1 /* $OpenBSD: sshkey.c,v 1.18 2015/05/08 03:17:49 djm Exp $ */ 2 /* 3 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 4 * Copyright (c) 2008 Alexander von Gernler. All rights reserved. 5 * Copyright (c) 2010,2011 Damien Miller. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 #include <sys/param.h> /* MIN MAX */ 29 #include <sys/types.h> 30 #include <netinet/in.h> 31 32 #ifdef WITH_OPENSSL 33 #include <openssl/evp.h> 34 #include <openssl/err.h> 35 #include <openssl/pem.h> 36 #endif 37 38 #include "crypto_api.h" 39 40 #include <errno.h> 41 #include <stdio.h> 42 #include <string.h> 43 #include <util.h> 44 #include <limits.h> 45 #include <resolv.h> 46 47 #include "ssh2.h" 48 #include "ssherr.h" 49 #include "misc.h" 50 #include "sshbuf.h" 51 #include "rsa.h" 52 #include "cipher.h" 53 #include "digest.h" 54 #define SSHKEY_INTERNAL 55 #include "sshkey.h" 56 #include "match.h" 57 58 /* openssh private key file format */ 59 #define MARK_BEGIN "-----BEGIN OPENSSH PRIVATE KEY-----\n" 60 #define MARK_END "-----END OPENSSH PRIVATE KEY-----\n" 61 #define MARK_BEGIN_LEN (sizeof(MARK_BEGIN) - 1) 62 #define MARK_END_LEN (sizeof(MARK_END) - 1) 63 #define KDFNAME "bcrypt" 64 #define AUTH_MAGIC "openssh-key-v1" 65 #define SALT_LEN 16 66 #define DEFAULT_CIPHERNAME "aes256-cbc" 67 #define DEFAULT_ROUNDS 16 68 69 /* Version identification string for SSH v1 identity files. */ 70 #define LEGACY_BEGIN "SSH PRIVATE KEY FILE FORMAT 1.1\n" 71 72 static int sshkey_from_blob_internal(struct sshbuf *buf, 73 struct sshkey **keyp, int allow_cert); 74 75 /* Supported key types */ 76 struct keytype { 77 const char *name; 78 const char *shortname; 79 int type; 80 int nid; 81 int cert; 82 }; 83 static const struct keytype keytypes[] = { 84 { "ssh-ed25519", "ED25519", KEY_ED25519, 0, 0 }, 85 { "ssh-ed25519-cert-v01@openssh.com", "ED25519-CERT", 86 KEY_ED25519_CERT, 0, 1 }, 87 #ifdef WITH_OPENSSL 88 { NULL, "RSA1", KEY_RSA1, 0, 0 }, 89 { "ssh-rsa", "RSA", KEY_RSA, 0, 0 }, 90 { "ssh-dss", "DSA", KEY_DSA, 0, 0 }, 91 { "ecdsa-sha2-nistp256", "ECDSA", KEY_ECDSA, NID_X9_62_prime256v1, 0 }, 92 { "ecdsa-sha2-nistp384", "ECDSA", KEY_ECDSA, NID_secp384r1, 0 }, 93 { "ecdsa-sha2-nistp521", "ECDSA", KEY_ECDSA, NID_secp521r1, 0 }, 94 { "ssh-rsa-cert-v01@openssh.com", "RSA-CERT", KEY_RSA_CERT, 0, 1 }, 95 { "ssh-dss-cert-v01@openssh.com", "DSA-CERT", KEY_DSA_CERT, 0, 1 }, 96 { "ecdsa-sha2-nistp256-cert-v01@openssh.com", "ECDSA-CERT", 97 KEY_ECDSA_CERT, NID_X9_62_prime256v1, 1 }, 98 { "ecdsa-sha2-nistp384-cert-v01@openssh.com", "ECDSA-CERT", 99 KEY_ECDSA_CERT, NID_secp384r1, 1 }, 100 { "ecdsa-sha2-nistp521-cert-v01@openssh.com", "ECDSA-CERT", 101 KEY_ECDSA_CERT, NID_secp521r1, 1 }, 102 { "ssh-rsa-cert-v00@openssh.com", "RSA-CERT-V00", 103 KEY_RSA_CERT_V00, 0, 1 }, 104 { "ssh-dss-cert-v00@openssh.com", "DSA-CERT-V00", 105 KEY_DSA_CERT_V00, 0, 1 }, 106 #endif /* WITH_OPENSSL */ 107 { NULL, NULL, -1, -1, 0 } 108 }; 109 110 const char * 111 sshkey_type(const struct sshkey *k) 112 { 113 const struct keytype *kt; 114 115 for (kt = keytypes; kt->type != -1; kt++) { 116 if (kt->type == k->type) 117 return kt->shortname; 118 } 119 return "unknown"; 120 } 121 122 static const char * 123 sshkey_ssh_name_from_type_nid(int type, int nid) 124 { 125 const struct keytype *kt; 126 127 for (kt = keytypes; kt->type != -1; kt++) { 128 if (kt->type == type && (kt->nid == 0 || kt->nid == nid)) 129 return kt->name; 130 } 131 return "ssh-unknown"; 132 } 133 134 int 135 sshkey_type_is_cert(int type) 136 { 137 const struct keytype *kt; 138 139 for (kt = keytypes; kt->type != -1; kt++) { 140 if (kt->type == type) 141 return kt->cert; 142 } 143 return 0; 144 } 145 146 const char * 147 sshkey_ssh_name(const struct sshkey *k) 148 { 149 return sshkey_ssh_name_from_type_nid(k->type, k->ecdsa_nid); 150 } 151 152 const char * 153 sshkey_ssh_name_plain(const struct sshkey *k) 154 { 155 return sshkey_ssh_name_from_type_nid(sshkey_type_plain(k->type), 156 k->ecdsa_nid); 157 } 158 159 int 160 sshkey_type_from_name(const char *name) 161 { 162 const struct keytype *kt; 163 164 for (kt = keytypes; kt->type != -1; kt++) { 165 /* Only allow shortname matches for plain key types */ 166 if ((kt->name != NULL && strcmp(name, kt->name) == 0) || 167 (!kt->cert && strcasecmp(kt->shortname, name) == 0)) 168 return kt->type; 169 } 170 return KEY_UNSPEC; 171 } 172 173 int 174 sshkey_ecdsa_nid_from_name(const char *name) 175 { 176 const struct keytype *kt; 177 178 for (kt = keytypes; kt->type != -1; kt++) { 179 if (kt->type != KEY_ECDSA && kt->type != KEY_ECDSA_CERT) 180 continue; 181 if (kt->name != NULL && strcmp(name, kt->name) == 0) 182 return kt->nid; 183 } 184 return -1; 185 } 186 187 char * 188 key_alg_list(int certs_only, int plain_only) 189 { 190 char *tmp, *ret = NULL; 191 size_t nlen, rlen = 0; 192 const struct keytype *kt; 193 194 for (kt = keytypes; kt->type != -1; kt++) { 195 if (kt->name == NULL) 196 continue; 197 if ((certs_only && !kt->cert) || (plain_only && kt->cert)) 198 continue; 199 if (ret != NULL) 200 ret[rlen++] = '\n'; 201 nlen = strlen(kt->name); 202 if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) { 203 free(ret); 204 return NULL; 205 } 206 ret = tmp; 207 memcpy(ret + rlen, kt->name, nlen + 1); 208 rlen += nlen; 209 } 210 return ret; 211 } 212 213 int 214 sshkey_names_valid2(const char *names, int allow_wildcard) 215 { 216 char *s, *cp, *p; 217 const struct keytype *kt; 218 int type; 219 220 if (names == NULL || strcmp(names, "") == 0) 221 return 0; 222 if ((s = cp = strdup(names)) == NULL) 223 return 0; 224 for ((p = strsep(&cp, ",")); p && *p != '\0'; 225 (p = strsep(&cp, ","))) { 226 type = sshkey_type_from_name(p); 227 if (type == KEY_RSA1) { 228 free(s); 229 return 0; 230 } 231 if (type == KEY_UNSPEC) { 232 if (allow_wildcard) { 233 /* 234 * Try matching key types against the string. 235 * If any has a positive or negative match then 236 * the component is accepted. 237 */ 238 for (kt = keytypes; kt->type != -1; kt++) { 239 if (kt->type == KEY_RSA1) 240 continue; 241 if (match_pattern_list(kt->name, 242 p, 0) != 0) 243 break; 244 } 245 if (kt->type != -1) 246 continue; 247 } 248 free(s); 249 return 0; 250 } 251 } 252 free(s); 253 return 1; 254 } 255 256 u_int 257 sshkey_size(const struct sshkey *k) 258 { 259 switch (k->type) { 260 #ifdef WITH_OPENSSL 261 case KEY_RSA1: 262 case KEY_RSA: 263 case KEY_RSA_CERT_V00: 264 case KEY_RSA_CERT: 265 return BN_num_bits(k->rsa->n); 266 case KEY_DSA: 267 case KEY_DSA_CERT_V00: 268 case KEY_DSA_CERT: 269 return BN_num_bits(k->dsa->p); 270 case KEY_ECDSA: 271 case KEY_ECDSA_CERT: 272 return sshkey_curve_nid_to_bits(k->ecdsa_nid); 273 #endif /* WITH_OPENSSL */ 274 case KEY_ED25519: 275 case KEY_ED25519_CERT: 276 return 256; /* XXX */ 277 } 278 return 0; 279 } 280 281 int 282 sshkey_cert_is_legacy(const struct sshkey *k) 283 { 284 switch (k->type) { 285 case KEY_DSA_CERT_V00: 286 case KEY_RSA_CERT_V00: 287 return 1; 288 default: 289 return 0; 290 } 291 } 292 293 static int 294 sshkey_type_is_valid_ca(int type) 295 { 296 switch (type) { 297 case KEY_RSA: 298 case KEY_DSA: 299 case KEY_ECDSA: 300 case KEY_ED25519: 301 return 1; 302 default: 303 return 0; 304 } 305 } 306 307 int 308 sshkey_is_cert(const struct sshkey *k) 309 { 310 if (k == NULL) 311 return 0; 312 return sshkey_type_is_cert(k->type); 313 } 314 315 /* Return the cert-less equivalent to a certified key type */ 316 int 317 sshkey_type_plain(int type) 318 { 319 switch (type) { 320 case KEY_RSA_CERT_V00: 321 case KEY_RSA_CERT: 322 return KEY_RSA; 323 case KEY_DSA_CERT_V00: 324 case KEY_DSA_CERT: 325 return KEY_DSA; 326 case KEY_ECDSA_CERT: 327 return KEY_ECDSA; 328 case KEY_ED25519_CERT: 329 return KEY_ED25519; 330 default: 331 return type; 332 } 333 } 334 335 #ifdef WITH_OPENSSL 336 /* XXX: these are really begging for a table-driven approach */ 337 int 338 sshkey_curve_name_to_nid(const char *name) 339 { 340 if (strcmp(name, "nistp256") == 0) 341 return NID_X9_62_prime256v1; 342 else if (strcmp(name, "nistp384") == 0) 343 return NID_secp384r1; 344 else if (strcmp(name, "nistp521") == 0) 345 return NID_secp521r1; 346 else 347 return -1; 348 } 349 350 u_int 351 sshkey_curve_nid_to_bits(int nid) 352 { 353 switch (nid) { 354 case NID_X9_62_prime256v1: 355 return 256; 356 case NID_secp384r1: 357 return 384; 358 case NID_secp521r1: 359 return 521; 360 default: 361 return 0; 362 } 363 } 364 365 int 366 sshkey_ecdsa_bits_to_nid(int bits) 367 { 368 switch (bits) { 369 case 256: 370 return NID_X9_62_prime256v1; 371 case 384: 372 return NID_secp384r1; 373 case 521: 374 return NID_secp521r1; 375 default: 376 return -1; 377 } 378 } 379 380 const char * 381 sshkey_curve_nid_to_name(int nid) 382 { 383 switch (nid) { 384 case NID_X9_62_prime256v1: 385 return "nistp256"; 386 case NID_secp384r1: 387 return "nistp384"; 388 case NID_secp521r1: 389 return "nistp521"; 390 default: 391 return NULL; 392 } 393 } 394 395 int 396 sshkey_ec_nid_to_hash_alg(int nid) 397 { 398 int kbits = sshkey_curve_nid_to_bits(nid); 399 400 if (kbits <= 0) 401 return -1; 402 403 /* RFC5656 section 6.2.1 */ 404 if (kbits <= 256) 405 return SSH_DIGEST_SHA256; 406 else if (kbits <= 384) 407 return SSH_DIGEST_SHA384; 408 else 409 return SSH_DIGEST_SHA512; 410 } 411 #endif /* WITH_OPENSSL */ 412 413 static void 414 cert_free(struct sshkey_cert *cert) 415 { 416 u_int i; 417 418 if (cert == NULL) 419 return; 420 if (cert->certblob != NULL) 421 sshbuf_free(cert->certblob); 422 if (cert->critical != NULL) 423 sshbuf_free(cert->critical); 424 if (cert->extensions != NULL) 425 sshbuf_free(cert->extensions); 426 if (cert->key_id != NULL) 427 free(cert->key_id); 428 for (i = 0; i < cert->nprincipals; i++) 429 free(cert->principals[i]); 430 if (cert->principals != NULL) 431 free(cert->principals); 432 if (cert->signature_key != NULL) 433 sshkey_free(cert->signature_key); 434 explicit_bzero(cert, sizeof(*cert)); 435 free(cert); 436 } 437 438 static struct sshkey_cert * 439 cert_new(void) 440 { 441 struct sshkey_cert *cert; 442 443 if ((cert = calloc(1, sizeof(*cert))) == NULL) 444 return NULL; 445 if ((cert->certblob = sshbuf_new()) == NULL || 446 (cert->critical = sshbuf_new()) == NULL || 447 (cert->extensions = sshbuf_new()) == NULL) { 448 cert_free(cert); 449 return NULL; 450 } 451 cert->key_id = NULL; 452 cert->principals = NULL; 453 cert->signature_key = NULL; 454 return cert; 455 } 456 457 struct sshkey * 458 sshkey_new(int type) 459 { 460 struct sshkey *k; 461 #ifdef WITH_OPENSSL 462 RSA *rsa; 463 DSA *dsa; 464 #endif /* WITH_OPENSSL */ 465 466 if ((k = calloc(1, sizeof(*k))) == NULL) 467 return NULL; 468 k->type = type; 469 k->ecdsa = NULL; 470 k->ecdsa_nid = -1; 471 k->dsa = NULL; 472 k->rsa = NULL; 473 k->cert = NULL; 474 k->ed25519_sk = NULL; 475 k->ed25519_pk = NULL; 476 switch (k->type) { 477 #ifdef WITH_OPENSSL 478 case KEY_RSA1: 479 case KEY_RSA: 480 case KEY_RSA_CERT_V00: 481 case KEY_RSA_CERT: 482 if ((rsa = RSA_new()) == NULL || 483 (rsa->n = BN_new()) == NULL || 484 (rsa->e = BN_new()) == NULL) { 485 if (rsa != NULL) 486 RSA_free(rsa); 487 free(k); 488 return NULL; 489 } 490 k->rsa = rsa; 491 break; 492 case KEY_DSA: 493 case KEY_DSA_CERT_V00: 494 case KEY_DSA_CERT: 495 if ((dsa = DSA_new()) == NULL || 496 (dsa->p = BN_new()) == NULL || 497 (dsa->q = BN_new()) == NULL || 498 (dsa->g = BN_new()) == NULL || 499 (dsa->pub_key = BN_new()) == NULL) { 500 if (dsa != NULL) 501 DSA_free(dsa); 502 free(k); 503 return NULL; 504 } 505 k->dsa = dsa; 506 break; 507 case KEY_ECDSA: 508 case KEY_ECDSA_CERT: 509 /* Cannot do anything until we know the group */ 510 break; 511 #endif /* WITH_OPENSSL */ 512 case KEY_ED25519: 513 case KEY_ED25519_CERT: 514 /* no need to prealloc */ 515 break; 516 case KEY_UNSPEC: 517 break; 518 default: 519 free(k); 520 return NULL; 521 break; 522 } 523 524 if (sshkey_is_cert(k)) { 525 if ((k->cert = cert_new()) == NULL) { 526 sshkey_free(k); 527 return NULL; 528 } 529 } 530 531 return k; 532 } 533 534 int 535 sshkey_add_private(struct sshkey *k) 536 { 537 switch (k->type) { 538 #ifdef WITH_OPENSSL 539 case KEY_RSA1: 540 case KEY_RSA: 541 case KEY_RSA_CERT_V00: 542 case KEY_RSA_CERT: 543 #define bn_maybe_alloc_failed(p) (p == NULL && (p = BN_new()) == NULL) 544 if (bn_maybe_alloc_failed(k->rsa->d) || 545 bn_maybe_alloc_failed(k->rsa->iqmp) || 546 bn_maybe_alloc_failed(k->rsa->q) || 547 bn_maybe_alloc_failed(k->rsa->p) || 548 bn_maybe_alloc_failed(k->rsa->dmq1) || 549 bn_maybe_alloc_failed(k->rsa->dmp1)) 550 return SSH_ERR_ALLOC_FAIL; 551 break; 552 case KEY_DSA: 553 case KEY_DSA_CERT_V00: 554 case KEY_DSA_CERT: 555 if (bn_maybe_alloc_failed(k->dsa->priv_key)) 556 return SSH_ERR_ALLOC_FAIL; 557 break; 558 #undef bn_maybe_alloc_failed 559 case KEY_ECDSA: 560 case KEY_ECDSA_CERT: 561 /* Cannot do anything until we know the group */ 562 break; 563 #endif /* WITH_OPENSSL */ 564 case KEY_ED25519: 565 case KEY_ED25519_CERT: 566 /* no need to prealloc */ 567 break; 568 case KEY_UNSPEC: 569 break; 570 default: 571 return SSH_ERR_INVALID_ARGUMENT; 572 } 573 return 0; 574 } 575 576 struct sshkey * 577 sshkey_new_private(int type) 578 { 579 struct sshkey *k = sshkey_new(type); 580 581 if (k == NULL) 582 return NULL; 583 if (sshkey_add_private(k) != 0) { 584 sshkey_free(k); 585 return NULL; 586 } 587 return k; 588 } 589 590 void 591 sshkey_free(struct sshkey *k) 592 { 593 if (k == NULL) 594 return; 595 switch (k->type) { 596 #ifdef WITH_OPENSSL 597 case KEY_RSA1: 598 case KEY_RSA: 599 case KEY_RSA_CERT_V00: 600 case KEY_RSA_CERT: 601 if (k->rsa != NULL) 602 RSA_free(k->rsa); 603 k->rsa = NULL; 604 break; 605 case KEY_DSA: 606 case KEY_DSA_CERT_V00: 607 case KEY_DSA_CERT: 608 if (k->dsa != NULL) 609 DSA_free(k->dsa); 610 k->dsa = NULL; 611 break; 612 case KEY_ECDSA: 613 case KEY_ECDSA_CERT: 614 if (k->ecdsa != NULL) 615 EC_KEY_free(k->ecdsa); 616 k->ecdsa = NULL; 617 break; 618 #endif /* WITH_OPENSSL */ 619 case KEY_ED25519: 620 case KEY_ED25519_CERT: 621 if (k->ed25519_pk) { 622 explicit_bzero(k->ed25519_pk, ED25519_PK_SZ); 623 free(k->ed25519_pk); 624 k->ed25519_pk = NULL; 625 } 626 if (k->ed25519_sk) { 627 explicit_bzero(k->ed25519_sk, ED25519_SK_SZ); 628 free(k->ed25519_sk); 629 k->ed25519_sk = NULL; 630 } 631 break; 632 case KEY_UNSPEC: 633 break; 634 default: 635 break; 636 } 637 if (sshkey_is_cert(k)) 638 cert_free(k->cert); 639 explicit_bzero(k, sizeof(*k)); 640 free(k); 641 } 642 643 static int 644 cert_compare(struct sshkey_cert *a, struct sshkey_cert *b) 645 { 646 if (a == NULL && b == NULL) 647 return 1; 648 if (a == NULL || b == NULL) 649 return 0; 650 if (sshbuf_len(a->certblob) != sshbuf_len(b->certblob)) 651 return 0; 652 if (timingsafe_bcmp(sshbuf_ptr(a->certblob), sshbuf_ptr(b->certblob), 653 sshbuf_len(a->certblob)) != 0) 654 return 0; 655 return 1; 656 } 657 658 /* 659 * Compare public portions of key only, allowing comparisons between 660 * certificates and plain keys too. 661 */ 662 int 663 sshkey_equal_public(const struct sshkey *a, const struct sshkey *b) 664 { 665 #ifdef WITH_OPENSSL 666 BN_CTX *bnctx; 667 #endif /* WITH_OPENSSL */ 668 669 if (a == NULL || b == NULL || 670 sshkey_type_plain(a->type) != sshkey_type_plain(b->type)) 671 return 0; 672 673 switch (a->type) { 674 #ifdef WITH_OPENSSL 675 case KEY_RSA1: 676 case KEY_RSA_CERT_V00: 677 case KEY_RSA_CERT: 678 case KEY_RSA: 679 return a->rsa != NULL && b->rsa != NULL && 680 BN_cmp(a->rsa->e, b->rsa->e) == 0 && 681 BN_cmp(a->rsa->n, b->rsa->n) == 0; 682 case KEY_DSA_CERT_V00: 683 case KEY_DSA_CERT: 684 case KEY_DSA: 685 return a->dsa != NULL && b->dsa != NULL && 686 BN_cmp(a->dsa->p, b->dsa->p) == 0 && 687 BN_cmp(a->dsa->q, b->dsa->q) == 0 && 688 BN_cmp(a->dsa->g, b->dsa->g) == 0 && 689 BN_cmp(a->dsa->pub_key, b->dsa->pub_key) == 0; 690 case KEY_ECDSA_CERT: 691 case KEY_ECDSA: 692 if (a->ecdsa == NULL || b->ecdsa == NULL || 693 EC_KEY_get0_public_key(a->ecdsa) == NULL || 694 EC_KEY_get0_public_key(b->ecdsa) == NULL) 695 return 0; 696 if ((bnctx = BN_CTX_new()) == NULL) 697 return 0; 698 if (EC_GROUP_cmp(EC_KEY_get0_group(a->ecdsa), 699 EC_KEY_get0_group(b->ecdsa), bnctx) != 0 || 700 EC_POINT_cmp(EC_KEY_get0_group(a->ecdsa), 701 EC_KEY_get0_public_key(a->ecdsa), 702 EC_KEY_get0_public_key(b->ecdsa), bnctx) != 0) { 703 BN_CTX_free(bnctx); 704 return 0; 705 } 706 BN_CTX_free(bnctx); 707 return 1; 708 #endif /* WITH_OPENSSL */ 709 case KEY_ED25519: 710 case KEY_ED25519_CERT: 711 return a->ed25519_pk != NULL && b->ed25519_pk != NULL && 712 memcmp(a->ed25519_pk, b->ed25519_pk, ED25519_PK_SZ) == 0; 713 default: 714 return 0; 715 } 716 /* NOTREACHED */ 717 } 718 719 int 720 sshkey_equal(const struct sshkey *a, const struct sshkey *b) 721 { 722 if (a == NULL || b == NULL || a->type != b->type) 723 return 0; 724 if (sshkey_is_cert(a)) { 725 if (!cert_compare(a->cert, b->cert)) 726 return 0; 727 } 728 return sshkey_equal_public(a, b); 729 } 730 731 static int 732 to_blob_buf(const struct sshkey *key, struct sshbuf *b, int force_plain) 733 { 734 int type, ret = SSH_ERR_INTERNAL_ERROR; 735 const char *typename; 736 737 if (key == NULL) 738 return SSH_ERR_INVALID_ARGUMENT; 739 740 type = force_plain ? sshkey_type_plain(key->type) : key->type; 741 typename = sshkey_ssh_name_from_type_nid(type, key->ecdsa_nid); 742 743 switch (type) { 744 #ifdef WITH_OPENSSL 745 case KEY_DSA_CERT_V00: 746 case KEY_RSA_CERT_V00: 747 case KEY_DSA_CERT: 748 case KEY_ECDSA_CERT: 749 case KEY_RSA_CERT: 750 #endif /* WITH_OPENSSL */ 751 case KEY_ED25519_CERT: 752 /* Use the existing blob */ 753 /* XXX modified flag? */ 754 if ((ret = sshbuf_putb(b, key->cert->certblob)) != 0) 755 return ret; 756 break; 757 #ifdef WITH_OPENSSL 758 case KEY_DSA: 759 if (key->dsa == NULL) 760 return SSH_ERR_INVALID_ARGUMENT; 761 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 762 (ret = sshbuf_put_bignum2(b, key->dsa->p)) != 0 || 763 (ret = sshbuf_put_bignum2(b, key->dsa->q)) != 0 || 764 (ret = sshbuf_put_bignum2(b, key->dsa->g)) != 0 || 765 (ret = sshbuf_put_bignum2(b, key->dsa->pub_key)) != 0) 766 return ret; 767 break; 768 case KEY_ECDSA: 769 if (key->ecdsa == NULL) 770 return SSH_ERR_INVALID_ARGUMENT; 771 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 772 (ret = sshbuf_put_cstring(b, 773 sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || 774 (ret = sshbuf_put_eckey(b, key->ecdsa)) != 0) 775 return ret; 776 break; 777 case KEY_RSA: 778 if (key->rsa == NULL) 779 return SSH_ERR_INVALID_ARGUMENT; 780 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 781 (ret = sshbuf_put_bignum2(b, key->rsa->e)) != 0 || 782 (ret = sshbuf_put_bignum2(b, key->rsa->n)) != 0) 783 return ret; 784 break; 785 #endif /* WITH_OPENSSL */ 786 case KEY_ED25519: 787 if (key->ed25519_pk == NULL) 788 return SSH_ERR_INVALID_ARGUMENT; 789 if ((ret = sshbuf_put_cstring(b, typename)) != 0 || 790 (ret = sshbuf_put_string(b, 791 key->ed25519_pk, ED25519_PK_SZ)) != 0) 792 return ret; 793 break; 794 default: 795 return SSH_ERR_KEY_TYPE_UNKNOWN; 796 } 797 return 0; 798 } 799 800 int 801 sshkey_putb(const struct sshkey *key, struct sshbuf *b) 802 { 803 return to_blob_buf(key, b, 0); 804 } 805 806 int 807 sshkey_puts(const struct sshkey *key, struct sshbuf *b) 808 { 809 struct sshbuf *tmp; 810 int r; 811 812 if ((tmp = sshbuf_new()) == NULL) 813 return SSH_ERR_ALLOC_FAIL; 814 r = to_blob_buf(key, tmp, 0); 815 if (r == 0) 816 r = sshbuf_put_stringb(b, tmp); 817 sshbuf_free(tmp); 818 return r; 819 } 820 821 int 822 sshkey_putb_plain(const struct sshkey *key, struct sshbuf *b) 823 { 824 return to_blob_buf(key, b, 1); 825 } 826 827 static int 828 to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp, int force_plain) 829 { 830 int ret = SSH_ERR_INTERNAL_ERROR; 831 size_t len; 832 struct sshbuf *b = NULL; 833 834 if (lenp != NULL) 835 *lenp = 0; 836 if (blobp != NULL) 837 *blobp = NULL; 838 if ((b = sshbuf_new()) == NULL) 839 return SSH_ERR_ALLOC_FAIL; 840 if ((ret = to_blob_buf(key, b, force_plain)) != 0) 841 goto out; 842 len = sshbuf_len(b); 843 if (lenp != NULL) 844 *lenp = len; 845 if (blobp != NULL) { 846 if ((*blobp = malloc(len)) == NULL) { 847 ret = SSH_ERR_ALLOC_FAIL; 848 goto out; 849 } 850 memcpy(*blobp, sshbuf_ptr(b), len); 851 } 852 ret = 0; 853 out: 854 sshbuf_free(b); 855 return ret; 856 } 857 858 int 859 sshkey_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp) 860 { 861 return to_blob(key, blobp, lenp, 0); 862 } 863 864 int 865 sshkey_plain_to_blob(const struct sshkey *key, u_char **blobp, size_t *lenp) 866 { 867 return to_blob(key, blobp, lenp, 1); 868 } 869 870 int 871 sshkey_fingerprint_raw(const struct sshkey *k, int dgst_alg, 872 u_char **retp, size_t *lenp) 873 { 874 u_char *blob = NULL, *ret = NULL; 875 size_t blob_len = 0; 876 int r = SSH_ERR_INTERNAL_ERROR; 877 878 if (retp != NULL) 879 *retp = NULL; 880 if (lenp != NULL) 881 *lenp = 0; 882 if (ssh_digest_bytes(dgst_alg) == 0) { 883 r = SSH_ERR_INVALID_ARGUMENT; 884 goto out; 885 } 886 887 if (k->type == KEY_RSA1) { 888 #ifdef WITH_OPENSSL 889 int nlen = BN_num_bytes(k->rsa->n); 890 int elen = BN_num_bytes(k->rsa->e); 891 892 blob_len = nlen + elen; 893 if (nlen >= INT_MAX - elen || 894 (blob = malloc(blob_len)) == NULL) { 895 r = SSH_ERR_ALLOC_FAIL; 896 goto out; 897 } 898 BN_bn2bin(k->rsa->n, blob); 899 BN_bn2bin(k->rsa->e, blob + nlen); 900 #endif /* WITH_OPENSSL */ 901 } else if ((r = to_blob(k, &blob, &blob_len, 1)) != 0) 902 goto out; 903 if ((ret = calloc(1, SSH_DIGEST_MAX_LENGTH)) == NULL) { 904 r = SSH_ERR_ALLOC_FAIL; 905 goto out; 906 } 907 if ((r = ssh_digest_memory(dgst_alg, blob, blob_len, 908 ret, SSH_DIGEST_MAX_LENGTH)) != 0) 909 goto out; 910 /* success */ 911 if (retp != NULL) { 912 *retp = ret; 913 ret = NULL; 914 } 915 if (lenp != NULL) 916 *lenp = ssh_digest_bytes(dgst_alg); 917 r = 0; 918 out: 919 free(ret); 920 if (blob != NULL) { 921 explicit_bzero(blob, blob_len); 922 free(blob); 923 } 924 return r; 925 } 926 927 static char * 928 fingerprint_b64(const char *alg, u_char *dgst_raw, size_t dgst_raw_len) 929 { 930 char *ret; 931 size_t plen = strlen(alg) + 1; 932 size_t rlen = ((dgst_raw_len + 2) / 3) * 4 + plen + 1; 933 int r; 934 935 if (dgst_raw_len > 65536 || (ret = calloc(1, rlen)) == NULL) 936 return NULL; 937 strlcpy(ret, alg, rlen); 938 strlcat(ret, ":", rlen); 939 if (dgst_raw_len == 0) 940 return ret; 941 if ((r = b64_ntop(dgst_raw, dgst_raw_len, 942 ret + plen, rlen - plen)) == -1) { 943 explicit_bzero(ret, rlen); 944 free(ret); 945 return NULL; 946 } 947 /* Trim padding characters from end */ 948 ret[strcspn(ret, "=")] = '\0'; 949 return ret; 950 } 951 952 static char * 953 fingerprint_hex(const char *alg, u_char *dgst_raw, size_t dgst_raw_len) 954 { 955 char *retval, hex[5]; 956 size_t i, rlen = dgst_raw_len * 3 + strlen(alg) + 2; 957 958 if (dgst_raw_len > 65536 || (retval = calloc(1, rlen)) == NULL) 959 return NULL; 960 strlcpy(retval, alg, rlen); 961 strlcat(retval, ":", rlen); 962 for (i = 0; i < dgst_raw_len; i++) { 963 snprintf(hex, sizeof(hex), "%s%02x", 964 i > 0 ? ":" : "", dgst_raw[i]); 965 strlcat(retval, hex, rlen); 966 } 967 return retval; 968 } 969 970 static char * 971 fingerprint_bubblebabble(u_char *dgst_raw, size_t dgst_raw_len) 972 { 973 char vowels[] = { 'a', 'e', 'i', 'o', 'u', 'y' }; 974 char consonants[] = { 'b', 'c', 'd', 'f', 'g', 'h', 'k', 'l', 'm', 975 'n', 'p', 'r', 's', 't', 'v', 'z', 'x' }; 976 u_int i, j = 0, rounds, seed = 1; 977 char *retval; 978 979 rounds = (dgst_raw_len / 2) + 1; 980 if ((retval = calloc(rounds, 6)) == NULL) 981 return NULL; 982 retval[j++] = 'x'; 983 for (i = 0; i < rounds; i++) { 984 u_int idx0, idx1, idx2, idx3, idx4; 985 if ((i + 1 < rounds) || (dgst_raw_len % 2 != 0)) { 986 idx0 = (((((u_int)(dgst_raw[2 * i])) >> 6) & 3) + 987 seed) % 6; 988 idx1 = (((u_int)(dgst_raw[2 * i])) >> 2) & 15; 989 idx2 = ((((u_int)(dgst_raw[2 * i])) & 3) + 990 (seed / 6)) % 6; 991 retval[j++] = vowels[idx0]; 992 retval[j++] = consonants[idx1]; 993 retval[j++] = vowels[idx2]; 994 if ((i + 1) < rounds) { 995 idx3 = (((u_int)(dgst_raw[(2 * i) + 1])) >> 4) & 15; 996 idx4 = (((u_int)(dgst_raw[(2 * i) + 1]))) & 15; 997 retval[j++] = consonants[idx3]; 998 retval[j++] = '-'; 999 retval[j++] = consonants[idx4]; 1000 seed = ((seed * 5) + 1001 ((((u_int)(dgst_raw[2 * i])) * 7) + 1002 ((u_int)(dgst_raw[(2 * i) + 1])))) % 36; 1003 } 1004 } else { 1005 idx0 = seed % 6; 1006 idx1 = 16; 1007 idx2 = seed / 6; 1008 retval[j++] = vowels[idx0]; 1009 retval[j++] = consonants[idx1]; 1010 retval[j++] = vowels[idx2]; 1011 } 1012 } 1013 retval[j++] = 'x'; 1014 retval[j++] = '\0'; 1015 return retval; 1016 } 1017 1018 /* 1019 * Draw an ASCII-Art representing the fingerprint so human brain can 1020 * profit from its built-in pattern recognition ability. 1021 * This technique is called "random art" and can be found in some 1022 * scientific publications like this original paper: 1023 * 1024 * "Hash Visualization: a New Technique to improve Real-World Security", 1025 * Perrig A. and Song D., 1999, International Workshop on Cryptographic 1026 * Techniques and E-Commerce (CrypTEC '99) 1027 * sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf 1028 * 1029 * The subject came up in a talk by Dan Kaminsky, too. 1030 * 1031 * If you see the picture is different, the key is different. 1032 * If the picture looks the same, you still know nothing. 1033 * 1034 * The algorithm used here is a worm crawling over a discrete plane, 1035 * leaving a trace (augmenting the field) everywhere it goes. 1036 * Movement is taken from dgst_raw 2bit-wise. Bumping into walls 1037 * makes the respective movement vector be ignored for this turn. 1038 * Graphs are not unambiguous, because circles in graphs can be 1039 * walked in either direction. 1040 */ 1041 1042 /* 1043 * Field sizes for the random art. Have to be odd, so the starting point 1044 * can be in the exact middle of the picture, and FLDBASE should be >=8 . 1045 * Else pictures would be too dense, and drawing the frame would 1046 * fail, too, because the key type would not fit in anymore. 1047 */ 1048 #define FLDBASE 8 1049 #define FLDSIZE_Y (FLDBASE + 1) 1050 #define FLDSIZE_X (FLDBASE * 2 + 1) 1051 static char * 1052 fingerprint_randomart(const char *alg, u_char *dgst_raw, size_t dgst_raw_len, 1053 const struct sshkey *k) 1054 { 1055 /* 1056 * Chars to be used after each other every time the worm 1057 * intersects with itself. Matter of taste. 1058 */ 1059 char *augmentation_string = " .o+=*BOX@%&#/^SE"; 1060 char *retval, *p, title[FLDSIZE_X], hash[FLDSIZE_X]; 1061 u_char field[FLDSIZE_X][FLDSIZE_Y]; 1062 size_t i, tlen, hlen; 1063 u_int b; 1064 int x, y, r; 1065 size_t len = strlen(augmentation_string) - 1; 1066 1067 if ((retval = calloc((FLDSIZE_X + 3), (FLDSIZE_Y + 2))) == NULL) 1068 return NULL; 1069 1070 /* initialize field */ 1071 memset(field, 0, FLDSIZE_X * FLDSIZE_Y * sizeof(char)); 1072 x = FLDSIZE_X / 2; 1073 y = FLDSIZE_Y / 2; 1074 1075 /* process raw key */ 1076 for (i = 0; i < dgst_raw_len; i++) { 1077 int input; 1078 /* each byte conveys four 2-bit move commands */ 1079 input = dgst_raw[i]; 1080 for (b = 0; b < 4; b++) { 1081 /* evaluate 2 bit, rest is shifted later */ 1082 x += (input & 0x1) ? 1 : -1; 1083 y += (input & 0x2) ? 1 : -1; 1084 1085 /* assure we are still in bounds */ 1086 x = MAX(x, 0); 1087 y = MAX(y, 0); 1088 x = MIN(x, FLDSIZE_X - 1); 1089 y = MIN(y, FLDSIZE_Y - 1); 1090 1091 /* augment the field */ 1092 if (field[x][y] < len - 2) 1093 field[x][y]++; 1094 input = input >> 2; 1095 } 1096 } 1097 1098 /* mark starting point and end point*/ 1099 field[FLDSIZE_X / 2][FLDSIZE_Y / 2] = len - 1; 1100 field[x][y] = len; 1101 1102 /* assemble title */ 1103 r = snprintf(title, sizeof(title), "[%s %u]", 1104 sshkey_type(k), sshkey_size(k)); 1105 /* If [type size] won't fit, then try [type]; fits "[ED25519-CERT]" */ 1106 if (r < 0 || r > (int)sizeof(title)) 1107 r = snprintf(title, sizeof(title), "[%s]", sshkey_type(k)); 1108 tlen = (r <= 0) ? 0 : strlen(title); 1109 1110 /* assemble hash ID. */ 1111 r = snprintf(hash, sizeof(hash), "[%s]", alg); 1112 hlen = (r <= 0) ? 0 : strlen(hash); 1113 1114 /* output upper border */ 1115 p = retval; 1116 *p++ = '+'; 1117 for (i = 0; i < (FLDSIZE_X - tlen) / 2; i++) 1118 *p++ = '-'; 1119 memcpy(p, title, tlen); 1120 p += tlen; 1121 for (i += tlen; i < FLDSIZE_X; i++) 1122 *p++ = '-'; 1123 *p++ = '+'; 1124 *p++ = '\n'; 1125 1126 /* output content */ 1127 for (y = 0; y < FLDSIZE_Y; y++) { 1128 *p++ = '|'; 1129 for (x = 0; x < FLDSIZE_X; x++) 1130 *p++ = augmentation_string[MIN(field[x][y], len)]; 1131 *p++ = '|'; 1132 *p++ = '\n'; 1133 } 1134 1135 /* output lower border */ 1136 *p++ = '+'; 1137 for (i = 0; i < (FLDSIZE_X - hlen) / 2; i++) 1138 *p++ = '-'; 1139 memcpy(p, hash, hlen); 1140 p += hlen; 1141 for (i += hlen; i < FLDSIZE_X; i++) 1142 *p++ = '-'; 1143 *p++ = '+'; 1144 1145 return retval; 1146 } 1147 1148 char * 1149 sshkey_fingerprint(const struct sshkey *k, int dgst_alg, 1150 enum sshkey_fp_rep dgst_rep) 1151 { 1152 char *retval = NULL; 1153 u_char *dgst_raw; 1154 size_t dgst_raw_len; 1155 1156 if (sshkey_fingerprint_raw(k, dgst_alg, &dgst_raw, &dgst_raw_len) != 0) 1157 return NULL; 1158 switch (dgst_rep) { 1159 case SSH_FP_DEFAULT: 1160 if (dgst_alg == SSH_DIGEST_MD5) { 1161 retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg), 1162 dgst_raw, dgst_raw_len); 1163 } else { 1164 retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg), 1165 dgst_raw, dgst_raw_len); 1166 } 1167 break; 1168 case SSH_FP_HEX: 1169 retval = fingerprint_hex(ssh_digest_alg_name(dgst_alg), 1170 dgst_raw, dgst_raw_len); 1171 break; 1172 case SSH_FP_BASE64: 1173 retval = fingerprint_b64(ssh_digest_alg_name(dgst_alg), 1174 dgst_raw, dgst_raw_len); 1175 break; 1176 case SSH_FP_BUBBLEBABBLE: 1177 retval = fingerprint_bubblebabble(dgst_raw, dgst_raw_len); 1178 break; 1179 case SSH_FP_RANDOMART: 1180 retval = fingerprint_randomart(ssh_digest_alg_name(dgst_alg), 1181 dgst_raw, dgst_raw_len, k); 1182 break; 1183 default: 1184 explicit_bzero(dgst_raw, dgst_raw_len); 1185 free(dgst_raw); 1186 return NULL; 1187 } 1188 explicit_bzero(dgst_raw, dgst_raw_len); 1189 free(dgst_raw); 1190 return retval; 1191 } 1192 1193 #ifdef WITH_SSH1 1194 /* 1195 * Reads a multiple-precision integer in decimal from the buffer, and advances 1196 * the pointer. The integer must already be initialized. This function is 1197 * permitted to modify the buffer. This leaves *cpp to point just beyond the 1198 * last processed character. 1199 */ 1200 static int 1201 read_decimal_bignum(char **cpp, BIGNUM *v) 1202 { 1203 char *cp; 1204 size_t e; 1205 int skip = 1; /* skip white space */ 1206 1207 cp = *cpp; 1208 while (*cp == ' ' || *cp == '\t') 1209 cp++; 1210 e = strspn(cp, "0123456789"); 1211 if (e == 0) 1212 return SSH_ERR_INVALID_FORMAT; 1213 if (e > SSHBUF_MAX_BIGNUM * 3) 1214 return SSH_ERR_BIGNUM_TOO_LARGE; 1215 if (cp[e] == '\0') 1216 skip = 0; 1217 else if (index(" \t\r\n", cp[e]) == NULL) 1218 return SSH_ERR_INVALID_FORMAT; 1219 cp[e] = '\0'; 1220 if (BN_dec2bn(&v, cp) <= 0) 1221 return SSH_ERR_INVALID_FORMAT; 1222 *cpp = cp + e + skip; 1223 return 0; 1224 } 1225 #endif /* WITH_SSH1 */ 1226 1227 /* returns 0 ok, and < 0 error */ 1228 int 1229 sshkey_read(struct sshkey *ret, char **cpp) 1230 { 1231 struct sshkey *k; 1232 int retval = SSH_ERR_INVALID_FORMAT; 1233 char *cp, *space; 1234 int r, type, curve_nid = -1; 1235 struct sshbuf *blob; 1236 #ifdef WITH_SSH1 1237 char *ep; 1238 u_long bits; 1239 #endif /* WITH_SSH1 */ 1240 1241 cp = *cpp; 1242 1243 switch (ret->type) { 1244 case KEY_RSA1: 1245 #ifdef WITH_SSH1 1246 /* Get number of bits. */ 1247 bits = strtoul(cp, &ep, 10); 1248 if (*cp == '\0' || index(" \t\r\n", *ep) == NULL || 1249 bits == 0 || bits > SSHBUF_MAX_BIGNUM * 8) 1250 return SSH_ERR_INVALID_FORMAT; /* Bad bit count... */ 1251 /* Get public exponent, public modulus. */ 1252 if ((r = read_decimal_bignum(&ep, ret->rsa->e)) < 0) 1253 return r; 1254 if ((r = read_decimal_bignum(&ep, ret->rsa->n)) < 0) 1255 return r; 1256 *cpp = ep; 1257 /* validate the claimed number of bits */ 1258 if (BN_num_bits(ret->rsa->n) != (int)bits) 1259 return SSH_ERR_KEY_BITS_MISMATCH; 1260 retval = 0; 1261 #endif /* WITH_SSH1 */ 1262 break; 1263 case KEY_UNSPEC: 1264 case KEY_RSA: 1265 case KEY_DSA: 1266 case KEY_ECDSA: 1267 case KEY_ED25519: 1268 case KEY_DSA_CERT_V00: 1269 case KEY_RSA_CERT_V00: 1270 case KEY_DSA_CERT: 1271 case KEY_ECDSA_CERT: 1272 case KEY_RSA_CERT: 1273 case KEY_ED25519_CERT: 1274 space = strchr(cp, ' '); 1275 if (space == NULL) 1276 return SSH_ERR_INVALID_FORMAT; 1277 *space = '\0'; 1278 type = sshkey_type_from_name(cp); 1279 if (sshkey_type_plain(type) == KEY_ECDSA && 1280 (curve_nid = sshkey_ecdsa_nid_from_name(cp)) == -1) 1281 return SSH_ERR_EC_CURVE_INVALID; 1282 *space = ' '; 1283 if (type == KEY_UNSPEC) 1284 return SSH_ERR_INVALID_FORMAT; 1285 cp = space+1; 1286 if (*cp == '\0') 1287 return SSH_ERR_INVALID_FORMAT; 1288 if (ret->type != KEY_UNSPEC && ret->type != type) 1289 return SSH_ERR_KEY_TYPE_MISMATCH; 1290 if ((blob = sshbuf_new()) == NULL) 1291 return SSH_ERR_ALLOC_FAIL; 1292 /* trim comment */ 1293 space = strchr(cp, ' '); 1294 if (space) { 1295 /* advance 'space': skip whitespace */ 1296 *space++ = '\0'; 1297 while (*space == ' ' || *space == '\t') 1298 space++; 1299 *cpp = space; 1300 } else 1301 *cpp = cp + strlen(cp); 1302 if ((r = sshbuf_b64tod(blob, cp)) != 0) { 1303 sshbuf_free(blob); 1304 return r; 1305 } 1306 if ((r = sshkey_from_blob(sshbuf_ptr(blob), 1307 sshbuf_len(blob), &k)) != 0) { 1308 sshbuf_free(blob); 1309 return r; 1310 } 1311 sshbuf_free(blob); 1312 if (k->type != type) { 1313 sshkey_free(k); 1314 return SSH_ERR_KEY_TYPE_MISMATCH; 1315 } 1316 if (sshkey_type_plain(type) == KEY_ECDSA && 1317 curve_nid != k->ecdsa_nid) { 1318 sshkey_free(k); 1319 return SSH_ERR_EC_CURVE_MISMATCH; 1320 } 1321 ret->type = type; 1322 if (sshkey_is_cert(ret)) { 1323 if (!sshkey_is_cert(k)) { 1324 sshkey_free(k); 1325 return SSH_ERR_EXPECTED_CERT; 1326 } 1327 if (ret->cert != NULL) 1328 cert_free(ret->cert); 1329 ret->cert = k->cert; 1330 k->cert = NULL; 1331 } 1332 #ifdef WITH_OPENSSL 1333 if (sshkey_type_plain(ret->type) == KEY_RSA) { 1334 if (ret->rsa != NULL) 1335 RSA_free(ret->rsa); 1336 ret->rsa = k->rsa; 1337 k->rsa = NULL; 1338 #ifdef DEBUG_PK 1339 RSA_print_fp(stderr, ret->rsa, 8); 1340 #endif 1341 } 1342 if (sshkey_type_plain(ret->type) == KEY_DSA) { 1343 if (ret->dsa != NULL) 1344 DSA_free(ret->dsa); 1345 ret->dsa = k->dsa; 1346 k->dsa = NULL; 1347 #ifdef DEBUG_PK 1348 DSA_print_fp(stderr, ret->dsa, 8); 1349 #endif 1350 } 1351 if (sshkey_type_plain(ret->type) == KEY_ECDSA) { 1352 if (ret->ecdsa != NULL) 1353 EC_KEY_free(ret->ecdsa); 1354 ret->ecdsa = k->ecdsa; 1355 ret->ecdsa_nid = k->ecdsa_nid; 1356 k->ecdsa = NULL; 1357 k->ecdsa_nid = -1; 1358 #ifdef DEBUG_PK 1359 sshkey_dump_ec_key(ret->ecdsa); 1360 #endif 1361 } 1362 #endif /* WITH_OPENSSL */ 1363 if (sshkey_type_plain(ret->type) == KEY_ED25519) { 1364 free(ret->ed25519_pk); 1365 ret->ed25519_pk = k->ed25519_pk; 1366 k->ed25519_pk = NULL; 1367 #ifdef DEBUG_PK 1368 /* XXX */ 1369 #endif 1370 } 1371 retval = 0; 1372 /*XXXX*/ 1373 sshkey_free(k); 1374 if (retval != 0) 1375 break; 1376 break; 1377 default: 1378 return SSH_ERR_INVALID_ARGUMENT; 1379 } 1380 return retval; 1381 } 1382 1383 int 1384 sshkey_write(const struct sshkey *key, FILE *f) 1385 { 1386 int ret = SSH_ERR_INTERNAL_ERROR; 1387 struct sshbuf *b = NULL, *bb = NULL; 1388 char *uu = NULL; 1389 #ifdef WITH_SSH1 1390 u_int bits = 0; 1391 char *dec_e = NULL, *dec_n = NULL; 1392 #endif /* WITH_SSH1 */ 1393 1394 if (sshkey_is_cert(key)) { 1395 if (key->cert == NULL) 1396 return SSH_ERR_EXPECTED_CERT; 1397 if (sshbuf_len(key->cert->certblob) == 0) 1398 return SSH_ERR_KEY_LACKS_CERTBLOB; 1399 } 1400 if ((b = sshbuf_new()) == NULL) 1401 return SSH_ERR_ALLOC_FAIL; 1402 switch (key->type) { 1403 #ifdef WITH_SSH1 1404 case KEY_RSA1: 1405 if (key->rsa == NULL || key->rsa->e == NULL || 1406 key->rsa->n == NULL) { 1407 ret = SSH_ERR_INVALID_ARGUMENT; 1408 goto out; 1409 } 1410 if ((dec_e = BN_bn2dec(key->rsa->e)) == NULL || 1411 (dec_n = BN_bn2dec(key->rsa->n)) == NULL) { 1412 ret = SSH_ERR_ALLOC_FAIL; 1413 goto out; 1414 } 1415 /* size of modulus 'n' */ 1416 if ((bits = BN_num_bits(key->rsa->n)) <= 0) { 1417 ret = SSH_ERR_INVALID_ARGUMENT; 1418 goto out; 1419 } 1420 if ((ret = sshbuf_putf(b, "%u %s %s", bits, dec_e, dec_n)) != 0) 1421 goto out; 1422 #endif /* WITH_SSH1 */ 1423 break; 1424 #ifdef WITH_OPENSSL 1425 case KEY_DSA: 1426 case KEY_DSA_CERT_V00: 1427 case KEY_DSA_CERT: 1428 case KEY_ECDSA: 1429 case KEY_ECDSA_CERT: 1430 case KEY_RSA: 1431 case KEY_RSA_CERT_V00: 1432 case KEY_RSA_CERT: 1433 #endif /* WITH_OPENSSL */ 1434 case KEY_ED25519: 1435 case KEY_ED25519_CERT: 1436 if ((bb = sshbuf_new()) == NULL) { 1437 ret = SSH_ERR_ALLOC_FAIL; 1438 goto out; 1439 } 1440 if ((ret = sshkey_putb(key, bb)) != 0) 1441 goto out; 1442 if ((uu = sshbuf_dtob64(bb)) == NULL) { 1443 ret = SSH_ERR_ALLOC_FAIL; 1444 goto out; 1445 } 1446 if ((ret = sshbuf_putf(b, "%s ", sshkey_ssh_name(key))) != 0) 1447 goto out; 1448 if ((ret = sshbuf_put(b, uu, strlen(uu))) != 0) 1449 goto out; 1450 break; 1451 default: 1452 ret = SSH_ERR_KEY_TYPE_UNKNOWN; 1453 goto out; 1454 } 1455 if (fwrite(sshbuf_ptr(b), sshbuf_len(b), 1, f) != 1) { 1456 if (feof(f)) 1457 errno = EPIPE; 1458 ret = SSH_ERR_SYSTEM_ERROR; 1459 goto out; 1460 } 1461 ret = 0; 1462 out: 1463 if (b != NULL) 1464 sshbuf_free(b); 1465 if (bb != NULL) 1466 sshbuf_free(bb); 1467 if (uu != NULL) 1468 free(uu); 1469 #ifdef WITH_SSH1 1470 if (dec_e != NULL) 1471 OPENSSL_free(dec_e); 1472 if (dec_n != NULL) 1473 OPENSSL_free(dec_n); 1474 #endif /* WITH_SSH1 */ 1475 return ret; 1476 } 1477 1478 const char * 1479 sshkey_cert_type(const struct sshkey *k) 1480 { 1481 switch (k->cert->type) { 1482 case SSH2_CERT_TYPE_USER: 1483 return "user"; 1484 case SSH2_CERT_TYPE_HOST: 1485 return "host"; 1486 default: 1487 return "unknown"; 1488 } 1489 } 1490 1491 #ifdef WITH_OPENSSL 1492 static int 1493 rsa_generate_private_key(u_int bits, RSA **rsap) 1494 { 1495 RSA *private = NULL; 1496 BIGNUM *f4 = NULL; 1497 int ret = SSH_ERR_INTERNAL_ERROR; 1498 1499 if (rsap == NULL || 1500 bits < SSH_RSA_MINIMUM_MODULUS_SIZE || 1501 bits > SSHBUF_MAX_BIGNUM * 8) 1502 return SSH_ERR_INVALID_ARGUMENT; 1503 *rsap = NULL; 1504 if ((private = RSA_new()) == NULL || (f4 = BN_new()) == NULL) { 1505 ret = SSH_ERR_ALLOC_FAIL; 1506 goto out; 1507 } 1508 if (!BN_set_word(f4, RSA_F4) || 1509 !RSA_generate_key_ex(private, bits, f4, NULL)) { 1510 ret = SSH_ERR_LIBCRYPTO_ERROR; 1511 goto out; 1512 } 1513 *rsap = private; 1514 private = NULL; 1515 ret = 0; 1516 out: 1517 if (private != NULL) 1518 RSA_free(private); 1519 if (f4 != NULL) 1520 BN_free(f4); 1521 return ret; 1522 } 1523 1524 static int 1525 dsa_generate_private_key(u_int bits, DSA **dsap) 1526 { 1527 DSA *private; 1528 int ret = SSH_ERR_INTERNAL_ERROR; 1529 1530 if (dsap == NULL || bits != 1024) 1531 return SSH_ERR_INVALID_ARGUMENT; 1532 if ((private = DSA_new()) == NULL) { 1533 ret = SSH_ERR_ALLOC_FAIL; 1534 goto out; 1535 } 1536 *dsap = NULL; 1537 if (!DSA_generate_parameters_ex(private, bits, NULL, 0, NULL, 1538 NULL, NULL) || !DSA_generate_key(private)) { 1539 DSA_free(private); 1540 ret = SSH_ERR_LIBCRYPTO_ERROR; 1541 goto out; 1542 } 1543 *dsap = private; 1544 private = NULL; 1545 ret = 0; 1546 out: 1547 if (private != NULL) 1548 DSA_free(private); 1549 return ret; 1550 } 1551 1552 int 1553 sshkey_ecdsa_key_to_nid(EC_KEY *k) 1554 { 1555 EC_GROUP *eg; 1556 int nids[] = { 1557 NID_X9_62_prime256v1, 1558 NID_secp384r1, 1559 NID_secp521r1, 1560 -1 1561 }; 1562 int nid; 1563 u_int i; 1564 BN_CTX *bnctx; 1565 const EC_GROUP *g = EC_KEY_get0_group(k); 1566 1567 /* 1568 * The group may be stored in a ASN.1 encoded private key in one of two 1569 * ways: as a "named group", which is reconstituted by ASN.1 object ID 1570 * or explicit group parameters encoded into the key blob. Only the 1571 * "named group" case sets the group NID for us, but we can figure 1572 * it out for the other case by comparing against all the groups that 1573 * are supported. 1574 */ 1575 if ((nid = EC_GROUP_get_curve_name(g)) > 0) 1576 return nid; 1577 if ((bnctx = BN_CTX_new()) == NULL) 1578 return -1; 1579 for (i = 0; nids[i] != -1; i++) { 1580 if ((eg = EC_GROUP_new_by_curve_name(nids[i])) == NULL) { 1581 BN_CTX_free(bnctx); 1582 return -1; 1583 } 1584 if (EC_GROUP_cmp(g, eg, bnctx) == 0) 1585 break; 1586 EC_GROUP_free(eg); 1587 } 1588 BN_CTX_free(bnctx); 1589 if (nids[i] != -1) { 1590 /* Use the group with the NID attached */ 1591 EC_GROUP_set_asn1_flag(eg, OPENSSL_EC_NAMED_CURVE); 1592 if (EC_KEY_set_group(k, eg) != 1) { 1593 EC_GROUP_free(eg); 1594 return -1; 1595 } 1596 } 1597 return nids[i]; 1598 } 1599 1600 static int 1601 ecdsa_generate_private_key(u_int bits, int *nid, EC_KEY **ecdsap) 1602 { 1603 EC_KEY *private; 1604 int ret = SSH_ERR_INTERNAL_ERROR; 1605 1606 if (nid == NULL || ecdsap == NULL || 1607 (*nid = sshkey_ecdsa_bits_to_nid(bits)) == -1) 1608 return SSH_ERR_INVALID_ARGUMENT; 1609 *ecdsap = NULL; 1610 if ((private = EC_KEY_new_by_curve_name(*nid)) == NULL) { 1611 ret = SSH_ERR_ALLOC_FAIL; 1612 goto out; 1613 } 1614 if (EC_KEY_generate_key(private) != 1) { 1615 ret = SSH_ERR_LIBCRYPTO_ERROR; 1616 goto out; 1617 } 1618 EC_KEY_set_asn1_flag(private, OPENSSL_EC_NAMED_CURVE); 1619 *ecdsap = private; 1620 private = NULL; 1621 ret = 0; 1622 out: 1623 if (private != NULL) 1624 EC_KEY_free(private); 1625 return ret; 1626 } 1627 #endif /* WITH_OPENSSL */ 1628 1629 int 1630 sshkey_generate(int type, u_int bits, struct sshkey **keyp) 1631 { 1632 struct sshkey *k; 1633 int ret = SSH_ERR_INTERNAL_ERROR; 1634 1635 if (keyp == NULL) 1636 return SSH_ERR_INVALID_ARGUMENT; 1637 *keyp = NULL; 1638 if ((k = sshkey_new(KEY_UNSPEC)) == NULL) 1639 return SSH_ERR_ALLOC_FAIL; 1640 switch (type) { 1641 case KEY_ED25519: 1642 if ((k->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL || 1643 (k->ed25519_sk = malloc(ED25519_SK_SZ)) == NULL) { 1644 ret = SSH_ERR_ALLOC_FAIL; 1645 break; 1646 } 1647 crypto_sign_ed25519_keypair(k->ed25519_pk, k->ed25519_sk); 1648 ret = 0; 1649 break; 1650 #ifdef WITH_OPENSSL 1651 case KEY_DSA: 1652 ret = dsa_generate_private_key(bits, &k->dsa); 1653 break; 1654 case KEY_ECDSA: 1655 ret = ecdsa_generate_private_key(bits, &k->ecdsa_nid, 1656 &k->ecdsa); 1657 break; 1658 case KEY_RSA: 1659 case KEY_RSA1: 1660 ret = rsa_generate_private_key(bits, &k->rsa); 1661 break; 1662 #endif /* WITH_OPENSSL */ 1663 default: 1664 ret = SSH_ERR_INVALID_ARGUMENT; 1665 } 1666 if (ret == 0) { 1667 k->type = type; 1668 *keyp = k; 1669 } else 1670 sshkey_free(k); 1671 return ret; 1672 } 1673 1674 int 1675 sshkey_cert_copy(const struct sshkey *from_key, struct sshkey *to_key) 1676 { 1677 u_int i; 1678 const struct sshkey_cert *from; 1679 struct sshkey_cert *to; 1680 int ret = SSH_ERR_INTERNAL_ERROR; 1681 1682 if (to_key->cert != NULL) { 1683 cert_free(to_key->cert); 1684 to_key->cert = NULL; 1685 } 1686 1687 if ((from = from_key->cert) == NULL) 1688 return SSH_ERR_INVALID_ARGUMENT; 1689 1690 if ((to = to_key->cert = cert_new()) == NULL) 1691 return SSH_ERR_ALLOC_FAIL; 1692 1693 if ((ret = sshbuf_putb(to->certblob, from->certblob)) != 0 || 1694 (ret = sshbuf_putb(to->critical, from->critical)) != 0 || 1695 (ret = sshbuf_putb(to->extensions, from->extensions) != 0)) 1696 return ret; 1697 1698 to->serial = from->serial; 1699 to->type = from->type; 1700 if (from->key_id == NULL) 1701 to->key_id = NULL; 1702 else if ((to->key_id = strdup(from->key_id)) == NULL) 1703 return SSH_ERR_ALLOC_FAIL; 1704 to->valid_after = from->valid_after; 1705 to->valid_before = from->valid_before; 1706 if (from->signature_key == NULL) 1707 to->signature_key = NULL; 1708 else if ((ret = sshkey_from_private(from->signature_key, 1709 &to->signature_key)) != 0) 1710 return ret; 1711 1712 if (from->nprincipals > SSHKEY_CERT_MAX_PRINCIPALS) 1713 return SSH_ERR_INVALID_ARGUMENT; 1714 if (from->nprincipals > 0) { 1715 if ((to->principals = calloc(from->nprincipals, 1716 sizeof(*to->principals))) == NULL) 1717 return SSH_ERR_ALLOC_FAIL; 1718 for (i = 0; i < from->nprincipals; i++) { 1719 to->principals[i] = strdup(from->principals[i]); 1720 if (to->principals[i] == NULL) { 1721 to->nprincipals = i; 1722 return SSH_ERR_ALLOC_FAIL; 1723 } 1724 } 1725 } 1726 to->nprincipals = from->nprincipals; 1727 return 0; 1728 } 1729 1730 int 1731 sshkey_from_private(const struct sshkey *k, struct sshkey **pkp) 1732 { 1733 struct sshkey *n = NULL; 1734 int ret = SSH_ERR_INTERNAL_ERROR; 1735 1736 if (pkp != NULL) 1737 *pkp = NULL; 1738 1739 switch (k->type) { 1740 #ifdef WITH_OPENSSL 1741 case KEY_DSA: 1742 case KEY_DSA_CERT_V00: 1743 case KEY_DSA_CERT: 1744 if ((n = sshkey_new(k->type)) == NULL) 1745 return SSH_ERR_ALLOC_FAIL; 1746 if ((BN_copy(n->dsa->p, k->dsa->p) == NULL) || 1747 (BN_copy(n->dsa->q, k->dsa->q) == NULL) || 1748 (BN_copy(n->dsa->g, k->dsa->g) == NULL) || 1749 (BN_copy(n->dsa->pub_key, k->dsa->pub_key) == NULL)) { 1750 sshkey_free(n); 1751 return SSH_ERR_ALLOC_FAIL; 1752 } 1753 break; 1754 case KEY_ECDSA: 1755 case KEY_ECDSA_CERT: 1756 if ((n = sshkey_new(k->type)) == NULL) 1757 return SSH_ERR_ALLOC_FAIL; 1758 n->ecdsa_nid = k->ecdsa_nid; 1759 n->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); 1760 if (n->ecdsa == NULL) { 1761 sshkey_free(n); 1762 return SSH_ERR_ALLOC_FAIL; 1763 } 1764 if (EC_KEY_set_public_key(n->ecdsa, 1765 EC_KEY_get0_public_key(k->ecdsa)) != 1) { 1766 sshkey_free(n); 1767 return SSH_ERR_LIBCRYPTO_ERROR; 1768 } 1769 break; 1770 case KEY_RSA: 1771 case KEY_RSA1: 1772 case KEY_RSA_CERT_V00: 1773 case KEY_RSA_CERT: 1774 if ((n = sshkey_new(k->type)) == NULL) 1775 return SSH_ERR_ALLOC_FAIL; 1776 if ((BN_copy(n->rsa->n, k->rsa->n) == NULL) || 1777 (BN_copy(n->rsa->e, k->rsa->e) == NULL)) { 1778 sshkey_free(n); 1779 return SSH_ERR_ALLOC_FAIL; 1780 } 1781 break; 1782 #endif /* WITH_OPENSSL */ 1783 case KEY_ED25519: 1784 case KEY_ED25519_CERT: 1785 if ((n = sshkey_new(k->type)) == NULL) 1786 return SSH_ERR_ALLOC_FAIL; 1787 if (k->ed25519_pk != NULL) { 1788 if ((n->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL) { 1789 sshkey_free(n); 1790 return SSH_ERR_ALLOC_FAIL; 1791 } 1792 memcpy(n->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ); 1793 } 1794 break; 1795 default: 1796 return SSH_ERR_KEY_TYPE_UNKNOWN; 1797 } 1798 if (sshkey_is_cert(k)) { 1799 if ((ret = sshkey_cert_copy(k, n)) != 0) { 1800 sshkey_free(n); 1801 return ret; 1802 } 1803 } 1804 *pkp = n; 1805 return 0; 1806 } 1807 1808 static int 1809 cert_parse(struct sshbuf *b, struct sshkey *key, struct sshbuf *certbuf) 1810 { 1811 struct sshbuf *principals = NULL, *crit = NULL; 1812 struct sshbuf *exts = NULL, *ca = NULL; 1813 u_char *sig = NULL; 1814 size_t signed_len = 0, slen = 0, kidlen = 0; 1815 int ret = SSH_ERR_INTERNAL_ERROR; 1816 int v00 = sshkey_cert_is_legacy(key); 1817 1818 /* Copy the entire key blob for verification and later serialisation */ 1819 if ((ret = sshbuf_putb(key->cert->certblob, certbuf)) != 0) 1820 return ret; 1821 1822 if ((!v00 && (ret = sshbuf_get_u64(b, &key->cert->serial)) != 0) || 1823 (ret = sshbuf_get_u32(b, &key->cert->type)) != 0 || 1824 (ret = sshbuf_get_cstring(b, &key->cert->key_id, &kidlen)) != 0 || 1825 (ret = sshbuf_froms(b, &principals)) != 0 || 1826 (ret = sshbuf_get_u64(b, &key->cert->valid_after)) != 0 || 1827 (ret = sshbuf_get_u64(b, &key->cert->valid_before)) != 0 || 1828 (ret = sshbuf_froms(b, &crit)) != 0 || 1829 (!v00 && (ret = sshbuf_froms(b, &exts)) != 0) || 1830 (v00 && (ret = sshbuf_get_string_direct(b, NULL, NULL)) != 0) || 1831 (ret = sshbuf_get_string_direct(b, NULL, NULL)) != 0 || 1832 (ret = sshbuf_froms(b, &ca)) != 0) { 1833 /* XXX debug print error for ret */ 1834 ret = SSH_ERR_INVALID_FORMAT; 1835 goto out; 1836 } 1837 1838 /* Signature is left in the buffer so we can calculate this length */ 1839 signed_len = sshbuf_len(key->cert->certblob) - sshbuf_len(b); 1840 1841 if ((ret = sshbuf_get_string(b, &sig, &slen)) != 0) { 1842 ret = SSH_ERR_INVALID_FORMAT; 1843 goto out; 1844 } 1845 1846 if (key->cert->type != SSH2_CERT_TYPE_USER && 1847 key->cert->type != SSH2_CERT_TYPE_HOST) { 1848 ret = SSH_ERR_KEY_CERT_UNKNOWN_TYPE; 1849 goto out; 1850 } 1851 1852 /* Parse principals section */ 1853 while (sshbuf_len(principals) > 0) { 1854 char *principal = NULL; 1855 char **oprincipals = NULL; 1856 1857 if (key->cert->nprincipals >= SSHKEY_CERT_MAX_PRINCIPALS) { 1858 ret = SSH_ERR_INVALID_FORMAT; 1859 goto out; 1860 } 1861 if ((ret = sshbuf_get_cstring(principals, &principal, 1862 NULL)) != 0) { 1863 ret = SSH_ERR_INVALID_FORMAT; 1864 goto out; 1865 } 1866 oprincipals = key->cert->principals; 1867 key->cert->principals = realloc(key->cert->principals, 1868 (key->cert->nprincipals + 1) * 1869 sizeof(*key->cert->principals)); 1870 if (key->cert->principals == NULL) { 1871 free(principal); 1872 key->cert->principals = oprincipals; 1873 ret = SSH_ERR_ALLOC_FAIL; 1874 goto out; 1875 } 1876 key->cert->principals[key->cert->nprincipals++] = principal; 1877 } 1878 1879 /* 1880 * Stash a copies of the critical options and extensions sections 1881 * for later use. 1882 */ 1883 if ((ret = sshbuf_putb(key->cert->critical, crit)) != 0 || 1884 (exts != NULL && 1885 (ret = sshbuf_putb(key->cert->extensions, exts)) != 0)) 1886 goto out; 1887 1888 /* 1889 * Validate critical options and extensions sections format. 1890 * NB. extensions are not present in v00 certs. 1891 */ 1892 while (sshbuf_len(crit) != 0) { 1893 if ((ret = sshbuf_get_string_direct(crit, NULL, NULL)) != 0 || 1894 (ret = sshbuf_get_string_direct(crit, NULL, NULL)) != 0) { 1895 sshbuf_reset(key->cert->critical); 1896 ret = SSH_ERR_INVALID_FORMAT; 1897 goto out; 1898 } 1899 } 1900 while (exts != NULL && sshbuf_len(exts) != 0) { 1901 if ((ret = sshbuf_get_string_direct(exts, NULL, NULL)) != 0 || 1902 (ret = sshbuf_get_string_direct(exts, NULL, NULL)) != 0) { 1903 sshbuf_reset(key->cert->extensions); 1904 ret = SSH_ERR_INVALID_FORMAT; 1905 goto out; 1906 } 1907 } 1908 1909 /* Parse CA key and check signature */ 1910 if (sshkey_from_blob_internal(ca, &key->cert->signature_key, 0) != 0) { 1911 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 1912 goto out; 1913 } 1914 if (!sshkey_type_is_valid_ca(key->cert->signature_key->type)) { 1915 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 1916 goto out; 1917 } 1918 if ((ret = sshkey_verify(key->cert->signature_key, sig, slen, 1919 sshbuf_ptr(key->cert->certblob), signed_len, 0)) != 0) 1920 goto out; 1921 1922 /* Success */ 1923 ret = 0; 1924 out: 1925 sshbuf_free(ca); 1926 sshbuf_free(crit); 1927 sshbuf_free(exts); 1928 sshbuf_free(principals); 1929 free(sig); 1930 return ret; 1931 } 1932 1933 static int 1934 sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp, 1935 int allow_cert) 1936 { 1937 int type, ret = SSH_ERR_INTERNAL_ERROR; 1938 char *ktype = NULL, *curve = NULL; 1939 struct sshkey *key = NULL; 1940 size_t len; 1941 u_char *pk = NULL; 1942 struct sshbuf *copy; 1943 #ifdef WITH_OPENSSL 1944 EC_POINT *q = NULL; 1945 #endif /* WITH_OPENSSL */ 1946 1947 #ifdef DEBUG_PK /* XXX */ 1948 sshbuf_dump(b, stderr); 1949 #endif 1950 *keyp = NULL; 1951 if ((copy = sshbuf_fromb(b)) == NULL) { 1952 ret = SSH_ERR_ALLOC_FAIL; 1953 goto out; 1954 } 1955 if (sshbuf_get_cstring(b, &ktype, NULL) != 0) { 1956 ret = SSH_ERR_INVALID_FORMAT; 1957 goto out; 1958 } 1959 1960 type = sshkey_type_from_name(ktype); 1961 if (!allow_cert && sshkey_type_is_cert(type)) { 1962 ret = SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 1963 goto out; 1964 } 1965 switch (type) { 1966 #ifdef WITH_OPENSSL 1967 case KEY_RSA_CERT: 1968 /* Skip nonce */ 1969 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 1970 ret = SSH_ERR_INVALID_FORMAT; 1971 goto out; 1972 } 1973 /* FALLTHROUGH */ 1974 case KEY_RSA: 1975 case KEY_RSA_CERT_V00: 1976 if ((key = sshkey_new(type)) == NULL) { 1977 ret = SSH_ERR_ALLOC_FAIL; 1978 goto out; 1979 } 1980 if (sshbuf_get_bignum2(b, key->rsa->e) != 0 || 1981 sshbuf_get_bignum2(b, key->rsa->n) != 0) { 1982 ret = SSH_ERR_INVALID_FORMAT; 1983 goto out; 1984 } 1985 #ifdef DEBUG_PK 1986 RSA_print_fp(stderr, key->rsa, 8); 1987 #endif 1988 break; 1989 case KEY_DSA_CERT: 1990 /* Skip nonce */ 1991 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 1992 ret = SSH_ERR_INVALID_FORMAT; 1993 goto out; 1994 } 1995 /* FALLTHROUGH */ 1996 case KEY_DSA: 1997 case KEY_DSA_CERT_V00: 1998 if ((key = sshkey_new(type)) == NULL) { 1999 ret = SSH_ERR_ALLOC_FAIL; 2000 goto out; 2001 } 2002 if (sshbuf_get_bignum2(b, key->dsa->p) != 0 || 2003 sshbuf_get_bignum2(b, key->dsa->q) != 0 || 2004 sshbuf_get_bignum2(b, key->dsa->g) != 0 || 2005 sshbuf_get_bignum2(b, key->dsa->pub_key) != 0) { 2006 ret = SSH_ERR_INVALID_FORMAT; 2007 goto out; 2008 } 2009 #ifdef DEBUG_PK 2010 DSA_print_fp(stderr, key->dsa, 8); 2011 #endif 2012 break; 2013 case KEY_ECDSA_CERT: 2014 /* Skip nonce */ 2015 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2016 ret = SSH_ERR_INVALID_FORMAT; 2017 goto out; 2018 } 2019 /* FALLTHROUGH */ 2020 case KEY_ECDSA: 2021 if ((key = sshkey_new(type)) == NULL) { 2022 ret = SSH_ERR_ALLOC_FAIL; 2023 goto out; 2024 } 2025 key->ecdsa_nid = sshkey_ecdsa_nid_from_name(ktype); 2026 if (sshbuf_get_cstring(b, &curve, NULL) != 0) { 2027 ret = SSH_ERR_INVALID_FORMAT; 2028 goto out; 2029 } 2030 if (key->ecdsa_nid != sshkey_curve_name_to_nid(curve)) { 2031 ret = SSH_ERR_EC_CURVE_MISMATCH; 2032 goto out; 2033 } 2034 if (key->ecdsa != NULL) 2035 EC_KEY_free(key->ecdsa); 2036 if ((key->ecdsa = EC_KEY_new_by_curve_name(key->ecdsa_nid)) 2037 == NULL) { 2038 ret = SSH_ERR_EC_CURVE_INVALID; 2039 goto out; 2040 } 2041 if ((q = EC_POINT_new(EC_KEY_get0_group(key->ecdsa))) == NULL) { 2042 ret = SSH_ERR_ALLOC_FAIL; 2043 goto out; 2044 } 2045 if (sshbuf_get_ec(b, q, EC_KEY_get0_group(key->ecdsa)) != 0) { 2046 ret = SSH_ERR_INVALID_FORMAT; 2047 goto out; 2048 } 2049 if (sshkey_ec_validate_public(EC_KEY_get0_group(key->ecdsa), 2050 q) != 0) { 2051 ret = SSH_ERR_KEY_INVALID_EC_VALUE; 2052 goto out; 2053 } 2054 if (EC_KEY_set_public_key(key->ecdsa, q) != 1) { 2055 /* XXX assume it is a allocation error */ 2056 ret = SSH_ERR_ALLOC_FAIL; 2057 goto out; 2058 } 2059 #ifdef DEBUG_PK 2060 sshkey_dump_ec_point(EC_KEY_get0_group(key->ecdsa), q); 2061 #endif 2062 break; 2063 #endif /* WITH_OPENSSL */ 2064 case KEY_ED25519_CERT: 2065 /* Skip nonce */ 2066 if (sshbuf_get_string_direct(b, NULL, NULL) != 0) { 2067 ret = SSH_ERR_INVALID_FORMAT; 2068 goto out; 2069 } 2070 /* FALLTHROUGH */ 2071 case KEY_ED25519: 2072 if ((ret = sshbuf_get_string(b, &pk, &len)) != 0) 2073 goto out; 2074 if (len != ED25519_PK_SZ) { 2075 ret = SSH_ERR_INVALID_FORMAT; 2076 goto out; 2077 } 2078 if ((key = sshkey_new(type)) == NULL) { 2079 ret = SSH_ERR_ALLOC_FAIL; 2080 goto out; 2081 } 2082 key->ed25519_pk = pk; 2083 pk = NULL; 2084 break; 2085 case KEY_UNSPEC: 2086 if ((key = sshkey_new(type)) == NULL) { 2087 ret = SSH_ERR_ALLOC_FAIL; 2088 goto out; 2089 } 2090 break; 2091 default: 2092 ret = SSH_ERR_KEY_TYPE_UNKNOWN; 2093 goto out; 2094 } 2095 2096 /* Parse certificate potion */ 2097 if (sshkey_is_cert(key) && (ret = cert_parse(b, key, copy)) != 0) 2098 goto out; 2099 2100 if (key != NULL && sshbuf_len(b) != 0) { 2101 ret = SSH_ERR_INVALID_FORMAT; 2102 goto out; 2103 } 2104 ret = 0; 2105 *keyp = key; 2106 key = NULL; 2107 out: 2108 sshbuf_free(copy); 2109 sshkey_free(key); 2110 free(ktype); 2111 free(curve); 2112 free(pk); 2113 #ifdef WITH_OPENSSL 2114 if (q != NULL) 2115 EC_POINT_free(q); 2116 #endif /* WITH_OPENSSL */ 2117 return ret; 2118 } 2119 2120 int 2121 sshkey_from_blob(const u_char *blob, size_t blen, struct sshkey **keyp) 2122 { 2123 struct sshbuf *b; 2124 int r; 2125 2126 if ((b = sshbuf_from(blob, blen)) == NULL) 2127 return SSH_ERR_ALLOC_FAIL; 2128 r = sshkey_from_blob_internal(b, keyp, 1); 2129 sshbuf_free(b); 2130 return r; 2131 } 2132 2133 int 2134 sshkey_fromb(struct sshbuf *b, struct sshkey **keyp) 2135 { 2136 return sshkey_from_blob_internal(b, keyp, 1); 2137 } 2138 2139 int 2140 sshkey_froms(struct sshbuf *buf, struct sshkey **keyp) 2141 { 2142 struct sshbuf *b; 2143 int r; 2144 2145 if ((r = sshbuf_froms(buf, &b)) != 0) 2146 return r; 2147 r = sshkey_from_blob_internal(b, keyp, 1); 2148 sshbuf_free(b); 2149 return r; 2150 } 2151 2152 int 2153 sshkey_sign(const struct sshkey *key, 2154 u_char **sigp, size_t *lenp, 2155 const u_char *data, size_t datalen, u_int compat) 2156 { 2157 if (sigp != NULL) 2158 *sigp = NULL; 2159 if (lenp != NULL) 2160 *lenp = 0; 2161 if (datalen > SSH_KEY_MAX_SIGN_DATA_SIZE) 2162 return SSH_ERR_INVALID_ARGUMENT; 2163 switch (key->type) { 2164 #ifdef WITH_OPENSSL 2165 case KEY_DSA_CERT_V00: 2166 case KEY_DSA_CERT: 2167 case KEY_DSA: 2168 return ssh_dss_sign(key, sigp, lenp, data, datalen, compat); 2169 case KEY_ECDSA_CERT: 2170 case KEY_ECDSA: 2171 return ssh_ecdsa_sign(key, sigp, lenp, data, datalen, compat); 2172 case KEY_RSA_CERT_V00: 2173 case KEY_RSA_CERT: 2174 case KEY_RSA: 2175 return ssh_rsa_sign(key, sigp, lenp, data, datalen, compat); 2176 #endif /* WITH_OPENSSL */ 2177 case KEY_ED25519: 2178 case KEY_ED25519_CERT: 2179 return ssh_ed25519_sign(key, sigp, lenp, data, datalen, compat); 2180 default: 2181 return SSH_ERR_KEY_TYPE_UNKNOWN; 2182 } 2183 } 2184 2185 /* 2186 * ssh_key_verify returns 0 for a correct signature and < 0 on error. 2187 */ 2188 int 2189 sshkey_verify(const struct sshkey *key, 2190 const u_char *sig, size_t siglen, 2191 const u_char *data, size_t dlen, u_int compat) 2192 { 2193 if (siglen == 0 || dlen > SSH_KEY_MAX_SIGN_DATA_SIZE) 2194 return SSH_ERR_INVALID_ARGUMENT; 2195 switch (key->type) { 2196 #ifdef WITH_OPENSSL 2197 case KEY_DSA_CERT_V00: 2198 case KEY_DSA_CERT: 2199 case KEY_DSA: 2200 return ssh_dss_verify(key, sig, siglen, data, dlen, compat); 2201 case KEY_ECDSA_CERT: 2202 case KEY_ECDSA: 2203 return ssh_ecdsa_verify(key, sig, siglen, data, dlen, compat); 2204 case KEY_RSA_CERT_V00: 2205 case KEY_RSA_CERT: 2206 case KEY_RSA: 2207 return ssh_rsa_verify(key, sig, siglen, data, dlen, compat); 2208 #endif /* WITH_OPENSSL */ 2209 case KEY_ED25519: 2210 case KEY_ED25519_CERT: 2211 return ssh_ed25519_verify(key, sig, siglen, data, dlen, compat); 2212 default: 2213 return SSH_ERR_KEY_TYPE_UNKNOWN; 2214 } 2215 } 2216 2217 /* Converts a private to a public key */ 2218 int 2219 sshkey_demote(const struct sshkey *k, struct sshkey **dkp) 2220 { 2221 struct sshkey *pk; 2222 int ret = SSH_ERR_INTERNAL_ERROR; 2223 2224 if (dkp != NULL) 2225 *dkp = NULL; 2226 2227 if ((pk = calloc(1, sizeof(*pk))) == NULL) 2228 return SSH_ERR_ALLOC_FAIL; 2229 pk->type = k->type; 2230 pk->flags = k->flags; 2231 pk->ecdsa_nid = k->ecdsa_nid; 2232 pk->dsa = NULL; 2233 pk->ecdsa = NULL; 2234 pk->rsa = NULL; 2235 pk->ed25519_pk = NULL; 2236 pk->ed25519_sk = NULL; 2237 2238 switch (k->type) { 2239 #ifdef WITH_OPENSSL 2240 case KEY_RSA_CERT_V00: 2241 case KEY_RSA_CERT: 2242 if ((ret = sshkey_cert_copy(k, pk)) != 0) 2243 goto fail; 2244 /* FALLTHROUGH */ 2245 case KEY_RSA1: 2246 case KEY_RSA: 2247 if ((pk->rsa = RSA_new()) == NULL || 2248 (pk->rsa->e = BN_dup(k->rsa->e)) == NULL || 2249 (pk->rsa->n = BN_dup(k->rsa->n)) == NULL) { 2250 ret = SSH_ERR_ALLOC_FAIL; 2251 goto fail; 2252 } 2253 break; 2254 case KEY_DSA_CERT_V00: 2255 case KEY_DSA_CERT: 2256 if ((ret = sshkey_cert_copy(k, pk)) != 0) 2257 goto fail; 2258 /* FALLTHROUGH */ 2259 case KEY_DSA: 2260 if ((pk->dsa = DSA_new()) == NULL || 2261 (pk->dsa->p = BN_dup(k->dsa->p)) == NULL || 2262 (pk->dsa->q = BN_dup(k->dsa->q)) == NULL || 2263 (pk->dsa->g = BN_dup(k->dsa->g)) == NULL || 2264 (pk->dsa->pub_key = BN_dup(k->dsa->pub_key)) == NULL) { 2265 ret = SSH_ERR_ALLOC_FAIL; 2266 goto fail; 2267 } 2268 break; 2269 case KEY_ECDSA_CERT: 2270 if ((ret = sshkey_cert_copy(k, pk)) != 0) 2271 goto fail; 2272 /* FALLTHROUGH */ 2273 case KEY_ECDSA: 2274 pk->ecdsa = EC_KEY_new_by_curve_name(pk->ecdsa_nid); 2275 if (pk->ecdsa == NULL) { 2276 ret = SSH_ERR_ALLOC_FAIL; 2277 goto fail; 2278 } 2279 if (EC_KEY_set_public_key(pk->ecdsa, 2280 EC_KEY_get0_public_key(k->ecdsa)) != 1) { 2281 ret = SSH_ERR_LIBCRYPTO_ERROR; 2282 goto fail; 2283 } 2284 break; 2285 #endif /* WITH_OPENSSL */ 2286 case KEY_ED25519_CERT: 2287 if ((ret = sshkey_cert_copy(k, pk)) != 0) 2288 goto fail; 2289 /* FALLTHROUGH */ 2290 case KEY_ED25519: 2291 if (k->ed25519_pk != NULL) { 2292 if ((pk->ed25519_pk = malloc(ED25519_PK_SZ)) == NULL) { 2293 ret = SSH_ERR_ALLOC_FAIL; 2294 goto fail; 2295 } 2296 memcpy(pk->ed25519_pk, k->ed25519_pk, ED25519_PK_SZ); 2297 } 2298 break; 2299 default: 2300 ret = SSH_ERR_KEY_TYPE_UNKNOWN; 2301 fail: 2302 sshkey_free(pk); 2303 return ret; 2304 } 2305 *dkp = pk; 2306 return 0; 2307 } 2308 2309 /* Convert a plain key to their _CERT equivalent */ 2310 int 2311 sshkey_to_certified(struct sshkey *k, int legacy) 2312 { 2313 int newtype; 2314 2315 switch (k->type) { 2316 #ifdef WITH_OPENSSL 2317 case KEY_RSA: 2318 newtype = legacy ? KEY_RSA_CERT_V00 : KEY_RSA_CERT; 2319 break; 2320 case KEY_DSA: 2321 newtype = legacy ? KEY_DSA_CERT_V00 : KEY_DSA_CERT; 2322 break; 2323 case KEY_ECDSA: 2324 if (legacy) 2325 return SSH_ERR_INVALID_ARGUMENT; 2326 newtype = KEY_ECDSA_CERT; 2327 break; 2328 #endif /* WITH_OPENSSL */ 2329 case KEY_ED25519: 2330 if (legacy) 2331 return SSH_ERR_INVALID_ARGUMENT; 2332 newtype = KEY_ED25519_CERT; 2333 break; 2334 default: 2335 return SSH_ERR_INVALID_ARGUMENT; 2336 } 2337 if ((k->cert = cert_new()) == NULL) 2338 return SSH_ERR_ALLOC_FAIL; 2339 k->type = newtype; 2340 return 0; 2341 } 2342 2343 /* Convert a certificate to its raw key equivalent */ 2344 int 2345 sshkey_drop_cert(struct sshkey *k) 2346 { 2347 if (!sshkey_type_is_cert(k->type)) 2348 return SSH_ERR_KEY_TYPE_UNKNOWN; 2349 cert_free(k->cert); 2350 k->cert = NULL; 2351 k->type = sshkey_type_plain(k->type); 2352 return 0; 2353 } 2354 2355 /* Sign a certified key, (re-)generating the signed certblob. */ 2356 int 2357 sshkey_certify(struct sshkey *k, struct sshkey *ca) 2358 { 2359 struct sshbuf *principals = NULL; 2360 u_char *ca_blob = NULL, *sig_blob = NULL, nonce[32]; 2361 size_t i, ca_len, sig_len; 2362 int ret = SSH_ERR_INTERNAL_ERROR; 2363 struct sshbuf *cert; 2364 2365 if (k == NULL || k->cert == NULL || 2366 k->cert->certblob == NULL || ca == NULL) 2367 return SSH_ERR_INVALID_ARGUMENT; 2368 if (!sshkey_is_cert(k)) 2369 return SSH_ERR_KEY_TYPE_UNKNOWN; 2370 if (!sshkey_type_is_valid_ca(ca->type)) 2371 return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2372 2373 if ((ret = sshkey_to_blob(ca, &ca_blob, &ca_len)) != 0) 2374 return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; 2375 2376 cert = k->cert->certblob; /* for readability */ 2377 sshbuf_reset(cert); 2378 if ((ret = sshbuf_put_cstring(cert, sshkey_ssh_name(k))) != 0) 2379 goto out; 2380 2381 /* -v01 certs put nonce first */ 2382 arc4random_buf(&nonce, sizeof(nonce)); 2383 if (!sshkey_cert_is_legacy(k)) { 2384 if ((ret = sshbuf_put_string(cert, nonce, sizeof(nonce))) != 0) 2385 goto out; 2386 } 2387 2388 /* XXX this substantially duplicates to_blob(); refactor */ 2389 switch (k->type) { 2390 #ifdef WITH_OPENSSL 2391 case KEY_DSA_CERT_V00: 2392 case KEY_DSA_CERT: 2393 if ((ret = sshbuf_put_bignum2(cert, k->dsa->p)) != 0 || 2394 (ret = sshbuf_put_bignum2(cert, k->dsa->q)) != 0 || 2395 (ret = sshbuf_put_bignum2(cert, k->dsa->g)) != 0 || 2396 (ret = sshbuf_put_bignum2(cert, k->dsa->pub_key)) != 0) 2397 goto out; 2398 break; 2399 case KEY_ECDSA_CERT: 2400 if ((ret = sshbuf_put_cstring(cert, 2401 sshkey_curve_nid_to_name(k->ecdsa_nid))) != 0 || 2402 (ret = sshbuf_put_ec(cert, 2403 EC_KEY_get0_public_key(k->ecdsa), 2404 EC_KEY_get0_group(k->ecdsa))) != 0) 2405 goto out; 2406 break; 2407 case KEY_RSA_CERT_V00: 2408 case KEY_RSA_CERT: 2409 if ((ret = sshbuf_put_bignum2(cert, k->rsa->e)) != 0 || 2410 (ret = sshbuf_put_bignum2(cert, k->rsa->n)) != 0) 2411 goto out; 2412 break; 2413 #endif /* WITH_OPENSSL */ 2414 case KEY_ED25519_CERT: 2415 if ((ret = sshbuf_put_string(cert, 2416 k->ed25519_pk, ED25519_PK_SZ)) != 0) 2417 goto out; 2418 break; 2419 default: 2420 ret = SSH_ERR_INVALID_ARGUMENT; 2421 goto out; 2422 } 2423 2424 /* -v01 certs have a serial number next */ 2425 if (!sshkey_cert_is_legacy(k)) { 2426 if ((ret = sshbuf_put_u64(cert, k->cert->serial)) != 0) 2427 goto out; 2428 } 2429 2430 if ((ret = sshbuf_put_u32(cert, k->cert->type)) != 0 || 2431 (ret = sshbuf_put_cstring(cert, k->cert->key_id)) != 0) 2432 goto out; 2433 2434 if ((principals = sshbuf_new()) == NULL) { 2435 ret = SSH_ERR_ALLOC_FAIL; 2436 goto out; 2437 } 2438 for (i = 0; i < k->cert->nprincipals; i++) { 2439 if ((ret = sshbuf_put_cstring(principals, 2440 k->cert->principals[i])) != 0) 2441 goto out; 2442 } 2443 if ((ret = sshbuf_put_stringb(cert, principals)) != 0 || 2444 (ret = sshbuf_put_u64(cert, k->cert->valid_after)) != 0 || 2445 (ret = sshbuf_put_u64(cert, k->cert->valid_before)) != 0 || 2446 (ret = sshbuf_put_stringb(cert, k->cert->critical)) != 0) 2447 goto out; 2448 2449 /* -v01 certs have non-critical options here */ 2450 if (!sshkey_cert_is_legacy(k)) { 2451 if ((ret = sshbuf_put_stringb(cert, k->cert->extensions)) != 0) 2452 goto out; 2453 } 2454 2455 /* -v00 certs put the nonce at the end */ 2456 if (sshkey_cert_is_legacy(k)) { 2457 if ((ret = sshbuf_put_string(cert, nonce, sizeof(nonce))) != 0) 2458 goto out; 2459 } 2460 2461 if ((ret = sshbuf_put_string(cert, NULL, 0)) != 0 || /* Reserved */ 2462 (ret = sshbuf_put_string(cert, ca_blob, ca_len)) != 0) 2463 goto out; 2464 2465 /* Sign the whole mess */ 2466 if ((ret = sshkey_sign(ca, &sig_blob, &sig_len, sshbuf_ptr(cert), 2467 sshbuf_len(cert), 0)) != 0) 2468 goto out; 2469 2470 /* Append signature and we are done */ 2471 if ((ret = sshbuf_put_string(cert, sig_blob, sig_len)) != 0) 2472 goto out; 2473 ret = 0; 2474 out: 2475 if (ret != 0) 2476 sshbuf_reset(cert); 2477 if (sig_blob != NULL) 2478 free(sig_blob); 2479 if (ca_blob != NULL) 2480 free(ca_blob); 2481 if (principals != NULL) 2482 sshbuf_free(principals); 2483 return ret; 2484 } 2485 2486 int 2487 sshkey_cert_check_authority(const struct sshkey *k, 2488 int want_host, int require_principal, 2489 const char *name, const char **reason) 2490 { 2491 u_int i, principal_matches; 2492 time_t now = time(NULL); 2493 2494 if (reason != NULL) 2495 *reason = NULL; 2496 2497 if (want_host) { 2498 if (k->cert->type != SSH2_CERT_TYPE_HOST) { 2499 *reason = "Certificate invalid: not a host certificate"; 2500 return SSH_ERR_KEY_CERT_INVALID; 2501 } 2502 } else { 2503 if (k->cert->type != SSH2_CERT_TYPE_USER) { 2504 *reason = "Certificate invalid: not a user certificate"; 2505 return SSH_ERR_KEY_CERT_INVALID; 2506 } 2507 } 2508 if (now < 0) { 2509 /* yikes - system clock before epoch! */ 2510 *reason = "Certificate invalid: not yet valid"; 2511 return SSH_ERR_KEY_CERT_INVALID; 2512 } 2513 if ((u_int64_t)now < k->cert->valid_after) { 2514 *reason = "Certificate invalid: not yet valid"; 2515 return SSH_ERR_KEY_CERT_INVALID; 2516 } 2517 if ((u_int64_t)now >= k->cert->valid_before) { 2518 *reason = "Certificate invalid: expired"; 2519 return SSH_ERR_KEY_CERT_INVALID; 2520 } 2521 if (k->cert->nprincipals == 0) { 2522 if (require_principal) { 2523 *reason = "Certificate lacks principal list"; 2524 return SSH_ERR_KEY_CERT_INVALID; 2525 } 2526 } else if (name != NULL) { 2527 principal_matches = 0; 2528 for (i = 0; i < k->cert->nprincipals; i++) { 2529 if (strcmp(name, k->cert->principals[i]) == 0) { 2530 principal_matches = 1; 2531 break; 2532 } 2533 } 2534 if (!principal_matches) { 2535 *reason = "Certificate invalid: name is not a listed " 2536 "principal"; 2537 return SSH_ERR_KEY_CERT_INVALID; 2538 } 2539 } 2540 return 0; 2541 } 2542 2543 int 2544 sshkey_private_serialize(const struct sshkey *key, struct sshbuf *b) 2545 { 2546 int r = SSH_ERR_INTERNAL_ERROR; 2547 2548 if ((r = sshbuf_put_cstring(b, sshkey_ssh_name(key))) != 0) 2549 goto out; 2550 switch (key->type) { 2551 #ifdef WITH_OPENSSL 2552 case KEY_RSA: 2553 if ((r = sshbuf_put_bignum2(b, key->rsa->n)) != 0 || 2554 (r = sshbuf_put_bignum2(b, key->rsa->e)) != 0 || 2555 (r = sshbuf_put_bignum2(b, key->rsa->d)) != 0 || 2556 (r = sshbuf_put_bignum2(b, key->rsa->iqmp)) != 0 || 2557 (r = sshbuf_put_bignum2(b, key->rsa->p)) != 0 || 2558 (r = sshbuf_put_bignum2(b, key->rsa->q)) != 0) 2559 goto out; 2560 break; 2561 case KEY_RSA_CERT_V00: 2562 case KEY_RSA_CERT: 2563 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 2564 r = SSH_ERR_INVALID_ARGUMENT; 2565 goto out; 2566 } 2567 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 2568 (r = sshbuf_put_bignum2(b, key->rsa->d)) != 0 || 2569 (r = sshbuf_put_bignum2(b, key->rsa->iqmp)) != 0 || 2570 (r = sshbuf_put_bignum2(b, key->rsa->p)) != 0 || 2571 (r = sshbuf_put_bignum2(b, key->rsa->q)) != 0) 2572 goto out; 2573 break; 2574 case KEY_DSA: 2575 if ((r = sshbuf_put_bignum2(b, key->dsa->p)) != 0 || 2576 (r = sshbuf_put_bignum2(b, key->dsa->q)) != 0 || 2577 (r = sshbuf_put_bignum2(b, key->dsa->g)) != 0 || 2578 (r = sshbuf_put_bignum2(b, key->dsa->pub_key)) != 0 || 2579 (r = sshbuf_put_bignum2(b, key->dsa->priv_key)) != 0) 2580 goto out; 2581 break; 2582 case KEY_DSA_CERT_V00: 2583 case KEY_DSA_CERT: 2584 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 2585 r = SSH_ERR_INVALID_ARGUMENT; 2586 goto out; 2587 } 2588 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 2589 (r = sshbuf_put_bignum2(b, key->dsa->priv_key)) != 0) 2590 goto out; 2591 break; 2592 case KEY_ECDSA: 2593 if ((r = sshbuf_put_cstring(b, 2594 sshkey_curve_nid_to_name(key->ecdsa_nid))) != 0 || 2595 (r = sshbuf_put_eckey(b, key->ecdsa)) != 0 || 2596 (r = sshbuf_put_bignum2(b, 2597 EC_KEY_get0_private_key(key->ecdsa))) != 0) 2598 goto out; 2599 break; 2600 case KEY_ECDSA_CERT: 2601 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 2602 r = SSH_ERR_INVALID_ARGUMENT; 2603 goto out; 2604 } 2605 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 2606 (r = sshbuf_put_bignum2(b, 2607 EC_KEY_get0_private_key(key->ecdsa))) != 0) 2608 goto out; 2609 break; 2610 #endif /* WITH_OPENSSL */ 2611 case KEY_ED25519: 2612 if ((r = sshbuf_put_string(b, key->ed25519_pk, 2613 ED25519_PK_SZ)) != 0 || 2614 (r = sshbuf_put_string(b, key->ed25519_sk, 2615 ED25519_SK_SZ)) != 0) 2616 goto out; 2617 break; 2618 case KEY_ED25519_CERT: 2619 if (key->cert == NULL || sshbuf_len(key->cert->certblob) == 0) { 2620 r = SSH_ERR_INVALID_ARGUMENT; 2621 goto out; 2622 } 2623 if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0 || 2624 (r = sshbuf_put_string(b, key->ed25519_pk, 2625 ED25519_PK_SZ)) != 0 || 2626 (r = sshbuf_put_string(b, key->ed25519_sk, 2627 ED25519_SK_SZ)) != 0) 2628 goto out; 2629 break; 2630 default: 2631 r = SSH_ERR_INVALID_ARGUMENT; 2632 goto out; 2633 } 2634 /* success */ 2635 r = 0; 2636 out: 2637 return r; 2638 } 2639 2640 int 2641 sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) 2642 { 2643 char *tname = NULL, *curve = NULL; 2644 struct sshkey *k = NULL; 2645 size_t pklen = 0, sklen = 0; 2646 int type, r = SSH_ERR_INTERNAL_ERROR; 2647 u_char *ed25519_pk = NULL, *ed25519_sk = NULL; 2648 #ifdef WITH_OPENSSL 2649 BIGNUM *exponent = NULL; 2650 #endif /* WITH_OPENSSL */ 2651 2652 if (kp != NULL) 2653 *kp = NULL; 2654 if ((r = sshbuf_get_cstring(buf, &tname, NULL)) != 0) 2655 goto out; 2656 type = sshkey_type_from_name(tname); 2657 switch (type) { 2658 #ifdef WITH_OPENSSL 2659 case KEY_DSA: 2660 if ((k = sshkey_new_private(type)) == NULL) { 2661 r = SSH_ERR_ALLOC_FAIL; 2662 goto out; 2663 } 2664 if ((r = sshbuf_get_bignum2(buf, k->dsa->p)) != 0 || 2665 (r = sshbuf_get_bignum2(buf, k->dsa->q)) != 0 || 2666 (r = sshbuf_get_bignum2(buf, k->dsa->g)) != 0 || 2667 (r = sshbuf_get_bignum2(buf, k->dsa->pub_key)) != 0 || 2668 (r = sshbuf_get_bignum2(buf, k->dsa->priv_key)) != 0) 2669 goto out; 2670 break; 2671 case KEY_DSA_CERT_V00: 2672 case KEY_DSA_CERT: 2673 if ((r = sshkey_froms(buf, &k)) != 0 || 2674 (r = sshkey_add_private(k)) != 0 || 2675 (r = sshbuf_get_bignum2(buf, k->dsa->priv_key)) != 0) 2676 goto out; 2677 break; 2678 case KEY_ECDSA: 2679 if ((k = sshkey_new_private(type)) == NULL) { 2680 r = SSH_ERR_ALLOC_FAIL; 2681 goto out; 2682 } 2683 if ((k->ecdsa_nid = sshkey_ecdsa_nid_from_name(tname)) == -1) { 2684 r = SSH_ERR_INVALID_ARGUMENT; 2685 goto out; 2686 } 2687 if ((r = sshbuf_get_cstring(buf, &curve, NULL)) != 0) 2688 goto out; 2689 if (k->ecdsa_nid != sshkey_curve_name_to_nid(curve)) { 2690 r = SSH_ERR_EC_CURVE_MISMATCH; 2691 goto out; 2692 } 2693 k->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); 2694 if (k->ecdsa == NULL || (exponent = BN_new()) == NULL) { 2695 r = SSH_ERR_LIBCRYPTO_ERROR; 2696 goto out; 2697 } 2698 if ((r = sshbuf_get_eckey(buf, k->ecdsa)) != 0 || 2699 (r = sshbuf_get_bignum2(buf, exponent))) 2700 goto out; 2701 if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) { 2702 r = SSH_ERR_LIBCRYPTO_ERROR; 2703 goto out; 2704 } 2705 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 2706 EC_KEY_get0_public_key(k->ecdsa)) != 0) || 2707 (r = sshkey_ec_validate_private(k->ecdsa)) != 0) 2708 goto out; 2709 break; 2710 case KEY_ECDSA_CERT: 2711 if ((exponent = BN_new()) == NULL) { 2712 r = SSH_ERR_LIBCRYPTO_ERROR; 2713 goto out; 2714 } 2715 if ((r = sshkey_froms(buf, &k)) != 0 || 2716 (r = sshkey_add_private(k)) != 0 || 2717 (r = sshbuf_get_bignum2(buf, exponent)) != 0) 2718 goto out; 2719 if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) { 2720 r = SSH_ERR_LIBCRYPTO_ERROR; 2721 goto out; 2722 } 2723 if ((r = sshkey_ec_validate_public(EC_KEY_get0_group(k->ecdsa), 2724 EC_KEY_get0_public_key(k->ecdsa)) != 0) || 2725 (r = sshkey_ec_validate_private(k->ecdsa)) != 0) 2726 goto out; 2727 break; 2728 case KEY_RSA: 2729 if ((k = sshkey_new_private(type)) == NULL) { 2730 r = SSH_ERR_ALLOC_FAIL; 2731 goto out; 2732 } 2733 if ((r = sshbuf_get_bignum2(buf, k->rsa->n)) != 0 || 2734 (r = sshbuf_get_bignum2(buf, k->rsa->e)) != 0 || 2735 (r = sshbuf_get_bignum2(buf, k->rsa->d)) != 0 || 2736 (r = sshbuf_get_bignum2(buf, k->rsa->iqmp)) != 0 || 2737 (r = sshbuf_get_bignum2(buf, k->rsa->p)) != 0 || 2738 (r = sshbuf_get_bignum2(buf, k->rsa->q)) != 0 || 2739 (r = rsa_generate_additional_parameters(k->rsa)) != 0) 2740 goto out; 2741 break; 2742 case KEY_RSA_CERT_V00: 2743 case KEY_RSA_CERT: 2744 if ((r = sshkey_froms(buf, &k)) != 0 || 2745 (r = sshkey_add_private(k)) != 0 || 2746 (r = sshbuf_get_bignum2(buf, k->rsa->d) != 0) || 2747 (r = sshbuf_get_bignum2(buf, k->rsa->iqmp) != 0) || 2748 (r = sshbuf_get_bignum2(buf, k->rsa->p) != 0) || 2749 (r = sshbuf_get_bignum2(buf, k->rsa->q) != 0) || 2750 (r = rsa_generate_additional_parameters(k->rsa)) != 0) 2751 goto out; 2752 break; 2753 #endif /* WITH_OPENSSL */ 2754 case KEY_ED25519: 2755 if ((k = sshkey_new_private(type)) == NULL) { 2756 r = SSH_ERR_ALLOC_FAIL; 2757 goto out; 2758 } 2759 if ((r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 || 2760 (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0) 2761 goto out; 2762 if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) { 2763 r = SSH_ERR_INVALID_FORMAT; 2764 goto out; 2765 } 2766 k->ed25519_pk = ed25519_pk; 2767 k->ed25519_sk = ed25519_sk; 2768 ed25519_pk = ed25519_sk = NULL; 2769 break; 2770 case KEY_ED25519_CERT: 2771 if ((r = sshkey_froms(buf, &k)) != 0 || 2772 (r = sshkey_add_private(k)) != 0 || 2773 (r = sshbuf_get_string(buf, &ed25519_pk, &pklen)) != 0 || 2774 (r = sshbuf_get_string(buf, &ed25519_sk, &sklen)) != 0) 2775 goto out; 2776 if (pklen != ED25519_PK_SZ || sklen != ED25519_SK_SZ) { 2777 r = SSH_ERR_INVALID_FORMAT; 2778 goto out; 2779 } 2780 k->ed25519_pk = ed25519_pk; 2781 k->ed25519_sk = ed25519_sk; 2782 ed25519_pk = ed25519_sk = NULL; 2783 break; 2784 default: 2785 r = SSH_ERR_KEY_TYPE_UNKNOWN; 2786 goto out; 2787 } 2788 #ifdef WITH_OPENSSL 2789 /* enable blinding */ 2790 switch (k->type) { 2791 case KEY_RSA: 2792 case KEY_RSA_CERT_V00: 2793 case KEY_RSA_CERT: 2794 case KEY_RSA1: 2795 if (RSA_blinding_on(k->rsa, NULL) != 1) { 2796 r = SSH_ERR_LIBCRYPTO_ERROR; 2797 goto out; 2798 } 2799 break; 2800 } 2801 #endif /* WITH_OPENSSL */ 2802 /* success */ 2803 r = 0; 2804 if (kp != NULL) { 2805 *kp = k; 2806 k = NULL; 2807 } 2808 out: 2809 free(tname); 2810 free(curve); 2811 #ifdef WITH_OPENSSL 2812 if (exponent != NULL) 2813 BN_clear_free(exponent); 2814 #endif /* WITH_OPENSSL */ 2815 sshkey_free(k); 2816 if (ed25519_pk != NULL) { 2817 explicit_bzero(ed25519_pk, pklen); 2818 free(ed25519_pk); 2819 } 2820 if (ed25519_sk != NULL) { 2821 explicit_bzero(ed25519_sk, sklen); 2822 free(ed25519_sk); 2823 } 2824 return r; 2825 } 2826 2827 #ifdef WITH_OPENSSL 2828 int 2829 sshkey_ec_validate_public(const EC_GROUP *group, const EC_POINT *public) 2830 { 2831 BN_CTX *bnctx; 2832 EC_POINT *nq = NULL; 2833 BIGNUM *order, *x, *y, *tmp; 2834 int ret = SSH_ERR_KEY_INVALID_EC_VALUE; 2835 2836 if ((bnctx = BN_CTX_new()) == NULL) 2837 return SSH_ERR_ALLOC_FAIL; 2838 BN_CTX_start(bnctx); 2839 2840 /* 2841 * We shouldn't ever hit this case because bignum_get_ecpoint() 2842 * refuses to load GF2m points. 2843 */ 2844 if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) != 2845 NID_X9_62_prime_field) 2846 goto out; 2847 2848 /* Q != infinity */ 2849 if (EC_POINT_is_at_infinity(group, public)) 2850 goto out; 2851 2852 if ((x = BN_CTX_get(bnctx)) == NULL || 2853 (y = BN_CTX_get(bnctx)) == NULL || 2854 (order = BN_CTX_get(bnctx)) == NULL || 2855 (tmp = BN_CTX_get(bnctx)) == NULL) { 2856 ret = SSH_ERR_ALLOC_FAIL; 2857 goto out; 2858 } 2859 2860 /* log2(x) > log2(order)/2, log2(y) > log2(order)/2 */ 2861 if (EC_GROUP_get_order(group, order, bnctx) != 1 || 2862 EC_POINT_get_affine_coordinates_GFp(group, public, 2863 x, y, bnctx) != 1) { 2864 ret = SSH_ERR_LIBCRYPTO_ERROR; 2865 goto out; 2866 } 2867 if (BN_num_bits(x) <= BN_num_bits(order) / 2 || 2868 BN_num_bits(y) <= BN_num_bits(order) / 2) 2869 goto out; 2870 2871 /* nQ == infinity (n == order of subgroup) */ 2872 if ((nq = EC_POINT_new(group)) == NULL) { 2873 ret = SSH_ERR_ALLOC_FAIL; 2874 goto out; 2875 } 2876 if (EC_POINT_mul(group, nq, NULL, public, order, bnctx) != 1) { 2877 ret = SSH_ERR_LIBCRYPTO_ERROR; 2878 goto out; 2879 } 2880 if (EC_POINT_is_at_infinity(group, nq) != 1) 2881 goto out; 2882 2883 /* x < order - 1, y < order - 1 */ 2884 if (!BN_sub(tmp, order, BN_value_one())) { 2885 ret = SSH_ERR_LIBCRYPTO_ERROR; 2886 goto out; 2887 } 2888 if (BN_cmp(x, tmp) >= 0 || BN_cmp(y, tmp) >= 0) 2889 goto out; 2890 ret = 0; 2891 out: 2892 BN_CTX_free(bnctx); 2893 if (nq != NULL) 2894 EC_POINT_free(nq); 2895 return ret; 2896 } 2897 2898 int 2899 sshkey_ec_validate_private(const EC_KEY *key) 2900 { 2901 BN_CTX *bnctx; 2902 BIGNUM *order, *tmp; 2903 int ret = SSH_ERR_KEY_INVALID_EC_VALUE; 2904 2905 if ((bnctx = BN_CTX_new()) == NULL) 2906 return SSH_ERR_ALLOC_FAIL; 2907 BN_CTX_start(bnctx); 2908 2909 if ((order = BN_CTX_get(bnctx)) == NULL || 2910 (tmp = BN_CTX_get(bnctx)) == NULL) { 2911 ret = SSH_ERR_ALLOC_FAIL; 2912 goto out; 2913 } 2914 2915 /* log2(private) > log2(order)/2 */ 2916 if (EC_GROUP_get_order(EC_KEY_get0_group(key), order, bnctx) != 1) { 2917 ret = SSH_ERR_LIBCRYPTO_ERROR; 2918 goto out; 2919 } 2920 if (BN_num_bits(EC_KEY_get0_private_key(key)) <= 2921 BN_num_bits(order) / 2) 2922 goto out; 2923 2924 /* private < order - 1 */ 2925 if (!BN_sub(tmp, order, BN_value_one())) { 2926 ret = SSH_ERR_LIBCRYPTO_ERROR; 2927 goto out; 2928 } 2929 if (BN_cmp(EC_KEY_get0_private_key(key), tmp) >= 0) 2930 goto out; 2931 ret = 0; 2932 out: 2933 BN_CTX_free(bnctx); 2934 return ret; 2935 } 2936 2937 void 2938 sshkey_dump_ec_point(const EC_GROUP *group, const EC_POINT *point) 2939 { 2940 BIGNUM *x, *y; 2941 BN_CTX *bnctx; 2942 2943 if (point == NULL) { 2944 fputs("point=(NULL)\n", stderr); 2945 return; 2946 } 2947 if ((bnctx = BN_CTX_new()) == NULL) { 2948 fprintf(stderr, "%s: BN_CTX_new failed\n", __func__); 2949 return; 2950 } 2951 BN_CTX_start(bnctx); 2952 if ((x = BN_CTX_get(bnctx)) == NULL || 2953 (y = BN_CTX_get(bnctx)) == NULL) { 2954 fprintf(stderr, "%s: BN_CTX_get failed\n", __func__); 2955 return; 2956 } 2957 if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) != 2958 NID_X9_62_prime_field) { 2959 fprintf(stderr, "%s: group is not a prime field\n", __func__); 2960 return; 2961 } 2962 if (EC_POINT_get_affine_coordinates_GFp(group, point, x, y, 2963 bnctx) != 1) { 2964 fprintf(stderr, "%s: EC_POINT_get_affine_coordinates_GFp\n", 2965 __func__); 2966 return; 2967 } 2968 fputs("x=", stderr); 2969 BN_print_fp(stderr, x); 2970 fputs("\ny=", stderr); 2971 BN_print_fp(stderr, y); 2972 fputs("\n", stderr); 2973 BN_CTX_free(bnctx); 2974 } 2975 2976 void 2977 sshkey_dump_ec_key(const EC_KEY *key) 2978 { 2979 const BIGNUM *exponent; 2980 2981 sshkey_dump_ec_point(EC_KEY_get0_group(key), 2982 EC_KEY_get0_public_key(key)); 2983 fputs("exponent=", stderr); 2984 if ((exponent = EC_KEY_get0_private_key(key)) == NULL) 2985 fputs("(NULL)", stderr); 2986 else 2987 BN_print_fp(stderr, EC_KEY_get0_private_key(key)); 2988 fputs("\n", stderr); 2989 } 2990 #endif /* WITH_OPENSSL */ 2991 2992 static int 2993 sshkey_private_to_blob2(const struct sshkey *prv, struct sshbuf *blob, 2994 const char *passphrase, const char *comment, const char *ciphername, 2995 int rounds) 2996 { 2997 u_char *cp, *key = NULL, *pubkeyblob = NULL; 2998 u_char salt[SALT_LEN]; 2999 char *b64 = NULL; 3000 size_t i, pubkeylen, keylen, ivlen, blocksize, authlen; 3001 u_int check; 3002 int r = SSH_ERR_INTERNAL_ERROR; 3003 struct sshcipher_ctx ciphercontext; 3004 const struct sshcipher *cipher; 3005 const char *kdfname = KDFNAME; 3006 struct sshbuf *encoded = NULL, *encrypted = NULL, *kdf = NULL; 3007 3008 memset(&ciphercontext, 0, sizeof(ciphercontext)); 3009 3010 if (rounds <= 0) 3011 rounds = DEFAULT_ROUNDS; 3012 if (passphrase == NULL || !strlen(passphrase)) { 3013 ciphername = "none"; 3014 kdfname = "none"; 3015 } else if (ciphername == NULL) 3016 ciphername = DEFAULT_CIPHERNAME; 3017 else if (cipher_number(ciphername) != SSH_CIPHER_SSH2) { 3018 r = SSH_ERR_INVALID_ARGUMENT; 3019 goto out; 3020 } 3021 if ((cipher = cipher_by_name(ciphername)) == NULL) { 3022 r = SSH_ERR_INTERNAL_ERROR; 3023 goto out; 3024 } 3025 3026 if ((kdf = sshbuf_new()) == NULL || 3027 (encoded = sshbuf_new()) == NULL || 3028 (encrypted = sshbuf_new()) == NULL) { 3029 r = SSH_ERR_ALLOC_FAIL; 3030 goto out; 3031 } 3032 blocksize = cipher_blocksize(cipher); 3033 keylen = cipher_keylen(cipher); 3034 ivlen = cipher_ivlen(cipher); 3035 authlen = cipher_authlen(cipher); 3036 if ((key = calloc(1, keylen + ivlen)) == NULL) { 3037 r = SSH_ERR_ALLOC_FAIL; 3038 goto out; 3039 } 3040 if (strcmp(kdfname, "bcrypt") == 0) { 3041 arc4random_buf(salt, SALT_LEN); 3042 if (bcrypt_pbkdf(passphrase, strlen(passphrase), 3043 salt, SALT_LEN, key, keylen + ivlen, rounds) < 0) { 3044 r = SSH_ERR_INVALID_ARGUMENT; 3045 goto out; 3046 } 3047 if ((r = sshbuf_put_string(kdf, salt, SALT_LEN)) != 0 || 3048 (r = sshbuf_put_u32(kdf, rounds)) != 0) 3049 goto out; 3050 } else if (strcmp(kdfname, "none") != 0) { 3051 /* Unsupported KDF type */ 3052 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 3053 goto out; 3054 } 3055 if ((r = cipher_init(&ciphercontext, cipher, key, keylen, 3056 key + keylen, ivlen, 1)) != 0) 3057 goto out; 3058 3059 if ((r = sshbuf_put(encoded, AUTH_MAGIC, sizeof(AUTH_MAGIC))) != 0 || 3060 (r = sshbuf_put_cstring(encoded, ciphername)) != 0 || 3061 (r = sshbuf_put_cstring(encoded, kdfname)) != 0 || 3062 (r = sshbuf_put_stringb(encoded, kdf)) != 0 || 3063 (r = sshbuf_put_u32(encoded, 1)) != 0 || /* number of keys */ 3064 (r = sshkey_to_blob(prv, &pubkeyblob, &pubkeylen)) != 0 || 3065 (r = sshbuf_put_string(encoded, pubkeyblob, pubkeylen)) != 0) 3066 goto out; 3067 3068 /* set up the buffer that will be encrypted */ 3069 3070 /* Random check bytes */ 3071 check = arc4random(); 3072 if ((r = sshbuf_put_u32(encrypted, check)) != 0 || 3073 (r = sshbuf_put_u32(encrypted, check)) != 0) 3074 goto out; 3075 3076 /* append private key and comment*/ 3077 if ((r = sshkey_private_serialize(prv, encrypted)) != 0 || 3078 (r = sshbuf_put_cstring(encrypted, comment)) != 0) 3079 goto out; 3080 3081 /* padding */ 3082 i = 0; 3083 while (sshbuf_len(encrypted) % blocksize) { 3084 if ((r = sshbuf_put_u8(encrypted, ++i & 0xff)) != 0) 3085 goto out; 3086 } 3087 3088 /* length in destination buffer */ 3089 if ((r = sshbuf_put_u32(encoded, sshbuf_len(encrypted))) != 0) 3090 goto out; 3091 3092 /* encrypt */ 3093 if ((r = sshbuf_reserve(encoded, 3094 sshbuf_len(encrypted) + authlen, &cp)) != 0) 3095 goto out; 3096 if ((r = cipher_crypt(&ciphercontext, 0, cp, 3097 sshbuf_ptr(encrypted), sshbuf_len(encrypted), 0, authlen)) != 0) 3098 goto out; 3099 3100 /* uuencode */ 3101 if ((b64 = sshbuf_dtob64(encoded)) == NULL) { 3102 r = SSH_ERR_ALLOC_FAIL; 3103 goto out; 3104 } 3105 3106 sshbuf_reset(blob); 3107 if ((r = sshbuf_put(blob, MARK_BEGIN, MARK_BEGIN_LEN)) != 0) 3108 goto out; 3109 for (i = 0; i < strlen(b64); i++) { 3110 if ((r = sshbuf_put_u8(blob, b64[i])) != 0) 3111 goto out; 3112 /* insert line breaks */ 3113 if (i % 70 == 69 && (r = sshbuf_put_u8(blob, '\n')) != 0) 3114 goto out; 3115 } 3116 if (i % 70 != 69 && (r = sshbuf_put_u8(blob, '\n')) != 0) 3117 goto out; 3118 if ((r = sshbuf_put(blob, MARK_END, MARK_END_LEN)) != 0) 3119 goto out; 3120 3121 /* success */ 3122 r = 0; 3123 3124 out: 3125 sshbuf_free(kdf); 3126 sshbuf_free(encoded); 3127 sshbuf_free(encrypted); 3128 cipher_cleanup(&ciphercontext); 3129 explicit_bzero(salt, sizeof(salt)); 3130 if (key != NULL) { 3131 explicit_bzero(key, keylen + ivlen); 3132 free(key); 3133 } 3134 if (pubkeyblob != NULL) { 3135 explicit_bzero(pubkeyblob, pubkeylen); 3136 free(pubkeyblob); 3137 } 3138 if (b64 != NULL) { 3139 explicit_bzero(b64, strlen(b64)); 3140 free(b64); 3141 } 3142 return r; 3143 } 3144 3145 static int 3146 sshkey_parse_private2(struct sshbuf *blob, int type, const char *passphrase, 3147 struct sshkey **keyp, char **commentp) 3148 { 3149 char *comment = NULL, *ciphername = NULL, *kdfname = NULL; 3150 const struct sshcipher *cipher = NULL; 3151 const u_char *cp; 3152 int r = SSH_ERR_INTERNAL_ERROR; 3153 size_t encoded_len; 3154 size_t i, keylen = 0, ivlen = 0, authlen = 0, slen = 0; 3155 struct sshbuf *encoded = NULL, *decoded = NULL; 3156 struct sshbuf *kdf = NULL, *decrypted = NULL; 3157 struct sshcipher_ctx ciphercontext; 3158 struct sshkey *k = NULL; 3159 u_char *key = NULL, *salt = NULL, *dp, pad, last; 3160 u_int blocksize, rounds, nkeys, encrypted_len, check1, check2; 3161 3162 memset(&ciphercontext, 0, sizeof(ciphercontext)); 3163 if (keyp != NULL) 3164 *keyp = NULL; 3165 if (commentp != NULL) 3166 *commentp = NULL; 3167 3168 if ((encoded = sshbuf_new()) == NULL || 3169 (decoded = sshbuf_new()) == NULL || 3170 (decrypted = sshbuf_new()) == NULL) { 3171 r = SSH_ERR_ALLOC_FAIL; 3172 goto out; 3173 } 3174 3175 /* check preamble */ 3176 cp = sshbuf_ptr(blob); 3177 encoded_len = sshbuf_len(blob); 3178 if (encoded_len < (MARK_BEGIN_LEN + MARK_END_LEN) || 3179 memcmp(cp, MARK_BEGIN, MARK_BEGIN_LEN) != 0) { 3180 r = SSH_ERR_INVALID_FORMAT; 3181 goto out; 3182 } 3183 cp += MARK_BEGIN_LEN; 3184 encoded_len -= MARK_BEGIN_LEN; 3185 3186 /* Look for end marker, removing whitespace as we go */ 3187 while (encoded_len > 0) { 3188 if (*cp != '\n' && *cp != '\r') { 3189 if ((r = sshbuf_put_u8(encoded, *cp)) != 0) 3190 goto out; 3191 } 3192 last = *cp; 3193 encoded_len--; 3194 cp++; 3195 if (last == '\n') { 3196 if (encoded_len >= MARK_END_LEN && 3197 memcmp(cp, MARK_END, MARK_END_LEN) == 0) { 3198 /* \0 terminate */ 3199 if ((r = sshbuf_put_u8(encoded, 0)) != 0) 3200 goto out; 3201 break; 3202 } 3203 } 3204 } 3205 if (encoded_len == 0) { 3206 r = SSH_ERR_INVALID_FORMAT; 3207 goto out; 3208 } 3209 3210 /* decode base64 */ 3211 if ((r = sshbuf_b64tod(decoded, (char *)sshbuf_ptr(encoded))) != 0) 3212 goto out; 3213 3214 /* check magic */ 3215 if (sshbuf_len(decoded) < sizeof(AUTH_MAGIC) || 3216 memcmp(sshbuf_ptr(decoded), AUTH_MAGIC, sizeof(AUTH_MAGIC))) { 3217 r = SSH_ERR_INVALID_FORMAT; 3218 goto out; 3219 } 3220 /* parse public portion of key */ 3221 if ((r = sshbuf_consume(decoded, sizeof(AUTH_MAGIC))) != 0 || 3222 (r = sshbuf_get_cstring(decoded, &ciphername, NULL)) != 0 || 3223 (r = sshbuf_get_cstring(decoded, &kdfname, NULL)) != 0 || 3224 (r = sshbuf_froms(decoded, &kdf)) != 0 || 3225 (r = sshbuf_get_u32(decoded, &nkeys)) != 0 || 3226 (r = sshbuf_skip_string(decoded)) != 0 || /* pubkey */ 3227 (r = sshbuf_get_u32(decoded, &encrypted_len)) != 0) 3228 goto out; 3229 3230 if ((cipher = cipher_by_name(ciphername)) == NULL) { 3231 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 3232 goto out; 3233 } 3234 if ((passphrase == NULL || strlen(passphrase) == 0) && 3235 strcmp(ciphername, "none") != 0) { 3236 /* passphrase required */ 3237 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3238 goto out; 3239 } 3240 if (strcmp(kdfname, "none") != 0 && strcmp(kdfname, "bcrypt") != 0) { 3241 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 3242 goto out; 3243 } 3244 if (!strcmp(kdfname, "none") && strcmp(ciphername, "none") != 0) { 3245 r = SSH_ERR_INVALID_FORMAT; 3246 goto out; 3247 } 3248 if (nkeys != 1) { 3249 /* XXX only one key supported */ 3250 r = SSH_ERR_INVALID_FORMAT; 3251 goto out; 3252 } 3253 3254 /* check size of encrypted key blob */ 3255 blocksize = cipher_blocksize(cipher); 3256 if (encrypted_len < blocksize || (encrypted_len % blocksize) != 0) { 3257 r = SSH_ERR_INVALID_FORMAT; 3258 goto out; 3259 } 3260 3261 /* setup key */ 3262 keylen = cipher_keylen(cipher); 3263 ivlen = cipher_ivlen(cipher); 3264 authlen = cipher_authlen(cipher); 3265 if ((key = calloc(1, keylen + ivlen)) == NULL) { 3266 r = SSH_ERR_ALLOC_FAIL; 3267 goto out; 3268 } 3269 if (strcmp(kdfname, "bcrypt") == 0) { 3270 if ((r = sshbuf_get_string(kdf, &salt, &slen)) != 0 || 3271 (r = sshbuf_get_u32(kdf, &rounds)) != 0) 3272 goto out; 3273 if (bcrypt_pbkdf(passphrase, strlen(passphrase), salt, slen, 3274 key, keylen + ivlen, rounds) < 0) { 3275 r = SSH_ERR_INVALID_FORMAT; 3276 goto out; 3277 } 3278 } 3279 3280 /* check that an appropriate amount of auth data is present */ 3281 if (sshbuf_len(decoded) < encrypted_len + authlen) { 3282 r = SSH_ERR_INVALID_FORMAT; 3283 goto out; 3284 } 3285 3286 /* decrypt private portion of key */ 3287 if ((r = sshbuf_reserve(decrypted, encrypted_len, &dp)) != 0 || 3288 (r = cipher_init(&ciphercontext, cipher, key, keylen, 3289 key + keylen, ivlen, 0)) != 0) 3290 goto out; 3291 if ((r = cipher_crypt(&ciphercontext, 0, dp, sshbuf_ptr(decoded), 3292 encrypted_len, 0, authlen)) != 0) { 3293 /* an integrity error here indicates an incorrect passphrase */ 3294 if (r == SSH_ERR_MAC_INVALID) 3295 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3296 goto out; 3297 } 3298 if ((r = sshbuf_consume(decoded, encrypted_len + authlen)) != 0) 3299 goto out; 3300 /* there should be no trailing data */ 3301 if (sshbuf_len(decoded) != 0) { 3302 r = SSH_ERR_INVALID_FORMAT; 3303 goto out; 3304 } 3305 3306 /* check check bytes */ 3307 if ((r = sshbuf_get_u32(decrypted, &check1)) != 0 || 3308 (r = sshbuf_get_u32(decrypted, &check2)) != 0) 3309 goto out; 3310 if (check1 != check2) { 3311 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3312 goto out; 3313 } 3314 3315 /* Load the private key and comment */ 3316 if ((r = sshkey_private_deserialize(decrypted, &k)) != 0 || 3317 (r = sshbuf_get_cstring(decrypted, &comment, NULL)) != 0) 3318 goto out; 3319 3320 /* Check deterministic padding */ 3321 i = 0; 3322 while (sshbuf_len(decrypted)) { 3323 if ((r = sshbuf_get_u8(decrypted, &pad)) != 0) 3324 goto out; 3325 if (pad != (++i & 0xff)) { 3326 r = SSH_ERR_INVALID_FORMAT; 3327 goto out; 3328 } 3329 } 3330 3331 /* XXX decode pubkey and check against private */ 3332 3333 /* success */ 3334 r = 0; 3335 if (keyp != NULL) { 3336 *keyp = k; 3337 k = NULL; 3338 } 3339 if (commentp != NULL) { 3340 *commentp = comment; 3341 comment = NULL; 3342 } 3343 out: 3344 pad = 0; 3345 cipher_cleanup(&ciphercontext); 3346 free(ciphername); 3347 free(kdfname); 3348 free(comment); 3349 if (salt != NULL) { 3350 explicit_bzero(salt, slen); 3351 free(salt); 3352 } 3353 if (key != NULL) { 3354 explicit_bzero(key, keylen + ivlen); 3355 free(key); 3356 } 3357 sshbuf_free(encoded); 3358 sshbuf_free(decoded); 3359 sshbuf_free(kdf); 3360 sshbuf_free(decrypted); 3361 sshkey_free(k); 3362 return r; 3363 } 3364 3365 #if WITH_SSH1 3366 /* 3367 * Serialises the authentication (private) key to a blob, encrypting it with 3368 * passphrase. The identification of the blob (lowest 64 bits of n) will 3369 * precede the key to provide identification of the key without needing a 3370 * passphrase. 3371 */ 3372 static int 3373 sshkey_private_rsa1_to_blob(struct sshkey *key, struct sshbuf *blob, 3374 const char *passphrase, const char *comment) 3375 { 3376 struct sshbuf *buffer = NULL, *encrypted = NULL; 3377 u_char buf[8]; 3378 int r, cipher_num; 3379 struct sshcipher_ctx ciphercontext; 3380 const struct sshcipher *cipher; 3381 u_char *cp; 3382 3383 /* 3384 * If the passphrase is empty, use SSH_CIPHER_NONE to ease converting 3385 * to another cipher; otherwise use SSH_AUTHFILE_CIPHER. 3386 */ 3387 cipher_num = (strcmp(passphrase, "") == 0) ? 3388 SSH_CIPHER_NONE : SSH_CIPHER_3DES; 3389 if ((cipher = cipher_by_number(cipher_num)) == NULL) 3390 return SSH_ERR_INTERNAL_ERROR; 3391 3392 /* This buffer is used to build the secret part of the private key. */ 3393 if ((buffer = sshbuf_new()) == NULL) 3394 return SSH_ERR_ALLOC_FAIL; 3395 3396 /* Put checkbytes for checking passphrase validity. */ 3397 if ((r = sshbuf_reserve(buffer, 4, &cp)) != 0) 3398 goto out; 3399 arc4random_buf(cp, 2); 3400 memcpy(cp + 2, cp, 2); 3401 3402 /* 3403 * Store the private key (n and e will not be stored because they 3404 * will be stored in plain text, and storing them also in encrypted 3405 * format would just give known plaintext). 3406 * Note: q and p are stored in reverse order to SSL. 3407 */ 3408 if ((r = sshbuf_put_bignum1(buffer, key->rsa->d)) != 0 || 3409 (r = sshbuf_put_bignum1(buffer, key->rsa->iqmp)) != 0 || 3410 (r = sshbuf_put_bignum1(buffer, key->rsa->q)) != 0 || 3411 (r = sshbuf_put_bignum1(buffer, key->rsa->p)) != 0) 3412 goto out; 3413 3414 /* Pad the part to be encrypted to a size that is a multiple of 8. */ 3415 explicit_bzero(buf, 8); 3416 if ((r = sshbuf_put(buffer, buf, 8 - (sshbuf_len(buffer) % 8))) != 0) 3417 goto out; 3418 3419 /* This buffer will be used to contain the data in the file. */ 3420 if ((encrypted = sshbuf_new()) == NULL) { 3421 r = SSH_ERR_ALLOC_FAIL; 3422 goto out; 3423 } 3424 3425 /* First store keyfile id string. */ 3426 if ((r = sshbuf_put(encrypted, LEGACY_BEGIN, 3427 sizeof(LEGACY_BEGIN))) != 0) 3428 goto out; 3429 3430 /* Store cipher type and "reserved" field. */ 3431 if ((r = sshbuf_put_u8(encrypted, cipher_num)) != 0 || 3432 (r = sshbuf_put_u32(encrypted, 0)) != 0) 3433 goto out; 3434 3435 /* Store public key. This will be in plain text. */ 3436 if ((r = sshbuf_put_u32(encrypted, BN_num_bits(key->rsa->n))) != 0 || 3437 (r = sshbuf_put_bignum1(encrypted, key->rsa->n) != 0) || 3438 (r = sshbuf_put_bignum1(encrypted, key->rsa->e) != 0) || 3439 (r = sshbuf_put_cstring(encrypted, comment) != 0)) 3440 goto out; 3441 3442 /* Allocate space for the private part of the key in the buffer. */ 3443 if ((r = sshbuf_reserve(encrypted, sshbuf_len(buffer), &cp)) != 0) 3444 goto out; 3445 3446 if ((r = cipher_set_key_string(&ciphercontext, cipher, passphrase, 3447 CIPHER_ENCRYPT)) != 0) 3448 goto out; 3449 if ((r = cipher_crypt(&ciphercontext, 0, cp, 3450 sshbuf_ptr(buffer), sshbuf_len(buffer), 0, 0)) != 0) 3451 goto out; 3452 if ((r = cipher_cleanup(&ciphercontext)) != 0) 3453 goto out; 3454 3455 r = sshbuf_putb(blob, encrypted); 3456 3457 out: 3458 explicit_bzero(&ciphercontext, sizeof(ciphercontext)); 3459 explicit_bzero(buf, sizeof(buf)); 3460 if (buffer != NULL) 3461 sshbuf_free(buffer); 3462 if (encrypted != NULL) 3463 sshbuf_free(encrypted); 3464 3465 return r; 3466 } 3467 #endif /* WITH_SSH1 */ 3468 3469 #ifdef WITH_OPENSSL 3470 /* convert SSH v2 key in OpenSSL PEM format */ 3471 static int 3472 sshkey_private_pem_to_blob(struct sshkey *key, struct sshbuf *blob, 3473 const char *_passphrase, const char *comment) 3474 { 3475 int success, r; 3476 int blen, len = strlen(_passphrase); 3477 u_char *passphrase = (len > 0) ? (u_char *)_passphrase : NULL; 3478 const EVP_CIPHER *cipher = (len > 0) ? EVP_aes_128_cbc() : NULL; 3479 const u_char *bptr; 3480 BIO *bio = NULL; 3481 3482 if (len > 0 && len <= 4) 3483 return SSH_ERR_PASSPHRASE_TOO_SHORT; 3484 if ((bio = BIO_new(BIO_s_mem())) == NULL) 3485 return SSH_ERR_ALLOC_FAIL; 3486 3487 switch (key->type) { 3488 case KEY_DSA: 3489 success = PEM_write_bio_DSAPrivateKey(bio, key->dsa, 3490 cipher, passphrase, len, NULL, NULL); 3491 break; 3492 case KEY_ECDSA: 3493 success = PEM_write_bio_ECPrivateKey(bio, key->ecdsa, 3494 cipher, passphrase, len, NULL, NULL); 3495 break; 3496 case KEY_RSA: 3497 success = PEM_write_bio_RSAPrivateKey(bio, key->rsa, 3498 cipher, passphrase, len, NULL, NULL); 3499 break; 3500 default: 3501 success = 0; 3502 break; 3503 } 3504 if (success == 0) { 3505 r = SSH_ERR_LIBCRYPTO_ERROR; 3506 goto out; 3507 } 3508 if ((blen = BIO_get_mem_data(bio, &bptr)) <= 0) { 3509 r = SSH_ERR_INTERNAL_ERROR; 3510 goto out; 3511 } 3512 if ((r = sshbuf_put(blob, bptr, blen)) != 0) 3513 goto out; 3514 r = 0; 3515 out: 3516 BIO_free(bio); 3517 return r; 3518 } 3519 #endif /* WITH_OPENSSL */ 3520 3521 /* Serialise "key" to buffer "blob" */ 3522 int 3523 sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob, 3524 const char *passphrase, const char *comment, 3525 int force_new_format, const char *new_format_cipher, int new_format_rounds) 3526 { 3527 switch (key->type) { 3528 #ifdef WITH_SSH1 3529 case KEY_RSA1: 3530 return sshkey_private_rsa1_to_blob(key, blob, 3531 passphrase, comment); 3532 #endif /* WITH_SSH1 */ 3533 #ifdef WITH_OPENSSL 3534 case KEY_DSA: 3535 case KEY_ECDSA: 3536 case KEY_RSA: 3537 if (force_new_format) { 3538 return sshkey_private_to_blob2(key, blob, passphrase, 3539 comment, new_format_cipher, new_format_rounds); 3540 } 3541 return sshkey_private_pem_to_blob(key, blob, 3542 passphrase, comment); 3543 #endif /* WITH_OPENSSL */ 3544 case KEY_ED25519: 3545 return sshkey_private_to_blob2(key, blob, passphrase, 3546 comment, new_format_cipher, new_format_rounds); 3547 default: 3548 return SSH_ERR_KEY_TYPE_UNKNOWN; 3549 } 3550 } 3551 3552 #ifdef WITH_SSH1 3553 /* 3554 * Parse the public, unencrypted portion of a RSA1 key. 3555 */ 3556 int 3557 sshkey_parse_public_rsa1_fileblob(struct sshbuf *blob, 3558 struct sshkey **keyp, char **commentp) 3559 { 3560 int r; 3561 struct sshkey *pub = NULL; 3562 struct sshbuf *copy = NULL; 3563 3564 if (keyp != NULL) 3565 *keyp = NULL; 3566 if (commentp != NULL) 3567 *commentp = NULL; 3568 3569 /* Check that it is at least big enough to contain the ID string. */ 3570 if (sshbuf_len(blob) < sizeof(LEGACY_BEGIN)) 3571 return SSH_ERR_INVALID_FORMAT; 3572 3573 /* 3574 * Make sure it begins with the id string. Consume the id string 3575 * from the buffer. 3576 */ 3577 if (memcmp(sshbuf_ptr(blob), LEGACY_BEGIN, sizeof(LEGACY_BEGIN)) != 0) 3578 return SSH_ERR_INVALID_FORMAT; 3579 /* Make a working copy of the keyblob and skip past the magic */ 3580 if ((copy = sshbuf_fromb(blob)) == NULL) 3581 return SSH_ERR_ALLOC_FAIL; 3582 if ((r = sshbuf_consume(copy, sizeof(LEGACY_BEGIN))) != 0) 3583 goto out; 3584 3585 /* Skip cipher type, reserved data and key bits. */ 3586 if ((r = sshbuf_get_u8(copy, NULL)) != 0 || /* cipher type */ 3587 (r = sshbuf_get_u32(copy, NULL)) != 0 || /* reserved */ 3588 (r = sshbuf_get_u32(copy, NULL)) != 0) /* key bits */ 3589 goto out; 3590 3591 /* Read the public key from the buffer. */ 3592 if ((pub = sshkey_new(KEY_RSA1)) == NULL || 3593 (r = sshbuf_get_bignum1(copy, pub->rsa->n)) != 0 || 3594 (r = sshbuf_get_bignum1(copy, pub->rsa->e)) != 0) 3595 goto out; 3596 3597 /* Finally, the comment */ 3598 if ((r = sshbuf_get_string(copy, (u_char**)commentp, NULL)) != 0) 3599 goto out; 3600 3601 /* The encrypted private part is not parsed by this function. */ 3602 3603 r = 0; 3604 if (keyp != NULL) 3605 *keyp = pub; 3606 else 3607 sshkey_free(pub); 3608 pub = NULL; 3609 3610 out: 3611 if (copy != NULL) 3612 sshbuf_free(copy); 3613 if (pub != NULL) 3614 sshkey_free(pub); 3615 return r; 3616 } 3617 3618 static int 3619 sshkey_parse_private_rsa1(struct sshbuf *blob, const char *passphrase, 3620 struct sshkey **keyp, char **commentp) 3621 { 3622 int r; 3623 u_int16_t check1, check2; 3624 u_int8_t cipher_type; 3625 struct sshbuf *decrypted = NULL, *copy = NULL; 3626 u_char *cp; 3627 char *comment = NULL; 3628 struct sshcipher_ctx ciphercontext; 3629 const struct sshcipher *cipher; 3630 struct sshkey *prv = NULL; 3631 3632 *keyp = NULL; 3633 if (commentp != NULL) 3634 *commentp = NULL; 3635 3636 /* Check that it is at least big enough to contain the ID string. */ 3637 if (sshbuf_len(blob) < sizeof(LEGACY_BEGIN)) 3638 return SSH_ERR_INVALID_FORMAT; 3639 3640 /* 3641 * Make sure it begins with the id string. Consume the id string 3642 * from the buffer. 3643 */ 3644 if (memcmp(sshbuf_ptr(blob), LEGACY_BEGIN, sizeof(LEGACY_BEGIN)) != 0) 3645 return SSH_ERR_INVALID_FORMAT; 3646 3647 if ((prv = sshkey_new_private(KEY_RSA1)) == NULL) { 3648 r = SSH_ERR_ALLOC_FAIL; 3649 goto out; 3650 } 3651 if ((copy = sshbuf_fromb(blob)) == NULL || 3652 (decrypted = sshbuf_new()) == NULL) { 3653 r = SSH_ERR_ALLOC_FAIL; 3654 goto out; 3655 } 3656 if ((r = sshbuf_consume(copy, sizeof(LEGACY_BEGIN))) != 0) 3657 goto out; 3658 3659 /* Read cipher type. */ 3660 if ((r = sshbuf_get_u8(copy, &cipher_type)) != 0 || 3661 (r = sshbuf_get_u32(copy, NULL)) != 0) /* reserved */ 3662 goto out; 3663 3664 /* Read the public key and comment from the buffer. */ 3665 if ((r = sshbuf_get_u32(copy, NULL)) != 0 || /* key bits */ 3666 (r = sshbuf_get_bignum1(copy, prv->rsa->n)) != 0 || 3667 (r = sshbuf_get_bignum1(copy, prv->rsa->e)) != 0 || 3668 (r = sshbuf_get_cstring(copy, &comment, NULL)) != 0) 3669 goto out; 3670 3671 /* Check that it is a supported cipher. */ 3672 cipher = cipher_by_number(cipher_type); 3673 if (cipher == NULL) { 3674 r = SSH_ERR_KEY_UNKNOWN_CIPHER; 3675 goto out; 3676 } 3677 /* Initialize space for decrypted data. */ 3678 if ((r = sshbuf_reserve(decrypted, sshbuf_len(copy), &cp)) != 0) 3679 goto out; 3680 3681 /* Rest of the buffer is encrypted. Decrypt it using the passphrase. */ 3682 if ((r = cipher_set_key_string(&ciphercontext, cipher, passphrase, 3683 CIPHER_DECRYPT)) != 0) 3684 goto out; 3685 if ((r = cipher_crypt(&ciphercontext, 0, cp, 3686 sshbuf_ptr(copy), sshbuf_len(copy), 0, 0)) != 0) { 3687 cipher_cleanup(&ciphercontext); 3688 goto out; 3689 } 3690 if ((r = cipher_cleanup(&ciphercontext)) != 0) 3691 goto out; 3692 3693 if ((r = sshbuf_get_u16(decrypted, &check1)) != 0 || 3694 (r = sshbuf_get_u16(decrypted, &check2)) != 0) 3695 goto out; 3696 if (check1 != check2) { 3697 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3698 goto out; 3699 } 3700 3701 /* Read the rest of the private key. */ 3702 if ((r = sshbuf_get_bignum1(decrypted, prv->rsa->d)) != 0 || 3703 (r = sshbuf_get_bignum1(decrypted, prv->rsa->iqmp)) != 0 || 3704 (r = sshbuf_get_bignum1(decrypted, prv->rsa->q)) != 0 || 3705 (r = sshbuf_get_bignum1(decrypted, prv->rsa->p)) != 0) 3706 goto out; 3707 3708 /* calculate p-1 and q-1 */ 3709 if ((r = rsa_generate_additional_parameters(prv->rsa)) != 0) 3710 goto out; 3711 3712 /* enable blinding */ 3713 if (RSA_blinding_on(prv->rsa, NULL) != 1) { 3714 r = SSH_ERR_LIBCRYPTO_ERROR; 3715 goto out; 3716 } 3717 r = 0; 3718 *keyp = prv; 3719 prv = NULL; 3720 if (commentp != NULL) { 3721 *commentp = comment; 3722 comment = NULL; 3723 } 3724 out: 3725 explicit_bzero(&ciphercontext, sizeof(ciphercontext)); 3726 if (comment != NULL) 3727 free(comment); 3728 if (prv != NULL) 3729 sshkey_free(prv); 3730 if (copy != NULL) 3731 sshbuf_free(copy); 3732 if (decrypted != NULL) 3733 sshbuf_free(decrypted); 3734 return r; 3735 } 3736 #endif /* WITH_SSH1 */ 3737 3738 #ifdef WITH_OPENSSL 3739 static int 3740 sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, 3741 const char *passphrase, struct sshkey **keyp) 3742 { 3743 EVP_PKEY *pk = NULL; 3744 struct sshkey *prv = NULL; 3745 BIO *bio = NULL; 3746 int r; 3747 3748 *keyp = NULL; 3749 3750 if ((bio = BIO_new(BIO_s_mem())) == NULL || sshbuf_len(blob) > INT_MAX) 3751 return SSH_ERR_ALLOC_FAIL; 3752 if (BIO_write(bio, sshbuf_ptr(blob), sshbuf_len(blob)) != 3753 (int)sshbuf_len(blob)) { 3754 r = SSH_ERR_ALLOC_FAIL; 3755 goto out; 3756 } 3757 3758 if ((pk = PEM_read_bio_PrivateKey(bio, NULL, NULL, 3759 (char *)passphrase)) == NULL) { 3760 r = SSH_ERR_KEY_WRONG_PASSPHRASE; 3761 goto out; 3762 } 3763 if (pk->type == EVP_PKEY_RSA && 3764 (type == KEY_UNSPEC || type == KEY_RSA)) { 3765 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 3766 r = SSH_ERR_ALLOC_FAIL; 3767 goto out; 3768 } 3769 prv->rsa = EVP_PKEY_get1_RSA(pk); 3770 prv->type = KEY_RSA; 3771 #ifdef DEBUG_PK 3772 RSA_print_fp(stderr, prv->rsa, 8); 3773 #endif 3774 if (RSA_blinding_on(prv->rsa, NULL) != 1) { 3775 r = SSH_ERR_LIBCRYPTO_ERROR; 3776 goto out; 3777 } 3778 } else if (pk->type == EVP_PKEY_DSA && 3779 (type == KEY_UNSPEC || type == KEY_DSA)) { 3780 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 3781 r = SSH_ERR_ALLOC_FAIL; 3782 goto out; 3783 } 3784 prv->dsa = EVP_PKEY_get1_DSA(pk); 3785 prv->type = KEY_DSA; 3786 #ifdef DEBUG_PK 3787 DSA_print_fp(stderr, prv->dsa, 8); 3788 #endif 3789 } else if (pk->type == EVP_PKEY_EC && 3790 (type == KEY_UNSPEC || type == KEY_ECDSA)) { 3791 if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) { 3792 r = SSH_ERR_ALLOC_FAIL; 3793 goto out; 3794 } 3795 prv->ecdsa = EVP_PKEY_get1_EC_KEY(pk); 3796 prv->type = KEY_ECDSA; 3797 prv->ecdsa_nid = sshkey_ecdsa_key_to_nid(prv->ecdsa); 3798 if (prv->ecdsa_nid == -1 || 3799 sshkey_curve_nid_to_name(prv->ecdsa_nid) == NULL || 3800 sshkey_ec_validate_public(EC_KEY_get0_group(prv->ecdsa), 3801 EC_KEY_get0_public_key(prv->ecdsa)) != 0 || 3802 sshkey_ec_validate_private(prv->ecdsa) != 0) { 3803 r = SSH_ERR_INVALID_FORMAT; 3804 goto out; 3805 } 3806 #ifdef DEBUG_PK 3807 if (prv != NULL && prv->ecdsa != NULL) 3808 sshkey_dump_ec_key(prv->ecdsa); 3809 #endif 3810 } else { 3811 r = SSH_ERR_INVALID_FORMAT; 3812 goto out; 3813 } 3814 r = 0; 3815 *keyp = prv; 3816 prv = NULL; 3817 out: 3818 BIO_free(bio); 3819 if (pk != NULL) 3820 EVP_PKEY_free(pk); 3821 if (prv != NULL) 3822 sshkey_free(prv); 3823 return r; 3824 } 3825 #endif /* WITH_OPENSSL */ 3826 3827 int 3828 sshkey_parse_private_fileblob_type(struct sshbuf *blob, int type, 3829 const char *passphrase, struct sshkey **keyp, char **commentp) 3830 { 3831 int r; 3832 3833 *keyp = NULL; 3834 if (commentp != NULL) 3835 *commentp = NULL; 3836 3837 switch (type) { 3838 #ifdef WITH_SSH1 3839 case KEY_RSA1: 3840 return sshkey_parse_private_rsa1(blob, passphrase, 3841 keyp, commentp); 3842 #endif /* WITH_SSH1 */ 3843 #ifdef WITH_OPENSSL 3844 case KEY_DSA: 3845 case KEY_ECDSA: 3846 case KEY_RSA: 3847 return sshkey_parse_private_pem_fileblob(blob, type, 3848 passphrase, keyp); 3849 #endif /* WITH_OPENSSL */ 3850 case KEY_ED25519: 3851 return sshkey_parse_private2(blob, type, passphrase, 3852 keyp, commentp); 3853 case KEY_UNSPEC: 3854 if ((r = sshkey_parse_private2(blob, type, passphrase, keyp, 3855 commentp)) == 0) 3856 return 0; 3857 #ifdef WITH_OPENSSL 3858 return sshkey_parse_private_pem_fileblob(blob, type, 3859 passphrase, keyp); 3860 #else 3861 return SSH_ERR_INVALID_FORMAT; 3862 #endif /* WITH_OPENSSL */ 3863 default: 3864 return SSH_ERR_KEY_TYPE_UNKNOWN; 3865 } 3866 } 3867 3868 int 3869 sshkey_parse_private_fileblob(struct sshbuf *buffer, const char *passphrase, 3870 const char *filename, struct sshkey **keyp, char **commentp) 3871 { 3872 int r; 3873 3874 if (keyp != NULL) 3875 *keyp = NULL; 3876 if (commentp != NULL) 3877 *commentp = NULL; 3878 3879 #ifdef WITH_SSH1 3880 /* it's a SSH v1 key if the public key part is readable */ 3881 if ((r = sshkey_parse_public_rsa1_fileblob(buffer, NULL, NULL)) == 0) { 3882 return sshkey_parse_private_fileblob_type(buffer, KEY_RSA1, 3883 passphrase, keyp, commentp); 3884 } 3885 #endif /* WITH_SSH1 */ 3886 if ((r = sshkey_parse_private_fileblob_type(buffer, KEY_UNSPEC, 3887 passphrase, keyp, commentp)) == 0) 3888 return 0; 3889 return r; 3890 } 3891