1 /* $OpenBSD: sshkey.c,v 1.24 2015/10/15 23:08:23 djm Exp $ */ 2 /* 3 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 4 * Copyright (c) 2008 Alexander von Gernler. All rights reserved. 5 * Copyright (c) 2010,2011 Damien Miller. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 #include <sys/param.h> /* MIN MAX */ 29 #include <sys/types.h> 30 #include <netinet/in.h> 31 32 #ifdef WITH_OPENSSL 33 #include <openssl/evp.h> 34 #include <openssl/err.h> 35 #include <openssl/pem.h> 36 #endif 37 38 #include "crypto_api.h" 39 40 #include <errno.h> 41 #include <stdio.h> 42 #include <string.h> 43 #include <util.h> 44 #include <limits.h> 45 #include <resolv.h> 46 47 #include "ssh2.h" 48 #include "ssherr.h" 49 #include "misc.h" 50 #include "sshbuf.h" 51 #include "rsa.h" 52 #include "cipher.h" 53 #include "digest.h" 54 #define SSHKEY_INTERNAL 55 #include "sshkey.h" 56 #include "match.h" 57 58 /* openssh private key file format */ 59 #define MARK_BEGIN "-----BEGIN OPENSSH PRIVATE KEY-----\n" 60 #define MARK_END "-----END OPENSSH PRIVATE KEY-----\n" 61 #define MARK_BEGIN_LEN (sizeof(MARK_BEGIN) - 1) 62 #define MARK_END_LEN (sizeof(MARK_END) - 1) 63 #define KDFNAME "bcrypt" 64 #define AUTH_MAGIC "openssh-key-v1" 65 #define SALT_LEN 16 66 #define DEFAULT_CIPHERNAME "aes256-cbc" 67 #define DEFAULT_ROUNDS 16 68 69 /* Version identification string for SSH v1 identity files. */ 70 #define LEGACY_BEGIN "SSH PRIVATE KEY FILE FORMAT 1.1\n" 71 72 static int sshkey_from_blob_internal(struct sshbuf *buf, 73 struct sshkey **keyp, int allow_cert); 74 75 /* Supported key types */ 76 struct keytype { 77 const char *name; 78 const char *shortname; 79 int type; 80 int nid; 81 int cert; 82 }; 83 static const struct keytype keytypes[] = { 84 { "ssh-ed25519", "ED25519", KEY_ED25519, 0, 0 }, 85 { "ssh-ed25519-cert-v01@openssh.com", "ED25519-CERT", 86 KEY_ED25519_CERT, 0, 1 }, 87 #ifdef WITH_OPENSSL 88 { NULL, "RSA1", KEY_RSA1, 0, 0 }, 89 { "ssh-rsa", "RSA", KEY_RSA, 0, 0 }, 90 { "ssh-dss", "DSA", KEY_DSA, 0, 0 }, 91 { "ecdsa-sha2-nistp256", "ECDSA", KEY_ECDSA, NID_X9_62_prime256v1, 0 }, 92 { "ecdsa-sha2-nistp384", "ECDSA", KEY_ECDSA, NID_secp384r1, 0 }, 93 { "ecdsa-sha2-nistp521", "ECDSA", KEY_ECDSA, NID_secp521r1, 0 }, 94 { "ssh-rsa-cert-v01@openssh.com", "RSA-CERT", KEY_RSA_CERT, 0, 1 }, 95 { "ssh-dss-cert-v01@openssh.com", "DSA-CERT", KEY_DSA_CERT, 0, 1 }, 96 { "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ECDSA-CERT", 97 KEY_ECDSA_CERT, NID_X9_62_prime256v1, 1 }, 98 { "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ECDSA-CERT", 99 KEY_ECDSA_CERT, NID_secp384r1, 1 }, 100 { "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ECDSA-CERT", 101 KEY_ECDSA_CERT, NID_secp521r1, 1 }, 102 #endif /* WITH_OPENSSL */ 103 { NULL, NULL, -1, -1, 0 } 104 }; 105 106 const char * 107 sshkey_type(const struct sshkey *k) 108 { 109 const struct keytype *kt; 110 111 for (kt = keytypes; kt->type != -1; kt++) { 112 if (kt->type == k->type) 113 return kt->shortname; 114 } 115 return "unknown"; 116 } 117 118 static const char * 119 sshkey_ssh_name_from_type_nid(int type, int nid) 120 { 121 const struct keytype *kt; 122 123 for (kt = keytypes; kt->type != -1; kt++) { 124 if (kt->type == type && (kt->nid == 0 || kt->nid == nid)) 125 return kt->name; 126 } 127 return "ssh-unknown"; 128 } 129 130 int 131 sshkey_type_is_cert(int type) 132 { 133 const struct keytype *kt; 134 135 for (kt = keytypes; kt->type != -1; kt++) { 136 if (kt->type == type) 137 return kt->cert; 138 } 139 return 0; 140 } 141 142 const char * 143 sshkey_ssh_name(const struct sshkey *k) 144 { 145 return sshkey_ssh_name_from_type_nid(k->type, k->ecdsa_nid); 146 } 147 148 const char * 149 sshkey_ssh_name_plain(const struct sshkey *k) 150 { 151 return sshkey_ssh_name_from_type_nid(sshkey_type_plain(k->type), 152 k->ecdsa_nid); 153 } 154 155 int 156 sshkey_type_from_name(const char *name) 157 { 158 const struct keytype *kt; 159 160 for (kt = keytypes; kt->type != -1; kt++) { 161 /* Only allow shortname matches for plain key types */ 162 if ((kt->name != NULL && strcmp(name, kt->name) == 0) || 163 (!kt->cert && strcasecmp(kt->shortname, name) == 0)) 164 return kt->type; 165 } 166 return KEY_UNSPEC; 167 } 168 169 int 170 sshkey_ecdsa_nid_from_name(const char *name) 171 { 172 const struct keytype *kt; 173 174 for (kt = keytypes; kt->type != -1; kt++) { 175 if (kt->type != KEY_ECDSA && kt->type != KEY_ECDSA_CERT) 176 continue; 177 if (kt->name != NULL && strcmp(name, kt->name) == 0) 178 return kt->nid; 179 } 180 return -1; 181 } 182 183 char * 184 key_alg_list(int certs_only, int plain_only) 185 { 186 char *tmp, *ret = NULL; 187 size_t nlen, rlen = 0; 188 const struct keytype *kt; 189 190 for (kt = keytypes; kt->type != -1; kt++) { 191 if (kt->name == NULL) 192 continue; 193 if ((certs_only && !kt->cert) || (plain_only && kt->cert)) 194 continue; 195 if (ret != NULL) 196 ret[rlen++] = '\n'; 197 nlen = strlen(kt->name); 198 if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) { 199 free(ret); 200 return NULL; 201 } 202 ret = tmp; 203 memcpy(ret + rlen, kt->name, nlen + 1); 204 rlen += nlen; 205 } 206 return ret; 207 } 208 209 int 210 sshkey_names_valid2(const char *names, int allow_wildcard) 211 { 212 char *s, *cp, *p; 213 const struct keytype *kt; 214 int type; 215 216 if (names == NULL || strcmp(names, "") == 0) 217 return 0; 218 if ((s = cp = strdup(names)) == NULL) 219 return 0; 220 for ((p = strsep(&cp, ",")); p && *p != '\0'; 221 (p = strsep(&cp, ","))) { 222 type = sshkey_type_from_name(p); 223 if (type == KEY_RSA1) { 224 free(s); 225 return 0; 226 } 227 if (type == KEY_UNSPEC) { 228 if (allow_wildcard) { 229 /* 230 * Try matching key types against the string. 231 * If any has a positive or negative match then 232 * the component is accepted. 233 */ 234 for (kt = keytypes; kt->type != -1; kt++) { 235 if (kt->type == KEY_RSA1) 236 continue; 237 if (match_pattern_list(kt->name, 238 p, 0) != 0) 239 break; 240 } 241 if (kt->type != -1) 242 continue; 243 } 244 free(s); 245 return 0; 246 } 247 } 248 free(s); 249 return 1; 250 } 251 252 u_int 253 sshkey_size(const struct sshkey *k) 254 { 255 switch (k->type) { 256 #ifdef WITH_OPENSSL 257 case KEY_RSA1: 258 case KEY_RSA: 259 case KEY_RSA_CERT: 260 return BN_num_bits(k->rsa->n); 261 case KEY_DSA: 262 case KEY_DSA_CERT: 263 return BN_num_bits(k->dsa->p); 264 case KEY_ECDSA: 265 case KEY_ECDSA_CERT: 266 return sshkey_curve_nid_to_bits(k->ecdsa_nid); 267 #endif /* WITH_OPENSSL */ 268 case KEY_ED25519: 269 case KEY_ED25519_CERT: 270 return 256; /* XXX */ 271 } 272 return 0; 273 } 274 275 static int 276 sshkey_type_is_valid_ca(int type) 277 { 278 switch (type) { 279 case KEY_RSA: 280 case KEY_DSA: 281 case KEY_ECDSA: 282 case KEY_ED25519: 283 return 1; 284 default: 285 return 0; 286 } 287 } 288 289 int 290 sshkey_is_cert(const struct sshkey *k) 291 { 292 if (k == NULL) 293 return 0; 294 return sshkey_type_is_cert(k->type); 295 } 296 297 /* Return the cert-less equivalent to a certified key type */ 298 int 299 sshkey_type_plain(int type) 300 { 301 switch (type) { 302 case KEY_RSA_CERT: 303 return KEY_RSA; 304 case KEY_DSA_CERT: 305 return KEY_DSA; 306 case KEY_ECDSA_CERT: 307 return KEY_ECDSA; 308 case KEY_ED25519_CERT: 309 return KEY_ED25519; 310 default: 311 return type; 312 } 313 } 314 315 #ifdef WITH_OPENSSL 316 /* XXX: these are really begging for a table-driven approach */ 317 int 318 sshkey_curve_name_to_nid(const char *name) 319 { 320 if (strcmp(name, "nistp256") == 0) 321 return NID_X9_62_prime256v1; 322 else if (strcmp(name, "nistp384") == 0) 323 return NID_secp384r1; 324 else if (strcmp(name, "nistp521") == 0) 325 return NID_secp521r1; 326 else 327 return -1; 328 } 329 330 u_int 331 sshkey_curve_nid_to_bits(int nid) 332 { 333 switch (nid) { 334 case NID_X9_62_prime256v1: 335 return 256; 336 case NID_secp384r1: 337 return 384; 338 case NID_secp521r1: 339 return 521; 340 default: 341 return 0; 342 } 343 } 344 345 int 346 sshkey_ecdsa_bits_to_nid(int bits) 347 { 348 switch (bits) { 349 case 256: 350 return NID_X9_62_prime256v1; 351 case 384: 352 return NID_secp384r1; 353 case 521: 354 return NID_secp521r1; 355 default: 356 return -1; 357 } 358 } 359 360 const char * 361 sshkey_curve_nid_to_name(int nid) 362 { 363 switch (nid) { 364 case NID_X9_62_prime256v1: 365 return "nistp256"; 366 case NID_secp384r1: 367 return "nistp384"; 368 case NID_secp521r1: 369 return "nistp521"; 370 default: 371 return NULL; 372 } 373 } 374 375 int 376 sshkey_ec_nid_to_hash_alg(int nid) 377 { 378 int kbits = sshkey_curve_nid_to_bits(nid); 379 380 if (kbits <= 0) 381 return -1; 382 383 /* RFC5656 section 6.2.1 */ 384 if (kbits <= 256) 385 return SSH_DIGEST_SHA256; 386 else if (kbits <= 384) 387 return SSH_DIGEST_SHA384; 388 else 389 return SSH_DIGEST_SHA512; 390 } 391 #endif /* WITH_OPENSSL */ 392 393 static void 394 cert_free(struct sshkey_cert *cert) 395 { 396 u_int i; 397 398 if (cert == NULL) 399 return; 400 if (cert->certblob != NULL) 401 sshbuf_free(cert->certblob); 402 if (cert->critical != NULL) 403 sshbuf_free(cert->critical); 404 if (cert->extensions != NULL) 405 sshbuf_free(cert->extensions); 406 if (cert->key_id != NULL) 407 free(cert->key_id); 408 for (i = 0; i < cert->nprincipals; i++) 409 free(cert->principals[i]); 410 if (cert->principals != NULL) 411 free(cert->principals); 412 if (cert->signature_key != NULL) 413 sshkey_free(cert->signature_key); 414 explicit_bzero(cert, sizeof(*cert)); 415 free(cert); 416 } 417 418 static struct sshkey_cert * 419 cert_new(void) 420 { 421 struct sshkey_cert *cert; 422 423 if ((cert = calloc(1, sizeof(*cert))) == NULL) 424 return NULL; 425 if ((cert->certblob = sshbuf_new()) == NULL || 426 (cert->critical = sshbuf_new()) == NULL || 427 (cert->extensions = sshbuf_new()) == NULL) { 428 cert_free(cert); 429 return NULL; 430 } 431 cert->key_id = NULL; 432 cert->principals = NULL; 433 cert->signature_key = NULL; 434 return cert; 435 } 436 437 struct sshkey * 438 sshkey_new(int type) 439 { 440 struct sshkey *k; 441 #ifdef WITH_OPENSSL 442 RSA *rsa; 443 DSA *dsa; 444 #endif /* WITH_OPENSSL */ 445 446 if ((k = calloc(1, sizeof(*k))) == NULL) 447 return NULL; 448 k->type = type; 449 k->ecdsa = NULL; 450 k->ecdsa_nid = -1; 451 k->dsa = NULL; 452 k->rsa = NULL; 453 k->cert = NULL; 454 k->ed25519_sk = NULL; 455 k->ed25519_pk = NULL; 456 switch (k->type) { 457 #ifdef WITH_OPENSSL 458 case KEY_RSA1: 459 case KEY_RSA: 460 case KEY_RSA_CERT: 461 if ((rsa = RSA_new()) == NULL || 462 (rsa->n = BN_new()) == NULL || 463 (rsa->e = BN_new()) == NULL) { 464 if (rsa != NULL) 465 RSA_free(rsa); 466 free(k); 467 return NULL; 468 } 469 k->rsa = rsa; 470 break; 471 case KEY_DSA: 472 case KEY_DSA_CERT: 473 if ((dsa = DSA_new()) == NULL || 474 (dsa->p = BN_new()) == NULL || 475 (dsa->q = BN_new()) == NULL || 476 (dsa->g = BN_new()) == NULL || 477 (dsa->pub_key = BN_new()) == NULL) { 478 if (dsa != NULL) 479 DSA_free(dsa); 480 free(k); 481 return NULL; 482 } 483 k->dsa = dsa; 484 break; 485 case KEY_ECDSA: 486 case KEY_ECDSA_CERT: 487 /* Cannot do anything until we know the group */ 488 break; 489 #endif /* WITH_OPENSSL */ 490 case KEY_ED25519: 491 case KEY_ED25519_CERT: 492 /* no need to prealloc */ 493 break; 494 case KEY_UNSPEC: 495 break; 496 default: 497 free(k); 498 return NULL; 499 break; 500 } 501 502 if (sshkey_is_cert(k)) { 503 if ((k->cert = cert_new()) == NULL) { 504 sshkey_free(k); 505 return NULL; 506 } 507 } 508 509 return k; 510 } 511 512 int 513 sshkey_add_private(struct sshkey *k) 514 { 515 switch (k->type) { 516 #ifdef WITH_OPENSSL 517 case KEY_RSA1: 518 case KEY_RSA: 519 case KEY_RSA_CERT: 520 #define bn_maybe_alloc_failed(p) (p == NULL && (p = BN_new()) == NULL) 521 if (bn_maybe_alloc_failed(k->rsa->d) || 522 bn_maybe_alloc_failed(k->rsa->iqmp) || 523 bn_maybe_alloc_failed(k->rsa->q) || 524 bn_maybe_alloc_failed(k->rsa->p) || 525 bn_maybe_alloc_failed(k->rsa->dmq1) || 526 bn_maybe_alloc_failed(k->rsa->dmp1)) 527 return SSH_ERR_ALLOC_FAIL; 528 break; 529 case KEY_DSA: 530 case KEY_DSA_CERT: 531 if (bn_maybe_alloc_failed(k->dsa->priv_key)) 532 return SSH_ERR_ALLOC_FAIL; 533 break; 534 #undef bn_maybe_alloc_failed 535 case KEY_ECDSA: 536 case KEY_ECDSA_CERT: 537 /* Cannot do anything until we know the group */ 538 break; 539 #endif /* WITH_OPENSSL */ 540 case KEY_ED25519: 541 case KEY_ED25519_CERT: 542 /* no need to prealloc */ 543 break; 544 case KEY_UNSPEC: 545 break; 546 default: 547 return SSH_ERR_INVALID_ARGUMENT; 548 } 549 return 0; 550 } 551 552 struct sshkey * 553 sshkey_new_private(int type) 554 { 555 struct sshkey *k = sshkey_new(type); 556 557 if (k == NULL) 558 return NULL; 559 if (sshkey_add_private(k) != 0) { 560 sshkey_free(k); 561 return NULL; 562 } 563 return k; 564 } 565 566 void 567 sshkey_free(struct sshkey *k) 568 { 569 if (k == NULL) 570 return; 571 switch (k->type) { 572 #ifdef WITH_OPENSSL 573 case KEY_RSA1: 574 case KEY_RSA: 575 case KEY_RSA_CERT: 576 if (k->rsa != NULL) 577 RSA_free(k->rsa); 578 k->rsa = NULL; 579 break; 580 case KEY_DSA: 581 case KEY_DSA_CERT: 582 if (k->dsa != NULL) 583 DSA_free(k->dsa); 584 k->dsa = NULL; 585 break; 586 case KEY_ECDSA: 587 case KEY_ECDSA_CERT: 588 if (k->ecdsa != NULL) 589 EC_KEY_free(k->ecdsa); 590 k->ecdsa = NULL; 591 break; 592 #endif /* WITH_OPENSSL */ 593 case KEY_ED25519: 594 case KEY_ED25519_CERT: 595 if (k->ed25519_pk) { 596 explicit_bzero(k->ed25519_pk, ED25519_PK_SZ); 597 free(k->ed25519_pk); 598 k->ed25519_pk = NULL; 599 } 600 if (k->ed25519_sk) { 601 explicit_bzero(k->ed25519_sk, ED25519_SK_SZ); 602 free(k->ed25519_sk); 603 k->ed25519_sk = NULL; 604 } 605 break; 606 case KEY_UNSPEC: 607 break; 608 default: 609 break; 610 } 611 if (sshkey_is_cert(k)) 612 cert_free(k->cert); 613 explicit_bzero(k, sizeof(*k)); 614 free(k); 615 } 616 617 static int 618 cert_compare(struct sshkey_cert *a, struct sshkey_cert *b) 619 { 620 if (a == NULL && b == NULL) 621 return 1; 622 if (a == NULL || b == NULL) 623 return 0; 624 if (sshbuf_len(a->certblob) != sshbuf_len(b->certblob)) 625 return 0; 626 if (timingsafe_bcmp(sshbuf_ptr(a->certblob), sshbuf_ptr(b->certblob), 627 sshbuf_len(a->certblob)) != 0) 628 return 0; 629 return 1; 630 } 631 632 /* 633 * Compare public portions of key only, allowing comparisons between 634 * certificates and plain keys too. 635 */ 636 int 637 sshkey_equal_public(const struct sshkey *a, const struct sshkey *b) 638 { 639 #ifdef WITH_OPENSSL 640 BN_CTX *bnctx; 641 #endif /* WITH_OPENSSL */ 642 643 if (a == NULL || b == NULL || 644 sshkey_type_plain(a->type) != sshkey_type_plain(b->type)) 645 return 0; 646 647 switch (a->type) { 648 #ifdef WITH_OPENSSL 649 case KEY_RSA1: 650 case KEY_RSA_CERT: 651 case KEY_RSA: 652 return a->rsa != NULL && b->rsa != NULL && 653 BN_cmp(a->rsa->e, b->rsa->e) == 0 && 654 BN_cmp(a->rsa->n, b->rsa->n) == 0; 655 case KEY_DSA_CERT: 656 case KEY_DSA: 657 return a->dsa != NULL && b->dsa != NULL && 658 BN_cmp(a->dsa->p, b->dsa->p) == 0 && 659 BN_cmp(a->dsa->q, b->dsa->q) == 0 && 660 BN_cmp(a->dsa->g, b->dsa->g) == 0 && 661 BN_cmp(a->dsa->pub_key, b->dsa->pub_key) == 0; 662 case KEY_ECDSA_CERT: 663 case KEY_ECDSA: 664 if (a->ecdsa == NULL || b->ecdsa == NULL || 665 EC_KEY_get0_public_key(a->ecdsa) == NULL || 666 EC_KEY_get0_public_key(b->ecdsa) == NULL) 667 return 0; 668 if ((bnctx = BN_CTX_new()) == NULL) 669 return 0; 670 if (EC_GROUP_cmp(EC_KEY_get0_group(a->ecdsa), 671 EC_KEY_get0_group(b->ecdsa), bnctx) != 0 || 672 EC_POINT_cmp(EC_KEY_get0_group(a->ecdsa), 673 EC_KEY_get0_public_key(a->ecdsa), 674 EC_KEY_get0_public_key(b->ecdsa), bnctx) != 0) { 675 BN_CTX_free(bnctx); 676 return 0; 677 } 678 BN_CTX_free(bnctx); 679 return 1; 680 #endif /* WITH_OPENSSL */ 681 case KEY_ED25519: 682 case KEY_ED25519_CERT: 683 return a->ed25519_pk != NULL && b->ed25519_pk != NULL && 684 memcmp(a->ed25519_pk, b->ed25519_pk, ED25519_PK_SZ) == 0; 685 default: 686 return 0; 687 } 688 /* NOTREACHED */ 689 } 690 691 int 692 sshkey_equal(const struct sshkey *a, const struct sshkey *b) 693 { 694 if (a == NULL || b == NULL || a->type != b->type) 695 return 0; 696 if (sshkey_is_cert(a)) { 697 if (!cert_compare(a->cert, b->cert)) 698 return 0; 699 } 700 return sshkey_equal_public(a, b); 701 } 702 703 static int 704 to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain) 705 { 706 int type, ret = SSH_ERR_INTERNAL_ERROR; 707 const char *typename; 708 709 if (key == NULL) 710 return SSH_ERR_INVALID_ARGUMENT; 711 712 if (sshkey_is_cert(key)) { 713 if (key->cert == NULL) 714 return SSH_ERR_EXPECTED_CERT; 715 if (sshbuf_len(key->cert->certblob) == 0) 716 return SSH_ERR_KEY_LACKS_CERTBLOB; 717 } 718 type = force_plain ? sshkey_type_plain(key->type) : key->type; 719 typename = sshkey_ssh_name_from_type_nid(type, key->ecdsa_nid); 720 721 switch (type) { 722 #ifdef WITH_OPENSSL 723 case KEY_DSA_CERT: 724 case KEY_ECDSA_CERT: 725 case KEY_RSA_CERT: 726 #endif /* WITH_OPENSSL */ 727 case KEY_ED25519_CERT: 728 /* Use the existing blob */ 729 /* XXX modified flag? */ 730 if ((ret = sshbuf_putb(b, key->cert->certblob)) != 0) 731 return ret; 732 break; 733 #ifdef WITH_OPENSSL 734 case KEY_DSA: 735 if (key->dsa == NULL) 736 return SSH_ERR_INVALID_ARGUMENT; 737 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 738 (ret = sshbuf_put_bignum2(b, key->dsa->p)) != 0 || 739 (ret = sshbuf_put_bignum2(b, key->dsa->q)) != 0 || 740 (ret = sshbuf_put_bignum2(b, key->dsa->g)) != 0 || 741 (ret = sshbuf_put_bignum2(b, key->dsa->pub_key)) != 0) 742 return ret; 743 break; 744 case KEY_ECDSA: 745 if (key->ecdsa == NULL) 746 return SSH_ERR_INVALID_ARGUMENT; 747 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 748 (ret = sshbuf_put_cstring(b, 749 sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || 750 (ret = sshbuf_put_eckey(b, key->ecdsa)) != 0) 751 return ret; 752 break; 753 case KEY_RSA: 754 if (key->rsa == NULL) 755 return SSH_ERR_INVALID_ARGUMENT; 756 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 757 (ret = sshbuf_put_bignum2(b, key->rsa->e)) != 0 || 758 (ret = sshbuf_put_bignum2(b, key->rsa->n)) != 0) 759 return ret; 760 break; 761 #endif /* WITH_OPENSSL */ 762 case KEY_ED25519: 763 if (key->ed25519_pk == NULL) 764 return SSH_ERR_INVALID_ARGUMENT; 765 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 766 (ret = sshbuf_put_string(b, 767 key->ed25519_pk, ED25519_PK_SZ)) != 0) 768 return ret; 769 break; 770 default: 771 return SSH_ERR_KEY_TYPE_UNKNOWN; 772 } 773 return 0; 774 } 775 776 int 777 sshkey_putb(const struct sshkey *key, struct sshbuf *b) 778 { 779 return to_blob_buf(key, b, 0); 780 } 781 782 int 783 sshkey_puts(const struct sshkey *key, struct sshbuf *b) 784 { 785 struct sshbuf *tmp; 786 int r; 787 788 if ((tmp = sshbuf_new()) == NULL) 789 return SSH_ERR_ALLOC_FAIL; 790 r = to_blob_buf(key, tmp, 0); 791 if (r == 0) 792 r = sshbuf_put_stringb(b, tmp); 793 sshbuf_free(tmp); 794 return r; 795 } 796 797 int 798 sshkey_putb_plain(const struct sshkey *key, struct sshbuf *b) 799 { 800 return to_blob_buf(key, b, 1); 801 } 802 803 static int 804 to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp, int force_plain) 805 { 806 int ret = SSH_ERR_INTERNAL_ERROR; 807 size_t len; 808 struct sshbuf *b = NULL; 809 810 if (lenp != NULL) 811 *lenp = 0; 812 if (blobp != NULL) 813 *blobp = NULL; 814 if ((b = sshbuf_new()) == NULL) 815 return SSH_ERR_ALLOC_FAIL; 816 if ((ret = to_blob_buf(key, b, force_plain)) != 0) 817 goto out; 818 len = sshbuf_len(b); 819 if (lenp != NULL) 820 *lenp = len; 821 if (blobp != NULL) { 822 if ((*blobp = malloc(len)) == NULL) { 823 ret = SSH_ERR_ALLOC_FAIL; 824 goto out; 825 } 826 memcpy(*blobp, sshbuf_ptr(b), len); 827 } 828 ret = 0; 829 out: 830 sshbuf_free(b); 831 return ret; 832 } 833 834 int 835 sshkey_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp) 836 { 837 return to_blob(key, blobp, lenp, 0); 838 } 839 840 int 841 sshkey_plain_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp) 842 { 843 return to_blob(key, blobp, lenp, 1); 844 } 845 846 int 847 sshkey_fingerprint_raw(const struct sshkey *k, int dgst_alg, 848 u_char **retp, size_t *lenp) 849 { 850 u_char *blob = NULL, *ret = NULL; 851 size_t blob_len = 0; 852 int r = SSH_ERR_INTERNAL_ERROR; 853 854 if (retp != NULL) 855 *retp = NULL; 856 if (lenp != NULL) 857 *lenp = 0; 858 if (ssh_digest_bytes(dgst_alg) == 0) { 859 r = SSH_ERR_INVALID_ARGUMENT; 860 goto out; 861 } 862 863 if (k->type == KEY_RSA1) { 864 #ifdef WITH_OPENSSL 865 int nlen = BN_num_bytes(k->rsa->n); 866 int elen = BN_num_bytes(k->rsa->e); 867 868 blob_len = nlen + elen; 869 if (nlen >= INT_MAX - elen || 870 (blob = malloc(blob_len)) == NULL) { 871 r = SSH_ERR_ALLOC_FAIL; 872 goto out; 873 } 874 BN_bn2bin(k->rsa->n, blob); 875 BN_bn2bin(k->rsa->e, blob + nlen); 876 #endif /* WITH_OPENSSL */ 877 } else if ((r = to_blob(k, &blob, &blob_len, 1)) != 0) 878 goto out; 879 if ((ret = calloc(1, SSH_DIGEST_MAX_LENGTH)) == NULL) { 880 r = SSH_ERR_ALLOC_FAIL; 881 goto out; 882 } 883 if ((r = ssh_digest_memory(dgst_alg, blob, blob_len, 884 ret, SSH_DIGEST_MAX_LENGTH)) != 0) 885 goto out; 886 /* success */ 887 if (retp != NULL) { 888 *retp = ret; 889 ret = NULL; 890 } 891 if (lenp != NULL) 892 *lenp = ssh_digest_bytes(dgst_alg); 893 r = 0; 894 out: 895 free(ret); 896 if (blob != NULL) { 897 explicit_bzero(blob, blob_len); 898 free(blob); 899 } 900 return r; 901 } 902 903 static char * 904 fingerprint_b64(const char *alg, u_char *dgst_raw, size_t dgst_raw_len) 905 { 906 char *ret; 907 size_t plen = strlen(alg) + 1; 908 size_t rlen = ((dgst_raw_len + 2) / 3) * 4 + plen + 1; 909 int r; 910 911 if (dgst_raw_len > 65536 || (ret = calloc(1, rlen)) == NULL) 912 return NULL; 913 strlcpy(ret, alg, rlen); 914 strlcat(ret, ":", rlen); 915 if (dgst_raw_len == 0) 916 return ret; 917 if ((r = b64_ntop(dgst_raw, dgst_raw_len, 918 ret + plen, rlen - plen)) == -1) { 919 explicit_bzero(ret, rlen); 920 free(ret); 921 return NULL; 922 } 923 /* Trim padding characters from end */ 924 ret[strcspn(ret, "=")] = '\0'; 925 return ret; 926 } 927 928 static char * 929 fingerprint_hex(const char *alg, u_char *dgst_raw, size_t dgst_raw_len) 930 { 931 char *retval, hex[5]; 932 size_t i, rlen = dgst_raw_len * 3 + strlen(alg) + 2; 933 934 if (dgst_raw_len > 65536 || (retval = calloc(1, rlen)) == NULL) 935 return NULL; 936 strlcpy(retval, alg, rlen); 937 strlcat(retval, ":", rlen); 938 for (i = 0; i < dgst_raw_len; i++) { 939 snprintf(hex, sizeof(hex), "%s%02x", 940 i > 0 ? ":" : "", dgst_raw[i]); 941 strlcat(retval, hex, rlen); 942 } 943 return retval; 944 } 945 946 static char * 947 fingerprint_bubblebabble(u_char *dgst_raw, size_t dgst_raw_len) 948 { 949 char vowels[] = { 'a', 'e', 'i', 'o', 'u', 'y' }; 950 char consonants[] = { 'b', 'c', 'd', 'f', 'g', 'h', 'k', 'l', 'm', 951 'n', 'p', 'r', 's', 't', 'v', 'z', 'x' }; 952 u_int i, j = 0, rounds, seed = 1; 953 char *retval; 954 955 rounds = (dgst_raw_len / 2) + 1; 956 if ((retval = calloc(rounds, 6)) == NULL) 957 return NULL; 958 retval[j++] = 'x'; 959 for (i = 0; i < rounds; i++) { 960 u_int idx0, idx1, idx2, idx3, idx4; 961 if ((i + 1 < rounds) || (dgst_raw_len % 2 != 0)) { 962 idx0 = (((((u_int)(dgst_raw[2 * i])) >> 6) & 3) + 963 seed) % 6; 964 idx1 = (((u_int)(dgst_raw[2 * i])) >> 2) & 15; 965 idx2 = ((((u_int)(dgst_raw[2 * i])) & 3) + 966 (seed / 6)) % 6; 967 retval[j++] = vowels[idx0]; 968 retval[j++] = consonants[idx1]; 969 retval[j++] = vowels[idx2]; 970 if ((i + 1) < rounds) { 971 idx3 = (((u_int)(dgst_raw[(2 * i) + 1])) >> 4) & 15; 972 idx4 = (((u_int)(dgst_raw[(2 * i) + 1]))) & 15; 973 retval[j++] = consonants[idx3]; 974 retval[j++] = '-'; 975 retval[j++] = consonants[idx4]; 976 seed = ((seed * 5) + 977 ((((u_int)(dgst_raw[2 * i])) * 7) + 978 ((u_int)(dgst_raw[(2 * i) + 1])))) % 36; 979 } 980 } else { 981 idx0 = seed % 6; 982 idx1 = 16; 983 idx2 = seed / 6; 984 retval[j++] = vowels[idx0]; 985 retval[j++] = consonants[idx1]; 986 retval[j++] = vowels[idx2]; 987 } 988 } 989 retval[j++] = 'x'; 990 retval[j++] = '\0'; 991 return retval; 992 } 993 994 /* 995 * Draw an ASCII-Art representing the fingerprint so human brain can 996 * profit from its built-in pattern recognition ability. 997 * This technique is called "random art" and can be found in some 998 * scientific publications like this original paper: 999 * 1000 * "Hash Visualization: a New Technique to improve Real-World Security", 1001 * Perrig A. and Song D., 1999, International Workshop on Cryptographic 1002 * Techniques and E-Commerce (CrypTEC '99) 1003 * sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf 1004 * 1005 * The subject came up in a talk by Dan Kaminsky, too. 1006 * 1007 * If you see the picture is different, the key is different. 1008 * If the picture looks the same, you still know nothing. 1009 * 1010 * The algorithm used here is a worm crawling over a discrete plane, 1011 * leaving a trace (augmenting the field) everywhere it goes. 1012 * Movement is taken from dgst_raw 2bit-wise. Bumping into walls 1013 * makes the respective movement vector be ignored for this turn. 1014 * Graphs are not unambiguous, because circles in graphs can be 1015 * walked in either direction. 1016 */ 1017 1018 /* 1019 * Field sizes for the random art. Have to be odd, so the starting point 1020 * can be in the exact middle of the picture, and FLDBASE should be >=8 . 1021 * Else pictures would be too dense, and drawing the frame would 1022 * fail, too, because the key type would not fit in anymore. 1023 */ 1024 #define FLDBASE 8 1025 #define FLDSIZE_Y (FLDBASE + 1) 1026 #define FLDSIZE_X (FLDBASE * 2 + 1) 1027 static char * 1028 fingerprint_randomart(const char *alg, u_char *dgst_raw, size_t dgst_raw_len, 1029 const struct sshkey *k) 1030 { 1031 /* 1032 * Chars to be used after each other every time the worm 1033 * intersects with itself. Matter of taste. 1034 */ 1035 char *augmentation_string = " .o+=*BOX@%&#/^SE"; 1036 char *retval, *p, title[FLDSIZE_X], hash[FLDSIZE_X]; 1037 u_char field[FLDSIZE_X][FLDSIZE_Y]; 1038 size_t i, tlen, hlen; 1039 u_int b; 1040 int x, y, r; 1041 size_t len = strlen(augmentation_string) - 1; 1042 1043 if ((retval = calloc((FLDSIZE_X + 3), (FLDSIZE_Y + 2))) == NULL) 1044 return NULL; 1045 1046 /* initialize field */ 1047 memset(field, 0, FLDSIZE_X * FLDSIZE_Y * sizeof(char)); 1048 x = FLDSIZE_X / 2; 1049 y = FLDSIZE_Y / 2; 1050 1051 /* process raw key */ 1052 for (i = 0; i < dgst_raw_len; i++) { 1053 int input; 1054 /* each byte conveys four 2-bit move commands */ 1055 input = dgst_raw[i]; 1056 for (b = 0; b < 4; b++) { 1057 /* evaluate 2 bit, rest is shifted later */ 1058 x += (input & 0x1) ? 1 : -1; 1059 y += (input & 0x2) ? 1 : -1; 1060 1061 /* assure we are still in bounds */ 1062 x = MAX(x, 0); 1063 y = MAX(y, 0); 1064 x = MIN(x, FLDSIZE_X - 1); 1065 y = MIN(y, FLDSIZE_Y - 1); 1066 1067 /* augment the field */ 1068 if (field[x][y] < len - 2) 1069 field[x][y]++; 1070 input = input >> 2; 1071 } 1072 } 1073 1074 /* mark starting point and end point*/ 1075 field[FLDSIZE_X / 2][FLDSIZE_Y / 2] = len - 1; 1076 field[x][y] = len; 1077 1078 /* assemble title */ 1079 r = snprintf(title, sizeof(title), "[%s %u]", 1080 sshkey_type(k), sshkey_size(k)); 1081 /* If [type size] won't fit, then try [type]; fits "[ED25519-CERT]" */ 1082 if (r < 0 || r > (int)sizeof(title)) 1083 r = snprintf(title, sizeof(title), "[%s]", sshkey_type(k)); 1084 tlen = (r <= 0) ? 0 : strlen(title); 1085 1086 /* assemble hash ID. */ 1087 r = snprintf(hash, sizeof(hash), "[%s]", alg); 1088 hlen = (r <= 0) ? 0 : strlen(hash); 1089 1090 /* output upper border */ 1091 p = retval; 1092 *p++ = '+'; 1093 for (i = 0; i < (FLDSIZE_X - tlen) / 2; i++) 1094 *p++ = '-'; 1095 memcpy(p, title, tlen); 1096 p += tlen; 1097 for (i += tlen; i < FLDSIZE_X; i++) 1098 *p++ = '-'; 1099 *p++ = '+'; 1100 *p++ = '\n'; 1101 1102 /* output content */ 1103 for (y = 0; y < FLDSIZE_Y; y++) { 1104 *p++ = '|'; 1105 for (x = 0; x < FLDSIZE_X; x++) 1106 *p++ = augmentation_string[MIN(field[x][y], len)]; 1107 *p++ = '|'; 1108 *p++ = '\n'; 1109 } 1110 1111 /* output lower border */ 1112 *p++ = '+'; 1113 for (i = 0; i < (FLDSIZE_X - hlen) / 2; i++) 1114 *p++ = '-'; 1115 memcpy(p, hash, hlen); 1116 p += hlen; 1117 for (i += hlen; i < FLDSIZE_X; i++) 1118 *p++ = '-'; 1119 *p++ = '+'; 1120 1121 return retval; 1122 } 1123 1124 char * 1125 sshkey_fingerprint(const struct sshkey *k, int dgst_alg, 1126 enum sshkey_fp_rep dgst_rep) 1127 { 1128 char *retval = NULL; 1129 u_char *dgst_raw; 1130 size_t dgst_raw_len; 1131 1132 if (sshkey_fingerprint_raw(k, dgst_alg, &dgst_raw, &dgst_raw_len) != 0) 1133 return NULL; 1134 switch (dgst_rep) { 1135 case SSH_FP_DEFAULT: 1136 if (dgst_alg == SSH_DIGEST_MD5) { 1137 retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg), 1138 dgst_raw, dgst_raw_len); 1139 } else { 1140 retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg), 1141 dgst_raw, dgst_raw_len); 1142 } 1143 break; 1144 case SSH_FP_HEX: 1145 retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg), 1146 dgst_raw, dgst_raw_len); 1147 break; 1148 case SSH_FP_BASE64: 1149 retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg), 1150 dgst_raw, dgst_raw_len); 1151 break; 1152 case SSH_FP_BUBBLEBABBLE: 1153 retval = fingerprint_bubblebabble(dgst_raw, dgst_raw_len); 1154 break; 1155 case SSH_FP_RANDOMART: 1156 retval = fingerprint_randomart(ssh_digest_alg_name(dgst_alg), 1157 dgst_raw, dgst_raw_len, k); 1158 break; 1159 default: 1160 explicit_bzero(dgst_raw, dgst_raw_len); 1161 free(dgst_raw); 1162 return NULL; 1163 } 1164 explicit_bzero(dgst_raw, dgst_raw_len); 1165 free(dgst_raw); 1166 return retval; 1167 } 1168 1169 #ifdef WITH_SSH1 1170 /* 1171 * Reads a multiple-precision integer in decimal from the buffer, and advances 1172 * the pointer. The integer must already be initialized. This function is 1173 * permitted to modify the buffer. This leaves *cpp to point just beyond the 1174 * last processed character. 1175 */ 1176 static int 1177 read_decimal_bignum(char **cpp, BIGNUM *v) 1178 { 1179 char *cp; 1180 size_t e; 1181 int skip = 1; /* skip white space */ 1182 1183 cp = *cpp; 1184 while (*cp == ' ' || *cp == '\t') 1185 cp++; 1186 e = strspn(cp, "0123456789"); 1187 if (e == 0) 1188 return SSH_ERR_INVALID_FORMAT; 1189 if (e > SSHBUF_MAX_BIGNUM * 3) 1190 return SSH_ERR_BIGNUM_TOO_LARGE; 1191 if (cp[e] == '\0') 1192 skip = 0; 1193 else if (index(" \t\r\n", cp[e]) == NULL) 1194 return SSH_ERR_INVALID_FORMAT; 1195 cp[e] = '\0'; 1196 if (BN_dec2bn(&v, cp) <= 0) 1197 return SSH_ERR_INVALID_FORMAT; 1198 *cpp = cp + e + skip; 1199 return 0; 1200 } 1201 #endif /* WITH_SSH1 */ 1202 1203 /* returns 0 ok, and < 0 error */ 1204 int 1205 sshkey_read(struct sshkey *ret, char **cpp) 1206 { 1207 struct sshkey *k; 1208 int retval = SSH_ERR_INVALID_FORMAT; 1209 char *cp, *space; 1210 int r, type, curve_nid = -1; 1211 struct sshbuf *blob; 1212 #ifdef WITH_SSH1 1213 char *ep; 1214 u_long bits; 1215 #endif /* WITH_SSH1 */ 1216 1217 cp = *cpp; 1218 1219 switch (ret->type) { 1220 case KEY_RSA1: 1221 #ifdef WITH_SSH1 1222 /* Get number of bits. */ 1223 bits = strtoul(cp, &ep, 10); 1224 if (*cp == '\0' || index(" \t\r\n", *ep) == NULL || 1225 bits == 0 || bits > SSHBUF_MAX_BIGNUM * 8) 1226 return SSH_ERR_INVALID_FORMAT; /* Bad bit count... */ 1227 /* Get public exponent, public modulus. */ 1228 if ((r = read_decimal_bignum(&ep, ret->rsa->e)) < 0) 1229 return r; 1230 if ((r = read_decimal_bignum(&ep, ret->rsa->n)) < 0) 1231 return r; 1232 *cpp = ep; 1233 /* validate the claimed number of bits */ 1234 if (BN_num_bits(ret->rsa->n) != (int)bits) 1235 return SSH_ERR_KEY_BITS_MISMATCH; 1236 retval = 0; 1237 #endif /* WITH_SSH1 */ 1238 break; 1239 case KEY_UNSPEC: 1240 case KEY_RSA: 1241 case KEY_DSA: 1242 case KEY_ECDSA: 1243 case KEY_ED25519: 1244 case KEY_DSA_CERT: 1245 case KEY_ECDSA_CERT: 1246 case KEY_RSA_CERT: 1247 case KEY_ED25519_CERT: 1248 space = strchr(cp, ' '); 1249 if (space == NULL) 1250 return SSH_ERR_INVALID_FORMAT; 1251 *space = '\0'; 1252 type = sshkey_type_from_name(cp); 1253 if (sshkey_type_plain(type) == KEY_ECDSA && 1254 (curve_nid = sshkey_ecdsa_nid_from_name(cp)) == -1) 1255 return SSH_ERR_EC_CURVE_INVALID; 1256 *space = ' '; 1257 if (type == KEY_UNSPEC) 1258 return SSH_ERR_INVALID_FORMAT; 1259 cp = space+1; 1260 if (*cp == '\0') 1261 return SSH_ERR_INVALID_FORMAT; 1262 if (ret->type != KEY_UNSPEC && ret->type != type) 1263 return SSH_ERR_KEY_TYPE_MISMATCH; 1264 if ((blob = sshbuf_new()) == NULL) 1265 return SSH_ERR_ALLOC_FAIL; 1266 /* trim comment */ 1267 space = strchr(cp, ' '); 1268 if (space) { 1269 /* advance 'space': skip whitespace */ 1270 *space++ = '\0'; 1271 while (*space == ' ' || *space == '\t') 1272 space++; 1273 *cpp = space; 1274 } else 1275 *cpp = cp + strlen(cp); 1276 if ((r = sshbuf_b64tod(blob, cp)) != 0) { 1277 sshbuf_free(blob); 1278 return r; 1279 } 1280 if ((r = sshkey_from_blob(sshbuf_ptr(blob), 1281 sshbuf_len(blob), &k)) != 0) { 1282 sshbuf_free(blob); 1283 return r; 1284 } 1285 sshbuf_free(blob); 1286 if (k->type != type) { 1287 sshkey_free(k); 1288 return SSH_ERR_KEY_TYPE_MISMATCH; 1289 } 1290 if (sshkey_type_plain(type) == KEY_ECDSA && 1291 curve_nid != k->ecdsa_nid) { 1292 sshkey_free(k); 1293 return SSH_ERR_EC_CURVE_MISMATCH; 1294 } 1295 ret->type = type; 1296 if (sshkey_is_cert(ret)) { 1297 if (!sshkey_is_cert(k)) { 1298 sshkey_free(k); 1299 return SSH_ERR_EXPECTED_CERT; 1300 } 1301 if (ret->cert != NULL) 1302 cert_free(ret->cert); 1303 ret->cert = k->cert; 1304 k->cert = NULL; 1305 } 1306 #ifdef WITH_OPENSSL 1307 if (sshkey_type_plain(ret->type) == KEY_RSA) { 1308 if (ret->rsa != NULL) 1309 RSA_free(ret->rsa); 1310 ret->rsa = k->rsa; 1311 k->rsa = NULL; 1312 #ifdef DEBUG_PK 1313 RSA_print_fp(stderr, ret->rsa, 8); 1314 #endif 1315 } 1316 if (sshkey_type_plain(ret->type) == KEY_DSA) { 1317 if (ret->dsa != NULL) 1318 DSA_free(ret->dsa); 1319 ret->dsa = k->dsa; 1320 k->dsa = NULL; 1321 #ifdef DEBUG_PK 1322 DSA_print_fp(stderr, ret->dsa, 8); 1323 #endif 1324 } 1325 if (sshkey_type_plain(ret->type) == KEY_ECDSA) { 1326 if (ret->ecdsa != NULL) 1327 EC_KEY_free(ret->ecdsa); 1328 ret->ecdsa = k->ecdsa; 1329 ret->ecdsa_nid = k->ecdsa_nid; 1330 k->ecdsa = NULL; 1331 k->ecdsa_nid = -1; 1332 #ifdef DEBUG_PK 1333 sshkey_dump_ec_key(ret->ecdsa); 1334 #endif 1335 } 1336 #endif /* WITH_OPENSSL */ 1337 if (sshkey_type_plain(ret->type) == KEY_ED25519) { 1338 free(ret->ed25519_pk); 1339 ret->ed25519_pk = k->ed25519_pk; 1340 k->ed25519_pk = NULL; 1341 #ifdef DEBUG_PK 1342 /* XXX */ 1343 #endif 1344 } 1345 retval = 0; 1346 /*XXXX*/ 1347 sshkey_free(k); 1348 if (retval != 0) 1349 break; 1350 break; 1351 default: 1352 return SSH_ERR_INVALID_ARGUMENT; 1353 } 1354 return retval; 1355 } 1356 1357 int 1358 sshkey_to_base64(const struct sshkey *key, char **b64p) 1359 { 1360 int r = SSH_ERR_INTERNAL_ERROR; 1361 struct sshbuf *b = NULL; 1362 char *uu = NULL; 1363 1364 if (b64p != NULL) 1365 *b64p = NULL; 1366 if ((b = sshbuf_new()) == NULL) 1367 return SSH_ERR_ALLOC_FAIL; 1368 if ((r = sshkey_putb(key, b)) != 0) 1369 goto out; 1370 if ((uu = sshbuf_dtob64(b)) == NULL) { 1371 r = SSH_ERR_ALLOC_FAIL; 1372 goto out; 1373 } 1374 /* Success */ 1375 if (b64p != NULL) { 1376 *b64p = uu; 1377 uu = NULL; 1378 } 1379 r = 0; 1380 out: 1381 sshbuf_free(b); 1382 free(uu); 1383 return r; 1384 } 1385 1386 static int 1387 sshkey_format_rsa1(const struct sshkey *key, struct sshbuf *b) 1388 { 1389 int r = SSH_ERR_INTERNAL_ERROR; 1390 #ifdef WITH_SSH1 1391 u_int bits = 0; 1392 char *dec_e = NULL, *dec_n = NULL; 1393 1394 if (key->rsa == NULL || key->rsa->e == NULL || 1395 key->rsa->n == NULL) { 1396 r = SSH_ERR_INVALID_ARGUMENT; 1397 goto out; 1398 } 1399 if ((dec_e = BN_bn2dec(key->rsa->e)) == NULL || 1400 (dec_n = BN_bn2dec(key->rsa->n)) == NULL) { 1401 r = SSH_ERR_ALLOC_FAIL; 1402 goto out; 1403 } 1404 /* size of modulus 'n' */ 1405 if ((bits = BN_num_bits(key->rsa->n)) <= 0) { 1406 r = SSH_ERR_INVALID_ARGUMENT; 1407 goto out; 1408 } 1409 if ((r = sshbuf_putf(b, "%u %s %s", bits, dec_e, dec_n)) != 0) 1410 goto out; 1411 1412 /* Success */ 1413 r = 0; 1414 out: 1415 if (dec_e != NULL) 1416 OPENSSL_free(dec_e); 1417 if (dec_n != NULL) 1418 OPENSSL_free(dec_n); 1419 #endif /* WITH_SSH1 */ 1420 1421 return r; 1422 } 1423 1424 static int 1425 sshkey_format_text(const struct sshkey *key, struct sshbuf *b) 1426 { 1427 int r = SSH_ERR_INTERNAL_ERROR; 1428 char *uu = NULL; 1429 1430 if (key->type == KEY_RSA1) { 1431 if ((r = sshkey_format_rsa1(key, b)) != 0) 1432 goto out; 1433 } else { 1434 /* Unsupported key types handled in sshkey_to_base64() */ 1435 if ((r = sshkey_to_base64(key, &uu)) != 0) 1436 goto out; 1437 if ((r = sshbuf_putf(b, "%s %s", 1438 sshkey_ssh_name(key), uu)) != 0) 1439 goto out; 1440 } 1441 r = 0; 1442 out: 1443 free(uu); 1444 return r; 1445 } 1446 1447 int 1448 sshkey_write(const struct sshkey *key, FILE *f) 1449 { 1450 struct sshbuf *b = NULL; 1451 int r = SSH_ERR_INTERNAL_ERROR; 1452 1453 if ((b = sshbuf_new()) == NULL) 1454 return SSH_ERR_ALLOC_FAIL; 1455 if ((r = sshkey_format_text(key, b)) != 0) 1456 goto out; 1457 if (fwrite(sshbuf_ptr(b), sshbuf_len(b), 1, f) != 1) { 1458 if (feof(f)) 1459 errno = EPIPE; 1460 r = SSH_ERR_SYSTEM_ERROR; 1461 goto out; 1462 } 1463 /* Success */ 1464 r = 0; 1465 out: 1466 sshbuf_free(b); 1467 return r; 1468 } 1469 1470 const char * 1471 sshkey_cert_type(const struct sshkey *k) 1472 { 1473 switch (k->cert->type) { 1474 case SSH2_CERT_TYPE_USER: 1475 return "user"; 1476 case SSH2_CERT_TYPE_HOST: 1477 return "host"; 1478 default: 1479 return "unknown"; 1480 } 1481 } 1482 1483 #ifdef WITH_OPENSSL 1484 static int 1485 rsa_generate_private_key(u_int bits, RSA **rsap) 1486 { 1487 RSA *private = NULL; 1488 BIGNUM *f4 = NULL; 1489 int ret = SSH_ERR_INTERNAL_ERROR; 1490 1491 if (rsap == NULL || 1492 bits < SSH_RSA_MINIMUM_MODULUS_SIZE || 1493 bits > SSHBUF_MAX_BIGNUM * 8) 1494 return SSH_ERR_INVALID_ARGUMENT; 1495 *rsap = NULL; 1496 if ((private = RSA_new()) == NULL || (f4 = BN_new()) == NULL) { 1497 ret = SSH_ERR_ALLOC_FAIL; 1498 goto out; 1499 } 1500 if (!BN_set_word(f4, RSA_F4) || 1501 !RSA_generate_key_ex(private, bits, f4, NULL)) { 1502 ret = SSH_ERR_LIBCRYPTO_ERROR; 1503 goto out; 1504 } 1505 *rsap = private; 1506 private = NULL; 1507 ret = 0; 1508 out: 1509 if (private != NULL) 1510 RSA_free(private); 1511 if (f4 != NULL) 1512 BN_free(f4); 1513 return ret; 1514 } 1515 1516 static int 1517 dsa_generate_private_key(u_int bits, DSA **dsap) 1518 { 1519 DSA *private; 1520 int ret = SSH_ERR_INTERNAL_ERROR; 1521 1522 if (dsap == NULL || bits != 1024) 1523 return SSH_ERR_INVALID_ARGUMENT; 1524 if ((private = DSA_new()) == NULL) { 1525 ret = SSH_ERR_ALLOC_FAIL; 1526 goto out; 1527 } 1528 *dsap = NULL; 1529 if (!DSA_generate_parameters_ex(private, bits, NULL, 0, NULL, 1530 NULL, NULL) || !DSA_generate_key(private)) { 1531 ret = SSH_ERR_LIBCRYPTO_ERROR; 1532 goto out; 1533 } 1534 *dsap = private; 1535 private = NULL; 1536 ret = 0; 1537 out: 1538 if (private != NULL) 1539 DSA_free(private); 1540 return ret; 1541 } 1542 1543 int 1544 sshkey_ecdsa_key_to_nid(EC_KEY *k) 1545 { 1546 EC_GROUP *eg; 1547 int nids[] = { 1548 NID_X9_62_prime256v1, 1549 NID_secp384r1, 1550 NID_secp521r1, 1551 -1 1552 }; 1553 int nid; 1554 u_int i; 1555 BN_CTX *bnctx; 1556 const EC_GROUP *g = EC_KEY_get0_group(k); 1557 1558 /* 1559 * The group may be stored in a ASN.1 encoded private key in one of two 1560 * ways: as a "named group", which is reconstituted by ASN.1 object ID 1561 * or explicit group parameters encoded into the key blob. Only the 1562 * "named group" case sets the group NID for us, but we can figure 1563 * it out for the other case by comparing against all the groups that 1564 * are supported. 1565 */ 1566 if ((nid = EC_GROUP_get_curve_name(g)) > 0) 1567 return nid; 1568 if ((bnctx = BN_CTX_new()) == NULL) 1569 return -1; 1570 for (i = 0; nids[i] != -1; i++) { 1571 if ((eg = EC_GROUP_new_by_curve_name(nids[i])) == NULL) { 1572 BN_CTX_free(bnctx); 1573 return -1; 1574 } 1575 if (EC_GROUP_cmp(g, eg, bnctx) == 0) 1576 break; 1577 EC_GROUP_free(eg); 1578 } 1579 BN_CTX_free(bnctx); 1580 if (nids[i] != -1) { 1581 /* Use the group with the NID attached */ 1582 EC_GROUP_set_asn1_flag(eg, OPENSSL_EC_NAMED_CURVE); 1583 if (EC_KEY_set_group(k, eg) != 1) { 1584 EC_GROUP_free(eg); 1585 return -1; 1586 } 1587 } 1588 return nids[i]; 1589 } 1590 1591 static int 1592 ecdsa_generate_private_key(u_int bits, int *nid, EC_KEY **ecdsap) 1593 { 1594 EC_KEY *private; 1595 int ret = SSH_ERR_INTERNAL_ERROR; 1596 1597 if (nid == NULL || ecdsap == NULL || 1598 (*nid = sshkey_ecdsa_bits_to_nid(bits)) == -1) 1599 return SSH_ERR_INVALID_ARGUMENT; 1600 *ecdsap = NULL; 1601 if ((private = EC_KEY_new_by_curve_name(*nid)) == NULL) { 1602 ret = SSH_ERR_ALLOC_FAIL; 1603 goto out; 1604 } 1605 if (EC_KEY_generate_key(private) != 1) { 1606 ret = SSH_ERR_LIBCRYPTO_ERROR; 1607 goto out; 1608 } 1609 EC_KEY_set_asn1_flag(private, OPENSSL_EC_NAMED_CURVE); 1610 *ecdsap = private; 1611 private = NULL; 1612 ret = 0; 1613 out: 1614 if (private != NULL) 1615 EC_KEY_free(private); 1616 return ret; 1617 } 1618 #endif /* WITH_OPENSSL */ 1619 1620 int 1621 sshkey_generate(int type, u_int bits, struct sshkey **keyp) 1622 { 1623 struct sshkey *k; 1624 int ret = SSH_ERR_INTERNAL_ERROR; 1625 1626 if (keyp == NULL) 1627 return SSH_ERR_INVALID_ARGUMENT; 1628 *keyp = NULL; 1629 if ((k = sshkey_new(KEY_UNSPEC)) == NULL) 1630 return SSH_ERR_ALLOC_FAIL; 1631 switch (type) { 1632 case KEY_ED25519: 1633 if ((k->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL || 1634 (k->ed25519_sk = malloc(ED25519_SK_SZ)) == NULL) { 1635 ret = SSH_ERR_ALLOC_FAIL; 1636 break; 1637 } 1638 crypto_sign_ed25519_keypair(k->ed25519_pk, k->ed25519_sk); 1639 ret = 0; 1640 break; 1641 #ifdef WITH_OPENSSL 1642 case KEY_DSA: 1643 ret = dsa_generate_private_key(bits, &k->dsa); 1644 break; 1645 case KEY_ECDSA: 1646 ret = ecdsa_generate_private_key(bits, &k->ecdsa_nid, 1647 &k->ecdsa); 1648 break; 1649 case KEY_RSA: 1650 case KEY_RSA1: 1651 ret = rsa_generate_private_key(bits, &k->rsa); 1652 break; 1653 #endif /* WITH_OPENSSL */ 1654 default: 1655 ret = SSH_ERR_INVALID_ARGUMENT; 1656 } 1657 if (ret == 0) { 1658 k->type = type; 1659 *keyp = k; 1660 } else 1661 sshkey_free(k); 1662 return ret; 1663 } 1664 1665 int 1666 sshkey_cert_copy(const struct sshkey *from_key, struct sshkey *to_key) 1667 { 1668 u_int i; 1669 const struct sshkey_cert *from; 1670 struct sshkey_cert *to; 1671 int ret = SSH_ERR_INTERNAL_ERROR; 1672 1673 if (to_key->cert != NULL) { 1674 cert_free(to_key->cert); 1675 to_key->cert = NULL; 1676 } 1677 1678 if ((from = from_key->cert) == NULL) 1679 return SSH_ERR_INVALID_ARGUMENT; 1680 1681 if ((to = to_key->cert = cert_new()) == NULL) 1682 return SSH_ERR_ALLOC_FAIL; 1683 1684 if ((ret = sshbuf_putb(to->certblob, from->certblob)) != 0 || 1685 (ret = sshbuf_putb(to->critical, from->critical)) != 0 || 1686 (ret = sshbuf_putb(to->extensions, from->extensions)) != 0) 1687 return ret; 1688 1689 to->serial = from->serial; 1690 to->type = from->type; 1691 if (from->key_id == NULL) 1692 to->key_id = NULL; 1693 else if ((to->key_id = strdup(from->key_id)) == NULL) 1694 return SSH_ERR_ALLOC_FAIL; 1695 to->valid_after = from->valid_after; 1696 to->valid_before = from->valid_before; 1697 if (from->signature_key == NULL) 1698 to->signature_key = NULL; 1699 else if ((ret = sshkey_from_private(from->signature_key, 1700 &to->signature_key)) != 0) 1701 return ret; 1702 1703 if (from->nprincipals > SSHKEY_CERT_MAX_PRINCIPALS) 1704 return SSH_ERR_INVALID_ARGUMENT; 1705 if (from->nprincipals > 0) { 1706 if ((to->principals = calloc(from->nprincipals, 1707 sizeof(*to->principals))) == NULL) 1708 return SSH_ERR_ALLOC_FAIL; 1709 for (i = 0; i < from->nprincipals; i++) { 1710 to->principals[i] = strdup(from->principals[i]); 1711 if (to->principals[i] == NULL) { 1712 to->nprincipals = i; 1713 return SSH_ERR_ALLOC_FAIL; 1714 } 1715 } 1716 } 1717 to->nprincipals = from->nprincipals; 1718 return 0; 1719 } 1720 1721 int 1722 sshkey_from_private(const struct sshkey *k, struct sshkey **pkp) 1723 { 1724 struct sshkey *n = NULL; 1725 int ret = SSH_ERR_INTERNAL_ERROR; 1726 1727 *pkp = NULL; 1728 switch (k->type) { 1729 #ifdef WITH_OPENSSL 1730 case KEY_DSA: 1731 case KEY_DSA_CERT: 1732 if ((n = sshkey_new(k->type)) == NULL) 1733 return SSH_ERR_ALLOC_FAIL; 1734 if ((BN_copy(n->dsa->p, k->dsa->p) == NULL) || 1735 (BN_copy(n->dsa->q, k->dsa->q) == NULL) || 1736 (BN_copy(n->dsa->g, k->dsa->g) == NULL) || 1737 (BN_copy(n->dsa->pub_key, k->dsa->pub_key) == NULL)) { 1738 sshkey_free(n); 1739 return SSH_ERR_ALLOC_FAIL; 1740 } 1741 break; 1742 case KEY_ECDSA: 1743 case KEY_ECDSA_CERT: 1744 if ((n = sshkey_new(k->type)) == NULL) 1745 return SSH_ERR_ALLOC_FAIL; 1746 n->ecdsa_nid = k->ecdsa_nid; 1747 n->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); 1748 if (n->ecdsa == NULL) { 1749 sshkey_free(n); 1750 return SSH_ERR_ALLOC_FAIL; 1751 } 1752 if (EC_KEY_set_public_key(n->ecdsa, 1753 EC_KEY_get0_public_key(k->ecdsa)) != 1) { 1754 sshkey_free(n); 1755 return SSH_ERR_LIBCRYPTO_ERROR; 1756 } 1757 break; 1758 case KEY_RSA: 1759 case KEY_RSA1: 1760 case KEY_RSA_CERT: 1761 if ((n = sshkey_new(k->type)) == NULL) 1762 return SSH_ERR_ALLOC_FAIL; 1763 if ((BN_copy(n->rsa->n, k->rsa->n) == NULL) || 1764 (BN_copy(n->rsa->e, k->rsa->e) == NULL)) { 1765 sshkey_free(n); 1766 return SSH_ERR_ALLOC_FAIL; 1767 } 1768 break; 1769 #endif /* WITH_OPENSSL */ 1770 case KEY_ED25519: 1771 case KEY_ED25519_CERT: 1772 if ((n = sshkey_new(k->type)) == NULL) 1773 return SSH_ERR_ALLOC_FAIL; 1774 if (k->ed25519_pk != NULL) { 1775 if ((n->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL) { 1776 sshkey_free(n); 1777 return SSH_ERR_ALLOC_FAIL; 1778 } 1779 memcpy(n->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ); 1780 } 1781 break; 1782 default: 1783 return SSH_ERR_KEY_TYPE_UNKNOWN; 1784 } 1785 if (sshkey_is_cert(k)) { 1786 if ((ret = sshkey_cert_copy(k, n)) != 0) { 1787 sshkey_free(n); 1788 return ret; 1789 } 1790 } 1791 *pkp = n; 1792 return 0; 1793 } 1794 1795 static int 1796 cert_parse(struct sshbuf *b, struct sshkey *key, struct sshbuf *certbuf) 1797 { 1798 struct sshbuf *principals = NULL, *crit = NULL; 1799 struct sshbuf *exts = NULL, *ca = NULL; 1800 u_char *sig = NULL; 1801 size_t signed_len = 0, slen = 0, kidlen = 0; 1802 int ret = SSH_ERR_INTERNAL_ERROR; 1803 1804 /* Copy the entire key blob for verification and later serialisation */ 1805 if ((ret = sshbuf_putb(key->cert->certblob, certbuf)) != 0) 1806 return ret; 1807 1808 /* Parse body of certificate up to signature */ 1809 if ((ret = sshbuf_get_u64(b, &key->cert->serial)) != 0 || 1810 (ret = sshbuf_get_u32(b, &key->cert->type)) != 0 || 1811 (ret = sshbuf_get_cstring(b, &key->cert->key_id, &kidlen)) != 0 || 1812 (ret = sshbuf_froms(b, &principals)) != 0 || 1813 (ret = sshbuf_get_u64(b, &key->cert->valid_after)) != 0 || 1814 (ret = sshbuf_get_u64(b, &key->cert->valid_before)) != 0 || 1815 (ret = sshbuf_froms(b, &crit)) != 0 || 1816 (ret = sshbuf_froms(b, &exts)) != 0 || 1817 (ret = sshbuf_get_string_direct(b, NULL, NULL)) != 0 || 1818 (ret = sshbuf_froms(b, &ca)) != 0) { 1819 /* XXX debug print error for ret */ 1820 ret = SSH_ERR_INVALID_FORMAT; 1821 goto out; 1822 } 1823 1824 /* Signature is left in the buffer so we can calculate this length */ 1825 signed_len = sshbuf_len(key->cert->certblob) - sshbuf_len(b); 1826 1827 if ((ret = sshbuf_get_string(b, &sig, &slen)) != 0) { 1828 ret = SSH_ERR_INVALID_FORMAT; 1829 goto out; 1830 } 1831 1832 if (key->cert->type != SSH2_CERT_TYPE_USER && 1833 key->cert->type != SSH2_CERT_TYPE_HOST) { 1834 ret = SSH_ERR_KEY_CERT_UNKNOWN_TYPE; 1835 goto out; 1836 } 1837 1838 /* Parse principals section */ 1839 while (sshbuf_len(principals) > 0) { 1840 char *principal = NULL; 1841 char **oprincipals = NULL; 1842 1843 if (key->cert->nprincipals >= SSHKEY_CERT_MAX_PRINCIPALS) { 1844 ret = SSH_ERR_INVALID_FORMAT; 1845 goto out; 1846 } 1847 if ((ret = sshbuf_get_cstring(principals, &principal, 1848 NULL)) != 0) { 1849 ret = SSH_ERR_INVALID_FORMAT; 1850 goto out; 1851 } 1852 oprincipals = key->cert->principals; 1853 key->cert->principals = reallocarray(key->cert->principals, 1854 key->cert->nprincipals + 1, sizeof(*key->cert->principals)); 1855 if (key->cert->principals == NULL) { 1856 free(principal); 1857 key->cert->principals = oprincipals; 1858 ret = SSH_ERR_ALLOC_FAIL; 1859 goto out; 1860 } 1861 key->cert->principals[key->cert->nprincipals++] = principal; 1862 } 1863 1864 /* 1865 * Stash a copies of the critical options and extensions sections 1866 * for later use. 1867 */ 1868 if ((ret = sshbuf_putb(key->cert->critical, crit)) != 0 || 1869 (exts != NULL && 1870 (ret = sshbuf_putb(key->cert->extensions, exts)) != 0)) 1871 goto out; 1872 1873 /* 1874 * Validate critical options and extensions sections format. 1875 */ 1876 while (sshbuf_len(crit) != 0) { 1877 if ((ret = sshbuf_get_string_direct(crit, NULL, NULL)) != 0 || 1878 (ret = sshbuf_get_string_direct(crit, NULL, NULL)) != 0) { 1879 sshbuf_reset(key->cert->critical); 1880 ret = SSH_ERR_INVALID_FORMAT; 1881 goto out; 1882 } 1883 } 1884 while (exts != NULL && sshbuf_len(exts) != 0) { 1885 if ((ret = sshbuf_get_string_direct(exts, NULL, NULL)) != 0 || 1886 (ret = sshbuf_get_string_direct(exts, NULL, NULL)) != 0) { 1887 sshbuf_reset(key->cert->extensions); 1888 ret = SSH_ERR_INVALID_FORMAT; 1889 goto out; 1890 } 1891 } 1892 1893 /* Parse CA key and check signature */ 1894 if (sshkey_from_blob_internal(ca, &key->cert->signature_key, 0) != 0) { 1895 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 1896 goto out; 1897 } 1898 if (!sshkey_type_is_valid_ca(key->cert->signature_key->type)) { 1899 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 1900 goto out; 1901 } 1902 if ((ret = sshkey_verify(key->cert->signature_key, sig, slen, 1903 sshbuf_ptr(key->cert->certblob), signed_len, 0)) != 0) 1904 goto out; 1905 1906 /* Success */ 1907 ret = 0; 1908 out: 1909 sshbuf_free(ca); 1910 sshbuf_free(crit); 1911 sshbuf_free(exts); 1912 sshbuf_free(principals); 1913 free(sig); 1914 return ret; 1915 } 1916 1917 static int 1918 sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp, 1919 int allow_cert) 1920 { 1921 int type, ret = SSH_ERR_INTERNAL_ERROR; 1922 char *ktype = NULL, *curve = NULL; 1923 struct sshkey *key = NULL; 1924 size_t len; 1925 u_char *pk = NULL; 1926 struct sshbuf *copy; 1927 #ifdef WITH_OPENSSL 1928 EC_POINT *q = NULL; 1929 #endif /* WITH_OPENSSL */ 1930 1931 #ifdef DEBUG_PK /* XXX */ 1932 sshbuf_dump(b, stderr); 1933 #endif 1934 *keyp = NULL; 1935 if ((copy = sshbuf_fromb(b)) == NULL) { 1936 ret = SSH_ERR_ALLOC_FAIL; 1937 goto out; 1938 } 1939 if (sshbuf_get_cstring(b, &ktype, NULL) != 0) { 1940 ret = SSH_ERR_INVALID_FORMAT; 1941 goto out; 1942 } 1943 1944 type = sshkey_type_from_name(ktype); 1945 if (!allow_cert && sshkey_type_is_cert(type)) { 1946 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 1947 goto out; 1948 } 1949 switch (type) { 1950 #ifdef WITH_OPENSSL 1951 case KEY_RSA_CERT: 1952 /* Skip nonce */ 1953 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 1954 ret = SSH_ERR_INVALID_FORMAT; 1955 goto out; 1956 } 1957 /* FALLTHROUGH */ 1958 case KEY_RSA: 1959 if ((key = sshkey_new(type)) == NULL) { 1960 ret = SSH_ERR_ALLOC_FAIL; 1961 goto out; 1962 } 1963 if (sshbuf_get_bignum2(b, key->rsa->e) != 0 || 1964 sshbuf_get_bignum2(b, key->rsa->n) != 0) { 1965 ret = SSH_ERR_INVALID_FORMAT; 1966 goto out; 1967 } 1968 #ifdef DEBUG_PK 1969 RSA_print_fp(stderr, key->rsa, 8); 1970 #endif 1971 break; 1972 case KEY_DSA_CERT: 1973 /* Skip nonce */ 1974 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 1975 ret = SSH_ERR_INVALID_FORMAT; 1976 goto out; 1977 } 1978 /* FALLTHROUGH */ 1979 case KEY_DSA: 1980 if ((key = sshkey_new(type)) == NULL) { 1981 ret = SSH_ERR_ALLOC_FAIL; 1982 goto out; 1983 } 1984 if (sshbuf_get_bignum2(b, key->dsa->p) != 0 || 1985 sshbuf_get_bignum2(b, key->dsa->q) != 0 || 1986 sshbuf_get_bignum2(b, key->dsa->g) != 0 || 1987 sshbuf_get_bignum2(b, key->dsa->pub_key) != 0) { 1988 ret = SSH_ERR_INVALID_FORMAT; 1989 goto out; 1990 } 1991 #ifdef DEBUG_PK 1992 DSA_print_fp(stderr, key->dsa, 8); 1993 #endif 1994 break; 1995 case KEY_ECDSA_CERT: 1996 /* Skip nonce */ 1997 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 1998 ret = SSH_ERR_INVALID_FORMAT; 1999 goto out; 2000 } 2001 /* FALLTHROUGH */ 2002 case KEY_ECDSA: 2003 if ((key = sshkey_new(type)) == NULL) { 2004 ret = SSH_ERR_ALLOC_FAIL; 2005 goto out; 2006 } 2007 key->ecdsa_nid = sshkey_ecdsa_nid_from_name(ktype); 2008 if (sshbuf_get_cstring(b, &curve, NULL) != 0) { 2009 ret = SSH_ERR_INVALID_FORMAT; 2010 goto out; 2011 } 2012 if (key->ecdsa_nid != sshkey_curve_name_to_nid(curve)) { 2013 ret = SSH_ERR_EC_CURVE_MISMATCH; 2014 goto out; 2015 } 2016 if (key->ecdsa != NULL) 2017 EC_KEY_free(key->ecdsa); 2018 if ((key->ecdsa = EC_KEY_new_by_curve_name(key->ecdsa_nid)) 2019 == NULL) { 2020 ret = SSH_ERR_EC_CURVE_INVALID; 2021 goto out; 2022 } 2023 if ((q = EC_POINT_new(EC_KEY_get0_group(key->ecdsa))) == NULL) { 2024 ret = SSH_ERR_ALLOC_FAIL; 2025 goto out; 2026 } 2027 if (sshbuf_get_ec(b, q, EC_KEY_get0_group(key->ecdsa)) != 0) { 2028 ret = SSH_ERR_INVALID_FORMAT; 2029 goto out; 2030 } 2031 if (sshkey_ec_validate_public(EC_KEY_get0_group(key->ecdsa), 2032 q) != 0) { 2033 ret = SSH_ERR_KEY_INVALID_EC_VALUE; 2034 goto out; 2035 } 2036 if (EC_KEY_set_public_key(key->ecdsa, q) != 1) { 2037 /* XXX assume it is a allocation error */ 2038 ret = SSH_ERR_ALLOC_FAIL; 2039 goto out; 2040 } 2041 #ifdef DEBUG_PK 2042 sshkey_dump_ec_point(EC_KEY_get0_group(key->ecdsa), q); 2043 #endif 2044 break; 2045 #endif /* WITH_OPENSSL */ 2046 case KEY_ED25519_CERT: 2047 /* Skip nonce */ 2048 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2049 ret = SSH_ERR_INVALID_FORMAT; 2050 goto out; 2051 } 2052 /* FALLTHROUGH */ 2053 case KEY_ED25519: 2054 if ((ret = sshbuf_get_string(b, &pk, &len)) != 0) 2055 goto out; 2056 if (len != ED25519_PK_SZ) { 2057 ret = SSH_ERR_INVALID_FORMAT; 2058 goto out; 2059 } 2060 if ((key = sshkey_new(type)) == NULL) { 2061 ret = SSH_ERR_ALLOC_FAIL; 2062 goto out; 2063 } 2064 key->ed25519_pk = pk; 2065 pk = NULL; 2066 break; 2067 case KEY_UNSPEC: 2068 if ((key = sshkey_new(type)) == NULL) { 2069 ret = SSH_ERR_ALLOC_FAIL; 2070 goto out; 2071 } 2072 break; 2073 default: 2074 ret = SSH_ERR_KEY_TYPE_UNKNOWN; 2075 goto out; 2076 } 2077 2078 /* Parse certificate potion */ 2079 if (sshkey_is_cert(key) && (ret = cert_parse(b, key, copy)) != 0) 2080 goto out; 2081 2082 if (key != NULL && sshbuf_len(b) != 0) { 2083 ret = SSH_ERR_INVALID_FORMAT; 2084 goto out; 2085 } 2086 ret = 0; 2087 *keyp = key; 2088 key = NULL; 2089 out: 2090 sshbuf_free(copy); 2091 sshkey_free(key); 2092 free(ktype); 2093 free(curve); 2094 free(pk); 2095 #ifdef WITH_OPENSSL 2096 if (q != NULL) 2097 EC_POINT_free(q); 2098 #endif /* WITH_OPENSSL */ 2099 return ret; 2100 } 2101 2102 int 2103 sshkey_from_blob(const u_char *blob, size_t blen, struct sshkey **keyp) 2104 { 2105 struct sshbuf *b; 2106 int r; 2107 2108 if ((b = sshbuf_from(blob, blen)) == NULL) 2109 return SSH_ERR_ALLOC_FAIL; 2110 r = sshkey_from_blob_internal(b, keyp, 1); 2111 sshbuf_free(b); 2112 return r; 2113 } 2114 2115 int 2116 sshkey_fromb(struct sshbuf *b, struct sshkey **keyp) 2117 { 2118 return sshkey_from_blob_internal(b, keyp, 1); 2119 } 2120 2121 int 2122 sshkey_froms(struct sshbuf *buf, struct sshkey **keyp) 2123 { 2124 struct sshbuf *b; 2125 int r; 2126 2127 if ((r = sshbuf_froms(buf, &b)) != 0) 2128 return r; 2129 r = sshkey_from_blob_internal(b, keyp, 1); 2130 sshbuf_free(b); 2131 return r; 2132 } 2133 2134 int 2135 sshkey_sign(const struct sshkey *key, 2136 u_char **sigp, size_t *lenp, 2137 const u_char *data, size_t datalen, u_int compat) 2138 { 2139 if (sigp != NULL) 2140 *sigp = NULL; 2141 if (lenp != NULL) 2142 *lenp = 0; 2143 if (datalen > SSH_KEY_MAX_SIGN_DATA_SIZE) 2144 return SSH_ERR_INVALID_ARGUMENT; 2145 switch (key->type) { 2146 #ifdef WITH_OPENSSL 2147 case KEY_DSA_CERT: 2148 case KEY_DSA: 2149 return ssh_dss_sign(key, sigp, lenp, data, datalen, compat); 2150 case KEY_ECDSA_CERT: 2151 case KEY_ECDSA: 2152 return ssh_ecdsa_sign(key, sigp, lenp, data, datalen, compat); 2153 case KEY_RSA_CERT: 2154 case KEY_RSA: 2155 return ssh_rsa_sign(key, sigp, lenp, data, datalen, compat); 2156 #endif /* WITH_OPENSSL */ 2157 case KEY_ED25519: 2158 case KEY_ED25519_CERT: 2159 return ssh_ed25519_sign(key, sigp, lenp, data, datalen, compat); 2160 default: 2161 return SSH_ERR_KEY_TYPE_UNKNOWN; 2162 } 2163 } 2164 2165 /* 2166 * ssh_key_verify returns 0 for a correct signature and < 0 on error. 2167 */ 2168 int 2169 sshkey_verify(const struct sshkey *key, 2170 const u_char *sig, size_t siglen, 2171 const u_char *data, size_t dlen, u_int compat) 2172 { 2173 if (siglen == 0 || dlen > SSH_KEY_MAX_SIGN_DATA_SIZE) 2174 return SSH_ERR_INVALID_ARGUMENT; 2175 switch (key->type) { 2176 #ifdef WITH_OPENSSL 2177 case KEY_DSA_CERT: 2178 case KEY_DSA: 2179 return ssh_dss_verify(key, sig, siglen, data, dlen, compat); 2180 case KEY_ECDSA_CERT: 2181 case KEY_ECDSA: 2182 return ssh_ecdsa_verify(key, sig, siglen, data, dlen, compat); 2183 case KEY_RSA_CERT: 2184 case KEY_RSA: 2185 return ssh_rsa_verify(key, sig, siglen, data, dlen, compat); 2186 #endif /* WITH_OPENSSL */ 2187 case KEY_ED25519: 2188 case KEY_ED25519_CERT: 2189 return ssh_ed25519_verify(key, sig, siglen, data, dlen, compat); 2190 default: 2191 return SSH_ERR_KEY_TYPE_UNKNOWN; 2192 } 2193 } 2194 2195 /* Converts a private to a public key */ 2196 int 2197 sshkey_demote(const struct sshkey *k, struct sshkey **dkp) 2198 { 2199 struct sshkey *pk; 2200 int ret = SSH_ERR_INTERNAL_ERROR; 2201 2202 *dkp = NULL; 2203 if ((pk = calloc(1, sizeof(*pk))) == NULL) 2204 return SSH_ERR_ALLOC_FAIL; 2205 pk->type = k->type; 2206 pk->flags = k->flags; 2207 pk->ecdsa_nid = k->ecdsa_nid; 2208 pk->dsa = NULL; 2209 pk->ecdsa = NULL; 2210 pk->rsa = NULL; 2211 pk->ed25519_pk = NULL; 2212 pk->ed25519_sk = NULL; 2213 2214 switch (k->type) { 2215 #ifdef WITH_OPENSSL 2216 case KEY_RSA_CERT: 2217 if ((ret = sshkey_cert_copy(k, pk)) != 0) 2218 goto fail; 2219 /* FALLTHROUGH */ 2220 case KEY_RSA1: 2221 case KEY_RSA: 2222 if ((pk->rsa = RSA_new()) == NULL || 2223 (pk->rsa->e = BN_dup(k->rsa->e)) == NULL || 2224 (pk->rsa->n = BN_dup(k->rsa->n)) == NULL) { 2225 ret = SSH_ERR_ALLOC_FAIL; 2226 goto fail; 2227 } 2228 break; 2229 case KEY_DSA_CERT: 2230 if ((ret = sshkey_cert_copy(k, pk)) != 0) 2231 goto fail; 2232 /* FALLTHROUGH */ 2233 case KEY_DSA: 2234 if ((pk->dsa = DSA_new()) == NULL || 2235 (pk->dsa->p = BN_dup(k->dsa->p)) == NULL || 2236 (pk->dsa->q = BN_dup(k->dsa->q)) == NULL || 2237 (pk->dsa->g = BN_dup(k->dsa->g)) == NULL || 2238 (pk->dsa->pub_key = BN_dup(k->dsa->pub_key)) == NULL) { 2239 ret = SSH_ERR_ALLOC_FAIL; 2240 goto fail; 2241 } 2242 break; 2243 case KEY_ECDSA_CERT: 2244 if ((ret = sshkey_cert_copy(k, pk)) != 0) 2245 goto fail; 2246 /* FALLTHROUGH */ 2247 case KEY_ECDSA: 2248 pk->ecdsa = EC_KEY_new_by_curve_name(pk->ecdsa_nid); 2249 if (pk->ecdsa == NULL) { 2250 ret = SSH_ERR_ALLOC_FAIL; 2251 goto fail; 2252 } 2253 if (EC_KEY_set_public_key(pk->ecdsa, 2254 EC_KEY_get0_public_key(k->ecdsa)) != 1) { 2255 ret = SSH_ERR_LIBCRYPTO_ERROR; 2256 goto fail; 2257 } 2258 break; 2259 #endif /* WITH_OPENSSL */ 2260 case KEY_ED25519_CERT: 2261 if ((ret = sshkey_cert_copy(k, pk)) != 0) 2262 goto fail; 2263 /* FALLTHROUGH */ 2264 case KEY_ED25519: 2265 if (k->ed25519_pk != NULL) { 2266 if ((pk->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL) { 2267 ret = SSH_ERR_ALLOC_FAIL; 2268 goto fail; 2269 } 2270 memcpy(pk->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ); 2271 } 2272 break; 2273 default: 2274 ret = SSH_ERR_KEY_TYPE_UNKNOWN; 2275 fail: 2276 sshkey_free(pk); 2277 return ret; 2278 } 2279 *dkp = pk; 2280 return 0; 2281 } 2282 2283 /* Convert a plain key to their _CERT equivalent */ 2284 int 2285 sshkey_to_certified(struct sshkey *k) 2286 { 2287 int newtype; 2288 2289 switch (k->type) { 2290 #ifdef WITH_OPENSSL 2291 case KEY_RSA: 2292 newtype = KEY_RSA_CERT; 2293 break; 2294 case KEY_DSA: 2295 newtype = KEY_DSA_CERT; 2296 break; 2297 case KEY_ECDSA: 2298 newtype = KEY_ECDSA_CERT; 2299 break; 2300 #endif /* WITH_OPENSSL */ 2301 case KEY_ED25519: 2302 newtype = KEY_ED25519_CERT; 2303 break; 2304 default: 2305 return SSH_ERR_INVALID_ARGUMENT; 2306 } 2307 if ((k->cert = cert_new()) == NULL) 2308 return SSH_ERR_ALLOC_FAIL; 2309 k->type = newtype; 2310 return 0; 2311 } 2312 2313 /* Convert a certificate to its raw key equivalent */ 2314 int 2315 sshkey_drop_cert(struct sshkey *k) 2316 { 2317 if (!sshkey_type_is_cert(k->type)) 2318 return SSH_ERR_KEY_TYPE_UNKNOWN; 2319 cert_free(k->cert); 2320 k->cert = NULL; 2321 k->type = sshkey_type_plain(k->type); 2322 return 0; 2323 } 2324 2325 /* Sign a certified key, (re-)generating the signed certblob. */ 2326 int 2327 sshkey_certify(struct sshkey *k, struct sshkey *ca) 2328 { 2329 struct sshbuf *principals = NULL; 2330 u_char *ca_blob = NULL, *sig_blob = NULL, nonce[32]; 2331 size_t i, ca_len, sig_len; 2332 int ret = SSH_ERR_INTERNAL_ERROR; 2333 struct sshbuf *cert; 2334 2335 if (k == NULL || k->cert == NULL || 2336 k->cert->certblob == NULL || ca == NULL) 2337 return SSH_ERR_INVALID_ARGUMENT; 2338 if (!sshkey_is_cert(k)) 2339 return SSH_ERR_KEY_TYPE_UNKNOWN; 2340 if (!sshkey_type_is_valid_ca(ca->type)) 2341 return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2342 2343 if ((ret = sshkey_to_blob(ca, &ca_blob, &ca_len)) != 0) 2344 return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2345 2346 cert = k->cert->certblob; /* for readability */ 2347 sshbuf_reset(cert); 2348 if ((ret = sshbuf_put_cstring(cert, sshkey_ssh_name(k))) != 0) 2349 goto out; 2350 2351 /* -v01 certs put nonce first */ 2352 arc4random_buf(&nonce, sizeof(nonce)); 2353 if ((ret = sshbuf_put_string(cert, nonce, sizeof(nonce))) != 0) 2354 goto out; 2355 2356 /* XXX this substantially duplicates to_blob(); refactor */ 2357 switch (k->type) { 2358 #ifdef WITH_OPENSSL 2359 case KEY_DSA_CERT: 2360 if ((ret = sshbuf_put_bignum2(cert, k->dsa->p)) != 0 || 2361 (ret = sshbuf_put_bignum2(cert, k->dsa->q)) != 0 || 2362 (ret = sshbuf_put_bignum2(cert, k->dsa->g)) != 0 || 2363 (ret = sshbuf_put_bignum2(cert, k->dsa->pub_key)) != 0) 2364 goto out; 2365 break; 2366 case KEY_ECDSA_CERT: 2367 if ((ret = sshbuf_put_cstring(cert, 2368 sshkey_curve_nid_to_name(k->ecdsa_nid))) != 0 || 2369 (ret = sshbuf_put_ec(cert, 2370 EC_KEY_get0_public_key(k->ecdsa), 2371 EC_KEY_get0_group(k->ecdsa))) != 0) 2372 goto out; 2373 break; 2374 case KEY_RSA_CERT: 2375 if ((ret = sshbuf_put_bignum2(cert, k->rsa->e)) != 0 || 2376 (ret = sshbuf_put_bignum2(cert, k->rsa->n)) != 0) 2377 goto out; 2378 break; 2379 #endif /* WITH_OPENSSL */ 2380 case KEY_ED25519_CERT: 2381 if ((ret = sshbuf_put_string(cert, 2382 k->ed25519_pk, ED25519_PK_SZ)) != 0) 2383 goto out; 2384 break; 2385 default: 2386 ret = SSH_ERR_INVALID_ARGUMENT; 2387 goto out; 2388 } 2389 2390 if ((ret = sshbuf_put_u64(cert, k->cert->serial)) != 0 || 2391 (ret = sshbuf_put_u32(cert, k->cert->type)) != 0 || 2392 (ret = sshbuf_put_cstring(cert, k->cert->key_id)) != 0) 2393 goto out; 2394 2395 if ((principals = sshbuf_new()) == NULL) { 2396 ret = SSH_ERR_ALLOC_FAIL; 2397 goto out; 2398 } 2399 for (i = 0; i < k->cert->nprincipals; i++) { 2400 if ((ret = sshbuf_put_cstring(principals, 2401 k->cert->principals[i])) != 0) 2402 goto out; 2403 } 2404 if ((ret = sshbuf_put_stringb(cert, principals)) != 0 || 2405 (ret = sshbuf_put_u64(cert, k->cert->valid_after)) != 0 || 2406 (ret = sshbuf_put_u64(cert, k->cert->valid_before)) != 0 || 2407 (ret = sshbuf_put_stringb(cert, k->cert->critical)) != 0 || 2408 (ret = sshbuf_put_stringb(cert, k->cert->extensions)) != 0 || 2409 (ret = sshbuf_put_string(cert, NULL, 0)) != 0 || /* Reserved */ 2410 (ret = sshbuf_put_string(cert, ca_blob, ca_len)) != 0) 2411 goto out; 2412 2413 /* Sign the whole mess */ 2414 if ((ret = sshkey_sign(ca, &sig_blob, &sig_len, sshbuf_ptr(cert), 2415 sshbuf_len(cert), 0)) != 0) 2416 goto out; 2417 2418 /* Append signature and we are done */ 2419 if ((ret = sshbuf_put_string(cert, sig_blob, sig_len)) != 0) 2420 goto out; 2421 ret = 0; 2422 out: 2423 if (ret != 0) 2424 sshbuf_reset(cert); 2425 if (sig_blob != NULL) 2426 free(sig_blob); 2427 if (ca_blob != NULL) 2428 free(ca_blob); 2429 if (principals != NULL) 2430 sshbuf_free(principals); 2431 return ret; 2432 } 2433 2434 int 2435 sshkey_cert_check_authority(const struct sshkey *k, 2436 int want_host, int require_principal, 2437 const char *name, const char **reason) 2438 { 2439 u_int i, principal_matches; 2440 time_t now = time(NULL); 2441 2442 if (reason != NULL) 2443 *reason = NULL; 2444 2445 if (want_host) { 2446 if (k->cert->type != SSH2_CERT_TYPE_HOST) { 2447 *reason = "Certificate invalid: not a host certificate"; 2448 return SSH_ERR_KEY_CERT_INVALID; 2449 } 2450 } else { 2451 if (k->cert->type != SSH2_CERT_TYPE_USER) { 2452 *reason = "Certificate invalid: not a user certificate"; 2453 return SSH_ERR_KEY_CERT_INVALID; 2454 } 2455 } 2456 if (now < 0) { 2457 /* yikes - system clock before epoch! */ 2458 *reason = "Certificate invalid: not yet valid"; 2459 return SSH_ERR_KEY_CERT_INVALID; 2460 } 2461 if ((u_int64_t)now < k->cert->valid_after) { 2462 *reason = "Certificate invalid: not yet valid"; 2463 return SSH_ERR_KEY_CERT_INVALID; 2464 } 2465 if ((u_int64_t)now >= k->cert->valid_before) { 2466 *reason = "Certificate invalid: expired"; 2467 return SSH_ERR_KEY_CERT_INVALID; 2468 } 2469 if (k->cert->nprincipals == 0) { 2470 if (require_principal) { 2471 *reason = "Certificate lacks principal list"; 2472 return SSH_ERR_KEY_CERT_INVALID; 2473 } 2474 } else if (name != NULL) { 2475 principal_matches = 0; 2476 for (i = 0; i < k->cert->nprincipals; i++) { 2477 if (strcmp(name, k->cert->principals[i]) == 0) { 2478 principal_matches = 1; 2479 break; 2480 } 2481 } 2482 if (!principal_matches) { 2483 *reason = "Certificate invalid: name is not a listed " 2484 "principal"; 2485 return SSH_ERR_KEY_CERT_INVALID; 2486 } 2487 } 2488 return 0; 2489 } 2490 2491 int 2492 sshkey_private_serialize(const struct sshkey *key, struct sshbuf *b) 2493 { 2494 int r = SSH_ERR_INTERNAL_ERROR; 2495 2496 if ((r = sshbuf_put_cstring(b, sshkey_ssh_name(key))) != 0) 2497 goto out; 2498 switch (key->type) { 2499 #ifdef WITH_OPENSSL 2500 case KEY_RSA: 2501 if ((r = sshbuf_put_bignum2(b, key->rsa->n)) != 0 || 2502 (r = sshbuf_put_bignum2(b, key->rsa->e)) != 0 || 2503 (r = sshbuf_put_bignum2(b, key->rsa->d)) != 0 || 2504 (r = sshbuf_put_bignum2(b, key->rsa->iqmp)) != 0 || 2505 (r = sshbuf_put_bignum2(b, key->rsa->p)) != 0 || 2506 (r = sshbuf_put_bignum2(b, key->rsa->q)) != 0) 2507 goto out; 2508 break; 2509 case KEY_RSA_CERT: 2510 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 2511 r = SSH_ERR_INVALID_ARGUMENT; 2512 goto out; 2513 } 2514 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 2515 (r = sshbuf_put_bignum2(b, key->rsa->d)) != 0 || 2516 (r = sshbuf_put_bignum2(b, key->rsa->iqmp)) != 0 || 2517 (r = sshbuf_put_bignum2(b, key->rsa->p)) != 0 || 2518 (r = sshbuf_put_bignum2(b, key->rsa->q)) != 0) 2519 goto out; 2520 break; 2521 case KEY_DSA: 2522 if ((r = sshbuf_put_bignum2(b, key->dsa->p)) != 0 || 2523 (r = sshbuf_put_bignum2(b, key->dsa->q)) != 0 || 2524 (r = sshbuf_put_bignum2(b, key->dsa->g)) != 0 || 2525 (r = sshbuf_put_bignum2(b, key->dsa->pub_key)) != 0 || 2526 (r = sshbuf_put_bignum2(b, key->dsa->priv_key)) != 0) 2527 goto out; 2528 break; 2529 case KEY_DSA_CERT: 2530 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 2531 r = SSH_ERR_INVALID_ARGUMENT; 2532 goto out; 2533 } 2534 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 2535 (r = sshbuf_put_bignum2(b, key->dsa->priv_key)) != 0) 2536 goto out; 2537 break; 2538 case KEY_ECDSA: 2539 if ((r = sshbuf_put_cstring(b, 2540 sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || 2541 (r = sshbuf_put_eckey(b, key->ecdsa)) != 0 || 2542 (r = sshbuf_put_bignum2(b, 2543 EC_KEY_get0_private_key(key->ecdsa))) != 0) 2544 goto out; 2545 break; 2546 case KEY_ECDSA_CERT: 2547 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 2548 r = SSH_ERR_INVALID_ARGUMENT; 2549 goto out; 2550 } 2551 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 2552 (r = sshbuf_put_bignum2(b, 2553 EC_KEY_get0_private_key(key->ecdsa))) != 0) 2554 goto out; 2555 break; 2556 #endif /* WITH_OPENSSL */ 2557 case KEY_ED25519: 2558 if ((r = sshbuf_put_string(b, key->ed25519_pk, 2559 ED25519_PK_SZ)) != 0 || 2560 (r = sshbuf_put_string(b, key->ed25519_sk, 2561 ED25519_SK_SZ)) != 0) 2562 goto out; 2563 break; 2564 case KEY_ED25519_CERT: 2565 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 2566 r = SSH_ERR_INVALID_ARGUMENT; 2567 goto out; 2568 } 2569 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 2570 (r = sshbuf_put_string(b, key->ed25519_pk, 2571 ED25519_PK_SZ)) != 0 || 2572 (r = sshbuf_put_string(b, key->ed25519_sk, 2573 ED25519_SK_SZ)) != 0) 2574 goto out; 2575 break; 2576 default: 2577 r = SSH_ERR_INVALID_ARGUMENT; 2578 goto out; 2579 } 2580 /* success */ 2581 r = 0; 2582 out: 2583 return r; 2584 } 2585 2586 int 2587 sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) 2588 { 2589 char *tname = NULL, *curve = NULL; 2590 struct sshkey *k = NULL; 2591 size_t pklen = 0, sklen = 0; 2592 int type, r = SSH_ERR_INTERNAL_ERROR; 2593 u_char *ed25519_pk = NULL, *ed25519_sk = NULL; 2594 #ifdef WITH_OPENSSL 2595 BIGNUM *exponent = NULL; 2596 #endif /* WITH_OPENSSL */ 2597 2598 if (kp != NULL) 2599 *kp = NULL; 2600 if ((r = sshbuf_get_cstring(buf, &tname, NULL)) != 0) 2601 goto out; 2602 type = sshkey_type_from_name(tname); 2603 switch (type) { 2604 #ifdef WITH_OPENSSL 2605 case KEY_DSA: 2606 if ((k = sshkey_new_private(type)) == NULL) { 2607 r = SSH_ERR_ALLOC_FAIL; 2608 goto out; 2609 } 2610 if ((r = sshbuf_get_bignum2(buf, k->dsa->p)) != 0 || 2611 (r = sshbuf_get_bignum2(buf, k->dsa->q)) != 0 || 2612 (r = sshbuf_get_bignum2(buf, k->dsa->g)) != 0 || 2613 (r = sshbuf_get_bignum2(buf, k->dsa->pub_key)) != 0 || 2614 (r = sshbuf_get_bignum2(buf, k->dsa->priv_key)) != 0) 2615 goto out; 2616 break; 2617 case KEY_DSA_CERT: 2618 if ((r = sshkey_froms(buf, &k)) != 0 || 2619 (r = sshkey_add_private(k)) != 0 || 2620 (r = sshbuf_get_bignum2(buf, k->dsa->priv_key)) != 0) 2621 goto out; 2622 break; 2623 case KEY_ECDSA: 2624 if ((k = sshkey_new_private(type)) == NULL) { 2625 r = SSH_ERR_ALLOC_FAIL; 2626 goto out; 2627 } 2628 if ((k->ecdsa_nid = sshkey_ecdsa_nid_from_name(tname)) == -1) { 2629 r = SSH_ERR_INVALID_ARGUMENT; 2630 goto out; 2631 } 2632 if ((r = sshbuf_get_cstring(buf, &curve, NULL)) != 0) 2633 goto out; 2634 if (k->ecdsa_nid != sshkey_curve_name_to_nid(curve)) { 2635 r = SSH_ERR_EC_CURVE_MISMATCH; 2636 goto out; 2637 } 2638 k->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); 2639 if (k->ecdsa == NULL || (exponent = BN_new()) == NULL) { 2640 r = SSH_ERR_LIBCRYPTO_ERROR; 2641 goto out; 2642 } 2643 if ((r = sshbuf_get_eckey(buf, k->ecdsa)) != 0 || 2644 (r = sshbuf_get_bignum2(buf, exponent))) 2645 goto out; 2646 if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) { 2647 r = SSH_ERR_LIBCRYPTO_ERROR; 2648 goto out; 2649 } 2650 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 2651 EC_KEY_get0_public_key(k->ecdsa))) != 0 || 2652 (r = sshkey_ec_validate_private(k->ecdsa)) != 0) 2653 goto out; 2654 break; 2655 case KEY_ECDSA_CERT: 2656 if ((exponent = BN_new()) == NULL) { 2657 r = SSH_ERR_LIBCRYPTO_ERROR; 2658 goto out; 2659 } 2660 if ((r = sshkey_froms(buf, &k)) != 0 || 2661 (r = sshkey_add_private(k)) != 0 || 2662 (r = sshbuf_get_bignum2(buf, exponent)) != 0) 2663 goto out; 2664 if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) { 2665 r = SSH_ERR_LIBCRYPTO_ERROR; 2666 goto out; 2667 } 2668 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 2669 EC_KEY_get0_public_key(k->ecdsa))) != 0 || 2670 (r = sshkey_ec_validate_private(k->ecdsa)) != 0) 2671 goto out; 2672 break; 2673 case KEY_RSA: 2674 if ((k = sshkey_new_private(type)) == NULL) { 2675 r = SSH_ERR_ALLOC_FAIL; 2676 goto out; 2677 } 2678 if ((r = sshbuf_get_bignum2(buf, k->rsa->n)) != 0 || 2679 (r = sshbuf_get_bignum2(buf, k->rsa->e)) != 0 || 2680 (r = sshbuf_get_bignum2(buf, k->rsa->d)) != 0 || 2681 (r = sshbuf_get_bignum2(buf, k->rsa->iqmp)) != 0 || 2682 (r = sshbuf_get_bignum2(buf, k->rsa->p)) != 0 || 2683 (r = sshbuf_get_bignum2(buf, k->rsa->q)) != 0 || 2684 (r = rsa_generate_additional_parameters(k->rsa)) != 0) 2685 goto out; 2686 break; 2687 case KEY_RSA_CERT: 2688 if ((r = sshkey_froms(buf, &k)) != 0 || 2689 (r = sshkey_add_private(k)) != 0 || 2690 (r = sshbuf_get_bignum2(buf, k->rsa->d)) != 0 || 2691 (r = sshbuf_get_bignum2(buf, k->rsa->iqmp)) != 0 || 2692 (r = sshbuf_get_bignum2(buf, k->rsa->p)) != 0 || 2693 (r = sshbuf_get_bignum2(buf, k->rsa->q)) != 0 || 2694 (r = rsa_generate_additional_parameters(k->rsa)) != 0) 2695 goto out; 2696 break; 2697 #endif /* WITH_OPENSSL */ 2698 case KEY_ED25519: 2699 if ((k = sshkey_new_private(type)) == NULL) { 2700 r = SSH_ERR_ALLOC_FAIL; 2701 goto out; 2702 } 2703 if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 || 2704 (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0) 2705 goto out; 2706 if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) { 2707 r = SSH_ERR_INVALID_FORMAT; 2708 goto out; 2709 } 2710 k->ed25519_pk = ed25519_pk; 2711 k->ed25519_sk = ed25519_sk; 2712 ed25519_pk = ed25519_sk = NULL; 2713 break; 2714 case KEY_ED25519_CERT: 2715 if ((r = sshkey_froms(buf, &k)) != 0 || 2716 (r = sshkey_add_private(k)) != 0 || 2717 (r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 || 2718 (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0) 2719 goto out; 2720 if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) { 2721 r = SSH_ERR_INVALID_FORMAT; 2722 goto out; 2723 } 2724 k->ed25519_pk = ed25519_pk; 2725 k->ed25519_sk = ed25519_sk; 2726 ed25519_pk = ed25519_sk = NULL; 2727 break; 2728 default: 2729 r = SSH_ERR_KEY_TYPE_UNKNOWN; 2730 goto out; 2731 } 2732 #ifdef WITH_OPENSSL 2733 /* enable blinding */ 2734 switch (k->type) { 2735 case KEY_RSA: 2736 case KEY_RSA_CERT: 2737 case KEY_RSA1: 2738 if (RSA_blinding_on(k->rsa, NULL) != 1) { 2739 r = SSH_ERR_LIBCRYPTO_ERROR; 2740 goto out; 2741 } 2742 break; 2743 } 2744 #endif /* WITH_OPENSSL */ 2745 /* success */ 2746 r = 0; 2747 if (kp != NULL) { 2748 *kp = k; 2749 k = NULL; 2750 } 2751 out: 2752 free(tname); 2753 free(curve); 2754 #ifdef WITH_OPENSSL 2755 if (exponent != NULL) 2756 BN_clear_free(exponent); 2757 #endif /* WITH_OPENSSL */ 2758 sshkey_free(k); 2759 if (ed25519_pk != NULL) { 2760 explicit_bzero(ed25519_pk, pklen); 2761 free(ed25519_pk); 2762 } 2763 if (ed25519_sk != NULL) { 2764 explicit_bzero(ed25519_sk, sklen); 2765 free(ed25519_sk); 2766 } 2767 return r; 2768 } 2769 2770 #ifdef WITH_OPENSSL 2771 int 2772 sshkey_ec_validate_public(const EC_GROUP *group, const EC_POINT *public) 2773 { 2774 BN_CTX *bnctx; 2775 EC_POINT *nq = NULL; 2776 BIGNUM *order, *x, *y, *tmp; 2777 int ret = SSH_ERR_KEY_INVALID_EC_VALUE; 2778 2779 if ((bnctx = BN_CTX_new()) == NULL) 2780 return SSH_ERR_ALLOC_FAIL; 2781 BN_CTX_start(bnctx); 2782 2783 /* 2784 * We shouldn't ever hit this case because bignum_get_ecpoint() 2785 * refuses to load GF2m points. 2786 */ 2787 if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) != 2788 NID_X9_62_prime_field) 2789 goto out; 2790 2791 /* Q != infinity */ 2792 if (EC_POINT_is_at_infinity(group, public)) 2793 goto out; 2794 2795 if ((x = BN_CTX_get(bnctx)) == NULL || 2796 (y = BN_CTX_get(bnctx)) == NULL || 2797 (order = BN_CTX_get(bnctx)) == NULL || 2798 (tmp = BN_CTX_get(bnctx)) == NULL) { 2799 ret = SSH_ERR_ALLOC_FAIL; 2800 goto out; 2801 } 2802 2803 /* log2(x) > log2(order)/2, log2(y) > log2(order)/2 */ 2804 if (EC_GROUP_get_order(group, order, bnctx) != 1 || 2805 EC_POINT_get_affine_coordinates_GFp(group, public, 2806 x, y, bnctx) != 1) { 2807 ret = SSH_ERR_LIBCRYPTO_ERROR; 2808 goto out; 2809 } 2810 if (BN_num_bits(x) <= BN_num_bits(order) / 2 || 2811 BN_num_bits(y) <= BN_num_bits(order) / 2) 2812 goto out; 2813 2814 /* nQ == infinity (n == order of subgroup) */ 2815 if ((nq = EC_POINT_new(group)) == NULL) { 2816 ret = SSH_ERR_ALLOC_FAIL; 2817 goto out; 2818 } 2819 if (EC_POINT_mul(group, nq, NULL, public, order, bnctx) != 1) { 2820 ret = SSH_ERR_LIBCRYPTO_ERROR; 2821 goto out; 2822 } 2823 if (EC_POINT_is_at_infinity(group, nq) != 1) 2824 goto out; 2825 2826 /* x < order - 1, y < order - 1 */ 2827 if (!BN_sub(tmp, order, BN_value_one())) { 2828 ret = SSH_ERR_LIBCRYPTO_ERROR; 2829 goto out; 2830 } 2831 if (BN_cmp(x, tmp) >= 0 || BN_cmp(y, tmp) >= 0) 2832 goto out; 2833 ret = 0; 2834 out: 2835 BN_CTX_free(bnctx); 2836 if (nq != NULL) 2837 EC_POINT_free(nq); 2838 return ret; 2839 } 2840 2841 int 2842 sshkey_ec_validate_private(const EC_KEY *key) 2843 { 2844 BN_CTX *bnctx; 2845 BIGNUM *order, *tmp; 2846 int ret = SSH_ERR_KEY_INVALID_EC_VALUE; 2847 2848 if ((bnctx = BN_CTX_new()) == NULL) 2849 return SSH_ERR_ALLOC_FAIL; 2850 BN_CTX_start(bnctx); 2851 2852 if ((order = BN_CTX_get(bnctx)) == NULL || 2853 (tmp = BN_CTX_get(bnctx)) == NULL) { 2854 ret = SSH_ERR_ALLOC_FAIL; 2855 goto out; 2856 } 2857 2858 /* log2(private) > log2(order)/2 */ 2859 if (EC_GROUP_get_order(EC_KEY_get0_group(key), order, bnctx) != 1) { 2860 ret = SSH_ERR_LIBCRYPTO_ERROR; 2861 goto out; 2862 } 2863 if (BN_num_bits(EC_KEY_get0_private_key(key)) <= 2864 BN_num_bits(order) / 2) 2865 goto out; 2866 2867 /* private < order - 1 */ 2868 if (!BN_sub(tmp, order, BN_value_one())) { 2869 ret = SSH_ERR_LIBCRYPTO_ERROR; 2870 goto out; 2871 } 2872 if (BN_cmp(EC_KEY_get0_private_key(key), tmp) >= 0) 2873 goto out; 2874 ret = 0; 2875 out: 2876 BN_CTX_free(bnctx); 2877 return ret; 2878 } 2879 2880 void 2881 sshkey_dump_ec_point(const EC_GROUP *group, const EC_POINT *point) 2882 { 2883 BIGNUM *x, *y; 2884 BN_CTX *bnctx; 2885 2886 if (point == NULL) { 2887 fputs("point=(NULL)\n", stderr); 2888 return; 2889 } 2890 if ((bnctx = BN_CTX_new()) == NULL) { 2891 fprintf(stderr, "%s: BN_CTX_new failed\n", __func__); 2892 return; 2893 } 2894 BN_CTX_start(bnctx); 2895 if ((x = BN_CTX_get(bnctx)) == NULL || 2896 (y = BN_CTX_get(bnctx)) == NULL) { 2897 fprintf(stderr, "%s: BN_CTX_get failed\n", __func__); 2898 return; 2899 } 2900 if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) != 2901 NID_X9_62_prime_field) { 2902 fprintf(stderr, "%s: group is not a prime field\n", __func__); 2903 return; 2904 } 2905 if (EC_POINT_get_affine_coordinates_GFp(group, point, x, y, 2906 bnctx) != 1) { 2907 fprintf(stderr, "%s: EC_POINT_get_affine_coordinates_GFp\n", 2908 __func__); 2909 return; 2910 } 2911 fputs("x=", stderr); 2912 BN_print_fp(stderr, x); 2913 fputs("\ny=", stderr); 2914 BN_print_fp(stderr, y); 2915 fputs("\n", stderr); 2916 BN_CTX_free(bnctx); 2917 } 2918 2919 void 2920 sshkey_dump_ec_key(const EC_KEY *key) 2921 { 2922 const BIGNUM *exponent; 2923 2924 sshkey_dump_ec_point(EC_KEY_get0_group(key), 2925 EC_KEY_get0_public_key(key)); 2926 fputs("exponent=", stderr); 2927 if ((exponent = EC_KEY_get0_private_key(key)) == NULL) 2928 fputs("(NULL)", stderr); 2929 else 2930 BN_print_fp(stderr, EC_KEY_get0_private_key(key)); 2931 fputs("\n", stderr); 2932 } 2933 #endif /* WITH_OPENSSL */ 2934 2935 static int 2936 sshkey_private_to_blob2(const struct sshkey *prv, struct sshbuf *blob, 2937 const char *passphrase, const char *comment, const char *ciphername, 2938 int rounds) 2939 { 2940 u_char *cp, *key = NULL, *pubkeyblob = NULL; 2941 u_char salt[SALT_LEN]; 2942 char *b64 = NULL; 2943 size_t i, pubkeylen, keylen, ivlen, blocksize, authlen; 2944 u_int check; 2945 int r = SSH_ERR_INTERNAL_ERROR; 2946 struct sshcipher_ctx ciphercontext; 2947 const struct sshcipher *cipher; 2948 const char *kdfname = KDFNAME; 2949 struct sshbuf *encoded = NULL, *encrypted = NULL, *kdf = NULL; 2950 2951 memset(&ciphercontext, 0, sizeof(ciphercontext)); 2952 2953 if (rounds <= 0) 2954 rounds = DEFAULT_ROUNDS; 2955 if (passphrase == NULL || !strlen(passphrase)) { 2956 ciphername = "none"; 2957 kdfname = "none"; 2958 } else if (ciphername == NULL) 2959 ciphername = DEFAULT_CIPHERNAME; 2960 else if (cipher_number(ciphername) != SSH_CIPHER_SSH2) { 2961 r = SSH_ERR_INVALID_ARGUMENT; 2962 goto out; 2963 } 2964 if ((cipher = cipher_by_name(ciphername)) == NULL) { 2965 r = SSH_ERR_INTERNAL_ERROR; 2966 goto out; 2967 } 2968 2969 if ((kdf = sshbuf_new()) == NULL || 2970 (encoded = sshbuf_new()) == NULL || 2971 (encrypted = sshbuf_new()) == NULL) { 2972 r = SSH_ERR_ALLOC_FAIL; 2973 goto out; 2974 } 2975 blocksize = cipher_blocksize(cipher); 2976 keylen = cipher_keylen(cipher); 2977 ivlen = cipher_ivlen(cipher); 2978 authlen = cipher_authlen(cipher); 2979 if ((key = calloc(1, keylen + ivlen)) == NULL) { 2980 r = SSH_ERR_ALLOC_FAIL; 2981 goto out; 2982 } 2983 if (strcmp(kdfname, "bcrypt") == 0) { 2984 arc4random_buf(salt, SALT_LEN); 2985 if (bcrypt_pbkdf(passphrase, strlen(passphrase), 2986 salt, SALT_LEN, key, keylen + ivlen, rounds) < 0) { 2987 r = SSH_ERR_INVALID_ARGUMENT; 2988 goto out; 2989 } 2990 if ((r = sshbuf_put_string(kdf, salt, SALT_LEN)) != 0 || 2991 (r = sshbuf_put_u32(kdf, rounds)) != 0) 2992 goto out; 2993 } else if (strcmp(kdfname, "none") != 0) { 2994 /* Unsupported KDF type */ 2995 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 2996 goto out; 2997 } 2998 if ((r = cipher_init(&ciphercontext, cipher, key, keylen, 2999 key + keylen, ivlen, 1)) != 0) 3000 goto out; 3001 3002 if ((r = sshbuf_put(encoded, AUTH_MAGIC, sizeof(AUTH_MAGIC))) != 0 || 3003 (r = sshbuf_put_cstring(encoded, ciphername)) != 0 || 3004 (r = sshbuf_put_cstring(encoded, kdfname)) != 0 || 3005 (r = sshbuf_put_stringb(encoded, kdf)) != 0 || 3006 (r = sshbuf_put_u32(encoded, 1)) != 0 || /* number of keys */ 3007 (r = sshkey_to_blob(prv, &pubkeyblob, &pubkeylen)) != 0 || 3008 (r = sshbuf_put_string(encoded, pubkeyblob, pubkeylen)) != 0) 3009 goto out; 3010 3011 /* set up the buffer that will be encrypted */ 3012 3013 /* Random check bytes */ 3014 check = arc4random(); 3015 if ((r = sshbuf_put_u32(encrypted, check)) != 0 || 3016 (r = sshbuf_put_u32(encrypted, check)) != 0) 3017 goto out; 3018 3019 /* append private key and comment*/ 3020 if ((r = sshkey_private_serialize(prv, encrypted)) != 0 || 3021 (r = sshbuf_put_cstring(encrypted, comment)) != 0) 3022 goto out; 3023 3024 /* padding */ 3025 i = 0; 3026 while (sshbuf_len(encrypted) % blocksize) { 3027 if ((r = sshbuf_put_u8(encrypted, ++i & 0xff)) != 0) 3028 goto out; 3029 } 3030 3031 /* length in destination buffer */ 3032 if ((r = sshbuf_put_u32(encoded, sshbuf_len(encrypted))) != 0) 3033 goto out; 3034 3035 /* encrypt */ 3036 if ((r = sshbuf_reserve(encoded, 3037 sshbuf_len(encrypted) + authlen, &cp)) != 0) 3038 goto out; 3039 if ((r = cipher_crypt(&ciphercontext, 0, cp, 3040 sshbuf_ptr(encrypted), sshbuf_len(encrypted), 0, authlen)) != 0) 3041 goto out; 3042 3043 /* uuencode */ 3044 if ((b64 = sshbuf_dtob64(encoded)) == NULL) { 3045 r = SSH_ERR_ALLOC_FAIL; 3046 goto out; 3047 } 3048 3049 sshbuf_reset(blob); 3050 if ((r = sshbuf_put(blob, MARK_BEGIN, MARK_BEGIN_LEN)) != 0) 3051 goto out; 3052 for (i = 0; i < strlen(b64); i++) { 3053 if ((r = sshbuf_put_u8(blob, b64[i])) != 0) 3054 goto out; 3055 /* insert line breaks */ 3056 if (i % 70 == 69 && (r = sshbuf_put_u8(blob, '\n')) != 0) 3057 goto out; 3058 } 3059 if (i % 70 != 69 && (r = sshbuf_put_u8(blob, '\n')) != 0) 3060 goto out; 3061 if ((r = sshbuf_put(blob, MARK_END, MARK_END_LEN)) != 0) 3062 goto out; 3063 3064 /* success */ 3065 r = 0; 3066 3067 out: 3068 sshbuf_free(kdf); 3069 sshbuf_free(encoded); 3070 sshbuf_free(encrypted); 3071 cipher_cleanup(&ciphercontext); 3072 explicit_bzero(salt, sizeof(salt)); 3073 if (key != NULL) { 3074 explicit_bzero(key, keylen + ivlen); 3075 free(key); 3076 } 3077 if (pubkeyblob != NULL) { 3078 explicit_bzero(pubkeyblob, pubkeylen); 3079 free(pubkeyblob); 3080 } 3081 if (b64 != NULL) { 3082 explicit_bzero(b64, strlen(b64)); 3083 free(b64); 3084 } 3085 return r; 3086 } 3087 3088 static int 3089 sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase, 3090 struct sshkey **keyp, char **commentp) 3091 { 3092 char *comment = NULL, *ciphername = NULL, *kdfname = NULL; 3093 const struct sshcipher *cipher = NULL; 3094 const u_char *cp; 3095 int r = SSH_ERR_INTERNAL_ERROR; 3096 size_t encoded_len; 3097 size_t i, keylen = 0, ivlen = 0, authlen = 0, slen = 0; 3098 struct sshbuf *encoded = NULL, *decoded = NULL; 3099 struct sshbuf *kdf = NULL, *decrypted = NULL; 3100 struct sshcipher_ctx ciphercontext; 3101 struct sshkey *k = NULL; 3102 u_char *key = NULL, *salt = NULL, *dp, pad, last; 3103 u_int blocksize, rounds, nkeys, encrypted_len, check1, check2; 3104 3105 memset(&ciphercontext, 0, sizeof(ciphercontext)); 3106 if (keyp != NULL) 3107 *keyp = NULL; 3108 if (commentp != NULL) 3109 *commentp = NULL; 3110 3111 if ((encoded = sshbuf_new()) == NULL || 3112 (decoded = sshbuf_new()) == NULL || 3113 (decrypted = sshbuf_new()) == NULL) { 3114 r = SSH_ERR_ALLOC_FAIL; 3115 goto out; 3116 } 3117 3118 /* check preamble */ 3119 cp = sshbuf_ptr(blob); 3120 encoded_len = sshbuf_len(blob); 3121 if (encoded_len < (MARK_BEGIN_LEN + MARK_END_LEN) || 3122 memcmp(cp, MARK_BEGIN, MARK_BEGIN_LEN) != 0) { 3123 r = SSH_ERR_INVALID_FORMAT; 3124 goto out; 3125 } 3126 cp += MARK_BEGIN_LEN; 3127 encoded_len -= MARK_BEGIN_LEN; 3128 3129 /* Look for end marker, removing whitespace as we go */ 3130 while (encoded_len > 0) { 3131 if (*cp != '\n' && *cp != '\r') { 3132 if ((r = sshbuf_put_u8(encoded, *cp)) != 0) 3133 goto out; 3134 } 3135 last = *cp; 3136 encoded_len--; 3137 cp++; 3138 if (last == '\n') { 3139 if (encoded_len >= MARK_END_LEN && 3140 memcmp(cp, MARK_END, MARK_END_LEN) == 0) { 3141 /* \0 terminate */ 3142 if ((r = sshbuf_put_u8(encoded, 0)) != 0) 3143 goto out; 3144 break; 3145 } 3146 } 3147 } 3148 if (encoded_len == 0) { 3149 r = SSH_ERR_INVALID_FORMAT; 3150 goto out; 3151 } 3152 3153 /* decode base64 */ 3154 if ((r = sshbuf_b64tod(decoded, (char *)sshbuf_ptr(encoded))) != 0) 3155 goto out; 3156 3157 /* check magic */ 3158 if (sshbuf_len(decoded) < sizeof(AUTH_MAGIC) || 3159 memcmp(sshbuf_ptr(decoded), AUTH_MAGIC, sizeof(AUTH_MAGIC))) { 3160 r = SSH_ERR_INVALID_FORMAT; 3161 goto out; 3162 } 3163 /* parse public portion of key */ 3164 if ((r = sshbuf_consume(decoded, sizeof(AUTH_MAGIC))) != 0 || 3165 (r = sshbuf_get_cstring(decoded, &ciphername, NULL)) != 0 || 3166 (r = sshbuf_get_cstring(decoded, &kdfname, NULL)) != 0 || 3167 (r = sshbuf_froms(decoded, &kdf)) != 0 || 3168 (r = sshbuf_get_u32(decoded, &nkeys)) != 0 || 3169 (r = sshbuf_skip_string(decoded)) != 0 || /* pubkey */ 3170 (r = sshbuf_get_u32(decoded, &encrypted_len)) != 0) 3171 goto out; 3172 3173 if ((cipher = cipher_by_name(ciphername)) == NULL) { 3174 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 3175 goto out; 3176 } 3177 if ((passphrase == NULL || strlen(passphrase) == 0) && 3178 strcmp(ciphername, "none") != 0) { 3179 /* passphrase required */ 3180 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3181 goto out; 3182 } 3183 if (strcmp(kdfname, "none") != 0 && strcmp(kdfname, "bcrypt") != 0) { 3184 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 3185 goto out; 3186 } 3187 if (!strcmp(kdfname, "none") && strcmp(ciphername, "none") != 0) { 3188 r = SSH_ERR_INVALID_FORMAT; 3189 goto out; 3190 } 3191 if (nkeys != 1) { 3192 /* XXX only one key supported */ 3193 r = SSH_ERR_INVALID_FORMAT; 3194 goto out; 3195 } 3196 3197 /* check size of encrypted key blob */ 3198 blocksize = cipher_blocksize(cipher); 3199 if (encrypted_len < blocksize || (encrypted_len % blocksize) != 0) { 3200 r = SSH_ERR_INVALID_FORMAT; 3201 goto out; 3202 } 3203 3204 /* setup key */ 3205 keylen = cipher_keylen(cipher); 3206 ivlen = cipher_ivlen(cipher); 3207 authlen = cipher_authlen(cipher); 3208 if ((key = calloc(1, keylen + ivlen)) == NULL) { 3209 r = SSH_ERR_ALLOC_FAIL; 3210 goto out; 3211 } 3212 if (strcmp(kdfname, "bcrypt") == 0) { 3213 if ((r = sshbuf_get_string(kdf, &salt, &slen)) != 0 || 3214 (r = sshbuf_get_u32(kdf, &rounds)) != 0) 3215 goto out; 3216 if (bcrypt_pbkdf(passphrase, strlen(passphrase), salt, slen, 3217 key, keylen + ivlen, rounds) < 0) { 3218 r = SSH_ERR_INVALID_FORMAT; 3219 goto out; 3220 } 3221 } 3222 3223 /* check that an appropriate amount of auth data is present */ 3224 if (sshbuf_len(decoded) < encrypted_len + authlen) { 3225 r = SSH_ERR_INVALID_FORMAT; 3226 goto out; 3227 } 3228 3229 /* decrypt private portion of key */ 3230 if ((r = sshbuf_reserve(decrypted, encrypted_len, &dp)) != 0 || 3231 (r = cipher_init(&ciphercontext, cipher, key, keylen, 3232 key + keylen, ivlen, 0)) != 0) 3233 goto out; 3234 if ((r = cipher_crypt(&ciphercontext, 0, dp, sshbuf_ptr(decoded), 3235 encrypted_len, 0, authlen)) != 0) { 3236 /* an integrity error here indicates an incorrect passphrase */ 3237 if (r == SSH_ERR_MAC_INVALID) 3238 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3239 goto out; 3240 } 3241 if ((r = sshbuf_consume(decoded, encrypted_len + authlen)) != 0) 3242 goto out; 3243 /* there should be no trailing data */ 3244 if (sshbuf_len(decoded) != 0) { 3245 r = SSH_ERR_INVALID_FORMAT; 3246 goto out; 3247 } 3248 3249 /* check check bytes */ 3250 if ((r = sshbuf_get_u32(decrypted, &check1)) != 0 || 3251 (r = sshbuf_get_u32(decrypted, &check2)) != 0) 3252 goto out; 3253 if (check1 != check2) { 3254 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3255 goto out; 3256 } 3257 3258 /* Load the private key and comment */ 3259 if ((r = sshkey_private_deserialize(decrypted, &k)) != 0 || 3260 (r = sshbuf_get_cstring(decrypted, &comment, NULL)) != 0) 3261 goto out; 3262 3263 /* Check deterministic padding */ 3264 i = 0; 3265 while (sshbuf_len(decrypted)) { 3266 if ((r = sshbuf_get_u8(decrypted, &pad)) != 0) 3267 goto out; 3268 if (pad != (++i & 0xff)) { 3269 r = SSH_ERR_INVALID_FORMAT; 3270 goto out; 3271 } 3272 } 3273 3274 /* XXX decode pubkey and check against private */ 3275 3276 /* success */ 3277 r = 0; 3278 if (keyp != NULL) { 3279 *keyp = k; 3280 k = NULL; 3281 } 3282 if (commentp != NULL) { 3283 *commentp = comment; 3284 comment = NULL; 3285 } 3286 out: 3287 pad = 0; 3288 cipher_cleanup(&ciphercontext); 3289 free(ciphername); 3290 free(kdfname); 3291 free(comment); 3292 if (salt != NULL) { 3293 explicit_bzero(salt, slen); 3294 free(salt); 3295 } 3296 if (key != NULL) { 3297 explicit_bzero(key, keylen + ivlen); 3298 free(key); 3299 } 3300 sshbuf_free(encoded); 3301 sshbuf_free(decoded); 3302 sshbuf_free(kdf); 3303 sshbuf_free(decrypted); 3304 sshkey_free(k); 3305 return r; 3306 } 3307 3308 #if WITH_SSH1 3309 /* 3310 * Serialises the authentication (private) key to a blob, encrypting it with 3311 * passphrase. The identification of the blob (lowest 64 bits of n) will 3312 * precede the key to provide identification of the key without needing a 3313 * passphrase. 3314 */ 3315 static int 3316 sshkey_private_rsa1_to_blob(struct sshkey *key, struct sshbuf *blob, 3317 const char *passphrase, const char *comment) 3318 { 3319 struct sshbuf *buffer = NULL, *encrypted = NULL; 3320 u_char buf[8]; 3321 int r, cipher_num; 3322 struct sshcipher_ctx ciphercontext; 3323 const struct sshcipher *cipher; 3324 u_char *cp; 3325 3326 /* 3327 * If the passphrase is empty, use SSH_CIPHER_NONE to ease converting 3328 * to another cipher; otherwise use SSH_AUTHFILE_CIPHER. 3329 */ 3330 cipher_num = (strcmp(passphrase, "") == 0) ? 3331 SSH_CIPHER_NONE : SSH_CIPHER_3DES; 3332 if ((cipher = cipher_by_number(cipher_num)) == NULL) 3333 return SSH_ERR_INTERNAL_ERROR; 3334 3335 /* This buffer is used to build the secret part of the private key. */ 3336 if ((buffer = sshbuf_new()) == NULL) 3337 return SSH_ERR_ALLOC_FAIL; 3338 3339 /* Put checkbytes for checking passphrase validity. */ 3340 if ((r = sshbuf_reserve(buffer, 4, &cp)) != 0) 3341 goto out; 3342 arc4random_buf(cp, 2); 3343 memcpy(cp + 2, cp, 2); 3344 3345 /* 3346 * Store the private key (n and e will not be stored because they 3347 * will be stored in plain text, and storing them also in encrypted 3348 * format would just give known plaintext). 3349 * Note: q and p are stored in reverse order to SSL. 3350 */ 3351 if ((r = sshbuf_put_bignum1(buffer, key->rsa->d)) != 0 || 3352 (r = sshbuf_put_bignum1(buffer, key->rsa->iqmp)) != 0 || 3353 (r = sshbuf_put_bignum1(buffer, key->rsa->q)) != 0 || 3354 (r = sshbuf_put_bignum1(buffer, key->rsa->p)) != 0) 3355 goto out; 3356 3357 /* Pad the part to be encrypted to a size that is a multiple of 8. */ 3358 explicit_bzero(buf, 8); 3359 if ((r = sshbuf_put(buffer, buf, 8 - (sshbuf_len(buffer) % 8))) != 0) 3360 goto out; 3361 3362 /* This buffer will be used to contain the data in the file. */ 3363 if ((encrypted = sshbuf_new()) == NULL) { 3364 r = SSH_ERR_ALLOC_FAIL; 3365 goto out; 3366 } 3367 3368 /* First store keyfile id string. */ 3369 if ((r = sshbuf_put(encrypted, LEGACY_BEGIN, 3370 sizeof(LEGACY_BEGIN))) != 0) 3371 goto out; 3372 3373 /* Store cipher type and "reserved" field. */ 3374 if ((r = sshbuf_put_u8(encrypted, cipher_num)) != 0 || 3375 (r = sshbuf_put_u32(encrypted, 0)) != 0) 3376 goto out; 3377 3378 /* Store public key. This will be in plain text. */ 3379 if ((r = sshbuf_put_u32(encrypted, BN_num_bits(key->rsa->n))) != 0 || 3380 (r = sshbuf_put_bignum1(encrypted, key->rsa->n)) != 0 || 3381 (r = sshbuf_put_bignum1(encrypted, key->rsa->e)) != 0 || 3382 (r = sshbuf_put_cstring(encrypted, comment)) != 0) 3383 goto out; 3384 3385 /* Allocate space for the private part of the key in the buffer. */ 3386 if ((r = sshbuf_reserve(encrypted, sshbuf_len(buffer), &cp)) != 0) 3387 goto out; 3388 3389 if ((r = cipher_set_key_string(&ciphercontext, cipher, passphrase, 3390 CIPHER_ENCRYPT)) != 0) 3391 goto out; 3392 if ((r = cipher_crypt(&ciphercontext, 0, cp, 3393 sshbuf_ptr(buffer), sshbuf_len(buffer), 0, 0)) != 0) 3394 goto out; 3395 if ((r = cipher_cleanup(&ciphercontext)) != 0) 3396 goto out; 3397 3398 r = sshbuf_putb(blob, encrypted); 3399 3400 out: 3401 explicit_bzero(&ciphercontext, sizeof(ciphercontext)); 3402 explicit_bzero(buf, sizeof(buf)); 3403 if (buffer != NULL) 3404 sshbuf_free(buffer); 3405 if (encrypted != NULL) 3406 sshbuf_free(encrypted); 3407 3408 return r; 3409 } 3410 #endif /* WITH_SSH1 */ 3411 3412 #ifdef WITH_OPENSSL 3413 /* convert SSH v2 key in OpenSSL PEM format */ 3414 static int 3415 sshkey_private_pem_to_blob(struct sshkey *key, struct sshbuf *blob, 3416 const char *_passphrase, const char *comment) 3417 { 3418 int success, r; 3419 int blen, len = strlen(_passphrase); 3420 u_char *passphrase = (len > 0) ? (u_char *)_passphrase : NULL; 3421 const EVP_CIPHER *cipher = (len > 0) ? EVP_aes_128_cbc() : NULL; 3422 const u_char *bptr; 3423 BIO *bio = NULL; 3424 3425 if (len > 0 && len <= 4) 3426 return SSH_ERR_PASSPHRASE_TOO_SHORT; 3427 if ((bio = BIO_new(BIO_s_mem())) == NULL) 3428 return SSH_ERR_ALLOC_FAIL; 3429 3430 switch (key->type) { 3431 case KEY_DSA: 3432 success = PEM_write_bio_DSAPrivateKey(bio, key->dsa, 3433 cipher, passphrase, len, NULL, NULL); 3434 break; 3435 case KEY_ECDSA: 3436 success = PEM_write_bio_ECPrivateKey(bio, key->ecdsa, 3437 cipher, passphrase, len, NULL, NULL); 3438 break; 3439 case KEY_RSA: 3440 success = PEM_write_bio_RSAPrivateKey(bio, key->rsa, 3441 cipher, passphrase, len, NULL, NULL); 3442 break; 3443 default: 3444 success = 0; 3445 break; 3446 } 3447 if (success == 0) { 3448 r = SSH_ERR_LIBCRYPTO_ERROR; 3449 goto out; 3450 } 3451 if ((blen = BIO_get_mem_data(bio, &bptr)) <= 0) { 3452 r = SSH_ERR_INTERNAL_ERROR; 3453 goto out; 3454 } 3455 if ((r = sshbuf_put(blob, bptr, blen)) != 0) 3456 goto out; 3457 r = 0; 3458 out: 3459 BIO_free(bio); 3460 return r; 3461 } 3462 #endif /* WITH_OPENSSL */ 3463 3464 /* Serialise "key" to buffer "blob" */ 3465 int 3466 sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob, 3467 const char *passphrase, const char *comment, 3468 int force_new_format, const char *new_format_cipher, int new_format_rounds) 3469 { 3470 switch (key->type) { 3471 #ifdef WITH_SSH1 3472 case KEY_RSA1: 3473 return sshkey_private_rsa1_to_blob(key, blob, 3474 passphrase, comment); 3475 #endif /* WITH_SSH1 */ 3476 #ifdef WITH_OPENSSL 3477 case KEY_DSA: 3478 case KEY_ECDSA: 3479 case KEY_RSA: 3480 if (force_new_format) { 3481 return sshkey_private_to_blob2(key, blob, passphrase, 3482 comment, new_format_cipher, new_format_rounds); 3483 } 3484 return sshkey_private_pem_to_blob(key, blob, 3485 passphrase, comment); 3486 #endif /* WITH_OPENSSL */ 3487 case KEY_ED25519: 3488 return sshkey_private_to_blob2(key, blob, passphrase, 3489 comment, new_format_cipher, new_format_rounds); 3490 default: 3491 return SSH_ERR_KEY_TYPE_UNKNOWN; 3492 } 3493 } 3494 3495 #ifdef WITH_SSH1 3496 /* 3497 * Parse the public, unencrypted portion of a RSA1 key. 3498 */ 3499 int 3500 sshkey_parse_public_rsa1_fileblob(struct sshbuf *blob, 3501 struct sshkey **keyp, char **commentp) 3502 { 3503 int r; 3504 struct sshkey *pub = NULL; 3505 struct sshbuf *copy = NULL; 3506 3507 if (keyp != NULL) 3508 *keyp = NULL; 3509 if (commentp != NULL) 3510 *commentp = NULL; 3511 3512 /* Check that it is at least big enough to contain the ID string. */ 3513 if (sshbuf_len(blob) < sizeof(LEGACY_BEGIN)) 3514 return SSH_ERR_INVALID_FORMAT; 3515 3516 /* 3517 * Make sure it begins with the id string. Consume the id string 3518 * from the buffer. 3519 */ 3520 if (memcmp(sshbuf_ptr(blob), LEGACY_BEGIN, sizeof(LEGACY_BEGIN)) != 0) 3521 return SSH_ERR_INVALID_FORMAT; 3522 /* Make a working copy of the keyblob and skip past the magic */ 3523 if ((copy = sshbuf_fromb(blob)) == NULL) 3524 return SSH_ERR_ALLOC_FAIL; 3525 if ((r = sshbuf_consume(copy, sizeof(LEGACY_BEGIN))) != 0) 3526 goto out; 3527 3528 /* Skip cipher type, reserved data and key bits. */ 3529 if ((r = sshbuf_get_u8(copy, NULL)) != 0 || /* cipher type */ 3530 (r = sshbuf_get_u32(copy, NULL)) != 0 || /* reserved */ 3531 (r = sshbuf_get_u32(copy, NULL)) != 0) /* key bits */ 3532 goto out; 3533 3534 /* Read the public key from the buffer. */ 3535 if ((pub = sshkey_new(KEY_RSA1)) == NULL || 3536 (r = sshbuf_get_bignum1(copy, pub->rsa->n)) != 0 || 3537 (r = sshbuf_get_bignum1(copy, pub->rsa->e)) != 0) 3538 goto out; 3539 3540 /* Finally, the comment */ 3541 if ((r = sshbuf_get_string(copy, (u_char**)commentp, NULL)) != 0) 3542 goto out; 3543 3544 /* The encrypted private part is not parsed by this function. */ 3545 3546 r = 0; 3547 if (keyp != NULL) 3548 *keyp = pub; 3549 else 3550 sshkey_free(pub); 3551 pub = NULL; 3552 3553 out: 3554 if (copy != NULL) 3555 sshbuf_free(copy); 3556 if (pub != NULL) 3557 sshkey_free(pub); 3558 return r; 3559 } 3560 3561 static int 3562 sshkey_parse_private_rsa1(struct sshbuf *blob, const char *passphrase, 3563 struct sshkey **keyp, char **commentp) 3564 { 3565 int r; 3566 u_int16_t check1, check2; 3567 u_int8_t cipher_type; 3568 struct sshbuf *decrypted = NULL, *copy = NULL; 3569 u_char *cp; 3570 char *comment = NULL; 3571 struct sshcipher_ctx ciphercontext; 3572 const struct sshcipher *cipher; 3573 struct sshkey *prv = NULL; 3574 3575 *keyp = NULL; 3576 if (commentp != NULL) 3577 *commentp = NULL; 3578 3579 /* Check that it is at least big enough to contain the ID string. */ 3580 if (sshbuf_len(blob) < sizeof(LEGACY_BEGIN)) 3581 return SSH_ERR_INVALID_FORMAT; 3582 3583 /* 3584 * Make sure it begins with the id string. Consume the id string 3585 * from the buffer. 3586 */ 3587 if (memcmp(sshbuf_ptr(blob), LEGACY_BEGIN, sizeof(LEGACY_BEGIN)) != 0) 3588 return SSH_ERR_INVALID_FORMAT; 3589 3590 if ((prv = sshkey_new_private(KEY_RSA1)) == NULL) { 3591 r = SSH_ERR_ALLOC_FAIL; 3592 goto out; 3593 } 3594 if ((copy = sshbuf_fromb(blob)) == NULL || 3595 (decrypted = sshbuf_new()) == NULL) { 3596 r = SSH_ERR_ALLOC_FAIL; 3597 goto out; 3598 } 3599 if ((r = sshbuf_consume(copy, sizeof(LEGACY_BEGIN))) != 0) 3600 goto out; 3601 3602 /* Read cipher type. */ 3603 if ((r = sshbuf_get_u8(copy, &cipher_type)) != 0 || 3604 (r = sshbuf_get_u32(copy, NULL)) != 0) /* reserved */ 3605 goto out; 3606 3607 /* Read the public key and comment from the buffer. */ 3608 if ((r = sshbuf_get_u32(copy, NULL)) != 0 || /* key bits */ 3609 (r = sshbuf_get_bignum1(copy, prv->rsa->n)) != 0 || 3610 (r = sshbuf_get_bignum1(copy, prv->rsa->e)) != 0 || 3611 (r = sshbuf_get_cstring(copy, &comment, NULL)) != 0) 3612 goto out; 3613 3614 /* Check that it is a supported cipher. */ 3615 cipher = cipher_by_number(cipher_type); 3616 if (cipher == NULL) { 3617 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 3618 goto out; 3619 } 3620 /* Initialize space for decrypted data. */ 3621 if ((r = sshbuf_reserve(decrypted, sshbuf_len(copy), &cp)) != 0) 3622 goto out; 3623 3624 /* Rest of the buffer is encrypted. Decrypt it using the passphrase. */ 3625 if ((r = cipher_set_key_string(&ciphercontext, cipher, passphrase, 3626 CIPHER_DECRYPT)) != 0) 3627 goto out; 3628 if ((r = cipher_crypt(&ciphercontext, 0, cp, 3629 sshbuf_ptr(copy), sshbuf_len(copy), 0, 0)) != 0) { 3630 cipher_cleanup(&ciphercontext); 3631 goto out; 3632 } 3633 if ((r = cipher_cleanup(&ciphercontext)) != 0) 3634 goto out; 3635 3636 if ((r = sshbuf_get_u16(decrypted, &check1)) != 0 || 3637 (r = sshbuf_get_u16(decrypted, &check2)) != 0) 3638 goto out; 3639 if (check1 != check2) { 3640 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3641 goto out; 3642 } 3643 3644 /* Read the rest of the private key. */ 3645 if ((r = sshbuf_get_bignum1(decrypted, prv->rsa->d)) != 0 || 3646 (r = sshbuf_get_bignum1(decrypted, prv->rsa->iqmp)) != 0 || 3647 (r = sshbuf_get_bignum1(decrypted, prv->rsa->q)) != 0 || 3648 (r = sshbuf_get_bignum1(decrypted, prv->rsa->p)) != 0) 3649 goto out; 3650 3651 /* calculate p-1 and q-1 */ 3652 if ((r = rsa_generate_additional_parameters(prv->rsa)) != 0) 3653 goto out; 3654 3655 /* enable blinding */ 3656 if (RSA_blinding_on(prv->rsa, NULL) != 1) { 3657 r = SSH_ERR_LIBCRYPTO_ERROR; 3658 goto out; 3659 } 3660 r = 0; 3661 *keyp = prv; 3662 prv = NULL; 3663 if (commentp != NULL) { 3664 *commentp = comment; 3665 comment = NULL; 3666 } 3667 out: 3668 explicit_bzero(&ciphercontext, sizeof(ciphercontext)); 3669 if (comment != NULL) 3670 free(comment); 3671 if (prv != NULL) 3672 sshkey_free(prv); 3673 if (copy != NULL) 3674 sshbuf_free(copy); 3675 if (decrypted != NULL) 3676 sshbuf_free(decrypted); 3677 return r; 3678 } 3679 #endif /* WITH_SSH1 */ 3680 3681 #ifdef WITH_OPENSSL 3682 static int 3683 sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, 3684 const char *passphrase, struct sshkey **keyp) 3685 { 3686 EVP_PKEY *pk = NULL; 3687 struct sshkey *prv = NULL; 3688 BIO *bio = NULL; 3689 int r; 3690 3691 *keyp = NULL; 3692 3693 if ((bio = BIO_new(BIO_s_mem())) == NULL || sshbuf_len(blob) > INT_MAX) 3694 return SSH_ERR_ALLOC_FAIL; 3695 if (BIO_write(bio, sshbuf_ptr(blob), sshbuf_len(blob)) != 3696 (int)sshbuf_len(blob)) { 3697 r = SSH_ERR_ALLOC_FAIL; 3698 goto out; 3699 } 3700 3701 if ((pk = PEM_read_bio_PrivateKey(bio, NULL, NULL, 3702 (char *)passphrase)) == NULL) { 3703 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3704 goto out; 3705 } 3706 if (pk->type == EVP_PKEY_RSA && 3707 (type == KEY_UNSPEC || type == KEY_RSA)) { 3708 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 3709 r = SSH_ERR_ALLOC_FAIL; 3710 goto out; 3711 } 3712 prv->rsa = EVP_PKEY_get1_RSA(pk); 3713 prv->type = KEY_RSA; 3714 #ifdef DEBUG_PK 3715 RSA_print_fp(stderr, prv->rsa, 8); 3716 #endif 3717 if (RSA_blinding_on(prv->rsa, NULL) != 1) { 3718 r = SSH_ERR_LIBCRYPTO_ERROR; 3719 goto out; 3720 } 3721 } else if (pk->type == EVP_PKEY_DSA && 3722 (type == KEY_UNSPEC || type == KEY_DSA)) { 3723 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 3724 r = SSH_ERR_ALLOC_FAIL; 3725 goto out; 3726 } 3727 prv->dsa = EVP_PKEY_get1_DSA(pk); 3728 prv->type = KEY_DSA; 3729 #ifdef DEBUG_PK 3730 DSA_print_fp(stderr, prv->dsa, 8); 3731 #endif 3732 } else if (pk->type == EVP_PKEY_EC && 3733 (type == KEY_UNSPEC || type == KEY_ECDSA)) { 3734 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 3735 r = SSH_ERR_ALLOC_FAIL; 3736 goto out; 3737 } 3738 prv->ecdsa = EVP_PKEY_get1_EC_KEY(pk); 3739 prv->type = KEY_ECDSA; 3740 prv->ecdsa_nid = sshkey_ecdsa_key_to_nid(prv->ecdsa); 3741 if (prv->ecdsa_nid == -1 || 3742 sshkey_curve_nid_to_name(prv->ecdsa_nid) == NULL || 3743 sshkey_ec_validate_public(EC_KEY_get0_group(prv->ecdsa), 3744 EC_KEY_get0_public_key(prv->ecdsa)) != 0 || 3745 sshkey_ec_validate_private(prv->ecdsa) != 0) { 3746 r = SSH_ERR_INVALID_FORMAT; 3747 goto out; 3748 } 3749 #ifdef DEBUG_PK 3750 if (prv != NULL && prv->ecdsa != NULL) 3751 sshkey_dump_ec_key(prv->ecdsa); 3752 #endif 3753 } else { 3754 r = SSH_ERR_INVALID_FORMAT; 3755 goto out; 3756 } 3757 r = 0; 3758 *keyp = prv; 3759 prv = NULL; 3760 out: 3761 BIO_free(bio); 3762 if (pk != NULL) 3763 EVP_PKEY_free(pk); 3764 if (prv != NULL) 3765 sshkey_free(prv); 3766 return r; 3767 } 3768 #endif /* WITH_OPENSSL */ 3769 3770 int 3771 sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type, 3772 const char *passphrase, struct sshkey **keyp, char **commentp) 3773 { 3774 *keyp = NULL; 3775 if (commentp != NULL) 3776 *commentp = NULL; 3777 3778 switch (type) { 3779 #ifdef WITH_SSH1 3780 case KEY_RSA1: 3781 return sshkey_parse_private_rsa1(blob, passphrase, 3782 keyp, commentp); 3783 #endif /* WITH_SSH1 */ 3784 #ifdef WITH_OPENSSL 3785 case KEY_DSA: 3786 case KEY_ECDSA: 3787 case KEY_RSA: 3788 return sshkey_parse_private_pem_fileblob(blob, type, 3789 passphrase, keyp); 3790 #endif /* WITH_OPENSSL */ 3791 case KEY_ED25519: 3792 return sshkey_parse_private2(blob, type, passphrase, 3793 keyp, commentp); 3794 case KEY_UNSPEC: 3795 if (sshkey_parse_private2(blob, type, passphrase, keyp, 3796 commentp) == 0) 3797 return 0; 3798 #ifdef WITH_OPENSSL 3799 return sshkey_parse_private_pem_fileblob(blob, type, 3800 passphrase, keyp); 3801 #else 3802 return SSH_ERR_INVALID_FORMAT; 3803 #endif /* WITH_OPENSSL */ 3804 default: 3805 return SSH_ERR_KEY_TYPE_UNKNOWN; 3806 } 3807 } 3808 3809 int 3810 sshkey_parse_private_fileblob(struct sshbuf *buffer, const char *passphrase, 3811 struct sshkey **keyp, char **commentp) 3812 { 3813 if (keyp != NULL) 3814 *keyp = NULL; 3815 if (commentp != NULL) 3816 *commentp = NULL; 3817 3818 #ifdef WITH_SSH1 3819 /* it's a SSH v1 key if the public key part is readable */ 3820 if (sshkey_parse_public_rsa1_fileblob(buffer, NULL, NULL) == 0) { 3821 return sshkey_parse_private_fileblob_type(buffer, KEY_RSA1, 3822 passphrase, keyp, commentp); 3823 } 3824 #endif /* WITH_SSH1 */ 3825 return sshkey_parse_private_fileblob_type(buffer, KEY_UNSPEC, 3826 passphrase, keyp, commentp); 3827 } 3828