xref: /openbsd-src/usr.bin/ssh/ssh-pkcs11-client.c (revision 48950c12d106c85f315112191a0228d7b83b9510)
1 /* $OpenBSD: ssh-pkcs11-client.c,v 1.3 2012/01/16 20:34:09 miod Exp $ */
2 /*
3  * Copyright (c) 2010 Markus Friedl.  All rights reserved.
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/types.h>
19 #include <sys/time.h>
20 #include <sys/socket.h>
21 
22 #include <stdarg.h>
23 #include <string.h>
24 #include <unistd.h>
25 #include <errno.h>
26 
27 #include "pathnames.h"
28 #include "xmalloc.h"
29 #include "buffer.h"
30 #include "log.h"
31 #include "misc.h"
32 #include "key.h"
33 #include "authfd.h"
34 #include "atomicio.h"
35 #include "ssh-pkcs11.h"
36 
37 /* borrows code from sftp-server and ssh-agent */
38 
39 int fd = -1;
40 pid_t pid = -1;
41 
42 static void
43 send_msg(Buffer *m)
44 {
45 	u_char buf[4];
46 	int mlen = buffer_len(m);
47 
48 	put_u32(buf, mlen);
49 	if (atomicio(vwrite, fd, buf, 4) != 4 ||
50 	    atomicio(vwrite, fd, buffer_ptr(m),
51 	    buffer_len(m)) != buffer_len(m))
52 		error("write to helper failed");
53 	buffer_consume(m, mlen);
54 }
55 
56 static int
57 recv_msg(Buffer *m)
58 {
59 	u_int l, len;
60 	u_char buf[1024];
61 
62 	if ((len = atomicio(read, fd, buf, 4)) != 4) {
63 		error("read from helper failed: %u", len);
64 		return (0); /* XXX */
65 	}
66 	len = get_u32(buf);
67 	if (len > 256 * 1024)
68 		fatal("response too long: %u", len);
69 	/* read len bytes into m */
70 	buffer_clear(m);
71 	while (len > 0) {
72 		l = len;
73 		if (l > sizeof(buf))
74 			l = sizeof(buf);
75 		if (atomicio(read, fd, buf, l) != l) {
76 			error("response from helper failed.");
77 			return (0); /* XXX */
78 		}
79 		buffer_append(m, buf, l);
80 		len -= l;
81 	}
82 	return (buffer_get_char(m));
83 }
84 
85 int
86 pkcs11_init(int interactive)
87 {
88 	return (0);
89 }
90 
91 void
92 pkcs11_terminate(void)
93 {
94 	close(fd);
95 }
96 
97 static int
98 pkcs11_rsa_private_encrypt(int flen, const u_char *from, u_char *to, RSA *rsa,
99     int padding)
100 {
101 	Key key;
102 	u_char *blob, *signature = NULL;
103 	u_int blen, slen = 0;
104 	int ret = -1;
105 	Buffer msg;
106 
107 	if (padding != RSA_PKCS1_PADDING)
108 		return (-1);
109 	key.type = KEY_RSA;
110 	key.rsa = rsa;
111 	if (key_to_blob(&key, &blob, &blen) == 0)
112 		return -1;
113 	buffer_init(&msg);
114 	buffer_put_char(&msg, SSH2_AGENTC_SIGN_REQUEST);
115 	buffer_put_string(&msg, blob, blen);
116 	buffer_put_string(&msg, from, flen);
117 	buffer_put_int(&msg, 0);
118 	xfree(blob);
119 	send_msg(&msg);
120 	buffer_clear(&msg);
121 
122 	if (recv_msg(&msg) == SSH2_AGENT_SIGN_RESPONSE) {
123 		signature = buffer_get_string(&msg, &slen);
124 		if (slen <= (u_int)RSA_size(rsa)) {
125 			memcpy(to, signature, slen);
126 			ret = slen;
127 		}
128 		xfree(signature);
129 	}
130 	buffer_free(&msg);
131 	return (ret);
132 }
133 
134 /* redirect the private key encrypt operation to the ssh-pkcs11-helper */
135 static int
136 wrap_key(RSA *rsa)
137 {
138 	static RSA_METHOD helper_rsa;
139 
140 	memcpy(&helper_rsa, RSA_get_default_method(), sizeof(helper_rsa));
141 	helper_rsa.name = "ssh-pkcs11-helper";
142 	helper_rsa.rsa_priv_enc = pkcs11_rsa_private_encrypt;
143 	RSA_set_method(rsa, &helper_rsa);
144 	return (0);
145 }
146 
147 static int
148 pkcs11_start_helper(void)
149 {
150 	int pair[2];
151 
152 	if (socketpair(AF_UNIX, SOCK_STREAM, 0, pair) == -1) {
153 		error("socketpair: %s", strerror(errno));
154 		return (-1);
155 	}
156 	if ((pid = fork()) == -1) {
157 		error("fork: %s", strerror(errno));
158 		return (-1);
159 	} else if (pid == 0) {
160 		if ((dup2(pair[1], STDIN_FILENO) == -1) ||
161 		    (dup2(pair[1], STDOUT_FILENO) == -1)) {
162 			fprintf(stderr, "dup2: %s\n", strerror(errno));
163 			_exit(1);
164 		}
165 		close(pair[0]);
166 		close(pair[1]);
167 		execlp(_PATH_SSH_PKCS11_HELPER, _PATH_SSH_PKCS11_HELPER,
168 		    (char *) 0);
169 		fprintf(stderr, "exec: %s: %s\n", _PATH_SSH_PKCS11_HELPER,
170 		    strerror(errno));
171 		_exit(1);
172 	}
173 	close(pair[1]);
174 	fd = pair[0];
175 	return (0);
176 }
177 
178 int
179 pkcs11_add_provider(char *name, char *pin, Key ***keysp)
180 {
181 	Key *k;
182 	int i, nkeys;
183 	u_char *blob;
184 	u_int blen;
185 	Buffer msg;
186 
187 	if (fd < 0 && pkcs11_start_helper() < 0)
188 		return (-1);
189 
190 	buffer_init(&msg);
191 	buffer_put_char(&msg, SSH_AGENTC_ADD_SMARTCARD_KEY);
192 	buffer_put_cstring(&msg, name);
193 	buffer_put_cstring(&msg, pin);
194 	send_msg(&msg);
195 	buffer_clear(&msg);
196 
197 	if (recv_msg(&msg) == SSH2_AGENT_IDENTITIES_ANSWER) {
198 		nkeys = buffer_get_int(&msg);
199 		*keysp = xcalloc(nkeys, sizeof(Key *));
200 		for (i = 0; i < nkeys; i++) {
201 			blob = buffer_get_string(&msg, &blen);
202 			xfree(buffer_get_string(&msg, NULL));
203 			k = key_from_blob(blob, blen);
204 			wrap_key(k->rsa);
205 			(*keysp)[i] = k;
206 			xfree(blob);
207 		}
208 	} else {
209 		nkeys = -1;
210 	}
211 	buffer_free(&msg);
212 	return (nkeys);
213 }
214 
215 int
216 pkcs11_del_provider(char *name)
217 {
218 	int ret = -1;
219 	Buffer msg;
220 
221 	buffer_init(&msg);
222 	buffer_put_char(&msg, SSH_AGENTC_REMOVE_SMARTCARD_KEY);
223 	buffer_put_cstring(&msg, name);
224 	buffer_put_cstring(&msg, "");
225 	send_msg(&msg);
226 	buffer_clear(&msg);
227 
228 	if (recv_msg(&msg) == SSH_AGENT_SUCCESS)
229 		ret = 0;
230 	buffer_free(&msg);
231 	return (ret);
232 }
233