1 /* $OpenBSD: sshkey.c,v 1.21 2015/08/19 23:19:01 djm Exp $ */ 2 /* 3 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 4 * Copyright (c) 2008 Alexander von Gernler. All rights reserved. 5 * Copyright (c) 2010,2011 Damien Miller. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 #include <sys/param.h> /* MIN MAX */ 29 #include <sys/types.h> 30 #include <netinet/in.h> 31 32 #ifdef WITH_OPENSSL 33 #include <openssl/evp.h> 34 #include <openssl/err.h> 35 #include <openssl/pem.h> 36 #endif 37 38 #include "crypto_api.h" 39 40 #include <errno.h> 41 #include <stdio.h> 42 #include <string.h> 43 #include <util.h> 44 #include <limits.h> 45 #include <resolv.h> 46 47 #include "ssh2.h" 48 #include "ssherr.h" 49 #include "misc.h" 50 #include "sshbuf.h" 51 #include "rsa.h" 52 #include "cipher.h" 53 #include "digest.h" 54 #define SSHKEY_INTERNAL 55 #include "sshkey.h" 56 #include "match.h" 57 58 /* openssh private key file format */ 59 #define MARK_BEGIN "-----BEGIN OPENSSH PRIVATE KEY-----\n" 60 #define MARK_END "-----END OPENSSH PRIVATE KEY-----\n" 61 #define MARK_BEGIN_LEN (sizeof(MARK_BEGIN) - 1) 62 #define MARK_END_LEN (sizeof(MARK_END) - 1) 63 #define KDFNAME "bcrypt" 64 #define AUTH_MAGIC "openssh-key-v1" 65 #define SALT_LEN 16 66 #define DEFAULT_CIPHERNAME "aes256-cbc" 67 #define DEFAULT_ROUNDS 16 68 69 /* Version identification string for SSH v1 identity files. */ 70 #define LEGACY_BEGIN "SSH PRIVATE KEY FILE FORMAT 1.1\n" 71 72 static int sshkey_from_blob_internal(struct sshbuf *buf, 73 struct sshkey **keyp, int allow_cert); 74 75 /* Supported key types */ 76 struct keytype { 77 const char *name; 78 const char *shortname; 79 int type; 80 int nid; 81 int cert; 82 }; 83 static const struct keytype keytypes[] = { 84 { "ssh-ed25519", "ED25519", KEY_ED25519, 0, 0 }, 85 { "ssh-ed25519-cert-v01@openssh.com", "ED25519-CERT", 86 KEY_ED25519_CERT, 0, 1 }, 87 #ifdef WITH_OPENSSL 88 { NULL, "RSA1", KEY_RSA1, 0, 0 }, 89 { "ssh-rsa", "RSA", KEY_RSA, 0, 0 }, 90 { "ssh-dss", "DSA", KEY_DSA, 0, 0 }, 91 { "ecdsa-sha2-nistp256", "ECDSA", KEY_ECDSA, NID_X9_62_prime256v1, 0 }, 92 { "ecdsa-sha2-nistp384", "ECDSA", KEY_ECDSA, NID_secp384r1, 0 }, 93 { "ecdsa-sha2-nistp521", "ECDSA", KEY_ECDSA, NID_secp521r1, 0 }, 94 { "ssh-rsa-cert-v01@openssh.com", "RSA-CERT", KEY_RSA_CERT, 0, 1 }, 95 { "ssh-dss-cert-v01@openssh.com", "DSA-CERT", KEY_DSA_CERT, 0, 1 }, 96 { "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ECDSA-CERT", 97 KEY_ECDSA_CERT, NID_X9_62_prime256v1, 1 }, 98 { "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ECDSA-CERT", 99 KEY_ECDSA_CERT, NID_secp384r1, 1 }, 100 { "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ECDSA-CERT", 101 KEY_ECDSA_CERT, NID_secp521r1, 1 }, 102 #endif /* WITH_OPENSSL */ 103 { NULL, NULL, -1, -1, 0 } 104 }; 105 106 const char * 107 sshkey_type(const struct sshkey *k) 108 { 109 const struct keytype *kt; 110 111 for (kt = keytypes; kt->type != -1; kt++) { 112 if (kt->type == k->type) 113 return kt->shortname; 114 } 115 return "unknown"; 116 } 117 118 static const char * 119 sshkey_ssh_name_from_type_nid(int type, int nid) 120 { 121 const struct keytype *kt; 122 123 for (kt = keytypes; kt->type != -1; kt++) { 124 if (kt->type == type && (kt->nid == 0 || kt->nid == nid)) 125 return kt->name; 126 } 127 return "ssh-unknown"; 128 } 129 130 int 131 sshkey_type_is_cert(int type) 132 { 133 const struct keytype *kt; 134 135 for (kt = keytypes; kt->type != -1; kt++) { 136 if (kt->type == type) 137 return kt->cert; 138 } 139 return 0; 140 } 141 142 const char * 143 sshkey_ssh_name(const struct sshkey *k) 144 { 145 return sshkey_ssh_name_from_type_nid(k->type, k->ecdsa_nid); 146 } 147 148 const char * 149 sshkey_ssh_name_plain(const struct sshkey *k) 150 { 151 return sshkey_ssh_name_from_type_nid(sshkey_type_plain(k->type), 152 k->ecdsa_nid); 153 } 154 155 int 156 sshkey_type_from_name(const char *name) 157 { 158 const struct keytype *kt; 159 160 for (kt = keytypes; kt->type != -1; kt++) { 161 /* Only allow shortname matches for plain key types */ 162 if ((kt->name != NULL && strcmp(name, kt->name) == 0) || 163 (!kt->cert && strcasecmp(kt->shortname, name) == 0)) 164 return kt->type; 165 } 166 return KEY_UNSPEC; 167 } 168 169 int 170 sshkey_ecdsa_nid_from_name(const char *name) 171 { 172 const struct keytype *kt; 173 174 for (kt = keytypes; kt->type != -1; kt++) { 175 if (kt->type != KEY_ECDSA && kt->type != KEY_ECDSA_CERT) 176 continue; 177 if (kt->name != NULL && strcmp(name, kt->name) == 0) 178 return kt->nid; 179 } 180 return -1; 181 } 182 183 char * 184 key_alg_list(int certs_only, int plain_only) 185 { 186 char *tmp, *ret = NULL; 187 size_t nlen, rlen = 0; 188 const struct keytype *kt; 189 190 for (kt = keytypes; kt->type != -1; kt++) { 191 if (kt->name == NULL) 192 continue; 193 if ((certs_only && !kt->cert) || (plain_only && kt->cert)) 194 continue; 195 if (ret != NULL) 196 ret[rlen++] = '\n'; 197 nlen = strlen(kt->name); 198 if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) { 199 free(ret); 200 return NULL; 201 } 202 ret = tmp; 203 memcpy(ret + rlen, kt->name, nlen + 1); 204 rlen += nlen; 205 } 206 return ret; 207 } 208 209 int 210 sshkey_names_valid2(const char *names, int allow_wildcard) 211 { 212 char *s, *cp, *p; 213 const struct keytype *kt; 214 int type; 215 216 if (names == NULL || strcmp(names, "") == 0) 217 return 0; 218 if ((s = cp = strdup(names)) == NULL) 219 return 0; 220 for ((p = strsep(&cp, ",")); p && *p != '\0'; 221 (p = strsep(&cp, ","))) { 222 type = sshkey_type_from_name(p); 223 if (type == KEY_RSA1) { 224 free(s); 225 return 0; 226 } 227 if (type == KEY_UNSPEC) { 228 if (allow_wildcard) { 229 /* 230 * Try matching key types against the string. 231 * If any has a positive or negative match then 232 * the component is accepted. 233 */ 234 for (kt = keytypes; kt->type != -1; kt++) { 235 if (kt->type == KEY_RSA1) 236 continue; 237 if (match_pattern_list(kt->name, 238 p, 0) != 0) 239 break; 240 } 241 if (kt->type != -1) 242 continue; 243 } 244 free(s); 245 return 0; 246 } 247 } 248 free(s); 249 return 1; 250 } 251 252 u_int 253 sshkey_size(const struct sshkey *k) 254 { 255 switch (k->type) { 256 #ifdef WITH_OPENSSL 257 case KEY_RSA1: 258 case KEY_RSA: 259 case KEY_RSA_CERT: 260 return BN_num_bits(k->rsa->n); 261 case KEY_DSA: 262 case KEY_DSA_CERT: 263 return BN_num_bits(k->dsa->p); 264 case KEY_ECDSA: 265 case KEY_ECDSA_CERT: 266 return sshkey_curve_nid_to_bits(k->ecdsa_nid); 267 #endif /* WITH_OPENSSL */ 268 case KEY_ED25519: 269 case KEY_ED25519_CERT: 270 return 256; /* XXX */ 271 } 272 return 0; 273 } 274 275 static int 276 sshkey_type_is_valid_ca(int type) 277 { 278 switch (type) { 279 case KEY_RSA: 280 case KEY_DSA: 281 case KEY_ECDSA: 282 case KEY_ED25519: 283 return 1; 284 default: 285 return 0; 286 } 287 } 288 289 int 290 sshkey_is_cert(const struct sshkey *k) 291 { 292 if (k == NULL) 293 return 0; 294 return sshkey_type_is_cert(k->type); 295 } 296 297 /* Return the cert-less equivalent to a certified key type */ 298 int 299 sshkey_type_plain(int type) 300 { 301 switch (type) { 302 case KEY_RSA_CERT: 303 return KEY_RSA; 304 case KEY_DSA_CERT: 305 return KEY_DSA; 306 case KEY_ECDSA_CERT: 307 return KEY_ECDSA; 308 case KEY_ED25519_CERT: 309 return KEY_ED25519; 310 default: 311 return type; 312 } 313 } 314 315 #ifdef WITH_OPENSSL 316 /* XXX: these are really begging for a table-driven approach */ 317 int 318 sshkey_curve_name_to_nid(const char *name) 319 { 320 if (strcmp(name, "nistp256") == 0) 321 return NID_X9_62_prime256v1; 322 else if (strcmp(name, "nistp384") == 0) 323 return NID_secp384r1; 324 else if (strcmp(name, "nistp521") == 0) 325 return NID_secp521r1; 326 else 327 return -1; 328 } 329 330 u_int 331 sshkey_curve_nid_to_bits(int nid) 332 { 333 switch (nid) { 334 case NID_X9_62_prime256v1: 335 return 256; 336 case NID_secp384r1: 337 return 384; 338 case NID_secp521r1: 339 return 521; 340 default: 341 return 0; 342 } 343 } 344 345 int 346 sshkey_ecdsa_bits_to_nid(int bits) 347 { 348 switch (bits) { 349 case 256: 350 return NID_X9_62_prime256v1; 351 case 384: 352 return NID_secp384r1; 353 case 521: 354 return NID_secp521r1; 355 default: 356 return -1; 357 } 358 } 359 360 const char * 361 sshkey_curve_nid_to_name(int nid) 362 { 363 switch (nid) { 364 case NID_X9_62_prime256v1: 365 return "nistp256"; 366 case NID_secp384r1: 367 return "nistp384"; 368 case NID_secp521r1: 369 return "nistp521"; 370 default: 371 return NULL; 372 } 373 } 374 375 int 376 sshkey_ec_nid_to_hash_alg(int nid) 377 { 378 int kbits = sshkey_curve_nid_to_bits(nid); 379 380 if (kbits <= 0) 381 return -1; 382 383 /* RFC5656 section 6.2.1 */ 384 if (kbits <= 256) 385 return SSH_DIGEST_SHA256; 386 else if (kbits <= 384) 387 return SSH_DIGEST_SHA384; 388 else 389 return SSH_DIGEST_SHA512; 390 } 391 #endif /* WITH_OPENSSL */ 392 393 static void 394 cert_free(struct sshkey_cert *cert) 395 { 396 u_int i; 397 398 if (cert == NULL) 399 return; 400 if (cert->certblob != NULL) 401 sshbuf_free(cert->certblob); 402 if (cert->critical != NULL) 403 sshbuf_free(cert->critical); 404 if (cert->extensions != NULL) 405 sshbuf_free(cert->extensions); 406 if (cert->key_id != NULL) 407 free(cert->key_id); 408 for (i = 0; i < cert->nprincipals; i++) 409 free(cert->principals[i]); 410 if (cert->principals != NULL) 411 free(cert->principals); 412 if (cert->signature_key != NULL) 413 sshkey_free(cert->signature_key); 414 explicit_bzero(cert, sizeof(*cert)); 415 free(cert); 416 } 417 418 static struct sshkey_cert * 419 cert_new(void) 420 { 421 struct sshkey_cert *cert; 422 423 if ((cert = calloc(1, sizeof(*cert))) == NULL) 424 return NULL; 425 if ((cert->certblob = sshbuf_new()) == NULL || 426 (cert->critical = sshbuf_new()) == NULL || 427 (cert->extensions = sshbuf_new()) == NULL) { 428 cert_free(cert); 429 return NULL; 430 } 431 cert->key_id = NULL; 432 cert->principals = NULL; 433 cert->signature_key = NULL; 434 return cert; 435 } 436 437 struct sshkey * 438 sshkey_new(int type) 439 { 440 struct sshkey *k; 441 #ifdef WITH_OPENSSL 442 RSA *rsa; 443 DSA *dsa; 444 #endif /* WITH_OPENSSL */ 445 446 if ((k = calloc(1, sizeof(*k))) == NULL) 447 return NULL; 448 k->type = type; 449 k->ecdsa = NULL; 450 k->ecdsa_nid = -1; 451 k->dsa = NULL; 452 k->rsa = NULL; 453 k->cert = NULL; 454 k->ed25519_sk = NULL; 455 k->ed25519_pk = NULL; 456 switch (k->type) { 457 #ifdef WITH_OPENSSL 458 case KEY_RSA1: 459 case KEY_RSA: 460 case KEY_RSA_CERT: 461 if ((rsa = RSA_new()) == NULL || 462 (rsa->n = BN_new()) == NULL || 463 (rsa->e = BN_new()) == NULL) { 464 if (rsa != NULL) 465 RSA_free(rsa); 466 free(k); 467 return NULL; 468 } 469 k->rsa = rsa; 470 break; 471 case KEY_DSA: 472 case KEY_DSA_CERT: 473 if ((dsa = DSA_new()) == NULL || 474 (dsa->p = BN_new()) == NULL || 475 (dsa->q = BN_new()) == NULL || 476 (dsa->g = BN_new()) == NULL || 477 (dsa->pub_key = BN_new()) == NULL) { 478 if (dsa != NULL) 479 DSA_free(dsa); 480 free(k); 481 return NULL; 482 } 483 k->dsa = dsa; 484 break; 485 case KEY_ECDSA: 486 case KEY_ECDSA_CERT: 487 /* Cannot do anything until we know the group */ 488 break; 489 #endif /* WITH_OPENSSL */ 490 case KEY_ED25519: 491 case KEY_ED25519_CERT: 492 /* no need to prealloc */ 493 break; 494 case KEY_UNSPEC: 495 break; 496 default: 497 free(k); 498 return NULL; 499 break; 500 } 501 502 if (sshkey_is_cert(k)) { 503 if ((k->cert = cert_new()) == NULL) { 504 sshkey_free(k); 505 return NULL; 506 } 507 } 508 509 return k; 510 } 511 512 int 513 sshkey_add_private(struct sshkey *k) 514 { 515 switch (k->type) { 516 #ifdef WITH_OPENSSL 517 case KEY_RSA1: 518 case KEY_RSA: 519 case KEY_RSA_CERT: 520 #define bn_maybe_alloc_failed(p) (p == NULL && (p = BN_new()) == NULL) 521 if (bn_maybe_alloc_failed(k->rsa->d) || 522 bn_maybe_alloc_failed(k->rsa->iqmp) || 523 bn_maybe_alloc_failed(k->rsa->q) || 524 bn_maybe_alloc_failed(k->rsa->p) || 525 bn_maybe_alloc_failed(k->rsa->dmq1) || 526 bn_maybe_alloc_failed(k->rsa->dmp1)) 527 return SSH_ERR_ALLOC_FAIL; 528 break; 529 case KEY_DSA: 530 case KEY_DSA_CERT: 531 if (bn_maybe_alloc_failed(k->dsa->priv_key)) 532 return SSH_ERR_ALLOC_FAIL; 533 break; 534 #undef bn_maybe_alloc_failed 535 case KEY_ECDSA: 536 case KEY_ECDSA_CERT: 537 /* Cannot do anything until we know the group */ 538 break; 539 #endif /* WITH_OPENSSL */ 540 case KEY_ED25519: 541 case KEY_ED25519_CERT: 542 /* no need to prealloc */ 543 break; 544 case KEY_UNSPEC: 545 break; 546 default: 547 return SSH_ERR_INVALID_ARGUMENT; 548 } 549 return 0; 550 } 551 552 struct sshkey * 553 sshkey_new_private(int type) 554 { 555 struct sshkey *k = sshkey_new(type); 556 557 if (k == NULL) 558 return NULL; 559 if (sshkey_add_private(k) != 0) { 560 sshkey_free(k); 561 return NULL; 562 } 563 return k; 564 } 565 566 void 567 sshkey_free(struct sshkey *k) 568 { 569 if (k == NULL) 570 return; 571 switch (k->type) { 572 #ifdef WITH_OPENSSL 573 case KEY_RSA1: 574 case KEY_RSA: 575 case KEY_RSA_CERT: 576 if (k->rsa != NULL) 577 RSA_free(k->rsa); 578 k->rsa = NULL; 579 break; 580 case KEY_DSA: 581 case KEY_DSA_CERT: 582 if (k->dsa != NULL) 583 DSA_free(k->dsa); 584 k->dsa = NULL; 585 break; 586 case KEY_ECDSA: 587 case KEY_ECDSA_CERT: 588 if (k->ecdsa != NULL) 589 EC_KEY_free(k->ecdsa); 590 k->ecdsa = NULL; 591 break; 592 #endif /* WITH_OPENSSL */ 593 case KEY_ED25519: 594 case KEY_ED25519_CERT: 595 if (k->ed25519_pk) { 596 explicit_bzero(k->ed25519_pk, ED25519_PK_SZ); 597 free(k->ed25519_pk); 598 k->ed25519_pk = NULL; 599 } 600 if (k->ed25519_sk) { 601 explicit_bzero(k->ed25519_sk, ED25519_SK_SZ); 602 free(k->ed25519_sk); 603 k->ed25519_sk = NULL; 604 } 605 break; 606 case KEY_UNSPEC: 607 break; 608 default: 609 break; 610 } 611 if (sshkey_is_cert(k)) 612 cert_free(k->cert); 613 explicit_bzero(k, sizeof(*k)); 614 free(k); 615 } 616 617 static int 618 cert_compare(struct sshkey_cert *a, struct sshkey_cert *b) 619 { 620 if (a == NULL && b == NULL) 621 return 1; 622 if (a == NULL || b == NULL) 623 return 0; 624 if (sshbuf_len(a->certblob) != sshbuf_len(b->certblob)) 625 return 0; 626 if (timingsafe_bcmp(sshbuf_ptr(a->certblob), sshbuf_ptr(b->certblob), 627 sshbuf_len(a->certblob)) != 0) 628 return 0; 629 return 1; 630 } 631 632 /* 633 * Compare public portions of key only, allowing comparisons between 634 * certificates and plain keys too. 635 */ 636 int 637 sshkey_equal_public(const struct sshkey *a, const struct sshkey *b) 638 { 639 #ifdef WITH_OPENSSL 640 BN_CTX *bnctx; 641 #endif /* WITH_OPENSSL */ 642 643 if (a == NULL || b == NULL || 644 sshkey_type_plain(a->type) != sshkey_type_plain(b->type)) 645 return 0; 646 647 switch (a->type) { 648 #ifdef WITH_OPENSSL 649 case KEY_RSA1: 650 case KEY_RSA_CERT: 651 case KEY_RSA: 652 return a->rsa != NULL && b->rsa != NULL && 653 BN_cmp(a->rsa->e, b->rsa->e) == 0 && 654 BN_cmp(a->rsa->n, b->rsa->n) == 0; 655 case KEY_DSA_CERT: 656 case KEY_DSA: 657 return a->dsa != NULL && b->dsa != NULL && 658 BN_cmp(a->dsa->p, b->dsa->p) == 0 && 659 BN_cmp(a->dsa->q, b->dsa->q) == 0 && 660 BN_cmp(a->dsa->g, b->dsa->g) == 0 && 661 BN_cmp(a->dsa->pub_key, b->dsa->pub_key) == 0; 662 case KEY_ECDSA_CERT: 663 case KEY_ECDSA: 664 if (a->ecdsa == NULL || b->ecdsa == NULL || 665 EC_KEY_get0_public_key(a->ecdsa) == NULL || 666 EC_KEY_get0_public_key(b->ecdsa) == NULL) 667 return 0; 668 if ((bnctx = BN_CTX_new()) == NULL) 669 return 0; 670 if (EC_GROUP_cmp(EC_KEY_get0_group(a->ecdsa), 671 EC_KEY_get0_group(b->ecdsa), bnctx) != 0 || 672 EC_POINT_cmp(EC_KEY_get0_group(a->ecdsa), 673 EC_KEY_get0_public_key(a->ecdsa), 674 EC_KEY_get0_public_key(b->ecdsa), bnctx) != 0) { 675 BN_CTX_free(bnctx); 676 return 0; 677 } 678 BN_CTX_free(bnctx); 679 return 1; 680 #endif /* WITH_OPENSSL */ 681 case KEY_ED25519: 682 case KEY_ED25519_CERT: 683 return a->ed25519_pk != NULL && b->ed25519_pk != NULL && 684 memcmp(a->ed25519_pk, b->ed25519_pk, ED25519_PK_SZ) == 0; 685 default: 686 return 0; 687 } 688 /* NOTREACHED */ 689 } 690 691 int 692 sshkey_equal(const struct sshkey *a, const struct sshkey *b) 693 { 694 if (a == NULL || b == NULL || a->type != b->type) 695 return 0; 696 if (sshkey_is_cert(a)) { 697 if (!cert_compare(a->cert, b->cert)) 698 return 0; 699 } 700 return sshkey_equal_public(a, b); 701 } 702 703 static int 704 to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain) 705 { 706 int type, ret = SSH_ERR_INTERNAL_ERROR; 707 const char *typename; 708 709 if (key == NULL) 710 return SSH_ERR_INVALID_ARGUMENT; 711 712 if (sshkey_is_cert(key)) { 713 if (key->cert == NULL) 714 return SSH_ERR_EXPECTED_CERT; 715 if (sshbuf_len(key->cert->certblob) == 0) 716 return SSH_ERR_KEY_LACKS_CERTBLOB; 717 } 718 type = force_plain ? sshkey_type_plain(key->type) : key->type; 719 typename = sshkey_ssh_name_from_type_nid(type, key->ecdsa_nid); 720 721 switch (type) { 722 #ifdef WITH_OPENSSL 723 case KEY_DSA_CERT: 724 case KEY_ECDSA_CERT: 725 case KEY_RSA_CERT: 726 #endif /* WITH_OPENSSL */ 727 case KEY_ED25519_CERT: 728 /* Use the existing blob */ 729 /* XXX modified flag? */ 730 if ((ret = sshbuf_putb(b, key->cert->certblob)) != 0) 731 return ret; 732 break; 733 #ifdef WITH_OPENSSL 734 case KEY_DSA: 735 if (key->dsa == NULL) 736 return SSH_ERR_INVALID_ARGUMENT; 737 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 738 (ret = sshbuf_put_bignum2(b, key->dsa->p)) != 0 || 739 (ret = sshbuf_put_bignum2(b, key->dsa->q)) != 0 || 740 (ret = sshbuf_put_bignum2(b, key->dsa->g)) != 0 || 741 (ret = sshbuf_put_bignum2(b, key->dsa->pub_key)) != 0) 742 return ret; 743 break; 744 case KEY_ECDSA: 745 if (key->ecdsa == NULL) 746 return SSH_ERR_INVALID_ARGUMENT; 747 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 748 (ret = sshbuf_put_cstring(b, 749 sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || 750 (ret = sshbuf_put_eckey(b, key->ecdsa)) != 0) 751 return ret; 752 break; 753 case KEY_RSA: 754 if (key->rsa == NULL) 755 return SSH_ERR_INVALID_ARGUMENT; 756 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 757 (ret = sshbuf_put_bignum2(b, key->rsa->e)) != 0 || 758 (ret = sshbuf_put_bignum2(b, key->rsa->n)) != 0) 759 return ret; 760 break; 761 #endif /* WITH_OPENSSL */ 762 case KEY_ED25519: 763 if (key->ed25519_pk == NULL) 764 return SSH_ERR_INVALID_ARGUMENT; 765 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 766 (ret = sshbuf_put_string(b, 767 key->ed25519_pk, ED25519_PK_SZ)) != 0) 768 return ret; 769 break; 770 default: 771 return SSH_ERR_KEY_TYPE_UNKNOWN; 772 } 773 return 0; 774 } 775 776 int 777 sshkey_putb(const struct sshkey *key, struct sshbuf *b) 778 { 779 return to_blob_buf(key, b, 0); 780 } 781 782 int 783 sshkey_puts(const struct sshkey *key, struct sshbuf *b) 784 { 785 struct sshbuf *tmp; 786 int r; 787 788 if ((tmp = sshbuf_new()) == NULL) 789 return SSH_ERR_ALLOC_FAIL; 790 r = to_blob_buf(key, tmp, 0); 791 if (r == 0) 792 r = sshbuf_put_stringb(b, tmp); 793 sshbuf_free(tmp); 794 return r; 795 } 796 797 int 798 sshkey_putb_plain(const struct sshkey *key, struct sshbuf *b) 799 { 800 return to_blob_buf(key, b, 1); 801 } 802 803 static int 804 to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp, int force_plain) 805 { 806 int ret = SSH_ERR_INTERNAL_ERROR; 807 size_t len; 808 struct sshbuf *b = NULL; 809 810 if (lenp != NULL) 811 *lenp = 0; 812 if (blobp != NULL) 813 *blobp = NULL; 814 if ((b = sshbuf_new()) == NULL) 815 return SSH_ERR_ALLOC_FAIL; 816 if ((ret = to_blob_buf(key, b, force_plain)) != 0) 817 goto out; 818 len = sshbuf_len(b); 819 if (lenp != NULL) 820 *lenp = len; 821 if (blobp != NULL) { 822 if ((*blobp = malloc(len)) == NULL) { 823 ret = SSH_ERR_ALLOC_FAIL; 824 goto out; 825 } 826 memcpy(*blobp, sshbuf_ptr(b), len); 827 } 828 ret = 0; 829 out: 830 sshbuf_free(b); 831 return ret; 832 } 833 834 int 835 sshkey_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp) 836 { 837 return to_blob(key, blobp, lenp, 0); 838 } 839 840 int 841 sshkey_plain_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp) 842 { 843 return to_blob(key, blobp, lenp, 1); 844 } 845 846 int 847 sshkey_fingerprint_raw(const struct sshkey *k, int dgst_alg, 848 u_char **retp, size_t *lenp) 849 { 850 u_char *blob = NULL, *ret = NULL; 851 size_t blob_len = 0; 852 int r = SSH_ERR_INTERNAL_ERROR; 853 854 if (retp != NULL) 855 *retp = NULL; 856 if (lenp != NULL) 857 *lenp = 0; 858 if (ssh_digest_bytes(dgst_alg) == 0) { 859 r = SSH_ERR_INVALID_ARGUMENT; 860 goto out; 861 } 862 863 if (k->type == KEY_RSA1) { 864 #ifdef WITH_OPENSSL 865 int nlen = BN_num_bytes(k->rsa->n); 866 int elen = BN_num_bytes(k->rsa->e); 867 868 blob_len = nlen + elen; 869 if (nlen >= INT_MAX - elen || 870 (blob = malloc(blob_len)) == NULL) { 871 r = SSH_ERR_ALLOC_FAIL; 872 goto out; 873 } 874 BN_bn2bin(k->rsa->n, blob); 875 BN_bn2bin(k->rsa->e, blob + nlen); 876 #endif /* WITH_OPENSSL */ 877 } else if ((r = to_blob(k, &blob, &blob_len, 1)) != 0) 878 goto out; 879 if ((ret = calloc(1, SSH_DIGEST_MAX_LENGTH)) == NULL) { 880 r = SSH_ERR_ALLOC_FAIL; 881 goto out; 882 } 883 if ((r = ssh_digest_memory(dgst_alg, blob, blob_len, 884 ret, SSH_DIGEST_MAX_LENGTH)) != 0) 885 goto out; 886 /* success */ 887 if (retp != NULL) { 888 *retp = ret; 889 ret = NULL; 890 } 891 if (lenp != NULL) 892 *lenp = ssh_digest_bytes(dgst_alg); 893 r = 0; 894 out: 895 free(ret); 896 if (blob != NULL) { 897 explicit_bzero(blob, blob_len); 898 free(blob); 899 } 900 return r; 901 } 902 903 static char * 904 fingerprint_b64(const char *alg, u_char *dgst_raw, size_t dgst_raw_len) 905 { 906 char *ret; 907 size_t plen = strlen(alg) + 1; 908 size_t rlen = ((dgst_raw_len + 2) / 3) * 4 + plen + 1; 909 int r; 910 911 if (dgst_raw_len > 65536 || (ret = calloc(1, rlen)) == NULL) 912 return NULL; 913 strlcpy(ret, alg, rlen); 914 strlcat(ret, ":", rlen); 915 if (dgst_raw_len == 0) 916 return ret; 917 if ((r = b64_ntop(dgst_raw, dgst_raw_len, 918 ret + plen, rlen - plen)) == -1) { 919 explicit_bzero(ret, rlen); 920 free(ret); 921 return NULL; 922 } 923 /* Trim padding characters from end */ 924 ret[strcspn(ret, "=")] = '\0'; 925 return ret; 926 } 927 928 static char * 929 fingerprint_hex(const char *alg, u_char *dgst_raw, size_t dgst_raw_len) 930 { 931 char *retval, hex[5]; 932 size_t i, rlen = dgst_raw_len * 3 + strlen(alg) + 2; 933 934 if (dgst_raw_len > 65536 || (retval = calloc(1, rlen)) == NULL) 935 return NULL; 936 strlcpy(retval, alg, rlen); 937 strlcat(retval, ":", rlen); 938 for (i = 0; i < dgst_raw_len; i++) { 939 snprintf(hex, sizeof(hex), "%s%02x", 940 i > 0 ? ":" : "", dgst_raw[i]); 941 strlcat(retval, hex, rlen); 942 } 943 return retval; 944 } 945 946 static char * 947 fingerprint_bubblebabble(u_char *dgst_raw, size_t dgst_raw_len) 948 { 949 char vowels[] = { 'a', 'e', 'i', 'o', 'u', 'y' }; 950 char consonants[] = { 'b', 'c', 'd', 'f', 'g', 'h', 'k', 'l', 'm', 951 'n', 'p', 'r', 's', 't', 'v', 'z', 'x' }; 952 u_int i, j = 0, rounds, seed = 1; 953 char *retval; 954 955 rounds = (dgst_raw_len / 2) + 1; 956 if ((retval = calloc(rounds, 6)) == NULL) 957 return NULL; 958 retval[j++] = 'x'; 959 for (i = 0; i < rounds; i++) { 960 u_int idx0, idx1, idx2, idx3, idx4; 961 if ((i + 1 < rounds) || (dgst_raw_len % 2 != 0)) { 962 idx0 = (((((u_int)(dgst_raw[2 * i])) >> 6) & 3) + 963 seed) % 6; 964 idx1 = (((u_int)(dgst_raw[2 * i])) >> 2) & 15; 965 idx2 = ((((u_int)(dgst_raw[2 * i])) & 3) + 966 (seed / 6)) % 6; 967 retval[j++] = vowels[idx0]; 968 retval[j++] = consonants[idx1]; 969 retval[j++] = vowels[idx2]; 970 if ((i + 1) < rounds) { 971 idx3 = (((u_int)(dgst_raw[(2 * i) + 1])) >> 4) & 15; 972 idx4 = (((u_int)(dgst_raw[(2 * i) + 1]))) & 15; 973 retval[j++] = consonants[idx3]; 974 retval[j++] = '-'; 975 retval[j++] = consonants[idx4]; 976 seed = ((seed * 5) + 977 ((((u_int)(dgst_raw[2 * i])) * 7) + 978 ((u_int)(dgst_raw[(2 * i) + 1])))) % 36; 979 } 980 } else { 981 idx0 = seed % 6; 982 idx1 = 16; 983 idx2 = seed / 6; 984 retval[j++] = vowels[idx0]; 985 retval[j++] = consonants[idx1]; 986 retval[j++] = vowels[idx2]; 987 } 988 } 989 retval[j++] = 'x'; 990 retval[j++] = '\0'; 991 return retval; 992 } 993 994 /* 995 * Draw an ASCII-Art representing the fingerprint so human brain can 996 * profit from its built-in pattern recognition ability. 997 * This technique is called "random art" and can be found in some 998 * scientific publications like this original paper: 999 * 1000 * "Hash Visualization: a New Technique to improve Real-World Security", 1001 * Perrig A. and Song D., 1999, International Workshop on Cryptographic 1002 * Techniques and E-Commerce (CrypTEC '99) 1003 * sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf 1004 * 1005 * The subject came up in a talk by Dan Kaminsky, too. 1006 * 1007 * If you see the picture is different, the key is different. 1008 * If the picture looks the same, you still know nothing. 1009 * 1010 * The algorithm used here is a worm crawling over a discrete plane, 1011 * leaving a trace (augmenting the field) everywhere it goes. 1012 * Movement is taken from dgst_raw 2bit-wise. Bumping into walls 1013 * makes the respective movement vector be ignored for this turn. 1014 * Graphs are not unambiguous, because circles in graphs can be 1015 * walked in either direction. 1016 */ 1017 1018 /* 1019 * Field sizes for the random art. Have to be odd, so the starting point 1020 * can be in the exact middle of the picture, and FLDBASE should be >=8 . 1021 * Else pictures would be too dense, and drawing the frame would 1022 * fail, too, because the key type would not fit in anymore. 1023 */ 1024 #define FLDBASE 8 1025 #define FLDSIZE_Y (FLDBASE + 1) 1026 #define FLDSIZE_X (FLDBASE * 2 + 1) 1027 static char * 1028 fingerprint_randomart(const char *alg, u_char *dgst_raw, size_t dgst_raw_len, 1029 const struct sshkey *k) 1030 { 1031 /* 1032 * Chars to be used after each other every time the worm 1033 * intersects with itself. Matter of taste. 1034 */ 1035 char *augmentation_string = " .o+=*BOX@%&#/^SE"; 1036 char *retval, *p, title[FLDSIZE_X], hash[FLDSIZE_X]; 1037 u_char field[FLDSIZE_X][FLDSIZE_Y]; 1038 size_t i, tlen, hlen; 1039 u_int b; 1040 int x, y, r; 1041 size_t len = strlen(augmentation_string) - 1; 1042 1043 if ((retval = calloc((FLDSIZE_X + 3), (FLDSIZE_Y + 2))) == NULL) 1044 return NULL; 1045 1046 /* initialize field */ 1047 memset(field, 0, FLDSIZE_X * FLDSIZE_Y * sizeof(char)); 1048 x = FLDSIZE_X / 2; 1049 y = FLDSIZE_Y / 2; 1050 1051 /* process raw key */ 1052 for (i = 0; i < dgst_raw_len; i++) { 1053 int input; 1054 /* each byte conveys four 2-bit move commands */ 1055 input = dgst_raw[i]; 1056 for (b = 0; b < 4; b++) { 1057 /* evaluate 2 bit, rest is shifted later */ 1058 x += (input & 0x1) ? 1 : -1; 1059 y += (input & 0x2) ? 1 : -1; 1060 1061 /* assure we are still in bounds */ 1062 x = MAX(x, 0); 1063 y = MAX(y, 0); 1064 x = MIN(x, FLDSIZE_X - 1); 1065 y = MIN(y, FLDSIZE_Y - 1); 1066 1067 /* augment the field */ 1068 if (field[x][y] < len - 2) 1069 field[x][y]++; 1070 input = input >> 2; 1071 } 1072 } 1073 1074 /* mark starting point and end point*/ 1075 field[FLDSIZE_X / 2][FLDSIZE_Y / 2] = len - 1; 1076 field[x][y] = len; 1077 1078 /* assemble title */ 1079 r = snprintf(title, sizeof(title), "[%s %u]", 1080 sshkey_type(k), sshkey_size(k)); 1081 /* If [type size] won't fit, then try [type]; fits "[ED25519-CERT]" */ 1082 if (r < 0 || r > (int)sizeof(title)) 1083 r = snprintf(title, sizeof(title), "[%s]", sshkey_type(k)); 1084 tlen = (r <= 0) ? 0 : strlen(title); 1085 1086 /* assemble hash ID. */ 1087 r = snprintf(hash, sizeof(hash), "[%s]", alg); 1088 hlen = (r <= 0) ? 0 : strlen(hash); 1089 1090 /* output upper border */ 1091 p = retval; 1092 *p++ = '+'; 1093 for (i = 0; i < (FLDSIZE_X - tlen) / 2; i++) 1094 *p++ = '-'; 1095 memcpy(p, title, tlen); 1096 p += tlen; 1097 for (i += tlen; i < FLDSIZE_X; i++) 1098 *p++ = '-'; 1099 *p++ = '+'; 1100 *p++ = '\n'; 1101 1102 /* output content */ 1103 for (y = 0; y < FLDSIZE_Y; y++) { 1104 *p++ = '|'; 1105 for (x = 0; x < FLDSIZE_X; x++) 1106 *p++ = augmentation_string[MIN(field[x][y], len)]; 1107 *p++ = '|'; 1108 *p++ = '\n'; 1109 } 1110 1111 /* output lower border */ 1112 *p++ = '+'; 1113 for (i = 0; i < (FLDSIZE_X - hlen) / 2; i++) 1114 *p++ = '-'; 1115 memcpy(p, hash, hlen); 1116 p += hlen; 1117 for (i += hlen; i < FLDSIZE_X; i++) 1118 *p++ = '-'; 1119 *p++ = '+'; 1120 1121 return retval; 1122 } 1123 1124 char * 1125 sshkey_fingerprint(const struct sshkey *k, int dgst_alg, 1126 enum sshkey_fp_rep dgst_rep) 1127 { 1128 char *retval = NULL; 1129 u_char *dgst_raw; 1130 size_t dgst_raw_len; 1131 1132 if (sshkey_fingerprint_raw(k, dgst_alg, &dgst_raw, &dgst_raw_len) != 0) 1133 return NULL; 1134 switch (dgst_rep) { 1135 case SSH_FP_DEFAULT: 1136 if (dgst_alg == SSH_DIGEST_MD5) { 1137 retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg), 1138 dgst_raw, dgst_raw_len); 1139 } else { 1140 retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg), 1141 dgst_raw, dgst_raw_len); 1142 } 1143 break; 1144 case SSH_FP_HEX: 1145 retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg), 1146 dgst_raw, dgst_raw_len); 1147 break; 1148 case SSH_FP_BASE64: 1149 retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg), 1150 dgst_raw, dgst_raw_len); 1151 break; 1152 case SSH_FP_BUBBLEBABBLE: 1153 retval = fingerprint_bubblebabble(dgst_raw, dgst_raw_len); 1154 break; 1155 case SSH_FP_RANDOMART: 1156 retval = fingerprint_randomart(ssh_digest_alg_name(dgst_alg), 1157 dgst_raw, dgst_raw_len, k); 1158 break; 1159 default: 1160 explicit_bzero(dgst_raw, dgst_raw_len); 1161 free(dgst_raw); 1162 return NULL; 1163 } 1164 explicit_bzero(dgst_raw, dgst_raw_len); 1165 free(dgst_raw); 1166 return retval; 1167 } 1168 1169 #ifdef WITH_SSH1 1170 /* 1171 * Reads a multiple-precision integer in decimal from the buffer, and advances 1172 * the pointer. The integer must already be initialized. This function is 1173 * permitted to modify the buffer. This leaves *cpp to point just beyond the 1174 * last processed character. 1175 */ 1176 static int 1177 read_decimal_bignum(char **cpp, BIGNUM *v) 1178 { 1179 char *cp; 1180 size_t e; 1181 int skip = 1; /* skip white space */ 1182 1183 cp = *cpp; 1184 while (*cp == ' ' || *cp == '\t') 1185 cp++; 1186 e = strspn(cp, "0123456789"); 1187 if (e == 0) 1188 return SSH_ERR_INVALID_FORMAT; 1189 if (e > SSHBUF_MAX_BIGNUM * 3) 1190 return SSH_ERR_BIGNUM_TOO_LARGE; 1191 if (cp[e] == '\0') 1192 skip = 0; 1193 else if (index(" \t\r\n", cp[e]) == NULL) 1194 return SSH_ERR_INVALID_FORMAT; 1195 cp[e] = '\0'; 1196 if (BN_dec2bn(&v, cp) <= 0) 1197 return SSH_ERR_INVALID_FORMAT; 1198 *cpp = cp + e + skip; 1199 return 0; 1200 } 1201 #endif /* WITH_SSH1 */ 1202 1203 /* returns 0 ok, and < 0 error */ 1204 int 1205 sshkey_read(struct sshkey *ret, char **cpp) 1206 { 1207 struct sshkey *k; 1208 int retval = SSH_ERR_INVALID_FORMAT; 1209 char *cp, *space; 1210 int r, type, curve_nid = -1; 1211 struct sshbuf *blob; 1212 #ifdef WITH_SSH1 1213 char *ep; 1214 u_long bits; 1215 #endif /* WITH_SSH1 */ 1216 1217 cp = *cpp; 1218 1219 switch (ret->type) { 1220 case KEY_RSA1: 1221 #ifdef WITH_SSH1 1222 /* Get number of bits. */ 1223 bits = strtoul(cp, &ep, 10); 1224 if (*cp == '\0' || index(" \t\r\n", *ep) == NULL || 1225 bits == 0 || bits > SSHBUF_MAX_BIGNUM * 8) 1226 return SSH_ERR_INVALID_FORMAT; /* Bad bit count... */ 1227 /* Get public exponent, public modulus. */ 1228 if ((r = read_decimal_bignum(&ep, ret->rsa->e)) < 0) 1229 return r; 1230 if ((r = read_decimal_bignum(&ep, ret->rsa->n)) < 0) 1231 return r; 1232 *cpp = ep; 1233 /* validate the claimed number of bits */ 1234 if (BN_num_bits(ret->rsa->n) != (int)bits) 1235 return SSH_ERR_KEY_BITS_MISMATCH; 1236 retval = 0; 1237 #endif /* WITH_SSH1 */ 1238 break; 1239 case KEY_UNSPEC: 1240 case KEY_RSA: 1241 case KEY_DSA: 1242 case KEY_ECDSA: 1243 case KEY_ED25519: 1244 case KEY_DSA_CERT: 1245 case KEY_ECDSA_CERT: 1246 case KEY_RSA_CERT: 1247 case KEY_ED25519_CERT: 1248 space = strchr(cp, ' '); 1249 if (space == NULL) 1250 return SSH_ERR_INVALID_FORMAT; 1251 *space = '\0'; 1252 type = sshkey_type_from_name(cp); 1253 if (sshkey_type_plain(type) == KEY_ECDSA && 1254 (curve_nid = sshkey_ecdsa_nid_from_name(cp)) == -1) 1255 return SSH_ERR_EC_CURVE_INVALID; 1256 *space = ' '; 1257 if (type == KEY_UNSPEC) 1258 return SSH_ERR_INVALID_FORMAT; 1259 cp = space+1; 1260 if (*cp == '\0') 1261 return SSH_ERR_INVALID_FORMAT; 1262 if (ret->type != KEY_UNSPEC && ret->type != type) 1263 return SSH_ERR_KEY_TYPE_MISMATCH; 1264 if ((blob = sshbuf_new()) == NULL) 1265 return SSH_ERR_ALLOC_FAIL; 1266 /* trim comment */ 1267 space = strchr(cp, ' '); 1268 if (space) { 1269 /* advance 'space': skip whitespace */ 1270 *space++ = '\0'; 1271 while (*space == ' ' || *space == '\t') 1272 space++; 1273 *cpp = space; 1274 } else 1275 *cpp = cp + strlen(cp); 1276 if ((r = sshbuf_b64tod(blob, cp)) != 0) { 1277 sshbuf_free(blob); 1278 return r; 1279 } 1280 if ((r = sshkey_from_blob(sshbuf_ptr(blob), 1281 sshbuf_len(blob), &k)) != 0) { 1282 sshbuf_free(blob); 1283 return r; 1284 } 1285 sshbuf_free(blob); 1286 if (k->type != type) { 1287 sshkey_free(k); 1288 return SSH_ERR_KEY_TYPE_MISMATCH; 1289 } 1290 if (sshkey_type_plain(type) == KEY_ECDSA && 1291 curve_nid != k->ecdsa_nid) { 1292 sshkey_free(k); 1293 return SSH_ERR_EC_CURVE_MISMATCH; 1294 } 1295 ret->type = type; 1296 if (sshkey_is_cert(ret)) { 1297 if (!sshkey_is_cert(k)) { 1298 sshkey_free(k); 1299 return SSH_ERR_EXPECTED_CERT; 1300 } 1301 if (ret->cert != NULL) 1302 cert_free(ret->cert); 1303 ret->cert = k->cert; 1304 k->cert = NULL; 1305 } 1306 #ifdef WITH_OPENSSL 1307 if (sshkey_type_plain(ret->type) == KEY_RSA) { 1308 if (ret->rsa != NULL) 1309 RSA_free(ret->rsa); 1310 ret->rsa = k->rsa; 1311 k->rsa = NULL; 1312 #ifdef DEBUG_PK 1313 RSA_print_fp(stderr, ret->rsa, 8); 1314 #endif 1315 } 1316 if (sshkey_type_plain(ret->type) == KEY_DSA) { 1317 if (ret->dsa != NULL) 1318 DSA_free(ret->dsa); 1319 ret->dsa = k->dsa; 1320 k->dsa = NULL; 1321 #ifdef DEBUG_PK 1322 DSA_print_fp(stderr, ret->dsa, 8); 1323 #endif 1324 } 1325 if (sshkey_type_plain(ret->type) == KEY_ECDSA) { 1326 if (ret->ecdsa != NULL) 1327 EC_KEY_free(ret->ecdsa); 1328 ret->ecdsa = k->ecdsa; 1329 ret->ecdsa_nid = k->ecdsa_nid; 1330 k->ecdsa = NULL; 1331 k->ecdsa_nid = -1; 1332 #ifdef DEBUG_PK 1333 sshkey_dump_ec_key(ret->ecdsa); 1334 #endif 1335 } 1336 #endif /* WITH_OPENSSL */ 1337 if (sshkey_type_plain(ret->type) == KEY_ED25519) { 1338 free(ret->ed25519_pk); 1339 ret->ed25519_pk = k->ed25519_pk; 1340 k->ed25519_pk = NULL; 1341 #ifdef DEBUG_PK 1342 /* XXX */ 1343 #endif 1344 } 1345 retval = 0; 1346 /*XXXX*/ 1347 sshkey_free(k); 1348 if (retval != 0) 1349 break; 1350 break; 1351 default: 1352 return SSH_ERR_INVALID_ARGUMENT; 1353 } 1354 return retval; 1355 } 1356 1357 int 1358 sshkey_to_base64(const struct sshkey *key, char **b64p) 1359 { 1360 int r = SSH_ERR_INTERNAL_ERROR; 1361 struct sshbuf *b = NULL; 1362 char *uu = NULL; 1363 1364 if (b64p != NULL) 1365 *b64p = NULL; 1366 if ((b = sshbuf_new()) == NULL) 1367 return SSH_ERR_ALLOC_FAIL; 1368 if ((r = sshkey_putb(key, b)) != 0) 1369 goto out; 1370 if ((uu = sshbuf_dtob64(b)) == NULL) { 1371 r = SSH_ERR_ALLOC_FAIL; 1372 goto out; 1373 } 1374 /* Success */ 1375 if (b64p != NULL) { 1376 *b64p = uu; 1377 uu = NULL; 1378 } 1379 r = 0; 1380 out: 1381 sshbuf_free(b); 1382 free(uu); 1383 return r; 1384 } 1385 1386 static int 1387 sshkey_format_rsa1(const struct sshkey *key, struct sshbuf *b) 1388 { 1389 int r = SSH_ERR_INTERNAL_ERROR; 1390 #ifdef WITH_SSH1 1391 u_int bits = 0; 1392 char *dec_e = NULL, *dec_n = NULL; 1393 1394 if (key->rsa == NULL || key->rsa->e == NULL || 1395 key->rsa->n == NULL) { 1396 r = SSH_ERR_INVALID_ARGUMENT; 1397 goto out; 1398 } 1399 if ((dec_e = BN_bn2dec(key->rsa->e)) == NULL || 1400 (dec_n = BN_bn2dec(key->rsa->n)) == NULL) { 1401 r = SSH_ERR_ALLOC_FAIL; 1402 goto out; 1403 } 1404 /* size of modulus 'n' */ 1405 if ((bits = BN_num_bits(key->rsa->n)) <= 0) { 1406 r = SSH_ERR_INVALID_ARGUMENT; 1407 goto out; 1408 } 1409 if ((r = sshbuf_putf(b, "%u %s %s", bits, dec_e, dec_n)) != 0) 1410 goto out; 1411 1412 /* Success */ 1413 r = 0; 1414 out: 1415 if (dec_e != NULL) 1416 OPENSSL_free(dec_e); 1417 if (dec_n != NULL) 1418 OPENSSL_free(dec_n); 1419 #endif /* WITH_SSH1 */ 1420 1421 return r; 1422 } 1423 1424 static int 1425 sshkey_format_text(const struct sshkey *key, struct sshbuf *b) 1426 { 1427 int r = SSH_ERR_INTERNAL_ERROR; 1428 char *uu = NULL; 1429 1430 if (key->type == KEY_RSA1) { 1431 if ((r = sshkey_format_rsa1(key, b)) != 0) 1432 goto out; 1433 } else { 1434 /* Unsupported key types handled in sshkey_to_base64() */ 1435 if ((r = sshkey_to_base64(key, &uu)) != 0) 1436 goto out; 1437 if ((r = sshbuf_putf(b, "%s %s", 1438 sshkey_ssh_name(key), uu)) != 0) 1439 goto out; 1440 } 1441 r = 0; 1442 out: 1443 free(uu); 1444 return r; 1445 } 1446 1447 int 1448 sshkey_write(const struct sshkey *key, FILE *f) 1449 { 1450 struct sshbuf *b = NULL; 1451 int r = SSH_ERR_INTERNAL_ERROR; 1452 1453 if ((b = sshbuf_new()) == NULL) 1454 return SSH_ERR_ALLOC_FAIL; 1455 if ((r = sshkey_format_text(key, b)) != 0) 1456 goto out; 1457 if (fwrite(sshbuf_ptr(b), sshbuf_len(b), 1, f) != 1) { 1458 if (feof(f)) 1459 errno = EPIPE; 1460 r = SSH_ERR_SYSTEM_ERROR; 1461 goto out; 1462 } 1463 /* Success */ 1464 r = 0; 1465 out: 1466 sshbuf_free(b); 1467 return r; 1468 } 1469 1470 const char * 1471 sshkey_cert_type(const struct sshkey *k) 1472 { 1473 switch (k->cert->type) { 1474 case SSH2_CERT_TYPE_USER: 1475 return "user"; 1476 case SSH2_CERT_TYPE_HOST: 1477 return "host"; 1478 default: 1479 return "unknown"; 1480 } 1481 } 1482 1483 #ifdef WITH_OPENSSL 1484 static int 1485 rsa_generate_private_key(u_int bits, RSA **rsap) 1486 { 1487 RSA *private = NULL; 1488 BIGNUM *f4 = NULL; 1489 int ret = SSH_ERR_INTERNAL_ERROR; 1490 1491 if (rsap == NULL || 1492 bits < SSH_RSA_MINIMUM_MODULUS_SIZE || 1493 bits > SSHBUF_MAX_BIGNUM * 8) 1494 return SSH_ERR_INVALID_ARGUMENT; 1495 *rsap = NULL; 1496 if ((private = RSA_new()) == NULL || (f4 = BN_new()) == NULL) { 1497 ret = SSH_ERR_ALLOC_FAIL; 1498 goto out; 1499 } 1500 if (!BN_set_word(f4, RSA_F4) || 1501 !RSA_generate_key_ex(private, bits, f4, NULL)) { 1502 ret = SSH_ERR_LIBCRYPTO_ERROR; 1503 goto out; 1504 } 1505 *rsap = private; 1506 private = NULL; 1507 ret = 0; 1508 out: 1509 if (private != NULL) 1510 RSA_free(private); 1511 if (f4 != NULL) 1512 BN_free(f4); 1513 return ret; 1514 } 1515 1516 static int 1517 dsa_generate_private_key(u_int bits, DSA **dsap) 1518 { 1519 DSA *private; 1520 int ret = SSH_ERR_INTERNAL_ERROR; 1521 1522 if (dsap == NULL || bits != 1024) 1523 return SSH_ERR_INVALID_ARGUMENT; 1524 if ((private = DSA_new()) == NULL) { 1525 ret = SSH_ERR_ALLOC_FAIL; 1526 goto out; 1527 } 1528 *dsap = NULL; 1529 if (!DSA_generate_parameters_ex(private, bits, NULL, 0, NULL, 1530 NULL, NULL) || !DSA_generate_key(private)) { 1531 ret = SSH_ERR_LIBCRYPTO_ERROR; 1532 goto out; 1533 } 1534 *dsap = private; 1535 private = NULL; 1536 ret = 0; 1537 out: 1538 if (private != NULL) 1539 DSA_free(private); 1540 return ret; 1541 } 1542 1543 int 1544 sshkey_ecdsa_key_to_nid(EC_KEY *k) 1545 { 1546 EC_GROUP *eg; 1547 int nids[] = { 1548 NID_X9_62_prime256v1, 1549 NID_secp384r1, 1550 NID_secp521r1, 1551 -1 1552 }; 1553 int nid; 1554 u_int i; 1555 BN_CTX *bnctx; 1556 const EC_GROUP *g = EC_KEY_get0_group(k); 1557 1558 /* 1559 * The group may be stored in a ASN.1 encoded private key in one of two 1560 * ways: as a "named group", which is reconstituted by ASN.1 object ID 1561 * or explicit group parameters encoded into the key blob. Only the 1562 * "named group" case sets the group NID for us, but we can figure 1563 * it out for the other case by comparing against all the groups that 1564 * are supported. 1565 */ 1566 if ((nid = EC_GROUP_get_curve_name(g)) > 0) 1567 return nid; 1568 if ((bnctx = BN_CTX_new()) == NULL) 1569 return -1; 1570 for (i = 0; nids[i] != -1; i++) { 1571 if ((eg = EC_GROUP_new_by_curve_name(nids[i])) == NULL) { 1572 BN_CTX_free(bnctx); 1573 return -1; 1574 } 1575 if (EC_GROUP_cmp(g, eg, bnctx) == 0) 1576 break; 1577 EC_GROUP_free(eg); 1578 } 1579 BN_CTX_free(bnctx); 1580 if (nids[i] != -1) { 1581 /* Use the group with the NID attached */ 1582 EC_GROUP_set_asn1_flag(eg, OPENSSL_EC_NAMED_CURVE); 1583 if (EC_KEY_set_group(k, eg) != 1) { 1584 EC_GROUP_free(eg); 1585 return -1; 1586 } 1587 } 1588 return nids[i]; 1589 } 1590 1591 static int 1592 ecdsa_generate_private_key(u_int bits, int *nid, EC_KEY **ecdsap) 1593 { 1594 EC_KEY *private; 1595 int ret = SSH_ERR_INTERNAL_ERROR; 1596 1597 if (nid == NULL || ecdsap == NULL || 1598 (*nid = sshkey_ecdsa_bits_to_nid(bits)) == -1) 1599 return SSH_ERR_INVALID_ARGUMENT; 1600 *ecdsap = NULL; 1601 if ((private = EC_KEY_new_by_curve_name(*nid)) == NULL) { 1602 ret = SSH_ERR_ALLOC_FAIL; 1603 goto out; 1604 } 1605 if (EC_KEY_generate_key(private) != 1) { 1606 ret = SSH_ERR_LIBCRYPTO_ERROR; 1607 goto out; 1608 } 1609 EC_KEY_set_asn1_flag(private, OPENSSL_EC_NAMED_CURVE); 1610 *ecdsap = private; 1611 private = NULL; 1612 ret = 0; 1613 out: 1614 if (private != NULL) 1615 EC_KEY_free(private); 1616 return ret; 1617 } 1618 #endif /* WITH_OPENSSL */ 1619 1620 int 1621 sshkey_generate(int type, u_int bits, struct sshkey **keyp) 1622 { 1623 struct sshkey *k; 1624 int ret = SSH_ERR_INTERNAL_ERROR; 1625 1626 if (keyp == NULL) 1627 return SSH_ERR_INVALID_ARGUMENT; 1628 *keyp = NULL; 1629 if ((k = sshkey_new(KEY_UNSPEC)) == NULL) 1630 return SSH_ERR_ALLOC_FAIL; 1631 switch (type) { 1632 case KEY_ED25519: 1633 if ((k->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL || 1634 (k->ed25519_sk = malloc(ED25519_SK_SZ)) == NULL) { 1635 ret = SSH_ERR_ALLOC_FAIL; 1636 break; 1637 } 1638 crypto_sign_ed25519_keypair(k->ed25519_pk, k->ed25519_sk); 1639 ret = 0; 1640 break; 1641 #ifdef WITH_OPENSSL 1642 case KEY_DSA: 1643 ret = dsa_generate_private_key(bits, &k->dsa); 1644 break; 1645 case KEY_ECDSA: 1646 ret = ecdsa_generate_private_key(bits, &k->ecdsa_nid, 1647 &k->ecdsa); 1648 break; 1649 case KEY_RSA: 1650 case KEY_RSA1: 1651 ret = rsa_generate_private_key(bits, &k->rsa); 1652 break; 1653 #endif /* WITH_OPENSSL */ 1654 default: 1655 ret = SSH_ERR_INVALID_ARGUMENT; 1656 } 1657 if (ret == 0) { 1658 k->type = type; 1659 *keyp = k; 1660 } else 1661 sshkey_free(k); 1662 return ret; 1663 } 1664 1665 int 1666 sshkey_cert_copy(const struct sshkey *from_key, struct sshkey *to_key) 1667 { 1668 u_int i; 1669 const struct sshkey_cert *from; 1670 struct sshkey_cert *to; 1671 int ret = SSH_ERR_INTERNAL_ERROR; 1672 1673 if (to_key->cert != NULL) { 1674 cert_free(to_key->cert); 1675 to_key->cert = NULL; 1676 } 1677 1678 if ((from = from_key->cert) == NULL) 1679 return SSH_ERR_INVALID_ARGUMENT; 1680 1681 if ((to = to_key->cert = cert_new()) == NULL) 1682 return SSH_ERR_ALLOC_FAIL; 1683 1684 if ((ret = sshbuf_putb(to->certblob, from->certblob)) != 0 || 1685 (ret = sshbuf_putb(to->critical, from->critical)) != 0 || 1686 (ret = sshbuf_putb(to->extensions, from->extensions) != 0)) 1687 return ret; 1688 1689 to->serial = from->serial; 1690 to->type = from->type; 1691 if (from->key_id == NULL) 1692 to->key_id = NULL; 1693 else if ((to->key_id = strdup(from->key_id)) == NULL) 1694 return SSH_ERR_ALLOC_FAIL; 1695 to->valid_after = from->valid_after; 1696 to->valid_before = from->valid_before; 1697 if (from->signature_key == NULL) 1698 to->signature_key = NULL; 1699 else if ((ret = sshkey_from_private(from->signature_key, 1700 &to->signature_key)) != 0) 1701 return ret; 1702 1703 if (from->nprincipals > SSHKEY_CERT_MAX_PRINCIPALS) 1704 return SSH_ERR_INVALID_ARGUMENT; 1705 if (from->nprincipals > 0) { 1706 if ((to->principals = calloc(from->nprincipals, 1707 sizeof(*to->principals))) == NULL) 1708 return SSH_ERR_ALLOC_FAIL; 1709 for (i = 0; i < from->nprincipals; i++) { 1710 to->principals[i] = strdup(from->principals[i]); 1711 if (to->principals[i] == NULL) { 1712 to->nprincipals = i; 1713 return SSH_ERR_ALLOC_FAIL; 1714 } 1715 } 1716 } 1717 to->nprincipals = from->nprincipals; 1718 return 0; 1719 } 1720 1721 int 1722 sshkey_from_private(const struct sshkey *k, struct sshkey **pkp) 1723 { 1724 struct sshkey *n = NULL; 1725 int ret = SSH_ERR_INTERNAL_ERROR; 1726 1727 if (pkp != NULL) 1728 *pkp = NULL; 1729 1730 switch (k->type) { 1731 #ifdef WITH_OPENSSL 1732 case KEY_DSA: 1733 case KEY_DSA_CERT: 1734 if ((n = sshkey_new(k->type)) == NULL) 1735 return SSH_ERR_ALLOC_FAIL; 1736 if ((BN_copy(n->dsa->p, k->dsa->p) == NULL) || 1737 (BN_copy(n->dsa->q, k->dsa->q) == NULL) || 1738 (BN_copy(n->dsa->g, k->dsa->g) == NULL) || 1739 (BN_copy(n->dsa->pub_key, k->dsa->pub_key) == NULL)) { 1740 sshkey_free(n); 1741 return SSH_ERR_ALLOC_FAIL; 1742 } 1743 break; 1744 case KEY_ECDSA: 1745 case KEY_ECDSA_CERT: 1746 if ((n = sshkey_new(k->type)) == NULL) 1747 return SSH_ERR_ALLOC_FAIL; 1748 n->ecdsa_nid = k->ecdsa_nid; 1749 n->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); 1750 if (n->ecdsa == NULL) { 1751 sshkey_free(n); 1752 return SSH_ERR_ALLOC_FAIL; 1753 } 1754 if (EC_KEY_set_public_key(n->ecdsa, 1755 EC_KEY_get0_public_key(k->ecdsa)) != 1) { 1756 sshkey_free(n); 1757 return SSH_ERR_LIBCRYPTO_ERROR; 1758 } 1759 break; 1760 case KEY_RSA: 1761 case KEY_RSA1: 1762 case KEY_RSA_CERT: 1763 if ((n = sshkey_new(k->type)) == NULL) 1764 return SSH_ERR_ALLOC_FAIL; 1765 if ((BN_copy(n->rsa->n, k->rsa->n) == NULL) || 1766 (BN_copy(n->rsa->e, k->rsa->e) == NULL)) { 1767 sshkey_free(n); 1768 return SSH_ERR_ALLOC_FAIL; 1769 } 1770 break; 1771 #endif /* WITH_OPENSSL */ 1772 case KEY_ED25519: 1773 case KEY_ED25519_CERT: 1774 if ((n = sshkey_new(k->type)) == NULL) 1775 return SSH_ERR_ALLOC_FAIL; 1776 if (k->ed25519_pk != NULL) { 1777 if ((n->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL) { 1778 sshkey_free(n); 1779 return SSH_ERR_ALLOC_FAIL; 1780 } 1781 memcpy(n->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ); 1782 } 1783 break; 1784 default: 1785 return SSH_ERR_KEY_TYPE_UNKNOWN; 1786 } 1787 if (sshkey_is_cert(k)) { 1788 if ((ret = sshkey_cert_copy(k, n)) != 0) { 1789 sshkey_free(n); 1790 return ret; 1791 } 1792 } 1793 *pkp = n; 1794 return 0; 1795 } 1796 1797 static int 1798 cert_parse(struct sshbuf *b, struct sshkey *key, struct sshbuf *certbuf) 1799 { 1800 struct sshbuf *principals = NULL, *crit = NULL; 1801 struct sshbuf *exts = NULL, *ca = NULL; 1802 u_char *sig = NULL; 1803 size_t signed_len = 0, slen = 0, kidlen = 0; 1804 int ret = SSH_ERR_INTERNAL_ERROR; 1805 1806 /* Copy the entire key blob for verification and later serialisation */ 1807 if ((ret = sshbuf_putb(key->cert->certblob, certbuf)) != 0) 1808 return ret; 1809 1810 /* Parse body of certificate up to signature */ 1811 if ((ret = sshbuf_get_u64(b, &key->cert->serial)) != 0 || 1812 (ret = sshbuf_get_u32(b, &key->cert->type)) != 0 || 1813 (ret = sshbuf_get_cstring(b, &key->cert->key_id, &kidlen)) != 0 || 1814 (ret = sshbuf_froms(b, &principals)) != 0 || 1815 (ret = sshbuf_get_u64(b, &key->cert->valid_after)) != 0 || 1816 (ret = sshbuf_get_u64(b, &key->cert->valid_before)) != 0 || 1817 (ret = sshbuf_froms(b, &crit)) != 0 || 1818 (ret = sshbuf_froms(b, &exts)) != 0 || 1819 (ret = sshbuf_get_string_direct(b, NULL, NULL)) != 0 || 1820 (ret = sshbuf_froms(b, &ca)) != 0) { 1821 /* XXX debug print error for ret */ 1822 ret = SSH_ERR_INVALID_FORMAT; 1823 goto out; 1824 } 1825 1826 /* Signature is left in the buffer so we can calculate this length */ 1827 signed_len = sshbuf_len(key->cert->certblob) - sshbuf_len(b); 1828 1829 if ((ret = sshbuf_get_string(b, &sig, &slen)) != 0) { 1830 ret = SSH_ERR_INVALID_FORMAT; 1831 goto out; 1832 } 1833 1834 if (key->cert->type != SSH2_CERT_TYPE_USER && 1835 key->cert->type != SSH2_CERT_TYPE_HOST) { 1836 ret = SSH_ERR_KEY_CERT_UNKNOWN_TYPE; 1837 goto out; 1838 } 1839 1840 /* Parse principals section */ 1841 while (sshbuf_len(principals) > 0) { 1842 char *principal = NULL; 1843 char **oprincipals = NULL; 1844 1845 if (key->cert->nprincipals >= SSHKEY_CERT_MAX_PRINCIPALS) { 1846 ret = SSH_ERR_INVALID_FORMAT; 1847 goto out; 1848 } 1849 if ((ret = sshbuf_get_cstring(principals, &principal, 1850 NULL)) != 0) { 1851 ret = SSH_ERR_INVALID_FORMAT; 1852 goto out; 1853 } 1854 oprincipals = key->cert->principals; 1855 key->cert->principals = reallocarray(key->cert->principals, 1856 key->cert->nprincipals + 1, sizeof(*key->cert->principals)); 1857 if (key->cert->principals == NULL) { 1858 free(principal); 1859 key->cert->principals = oprincipals; 1860 ret = SSH_ERR_ALLOC_FAIL; 1861 goto out; 1862 } 1863 key->cert->principals[key->cert->nprincipals++] = principal; 1864 } 1865 1866 /* 1867 * Stash a copies of the critical options and extensions sections 1868 * for later use. 1869 */ 1870 if ((ret = sshbuf_putb(key->cert->critical, crit)) != 0 || 1871 (exts != NULL && 1872 (ret = sshbuf_putb(key->cert->extensions, exts)) != 0)) 1873 goto out; 1874 1875 /* 1876 * Validate critical options and extensions sections format. 1877 */ 1878 while (sshbuf_len(crit) != 0) { 1879 if ((ret = sshbuf_get_string_direct(crit, NULL, NULL)) != 0 || 1880 (ret = sshbuf_get_string_direct(crit, NULL, NULL)) != 0) { 1881 sshbuf_reset(key->cert->critical); 1882 ret = SSH_ERR_INVALID_FORMAT; 1883 goto out; 1884 } 1885 } 1886 while (exts != NULL && sshbuf_len(exts) != 0) { 1887 if ((ret = sshbuf_get_string_direct(exts, NULL, NULL)) != 0 || 1888 (ret = sshbuf_get_string_direct(exts, NULL, NULL)) != 0) { 1889 sshbuf_reset(key->cert->extensions); 1890 ret = SSH_ERR_INVALID_FORMAT; 1891 goto out; 1892 } 1893 } 1894 1895 /* Parse CA key and check signature */ 1896 if (sshkey_from_blob_internal(ca, &key->cert->signature_key, 0) != 0) { 1897 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 1898 goto out; 1899 } 1900 if (!sshkey_type_is_valid_ca(key->cert->signature_key->type)) { 1901 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 1902 goto out; 1903 } 1904 if ((ret = sshkey_verify(key->cert->signature_key, sig, slen, 1905 sshbuf_ptr(key->cert->certblob), signed_len, 0)) != 0) 1906 goto out; 1907 1908 /* Success */ 1909 ret = 0; 1910 out: 1911 sshbuf_free(ca); 1912 sshbuf_free(crit); 1913 sshbuf_free(exts); 1914 sshbuf_free(principals); 1915 free(sig); 1916 return ret; 1917 } 1918 1919 static int 1920 sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp, 1921 int allow_cert) 1922 { 1923 int type, ret = SSH_ERR_INTERNAL_ERROR; 1924 char *ktype = NULL, *curve = NULL; 1925 struct sshkey *key = NULL; 1926 size_t len; 1927 u_char *pk = NULL; 1928 struct sshbuf *copy; 1929 #ifdef WITH_OPENSSL 1930 EC_POINT *q = NULL; 1931 #endif /* WITH_OPENSSL */ 1932 1933 #ifdef DEBUG_PK /* XXX */ 1934 sshbuf_dump(b, stderr); 1935 #endif 1936 *keyp = NULL; 1937 if ((copy = sshbuf_fromb(b)) == NULL) { 1938 ret = SSH_ERR_ALLOC_FAIL; 1939 goto out; 1940 } 1941 if (sshbuf_get_cstring(b, &ktype, NULL) != 0) { 1942 ret = SSH_ERR_INVALID_FORMAT; 1943 goto out; 1944 } 1945 1946 type = sshkey_type_from_name(ktype); 1947 if (!allow_cert && sshkey_type_is_cert(type)) { 1948 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 1949 goto out; 1950 } 1951 switch (type) { 1952 #ifdef WITH_OPENSSL 1953 case KEY_RSA_CERT: 1954 /* Skip nonce */ 1955 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 1956 ret = SSH_ERR_INVALID_FORMAT; 1957 goto out; 1958 } 1959 /* FALLTHROUGH */ 1960 case KEY_RSA: 1961 if ((key = sshkey_new(type)) == NULL) { 1962 ret = SSH_ERR_ALLOC_FAIL; 1963 goto out; 1964 } 1965 if (sshbuf_get_bignum2(b, key->rsa->e) != 0 || 1966 sshbuf_get_bignum2(b, key->rsa->n) != 0) { 1967 ret = SSH_ERR_INVALID_FORMAT; 1968 goto out; 1969 } 1970 #ifdef DEBUG_PK 1971 RSA_print_fp(stderr, key->rsa, 8); 1972 #endif 1973 break; 1974 case KEY_DSA_CERT: 1975 /* Skip nonce */ 1976 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 1977 ret = SSH_ERR_INVALID_FORMAT; 1978 goto out; 1979 } 1980 /* FALLTHROUGH */ 1981 case KEY_DSA: 1982 if ((key = sshkey_new(type)) == NULL) { 1983 ret = SSH_ERR_ALLOC_FAIL; 1984 goto out; 1985 } 1986 if (sshbuf_get_bignum2(b, key->dsa->p) != 0 || 1987 sshbuf_get_bignum2(b, key->dsa->q) != 0 || 1988 sshbuf_get_bignum2(b, key->dsa->g) != 0 || 1989 sshbuf_get_bignum2(b, key->dsa->pub_key) != 0) { 1990 ret = SSH_ERR_INVALID_FORMAT; 1991 goto out; 1992 } 1993 #ifdef DEBUG_PK 1994 DSA_print_fp(stderr, key->dsa, 8); 1995 #endif 1996 break; 1997 case KEY_ECDSA_CERT: 1998 /* Skip nonce */ 1999 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2000 ret = SSH_ERR_INVALID_FORMAT; 2001 goto out; 2002 } 2003 /* FALLTHROUGH */ 2004 case KEY_ECDSA: 2005 if ((key = sshkey_new(type)) == NULL) { 2006 ret = SSH_ERR_ALLOC_FAIL; 2007 goto out; 2008 } 2009 key->ecdsa_nid = sshkey_ecdsa_nid_from_name(ktype); 2010 if (sshbuf_get_cstring(b, &curve, NULL) != 0) { 2011 ret = SSH_ERR_INVALID_FORMAT; 2012 goto out; 2013 } 2014 if (key->ecdsa_nid != sshkey_curve_name_to_nid(curve)) { 2015 ret = SSH_ERR_EC_CURVE_MISMATCH; 2016 goto out; 2017 } 2018 if (key->ecdsa != NULL) 2019 EC_KEY_free(key->ecdsa); 2020 if ((key->ecdsa = EC_KEY_new_by_curve_name(key->ecdsa_nid)) 2021 == NULL) { 2022 ret = SSH_ERR_EC_CURVE_INVALID; 2023 goto out; 2024 } 2025 if ((q = EC_POINT_new(EC_KEY_get0_group(key->ecdsa))) == NULL) { 2026 ret = SSH_ERR_ALLOC_FAIL; 2027 goto out; 2028 } 2029 if (sshbuf_get_ec(b, q, EC_KEY_get0_group(key->ecdsa)) != 0) { 2030 ret = SSH_ERR_INVALID_FORMAT; 2031 goto out; 2032 } 2033 if (sshkey_ec_validate_public(EC_KEY_get0_group(key->ecdsa), 2034 q) != 0) { 2035 ret = SSH_ERR_KEY_INVALID_EC_VALUE; 2036 goto out; 2037 } 2038 if (EC_KEY_set_public_key(key->ecdsa, q) != 1) { 2039 /* XXX assume it is a allocation error */ 2040 ret = SSH_ERR_ALLOC_FAIL; 2041 goto out; 2042 } 2043 #ifdef DEBUG_PK 2044 sshkey_dump_ec_point(EC_KEY_get0_group(key->ecdsa), q); 2045 #endif 2046 break; 2047 #endif /* WITH_OPENSSL */ 2048 case KEY_ED25519_CERT: 2049 /* Skip nonce */ 2050 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2051 ret = SSH_ERR_INVALID_FORMAT; 2052 goto out; 2053 } 2054 /* FALLTHROUGH */ 2055 case KEY_ED25519: 2056 if ((ret = sshbuf_get_string(b, &pk, &len)) != 0) 2057 goto out; 2058 if (len != ED25519_PK_SZ) { 2059 ret = SSH_ERR_INVALID_FORMAT; 2060 goto out; 2061 } 2062 if ((key = sshkey_new(type)) == NULL) { 2063 ret = SSH_ERR_ALLOC_FAIL; 2064 goto out; 2065 } 2066 key->ed25519_pk = pk; 2067 pk = NULL; 2068 break; 2069 case KEY_UNSPEC: 2070 if ((key = sshkey_new(type)) == NULL) { 2071 ret = SSH_ERR_ALLOC_FAIL; 2072 goto out; 2073 } 2074 break; 2075 default: 2076 ret = SSH_ERR_KEY_TYPE_UNKNOWN; 2077 goto out; 2078 } 2079 2080 /* Parse certificate potion */ 2081 if (sshkey_is_cert(key) && (ret = cert_parse(b, key, copy)) != 0) 2082 goto out; 2083 2084 if (key != NULL && sshbuf_len(b) != 0) { 2085 ret = SSH_ERR_INVALID_FORMAT; 2086 goto out; 2087 } 2088 ret = 0; 2089 *keyp = key; 2090 key = NULL; 2091 out: 2092 sshbuf_free(copy); 2093 sshkey_free(key); 2094 free(ktype); 2095 free(curve); 2096 free(pk); 2097 #ifdef WITH_OPENSSL 2098 if (q != NULL) 2099 EC_POINT_free(q); 2100 #endif /* WITH_OPENSSL */ 2101 return ret; 2102 } 2103 2104 int 2105 sshkey_from_blob(const u_char *blob, size_t blen, struct sshkey **keyp) 2106 { 2107 struct sshbuf *b; 2108 int r; 2109 2110 if ((b = sshbuf_from(blob, blen)) == NULL) 2111 return SSH_ERR_ALLOC_FAIL; 2112 r = sshkey_from_blob_internal(b, keyp, 1); 2113 sshbuf_free(b); 2114 return r; 2115 } 2116 2117 int 2118 sshkey_fromb(struct sshbuf *b, struct sshkey **keyp) 2119 { 2120 return sshkey_from_blob_internal(b, keyp, 1); 2121 } 2122 2123 int 2124 sshkey_froms(struct sshbuf *buf, struct sshkey **keyp) 2125 { 2126 struct sshbuf *b; 2127 int r; 2128 2129 if ((r = sshbuf_froms(buf, &b)) != 0) 2130 return r; 2131 r = sshkey_from_blob_internal(b, keyp, 1); 2132 sshbuf_free(b); 2133 return r; 2134 } 2135 2136 int 2137 sshkey_sign(const struct sshkey *key, 2138 u_char **sigp, size_t *lenp, 2139 const u_char *data, size_t datalen, u_int compat) 2140 { 2141 if (sigp != NULL) 2142 *sigp = NULL; 2143 if (lenp != NULL) 2144 *lenp = 0; 2145 if (datalen > SSH_KEY_MAX_SIGN_DATA_SIZE) 2146 return SSH_ERR_INVALID_ARGUMENT; 2147 switch (key->type) { 2148 #ifdef WITH_OPENSSL 2149 case KEY_DSA_CERT: 2150 case KEY_DSA: 2151 return ssh_dss_sign(key, sigp, lenp, data, datalen, compat); 2152 case KEY_ECDSA_CERT: 2153 case KEY_ECDSA: 2154 return ssh_ecdsa_sign(key, sigp, lenp, data, datalen, compat); 2155 case KEY_RSA_CERT: 2156 case KEY_RSA: 2157 return ssh_rsa_sign(key, sigp, lenp, data, datalen, compat); 2158 #endif /* WITH_OPENSSL */ 2159 case KEY_ED25519: 2160 case KEY_ED25519_CERT: 2161 return ssh_ed25519_sign(key, sigp, lenp, data, datalen, compat); 2162 default: 2163 return SSH_ERR_KEY_TYPE_UNKNOWN; 2164 } 2165 } 2166 2167 /* 2168 * ssh_key_verify returns 0 for a correct signature and < 0 on error. 2169 */ 2170 int 2171 sshkey_verify(const struct sshkey *key, 2172 const u_char *sig, size_t siglen, 2173 const u_char *data, size_t dlen, u_int compat) 2174 { 2175 if (siglen == 0 || dlen > SSH_KEY_MAX_SIGN_DATA_SIZE) 2176 return SSH_ERR_INVALID_ARGUMENT; 2177 switch (key->type) { 2178 #ifdef WITH_OPENSSL 2179 case KEY_DSA_CERT: 2180 case KEY_DSA: 2181 return ssh_dss_verify(key, sig, siglen, data, dlen, compat); 2182 case KEY_ECDSA_CERT: 2183 case KEY_ECDSA: 2184 return ssh_ecdsa_verify(key, sig, siglen, data, dlen, compat); 2185 case KEY_RSA_CERT: 2186 case KEY_RSA: 2187 return ssh_rsa_verify(key, sig, siglen, data, dlen, compat); 2188 #endif /* WITH_OPENSSL */ 2189 case KEY_ED25519: 2190 case KEY_ED25519_CERT: 2191 return ssh_ed25519_verify(key, sig, siglen, data, dlen, compat); 2192 default: 2193 return SSH_ERR_KEY_TYPE_UNKNOWN; 2194 } 2195 } 2196 2197 /* Converts a private to a public key */ 2198 int 2199 sshkey_demote(const struct sshkey *k, struct sshkey **dkp) 2200 { 2201 struct sshkey *pk; 2202 int ret = SSH_ERR_INTERNAL_ERROR; 2203 2204 if (dkp != NULL) 2205 *dkp = NULL; 2206 2207 if ((pk = calloc(1, sizeof(*pk))) == NULL) 2208 return SSH_ERR_ALLOC_FAIL; 2209 pk->type = k->type; 2210 pk->flags = k->flags; 2211 pk->ecdsa_nid = k->ecdsa_nid; 2212 pk->dsa = NULL; 2213 pk->ecdsa = NULL; 2214 pk->rsa = NULL; 2215 pk->ed25519_pk = NULL; 2216 pk->ed25519_sk = NULL; 2217 2218 switch (k->type) { 2219 #ifdef WITH_OPENSSL 2220 case KEY_RSA_CERT: 2221 if ((ret = sshkey_cert_copy(k, pk)) != 0) 2222 goto fail; 2223 /* FALLTHROUGH */ 2224 case KEY_RSA1: 2225 case KEY_RSA: 2226 if ((pk->rsa = RSA_new()) == NULL || 2227 (pk->rsa->e = BN_dup(k->rsa->e)) == NULL || 2228 (pk->rsa->n = BN_dup(k->rsa->n)) == NULL) { 2229 ret = SSH_ERR_ALLOC_FAIL; 2230 goto fail; 2231 } 2232 break; 2233 case KEY_DSA_CERT: 2234 if ((ret = sshkey_cert_copy(k, pk)) != 0) 2235 goto fail; 2236 /* FALLTHROUGH */ 2237 case KEY_DSA: 2238 if ((pk->dsa = DSA_new()) == NULL || 2239 (pk->dsa->p = BN_dup(k->dsa->p)) == NULL || 2240 (pk->dsa->q = BN_dup(k->dsa->q)) == NULL || 2241 (pk->dsa->g = BN_dup(k->dsa->g)) == NULL || 2242 (pk->dsa->pub_key = BN_dup(k->dsa->pub_key)) == NULL) { 2243 ret = SSH_ERR_ALLOC_FAIL; 2244 goto fail; 2245 } 2246 break; 2247 case KEY_ECDSA_CERT: 2248 if ((ret = sshkey_cert_copy(k, pk)) != 0) 2249 goto fail; 2250 /* FALLTHROUGH */ 2251 case KEY_ECDSA: 2252 pk->ecdsa = EC_KEY_new_by_curve_name(pk->ecdsa_nid); 2253 if (pk->ecdsa == NULL) { 2254 ret = SSH_ERR_ALLOC_FAIL; 2255 goto fail; 2256 } 2257 if (EC_KEY_set_public_key(pk->ecdsa, 2258 EC_KEY_get0_public_key(k->ecdsa)) != 1) { 2259 ret = SSH_ERR_LIBCRYPTO_ERROR; 2260 goto fail; 2261 } 2262 break; 2263 #endif /* WITH_OPENSSL */ 2264 case KEY_ED25519_CERT: 2265 if ((ret = sshkey_cert_copy(k, pk)) != 0) 2266 goto fail; 2267 /* FALLTHROUGH */ 2268 case KEY_ED25519: 2269 if (k->ed25519_pk != NULL) { 2270 if ((pk->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL) { 2271 ret = SSH_ERR_ALLOC_FAIL; 2272 goto fail; 2273 } 2274 memcpy(pk->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ); 2275 } 2276 break; 2277 default: 2278 ret = SSH_ERR_KEY_TYPE_UNKNOWN; 2279 fail: 2280 sshkey_free(pk); 2281 return ret; 2282 } 2283 *dkp = pk; 2284 return 0; 2285 } 2286 2287 /* Convert a plain key to their _CERT equivalent */ 2288 int 2289 sshkey_to_certified(struct sshkey *k) 2290 { 2291 int newtype; 2292 2293 switch (k->type) { 2294 #ifdef WITH_OPENSSL 2295 case KEY_RSA: 2296 newtype = KEY_RSA_CERT; 2297 break; 2298 case KEY_DSA: 2299 newtype = KEY_DSA_CERT; 2300 break; 2301 case KEY_ECDSA: 2302 newtype = KEY_ECDSA_CERT; 2303 break; 2304 #endif /* WITH_OPENSSL */ 2305 case KEY_ED25519: 2306 newtype = KEY_ED25519_CERT; 2307 break; 2308 default: 2309 return SSH_ERR_INVALID_ARGUMENT; 2310 } 2311 if ((k->cert = cert_new()) == NULL) 2312 return SSH_ERR_ALLOC_FAIL; 2313 k->type = newtype; 2314 return 0; 2315 } 2316 2317 /* Convert a certificate to its raw key equivalent */ 2318 int 2319 sshkey_drop_cert(struct sshkey *k) 2320 { 2321 if (!sshkey_type_is_cert(k->type)) 2322 return SSH_ERR_KEY_TYPE_UNKNOWN; 2323 cert_free(k->cert); 2324 k->cert = NULL; 2325 k->type = sshkey_type_plain(k->type); 2326 return 0; 2327 } 2328 2329 /* Sign a certified key, (re-)generating the signed certblob. */ 2330 int 2331 sshkey_certify(struct sshkey *k, struct sshkey *ca) 2332 { 2333 struct sshbuf *principals = NULL; 2334 u_char *ca_blob = NULL, *sig_blob = NULL, nonce[32]; 2335 size_t i, ca_len, sig_len; 2336 int ret = SSH_ERR_INTERNAL_ERROR; 2337 struct sshbuf *cert; 2338 2339 if (k == NULL || k->cert == NULL || 2340 k->cert->certblob == NULL || ca == NULL) 2341 return SSH_ERR_INVALID_ARGUMENT; 2342 if (!sshkey_is_cert(k)) 2343 return SSH_ERR_KEY_TYPE_UNKNOWN; 2344 if (!sshkey_type_is_valid_ca(ca->type)) 2345 return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2346 2347 if ((ret = sshkey_to_blob(ca, &ca_blob, &ca_len)) != 0) 2348 return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2349 2350 cert = k->cert->certblob; /* for readability */ 2351 sshbuf_reset(cert); 2352 if ((ret = sshbuf_put_cstring(cert, sshkey_ssh_name(k))) != 0) 2353 goto out; 2354 2355 /* -v01 certs put nonce first */ 2356 arc4random_buf(&nonce, sizeof(nonce)); 2357 if ((ret = sshbuf_put_string(cert, nonce, sizeof(nonce))) != 0) 2358 goto out; 2359 2360 /* XXX this substantially duplicates to_blob(); refactor */ 2361 switch (k->type) { 2362 #ifdef WITH_OPENSSL 2363 case KEY_DSA_CERT: 2364 if ((ret = sshbuf_put_bignum2(cert, k->dsa->p)) != 0 || 2365 (ret = sshbuf_put_bignum2(cert, k->dsa->q)) != 0 || 2366 (ret = sshbuf_put_bignum2(cert, k->dsa->g)) != 0 || 2367 (ret = sshbuf_put_bignum2(cert, k->dsa->pub_key)) != 0) 2368 goto out; 2369 break; 2370 case KEY_ECDSA_CERT: 2371 if ((ret = sshbuf_put_cstring(cert, 2372 sshkey_curve_nid_to_name(k->ecdsa_nid))) != 0 || 2373 (ret = sshbuf_put_ec(cert, 2374 EC_KEY_get0_public_key(k->ecdsa), 2375 EC_KEY_get0_group(k->ecdsa))) != 0) 2376 goto out; 2377 break; 2378 case KEY_RSA_CERT: 2379 if ((ret = sshbuf_put_bignum2(cert, k->rsa->e)) != 0 || 2380 (ret = sshbuf_put_bignum2(cert, k->rsa->n)) != 0) 2381 goto out; 2382 break; 2383 #endif /* WITH_OPENSSL */ 2384 case KEY_ED25519_CERT: 2385 if ((ret = sshbuf_put_string(cert, 2386 k->ed25519_pk, ED25519_PK_SZ)) != 0) 2387 goto out; 2388 break; 2389 default: 2390 ret = SSH_ERR_INVALID_ARGUMENT; 2391 goto out; 2392 } 2393 2394 if ((ret = sshbuf_put_u64(cert, k->cert->serial)) != 0 || 2395 (ret = sshbuf_put_u32(cert, k->cert->type)) != 0 || 2396 (ret = sshbuf_put_cstring(cert, k->cert->key_id)) != 0) 2397 goto out; 2398 2399 if ((principals = sshbuf_new()) == NULL) { 2400 ret = SSH_ERR_ALLOC_FAIL; 2401 goto out; 2402 } 2403 for (i = 0; i < k->cert->nprincipals; i++) { 2404 if ((ret = sshbuf_put_cstring(principals, 2405 k->cert->principals[i])) != 0) 2406 goto out; 2407 } 2408 if ((ret = sshbuf_put_stringb(cert, principals)) != 0 || 2409 (ret = sshbuf_put_u64(cert, k->cert->valid_after)) != 0 || 2410 (ret = sshbuf_put_u64(cert, k->cert->valid_before)) != 0 || 2411 (ret = sshbuf_put_stringb(cert, k->cert->critical)) != 0 || 2412 (ret = sshbuf_put_stringb(cert, k->cert->extensions)) != 0 || 2413 (ret = sshbuf_put_string(cert, NULL, 0)) != 0 || /* Reserved */ 2414 (ret = sshbuf_put_string(cert, ca_blob, ca_len)) != 0) 2415 goto out; 2416 2417 /* Sign the whole mess */ 2418 if ((ret = sshkey_sign(ca, &sig_blob, &sig_len, sshbuf_ptr(cert), 2419 sshbuf_len(cert), 0)) != 0) 2420 goto out; 2421 2422 /* Append signature and we are done */ 2423 if ((ret = sshbuf_put_string(cert, sig_blob, sig_len)) != 0) 2424 goto out; 2425 ret = 0; 2426 out: 2427 if (ret != 0) 2428 sshbuf_reset(cert); 2429 if (sig_blob != NULL) 2430 free(sig_blob); 2431 if (ca_blob != NULL) 2432 free(ca_blob); 2433 if (principals != NULL) 2434 sshbuf_free(principals); 2435 return ret; 2436 } 2437 2438 int 2439 sshkey_cert_check_authority(const struct sshkey *k, 2440 int want_host, int require_principal, 2441 const char *name, const char **reason) 2442 { 2443 u_int i, principal_matches; 2444 time_t now = time(NULL); 2445 2446 if (reason != NULL) 2447 *reason = NULL; 2448 2449 if (want_host) { 2450 if (k->cert->type != SSH2_CERT_TYPE_HOST) { 2451 *reason = "Certificate invalid: not a host certificate"; 2452 return SSH_ERR_KEY_CERT_INVALID; 2453 } 2454 } else { 2455 if (k->cert->type != SSH2_CERT_TYPE_USER) { 2456 *reason = "Certificate invalid: not a user certificate"; 2457 return SSH_ERR_KEY_CERT_INVALID; 2458 } 2459 } 2460 if (now < 0) { 2461 /* yikes - system clock before epoch! */ 2462 *reason = "Certificate invalid: not yet valid"; 2463 return SSH_ERR_KEY_CERT_INVALID; 2464 } 2465 if ((u_int64_t)now < k->cert->valid_after) { 2466 *reason = "Certificate invalid: not yet valid"; 2467 return SSH_ERR_KEY_CERT_INVALID; 2468 } 2469 if ((u_int64_t)now >= k->cert->valid_before) { 2470 *reason = "Certificate invalid: expired"; 2471 return SSH_ERR_KEY_CERT_INVALID; 2472 } 2473 if (k->cert->nprincipals == 0) { 2474 if (require_principal) { 2475 *reason = "Certificate lacks principal list"; 2476 return SSH_ERR_KEY_CERT_INVALID; 2477 } 2478 } else if (name != NULL) { 2479 principal_matches = 0; 2480 for (i = 0; i < k->cert->nprincipals; i++) { 2481 if (strcmp(name, k->cert->principals[i]) == 0) { 2482 principal_matches = 1; 2483 break; 2484 } 2485 } 2486 if (!principal_matches) { 2487 *reason = "Certificate invalid: name is not a listed " 2488 "principal"; 2489 return SSH_ERR_KEY_CERT_INVALID; 2490 } 2491 } 2492 return 0; 2493 } 2494 2495 int 2496 sshkey_private_serialize(const struct sshkey *key, struct sshbuf *b) 2497 { 2498 int r = SSH_ERR_INTERNAL_ERROR; 2499 2500 if ((r = sshbuf_put_cstring(b, sshkey_ssh_name(key))) != 0) 2501 goto out; 2502 switch (key->type) { 2503 #ifdef WITH_OPENSSL 2504 case KEY_RSA: 2505 if ((r = sshbuf_put_bignum2(b, key->rsa->n)) != 0 || 2506 (r = sshbuf_put_bignum2(b, key->rsa->e)) != 0 || 2507 (r = sshbuf_put_bignum2(b, key->rsa->d)) != 0 || 2508 (r = sshbuf_put_bignum2(b, key->rsa->iqmp)) != 0 || 2509 (r = sshbuf_put_bignum2(b, key->rsa->p)) != 0 || 2510 (r = sshbuf_put_bignum2(b, key->rsa->q)) != 0) 2511 goto out; 2512 break; 2513 case KEY_RSA_CERT: 2514 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 2515 r = SSH_ERR_INVALID_ARGUMENT; 2516 goto out; 2517 } 2518 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 2519 (r = sshbuf_put_bignum2(b, key->rsa->d)) != 0 || 2520 (r = sshbuf_put_bignum2(b, key->rsa->iqmp)) != 0 || 2521 (r = sshbuf_put_bignum2(b, key->rsa->p)) != 0 || 2522 (r = sshbuf_put_bignum2(b, key->rsa->q)) != 0) 2523 goto out; 2524 break; 2525 case KEY_DSA: 2526 if ((r = sshbuf_put_bignum2(b, key->dsa->p)) != 0 || 2527 (r = sshbuf_put_bignum2(b, key->dsa->q)) != 0 || 2528 (r = sshbuf_put_bignum2(b, key->dsa->g)) != 0 || 2529 (r = sshbuf_put_bignum2(b, key->dsa->pub_key)) != 0 || 2530 (r = sshbuf_put_bignum2(b, key->dsa->priv_key)) != 0) 2531 goto out; 2532 break; 2533 case KEY_DSA_CERT: 2534 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 2535 r = SSH_ERR_INVALID_ARGUMENT; 2536 goto out; 2537 } 2538 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 2539 (r = sshbuf_put_bignum2(b, key->dsa->priv_key)) != 0) 2540 goto out; 2541 break; 2542 case KEY_ECDSA: 2543 if ((r = sshbuf_put_cstring(b, 2544 sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || 2545 (r = sshbuf_put_eckey(b, key->ecdsa)) != 0 || 2546 (r = sshbuf_put_bignum2(b, 2547 EC_KEY_get0_private_key(key->ecdsa))) != 0) 2548 goto out; 2549 break; 2550 case KEY_ECDSA_CERT: 2551 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 2552 r = SSH_ERR_INVALID_ARGUMENT; 2553 goto out; 2554 } 2555 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 2556 (r = sshbuf_put_bignum2(b, 2557 EC_KEY_get0_private_key(key->ecdsa))) != 0) 2558 goto out; 2559 break; 2560 #endif /* WITH_OPENSSL */ 2561 case KEY_ED25519: 2562 if ((r = sshbuf_put_string(b, key->ed25519_pk, 2563 ED25519_PK_SZ)) != 0 || 2564 (r = sshbuf_put_string(b, key->ed25519_sk, 2565 ED25519_SK_SZ)) != 0) 2566 goto out; 2567 break; 2568 case KEY_ED25519_CERT: 2569 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 2570 r = SSH_ERR_INVALID_ARGUMENT; 2571 goto out; 2572 } 2573 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 2574 (r = sshbuf_put_string(b, key->ed25519_pk, 2575 ED25519_PK_SZ)) != 0 || 2576 (r = sshbuf_put_string(b, key->ed25519_sk, 2577 ED25519_SK_SZ)) != 0) 2578 goto out; 2579 break; 2580 default: 2581 r = SSH_ERR_INVALID_ARGUMENT; 2582 goto out; 2583 } 2584 /* success */ 2585 r = 0; 2586 out: 2587 return r; 2588 } 2589 2590 int 2591 sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) 2592 { 2593 char *tname = NULL, *curve = NULL; 2594 struct sshkey *k = NULL; 2595 size_t pklen = 0, sklen = 0; 2596 int type, r = SSH_ERR_INTERNAL_ERROR; 2597 u_char *ed25519_pk = NULL, *ed25519_sk = NULL; 2598 #ifdef WITH_OPENSSL 2599 BIGNUM *exponent = NULL; 2600 #endif /* WITH_OPENSSL */ 2601 2602 if (kp != NULL) 2603 *kp = NULL; 2604 if ((r = sshbuf_get_cstring(buf, &tname, NULL)) != 0) 2605 goto out; 2606 type = sshkey_type_from_name(tname); 2607 switch (type) { 2608 #ifdef WITH_OPENSSL 2609 case KEY_DSA: 2610 if ((k = sshkey_new_private(type)) == NULL) { 2611 r = SSH_ERR_ALLOC_FAIL; 2612 goto out; 2613 } 2614 if ((r = sshbuf_get_bignum2(buf, k->dsa->p)) != 0 || 2615 (r = sshbuf_get_bignum2(buf, k->dsa->q)) != 0 || 2616 (r = sshbuf_get_bignum2(buf, k->dsa->g)) != 0 || 2617 (r = sshbuf_get_bignum2(buf, k->dsa->pub_key)) != 0 || 2618 (r = sshbuf_get_bignum2(buf, k->dsa->priv_key)) != 0) 2619 goto out; 2620 break; 2621 case KEY_DSA_CERT: 2622 if ((r = sshkey_froms(buf, &k)) != 0 || 2623 (r = sshkey_add_private(k)) != 0 || 2624 (r = sshbuf_get_bignum2(buf, k->dsa->priv_key)) != 0) 2625 goto out; 2626 break; 2627 case KEY_ECDSA: 2628 if ((k = sshkey_new_private(type)) == NULL) { 2629 r = SSH_ERR_ALLOC_FAIL; 2630 goto out; 2631 } 2632 if ((k->ecdsa_nid = sshkey_ecdsa_nid_from_name(tname)) == -1) { 2633 r = SSH_ERR_INVALID_ARGUMENT; 2634 goto out; 2635 } 2636 if ((r = sshbuf_get_cstring(buf, &curve, NULL)) != 0) 2637 goto out; 2638 if (k->ecdsa_nid != sshkey_curve_name_to_nid(curve)) { 2639 r = SSH_ERR_EC_CURVE_MISMATCH; 2640 goto out; 2641 } 2642 k->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); 2643 if (k->ecdsa == NULL || (exponent = BN_new()) == NULL) { 2644 r = SSH_ERR_LIBCRYPTO_ERROR; 2645 goto out; 2646 } 2647 if ((r = sshbuf_get_eckey(buf, k->ecdsa)) != 0 || 2648 (r = sshbuf_get_bignum2(buf, exponent))) 2649 goto out; 2650 if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) { 2651 r = SSH_ERR_LIBCRYPTO_ERROR; 2652 goto out; 2653 } 2654 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 2655 EC_KEY_get0_public_key(k->ecdsa)) != 0) || 2656 (r = sshkey_ec_validate_private(k->ecdsa)) != 0) 2657 goto out; 2658 break; 2659 case KEY_ECDSA_CERT: 2660 if ((exponent = BN_new()) == NULL) { 2661 r = SSH_ERR_LIBCRYPTO_ERROR; 2662 goto out; 2663 } 2664 if ((r = sshkey_froms(buf, &k)) != 0 || 2665 (r = sshkey_add_private(k)) != 0 || 2666 (r = sshbuf_get_bignum2(buf, exponent)) != 0) 2667 goto out; 2668 if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) { 2669 r = SSH_ERR_LIBCRYPTO_ERROR; 2670 goto out; 2671 } 2672 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 2673 EC_KEY_get0_public_key(k->ecdsa)) != 0) || 2674 (r = sshkey_ec_validate_private(k->ecdsa)) != 0) 2675 goto out; 2676 break; 2677 case KEY_RSA: 2678 if ((k = sshkey_new_private(type)) == NULL) { 2679 r = SSH_ERR_ALLOC_FAIL; 2680 goto out; 2681 } 2682 if ((r = sshbuf_get_bignum2(buf, k->rsa->n)) != 0 || 2683 (r = sshbuf_get_bignum2(buf, k->rsa->e)) != 0 || 2684 (r = sshbuf_get_bignum2(buf, k->rsa->d)) != 0 || 2685 (r = sshbuf_get_bignum2(buf, k->rsa->iqmp)) != 0 || 2686 (r = sshbuf_get_bignum2(buf, k->rsa->p)) != 0 || 2687 (r = sshbuf_get_bignum2(buf, k->rsa->q)) != 0 || 2688 (r = rsa_generate_additional_parameters(k->rsa)) != 0) 2689 goto out; 2690 break; 2691 case KEY_RSA_CERT: 2692 if ((r = sshkey_froms(buf, &k)) != 0 || 2693 (r = sshkey_add_private(k)) != 0 || 2694 (r = sshbuf_get_bignum2(buf, k->rsa->d) != 0) || 2695 (r = sshbuf_get_bignum2(buf, k->rsa->iqmp) != 0) || 2696 (r = sshbuf_get_bignum2(buf, k->rsa->p) != 0) || 2697 (r = sshbuf_get_bignum2(buf, k->rsa->q) != 0) || 2698 (r = rsa_generate_additional_parameters(k->rsa)) != 0) 2699 goto out; 2700 break; 2701 #endif /* WITH_OPENSSL */ 2702 case KEY_ED25519: 2703 if ((k = sshkey_new_private(type)) == NULL) { 2704 r = SSH_ERR_ALLOC_FAIL; 2705 goto out; 2706 } 2707 if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 || 2708 (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0) 2709 goto out; 2710 if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) { 2711 r = SSH_ERR_INVALID_FORMAT; 2712 goto out; 2713 } 2714 k->ed25519_pk = ed25519_pk; 2715 k->ed25519_sk = ed25519_sk; 2716 ed25519_pk = ed25519_sk = NULL; 2717 break; 2718 case KEY_ED25519_CERT: 2719 if ((r = sshkey_froms(buf, &k)) != 0 || 2720 (r = sshkey_add_private(k)) != 0 || 2721 (r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 || 2722 (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0) 2723 goto out; 2724 if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) { 2725 r = SSH_ERR_INVALID_FORMAT; 2726 goto out; 2727 } 2728 k->ed25519_pk = ed25519_pk; 2729 k->ed25519_sk = ed25519_sk; 2730 ed25519_pk = ed25519_sk = NULL; 2731 break; 2732 default: 2733 r = SSH_ERR_KEY_TYPE_UNKNOWN; 2734 goto out; 2735 } 2736 #ifdef WITH_OPENSSL 2737 /* enable blinding */ 2738 switch (k->type) { 2739 case KEY_RSA: 2740 case KEY_RSA_CERT: 2741 case KEY_RSA1: 2742 if (RSA_blinding_on(k->rsa, NULL) != 1) { 2743 r = SSH_ERR_LIBCRYPTO_ERROR; 2744 goto out; 2745 } 2746 break; 2747 } 2748 #endif /* WITH_OPENSSL */ 2749 /* success */ 2750 r = 0; 2751 if (kp != NULL) { 2752 *kp = k; 2753 k = NULL; 2754 } 2755 out: 2756 free(tname); 2757 free(curve); 2758 #ifdef WITH_OPENSSL 2759 if (exponent != NULL) 2760 BN_clear_free(exponent); 2761 #endif /* WITH_OPENSSL */ 2762 sshkey_free(k); 2763 if (ed25519_pk != NULL) { 2764 explicit_bzero(ed25519_pk, pklen); 2765 free(ed25519_pk); 2766 } 2767 if (ed25519_sk != NULL) { 2768 explicit_bzero(ed25519_sk, sklen); 2769 free(ed25519_sk); 2770 } 2771 return r; 2772 } 2773 2774 #ifdef WITH_OPENSSL 2775 int 2776 sshkey_ec_validate_public(const EC_GROUP *group, const EC_POINT *public) 2777 { 2778 BN_CTX *bnctx; 2779 EC_POINT *nq = NULL; 2780 BIGNUM *order, *x, *y, *tmp; 2781 int ret = SSH_ERR_KEY_INVALID_EC_VALUE; 2782 2783 if ((bnctx = BN_CTX_new()) == NULL) 2784 return SSH_ERR_ALLOC_FAIL; 2785 BN_CTX_start(bnctx); 2786 2787 /* 2788 * We shouldn't ever hit this case because bignum_get_ecpoint() 2789 * refuses to load GF2m points. 2790 */ 2791 if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) != 2792 NID_X9_62_prime_field) 2793 goto out; 2794 2795 /* Q != infinity */ 2796 if (EC_POINT_is_at_infinity(group, public)) 2797 goto out; 2798 2799 if ((x = BN_CTX_get(bnctx)) == NULL || 2800 (y = BN_CTX_get(bnctx)) == NULL || 2801 (order = BN_CTX_get(bnctx)) == NULL || 2802 (tmp = BN_CTX_get(bnctx)) == NULL) { 2803 ret = SSH_ERR_ALLOC_FAIL; 2804 goto out; 2805 } 2806 2807 /* log2(x) > log2(order)/2, log2(y) > log2(order)/2 */ 2808 if (EC_GROUP_get_order(group, order, bnctx) != 1 || 2809 EC_POINT_get_affine_coordinates_GFp(group, public, 2810 x, y, bnctx) != 1) { 2811 ret = SSH_ERR_LIBCRYPTO_ERROR; 2812 goto out; 2813 } 2814 if (BN_num_bits(x) <= BN_num_bits(order) / 2 || 2815 BN_num_bits(y) <= BN_num_bits(order) / 2) 2816 goto out; 2817 2818 /* nQ == infinity (n == order of subgroup) */ 2819 if ((nq = EC_POINT_new(group)) == NULL) { 2820 ret = SSH_ERR_ALLOC_FAIL; 2821 goto out; 2822 } 2823 if (EC_POINT_mul(group, nq, NULL, public, order, bnctx) != 1) { 2824 ret = SSH_ERR_LIBCRYPTO_ERROR; 2825 goto out; 2826 } 2827 if (EC_POINT_is_at_infinity(group, nq) != 1) 2828 goto out; 2829 2830 /* x < order - 1, y < order - 1 */ 2831 if (!BN_sub(tmp, order, BN_value_one())) { 2832 ret = SSH_ERR_LIBCRYPTO_ERROR; 2833 goto out; 2834 } 2835 if (BN_cmp(x, tmp) >= 0 || BN_cmp(y, tmp) >= 0) 2836 goto out; 2837 ret = 0; 2838 out: 2839 BN_CTX_free(bnctx); 2840 if (nq != NULL) 2841 EC_POINT_free(nq); 2842 return ret; 2843 } 2844 2845 int 2846 sshkey_ec_validate_private(const EC_KEY *key) 2847 { 2848 BN_CTX *bnctx; 2849 BIGNUM *order, *tmp; 2850 int ret = SSH_ERR_KEY_INVALID_EC_VALUE; 2851 2852 if ((bnctx = BN_CTX_new()) == NULL) 2853 return SSH_ERR_ALLOC_FAIL; 2854 BN_CTX_start(bnctx); 2855 2856 if ((order = BN_CTX_get(bnctx)) == NULL || 2857 (tmp = BN_CTX_get(bnctx)) == NULL) { 2858 ret = SSH_ERR_ALLOC_FAIL; 2859 goto out; 2860 } 2861 2862 /* log2(private) > log2(order)/2 */ 2863 if (EC_GROUP_get_order(EC_KEY_get0_group(key), order, bnctx) != 1) { 2864 ret = SSH_ERR_LIBCRYPTO_ERROR; 2865 goto out; 2866 } 2867 if (BN_num_bits(EC_KEY_get0_private_key(key)) <= 2868 BN_num_bits(order) / 2) 2869 goto out; 2870 2871 /* private < order - 1 */ 2872 if (!BN_sub(tmp, order, BN_value_one())) { 2873 ret = SSH_ERR_LIBCRYPTO_ERROR; 2874 goto out; 2875 } 2876 if (BN_cmp(EC_KEY_get0_private_key(key), tmp) >= 0) 2877 goto out; 2878 ret = 0; 2879 out: 2880 BN_CTX_free(bnctx); 2881 return ret; 2882 } 2883 2884 void 2885 sshkey_dump_ec_point(const EC_GROUP *group, const EC_POINT *point) 2886 { 2887 BIGNUM *x, *y; 2888 BN_CTX *bnctx; 2889 2890 if (point == NULL) { 2891 fputs("point=(NULL)\n", stderr); 2892 return; 2893 } 2894 if ((bnctx = BN_CTX_new()) == NULL) { 2895 fprintf(stderr, "%s: BN_CTX_new failed\n", __func__); 2896 return; 2897 } 2898 BN_CTX_start(bnctx); 2899 if ((x = BN_CTX_get(bnctx)) == NULL || 2900 (y = BN_CTX_get(bnctx)) == NULL) { 2901 fprintf(stderr, "%s: BN_CTX_get failed\n", __func__); 2902 return; 2903 } 2904 if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) != 2905 NID_X9_62_prime_field) { 2906 fprintf(stderr, "%s: group is not a prime field\n", __func__); 2907 return; 2908 } 2909 if (EC_POINT_get_affine_coordinates_GFp(group, point, x, y, 2910 bnctx) != 1) { 2911 fprintf(stderr, "%s: EC_POINT_get_affine_coordinates_GFp\n", 2912 __func__); 2913 return; 2914 } 2915 fputs("x=", stderr); 2916 BN_print_fp(stderr, x); 2917 fputs("\ny=", stderr); 2918 BN_print_fp(stderr, y); 2919 fputs("\n", stderr); 2920 BN_CTX_free(bnctx); 2921 } 2922 2923 void 2924 sshkey_dump_ec_key(const EC_KEY *key) 2925 { 2926 const BIGNUM *exponent; 2927 2928 sshkey_dump_ec_point(EC_KEY_get0_group(key), 2929 EC_KEY_get0_public_key(key)); 2930 fputs("exponent=", stderr); 2931 if ((exponent = EC_KEY_get0_private_key(key)) == NULL) 2932 fputs("(NULL)", stderr); 2933 else 2934 BN_print_fp(stderr, EC_KEY_get0_private_key(key)); 2935 fputs("\n", stderr); 2936 } 2937 #endif /* WITH_OPENSSL */ 2938 2939 static int 2940 sshkey_private_to_blob2(const struct sshkey *prv, struct sshbuf *blob, 2941 const char *passphrase, const char *comment, const char *ciphername, 2942 int rounds) 2943 { 2944 u_char *cp, *key = NULL, *pubkeyblob = NULL; 2945 u_char salt[SALT_LEN]; 2946 char *b64 = NULL; 2947 size_t i, pubkeylen, keylen, ivlen, blocksize, authlen; 2948 u_int check; 2949 int r = SSH_ERR_INTERNAL_ERROR; 2950 struct sshcipher_ctx ciphercontext; 2951 const struct sshcipher *cipher; 2952 const char *kdfname = KDFNAME; 2953 struct sshbuf *encoded = NULL, *encrypted = NULL, *kdf = NULL; 2954 2955 memset(&ciphercontext, 0, sizeof(ciphercontext)); 2956 2957 if (rounds <= 0) 2958 rounds = DEFAULT_ROUNDS; 2959 if (passphrase == NULL || !strlen(passphrase)) { 2960 ciphername = "none"; 2961 kdfname = "none"; 2962 } else if (ciphername == NULL) 2963 ciphername = DEFAULT_CIPHERNAME; 2964 else if (cipher_number(ciphername) != SSH_CIPHER_SSH2) { 2965 r = SSH_ERR_INVALID_ARGUMENT; 2966 goto out; 2967 } 2968 if ((cipher = cipher_by_name(ciphername)) == NULL) { 2969 r = SSH_ERR_INTERNAL_ERROR; 2970 goto out; 2971 } 2972 2973 if ((kdf = sshbuf_new()) == NULL || 2974 (encoded = sshbuf_new()) == NULL || 2975 (encrypted = sshbuf_new()) == NULL) { 2976 r = SSH_ERR_ALLOC_FAIL; 2977 goto out; 2978 } 2979 blocksize = cipher_blocksize(cipher); 2980 keylen = cipher_keylen(cipher); 2981 ivlen = cipher_ivlen(cipher); 2982 authlen = cipher_authlen(cipher); 2983 if ((key = calloc(1, keylen + ivlen)) == NULL) { 2984 r = SSH_ERR_ALLOC_FAIL; 2985 goto out; 2986 } 2987 if (strcmp(kdfname, "bcrypt") == 0) { 2988 arc4random_buf(salt, SALT_LEN); 2989 if (bcrypt_pbkdf(passphrase, strlen(passphrase), 2990 salt, SALT_LEN, key, keylen + ivlen, rounds) < 0) { 2991 r = SSH_ERR_INVALID_ARGUMENT; 2992 goto out; 2993 } 2994 if ((r = sshbuf_put_string(kdf, salt, SALT_LEN)) != 0 || 2995 (r = sshbuf_put_u32(kdf, rounds)) != 0) 2996 goto out; 2997 } else if (strcmp(kdfname, "none") != 0) { 2998 /* Unsupported KDF type */ 2999 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 3000 goto out; 3001 } 3002 if ((r = cipher_init(&ciphercontext, cipher, key, keylen, 3003 key + keylen, ivlen, 1)) != 0) 3004 goto out; 3005 3006 if ((r = sshbuf_put(encoded, AUTH_MAGIC, sizeof(AUTH_MAGIC))) != 0 || 3007 (r = sshbuf_put_cstring(encoded, ciphername)) != 0 || 3008 (r = sshbuf_put_cstring(encoded, kdfname)) != 0 || 3009 (r = sshbuf_put_stringb(encoded, kdf)) != 0 || 3010 (r = sshbuf_put_u32(encoded, 1)) != 0 || /* number of keys */ 3011 (r = sshkey_to_blob(prv, &pubkeyblob, &pubkeylen)) != 0 || 3012 (r = sshbuf_put_string(encoded, pubkeyblob, pubkeylen)) != 0) 3013 goto out; 3014 3015 /* set up the buffer that will be encrypted */ 3016 3017 /* Random check bytes */ 3018 check = arc4random(); 3019 if ((r = sshbuf_put_u32(encrypted, check)) != 0 || 3020 (r = sshbuf_put_u32(encrypted, check)) != 0) 3021 goto out; 3022 3023 /* append private key and comment*/ 3024 if ((r = sshkey_private_serialize(prv, encrypted)) != 0 || 3025 (r = sshbuf_put_cstring(encrypted, comment)) != 0) 3026 goto out; 3027 3028 /* padding */ 3029 i = 0; 3030 while (sshbuf_len(encrypted) % blocksize) { 3031 if ((r = sshbuf_put_u8(encrypted, ++i & 0xff)) != 0) 3032 goto out; 3033 } 3034 3035 /* length in destination buffer */ 3036 if ((r = sshbuf_put_u32(encoded, sshbuf_len(encrypted))) != 0) 3037 goto out; 3038 3039 /* encrypt */ 3040 if ((r = sshbuf_reserve(encoded, 3041 sshbuf_len(encrypted) + authlen, &cp)) != 0) 3042 goto out; 3043 if ((r = cipher_crypt(&ciphercontext, 0, cp, 3044 sshbuf_ptr(encrypted), sshbuf_len(encrypted), 0, authlen)) != 0) 3045 goto out; 3046 3047 /* uuencode */ 3048 if ((b64 = sshbuf_dtob64(encoded)) == NULL) { 3049 r = SSH_ERR_ALLOC_FAIL; 3050 goto out; 3051 } 3052 3053 sshbuf_reset(blob); 3054 if ((r = sshbuf_put(blob, MARK_BEGIN, MARK_BEGIN_LEN)) != 0) 3055 goto out; 3056 for (i = 0; i < strlen(b64); i++) { 3057 if ((r = sshbuf_put_u8(blob, b64[i])) != 0) 3058 goto out; 3059 /* insert line breaks */ 3060 if (i % 70 == 69 && (r = sshbuf_put_u8(blob, '\n')) != 0) 3061 goto out; 3062 } 3063 if (i % 70 != 69 && (r = sshbuf_put_u8(blob, '\n')) != 0) 3064 goto out; 3065 if ((r = sshbuf_put(blob, MARK_END, MARK_END_LEN)) != 0) 3066 goto out; 3067 3068 /* success */ 3069 r = 0; 3070 3071 out: 3072 sshbuf_free(kdf); 3073 sshbuf_free(encoded); 3074 sshbuf_free(encrypted); 3075 cipher_cleanup(&ciphercontext); 3076 explicit_bzero(salt, sizeof(salt)); 3077 if (key != NULL) { 3078 explicit_bzero(key, keylen + ivlen); 3079 free(key); 3080 } 3081 if (pubkeyblob != NULL) { 3082 explicit_bzero(pubkeyblob, pubkeylen); 3083 free(pubkeyblob); 3084 } 3085 if (b64 != NULL) { 3086 explicit_bzero(b64, strlen(b64)); 3087 free(b64); 3088 } 3089 return r; 3090 } 3091 3092 static int 3093 sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase, 3094 struct sshkey **keyp, char **commentp) 3095 { 3096 char *comment = NULL, *ciphername = NULL, *kdfname = NULL; 3097 const struct sshcipher *cipher = NULL; 3098 const u_char *cp; 3099 int r = SSH_ERR_INTERNAL_ERROR; 3100 size_t encoded_len; 3101 size_t i, keylen = 0, ivlen = 0, authlen = 0, slen = 0; 3102 struct sshbuf *encoded = NULL, *decoded = NULL; 3103 struct sshbuf *kdf = NULL, *decrypted = NULL; 3104 struct sshcipher_ctx ciphercontext; 3105 struct sshkey *k = NULL; 3106 u_char *key = NULL, *salt = NULL, *dp, pad, last; 3107 u_int blocksize, rounds, nkeys, encrypted_len, check1, check2; 3108 3109 memset(&ciphercontext, 0, sizeof(ciphercontext)); 3110 if (keyp != NULL) 3111 *keyp = NULL; 3112 if (commentp != NULL) 3113 *commentp = NULL; 3114 3115 if ((encoded = sshbuf_new()) == NULL || 3116 (decoded = sshbuf_new()) == NULL || 3117 (decrypted = sshbuf_new()) == NULL) { 3118 r = SSH_ERR_ALLOC_FAIL; 3119 goto out; 3120 } 3121 3122 /* check preamble */ 3123 cp = sshbuf_ptr(blob); 3124 encoded_len = sshbuf_len(blob); 3125 if (encoded_len < (MARK_BEGIN_LEN + MARK_END_LEN) || 3126 memcmp(cp, MARK_BEGIN, MARK_BEGIN_LEN) != 0) { 3127 r = SSH_ERR_INVALID_FORMAT; 3128 goto out; 3129 } 3130 cp += MARK_BEGIN_LEN; 3131 encoded_len -= MARK_BEGIN_LEN; 3132 3133 /* Look for end marker, removing whitespace as we go */ 3134 while (encoded_len > 0) { 3135 if (*cp != '\n' && *cp != '\r') { 3136 if ((r = sshbuf_put_u8(encoded, *cp)) != 0) 3137 goto out; 3138 } 3139 last = *cp; 3140 encoded_len--; 3141 cp++; 3142 if (last == '\n') { 3143 if (encoded_len >= MARK_END_LEN && 3144 memcmp(cp, MARK_END, MARK_END_LEN) == 0) { 3145 /* \0 terminate */ 3146 if ((r = sshbuf_put_u8(encoded, 0)) != 0) 3147 goto out; 3148 break; 3149 } 3150 } 3151 } 3152 if (encoded_len == 0) { 3153 r = SSH_ERR_INVALID_FORMAT; 3154 goto out; 3155 } 3156 3157 /* decode base64 */ 3158 if ((r = sshbuf_b64tod(decoded, (char *)sshbuf_ptr(encoded))) != 0) 3159 goto out; 3160 3161 /* check magic */ 3162 if (sshbuf_len(decoded) < sizeof(AUTH_MAGIC) || 3163 memcmp(sshbuf_ptr(decoded), AUTH_MAGIC, sizeof(AUTH_MAGIC))) { 3164 r = SSH_ERR_INVALID_FORMAT; 3165 goto out; 3166 } 3167 /* parse public portion of key */ 3168 if ((r = sshbuf_consume(decoded, sizeof(AUTH_MAGIC))) != 0 || 3169 (r = sshbuf_get_cstring(decoded, &ciphername, NULL)) != 0 || 3170 (r = sshbuf_get_cstring(decoded, &kdfname, NULL)) != 0 || 3171 (r = sshbuf_froms(decoded, &kdf)) != 0 || 3172 (r = sshbuf_get_u32(decoded, &nkeys)) != 0 || 3173 (r = sshbuf_skip_string(decoded)) != 0 || /* pubkey */ 3174 (r = sshbuf_get_u32(decoded, &encrypted_len)) != 0) 3175 goto out; 3176 3177 if ((cipher = cipher_by_name(ciphername)) == NULL) { 3178 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 3179 goto out; 3180 } 3181 if ((passphrase == NULL || strlen(passphrase) == 0) && 3182 strcmp(ciphername, "none") != 0) { 3183 /* passphrase required */ 3184 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3185 goto out; 3186 } 3187 if (strcmp(kdfname, "none") != 0 && strcmp(kdfname, "bcrypt") != 0) { 3188 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 3189 goto out; 3190 } 3191 if (!strcmp(kdfname, "none") && strcmp(ciphername, "none") != 0) { 3192 r = SSH_ERR_INVALID_FORMAT; 3193 goto out; 3194 } 3195 if (nkeys != 1) { 3196 /* XXX only one key supported */ 3197 r = SSH_ERR_INVALID_FORMAT; 3198 goto out; 3199 } 3200 3201 /* check size of encrypted key blob */ 3202 blocksize = cipher_blocksize(cipher); 3203 if (encrypted_len < blocksize || (encrypted_len % blocksize) != 0) { 3204 r = SSH_ERR_INVALID_FORMAT; 3205 goto out; 3206 } 3207 3208 /* setup key */ 3209 keylen = cipher_keylen(cipher); 3210 ivlen = cipher_ivlen(cipher); 3211 authlen = cipher_authlen(cipher); 3212 if ((key = calloc(1, keylen + ivlen)) == NULL) { 3213 r = SSH_ERR_ALLOC_FAIL; 3214 goto out; 3215 } 3216 if (strcmp(kdfname, "bcrypt") == 0) { 3217 if ((r = sshbuf_get_string(kdf, &salt, &slen)) != 0 || 3218 (r = sshbuf_get_u32(kdf, &rounds)) != 0) 3219 goto out; 3220 if (bcrypt_pbkdf(passphrase, strlen(passphrase), salt, slen, 3221 key, keylen + ivlen, rounds) < 0) { 3222 r = SSH_ERR_INVALID_FORMAT; 3223 goto out; 3224 } 3225 } 3226 3227 /* check that an appropriate amount of auth data is present */ 3228 if (sshbuf_len(decoded) < encrypted_len + authlen) { 3229 r = SSH_ERR_INVALID_FORMAT; 3230 goto out; 3231 } 3232 3233 /* decrypt private portion of key */ 3234 if ((r = sshbuf_reserve(decrypted, encrypted_len, &dp)) != 0 || 3235 (r = cipher_init(&ciphercontext, cipher, key, keylen, 3236 key + keylen, ivlen, 0)) != 0) 3237 goto out; 3238 if ((r = cipher_crypt(&ciphercontext, 0, dp, sshbuf_ptr(decoded), 3239 encrypted_len, 0, authlen)) != 0) { 3240 /* an integrity error here indicates an incorrect passphrase */ 3241 if (r == SSH_ERR_MAC_INVALID) 3242 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3243 goto out; 3244 } 3245 if ((r = sshbuf_consume(decoded, encrypted_len + authlen)) != 0) 3246 goto out; 3247 /* there should be no trailing data */ 3248 if (sshbuf_len(decoded) != 0) { 3249 r = SSH_ERR_INVALID_FORMAT; 3250 goto out; 3251 } 3252 3253 /* check check bytes */ 3254 if ((r = sshbuf_get_u32(decrypted, &check1)) != 0 || 3255 (r = sshbuf_get_u32(decrypted, &check2)) != 0) 3256 goto out; 3257 if (check1 != check2) { 3258 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3259 goto out; 3260 } 3261 3262 /* Load the private key and comment */ 3263 if ((r = sshkey_private_deserialize(decrypted, &k)) != 0 || 3264 (r = sshbuf_get_cstring(decrypted, &comment, NULL)) != 0) 3265 goto out; 3266 3267 /* Check deterministic padding */ 3268 i = 0; 3269 while (sshbuf_len(decrypted)) { 3270 if ((r = sshbuf_get_u8(decrypted, &pad)) != 0) 3271 goto out; 3272 if (pad != (++i & 0xff)) { 3273 r = SSH_ERR_INVALID_FORMAT; 3274 goto out; 3275 } 3276 } 3277 3278 /* XXX decode pubkey and check against private */ 3279 3280 /* success */ 3281 r = 0; 3282 if (keyp != NULL) { 3283 *keyp = k; 3284 k = NULL; 3285 } 3286 if (commentp != NULL) { 3287 *commentp = comment; 3288 comment = NULL; 3289 } 3290 out: 3291 pad = 0; 3292 cipher_cleanup(&ciphercontext); 3293 free(ciphername); 3294 free(kdfname); 3295 free(comment); 3296 if (salt != NULL) { 3297 explicit_bzero(salt, slen); 3298 free(salt); 3299 } 3300 if (key != NULL) { 3301 explicit_bzero(key, keylen + ivlen); 3302 free(key); 3303 } 3304 sshbuf_free(encoded); 3305 sshbuf_free(decoded); 3306 sshbuf_free(kdf); 3307 sshbuf_free(decrypted); 3308 sshkey_free(k); 3309 return r; 3310 } 3311 3312 #if WITH_SSH1 3313 /* 3314 * Serialises the authentication (private) key to a blob, encrypting it with 3315 * passphrase. The identification of the blob (lowest 64 bits of n) will 3316 * precede the key to provide identification of the key without needing a 3317 * passphrase. 3318 */ 3319 static int 3320 sshkey_private_rsa1_to_blob(struct sshkey *key, struct sshbuf *blob, 3321 const char *passphrase, const char *comment) 3322 { 3323 struct sshbuf *buffer = NULL, *encrypted = NULL; 3324 u_char buf[8]; 3325 int r, cipher_num; 3326 struct sshcipher_ctx ciphercontext; 3327 const struct sshcipher *cipher; 3328 u_char *cp; 3329 3330 /* 3331 * If the passphrase is empty, use SSH_CIPHER_NONE to ease converting 3332 * to another cipher; otherwise use SSH_AUTHFILE_CIPHER. 3333 */ 3334 cipher_num = (strcmp(passphrase, "") == 0) ? 3335 SSH_CIPHER_NONE : SSH_CIPHER_3DES; 3336 if ((cipher = cipher_by_number(cipher_num)) == NULL) 3337 return SSH_ERR_INTERNAL_ERROR; 3338 3339 /* This buffer is used to build the secret part of the private key. */ 3340 if ((buffer = sshbuf_new()) == NULL) 3341 return SSH_ERR_ALLOC_FAIL; 3342 3343 /* Put checkbytes for checking passphrase validity. */ 3344 if ((r = sshbuf_reserve(buffer, 4, &cp)) != 0) 3345 goto out; 3346 arc4random_buf(cp, 2); 3347 memcpy(cp + 2, cp, 2); 3348 3349 /* 3350 * Store the private key (n and e will not be stored because they 3351 * will be stored in plain text, and storing them also in encrypted 3352 * format would just give known plaintext). 3353 * Note: q and p are stored in reverse order to SSL. 3354 */ 3355 if ((r = sshbuf_put_bignum1(buffer, key->rsa->d)) != 0 || 3356 (r = sshbuf_put_bignum1(buffer, key->rsa->iqmp)) != 0 || 3357 (r = sshbuf_put_bignum1(buffer, key->rsa->q)) != 0 || 3358 (r = sshbuf_put_bignum1(buffer, key->rsa->p)) != 0) 3359 goto out; 3360 3361 /* Pad the part to be encrypted to a size that is a multiple of 8. */ 3362 explicit_bzero(buf, 8); 3363 if ((r = sshbuf_put(buffer, buf, 8 - (sshbuf_len(buffer) % 8))) != 0) 3364 goto out; 3365 3366 /* This buffer will be used to contain the data in the file. */ 3367 if ((encrypted = sshbuf_new()) == NULL) { 3368 r = SSH_ERR_ALLOC_FAIL; 3369 goto out; 3370 } 3371 3372 /* First store keyfile id string. */ 3373 if ((r = sshbuf_put(encrypted, LEGACY_BEGIN, 3374 sizeof(LEGACY_BEGIN))) != 0) 3375 goto out; 3376 3377 /* Store cipher type and "reserved" field. */ 3378 if ((r = sshbuf_put_u8(encrypted, cipher_num)) != 0 || 3379 (r = sshbuf_put_u32(encrypted, 0)) != 0) 3380 goto out; 3381 3382 /* Store public key. This will be in plain text. */ 3383 if ((r = sshbuf_put_u32(encrypted, BN_num_bits(key->rsa->n))) != 0 || 3384 (r = sshbuf_put_bignum1(encrypted, key->rsa->n) != 0) || 3385 (r = sshbuf_put_bignum1(encrypted, key->rsa->e) != 0) || 3386 (r = sshbuf_put_cstring(encrypted, comment) != 0)) 3387 goto out; 3388 3389 /* Allocate space for the private part of the key in the buffer. */ 3390 if ((r = sshbuf_reserve(encrypted, sshbuf_len(buffer), &cp)) != 0) 3391 goto out; 3392 3393 if ((r = cipher_set_key_string(&ciphercontext, cipher, passphrase, 3394 CIPHER_ENCRYPT)) != 0) 3395 goto out; 3396 if ((r = cipher_crypt(&ciphercontext, 0, cp, 3397 sshbuf_ptr(buffer), sshbuf_len(buffer), 0, 0)) != 0) 3398 goto out; 3399 if ((r = cipher_cleanup(&ciphercontext)) != 0) 3400 goto out; 3401 3402 r = sshbuf_putb(blob, encrypted); 3403 3404 out: 3405 explicit_bzero(&ciphercontext, sizeof(ciphercontext)); 3406 explicit_bzero(buf, sizeof(buf)); 3407 if (buffer != NULL) 3408 sshbuf_free(buffer); 3409 if (encrypted != NULL) 3410 sshbuf_free(encrypted); 3411 3412 return r; 3413 } 3414 #endif /* WITH_SSH1 */ 3415 3416 #ifdef WITH_OPENSSL 3417 /* convert SSH v2 key in OpenSSL PEM format */ 3418 static int 3419 sshkey_private_pem_to_blob(struct sshkey *key, struct sshbuf *blob, 3420 const char *_passphrase, const char *comment) 3421 { 3422 int success, r; 3423 int blen, len = strlen(_passphrase); 3424 u_char *passphrase = (len > 0) ? (u_char *)_passphrase : NULL; 3425 const EVP_CIPHER *cipher = (len > 0) ? EVP_aes_128_cbc() : NULL; 3426 const u_char *bptr; 3427 BIO *bio = NULL; 3428 3429 if (len > 0 && len <= 4) 3430 return SSH_ERR_PASSPHRASE_TOO_SHORT; 3431 if ((bio = BIO_new(BIO_s_mem())) == NULL) 3432 return SSH_ERR_ALLOC_FAIL; 3433 3434 switch (key->type) { 3435 case KEY_DSA: 3436 success = PEM_write_bio_DSAPrivateKey(bio, key->dsa, 3437 cipher, passphrase, len, NULL, NULL); 3438 break; 3439 case KEY_ECDSA: 3440 success = PEM_write_bio_ECPrivateKey(bio, key->ecdsa, 3441 cipher, passphrase, len, NULL, NULL); 3442 break; 3443 case KEY_RSA: 3444 success = PEM_write_bio_RSAPrivateKey(bio, key->rsa, 3445 cipher, passphrase, len, NULL, NULL); 3446 break; 3447 default: 3448 success = 0; 3449 break; 3450 } 3451 if (success == 0) { 3452 r = SSH_ERR_LIBCRYPTO_ERROR; 3453 goto out; 3454 } 3455 if ((blen = BIO_get_mem_data(bio, &bptr)) <= 0) { 3456 r = SSH_ERR_INTERNAL_ERROR; 3457 goto out; 3458 } 3459 if ((r = sshbuf_put(blob, bptr, blen)) != 0) 3460 goto out; 3461 r = 0; 3462 out: 3463 BIO_free(bio); 3464 return r; 3465 } 3466 #endif /* WITH_OPENSSL */ 3467 3468 /* Serialise "key" to buffer "blob" */ 3469 int 3470 sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob, 3471 const char *passphrase, const char *comment, 3472 int force_new_format, const char *new_format_cipher, int new_format_rounds) 3473 { 3474 switch (key->type) { 3475 #ifdef WITH_SSH1 3476 case KEY_RSA1: 3477 return sshkey_private_rsa1_to_blob(key, blob, 3478 passphrase, comment); 3479 #endif /* WITH_SSH1 */ 3480 #ifdef WITH_OPENSSL 3481 case KEY_DSA: 3482 case KEY_ECDSA: 3483 case KEY_RSA: 3484 if (force_new_format) { 3485 return sshkey_private_to_blob2(key, blob, passphrase, 3486 comment, new_format_cipher, new_format_rounds); 3487 } 3488 return sshkey_private_pem_to_blob(key, blob, 3489 passphrase, comment); 3490 #endif /* WITH_OPENSSL */ 3491 case KEY_ED25519: 3492 return sshkey_private_to_blob2(key, blob, passphrase, 3493 comment, new_format_cipher, new_format_rounds); 3494 default: 3495 return SSH_ERR_KEY_TYPE_UNKNOWN; 3496 } 3497 } 3498 3499 #ifdef WITH_SSH1 3500 /* 3501 * Parse the public, unencrypted portion of a RSA1 key. 3502 */ 3503 int 3504 sshkey_parse_public_rsa1_fileblob(struct sshbuf *blob, 3505 struct sshkey **keyp, char **commentp) 3506 { 3507 int r; 3508 struct sshkey *pub = NULL; 3509 struct sshbuf *copy = NULL; 3510 3511 if (keyp != NULL) 3512 *keyp = NULL; 3513 if (commentp != NULL) 3514 *commentp = NULL; 3515 3516 /* Check that it is at least big enough to contain the ID string. */ 3517 if (sshbuf_len(blob) < sizeof(LEGACY_BEGIN)) 3518 return SSH_ERR_INVALID_FORMAT; 3519 3520 /* 3521 * Make sure it begins with the id string. Consume the id string 3522 * from the buffer. 3523 */ 3524 if (memcmp(sshbuf_ptr(blob), LEGACY_BEGIN, sizeof(LEGACY_BEGIN)) != 0) 3525 return SSH_ERR_INVALID_FORMAT; 3526 /* Make a working copy of the keyblob and skip past the magic */ 3527 if ((copy = sshbuf_fromb(blob)) == NULL) 3528 return SSH_ERR_ALLOC_FAIL; 3529 if ((r = sshbuf_consume(copy, sizeof(LEGACY_BEGIN))) != 0) 3530 goto out; 3531 3532 /* Skip cipher type, reserved data and key bits. */ 3533 if ((r = sshbuf_get_u8(copy, NULL)) != 0 || /* cipher type */ 3534 (r = sshbuf_get_u32(copy, NULL)) != 0 || /* reserved */ 3535 (r = sshbuf_get_u32(copy, NULL)) != 0) /* key bits */ 3536 goto out; 3537 3538 /* Read the public key from the buffer. */ 3539 if ((pub = sshkey_new(KEY_RSA1)) == NULL || 3540 (r = sshbuf_get_bignum1(copy, pub->rsa->n)) != 0 || 3541 (r = sshbuf_get_bignum1(copy, pub->rsa->e)) != 0) 3542 goto out; 3543 3544 /* Finally, the comment */ 3545 if ((r = sshbuf_get_string(copy, (u_char**)commentp, NULL)) != 0) 3546 goto out; 3547 3548 /* The encrypted private part is not parsed by this function. */ 3549 3550 r = 0; 3551 if (keyp != NULL) 3552 *keyp = pub; 3553 else 3554 sshkey_free(pub); 3555 pub = NULL; 3556 3557 out: 3558 if (copy != NULL) 3559 sshbuf_free(copy); 3560 if (pub != NULL) 3561 sshkey_free(pub); 3562 return r; 3563 } 3564 3565 static int 3566 sshkey_parse_private_rsa1(struct sshbuf *blob, const char *passphrase, 3567 struct sshkey **keyp, char **commentp) 3568 { 3569 int r; 3570 u_int16_t check1, check2; 3571 u_int8_t cipher_type; 3572 struct sshbuf *decrypted = NULL, *copy = NULL; 3573 u_char *cp; 3574 char *comment = NULL; 3575 struct sshcipher_ctx ciphercontext; 3576 const struct sshcipher *cipher; 3577 struct sshkey *prv = NULL; 3578 3579 *keyp = NULL; 3580 if (commentp != NULL) 3581 *commentp = NULL; 3582 3583 /* Check that it is at least big enough to contain the ID string. */ 3584 if (sshbuf_len(blob) < sizeof(LEGACY_BEGIN)) 3585 return SSH_ERR_INVALID_FORMAT; 3586 3587 /* 3588 * Make sure it begins with the id string. Consume the id string 3589 * from the buffer. 3590 */ 3591 if (memcmp(sshbuf_ptr(blob), LEGACY_BEGIN, sizeof(LEGACY_BEGIN)) != 0) 3592 return SSH_ERR_INVALID_FORMAT; 3593 3594 if ((prv = sshkey_new_private(KEY_RSA1)) == NULL) { 3595 r = SSH_ERR_ALLOC_FAIL; 3596 goto out; 3597 } 3598 if ((copy = sshbuf_fromb(blob)) == NULL || 3599 (decrypted = sshbuf_new()) == NULL) { 3600 r = SSH_ERR_ALLOC_FAIL; 3601 goto out; 3602 } 3603 if ((r = sshbuf_consume(copy, sizeof(LEGACY_BEGIN))) != 0) 3604 goto out; 3605 3606 /* Read cipher type. */ 3607 if ((r = sshbuf_get_u8(copy, &cipher_type)) != 0 || 3608 (r = sshbuf_get_u32(copy, NULL)) != 0) /* reserved */ 3609 goto out; 3610 3611 /* Read the public key and comment from the buffer. */ 3612 if ((r = sshbuf_get_u32(copy, NULL)) != 0 || /* key bits */ 3613 (r = sshbuf_get_bignum1(copy, prv->rsa->n)) != 0 || 3614 (r = sshbuf_get_bignum1(copy, prv->rsa->e)) != 0 || 3615 (r = sshbuf_get_cstring(copy, &comment, NULL)) != 0) 3616 goto out; 3617 3618 /* Check that it is a supported cipher. */ 3619 cipher = cipher_by_number(cipher_type); 3620 if (cipher == NULL) { 3621 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 3622 goto out; 3623 } 3624 /* Initialize space for decrypted data. */ 3625 if ((r = sshbuf_reserve(decrypted, sshbuf_len(copy), &cp)) != 0) 3626 goto out; 3627 3628 /* Rest of the buffer is encrypted. Decrypt it using the passphrase. */ 3629 if ((r = cipher_set_key_string(&ciphercontext, cipher, passphrase, 3630 CIPHER_DECRYPT)) != 0) 3631 goto out; 3632 if ((r = cipher_crypt(&ciphercontext, 0, cp, 3633 sshbuf_ptr(copy), sshbuf_len(copy), 0, 0)) != 0) { 3634 cipher_cleanup(&ciphercontext); 3635 goto out; 3636 } 3637 if ((r = cipher_cleanup(&ciphercontext)) != 0) 3638 goto out; 3639 3640 if ((r = sshbuf_get_u16(decrypted, &check1)) != 0 || 3641 (r = sshbuf_get_u16(decrypted, &check2)) != 0) 3642 goto out; 3643 if (check1 != check2) { 3644 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3645 goto out; 3646 } 3647 3648 /* Read the rest of the private key. */ 3649 if ((r = sshbuf_get_bignum1(decrypted, prv->rsa->d)) != 0 || 3650 (r = sshbuf_get_bignum1(decrypted, prv->rsa->iqmp)) != 0 || 3651 (r = sshbuf_get_bignum1(decrypted, prv->rsa->q)) != 0 || 3652 (r = sshbuf_get_bignum1(decrypted, prv->rsa->p)) != 0) 3653 goto out; 3654 3655 /* calculate p-1 and q-1 */ 3656 if ((r = rsa_generate_additional_parameters(prv->rsa)) != 0) 3657 goto out; 3658 3659 /* enable blinding */ 3660 if (RSA_blinding_on(prv->rsa, NULL) != 1) { 3661 r = SSH_ERR_LIBCRYPTO_ERROR; 3662 goto out; 3663 } 3664 r = 0; 3665 *keyp = prv; 3666 prv = NULL; 3667 if (commentp != NULL) { 3668 *commentp = comment; 3669 comment = NULL; 3670 } 3671 out: 3672 explicit_bzero(&ciphercontext, sizeof(ciphercontext)); 3673 if (comment != NULL) 3674 free(comment); 3675 if (prv != NULL) 3676 sshkey_free(prv); 3677 if (copy != NULL) 3678 sshbuf_free(copy); 3679 if (decrypted != NULL) 3680 sshbuf_free(decrypted); 3681 return r; 3682 } 3683 #endif /* WITH_SSH1 */ 3684 3685 #ifdef WITH_OPENSSL 3686 static int 3687 sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, 3688 const char *passphrase, struct sshkey **keyp) 3689 { 3690 EVP_PKEY *pk = NULL; 3691 struct sshkey *prv = NULL; 3692 BIO *bio = NULL; 3693 int r; 3694 3695 *keyp = NULL; 3696 3697 if ((bio = BIO_new(BIO_s_mem())) == NULL || sshbuf_len(blob) > INT_MAX) 3698 return SSH_ERR_ALLOC_FAIL; 3699 if (BIO_write(bio, sshbuf_ptr(blob), sshbuf_len(blob)) != 3700 (int)sshbuf_len(blob)) { 3701 r = SSH_ERR_ALLOC_FAIL; 3702 goto out; 3703 } 3704 3705 if ((pk = PEM_read_bio_PrivateKey(bio, NULL, NULL, 3706 (char *)passphrase)) == NULL) { 3707 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3708 goto out; 3709 } 3710 if (pk->type == EVP_PKEY_RSA && 3711 (type == KEY_UNSPEC || type == KEY_RSA)) { 3712 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 3713 r = SSH_ERR_ALLOC_FAIL; 3714 goto out; 3715 } 3716 prv->rsa = EVP_PKEY_get1_RSA(pk); 3717 prv->type = KEY_RSA; 3718 #ifdef DEBUG_PK 3719 RSA_print_fp(stderr, prv->rsa, 8); 3720 #endif 3721 if (RSA_blinding_on(prv->rsa, NULL) != 1) { 3722 r = SSH_ERR_LIBCRYPTO_ERROR; 3723 goto out; 3724 } 3725 } else if (pk->type == EVP_PKEY_DSA && 3726 (type == KEY_UNSPEC || type == KEY_DSA)) { 3727 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 3728 r = SSH_ERR_ALLOC_FAIL; 3729 goto out; 3730 } 3731 prv->dsa = EVP_PKEY_get1_DSA(pk); 3732 prv->type = KEY_DSA; 3733 #ifdef DEBUG_PK 3734 DSA_print_fp(stderr, prv->dsa, 8); 3735 #endif 3736 } else if (pk->type == EVP_PKEY_EC && 3737 (type == KEY_UNSPEC || type == KEY_ECDSA)) { 3738 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 3739 r = SSH_ERR_ALLOC_FAIL; 3740 goto out; 3741 } 3742 prv->ecdsa = EVP_PKEY_get1_EC_KEY(pk); 3743 prv->type = KEY_ECDSA; 3744 prv->ecdsa_nid = sshkey_ecdsa_key_to_nid(prv->ecdsa); 3745 if (prv->ecdsa_nid == -1 || 3746 sshkey_curve_nid_to_name(prv->ecdsa_nid) == NULL || 3747 sshkey_ec_validate_public(EC_KEY_get0_group(prv->ecdsa), 3748 EC_KEY_get0_public_key(prv->ecdsa)) != 0 || 3749 sshkey_ec_validate_private(prv->ecdsa) != 0) { 3750 r = SSH_ERR_INVALID_FORMAT; 3751 goto out; 3752 } 3753 #ifdef DEBUG_PK 3754 if (prv != NULL && prv->ecdsa != NULL) 3755 sshkey_dump_ec_key(prv->ecdsa); 3756 #endif 3757 } else { 3758 r = SSH_ERR_INVALID_FORMAT; 3759 goto out; 3760 } 3761 r = 0; 3762 *keyp = prv; 3763 prv = NULL; 3764 out: 3765 BIO_free(bio); 3766 if (pk != NULL) 3767 EVP_PKEY_free(pk); 3768 if (prv != NULL) 3769 sshkey_free(prv); 3770 return r; 3771 } 3772 #endif /* WITH_OPENSSL */ 3773 3774 int 3775 sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type, 3776 const char *passphrase, struct sshkey **keyp, char **commentp) 3777 { 3778 int r; 3779 3780 *keyp = NULL; 3781 if (commentp != NULL) 3782 *commentp = NULL; 3783 3784 switch (type) { 3785 #ifdef WITH_SSH1 3786 case KEY_RSA1: 3787 return sshkey_parse_private_rsa1(blob, passphrase, 3788 keyp, commentp); 3789 #endif /* WITH_SSH1 */ 3790 #ifdef WITH_OPENSSL 3791 case KEY_DSA: 3792 case KEY_ECDSA: 3793 case KEY_RSA: 3794 return sshkey_parse_private_pem_fileblob(blob, type, 3795 passphrase, keyp); 3796 #endif /* WITH_OPENSSL */ 3797 case KEY_ED25519: 3798 return sshkey_parse_private2(blob, type, passphrase, 3799 keyp, commentp); 3800 case KEY_UNSPEC: 3801 if ((r = sshkey_parse_private2(blob, type, passphrase, keyp, 3802 commentp)) == 0) 3803 return 0; 3804 #ifdef WITH_OPENSSL 3805 return sshkey_parse_private_pem_fileblob(blob, type, 3806 passphrase, keyp); 3807 #else 3808 return SSH_ERR_INVALID_FORMAT; 3809 #endif /* WITH_OPENSSL */ 3810 default: 3811 return SSH_ERR_KEY_TYPE_UNKNOWN; 3812 } 3813 } 3814 3815 int 3816 sshkey_parse_private_fileblob(struct sshbuf *buffer, const char *passphrase, 3817 const char *filename, struct sshkey **keyp, char **commentp) 3818 { 3819 int r; 3820 3821 if (keyp != NULL) 3822 *keyp = NULL; 3823 if (commentp != NULL) 3824 *commentp = NULL; 3825 3826 #ifdef WITH_SSH1 3827 /* it's a SSH v1 key if the public key part is readable */ 3828 if ((r = sshkey_parse_public_rsa1_fileblob(buffer, NULL, NULL)) == 0) { 3829 return sshkey_parse_private_fileblob_type(buffer, KEY_RSA1, 3830 passphrase, keyp, commentp); 3831 } 3832 #endif /* WITH_SSH1 */ 3833 if ((r = sshkey_parse_private_fileblob_type(buffer, KEY_UNSPEC, 3834 passphrase, keyp, commentp)) == 0) 3835 return 0; 3836 return r; 3837 } 3838