(const struct sshkey *k, int dgst_alg, 858 u_char **retp, size_t *lenp) 859 { 860 u_char *blob = NULL, *ret = NULL; 861 size_t blob_len = 0; 862 int r = SSH_ERR_INTERNAL_ERROR; 863 864 if (retp != NULL) 865 *retp = NULL; 866 if (lenp != NULL) 867 *lenp = 0; 868 if (ssh_digest_bytes(dgst_alg) == 0) { 869 r = SSH_ERR_INVALID_ARGUMENT; 870 goto out; 871 } 872 if ((r = to_blob(k, &blob, &blob_len, 1)) != 0) 873 goto out; 874 if ((ret = calloc(1, SSH_DIGEST_MAX_LENGTH)) == NULL) { 875 r = SSH_ERR_ALLOC_FAIL; 876 goto out; 877 } 878 if ((r = ssh_digest_memory(dgst_alg, blob, blob_len, 879 ret, SSH_DIGEST_MAX_LENGTH)) != 0) 880 goto out; 881 /* success */ 882 if (retp != NULL) { 883 *retp = ret; 884 ret = NULL; 885 } 886 if (lenp != NULL) 887 *lenp = ssh_digest_bytes(dgst_alg); 888 r = 0; 889 out: 890 free(ret); 891 if (blob != NULL) { 892 explicit_bzero(blob, blob_len); 893 free(blob); 894 } 895 return r; 896 } 897 898 static char * 899 fingerprint_b64(const char *alg, u_char *dgst_raw, size_t dgst_raw_len) 900 { 901 char *ret; 902 size_t plen = strlen(alg) + 1; 903 size_t rlen = ((dgst_raw_len + 2) / 3) * 4 + plen + 1; 904 int r; 905 906 if (dgst_raw_len > 65536 || (ret = calloc(1, rlen)) == NULL) 907 return NULL; 908 strlcpy(ret, alg, rlen); 909 strlcat(ret, ":", rlen); 910 if (dgst_raw_len == 0) 911 return ret; 912 if ((r = b64_ntop(dgst_raw, dgst_raw_len, 913 ret + plen, rlen - plen)) == -1) { 914 explicit_bzero(ret, rlen); 915 free(ret); 916 return NULL; 917 } 918 /* Trim padding characters from end */ 919 ret[strcspn(ret, "=")] = '\0'; 920 return ret; 921 } 922 923 static char * 924 fingerprint_hex(const char *alg, u_char *dgst_raw, size_t dgst_raw_len) 925 { 926 char *retval, hex[5]; 927 size_t i, rlen = dgst_raw_len * 3 + strlen(alg) + 2; 928 929 if (dgst_raw_len > 65536 || (retval = calloc(1, rlen)) == NULL) 930 return NULL; 931 strlcpy(retval, alg, rlen); 932 strlcat(retval, ":", rlen); 933 for (i = 0; i < dgst_raw_len; i++) { 934 snprintf(hex, sizeof(hex), "%s%02x", 935 i > 0 ? ":" : "", dgst_raw[i]); 936 strlcat(retval, hex, rlen); 937 } 938 return retval; 939 } 940 941 static char * 942 fingerprint_bubblebabble(u_char *dgst_raw, size_t dgst_raw_len) 943 { 944 char vowels[] = { 'a', 'e', 'i', 'o', 'u', 'y' }; 945 char consonants[] = { 'b', 'c', 'd', 'f', 'g', 'h', 'k', 'l', 'm', 946 'n', 'p', 'r', 's', 't', 'v', 'z', 'x' }; 947 u_int i, j = 0, rounds, seed = 1; 948 char *retval; 949 950 rounds = (dgst_raw_len / 2) + 1; 951 if ((retval = calloc(rounds, 6)) == NULL) 952 return NULL; 953 retval[j++] = 'x'; 954 for (i = 0; i < rounds; i++) { 955 u_int idx0, idx1, idx2, idx3, idx4; 956 if ((i + 1 < rounds) || (dgst_raw_len % 2 != 0)) { 957 idx0 = (((((u_int)(dgst_raw[2 * i])) >> 6) & 3) + 958 seed) % 6; 959 idx1 = (((u_int)(dgst_raw[2 * i])) >> 2) & 15; 960 idx2 = ((((u_int)(dgst_raw[2 * i])) & 3) + 961 (seed / 6)) % 6; 962 retval[j++] = vowels[idx0]; 963 retval[j++] = consonants[idx1]; 964 retval[j++] = vowels[idx2]; 965 if ((i + 1) < rounds) { 966 idx3 = (((u_int)(dgst_raw[(2 * i) + 1])) >> 4) & 15; 967 idx4 = (((u_int)(dgst_raw[(2 * i) + 1]))) & 15; 968 retval[j++] = consonants[idx3]; 969 retval[j++] = '-'; 970 retval[j++] = consonants[idx4]; 971 seed = ((seed * 5) + 972 ((((u_int)(dgst_raw[2 * i])) * 7) + 973 ((u_int)(dgst_raw[(2 * i) + 1])))) % 36; 974 } 975 } else { 976 idx0 = seed % 6; 977 idx1 = 16; 978 idx2 = seed / 6; 979 retval[j++] = vowels[idx0]; 980 retval[j++] = consonants[idx1]; 981 retval[j++] = vowels[idx2]; 982 } 983 } 984 retval[j++] = 'x'; 985 retval[j++] = '\0'; 986 return retval; 987 } 988 989 /* 990 * Draw an ASCII-Art representing the fingerprint so human brain can 991 * profit from its built-in pattern recognition ability. 992 * This technique is called "random art" and can be found in some 993 * scientific publications like this original paper: 994 * 995 * "Hash Visualization: a New Technique to improve Real-World Security", 996 * Perrig A. and Song D., 1999, International Workshop on Cryptographic 997 * Techniques and E-Commerce (CrypTEC '99) 998 * sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf 999 * 1000 * The subject came up in a talk by Dan Kaminsky, too. 1001 * 1002 * If you see the picture is different, the key is different. 1003 * If the picture looks the same, you still know nothing. 1004 * 1005 * The algorithm used here is a worm crawling over a discrete plane, 1006 * leaving a trace (augmenting the field) everywhere it goes. 1007 * Movement is taken from dgst_raw 2bit-wise. Bumping into walls 1008 * makes the respective movement vector be ignored for this turn. 1009 * Graphs are not unambiguous, because circles in graphs can be 1010 * walked in either direction. 1011 */ 1012 1013 /* 1014 * Field sizes for the random art. Have to be odd, so the starting point 1015 * can be in the exact middle of the picture, and FLDBASE should be >=8 . 1016 * Else pictures would be too dense, and drawing the frame would 1017 * fail, too, because the key type would not fit in anymore. 1018 */ 1019 #define FLDBASE 8 1020 #define FLDSIZE_Y (FLDBASE + 1) 1021 #define FLDSIZE_X (FLDBASE * 2 + 1) 1022 static char * 1023 fingerprint_randomart(const char *alg, u_char *dgst_raw, size_t dgst_raw_len, 1024 const struct sshkey *k) 1025 { 1026 /* 1027 * Chars to be used after each other every time the worm 1028 * intersects with itself. Matter of taste. 1029 */ 1030 char *augmentation_string = " .o+=*BOX@%&#/^SE"; 1031 char *retval, *p, title[FLDSIZE_X], hash[FLDSIZE_X]; 1032 u_char field[FLDSIZE_X][FLDSIZE_Y]; 1033 size_t i, tlen, hlen; 1034 u_int b; 1035 int x, y, r; 1036 size_t len = strlen(augmentation_string) - 1; 1037 1038 if ((retval = calloc((FLDSIZE_X + 3), (FLDSIZE_Y + 2))) == NULL) 1039 return NULL; 1040 1041 /* initialize field */ 1042 memset(field, 0, FLDSIZE_X * FLDSIZE_Y * sizeof(char)); 1043 x = FLDSIZE_X / 2; 1044 y = FLDSIZE_Y / 2; 1045 1046 /* process raw key */ 1047 for (i = 0; i < dgst_raw_len; i++) { 1048 int input; 1049 /* each byte conveys four 2-bit move commands */ 1050 input = dgst_raw[i]; 1051 for (b = 0; b < 4; b++) { 1052 /* evaluate 2 bit, rest is shifted later */ 1053 x += (input & 0x1) ? 1 : -1; 1054 y += (input & 0x2) ? 1 : -1; 1055 1056 /* assure we are still in bounds */ 1057 x = MAXIMUM(x, 0); 1058 y = MAXIMUM(y, 0); 1059 x = MINIMUM(x, FLDSIZE_X - 1); 1060 y = MINIMUM(y, FLDSIZE_Y - 1); 1061 1062 /* augment the field */ 1063 if (field[x][y] < len - 2) 1064 field[x][y]++; 1065 input = input >> 2; 1066 } 1067 } 1068 1069 /* mark starting point and end point*/ 1070 field[FLDSIZE_X / 2][FLDSIZE_Y / 2] = len - 1; 1071 field[x][y] = len; 1072 1073 /* assemble title */ 1074 r = snprintf(title, sizeof(title), "[%s %u]", 1075 sshkey_type(k), sshkey_size(k)); 1076 /* If [type size] won't fit, then try [type]; fits "[ED25519-CERT]" */ 1077 if (r < 0 || r > (int)sizeof(title)) 1078 r = snprintf(title, sizeof(title), "[%s]", sshkey_type(k)); 1079 tlen = (r <= 0) ? 0 : strlen(title); 1080 1081 /* assemble hash ID. */ 1082 r = snprintf(hash, sizeof(hash), "[%s]", alg); 1083 hlen = (r <= 0) ? 0 : strlen(hash); 1084 1085 /* output upper border */ 1086 p = retval; 1087 *p++ = '+'; 1088 for (i = 0; i < (FLDSIZE_X - tlen) / 2; i++) 1089 *p++ = '-'; 1090 memcpy(p, title, tlen); 1091 p += tlen; 1092 for (i += tlen; i < FLDSIZE_X; i++) 1093 *p++ = '-'; 1094 *p++ = '+'; 1095 *p++ = '\n'; 1096 1097 /* output content */ 1098 for (y = 0; y < FLDSIZE_Y; y++) { 1099 *p++ = '|'; 1100 for (x = 0; x < FLDSIZE_X; x++) 1101 *p++ = augmentation_string[MINIMUM(field[x][y], len)]; 1102 *p++ = '|'; 1103 *p++ = '\n'; 1104 } 1105 1106 /* output lower border */ 1107 *p++ = '+'; 1108 for (i = 0; i < (FLDSIZE_X - hlen) / 2; i++) 1109 *p++ = '-'; 1110 memcpy(p, hash, hlen); 1111 p += hlen; 1112 for (i += hlen; i < FLDSIZE_X; i++) 1113 *p++ = '-'; 1114 *p++ = '+'; 1115 1116 return retval; 1117 } 1118 1119 char * 1120 sshkey_fingerprint(const struct sshkey *k, int dgst_alg, 1121 enum sshkey_fp_rep dgst_rep) 1122 { 1123 char *retval = NULL; 1124 u_char *dgst_raw; 1125 size_t dgst_raw_len; 1126 1127 if (sshkey_fingerprint_raw(k, dgst_alg, &dgst_raw, &dgst_raw_len) != 0) 1128 return NULL; 1129 switch (dgst_rep) { 1130 case SSH_FP_DEFAULT: 1131 if (dgst_alg == SSH_DIGEST_MD5) { 1132 retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg), 1133 dgst_raw, dgst_raw_len); 1134 } else { 1135 retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg), 1136 dgst_raw, dgst_raw_len); 1137 } 1138 break; 1139 case SSH_FP_HEX: 1140 retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg), 1141 dgst_raw, dgst_raw_len); 1142 break; 1143 case SSH_FP_BASE64: 1144 retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg), 1145 dgst_raw, dgst_raw_len); 1146 break; 1147 case SSH_FP_BUBBLEBABBLE: 1148 retval = fingerprint_bubblebabble(dgst_raw, dgst_raw_len); 1149 break; 1150 case SSH_FP_RANDOMART: 1151 retval = fingerprint_randomart(ssh_digest_alg_name(dgst_alg), 1152 dgst_raw, dgst_raw_len, k); 1153 break; 1154 default: 1155 explicit_bzero(dgst_raw, dgst_raw_len); 1156 free(dgst_raw); 1157 return NULL; 1158 } 1159 explicit_bzero(dgst_raw, dgst_raw_len); 1160 free(dgst_raw); 1161 return retval; 1162 } 1163 1164 1165 /* returns 0 ok, and < 0 error */ 1166 int 1167 sshkey_read(struct sshkey *ret, char **cpp) 1168 { 1169 struct sshkey *k; 1170 int retval = SSH_ERR_INVALID_FORMAT; 1171 char *ep, *cp, *space; 1172 int r, type, curve_nid = -1; 1173 struct sshbuf *blob; 1174 1175 if (ret == NULL) 1176 return SSH_ERR_INVALID_ARGUMENT; 1177 1178 cp = *cpp; 1179 1180 switch (ret->type) { 1181 case KEY_UNSPEC: 1182 case KEY_RSA: 1183 case KEY_DSA: 1184 case KEY_ECDSA: 1185 case KEY_ED25519: 1186 case KEY_DSA_CERT: 1187 case KEY_ECDSA_CERT: 1188 case KEY_RSA_CERT: 1189 case KEY_ED25519_CERT: 1190 space = strchr(cp, ' '); 1191 if (space == NULL) 1192 return SSH_ERR_INVALID_FORMAT; 1193 *space = '\0'; 1194 type = sshkey_type_from_name(cp); 1195 if (sshkey_type_plain(type) == KEY_ECDSA && 1196 (curve_nid = sshkey_ecdsa_nid_from_name(cp)) == -1) 1197 return SSH_ERR_EC_CURVE_INVALID; 1198 *space = ' '; 1199 if (type == KEY_UNSPEC) 1200 return SSH_ERR_INVALID_FORMAT; 1201 cp = space+1; 1202 if (*cp == '\0') 1203 return SSH_ERR_INVALID_FORMAT; 1204 if (ret->type != KEY_UNSPEC && ret->type != type) 1205 return SSH_ERR_KEY_TYPE_MISMATCH; 1206 if ((blob = sshbuf_new()) == NULL) 1207 return SSH_ERR_ALLOC_FAIL; 1208 /* trim comment */ 1209 space = strchr(cp, ' '); 1210 if (space) { 1211 /* advance 'space': skip whitespace */ 1212 *space++ = '\0'; 1213 while (*space == ' ' || *space == '\t') 1214 space++; 1215 ep = space; 1216 } else 1217 ep = cp + strlen(cp); 1218 if ((r = sshbuf_b64tod(blob, cp)) != 0) { 1219 sshbuf_free(blob); 1220 return r; 1221 } 1222 if ((r = sshkey_from_blob(sshbuf_ptr(blob), 1223 sshbuf_len(blob), &k)) != 0) { 1224 sshbuf_free(blob); 1225 return r; 1226 } 1227 sshbuf_free(blob); 1228 if (k->type != type) { 1229 sshkey_free(k); 1230 return SSH_ERR_KEY_TYPE_MISMATCH; 1231 } 1232 if (sshkey_type_plain(type) == KEY_ECDSA && 1233 curve_nid != k->ecdsa_nid) { 1234 sshkey_free(k); 1235 return SSH_ERR_EC_CURVE_MISMATCH; 1236 } 1237 ret->type = type; 1238 if (sshkey_is_cert(ret)) { 1239 if (!sshkey_is_cert(k)) { 1240 sshkey_free(k); 1241 return SSH_ERR_EXPECTED_CERT; 1242 } 1243 if (ret->cert != NULL) 1244 cert_free(ret->cert); 1245 ret->cert = k->cert; 1246 k->cert = NULL; 1247 } 1248 switch (sshkey_type_plain(ret->type)) { 1249 #ifdef WITH_OPENSSL 1250 case KEY_RSA: 1251 if (ret->rsa != NULL) 1252 RSA_free(ret->rsa); 1253 ret->rsa = k->rsa; 1254 k->rsa = NULL; 1255 #ifdef DEBUG_PK 1256 RSA_print_fp(stderr, ret->rsa, 8); 1257 #endif 1258 break; 1259 case KEY_DSA: 1260 if (ret->dsa != NULL) 1261 DSA_free(ret->dsa); 1262 ret->dsa = k->dsa; 1263 k->dsa = NULL; 1264 #ifdef DEBUG_PK 1265 DSA_print_fp(stderr, ret->dsa, 8); 1266 #endif 1267 break; 1268 # ifdef OPENSSL_HAS_ECC 1269 case KEY_ECDSA: 1270 if (ret->ecdsa != NULL) 1271 EC_KEY_free(ret->ecdsa); 1272 ret->ecdsa = k->ecdsa; 1273 ret->ecdsa_nid = k->ecdsa_nid; 1274 k->ecdsa = NULL; 1275 k->ecdsa_nid = -1; 1276 #ifdef DEBUG_PK 1277 sshkey_dump_ec_key(ret->ecdsa); 1278 #endif 1279 break; 1280 # endif /* OPENSSL_HAS_ECC */ 1281 #endif /* WITH_OPENSSL */ 1282 case KEY_ED25519: 1283 free(ret->ed25519_pk); 1284 ret->ed25519_pk = k->ed25519_pk; 1285 k->ed25519_pk = NULL; 1286 #ifdef DEBUG_PK 1287 /* XXX */ 1288 #endif 1289 break; 1290 } 1291 *cpp = ep; 1292 retval = 0; 1293 /*XXXX*/ 1294 sshkey_free(k); 1295 if (retval != 0) 1296 break; 1297 break; 1298 default: 1299 return SSH_ERR_INVALID_ARGUMENT; 1300 } 1301 return retval; 1302 } 1303 1304 int 1305 sshkey_to_base64(const struct sshkey *key, char **b64p) 1306 { 1307 int r = SSH_ERR_INTERNAL_ERROR; 1308 struct sshbuf *b = NULL; 1309 char *uu = NULL; 1310 1311 if (b64p != NULL) 1312 *b64p = NULL; 1313 if ((b = sshbuf_new()) == NULL) 1314 return SSH_ERR_ALLOC_FAIL; 1315 if ((r = sshkey_putb(key, b)) != 0) 1316 goto out; 1317 if ((uu = sshbuf_dtob64(b)) == NULL) { 1318 r = SSH_ERR_ALLOC_FAIL; 1319 goto out; 1320 } 1321 /* Success */ 1322 if (b64p != NULL) { 1323 *b64p = uu; 1324 uu = NULL; 1325 } 1326 r = 0; 1327 out: 1328 sshbuf_free(b); 1329 free(uu); 1330 return r; 1331 } 1332 1333 int 1334 sshkey_format_text(const struct sshkey *key, struct sshbuf *b) 1335 { 1336 int r = SSH_ERR_INTERNAL_ERROR; 1337 char *uu = NULL; 1338 1339 if ((r = sshkey_to_base64(key, &uu)) != 0) 1340 goto out; 1341 if ((r = sshbuf_putf(b, "%s %s", 1342 sshkey_ssh_name(key), uu)) != 0) 1343 goto out; 1344 r = 0; 1345 out: 1346 free(uu); 1347 return r; 1348 } 1349 1350 int 1351 sshkey_write(const struct sshkey *key, FILE *f) 1352 { 1353 struct sshbuf *b = NULL; 1354 int r = SSH_ERR_INTERNAL_ERROR; 1355 1356 if ((b = sshbuf_new()) == NULL) 1357 return SSH_ERR_ALLOC_FAIL; 1358 if ((r = sshkey_format_text(key, b)) != 0) 1359 goto out; 1360 if (fwrite(sshbuf_ptr(b), sshbuf_len(b), 1, f) != 1) { 1361 if (feof(f)) 1362 errno = EPIPE; 1363 r = SSH_ERR_SYSTEM_ERROR; 1364 goto out; 1365 } 1366 /* Success */ 1367 r = 0; 1368 out: 1369 sshbuf_free(b); 1370 return r; 1371 } 1372 1373 const char * 1374 sshkey_cert_type(const struct sshkey *k) 1375 { 1376 switch (k->cert->type) { 1377 case SSH2_CERT_TYPE_USER: 1378 return "user"; 1379 case SSH2_CERT_TYPE_HOST: 1380 return "host"; 1381 default: 1382 return "unknown"; 1383 } 1384 } 1385 1386 #ifdef WITH_OPENSSL 1387 static int 1388 rsa_generate_private_key(u_int bits, RSA **rsap) 1389 { 1390 RSA *private = NULL; 1391 BIGNUM *f4 = NULL; 1392 int ret = SSH_ERR_INTERNAL_ERROR; 1393 1394 if (rsap == NULL) 1395 return SSH_ERR_INVALID_ARGUMENT; 1396 if (bits < SSH_RSA_MINIMUM_MODULUS_SIZE || 1397 bits > SSHBUF_MAX_BIGNUM * 8) 1398 return SSH_ERR_KEY_LENGTH; 1399 *rsap = NULL; 1400 if ((private = RSA_new()) == NULL || (f4 = BN_new()) == NULL) { 1401 ret = SSH_ERR_ALLOC_FAIL; 1402 goto out; 1403 } 1404 if (!BN_set_word(f4, RSA_F4) || 1405 !RSA_generate_key_ex(private, bits, f4, NULL)) { 1406 ret = SSH_ERR_LIBCRYPTO_ERROR; 1407 goto out; 1408 } 1409 *rsap = private; 1410 private = NULL; 1411 ret = 0; 1412 out: 1413 if (private != NULL) 1414 RSA_free(private); 1415 if (f4 != NULL) 1416 BN_free(f4); 1417 return ret; 1418 } 1419 1420 static int 1421 dsa_generate_private_key(u_int bits, DSA **dsap) 1422 { 1423 DSA *private; 1424 int ret = SSH_ERR_INTERNAL_ERROR; 1425 1426 if (dsap == NULL) 1427 return SSH_ERR_INVALID_ARGUMENT; 1428 if (bits != 1024) 1429 return SSH_ERR_KEY_LENGTH; 1430 if ((private = DSA_new()) == NULL) { 1431 ret = SSH_ERR_ALLOC_FAIL; 1432 goto out; 1433 } 1434 *dsap = NULL; 1435 if (!DSA_generate_parameters_ex(private, bits, NULL, 0, NULL, 1436 NULL, NULL) || !DSA_generate_key(private)) { 1437 ret = SSH_ERR_LIBCRYPTO_ERROR; 1438 goto out; 1439 } 1440 *dsap = private; 1441 private = NULL; 1442 ret = 0; 1443 out: 1444 if (private != NULL) 1445 DSA_free(private); 1446 return ret; 1447 } 1448 1449 # ifdef OPENSSL_HAS_ECC 1450 int 1451 sshkey_ecdsa_key_to_nid(EC_KEY *k) 1452 { 1453 EC_GROUP *eg; 1454 int nids[] = { 1455 NID_X9_62_prime256v1, 1456 NID_secp384r1, 1457 # ifdef OPENSSL_HAS_NISTP521 1458 NID_secp521r1, 1459 # endif /* OPENSSL_HAS_NISTP521 */ 1460 -1 1461 }; 1462 int nid; 1463 u_int i; 1464 BN_CTX *bnctx; 1465 const EC_GROUP *g = EC_KEY_get0_group(k); 1466 1467 /* 1468 * The group may be stored in a ASN.1 encoded private key in one of two 1469 * ways: as a "named group", which is reconstituted by ASN.1 object ID 1470 * or explicit group parameters encoded into the key blob. Only the 1471 * "named group" case sets the group NID for us, but we can figure 1472 * it out for the other case by comparing against all the groups that 1473 * are supported. 1474 */ 1475 if ((nid = EC_GROUP_get_curve_name(g)) > 0) 1476 return nid; 1477 if ((bnctx = BN_CTX_new()) == NULL) 1478 return -1; 1479 for (i = 0; nids[i] != -1; i++) { 1480 if ((eg = EC_GROUP_new_by_curve_name(nids[i])) == NULL) { 1481 BN_CTX_free(bnctx); 1482 return -1; 1483 } 1484 if (EC_GROUP_cmp(g, eg, bnctx) == 0) 1485 break; 1486 EC_GROUP_free(eg); 1487 } 1488 BN_CTX_free(bnctx); 1489 if (nids[i] != -1) { 1490 /* Use the group with the NID attached */ 1491 EC_GROUP_set_asn1_flag(eg, OPENSSL_EC_NAMED_CURVE); 1492 if (EC_KEY_set_group(k, eg) != 1) { 1493 EC_GROUP_free(eg); 1494 return -1; 1495 } 1496 } 1497 return nids[i]; 1498 } 1499 1500 static int 1501 ecdsa_generate_private_key(u_int bits, int *nid, EC_KEY **ecdsap) 1502 { 1503 EC_KEY *private; 1504 int ret = SSH_ERR_INTERNAL_ERROR; 1505 1506 if (nid == NULL || ecdsap == NULL) 1507 return SSH_ERR_INVALID_ARGUMENT; 1508 if ((*nid = sshkey_ecdsa_bits_to_nid(bits)) == -1) 1509 return SSH_ERR_KEY_LENGTH; 1510 *ecdsap = NULL; 1511 if ((private = EC_KEY_new_by_curve_name(*nid)) == NULL) { 1512 ret = SSH_ERR_ALLOC_FAIL; 1513 goto out; 1514 } 1515 if (EC_KEY_generate_key(private) != 1) { 1516 ret = SSH_ERR_LIBCRYPTO_ERROR; 1517 goto out; 1518 } 1519 EC_KEY_set_asn1_flag(private, OPENSSL_EC_NAMED_CURVE); 1520 *ecdsap = private; 1521 private = NULL; 1522 ret = 0; 1523 out: 1524 if (private != NULL) 1525 EC_KEY_free(private); 1526 return ret; 1527 } 1528 # endif /* OPENSSL_HAS_ECC */ 1529 #endif /* WITH_OPENSSL */ 1530 1531 int 1532 sshkey_generate(int type, u_int bits, struct sshkey **keyp) 1533 { 1534 struct sshkey *k; 1535 int ret = SSH_ERR_INTERNAL_ERROR; 1536 1537 if (keyp == NULL) 1538 return SSH_ERR_INVALID_ARGUMENT; 1539 *keyp = NULL; 1540 if ((k = sshkey_new(KEY_UNSPEC)) == NULL) 1541 return SSH_ERR_ALLOC_FAIL; 1542 switch (type) { 1543 case KEY_ED25519: 1544 if ((k->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL || 1545 (k->ed25519_sk = malloc(ED25519_SK_SZ)) == NULL) { 1546 ret = SSH_ERR_ALLOC_FAIL; 1547 break; 1548 } 1549 crypto_sign_ed25519_keypair(k->ed25519_pk, k->ed25519_sk); 1550 ret = 0; 1551 break; 1552 #ifdef WITH_OPENSSL 1553 case KEY_DSA: 1554 ret = dsa_generate_private_key(bits, &k->dsa); 1555 break; 1556 # ifdef OPENSSL_HAS_ECC 1557 case KEY_ECDSA: 1558 ret = ecdsa_generate_private_key(bits, &k->ecdsa_nid, 1559 &k->ecdsa); 1560 break; 1561 # endif /* OPENSSL_HAS_ECC */ 1562 case KEY_RSA: 1563 ret = rsa_generate_private_key(bits, &k->rsa); 1564 break; 1565 #endif /* WITH_OPENSSL */ 1566 default: 1567 ret = SSH_ERR_INVALID_ARGUMENT; 1568 } 1569 if (ret == 0) { 1570 k->type = type; 1571 *keyp = k; 1572 } else 1573 sshkey_free(k); 1574 return ret; 1575 } 1576 1577 int 1578 sshkey_cert_copy(const struct sshkey *from_key, struct sshkey *to_key) 1579 { 1580 u_int i; 1581 const struct sshkey_cert *from; 1582 struct sshkey_cert *to; 1583 int ret = SSH_ERR_INTERNAL_ERROR; 1584 1585 if (to_key->cert != NULL) { 1586 cert_free(to_key->cert); 1587 to_key->cert = NULL; 1588 } 1589 1590 if ((from = from_key->cert) == NULL) 1591 return SSH_ERR_INVALID_ARGUMENT; 1592 1593 if ((to = to_key->cert = cert_new()) == NULL) 1594 return SSH_ERR_ALLOC_FAIL; 1595 1596 if ((ret = sshbuf_putb(to->certblob, from->certblob)) != 0 || 1597 (ret = sshbuf_putb(to->critical, from->critical)) != 0 || 1598 (ret = sshbuf_putb(to->extensions, from->extensions)) != 0) 1599 return ret; 1600 1601 to->serial = from->serial; 1602 to->type = from->type; 1603 if (from->key_id == NULL) 1604 to->key_id = NULL; 1605 else if ((to->key_id = strdup(from->key_id)) == NULL) 1606 return SSH_ERR_ALLOC_FAIL; 1607 to->valid_after = from->valid_after; 1608 to->valid_before = from->valid_before; 1609 if (from->signature_key == NULL) 1610 to->signature_key = NULL; 1611 else if ((ret = sshkey_from_private(from->signature_key, 1612 &to->signature_key)) != 0) 1613 return ret; 1614 1615 if (from->nprincipals > SSHKEY_CERT_MAX_PRINCIPALS) 1616 return SSH_ERR_INVALID_ARGUMENT; 1617 if (from->nprincipals > 0) { 1618 if ((to->principals = calloc(from->nprincipals, 1619 sizeof(*to->principals))) == NULL) 1620 return SSH_ERR_ALLOC_FAIL; 1621 for (i = 0; i < from->nprincipals; i++) { 1622 to->principals[i] = strdup(from->principals[i]); 1623 if (to->principals[i] == NULL) { 1624 to->nprincipals = i; 1625 return SSH_ERR_ALLOC_FAIL; 1626 } 1627 } 1628 } 1629 to->nprincipals = from->nprincipals; 1630 return 0; 1631 } 1632 1633 int 1634 sshkey_from_private(const struct sshkey *k, struct sshkey **pkp) 1635 { 1636 struct sshkey *n = NULL; 1637 int ret = SSH_ERR_INTERNAL_ERROR; 1638 1639 *pkp = NULL; 1640 switch (k->type) { 1641 #ifdef WITH_OPENSSL 1642 case KEY_DSA: 1643 case KEY_DSA_CERT: 1644 if ((n = sshkey_new(k->type)) == NULL) 1645 return SSH_ERR_ALLOC_FAIL; 1646 if ((BN_copy(n->dsa->p, k->dsa->p) == NULL) || 1647 (BN_copy(n->dsa->q, k->dsa->q) == NULL) || 1648 (BN_copy(n->dsa->g, k->dsa->g) == NULL) || 1649 (BN_copy(n->dsa->pub_key, k->dsa->pub_key) == NULL)) { 1650 sshkey_free(n); 1651 return SSH_ERR_ALLOC_FAIL; 1652 } 1653 break; 1654 # ifdef OPENSSL_HAS_ECC 1655 case KEY_ECDSA: 1656 case KEY_ECDSA_CERT: 1657 if ((n = sshkey_new(k->type)) == NULL) 1658 return SSH_ERR_ALLOC_FAIL; 1659 n->ecdsa_nid = k->ecdsa_nid; 1660 n->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); 1661 if (n->ecdsa == NULL) { 1662 sshkey_free(n); 1663 return SSH_ERR_ALLOC_FAIL; 1664 } 1665 if (EC_KEY_set_public_key(n->ecdsa, 1666 EC_KEY_get0_public_key(k->ecdsa)) != 1) { 1667 sshkey_free(n); 1668 return SSH_ERR_LIBCRYPTO_ERROR; 1669 } 1670 break; 1671 # endif /* OPENSSL_HAS_ECC */ 1672 case KEY_RSA: 1673 case KEY_RSA_CERT: 1674 if ((n = sshkey_new(k->type)) == NULL) 1675 return SSH_ERR_ALLOC_FAIL; 1676 if ((BN_copy(n->rsa->n, k->rsa->n) == NULL) || 1677 (BN_copy(n->rsa->e, k->rsa->e) == NULL)) { 1678 sshkey_free(n); 1679 return SSH_ERR_ALLOC_FAIL; 1680 } 1681 break; 1682 #endif /* WITH_OPENSSL */ 1683 case KEY_ED25519: 1684 case KEY_ED25519_CERT: 1685 if ((n = sshkey_new(k->type)) == NULL) 1686 return SSH_ERR_ALLOC_FAIL; 1687 if (k->ed25519_pk != NULL) { 1688 if ((n->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL) { 1689 sshkey_free(n); 1690 return SSH_ERR_ALLOC_FAIL; 1691 } 1692 memcpy(n->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ); 1693 } 1694 break; 1695 default: 1696 return SSH_ERR_KEY_TYPE_UNKNOWN; 1697 } 1698 if (sshkey_is_cert(k)) { 1699 if ((ret = sshkey_cert_copy(k, n)) != 0) { 1700 sshkey_free(n); 1701 return ret; 1702 } 1703 } 1704 *pkp = n; 1705 return 0; 1706 } 1707 1708 static int 1709 cert_parse(struct sshbuf *b, struct sshkey *key, struct sshbuf *certbuf) 1710 { 1711 struct sshbuf *principals = NULL, *crit = NULL; 1712 struct sshbuf *exts = NULL, *ca = NULL; 1713 u_char *sig = NULL; 1714 size_t signed_len = 0, slen = 0, kidlen = 0; 1715 int ret = SSH_ERR_INTERNAL_ERROR; 1716 1717 /* Copy the entire key blob for verification and later serialisation */ 1718 if ((ret = sshbuf_putb(key->cert->certblob, certbuf)) != 0) 1719 return ret; 1720 1721 /* Parse body of certificate up to signature */ 1722 if ((ret = sshbuf_get_u64(b, &key->cert->serial)) != 0 || 1723 (ret = sshbuf_get_u32(b, &key->cert->type)) != 0 || 1724 (ret = sshbuf_get_cstring(b, &key->cert->key_id, &kidlen)) != 0 || 1725 (ret = sshbuf_froms(b, &principals)) != 0 || 1726 (ret = sshbuf_get_u64(b, &key->cert->valid_after)) != 0 || 1727 (ret = sshbuf_get_u64(b, &key->cert->valid_before)) != 0 || 1728 (ret = sshbuf_froms(b, &crit)) != 0 || 1729 (ret = sshbuf_froms(b, &exts)) != 0 || 1730 (ret = sshbuf_get_string_direct(b, NULL, NULL)) != 0 || 1731 (ret = sshbuf_froms(b, &ca)) != 0) { 1732 /* XXX debug print error for ret */ 1733 ret = SSH_ERR_INVALID_FORMAT; 1734 goto out; 1735 } 1736 1737 /* Signature is left in the buffer so we can calculate this length */ 1738 signed_len = sshbuf_len(key->cert->certblob) - sshbuf_len(b); 1739 1740 if ((ret = sshbuf_get_string(b, &sig, &slen)) != 0) { 1741 ret = SSH_ERR_INVALID_FORMAT; 1742 goto out; 1743 } 1744 1745 if (key->cert->type != SSH2_CERT_TYPE_USER && 1746 key->cert->type != SSH2_CERT_TYPE_HOST) { 1747 ret = SSH_ERR_KEY_CERT_UNKNOWN_TYPE; 1748 goto out; 1749 } 1750 1751 /* Parse principals section */ 1752 while (sshbuf_len(principals) > 0) { 1753 char *principal = NULL; 1754 char **oprincipals = NULL; 1755 1756 if (key->cert->nprincipals >= SSHKEY_CERT_MAX_PRINCIPALS) { 1757 ret = SSH_ERR_INVALID_FORMAT; 1758 goto out; 1759 } 1760 if ((ret = sshbuf_get_cstring(principals, &principal, 1761 NULL)) != 0) { 1762 ret = SSH_ERR_INVALID_FORMAT; 1763 goto out; 1764 } 1765 oprincipals = key->cert->principals; 1766 key->cert->principals = recallocarray(key->cert->principals, 1767 key->cert->nprincipals, key->cert->nprincipals + 1, 1768 sizeof(*key->cert->principals)); 1769 if (key->cert->principals == NULL) { 1770 free(principal); 1771 key->cert->principals = oprincipals; 1772 ret = SSH_ERR_ALLOC_FAIL; 1773 goto out; 1774 } 1775 key->cert->principals[key->cert->nprincipals++] = principal; 1776 } 1777 1778 /* 1779 * Stash a copies of the critical options and extensions sections 1780 * for later use. 1781 */ 1782 if ((ret = sshbuf_putb(key->cert->critical, crit)) != 0 || 1783 (exts != NULL && 1784 (ret = sshbuf_putb(key->cert->extensions, exts)) != 0)) 1785 goto out; 1786 1787 /* 1788 * Validate critical options and extensions sections format. 1789 */ 1790 while (sshbuf_len(crit) != 0) { 1791 if ((ret = sshbuf_get_string_direct(crit, NULL, NULL)) != 0 || 1792 (ret = sshbuf_get_string_direct(crit, NULL, NULL)) != 0) { 1793 sshbuf_reset(key->cert->critical); 1794 ret = SSH_ERR_INVALID_FORMAT; 1795 goto out; 1796 } 1797 } 1798 while (exts != NULL && sshbuf_len(exts) != 0) { 1799 if ((ret = sshbuf_get_string_direct(exts, NULL, NULL)) != 0 || 1800 (ret = sshbuf_get_string_direct(exts, NULL, NULL)) != 0) { 1801 sshbuf_reset(key->cert->extensions); 1802 ret = SSH_ERR_INVALID_FORMAT; 1803 goto out; 1804 } 1805 } 1806 1807 /* Parse CA key and check signature */ 1808 if (sshkey_from_blob_internal(ca, &key->cert->signature_key, 0) != 0) { 1809 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 1810 goto out; 1811 } 1812 if (!sshkey_type_is_valid_ca(key->cert->signature_key->type)) { 1813 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 1814 goto out; 1815 } 1816 if ((ret = sshkey_verify(key->cert->signature_key, sig, slen, 1817 sshbuf_ptr(key->cert->certblob), signed_len, 0)) != 0) 1818 goto out; 1819 1820 /* Success */ 1821 ret = 0; 1822 out: 1823 sshbuf_free(ca); 1824 sshbuf_free(crit); 1825 sshbuf_free(exts); 1826 sshbuf_free(principals); 1827 free(sig); 1828 return ret; 1829 } 1830 1831 static int 1832 sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp, 1833 int allow_cert) 1834 { 1835 int type, ret = SSH_ERR_INTERNAL_ERROR; 1836 char *ktype = NULL, *curve = NULL; 1837 struct sshkey *key = NULL; 1838 size_t len; 1839 u_char *pk = NULL; 1840 struct sshbuf *copy; 1841 #if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) 1842 EC_POINT *q = NULL; 1843 #endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */ 1844 1845 #ifdef DEBUG_PK /* XXX */ 1846 sshbuf_dump(b, stderr); 1847 #endif 1848 if (keyp != NULL) 1849 *keyp = NULL; 1850 if ((copy = sshbuf_fromb(b)) == NULL) { 1851 ret = SSH_ERR_ALLOC_FAIL; 1852 goto out; 1853 } 1854 if (sshbuf_get_cstring(b, &ktype, NULL) != 0) { 1855 ret = SSH_ERR_INVALID_FORMAT; 1856 goto out; 1857 } 1858 1859 type = sshkey_type_from_name(ktype); 1860 if (!allow_cert && sshkey_type_is_cert(type)) { 1861 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 1862 goto out; 1863 } 1864 switch (type) { 1865 #ifdef WITH_OPENSSL 1866 case KEY_RSA_CERT: 1867 /* Skip nonce */ 1868 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 1869 ret = SSH_ERR_INVALID_FORMAT; 1870 goto out; 1871 } 1872 /* FALLTHROUGH */ 1873 case KEY_RSA: 1874 if ((key = sshkey_new(type)) == NULL) { 1875 ret = SSH_ERR_ALLOC_FAIL; 1876 goto out; 1877 } 1878 if (sshbuf_get_bignum2(b, key->rsa->e) != 0 || 1879 sshbuf_get_bignum2(b, key->rsa->n) != 0) { 1880 ret = SSH_ERR_INVALID_FORMAT; 1881 goto out; 1882 } 1883 if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) { 1884 ret = SSH_ERR_KEY_LENGTH; 1885 goto out; 1886 } 1887 #ifdef DEBUG_PK 1888 RSA_print_fp(stderr, key->rsa, 8); 1889 #endif 1890 break; 1891 case KEY_DSA_CERT: 1892 /* Skip nonce */ 1893 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 1894 ret = SSH_ERR_INVALID_FORMAT; 1895 goto out; 1896 } 1897 /* FALLTHROUGH */ 1898 case KEY_DSA: 1899 if ((key = sshkey_new(type)) == NULL) { 1900 ret = SSH_ERR_ALLOC_FAIL; 1901 goto out; 1902 } 1903 if (sshbuf_get_bignum2(b, key->dsa->p) != 0 || 1904 sshbuf_get_bignum2(b, key->dsa->q) != 0 || 1905 sshbuf_get_bignum2(b, key->dsa->g) != 0 || 1906 sshbuf_get_bignum2(b, key->dsa->pub_key) != 0) { 1907 ret = SSH_ERR_INVALID_FORMAT; 1908 goto out; 1909 } 1910 #ifdef DEBUG_PK 1911 DSA_print_fp(stderr, key->dsa, 8); 1912 #endif 1913 break; 1914 case KEY_ECDSA_CERT: 1915 /* Skip nonce */ 1916 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 1917 ret = SSH_ERR_INVALID_FORMAT; 1918 goto out; 1919 } 1920 /* FALLTHROUGH */ 1921 # ifdef OPENSSL_HAS_ECC 1922 case KEY_ECDSA: 1923 if ((key = sshkey_new(type)) == NULL) { 1924 ret = SSH_ERR_ALLOC_FAIL; 1925 goto out; 1926 } 1927 key->ecdsa_nid = sshkey_ecdsa_nid_from_name(ktype); 1928 if (sshbuf_get_cstring(b, &curve, NULL) != 0) { 1929 ret = SSH_ERR_INVALID_FORMAT; 1930 goto out; 1931 } 1932 if (key->ecdsa_nid != sshkey_curve_name_to_nid(curve)) { 1933 ret = SSH_ERR_EC_CURVE_MISMATCH; 1934 goto out; 1935 } 1936 if (key->ecdsa != NULL) 1937 EC_KEY_free(key->ecdsa); 1938 if ((key->ecdsa = EC_KEY_new_by_curve_name(key->ecdsa_nid)) 1939 == NULL) { 1940 ret = SSH_ERR_EC_CURVE_INVALID; 1941 goto out; 1942 } 1943 if ((q = EC_POINT_new(EC_KEY_get0_group(key->ecdsa))) == NULL) { 1944 ret = SSH_ERR_ALLOC_FAIL; 1945 goto out; 1946 } 1947 if (sshbuf_get_ec(b, q, EC_KEY_get0_group(key->ecdsa)) != 0) { 1948 ret = SSH_ERR_INVALID_FORMAT; 1949 goto out; 1950 } 1951 if (sshkey_ec_validate_public(EC_KEY_get0_group(key->ecdsa), 1952 q) != 0) { 1953 ret = SSH_ERR_KEY_INVALID_EC_VALUE; 1954 goto out; 1955 } 1956 if (EC_KEY_set_public_key(key->ecdsa, q) != 1) { 1957 /* XXX assume it is a allocation error */ 1958 ret = SSH_ERR_ALLOC_FAIL; 1959 goto out; 1960 } 1961 #ifdef DEBUG_PK 1962 sshkey_dump_ec_point(EC_KEY_get0_group(key->ecdsa), q); 1963 #endif 1964 break; 1965 # endif /* OPENSSL_HAS_ECC */ 1966 #endif /* WITH_OPENSSL */ 1967 case KEY_ED25519_CERT: 1968 /* Skip nonce */ 1969 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 1970 ret = SSH_ERR_INVALID_FORMAT; 1971 goto out; 1972 } 1973 /* FALLTHROUGH */ 1974 case KEY_ED25519: 1975 if ((ret = sshbuf_get_string(b, &pk, &len)) != 0) 1976 goto out; 1977 if (len != ED25519_PK_SZ) { 1978 ret = SSH_ERR_INVALID_FORMAT; 1979 goto out; 1980 } 1981 if ((key = sshkey_new(type)) == NULL) { 1982 ret = SSH_ERR_ALLOC_FAIL; 1983 goto out; 1984 } 1985 key->ed25519_pk = pk; 1986 pk = NULL; 1987 break; 1988 case KEY_UNSPEC: 1989 default: 1990 ret = SSH_ERR_KEY_TYPE_UNKNOWN; 1991 goto out; 1992 } 1993 1994 /* Parse certificate potion */ 1995 if (sshkey_is_cert(key) && (ret = cert_parse(b, key, copy)) != 0) 1996 goto out; 1997 1998 if (key != NULL && sshbuf_len(b) != 0) { 1999 ret = SSH_ERR_INVALID_FORMAT; 2000 goto out; 2001 } 2002 ret = 0; 2003 if (keyp != NULL) { 2004 *keyp = key; 2005 key = NULL; 2006 } 2007 out: 2008 sshbuf_free(copy); 2009 sshkey_free(key); 2010 free(ktype); 2011 free(curve); 2012 free(pk); 2013 #if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) 2014 if (q != NULL) 2015 EC_POINT_free(q); 2016 #endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */ 2017 return ret; 2018 } 2019 2020 int 2021 sshkey_from_blob(const u_char *blob, size_t blen, struct sshkey **keyp) 2022 { 2023 struct sshbuf *b; 2024 int r; 2025 2026 if ((b = sshbuf_from(blob, blen)) == NULL) 2027 return SSH_ERR_ALLOC_FAIL; 2028 r = sshkey_from_blob_internal(b, keyp, 1); 2029 sshbuf_free(b); 2030 return r; 2031 } 2032 2033 int 2034 sshkey_fromb(struct sshbuf *b, struct sshkey **keyp) 2035 { 2036 return sshkey_from_blob_internal(b, keyp, 1); 2037 } 2038 2039 int 2040 sshkey_froms(struct sshbuf *buf, struct sshkey **keyp) 2041 { 2042 struct sshbuf *b; 2043 int r; 2044 2045 if ((r = sshbuf_froms(buf, &b)) != 0) 2046 return r; 2047 r = sshkey_from_blob_internal(b, keyp, 1); 2048 sshbuf_free(b); 2049 return r; 2050 } 2051 2052 int 2053 sshkey_sign(const struct sshkey *key, 2054 u_char **sigp, size_t *lenp, 2055 const u_char *data, size_t datalen, const char *alg, u_int compat) 2056 { 2057 if (sigp != NULL) 2058 *sigp = NULL; 2059 if (lenp != NULL) 2060 *lenp = 0; 2061 if (datalen > SSH_KEY_MAX_SIGN_DATA_SIZE) 2062 return SSH_ERR_INVALID_ARGUMENT; 2063 switch (key->type) { 2064 #ifdef WITH_OPENSSL 2065 case KEY_DSA_CERT: 2066 case KEY_DSA: 2067 return ssh_dss_sign(key, sigp, lenp, data, datalen, compat); 2068 # ifdef OPENSSL_HAS_ECC 2069 case KEY_ECDSA_CERT: 2070 case KEY_ECDSA: 2071 return ssh_ecdsa_sign(key, sigp, lenp, data, datalen, compat); 2072 # endif /* OPENSSL_HAS_ECC */ 2073 case KEY_RSA_CERT: 2074 case KEY_RSA: 2075 return ssh_rsa_sign(key, sigp, lenp, data, datalen, alg); 2076 #endif /* WITH_OPENSSL */ 2077 case KEY_ED25519: 2078 case KEY_ED25519_CERT: 2079 return ssh_ed25519_sign(key, sigp, lenp, data, datalen, compat); 2080 default: 2081 return SSH_ERR_KEY_TYPE_UNKNOWN; 2082 } 2083 } 2084 2085 /* 2086 * ssh_key_verify returns 0 for a correct signature and < 0 on error. 2087 */ 2088 int 2089 sshkey_verify(const struct sshkey *key, 2090 const u_char *sig, size_t siglen, 2091 const u_char *data, size_t dlen, u_int compat) 2092 { 2093 if (siglen == 0 || dlen > SSH_KEY_MAX_SIGN_DATA_SIZE) 2094 return SSH_ERR_INVALID_ARGUMENT; 2095 switch (key->type) { 2096 #ifdef WITH_OPENSSL 2097 case KEY_DSA_CERT: 2098 case KEY_DSA: 2099 return ssh_dss_verify(key, sig, siglen, data, dlen, compat); 2100 # ifdef OPENSSL_HAS_ECC 2101 case KEY_ECDSA_CERT: 2102 case KEY_ECDSA: 2103 return ssh_ecdsa_verify(key, sig, siglen, data, dlen, compat); 2104 # endif /* OPENSSL_HAS_ECC */ 2105 case KEY_RSA_CERT: 2106 case KEY_RSA: 2107 return ssh_rsa_verify(key, sig, siglen, data, dlen); 2108 #endif /* WITH_OPENSSL */ 2109 case KEY_ED25519: 2110 case KEY_ED25519_CERT: 2111 return ssh_ed25519_verify(key, sig, siglen, data, dlen, compat); 2112 default: 2113 return SSH_ERR_KEY_TYPE_UNKNOWN; 2114 } 2115 } 2116 2117 /* Converts a private to a public key */ 2118 int 2119 sshkey_demote(const struct sshkey *k, struct sshkey **dkp) 2120 { 2121 struct sshkey *pk; 2122 int ret = SSH_ERR_INTERNAL_ERROR; 2123 2124 *dkp = NULL; 2125 if ((pk = calloc(1, sizeof(*pk))) == NULL) 2126 return SSH_ERR_ALLOC_FAIL; 2127 pk->type = k->type; 2128 pk->flags = k->flags; 2129 pk->ecdsa_nid = k->ecdsa_nid; 2130 pk->dsa = NULL; 2131 pk->ecdsa = NULL; 2132 pk->rsa = NULL; 2133 pk->ed25519_pk = NULL; 2134 pk->ed25519_sk = NULL; 2135 2136 switch (k->type) { 2137 #ifdef WITH_OPENSSL 2138 case KEY_RSA_CERT: 2139 if ((ret = sshkey_cert_copy(k, pk)) != 0) 2140 goto fail; 2141 /* FALLTHROUGH */ 2142 case KEY_RSA: 2143 if ((pk->rsa = RSA_new()) == NULL || 2144 (pk->rsa->e = BN_dup(k->rsa->e)) == NULL || 2145 (pk->rsa->n = BN_dup(k->rsa->n)) == NULL) { 2146 ret = SSH_ERR_ALLOC_FAIL; 2147 goto fail; 2148 } 2149 break; 2150 case KEY_DSA_CERT: 2151 if ((ret = sshkey_cert_copy(k, pk)) != 0) 2152 goto fail; 2153 /* FALLTHROUGH */ 2154 case KEY_DSA: 2155 if ((pk->dsa = DSA_new()) == NULL || 2156 (pk->dsa->p = BN_dup(k->dsa->p)) == NULL || 2157 (pk->dsa->q = BN_dup(k->dsa->q)) == NULL || 2158 (pk->dsa->g = BN_dup(k->dsa->g)) == NULL || 2159 (pk->dsa->pub_key = BN_dup(k->dsa->pub_key)) == NULL) { 2160 ret = SSH_ERR_ALLOC_FAIL; 2161 goto fail; 2162 } 2163 break; 2164 case KEY_ECDSA_CERT: 2165 if ((ret = sshkey_cert_copy(k, pk)) != 0) 2166 goto fail; 2167 /* FALLTHROUGH */ 2168 # ifdef OPENSSL_HAS_ECC 2169 case KEY_ECDSA: 2170 pk->ecdsa = EC_KEY_new_by_curve_name(pk->ecdsa_nid); 2171 if (pk->ecdsa == NULL) { 2172 ret = SSH_ERR_ALLOC_FAIL; 2173 goto fail; 2174 } 2175 if (EC_KEY_set_public_key(pk->ecdsa, 2176 EC_KEY_get0_public_key(k->ecdsa)) != 1) { 2177 ret = SSH_ERR_LIBCRYPTO_ERROR; 2178 goto fail; 2179 } 2180 break; 2181 # endif /* OPENSSL_HAS_ECC */ 2182 #endif /* WITH_OPENSSL */ 2183 case KEY_ED25519_CERT: 2184 if ((ret = sshkey_cert_copy(k, pk)) != 0) 2185 goto fail; 2186 /* FALLTHROUGH */ 2187 case KEY_ED25519: 2188 if (k->ed25519_pk != NULL) { 2189 if ((pk->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL) { 2190 ret = SSH_ERR_ALLOC_FAIL; 2191 goto fail; 2192 } 2193 memcpy(pk->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ); 2194 } 2195 break; 2196 default: 2197 ret = SSH_ERR_KEY_TYPE_UNKNOWN; 2198 fail: 2199 sshkey_free(pk); 2200 return ret; 2201 } 2202 *dkp = pk; 2203 return 0; 2204 } 2205 2206 /* Convert a plain key to their _CERT equivalent */ 2207 int 2208 sshkey_to_certified(struct sshkey *k) 2209 { 2210 int newtype; 2211 2212 switch (k->type) { 2213 #ifdef WITH_OPENSSL 2214 case KEY_RSA: 2215 newtype = KEY_RSA_CERT; 2216 break; 2217 case KEY_DSA: 2218 newtype = KEY_DSA_CERT; 2219 break; 2220 case KEY_ECDSA: 2221 newtype = KEY_ECDSA_CERT; 2222 break; 2223 #endif /* WITH_OPENSSL */ 2224 case KEY_ED25519: 2225 newtype = KEY_ED25519_CERT; 2226 break; 2227 default: 2228 return SSH_ERR_INVALID_ARGUMENT; 2229 } 2230 if ((k->cert = cert_new()) == NULL) 2231 return SSH_ERR_ALLOC_FAIL; 2232 k->type = newtype; 2233 return 0; 2234 } 2235 2236 /* Convert a certificate to its raw key equivalent */ 2237 int 2238 sshkey_drop_cert(struct sshkey *k) 2239 { 2240 if (!sshkey_type_is_cert(k->type)) 2241 return SSH_ERR_KEY_TYPE_UNKNOWN; 2242 cert_free(k->cert); 2243 k->cert = NULL; 2244 k->type = sshkey_type_plain(k->type); 2245 return 0; 2246 } 2247 2248 /* Sign a certified key, (re-)generating the signed certblob. */ 2249 int 2250 sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg, 2251 sshkey_certify_signer *signer, void *signer_ctx) 2252 { 2253 struct sshbuf *principals = NULL; 2254 u_char *ca_blob = NULL, *sig_blob = NULL, nonce[32]; 2255 size_t i, ca_len, sig_len; 2256 int ret = SSH_ERR_INTERNAL_ERROR; 2257 struct sshbuf *cert; 2258 2259 if (k == NULL || k->cert == NULL || 2260 k->cert->certblob == NULL || ca == NULL) 2261 return SSH_ERR_INVALID_ARGUMENT; 2262 if (!sshkey_is_cert(k)) 2263 return SSH_ERR_KEY_TYPE_UNKNOWN; 2264 if (!sshkey_type_is_valid_ca(ca->type)) 2265 return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2266 2267 if ((ret = sshkey_to_blob(ca, &ca_blob, &ca_len)) != 0) 2268 return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2269 2270 cert = k->cert->certblob; /* for readability */ 2271 sshbuf_reset(cert); 2272 if ((ret = sshbuf_put_cstring(cert, sshkey_ssh_name(k))) != 0) 2273 goto out; 2274 2275 /* -v01 certs put nonce first */ 2276 arc4random_buf(&nonce, sizeof(nonce)); 2277 if ((ret = sshbuf_put_string(cert, nonce, sizeof(nonce))) != 0) 2278 goto out; 2279 2280 /* XXX this substantially duplicates to_blob(); refactor */ 2281 switch (k->type) { 2282 #ifdef WITH_OPENSSL 2283 case KEY_DSA_CERT: 2284 if ((ret = sshbuf_put_bignum2(cert, k->dsa->p)) != 0 || 2285 (ret = sshbuf_put_bignum2(cert, k->dsa->q)) != 0 || 2286 (ret = sshbuf_put_bignum2(cert, k->dsa->g)) != 0 || 2287 (ret = sshbuf_put_bignum2(cert, k->dsa->pub_key)) != 0) 2288 goto out; 2289 break; 2290 # ifdef OPENSSL_HAS_ECC 2291 case KEY_ECDSA_CERT: 2292 if ((ret = sshbuf_put_cstring(cert, 2293 sshkey_curve_nid_to_name(k->ecdsa_nid))) != 0 || 2294 (ret = sshbuf_put_ec(cert, 2295 EC_KEY_get0_public_key(k->ecdsa), 2296 EC_KEY_get0_group(k->ecdsa))) != 0) 2297 goto out; 2298 break; 2299 # endif /* OPENSSL_HAS_ECC */ 2300 case KEY_RSA_CERT: 2301 if ((ret = sshbuf_put_bignum2(cert, k->rsa->e)) != 0 || 2302 (ret = sshbuf_put_bignum2(cert, k->rsa->n)) != 0) 2303 goto out; 2304 break; 2305 #endif /* WITH_OPENSSL */ 2306 case KEY_ED25519_CERT: 2307 if ((ret = sshbuf_put_string(cert, 2308 k->ed25519_pk, ED25519_PK_SZ)) != 0) 2309 goto out; 2310 break; 2311 default: 2312 ret = SSH_ERR_INVALID_ARGUMENT; 2313 goto out; 2314 } 2315 2316 if ((ret = sshbuf_put_u64(cert, k->cert->serial)) != 0 || 2317 (ret = sshbuf_put_u32(cert, k->cert->type)) != 0 || 2318 (ret = sshbuf_put_cstring(cert, k->cert->key_id)) != 0) 2319 goto out; 2320 2321 if ((principals = sshbuf_new()) == NULL) { 2322 ret = SSH_ERR_ALLOC_FAIL; 2323 goto out; 2324 } 2325 for (i = 0; i < k->cert->nprincipals; i++) { 2326 if ((ret = sshbuf_put_cstring(principals, 2327 k->cert->principals[i])) != 0) 2328 goto out; 2329 } 2330 if ((ret = sshbuf_put_stringb(cert, principals)) != 0 || 2331 (ret = sshbuf_put_u64(cert, k->cert->valid_after)) != 0 || 2332 (ret = sshbuf_put_u64(cert, k->cert->valid_before)) != 0 || 2333 (ret = sshbuf_put_stringb(cert, k->cert->critical)) != 0 || 2334 (ret = sshbuf_put_stringb(cert, k->cert->extensions)) != 0 || 2335 (ret = sshbuf_put_string(cert, NULL, 0)) != 0 || /* Reserved */ 2336 (ret = sshbuf_put_string(cert, ca_blob, ca_len)) != 0) 2337 goto out; 2338 2339 /* Sign the whole mess */ 2340 if ((ret = signer(ca, &sig_blob, &sig_len, sshbuf_ptr(cert), 2341 sshbuf_len(cert), alg, 0, signer_ctx)) != 0) 2342 goto out; 2343 2344 /* Append signature and we are done */ 2345 if ((ret = sshbuf_put_string(cert, sig_blob, sig_len)) != 0) 2346 goto out; 2347 ret = 0; 2348 out: 2349 if (ret != 0) 2350 sshbuf_reset(cert); 2351 free(sig_blob); 2352 free(ca_blob); 2353 sshbuf_free(principals); 2354 return ret; 2355 } 2356 2357 static int 2358 default_key_sign(const struct sshkey *key, u_char **sigp, size_t *lenp, 2359 const u_char *data, size_t datalen, 2360 const char *alg, u_int compat, void *ctx) 2361 { 2362 if (ctx != NULL) 2363 return SSH_ERR_INVALID_ARGUMENT; 2364 return sshkey_sign(key, sigp, lenp, data, datalen, alg, compat); 2365 } 2366 2367 int 2368 sshkey_certify(struct sshkey *k, struct sshkey *ca, const char *alg) 2369 { 2370 return sshkey_certify_custom(k, ca, alg, default_key_sign, NULL); 2371 } 2372 2373 int 2374 sshkey_cert_check_authority(const struct sshkey *k, 2375 int want_host, int require_principal, 2376 const char *name, const char **reason) 2377 { 2378 u_int i, principal_matches; 2379 time_t now = time(NULL); 2380 2381 if (reason != NULL) 2382 *reason = NULL; 2383 2384 if (want_host) { 2385 if (k->cert->type != SSH2_CERT_TYPE_HOST) { 2386 *reason = "Certificate invalid: not a host certificate"; 2387 return SSH_ERR_KEY_CERT_INVALID; 2388 } 2389 } else { 2390 if (k->cert->type != SSH2_CERT_TYPE_USER) { 2391 *reason = "Certificate invalid: not a user certificate"; 2392 return SSH_ERR_KEY_CERT_INVALID; 2393 } 2394 } 2395 if (now < 0) { 2396 /* yikes - system clock before epoch! */ 2397 *reason = "Certificate invalid: not yet valid"; 2398 return SSH_ERR_KEY_CERT_INVALID; 2399 } 2400 if ((u_int64_t)now < k->cert->valid_after) { 2401 *reason = "Certificate invalid: not yet valid"; 2402 return SSH_ERR_KEY_CERT_INVALID; 2403 } 2404 if ((u_int64_t)now >= k->cert->valid_before) { 2405 *reason = "Certificate invalid: expired"; 2406 return SSH_ERR_KEY_CERT_INVALID; 2407 } 2408 if (k->cert->nprincipals == 0) { 2409 if (require_principal) { 2410 *reason = "Certificate lacks principal list"; 2411 return SSH_ERR_KEY_CERT_INVALID; 2412 } 2413 } else if (name != NULL) { 2414 principal_matches = 0; 2415 for (i = 0; i < k->cert->nprincipals; i++) { 2416 if (strcmp(name, k->cert->principals[i]) == 0) { 2417 principal_matches = 1; 2418 break; 2419 } 2420 } 2421 if (!principal_matches) { 2422 *reason = "Certificate invalid: name is not a listed " 2423 "principal"; 2424 return SSH_ERR_KEY_CERT_INVALID; 2425 } 2426 } 2427 return 0; 2428 } 2429 2430 size_t 2431 sshkey_format_cert_validity(const struct sshkey_cert *cert, char *s, size_t l) 2432 { 2433 char from[32], to[32], ret[64]; 2434 time_t tt; 2435 struct tm *tm; 2436 2437 *from = *to = '\0'; 2438 if (cert->valid_after == 0 && 2439 cert->valid_before == 0xffffffffffffffffULL) 2440 return strlcpy(s, "forever", l); 2441 2442 if (cert->valid_after != 0) { 2443 /* XXX revisit INT_MAX in 2038 :) */ 2444 tt = cert->valid_after > INT_MAX ? 2445 INT_MAX : cert->valid_after; 2446 tm = localtime(&tt); 2447 strftime(from, sizeof(from), "%Y-%m-%dT%H:%M:%S", tm); 2448 } 2449 if (cert->valid_before != 0xffffffffffffffffULL) { 2450 /* XXX revisit INT_MAX in 2038 :) */ 2451 tt = cert->valid_before > INT_MAX ? 2452 INT_MAX : cert->valid_before; 2453 tm = localtime(&tt); 2454 strftime(to, sizeof(to), "%Y-%m-%dT%H:%M:%S", tm); 2455 } 2456 2457 if (cert->valid_after == 0) 2458 snprintf(ret, sizeof(ret), "before %s", to); 2459 else if (cert->valid_before == 0xffffffffffffffffULL) 2460 snprintf(ret, sizeof(ret), "after %s", from); 2461 else 2462 snprintf(ret, sizeof(ret), "from %s to %s", from, to); 2463 2464 return strlcpy(s, ret, l); 2465 } 2466 2467 int 2468 sshkey_private_serialize(const struct sshkey *key, struct sshbuf *b) 2469 { 2470 int r = SSH_ERR_INTERNAL_ERROR; 2471 2472 if ((r = sshbuf_put_cstring(b, sshkey_ssh_name(key))) != 0) 2473 goto out; 2474 switch (key->type) { 2475 #ifdef WITH_OPENSSL 2476 case KEY_RSA: 2477 if ((r = sshbuf_put_bignum2(b, key->rsa->n)) != 0 || 2478 (r = sshbuf_put_bignum2(b, key->rsa->e)) != 0 || 2479 (r = sshbuf_put_bignum2(b, key->rsa->d)) != 0 || 2480 (r = sshbuf_put_bignum2(b, key->rsa->iqmp)) != 0 || 2481 (r = sshbuf_put_bignum2(b, key->rsa->p)) != 0 || 2482 (r = sshbuf_put_bignum2(b, key->rsa->q)) != 0) 2483 goto out; 2484 break; 2485 case KEY_RSA_CERT: 2486 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 2487 r = SSH_ERR_INVALID_ARGUMENT; 2488 goto out; 2489 } 2490 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 2491 (r = sshbuf_put_bignum2(b, key->rsa->d)) != 0 || 2492 (r = sshbuf_put_bignum2(b, key->rsa->iqmp)) != 0 || 2493 (r = sshbuf_put_bignum2(b, key->rsa->p)) != 0 || 2494 (r = sshbuf_put_bignum2(b, key->rsa->q)) != 0) 2495 goto out; 2496 break; 2497 case KEY_DSA: 2498 if ((r = sshbuf_put_bignum2(b, key->dsa->p)) != 0 || 2499 (r = sshbuf_put_bignum2(b, key->dsa->q)) != 0 || 2500 (r = sshbuf_put_bignum2(b, key->dsa->g)) != 0 || 2501 (r = sshbuf_put_bignum2(b, key->dsa->pub_key)) != 0 || 2502 (r = sshbuf_put_bignum2(b, key->dsa->priv_key)) != 0) 2503 goto out; 2504 break; 2505 case KEY_DSA_CERT: 2506 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 2507 r = SSH_ERR_INVALID_ARGUMENT; 2508 goto out; 2509 } 2510 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 2511 (r = sshbuf_put_bignum2(b, key->dsa->priv_key)) != 0) 2512 goto out; 2513 break; 2514 # ifdef OPENSSL_HAS_ECC 2515 case KEY_ECDSA: 2516 if ((r = sshbuf_put_cstring(b, 2517 sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || 2518 (r = sshbuf_put_eckey(b, key->ecdsa)) != 0 || 2519 (r = sshbuf_put_bignum2(b, 2520 EC_KEY_get0_private_key(key->ecdsa))) != 0) 2521 goto out; 2522 break; 2523 case KEY_ECDSA_CERT: 2524 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 2525 r = SSH_ERR_INVALID_ARGUMENT; 2526 goto out; 2527 } 2528 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 2529 (r = sshbuf_put_bignum2(b, 2530 EC_KEY_get0_private_key(key->ecdsa))) != 0) 2531 goto out; 2532 break; 2533 # endif /* OPENSSL_HAS_ECC */ 2534 #endif /* WITH_OPENSSL */ 2535 case KEY_ED25519: 2536 if ((r = sshbuf_put_string(b, key->ed25519_pk, 2537 ED25519_PK_SZ)) != 0 || 2538 (r = sshbuf_put_string(b, key->ed25519_sk, 2539 ED25519_SK_SZ)) != 0) 2540 goto out; 2541 break; 2542 case KEY_ED25519_CERT: 2543 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 2544 r = SSH_ERR_INVALID_ARGUMENT; 2545 goto out; 2546 } 2547 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 2548 (r = sshbuf_put_string(b, key->ed25519_pk, 2549 ED25519_PK_SZ)) != 0 || 2550 (r = sshbuf_put_string(b, key->ed25519_sk, 2551 ED25519_SK_SZ)) != 0) 2552 goto out; 2553 break; 2554 default: 2555 r = SSH_ERR_INVALID_ARGUMENT; 2556 goto out; 2557 } 2558 /* success */ 2559 r = 0; 2560 out: 2561 return r; 2562 } 2563 2564 int 2565 sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) 2566 { 2567 char *tname = NULL, *curve = NULL; 2568 struct sshkey *k = NULL; 2569 size_t pklen = 0, sklen = 0; 2570 int type, r = SSH_ERR_INTERNAL_ERROR; 2571 u_char *ed25519_pk = NULL, *ed25519_sk = NULL; 2572 #ifdef WITH_OPENSSL 2573 BIGNUM *exponent = NULL; 2574 #endif /* WITH_OPENSSL */ 2575 2576 if (kp != NULL) 2577 *kp = NULL; 2578 if ((r = sshbuf_get_cstring(buf, &tname, NULL)) != 0) 2579 goto out; 2580 type = sshkey_type_from_name(tname); 2581 switch (type) { 2582 #ifdef WITH_OPENSSL 2583 case KEY_DSA: 2584 if ((k = sshkey_new_private(type)) == NULL) { 2585 r = SSH_ERR_ALLOC_FAIL; 2586 goto out; 2587 } 2588 if ((r = sshbuf_get_bignum2(buf, k->dsa->p)) != 0 || 2589 (r = sshbuf_get_bignum2(buf, k->dsa->q)) != 0 || 2590 (r = sshbuf_get_bignum2(buf, k->dsa->g)) != 0 || 2591 (r = sshbuf_get_bignum2(buf, k->dsa->pub_key)) != 0 || 2592 (r = sshbuf_get_bignum2(buf, k->dsa->priv_key)) != 0) 2593 goto out; 2594 break; 2595 case KEY_DSA_CERT: 2596 if ((r = sshkey_froms(buf, &k)) != 0 || 2597 (r = sshkey_add_private(k)) != 0 || 2598 (r = sshbuf_get_bignum2(buf, k->dsa->priv_key)) != 0) 2599 goto out; 2600 break; 2601 # ifdef OPENSSL_HAS_ECC 2602 case KEY_ECDSA: 2603 if ((k = sshkey_new_private(type)) == NULL) { 2604 r = SSH_ERR_ALLOC_FAIL; 2605 goto out; 2606 } 2607 if ((k->ecdsa_nid = sshkey_ecdsa_nid_from_name(tname)) == -1) { 2608 r = SSH_ERR_INVALID_ARGUMENT; 2609 goto out; 2610 } 2611 if ((r = sshbuf_get_cstring(buf, &curve, NULL)) != 0) 2612 goto out; 2613 if (k->ecdsa_nid != sshkey_curve_name_to_nid(curve)) { 2614 r = SSH_ERR_EC_CURVE_MISMATCH; 2615 goto out; 2616 } 2617 k->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); 2618 if (k->ecdsa == NULL || (exponent = BN_new()) == NULL) { 2619 r = SSH_ERR_LIBCRYPTO_ERROR; 2620 goto out; 2621 } 2622 if ((r = sshbuf_get_eckey(buf, k->ecdsa)) != 0 || 2623 (r = sshbuf_get_bignum2(buf, exponent))) 2624 goto out; 2625 if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) { 2626 r = SSH_ERR_LIBCRYPTO_ERROR; 2627 goto out; 2628 } 2629 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 2630 EC_KEY_get0_public_key(k->ecdsa))) != 0 || 2631 (r = sshkey_ec_validate_private(k->ecdsa)) != 0) 2632 goto out; 2633 break; 2634 case KEY_ECDSA_CERT: 2635 if ((exponent = BN_new()) == NULL) { 2636 r = SSH_ERR_LIBCRYPTO_ERROR; 2637 goto out; 2638 } 2639 if ((r = sshkey_froms(buf, &k)) != 0 || 2640 (r = sshkey_add_private(k)) != 0 || 2641 (r = sshbuf_get_bignum2(buf, exponent)) != 0) 2642 goto out; 2643 if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) { 2644 r = SSH_ERR_LIBCRYPTO_ERROR; 2645 goto out; 2646 } 2647 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 2648 EC_KEY_get0_public_key(k->ecdsa))) != 0 || 2649 (r = sshkey_ec_validate_private(k->ecdsa)) != 0) 2650 goto out; 2651 break; 2652 # endif /* OPENSSL_HAS_ECC */ 2653 case KEY_RSA: 2654 if ((k = sshkey_new_private(type)) == NULL) { 2655 r = SSH_ERR_ALLOC_FAIL; 2656 goto out; 2657 } 2658 if ((r = sshbuf_get_bignum2(buf, k->rsa->n)) != 0 || 2659 (r = sshbuf_get_bignum2(buf, k->rsa->e)) != 0 || 2660 (r = sshbuf_get_bignum2(buf, k->rsa->d)) != 0 || 2661 (r = sshbuf_get_bignum2(buf, k->rsa->iqmp)) != 0 || 2662 (r = sshbuf_get_bignum2(buf, k->rsa->p)) != 0 || 2663 (r = sshbuf_get_bignum2(buf, k->rsa->q)) != 0 || 2664 (r = ssh_rsa_generate_additional_parameters(k)) != 0) 2665 goto out; 2666 if (BN_num_bits(k->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) { 2667 r = SSH_ERR_KEY_LENGTH; 2668 goto out; 2669 } 2670 break; 2671 case KEY_RSA_CERT: 2672 if ((r = sshkey_froms(buf, &k)) != 0 || 2673 (r = sshkey_add_private(k)) != 0 || 2674 (r = sshbuf_get_bignum2(buf, k->rsa->d)) != 0 || 2675 (r = sshbuf_get_bignum2(buf, k->rsa->iqmp)) != 0 || 2676 (r = sshbuf_get_bignum2(buf, k->rsa->p)) != 0 || 2677 (r = sshbuf_get_bignum2(buf, k->rsa->q)) != 0 || 2678 (r = ssh_rsa_generate_additional_parameters(k)) != 0) 2679 goto out; 2680 if (BN_num_bits(k->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) { 2681 r = SSH_ERR_KEY_LENGTH; 2682 goto out; 2683 } 2684 break; 2685 #endif /* WITH_OPENSSL */ 2686 case KEY_ED25519: 2687 if ((k = sshkey_new_private(type)) == NULL) { 2688 r = SSH_ERR_ALLOC_FAIL; 2689 goto out; 2690 } 2691 if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 || 2692 (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0) 2693 goto out; 2694 if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) { 2695 r = SSH_ERR_INVALID_FORMAT; 2696 goto out; 2697 } 2698 k->ed25519_pk = ed25519_pk; 2699 k->ed25519_sk = ed25519_sk; 2700 ed25519_pk = ed25519_sk = NULL; 2701 break; 2702 case KEY_ED25519_CERT: 2703 if ((r = sshkey_froms(buf, &k)) != 0 || 2704 (r = sshkey_add_private(k)) != 0 || 2705 (r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 || 2706 (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0) 2707 goto out; 2708 if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) { 2709 r = SSH_ERR_INVALID_FORMAT; 2710 goto out; 2711 } 2712 k->ed25519_pk = ed25519_pk; 2713 k->ed25519_sk = ed25519_sk; 2714 ed25519_pk = ed25519_sk = NULL; 2715 break; 2716 default: 2717 r = SSH_ERR_KEY_TYPE_UNKNOWN; 2718 goto out; 2719 } 2720 #ifdef WITH_OPENSSL 2721 /* enable blinding */ 2722 switch (k->type) { 2723 case KEY_RSA: 2724 case KEY_RSA_CERT: 2725 if (RSA_blinding_on(k->rsa, NULL) != 1) { 2726 r = SSH_ERR_LIBCRYPTO_ERROR; 2727 goto out; 2728 } 2729 break; 2730 } 2731 #endif /* WITH_OPENSSL */ 2732 /* success */ 2733 r = 0; 2734 if (kp != NULL) { 2735 *kp = k; 2736 k = NULL; 2737 } 2738 out: 2739 free(tname); 2740 free(curve); 2741 #ifdef WITH_OPENSSL 2742 if (exponent != NULL) 2743 BN_clear_free(exponent); 2744 #endif /* WITH_OPENSSL */ 2745 sshkey_free(k); 2746 if (ed25519_pk != NULL) { 2747 explicit_bzero(ed25519_pk, pklen); 2748 free(ed25519_pk); 2749 } 2750 if (ed25519_sk != NULL) { 2751 explicit_bzero(ed25519_sk, sklen); 2752 free(ed25519_sk); 2753 } 2754 return r; 2755 } 2756 2757 #if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) 2758 int 2759 sshkey_ec_validate_public(const EC_GROUP *group, const EC_POINT *public) 2760 { 2761 BN_CTX *bnctx; 2762 EC_POINT *nq = NULL; 2763 BIGNUM *order, *x, *y, *tmp; 2764 int ret = SSH_ERR_KEY_INVALID_EC_VALUE; 2765 2766 /* 2767 * NB. This assumes OpenSSL has already verified that the public 2768 * point lies on the curve. This is done by EC_POINT_oct2point() 2769 * implicitly calling EC_POINT_is_on_curve(). If this code is ever 2770 * reachable with public points not unmarshalled using 2771 * EC_POINT_oct2point then the caller will need to explicitly check. 2772 */ 2773 2774 if ((bnctx = BN_CTX_new()) == NULL) 2775 return SSH_ERR_ALLOC_FAIL; 2776 BN_CTX_start(bnctx); 2777 2778 /* 2779 * We shouldn't ever hit this case because bignum_get_ecpoint() 2780 * refuses to load GF2m points. 2781 */ 2782 if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) != 2783 NID_X9_62_prime_field) 2784 goto out; 2785 2786 /* Q != infinity */ 2787 if (EC_POINT_is_at_infinity(group, public)) 2788 goto out; 2789 2790 if ((x = BN_CTX_get(bnctx)) == NULL || 2791 (y = BN_CTX_get(bnctx)) == NULL || 2792 (order = BN_CTX_get(bnctx)) == NULL || 2793 (tmp = BN_CTX_get(bnctx)) == NULL) { 2794 ret = SSH_ERR_ALLOC_FAIL; 2795 goto out; 2796 } 2797 2798 /* log2(x) > log2(order)/2, log2(y) > log2(order)/2 */ 2799 if (EC_GROUP_get_order(group, order, bnctx) != 1 || 2800 EC_POINT_get_affine_coordinates_GFp(group, public, 2801 x, y, bnctx) != 1) { 2802 ret = SSH_ERR_LIBCRYPTO_ERROR; 2803 goto out; 2804 } 2805 if (BN_num_bits(x) <= BN_num_bits(order) / 2 || 2806 BN_num_bits(y) <= BN_num_bits(order) / 2) 2807 goto out; 2808 2809 /* nQ == infinity (n == order of subgroup) */ 2810 if ((nq = EC_POINT_new(group)) == NULL) { 2811 ret = SSH_ERR_ALLOC_FAIL; 2812 goto out; 2813 } 2814 if (EC_POINT_mul(group, nq, NULL, public, order, bnctx) != 1) { 2815 ret = SSH_ERR_LIBCRYPTO_ERROR; 2816 goto out; 2817 } 2818 if (EC_POINT_is_at_infinity(group, nq) != 1) 2819 goto out; 2820 2821 /* x < order - 1, y < order - 1 */ 2822 if (!BN_sub(tmp, order, BN_value_one())) { 2823 ret = SSH_ERR_LIBCRYPTO_ERROR; 2824 goto out; 2825 } 2826 if (BN_cmp(x, tmp) >= 0 || BN_cmp(y, tmp) >= 0) 2827 goto out; 2828 ret = 0; 2829 out: 2830 BN_CTX_free(bnctx); 2831 if (nq != NULL) 2832 EC_POINT_free(nq); 2833 return ret; 2834 } 2835 2836 int 2837 sshkey_ec_validate_private(const EC_KEY *key) 2838 { 2839 BN_CTX *bnctx; 2840 BIGNUM *order, *tmp; 2841 int ret = SSH_ERR_KEY_INVALID_EC_VALUE; 2842 2843 if ((bnctx = BN_CTX_new()) == NULL) 2844 return SSH_ERR_ALLOC_FAIL; 2845 BN_CTX_start(bnctx); 2846 2847 if ((order = BN_CTX_get(bnctx)) == NULL || 2848 (tmp = BN_CTX_get(bnctx)) == NULL) { 2849 ret = SSH_ERR_ALLOC_FAIL; 2850 goto out; 2851 } 2852 2853 /* log2(private) > log2(order)/2 */ 2854 if (EC_GROUP_get_order(EC_KEY_get0_group(key), order, bnctx) != 1) { 2855 ret = SSH_ERR_LIBCRYPTO_ERROR; 2856 goto out; 2857 } 2858 if (BN_num_bits(EC_KEY_get0_private_key(key)) <= 2859 BN_num_bits(order) / 2) 2860 goto out; 2861 2862 /* private < order - 1 */ 2863 if (!BN_sub(tmp, order, BN_value_one())) { 2864 ret = SSH_ERR_LIBCRYPTO_ERROR; 2865 goto out; 2866 } 2867 if (BN_cmp(EC_KEY_get0_private_key(key), tmp) >= 0) 2868 goto out; 2869 ret = 0; 2870 out: 2871 BN_CTX_free(bnctx); 2872 return ret; 2873 } 2874 2875 void 2876 sshkey_dump_ec_point(const EC_GROUP *group, const EC_POINT *point) 2877 { 2878 BIGNUM *x, *y; 2879 BN_CTX *bnctx; 2880 2881 if (point == NULL) { 2882 fputs("point=(NULL)\n", stderr); 2883 return; 2884 } 2885 if ((bnctx = BN_CTX_new()) == NULL) { 2886 fprintf(stderr, "%s: BN_CTX_new failed\n", __func__); 2887 return; 2888 } 2889 BN_CTX_start(bnctx); 2890 if ((x = BN_CTX_get(bnctx)) == NULL || 2891 (y = BN_CTX_get(bnctx)) == NULL) { 2892 fprintf(stderr, "%s: BN_CTX_get failed\n", __func__); 2893 return; 2894 } 2895 if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) != 2896 NID_X9_62_prime_field) { 2897 fprintf(stderr, "%s: group is not a prime field\n", __func__); 2898 return; 2899 } 2900 if (EC_POINT_get_affine_coordinates_GFp(group, point, x, y, 2901 bnctx) != 1) { 2902 fprintf(stderr, "%s: EC_POINT_get_affine_coordinates_GFp\n", 2903 __func__); 2904 return; 2905 } 2906 fputs("x=", stderr); 2907 BN_print_fp(stderr, x); 2908 fputs("\ny=", stderr); 2909 BN_print_fp(stderr, y); 2910 fputs("\n", stderr); 2911 BN_CTX_free(bnctx); 2912 } 2913 2914 void 2915 sshkey_dump_ec_key(const EC_KEY *key) 2916 { 2917 const BIGNUM *exponent; 2918 2919 sshkey_dump_ec_point(EC_KEY_get0_group(key), 2920 EC_KEY_get0_public_key(key)); 2921 fputs("exponent=", stderr); 2922 if ((exponent = EC_KEY_get0_private_key(key)) == NULL) 2923 fputs("(NULL)", stderr); 2924 else 2925 BN_print_fp(stderr, EC_KEY_get0_private_key(key)); 2926 fputs("\n", stderr); 2927 } 2928 #endif /* WITH_OPENSSL && OPENSSL_HAS_ECC */ 2929 2930 static int 2931 sshkey_private_to_blob2(const struct sshkey *prv, struct sshbuf *blob, 2932 const char *passphrase, const char *comment, const char *ciphername, 2933 int rounds) 2934 { 2935 u_char *cp, *key = NULL, *pubkeyblob = NULL; 2936 u_char salt[SALT_LEN]; 2937 char *b64 = NULL; 2938 size_t i, pubkeylen, keylen, ivlen, blocksize, authlen; 2939 u_int check; 2940 int r = SSH_ERR_INTERNAL_ERROR; 2941 struct sshcipher_ctx *ciphercontext = NULL; 2942 const struct sshcipher *cipher; 2943 const char *kdfname = KDFNAME; 2944 struct sshbuf *encoded = NULL, *encrypted = NULL, *kdf = NULL; 2945 2946 if (rounds <= 0) 2947 rounds = DEFAULT_ROUNDS; 2948 if (passphrase == NULL || !strlen(passphrase)) { 2949 ciphername = "none"; 2950 kdfname = "none"; 2951 } else if (ciphername == NULL) 2952 ciphername = DEFAULT_CIPHERNAME; 2953 if ((cipher = cipher_by_name(ciphername)) == NULL) { 2954 r = SSH_ERR_INVALID_ARGUMENT; 2955 goto out; 2956 } 2957 2958 if ((kdf = sshbuf_new()) == NULL || 2959 (encoded = sshbuf_new()) == NULL || 2960 (encrypted = sshbuf_new()) == NULL) { 2961 r = SSH_ERR_ALLOC_FAIL; 2962 goto out; 2963 } 2964 blocksize = cipher_blocksize(cipher); 2965 keylen = cipher_keylen(cipher); 2966 ivlen = cipher_ivlen(cipher); 2967 authlen = cipher_authlen(cipher); 2968 if ((key = calloc(1, keylen + ivlen)) == NULL) { 2969 r = SSH_ERR_ALLOC_FAIL; 2970 goto out; 2971 } 2972 if (strcmp(kdfname, "bcrypt") == 0) { 2973 arc4random_buf(salt, SALT_LEN); 2974 if (bcrypt_pbkdf(passphrase, strlen(passphrase), 2975 salt, SALT_LEN, key, keylen + ivlen, rounds) < 0) { 2976 r = SSH_ERR_INVALID_ARGUMENT; 2977 goto out; 2978 } 2979 if ((r = sshbuf_put_string(kdf, salt, SALT_LEN)) != 0 || 2980 (r = sshbuf_put_u32(kdf, rounds)) != 0) 2981 goto out; 2982 } else if (strcmp(kdfname, "none") != 0) { 2983 /* Unsupported KDF type */ 2984 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 2985 goto out; 2986 } 2987 if ((r = cipher_init(&ciphercontext, cipher, key, keylen, 2988 key + keylen, ivlen, 1)) != 0) 2989 goto out; 2990 2991 if ((r = sshbuf_put(encoded, AUTH_MAGIC, sizeof(AUTH_MAGIC))) != 0 || 2992 (r = sshbuf_put_cstring(encoded, ciphername)) != 0 || 2993 (r = sshbuf_put_cstring(encoded, kdfname)) != 0 || 2994 (r = sshbuf_put_stringb(encoded, kdf)) != 0 || 2995 (r = sshbuf_put_u32(encoded, 1)) != 0 || /* number of keys */ 2996 (r = sshkey_to_blob(prv, &pubkeyblob, &pubkeylen)) != 0 || 2997 (r = sshbuf_put_string(encoded, pubkeyblob, pubkeylen)) != 0) 2998 goto out; 2999 3000 /* set up the buffer that will be encrypted */ 3001 3002 /* Random check bytes */ 3003 check = arc4random(); 3004 if ((r = sshbuf_put_u32(encrypted, check)) != 0 || 3005 (r = sshbuf_put_u32(encrypted, check)) != 0) 3006 goto out; 3007 3008 /* append private key and comment*/ 3009 if ((r = sshkey_private_serialize(prv, encrypted)) != 0 || 3010 (r = sshbuf_put_cstring(encrypted, comment)) != 0) 3011 goto out; 3012 3013 /* padding */ 3014 i = 0; 3015 while (sshbuf_len(encrypted) % blocksize) { 3016 if ((r = sshbuf_put_u8(encrypted, ++i & 0xff)) != 0) 3017 goto out; 3018 } 3019 3020 /* length in destination buffer */ 3021 if ((r = sshbuf_put_u32(encoded, sshbuf_len(encrypted))) != 0) 3022 goto out; 3023 3024 /* encrypt */ 3025 if ((r = sshbuf_reserve(encoded, 3026 sshbuf_len(encrypted) + authlen, &cp)) != 0) 3027 goto out; 3028 if ((r = cipher_crypt(ciphercontext, 0, cp, 3029 sshbuf_ptr(encrypted), sshbuf_len(encrypted), 0, authlen)) != 0) 3030 goto out; 3031 3032 /* uuencode */ 3033 if ((b64 = sshbuf_dtob64(encoded)) == NULL) { 3034 r = SSH_ERR_ALLOC_FAIL; 3035 goto out; 3036 } 3037 3038 sshbuf_reset(blob); 3039 if ((r = sshbuf_put(blob, MARK_BEGIN, MARK_BEGIN_LEN)) != 0) 3040 goto out; 3041 for (i = 0; i < strlen(b64); i++) { 3042 if ((r = sshbuf_put_u8(blob, b64[i])) != 0) 3043 goto out; 3044 /* insert line breaks */ 3045 if (i % 70 == 69 && (r = sshbuf_put_u8(blob, '\n')) != 0) 3046 goto out; 3047 } 3048 if (i % 70 != 69 && (r = sshbuf_put_u8(blob, '\n')) != 0) 3049 goto out; 3050 if ((r = sshbuf_put(blob, MARK_END, MARK_END_LEN)) != 0) 3051 goto out; 3052 3053 /* success */ 3054 r = 0; 3055 3056 out: 3057 sshbuf_free(kdf); 3058 sshbuf_free(encoded); 3059 sshbuf_free(encrypted); 3060 cipher_free(ciphercontext); 3061 explicit_bzero(salt, sizeof(salt)); 3062 if (key != NULL) { 3063 explicit_bzero(key, keylen + ivlen); 3064 free(key); 3065 } 3066 if (pubkeyblob != NULL) { 3067 explicit_bzero(pubkeyblob, pubkeylen); 3068 free(pubkeyblob); 3069 } 3070 if (b64 != NULL) { 3071 explicit_bzero(b64, strlen(b64)); 3072 free(b64); 3073 } 3074 return r; 3075 } 3076 3077 static int 3078 sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase, 3079 struct sshkey **keyp, char **commentp) 3080 { 3081 char *comment = NULL, *ciphername = NULL, *kdfname = NULL; 3082 const struct sshcipher *cipher = NULL; 3083 const u_char *cp; 3084 int r = SSH_ERR_INTERNAL_ERROR; 3085 size_t encoded_len; 3086 size_t i, keylen = 0, ivlen = 0, authlen = 0, slen = 0; 3087 struct sshbuf *encoded = NULL, *decoded = NULL; 3088 struct sshbuf *kdf = NULL, *decrypted = NULL; 3089 struct sshcipher_ctx *ciphercontext = NULL; 3090 struct sshkey *k = NULL; 3091 u_char *key = NULL, *salt = NULL, *dp, pad, last; 3092 u_int blocksize, rounds, nkeys, encrypted_len, check1, check2; 3093 3094 if (keyp != NULL) 3095 *keyp = NULL; 3096 if (commentp != NULL) 3097 *commentp = NULL; 3098 3099 if ((encoded = sshbuf_new()) == NULL || 3100 (decoded = sshbuf_new()) == NULL || 3101 (decrypted = sshbuf_new()) == NULL) { 3102 r = SSH_ERR_ALLOC_FAIL; 3103 goto out; 3104 } 3105 3106 /* check preamble */ 3107 cp = sshbuf_ptr(blob); 3108 encoded_len = sshbuf_len(blob); 3109 if (encoded_len < (MARK_BEGIN_LEN + MARK_END_LEN) || 3110 memcmp(cp, MARK_BEGIN, MARK_BEGIN_LEN) != 0) { 3111 r = SSH_ERR_INVALID_FORMAT; 3112 goto out; 3113 } 3114 cp += MARK_BEGIN_LEN; 3115 encoded_len -= MARK_BEGIN_LEN; 3116 3117 /* Look for end marker, removing whitespace as we go */ 3118 while (encoded_len > 0) { 3119 if (*cp != '\n' && *cp != '\r') { 3120 if ((r = sshbuf_put_u8(encoded, *cp)) != 0) 3121 goto out; 3122 } 3123 last = *cp; 3124 encoded_len--; 3125 cp++; 3126 if (last == '\n') { 3127 if (encoded_len >= MARK_END_LEN && 3128 memcmp(cp, MARK_END, MARK_END_LEN) == 0) { 3129 /* \0 terminate */ 3130 if ((r = sshbuf_put_u8(encoded, 0)) != 0) 3131 goto out; 3132 break; 3133 } 3134 } 3135 } 3136 if (encoded_len == 0) { 3137 r = SSH_ERR_INVALID_FORMAT; 3138 goto out; 3139 } 3140 3141 /* decode base64 */ 3142 if ((r = sshbuf_b64tod(decoded, (char *)sshbuf_ptr(encoded))) != 0) 3143 goto out; 3144 3145 /* check magic */ 3146 if (sshbuf_len(decoded) < sizeof(AUTH_MAGIC) || 3147 memcmp(sshbuf_ptr(decoded), AUTH_MAGIC, sizeof(AUTH_MAGIC))) { 3148 r = SSH_ERR_INVALID_FORMAT; 3149 goto out; 3150 } 3151 /* parse public portion of key */ 3152 if ((r = sshbuf_consume(decoded, sizeof(AUTH_MAGIC))) != 0 || 3153 (r = sshbuf_get_cstring(decoded, &ciphername, NULL)) != 0 || 3154 (r = sshbuf_get_cstring(decoded, &kdfname, NULL)) != 0 || 3155 (r = sshbuf_froms(decoded, &kdf)) != 0 || 3156 (r = sshbuf_get_u32(decoded, &nkeys)) != 0 || 3157 (r = sshbuf_skip_string(decoded)) != 0 || /* pubkey */ 3158 (r = sshbuf_get_u32(decoded, &encrypted_len)) != 0) 3159 goto out; 3160 3161 if ((cipher = cipher_by_name(ciphername)) == NULL) { 3162 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 3163 goto out; 3164 } 3165 if ((passphrase == NULL || strlen(passphrase) == 0) && 3166 strcmp(ciphername, "none") != 0) { 3167 /* passphrase required */ 3168 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3169 goto out; 3170 } 3171 if (strcmp(kdfname, "none") != 0 && strcmp(kdfname, "bcrypt") != 0) { 3172 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 3173 goto out; 3174 } 3175 if (!strcmp(kdfname, "none") && strcmp(ciphername, "none") != 0) { 3176 r = SSH_ERR_INVALID_FORMAT; 3177 goto out; 3178 } 3179 if (nkeys != 1) { 3180 /* XXX only one key supported */ 3181 r = SSH_ERR_INVALID_FORMAT; 3182 goto out; 3183 } 3184 3185 /* check size of encrypted key blob */ 3186 blocksize = cipher_blocksize(cipher); 3187 if (encrypted_len < blocksize || (encrypted_len % blocksize) != 0) { 3188 r = SSH_ERR_INVALID_FORMAT; 3189 goto out; 3190 } 3191 3192 /* setup key */ 3193 keylen = cipher_keylen(cipher); 3194 ivlen = cipher_ivlen(cipher); 3195 authlen = cipher_authlen(cipher); 3196 if ((key = calloc(1, keylen + ivlen)) == NULL) { 3197 r = SSH_ERR_ALLOC_FAIL; 3198 goto out; 3199 } 3200 if (strcmp(kdfname, "bcrypt") == 0) { 3201 if ((r = sshbuf_get_string(kdf, &salt, &slen)) != 0 || 3202 (r = sshbuf_get_u32(kdf, &rounds)) != 0) 3203 goto out; 3204 if (bcrypt_pbkdf(passphrase, strlen(passphrase), salt, slen, 3205 key, keylen + ivlen, rounds) < 0) { 3206 r = SSH_ERR_INVALID_FORMAT; 3207 goto out; 3208 } 3209 } 3210 3211 /* check that an appropriate amount of auth data is present */ 3212 if (sshbuf_len(decoded) < encrypted_len + authlen) { 3213 r = SSH_ERR_INVALID_FORMAT; 3214 goto out; 3215 } 3216 3217 /* decrypt private portion of key */ 3218 if ((r = sshbuf_reserve(decrypted, encrypted_len, &dp)) != 0 || 3219 (r = cipher_init(&ciphercontext, cipher, key, keylen, 3220 key + keylen, ivlen, 0)) != 0) 3221 goto out; 3222 if ((r = cipher_crypt(ciphercontext, 0, dp, sshbuf_ptr(decoded), 3223 encrypted_len, 0, authlen)) != 0) { 3224 /* an integrity error here indicates an incorrect passphrase */ 3225 if (r == SSH_ERR_MAC_INVALID) 3226 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3227 goto out; 3228 } 3229 if ((r = sshbuf_consume(decoded, encrypted_len + authlen)) != 0) 3230 goto out; 3231 /* there should be no trailing data */ 3232 if (sshbuf_len(decoded) != 0) { 3233 r = SSH_ERR_INVALID_FORMAT; 3234 goto out; 3235 } 3236 3237 /* check check bytes */ 3238 if ((r = sshbuf_get_u32(decrypted, &check1)) != 0 || 3239 (r = sshbuf_get_u32(decrypted, &check2)) != 0) 3240 goto out; 3241 if (check1 != check2) { 3242 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3243 goto out; 3244 } 3245 3246 /* Load the private key and comment */ 3247 if ((r = sshkey_private_deserialize(decrypted, &k)) != 0 || 3248 (r = sshbuf_get_cstring(decrypted, &comment, NULL)) != 0) 3249 goto out; 3250 3251 /* Check deterministic padding */ 3252 i = 0; 3253 while (sshbuf_len(decrypted)) { 3254 if ((r = sshbuf_get_u8(decrypted, &pad)) != 0) 3255 goto out; 3256 if (pad != (++i & 0xff)) { 3257 r = SSH_ERR_INVALID_FORMAT; 3258 goto out; 3259 } 3260 } 3261 3262 /* XXX decode pubkey and check against private */ 3263 3264 /* success */ 3265 r = 0; 3266 if (keyp != NULL) { 3267 *keyp = k; 3268 k = NULL; 3269 } 3270 if (commentp != NULL) { 3271 *commentp = comment; 3272 comment = NULL; 3273 } 3274 out: 3275 pad = 0; 3276 cipher_free(ciphercontext); 3277 free(ciphername); 3278 free(kdfname); 3279 free(comment); 3280 if (salt != NULL) { 3281 explicit_bzero(salt, slen); 3282 free(salt); 3283 } 3284 if (key != NULL) { 3285 explicit_bzero(key, keylen + ivlen); 3286 free(key); 3287 } 3288 sshbuf_free(encoded); 3289 sshbuf_free(decoded); 3290 sshbuf_free(kdf); 3291 sshbuf_free(decrypted); 3292 sshkey_free(k); 3293 return r; 3294 } 3295 3296 3297 #ifdef WITH_OPENSSL 3298 /* convert SSH v2 key in OpenSSL PEM format */ 3299 static int 3300 sshkey_private_pem_to_blob(struct sshkey *key, struct sshbuf *blob, 3301 const char *_passphrase, const char *comment) 3302 { 3303 int success, r; 3304 int blen, len = strlen(_passphrase); 3305 u_char *passphrase = (len > 0) ? (u_char *)_passphrase : NULL; 3306 const EVP_CIPHER *cipher = (len > 0) ? EVP_aes_128_cbc() : NULL; 3307 const u_char *bptr; 3308 BIO *bio = NULL; 3309 3310 if (len > 0 && len <= 4) 3311 return SSH_ERR_PASSPHRASE_TOO_SHORT; 3312 if ((bio = BIO_new(BIO_s_mem())) == NULL) 3313 return SSH_ERR_ALLOC_FAIL; 3314 3315 switch (key->type) { 3316 case KEY_DSA: 3317 success = PEM_write_bio_DSAPrivateKey(bio, key->dsa, 3318 cipher, passphrase, len, NULL, NULL); 3319 break; 3320 #ifdef OPENSSL_HAS_ECC 3321 case KEY_ECDSA: 3322 success = PEM_write_bio_ECPrivateKey(bio, key->ecdsa, 3323 cipher, passphrase, len, NULL, NULL); 3324 break; 3325 #endif 3326 case KEY_RSA: 3327 success = PEM_write_bio_RSAPrivateKey(bio, key->rsa, 3328 cipher, passphrase, len, NULL, NULL); 3329 break; 3330 default: 3331 success = 0; 3332 break; 3333 } 3334 if (success == 0) { 3335 r = SSH_ERR_LIBCRYPTO_ERROR; 3336 goto out; 3337 } 3338 if ((blen = BIO_get_mem_data(bio, &bptr)) <= 0) { 3339 r = SSH_ERR_INTERNAL_ERROR; 3340 goto out; 3341 } 3342 if ((r = sshbuf_put(blob, bptr, blen)) != 0) 3343 goto out; 3344 r = 0; 3345 out: 3346 BIO_free(bio); 3347 return r; 3348 } 3349 #endif /* WITH_OPENSSL */ 3350 3351 /* Serialise "key" to buffer "blob" */ 3352 int 3353 sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob, 3354 const char *passphrase, const char *comment, 3355 int force_new_format, const char *new_format_cipher, int new_format_rounds) 3356 { 3357 switch (key->type) { 3358 #ifdef WITH_OPENSSL 3359 case KEY_DSA: 3360 case KEY_ECDSA: 3361 case KEY_RSA: 3362 if (force_new_format) { 3363 return sshkey_private_to_blob2(key, blob, passphrase, 3364 comment, new_format_cipher, new_format_rounds); 3365 } 3366 return sshkey_private_pem_to_blob(key, blob, 3367 passphrase, comment); 3368 #endif /* WITH_OPENSSL */ 3369 case KEY_ED25519: 3370 return sshkey_private_to_blob2(key, blob, passphrase, 3371 comment, new_format_cipher, new_format_rounds); 3372 default: 3373 return SSH_ERR_KEY_TYPE_UNKNOWN; 3374 } 3375 } 3376 3377 3378 #ifdef WITH_OPENSSL 3379 static int 3380 translate_libcrypto_error(unsigned long pem_err) 3381 { 3382 int pem_reason = ERR_GET_REASON(pem_err); 3383 3384 switch (ERR_GET_LIB(pem_err)) { 3385 case ERR_LIB_PEM: 3386 switch (pem_reason) { 3387 case PEM_R_BAD_PASSWORD_READ: 3388 case PEM_R_PROBLEMS_GETTING_PASSWORD: 3389 case PEM_R_BAD_DECRYPT: 3390 return SSH_ERR_KEY_WRONG_PASSPHRASE; 3391 default: 3392 return SSH_ERR_INVALID_FORMAT; 3393 } 3394 case ERR_LIB_EVP: 3395 switch (pem_reason) { 3396 case EVP_R_BAD_DECRYPT: 3397 return SSH_ERR_KEY_WRONG_PASSPHRASE; 3398 case EVP_R_BN_DECODE_ERROR: 3399 case EVP_R_DECODE_ERROR: 3400 #ifdef EVP_R_PRIVATE_KEY_DECODE_ERROR 3401 case EVP_R_PRIVATE_KEY_DECODE_ERROR: 3402 #endif 3403 return SSH_ERR_INVALID_FORMAT; 3404 default: 3405 return SSH_ERR_LIBCRYPTO_ERROR; 3406 } 3407 case ERR_LIB_ASN1: 3408 return SSH_ERR_INVALID_FORMAT; 3409 } 3410 return SSH_ERR_LIBCRYPTO_ERROR; 3411 } 3412 3413 static void 3414 clear_libcrypto_errors(void) 3415 { 3416 while (ERR_get_error() != 0) 3417 ; 3418 } 3419 3420 /* 3421 * Translate OpenSSL error codes to determine whether 3422 * passphrase is required/incorrect. 3423 */ 3424 static int 3425 convert_libcrypto_error(void) 3426 { 3427 /* 3428 * Some password errors are reported at the beginning 3429 * of the error queue. 3430 */ 3431 if (translate_libcrypto_error(ERR_peek_error()) == 3432 SSH_ERR_KEY_WRONG_PASSPHRASE) 3433 return SSH_ERR_KEY_WRONG_PASSPHRASE; 3434 return translate_libcrypto_error(ERR_peek_last_error()); 3435 } 3436 3437 static int 3438 sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, 3439 const char *passphrase, struct sshkey **keyp) 3440 { 3441 EVP_PKEY *pk = NULL; 3442 struct sshkey *prv = NULL; 3443 BIO *bio = NULL; 3444 int r; 3445 3446 if (keyp != NULL) 3447 *keyp = NULL; 3448 3449 if ((bio = BIO_new(BIO_s_mem())) == NULL || sshbuf_len(blob) > INT_MAX) 3450 return SSH_ERR_ALLOC_FAIL; 3451 if (BIO_write(bio, sshbuf_ptr(blob), sshbuf_len(blob)) != 3452 (int)sshbuf_len(blob)) { 3453 r = SSH_ERR_ALLOC_FAIL; 3454 goto out; 3455 } 3456 3457 clear_libcrypto_errors(); 3458 if ((pk = PEM_read_bio_PrivateKey(bio, NULL, NULL, 3459 (char *)passphrase)) == NULL) { 3460 r = convert_libcrypto_error(); 3461 goto out; 3462 } 3463 if (pk->type == EVP_PKEY_RSA && 3464 (type == KEY_UNSPEC || type == KEY_RSA)) { 3465 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 3466 r = SSH_ERR_ALLOC_FAIL; 3467 goto out; 3468 } 3469 prv->rsa = EVP_PKEY_get1_RSA(pk); 3470 prv->type = KEY_RSA; 3471 #ifdef DEBUG_PK 3472 RSA_print_fp(stderr, prv->rsa, 8); 3473 #endif 3474 if (RSA_blinding_on(prv->rsa, NULL) != 1) { 3475 r = SSH_ERR_LIBCRYPTO_ERROR; 3476 goto out; 3477 } 3478 if (BN_num_bits(prv->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) { 3479 r = SSH_ERR_KEY_LENGTH; 3480 goto out; 3481 } 3482 } else if (pk->type == EVP_PKEY_DSA && 3483 (type == KEY_UNSPEC || type == KEY_DSA)) { 3484 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 3485 r = SSH_ERR_ALLOC_FAIL; 3486 goto out; 3487 } 3488 prv->dsa = EVP_PKEY_get1_DSA(pk); 3489 prv->type = KEY_DSA; 3490 #ifdef DEBUG_PK 3491 DSA_print_fp(stderr, prv->dsa, 8); 3492 #endif 3493 #ifdef OPENSSL_HAS_ECC 3494 } else if (pk->type == EVP_PKEY_EC && 3495 (type == KEY_UNSPEC || type == KEY_ECDSA)) { 3496 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 3497 r = SSH_ERR_ALLOC_FAIL; 3498 goto out; 3499 } 3500 prv->ecdsa = EVP_PKEY_get1_EC_KEY(pk); 3501 prv->type = KEY_ECDSA; 3502 prv->ecdsa_nid = sshkey_ecdsa_key_to_nid(prv->ecdsa); 3503 if (prv->ecdsa_nid == -1 || 3504 sshkey_curve_nid_to_name(prv->ecdsa_nid) == NULL || 3505 sshkey_ec_validate_public(EC_KEY_get0_group(prv->ecdsa), 3506 EC_KEY_get0_public_key(prv->ecdsa)) != 0 || 3507 sshkey_ec_validate_private(prv->ecdsa) != 0) { 3508 r = SSH_ERR_INVALID_FORMAT; 3509 goto out; 3510 } 3511 # ifdef DEBUG_PK 3512 if (prv != NULL && prv->ecdsa != NULL) 3513 sshkey_dump_ec_key(prv->ecdsa); 3514 # endif 3515 #endif /* OPENSSL_HAS_ECC */ 3516 } else { 3517 r = SSH_ERR_INVALID_FORMAT; 3518 goto out; 3519 } 3520 r = 0; 3521 if (keyp != NULL) { 3522 *keyp = prv; 3523 prv = NULL; 3524 } 3525 out: 3526 BIO_free(bio); 3527 if (pk != NULL) 3528 EVP_PKEY_free(pk); 3529 sshkey_free(prv); 3530 return r; 3531 } 3532 #endif /* WITH_OPENSSL */ 3533 3534 int 3535 sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type, 3536 const char *passphrase, struct sshkey **keyp, char **commentp) 3537 { 3538 int r = SSH_ERR_INTERNAL_ERROR; 3539 3540 if (keyp != NULL) 3541 *keyp = NULL; 3542 if (commentp != NULL) 3543 *commentp = NULL; 3544 3545 switch (type) { 3546 #ifdef WITH_OPENSSL 3547 case KEY_DSA: 3548 case KEY_ECDSA: 3549 case KEY_RSA: 3550 return sshkey_parse_private_pem_fileblob(blob, type, 3551 passphrase, keyp); 3552 #endif /* WITH_OPENSSL */ 3553 case KEY_ED25519: 3554 return sshkey_parse_private2(blob, type, passphrase, 3555 keyp, commentp); 3556 case KEY_UNSPEC: 3557 r = sshkey_parse_private2(blob, type, passphrase, keyp, 3558 commentp); 3559 /* Do not fallback to PEM parser if only passphrase is wrong. */ 3560 if (r == 0 || r == SSH_ERR_KEY_WRONG_PASSPHRASE) 3561 return r; 3562 #ifdef WITH_OPENSSL 3563 return sshkey_parse_private_pem_fileblob(blob, type, 3564 passphrase, keyp); 3565 #else 3566 return SSH_ERR_INVALID_FORMAT; 3567 #endif /* WITH_OPENSSL */ 3568 default: 3569 return SSH_ERR_KEY_TYPE_UNKNOWN; 3570 } 3571 } 3572 3573 int 3574 sshkey_parse_private_fileblob(struct sshbuf *buffer, const char *passphrase, 3575 struct sshkey **keyp, char **commentp) 3576 { 3577 if (keyp != NULL) 3578 *keyp = NULL; 3579 if (commentp != NULL) 3580 *commentp = NULL; 3581 3582 return sshkey_parse_private_fileblob_type(buffer, KEY_UNSPEC, 3583 passphrase, keyp, commentp); 3584 } 3585