xref: /openssh-portable/sshsig.c (revision 7a92a324)
1 /* $OpenBSD: sshsig.c,v 1.20 2021/01/31 10:50:10 dtucker Exp $ */
2 /*
3  * Copyright (c) 2019 Google LLC
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include "includes.h"
19 
20 #include <stdio.h>
21 #include <stdlib.h>
22 #include <stdarg.h>
23 #include <errno.h>
24 #include <string.h>
25 #include <unistd.h>
26 
27 #include "authfd.h"
28 #include "authfile.h"
29 #include "log.h"
30 #include "misc.h"
31 #include "sshbuf.h"
32 #include "sshsig.h"
33 #include "ssherr.h"
34 #include "sshkey.h"
35 #include "match.h"
36 #include "digest.h"
37 
38 #define SIG_VERSION		0x01
39 #define MAGIC_PREAMBLE		"SSHSIG"
40 #define MAGIC_PREAMBLE_LEN	(sizeof(MAGIC_PREAMBLE) - 1)
41 #define BEGIN_SIGNATURE		"-----BEGIN SSH SIGNATURE-----\n"
42 #define END_SIGNATURE		"-----END SSH SIGNATURE-----"
43 #define RSA_SIGN_ALG		"rsa-sha2-512" /* XXX maybe make configurable */
44 #define RSA_SIGN_ALLOWED	"rsa-sha2-512,rsa-sha2-256"
45 #define HASHALG_DEFAULT		"sha512" /* XXX maybe make configurable */
46 #define HASHALG_ALLOWED		"sha256,sha512"
47 
48 int
sshsig_armor(const struct sshbuf * blob,struct sshbuf ** out)49 sshsig_armor(const struct sshbuf *blob, struct sshbuf **out)
50 {
51 	struct sshbuf *buf = NULL;
52 	int r = SSH_ERR_INTERNAL_ERROR;
53 
54 	*out = NULL;
55 
56 	if ((buf = sshbuf_new()) == NULL) {
57 		error_f("sshbuf_new failed");
58 		r = SSH_ERR_ALLOC_FAIL;
59 		goto out;
60 	}
61 
62 	if ((r = sshbuf_put(buf, BEGIN_SIGNATURE,
63 	    sizeof(BEGIN_SIGNATURE)-1)) != 0) {
64 		error_fr(r, "sshbuf_putf");
65 		goto out;
66 	}
67 
68 	if ((r = sshbuf_dtob64(blob, buf, 1)) != 0) {
69 		error_fr(r, "base64 encode signature");
70 		goto out;
71 	}
72 
73 	if ((r = sshbuf_put(buf, END_SIGNATURE,
74 	    sizeof(END_SIGNATURE)-1)) != 0 ||
75 	    (r = sshbuf_put_u8(buf, '\n')) != 0) {
76 		error_fr(r, "sshbuf_put");
77 		goto out;
78 	}
79 	/* success */
80 	*out = buf;
81 	buf = NULL; /* transferred */
82 	r = 0;
83  out:
84 	sshbuf_free(buf);
85 	return r;
86 }
87 
88 int
sshsig_dearmor(struct sshbuf * sig,struct sshbuf ** out)89 sshsig_dearmor(struct sshbuf *sig, struct sshbuf **out)
90 {
91 	int r;
92 	size_t eoffset = 0;
93 	struct sshbuf *buf = NULL;
94 	struct sshbuf *sbuf = NULL;
95 	char *b64 = NULL;
96 
97 	if ((sbuf = sshbuf_fromb(sig)) == NULL) {
98 		error_f("sshbuf_fromb failed");
99 		return SSH_ERR_ALLOC_FAIL;
100 	}
101 
102 	if ((r = sshbuf_cmp(sbuf, 0,
103 	    BEGIN_SIGNATURE, sizeof(BEGIN_SIGNATURE)-1)) != 0) {
104 		error("Couldn't parse signature: missing header");
105 		goto done;
106 	}
107 
108 	if ((r = sshbuf_consume(sbuf, sizeof(BEGIN_SIGNATURE)-1)) != 0) {
109 		error_fr(r, "consume");
110 		goto done;
111 	}
112 
113 	if ((r = sshbuf_find(sbuf, 0, "\n" END_SIGNATURE,
114 	    sizeof("\n" END_SIGNATURE)-1, &eoffset)) != 0) {
115 		error("Couldn't parse signature: missing footer");
116 		goto done;
117 	}
118 
119 	if ((r = sshbuf_consume_end(sbuf, sshbuf_len(sbuf)-eoffset)) != 0) {
120 		error_fr(r, "consume");
121 		goto done;
122 	}
123 
124 	if ((b64 = sshbuf_dup_string(sbuf)) == NULL) {
125 		error_f("sshbuf_dup_string failed");
126 		r = SSH_ERR_ALLOC_FAIL;
127 		goto done;
128 	}
129 
130 	if ((buf = sshbuf_new()) == NULL) {
131 		error_f("sshbuf_new() failed");
132 		r = SSH_ERR_ALLOC_FAIL;
133 		goto done;
134 	}
135 
136 	if ((r = sshbuf_b64tod(buf, b64)) != 0) {
137 		error_fr(r, "decode base64");
138 		goto done;
139 	}
140 
141 	/* success */
142 	*out = buf;
143 	r = 0;
144 	buf = NULL; /* transferred */
145 done:
146 	sshbuf_free(buf);
147 	sshbuf_free(sbuf);
148 	free(b64);
149 	return r;
150 }
151 
152 static int
sshsig_wrap_sign(struct sshkey * key,const char * hashalg,const char * sk_provider,const char * sk_pin,const struct sshbuf * h_message,const char * sig_namespace,struct sshbuf ** out,sshsig_signer * signer,void * signer_ctx)153 sshsig_wrap_sign(struct sshkey *key, const char *hashalg,
154     const char *sk_provider, const char *sk_pin, const struct sshbuf *h_message,
155     const char *sig_namespace, struct sshbuf **out,
156     sshsig_signer *signer, void *signer_ctx)
157 {
158 	int r;
159 	size_t slen = 0;
160 	u_char *sig = NULL;
161 	struct sshbuf *blob = NULL;
162 	struct sshbuf *tosign = NULL;
163 	const char *sign_alg = NULL;
164 
165 	if ((tosign = sshbuf_new()) == NULL ||
166 	    (blob = sshbuf_new()) == NULL) {
167 		error_f("sshbuf_new failed");
168 		r = SSH_ERR_ALLOC_FAIL;
169 		goto done;
170 	}
171 
172 	if ((r = sshbuf_put(tosign, MAGIC_PREAMBLE, MAGIC_PREAMBLE_LEN)) != 0 ||
173 	    (r = sshbuf_put_cstring(tosign, sig_namespace)) != 0 ||
174 	    (r = sshbuf_put_string(tosign, NULL, 0)) != 0 || /* reserved */
175 	    (r = sshbuf_put_cstring(tosign, hashalg)) != 0 ||
176 	    (r = sshbuf_put_stringb(tosign, h_message)) != 0) {
177 		error_fr(r, "assemble message to sign");
178 		goto done;
179 	}
180 
181 	/* If using RSA keys then default to a good signature algorithm */
182 	if (sshkey_type_plain(key->type) == KEY_RSA)
183 		sign_alg = RSA_SIGN_ALG;
184 
185 	if (signer != NULL) {
186 		if ((r = signer(key, &sig, &slen,
187 		    sshbuf_ptr(tosign), sshbuf_len(tosign),
188 		    sign_alg, sk_provider, sk_pin, 0, signer_ctx)) != 0) {
189 			error_r(r, "Couldn't sign message (signer)");
190 			goto done;
191 		}
192 	} else {
193 		if ((r = sshkey_sign(key, &sig, &slen,
194 		    sshbuf_ptr(tosign), sshbuf_len(tosign),
195 		    sign_alg, sk_provider, sk_pin, 0)) != 0) {
196 			error_r(r, "Couldn't sign message");
197 			goto done;
198 		}
199 	}
200 
201 	if ((r = sshbuf_put(blob, MAGIC_PREAMBLE, MAGIC_PREAMBLE_LEN)) != 0 ||
202 	    (r = sshbuf_put_u32(blob, SIG_VERSION)) != 0 ||
203 	    (r = sshkey_puts(key, blob)) != 0 ||
204 	    (r = sshbuf_put_cstring(blob, sig_namespace)) != 0 ||
205 	    (r = sshbuf_put_string(blob, NULL, 0)) != 0 || /* reserved */
206 	    (r = sshbuf_put_cstring(blob, hashalg)) != 0 ||
207 	    (r = sshbuf_put_string(blob, sig, slen)) != 0) {
208 		error_fr(r, "assemble signature object");
209 		goto done;
210 	}
211 
212 	if (out != NULL) {
213 		*out = blob;
214 		blob = NULL;
215 	}
216 	r = 0;
217 done:
218 	free(sig);
219 	sshbuf_free(blob);
220 	sshbuf_free(tosign);
221 	return r;
222 }
223 
224 /* Check preamble and version. */
225 static int
sshsig_parse_preamble(struct sshbuf * buf)226 sshsig_parse_preamble(struct sshbuf *buf)
227 {
228 	int r = SSH_ERR_INTERNAL_ERROR;
229 	uint32_t sversion;
230 
231 	if ((r = sshbuf_cmp(buf, 0, MAGIC_PREAMBLE, MAGIC_PREAMBLE_LEN)) != 0 ||
232 	    (r = sshbuf_consume(buf, (sizeof(MAGIC_PREAMBLE)-1))) != 0 ||
233 	    (r = sshbuf_get_u32(buf, &sversion)) != 0) {
234 		error("Couldn't verify signature: invalid format");
235 		return r;
236 	}
237 
238 	if (sversion > SIG_VERSION) {
239 		error("Signature version %lu is larger than supported "
240 		    "version %u", (unsigned long)sversion, SIG_VERSION);
241 		return SSH_ERR_INVALID_FORMAT;
242 	}
243 	return 0;
244 }
245 
246 static int
sshsig_check_hashalg(const char * hashalg)247 sshsig_check_hashalg(const char *hashalg)
248 {
249 	if (hashalg == NULL ||
250 	    match_pattern_list(hashalg, HASHALG_ALLOWED, 0) == 1)
251 		return 0;
252 	error_f("unsupported hash algorithm \"%.100s\"", hashalg);
253 	return SSH_ERR_SIGN_ALG_UNSUPPORTED;
254 }
255 
256 static int
sshsig_peek_hashalg(struct sshbuf * signature,char ** hashalgp)257 sshsig_peek_hashalg(struct sshbuf *signature, char **hashalgp)
258 {
259 	struct sshbuf *buf = NULL;
260 	char *hashalg = NULL;
261 	int r = SSH_ERR_INTERNAL_ERROR;
262 
263 	if (hashalgp != NULL)
264 		*hashalgp = NULL;
265 	if ((buf = sshbuf_fromb(signature)) == NULL)
266 		return SSH_ERR_ALLOC_FAIL;
267 	if ((r = sshsig_parse_preamble(buf)) != 0)
268 		goto done;
269 	if ((r = sshbuf_get_string_direct(buf, NULL, NULL)) != 0 ||
270 	    (r = sshbuf_get_string_direct(buf, NULL, NULL)) != 0 ||
271 	    (r = sshbuf_get_string(buf, NULL, NULL)) != 0 ||
272 	    (r = sshbuf_get_cstring(buf, &hashalg, NULL)) != 0 ||
273 	    (r = sshbuf_get_string_direct(buf, NULL, NULL)) != 0) {
274 		error_fr(r, "parse signature object");
275 		goto done;
276 	}
277 
278 	/* success */
279 	r = 0;
280 	*hashalgp = hashalg;
281 	hashalg = NULL;
282  done:
283 	free(hashalg);
284 	sshbuf_free(buf);
285 	return r;
286 }
287 
288 static int
sshsig_wrap_verify(struct sshbuf * signature,const char * hashalg,const struct sshbuf * h_message,const char * expect_namespace,struct sshkey ** sign_keyp,struct sshkey_sig_details ** sig_details)289 sshsig_wrap_verify(struct sshbuf *signature, const char *hashalg,
290     const struct sshbuf *h_message, const char *expect_namespace,
291     struct sshkey **sign_keyp, struct sshkey_sig_details **sig_details)
292 {
293 	int r = SSH_ERR_INTERNAL_ERROR;
294 	struct sshbuf *buf = NULL, *toverify = NULL;
295 	struct sshkey *key = NULL;
296 	const u_char *sig;
297 	char *got_namespace = NULL, *sigtype = NULL, *sig_hashalg = NULL;
298 	size_t siglen;
299 
300 	debug_f("verify message length %zu", sshbuf_len(h_message));
301 	if (sig_details != NULL)
302 		*sig_details = NULL;
303 	if (sign_keyp != NULL)
304 		*sign_keyp = NULL;
305 
306 	if ((toverify = sshbuf_new()) == NULL) {
307 		error_f("sshbuf_new failed");
308 		r = SSH_ERR_ALLOC_FAIL;
309 		goto done;
310 	}
311 	if ((r = sshbuf_put(toverify, MAGIC_PREAMBLE,
312 	    MAGIC_PREAMBLE_LEN)) != 0 ||
313 	    (r = sshbuf_put_cstring(toverify, expect_namespace)) != 0 ||
314 	    (r = sshbuf_put_string(toverify, NULL, 0)) != 0 || /* reserved */
315 	    (r = sshbuf_put_cstring(toverify, hashalg)) != 0 ||
316 	    (r = sshbuf_put_stringb(toverify, h_message)) != 0) {
317 		error_fr(r, "assemble message to verify");
318 		goto done;
319 	}
320 
321 	if ((r = sshsig_parse_preamble(signature)) != 0)
322 		goto done;
323 
324 	if ((r = sshkey_froms(signature, &key)) != 0 ||
325 	    (r = sshbuf_get_cstring(signature, &got_namespace, NULL)) != 0 ||
326 	    (r = sshbuf_get_string(signature, NULL, NULL)) != 0 ||
327 	    (r = sshbuf_get_cstring(signature, &sig_hashalg, NULL)) != 0 ||
328 	    (r = sshbuf_get_string_direct(signature, &sig, &siglen)) != 0) {
329 		error_fr(r, "parse signature object");
330 		goto done;
331 	}
332 
333 	if (sshbuf_len(signature) != 0) {
334 		error("Signature contains trailing data");
335 		r = SSH_ERR_INVALID_FORMAT;
336 		goto done;
337 	}
338 
339 	if (strcmp(expect_namespace, got_namespace) != 0) {
340 		error("Couldn't verify signature: namespace does not match");
341 		debug_f("expected namespace \"%s\" received \"%s\"",
342 		    expect_namespace, got_namespace);
343 		r = SSH_ERR_SIGNATURE_INVALID;
344 		goto done;
345 	}
346 	if (strcmp(hashalg, sig_hashalg) != 0) {
347 		error("Couldn't verify signature: hash algorithm mismatch");
348 		debug_f("expected algorithm \"%s\" received \"%s\"",
349 		    hashalg, sig_hashalg);
350 		r = SSH_ERR_SIGNATURE_INVALID;
351 		goto done;
352 	}
353 	/* Ensure that RSA keys use an acceptable signature algorithm */
354 	if (sshkey_type_plain(key->type) == KEY_RSA) {
355 		if ((r = sshkey_get_sigtype(sig, siglen, &sigtype)) != 0) {
356 			error_r(r, "Couldn't verify signature: unable to get "
357 			    "signature type");
358 			goto done;
359 		}
360 		if (match_pattern_list(sigtype, RSA_SIGN_ALLOWED, 0) != 1) {
361 			error("Couldn't verify signature: unsupported RSA "
362 			    "signature algorithm %s", sigtype);
363 			r = SSH_ERR_SIGN_ALG_UNSUPPORTED;
364 			goto done;
365 		}
366 	}
367 	if ((r = sshkey_verify(key, sig, siglen, sshbuf_ptr(toverify),
368 	    sshbuf_len(toverify), NULL, 0, sig_details)) != 0) {
369 		error_r(r, "Signature verification failed");
370 		goto done;
371 	}
372 
373 	/* success */
374 	r = 0;
375 	if (sign_keyp != NULL) {
376 		*sign_keyp = key;
377 		key = NULL; /* transferred */
378 	}
379 done:
380 	free(got_namespace);
381 	free(sigtype);
382 	free(sig_hashalg);
383 	sshbuf_free(buf);
384 	sshbuf_free(toverify);
385 	sshkey_free(key);
386 	return r;
387 }
388 
389 static int
hash_buffer(const struct sshbuf * m,const char * hashalg,struct sshbuf ** bp)390 hash_buffer(const struct sshbuf *m, const char *hashalg, struct sshbuf **bp)
391 {
392 	char *hex, hash[SSH_DIGEST_MAX_LENGTH];
393 	int alg, r = SSH_ERR_INTERNAL_ERROR;
394 	struct sshbuf *b = NULL;
395 
396 	*bp = NULL;
397 	memset(hash, 0, sizeof(hash));
398 
399 	if ((r = sshsig_check_hashalg(hashalg)) != 0)
400 		return r;
401 	if ((alg = ssh_digest_alg_by_name(hashalg)) == -1) {
402 		error_f("can't look up hash algorithm %s", hashalg);
403 		return SSH_ERR_INTERNAL_ERROR;
404 	}
405 	if ((r = ssh_digest_buffer(alg, m, hash, sizeof(hash))) != 0) {
406 		error_fr(r, "ssh_digest_buffer");
407 		return r;
408 	}
409 	if ((hex = tohex(hash, ssh_digest_bytes(alg))) != NULL) {
410 		debug3_f("final hash: %s", hex);
411 		freezero(hex, strlen(hex));
412 	}
413 	if ((b = sshbuf_new()) == NULL) {
414 		r = SSH_ERR_ALLOC_FAIL;
415 		goto out;
416 	}
417 	if ((r = sshbuf_put(b, hash, ssh_digest_bytes(alg))) != 0) {
418 		error_fr(r, "sshbuf_put");
419 		goto out;
420 	}
421 	*bp = b;
422 	b = NULL; /* transferred */
423 	/* success */
424 	r = 0;
425  out:
426 	sshbuf_free(b);
427 	explicit_bzero(hash, sizeof(hash));
428 	return r;
429 }
430 
431 int
sshsig_signb(struct sshkey * key,const char * hashalg,const char * sk_provider,const char * sk_pin,const struct sshbuf * message,const char * sig_namespace,struct sshbuf ** out,sshsig_signer * signer,void * signer_ctx)432 sshsig_signb(struct sshkey *key, const char *hashalg,
433     const char *sk_provider, const char *sk_pin,
434     const struct sshbuf *message, const char *sig_namespace,
435     struct sshbuf **out, sshsig_signer *signer, void *signer_ctx)
436 {
437 	struct sshbuf *b = NULL;
438 	int r = SSH_ERR_INTERNAL_ERROR;
439 
440 	if (hashalg == NULL)
441 		hashalg = HASHALG_DEFAULT;
442 	if (out != NULL)
443 		*out = NULL;
444 	if ((r = hash_buffer(message, hashalg, &b)) != 0) {
445 		error_fr(r, "hash buffer");
446 		goto out;
447 	}
448 	if ((r = sshsig_wrap_sign(key, hashalg, sk_provider, sk_pin, b,
449 	    sig_namespace, out, signer, signer_ctx)) != 0)
450 		goto out;
451 	/* success */
452 	r = 0;
453  out:
454 	sshbuf_free(b);
455 	return r;
456 }
457 
458 int
sshsig_verifyb(struct sshbuf * signature,const struct sshbuf * message,const char * expect_namespace,struct sshkey ** sign_keyp,struct sshkey_sig_details ** sig_details)459 sshsig_verifyb(struct sshbuf *signature, const struct sshbuf *message,
460     const char *expect_namespace, struct sshkey **sign_keyp,
461     struct sshkey_sig_details **sig_details)
462 {
463 	struct sshbuf *b = NULL;
464 	int r = SSH_ERR_INTERNAL_ERROR;
465 	char *hashalg = NULL;
466 
467 	if (sig_details != NULL)
468 		*sig_details = NULL;
469 	if (sign_keyp != NULL)
470 		*sign_keyp = NULL;
471 	if ((r = sshsig_peek_hashalg(signature, &hashalg)) != 0)
472 		return r;
473 	debug_f("signature made with hash \"%s\"", hashalg);
474 	if ((r = hash_buffer(message, hashalg, &b)) != 0) {
475 		error_fr(r, "hash buffer");
476 		goto out;
477 	}
478 	if ((r = sshsig_wrap_verify(signature, hashalg, b, expect_namespace,
479 	    sign_keyp, sig_details)) != 0)
480 		goto out;
481 	/* success */
482 	r = 0;
483  out:
484 	sshbuf_free(b);
485 	free(hashalg);
486 	return r;
487 }
488 
489 static int
hash_file(int fd,const char * hashalg,struct sshbuf ** bp)490 hash_file(int fd, const char *hashalg, struct sshbuf **bp)
491 {
492 	char *hex, rbuf[8192], hash[SSH_DIGEST_MAX_LENGTH];
493 	ssize_t n, total = 0;
494 	struct ssh_digest_ctx *ctx;
495 	int alg, oerrno, r = SSH_ERR_INTERNAL_ERROR;
496 	struct sshbuf *b = NULL;
497 
498 	*bp = NULL;
499 	memset(hash, 0, sizeof(hash));
500 
501 	if ((r = sshsig_check_hashalg(hashalg)) != 0)
502 		return r;
503 	if ((alg = ssh_digest_alg_by_name(hashalg)) == -1) {
504 		error_f("can't look up hash algorithm %s", hashalg);
505 		return SSH_ERR_INTERNAL_ERROR;
506 	}
507 	if ((ctx = ssh_digest_start(alg)) == NULL) {
508 		error_f("ssh_digest_start failed");
509 		return SSH_ERR_INTERNAL_ERROR;
510 	}
511 	for (;;) {
512 		if ((n = read(fd, rbuf, sizeof(rbuf))) == -1) {
513 			if (errno == EINTR || errno == EAGAIN)
514 				continue;
515 			oerrno = errno;
516 			error_f("read: %s", strerror(errno));
517 			ssh_digest_free(ctx);
518 			errno = oerrno;
519 			r = SSH_ERR_SYSTEM_ERROR;
520 			goto out;
521 		} else if (n == 0) {
522 			debug2_f("hashed %zu bytes", total);
523 			break; /* EOF */
524 		}
525 		total += (size_t)n;
526 		if ((r = ssh_digest_update(ctx, rbuf, (size_t)n)) != 0) {
527 			error_fr(r, "ssh_digest_update");
528 			goto out;
529 		}
530 	}
531 	if ((r = ssh_digest_final(ctx, hash, sizeof(hash))) != 0) {
532 		error_fr(r, "ssh_digest_final");
533 		goto out;
534 	}
535 	if ((hex = tohex(hash, ssh_digest_bytes(alg))) != NULL) {
536 		debug3_f("final hash: %s", hex);
537 		freezero(hex, strlen(hex));
538 	}
539 	if ((b = sshbuf_new()) == NULL) {
540 		r = SSH_ERR_ALLOC_FAIL;
541 		goto out;
542 	}
543 	if ((r = sshbuf_put(b, hash, ssh_digest_bytes(alg))) != 0) {
544 		error_fr(r, "sshbuf_put");
545 		goto out;
546 	}
547 	*bp = b;
548 	b = NULL; /* transferred */
549 	/* success */
550 	r = 0;
551  out:
552 	sshbuf_free(b);
553 	ssh_digest_free(ctx);
554 	explicit_bzero(hash, sizeof(hash));
555 	return r;
556 }
557 
558 int
sshsig_sign_fd(struct sshkey * key,const char * hashalg,const char * sk_provider,const char * sk_pin,int fd,const char * sig_namespace,struct sshbuf ** out,sshsig_signer * signer,void * signer_ctx)559 sshsig_sign_fd(struct sshkey *key, const char *hashalg,
560     const char *sk_provider, const char *sk_pin,
561     int fd, const char *sig_namespace, struct sshbuf **out,
562     sshsig_signer *signer, void *signer_ctx)
563 {
564 	struct sshbuf *b = NULL;
565 	int r = SSH_ERR_INTERNAL_ERROR;
566 
567 	if (hashalg == NULL)
568 		hashalg = HASHALG_DEFAULT;
569 	if (out != NULL)
570 		*out = NULL;
571 	if ((r = hash_file(fd, hashalg, &b)) != 0) {
572 		error_fr(r, "hash_file");
573 		return r;
574 	}
575 	if ((r = sshsig_wrap_sign(key, hashalg, sk_provider, sk_pin, b,
576 	    sig_namespace, out, signer, signer_ctx)) != 0)
577 		goto out;
578 	/* success */
579 	r = 0;
580  out:
581 	sshbuf_free(b);
582 	return r;
583 }
584 
585 int
sshsig_verify_fd(struct sshbuf * signature,int fd,const char * expect_namespace,struct sshkey ** sign_keyp,struct sshkey_sig_details ** sig_details)586 sshsig_verify_fd(struct sshbuf *signature, int fd,
587     const char *expect_namespace, struct sshkey **sign_keyp,
588     struct sshkey_sig_details **sig_details)
589 {
590 	struct sshbuf *b = NULL;
591 	int r = SSH_ERR_INTERNAL_ERROR;
592 	char *hashalg = NULL;
593 
594 	if (sig_details != NULL)
595 		*sig_details = NULL;
596 	if (sign_keyp != NULL)
597 		*sign_keyp = NULL;
598 	if ((r = sshsig_peek_hashalg(signature, &hashalg)) != 0)
599 		return r;
600 	debug_f("signature made with hash \"%s\"", hashalg);
601 	if ((r = hash_file(fd, hashalg, &b)) != 0) {
602 		error_fr(r, "hash_file");
603 		goto out;
604 	}
605 	if ((r = sshsig_wrap_verify(signature, hashalg, b, expect_namespace,
606 	    sign_keyp, sig_details)) != 0)
607 		goto out;
608 	/* success */
609 	r = 0;
610  out:
611 	sshbuf_free(b);
612 	free(hashalg);
613 	return r;
614 }
615 
616 struct sshsigopt {
617 	int ca;
618 	char *namespaces;
619 };
620 
621 struct sshsigopt *
sshsigopt_parse(const char * opts,const char * path,u_long linenum,const char ** errstrp)622 sshsigopt_parse(const char *opts, const char *path, u_long linenum,
623     const char **errstrp)
624 {
625 	struct sshsigopt *ret;
626 	int r;
627 	const char *errstr = NULL;
628 
629 	if ((ret = calloc(1, sizeof(*ret))) == NULL)
630 		return NULL;
631 	if (opts == NULL || *opts == '\0')
632 		return ret; /* Empty options yields empty options :) */
633 
634 	while (*opts && *opts != ' ' && *opts != '\t') {
635 		/* flag options */
636 		if ((r = opt_flag("cert-authority", 0, &opts)) != -1) {
637 			ret->ca = 1;
638 		} else if (opt_match(&opts, "namespaces")) {
639 			if (ret->namespaces != NULL) {
640 				errstr = "multiple \"namespaces\" clauses";
641 				goto fail;
642 			}
643 			ret->namespaces = opt_dequote(&opts, &errstr);
644 			if (ret->namespaces == NULL)
645 				goto fail;
646 		}
647 		/*
648 		 * Skip the comma, and move to the next option
649 		 * (or break out if there are no more).
650 		 */
651 		if (*opts == '\0' || *opts == ' ' || *opts == '\t')
652 			break;		/* End of options. */
653 		/* Anything other than a comma is an unknown option */
654 		if (*opts != ',') {
655 			errstr = "unknown key option";
656 			goto fail;
657 		}
658 		opts++;
659 		if (*opts == '\0') {
660 			errstr = "unexpected end-of-options";
661 			goto fail;
662 		}
663 	}
664 	/* success */
665 	return ret;
666  fail:
667 	if (errstrp != NULL)
668 		*errstrp = errstr;
669 	sshsigopt_free(ret);
670 	return NULL;
671 }
672 
673 void
sshsigopt_free(struct sshsigopt * opts)674 sshsigopt_free(struct sshsigopt *opts)
675 {
676 	if (opts == NULL)
677 		return;
678 	free(opts->namespaces);
679 	free(opts);
680 }
681 
682 static int
parse_principals_key_and_options(const char * path,u_long linenum,char * line,const char * required_principal,char ** principalsp,struct sshkey ** keyp,struct sshsigopt ** sigoptsp)683 parse_principals_key_and_options(const char *path, u_long linenum, char *line,
684     const char *required_principal, char **principalsp, struct sshkey **keyp,
685     struct sshsigopt **sigoptsp)
686 {
687 	char *opts = NULL, *tmp, *cp, *principals = NULL;
688 	const char *reason = NULL;
689 	struct sshsigopt *sigopts = NULL;
690 	struct sshkey *key = NULL;
691 	int r = SSH_ERR_INTERNAL_ERROR;
692 
693 	if (principalsp != NULL)
694 		*principalsp = NULL;
695 	if (sigoptsp != NULL)
696 		*sigoptsp = NULL;
697 	if (keyp != NULL)
698 		*keyp = NULL;
699 
700 	cp = line;
701 	cp = cp + strspn(cp, " \t"); /* skip leading whitespace */
702 	if (*cp == '#' || *cp == '\0')
703 		return SSH_ERR_KEY_NOT_FOUND; /* blank or all-comment line */
704 
705 	/* format: identity[,identity...] [option[,option...]] key */
706 	if ((tmp = strdelimw(&cp)) == NULL) {
707 		error("%s:%lu: invalid line", path, linenum);
708 		r = SSH_ERR_INVALID_FORMAT;
709 		goto out;
710 	}
711 	if ((principals = strdup(tmp)) == NULL) {
712 		error_f("strdup failed");
713 		r = SSH_ERR_ALLOC_FAIL;
714 		goto out;
715 	}
716 	/*
717 	 * Bail out early if we're looking for a particular principal and this
718 	 * line does not list it.
719 	 */
720 	if (required_principal != NULL) {
721 		if (match_pattern_list(required_principal,
722 		    principals, 0) != 1) {
723 			/* principal didn't match */
724 			r = SSH_ERR_KEY_NOT_FOUND;
725 			goto out;
726 		}
727 		debug_f("%s:%lu: matched principal \"%s\"",
728 		    path, linenum, required_principal);
729 	}
730 
731 	if ((key = sshkey_new(KEY_UNSPEC)) == NULL) {
732 		error_f("sshkey_new failed");
733 		r = SSH_ERR_ALLOC_FAIL;
734 		goto out;
735 	}
736 	if (sshkey_read(key, &cp) != 0) {
737 		/* no key? Check for options */
738 		opts = cp;
739 		if (sshkey_advance_past_options(&cp) != 0) {
740 			error("%s:%lu: invalid options", path, linenum);
741 			r = SSH_ERR_INVALID_FORMAT;
742 			goto out;
743 		}
744 		*cp++ = '\0';
745 		skip_space(&cp);
746 		if (sshkey_read(key, &cp) != 0) {
747 			error("%s:%lu: invalid key", path, linenum);
748 			r = SSH_ERR_INVALID_FORMAT;
749 			goto out;
750 		}
751 	}
752 	debug3("%s:%lu: options %s", path, linenum, opts == NULL ? "" : opts);
753 	if ((sigopts = sshsigopt_parse(opts, path, linenum, &reason)) == NULL) {
754 		error("%s:%lu: bad options: %s", path, linenum, reason);
755 		r = SSH_ERR_INVALID_FORMAT;
756 		goto out;
757 	}
758 	/* success */
759 	if (principalsp != NULL) {
760 		*principalsp = principals;
761 		principals = NULL; /* transferred */
762 	}
763 	if (sigoptsp != NULL) {
764 		*sigoptsp = sigopts;
765 		sigopts = NULL; /* transferred */
766 	}
767 	if (keyp != NULL) {
768 		*keyp = key;
769 		key = NULL; /* transferred */
770 	}
771 	r = 0;
772  out:
773 	free(principals);
774 	sshsigopt_free(sigopts);
775 	sshkey_free(key);
776 	return r;
777 }
778 
779 static int
check_allowed_keys_line(const char * path,u_long linenum,char * line,const struct sshkey * sign_key,const char * principal,const char * sig_namespace)780 check_allowed_keys_line(const char *path, u_long linenum, char *line,
781     const struct sshkey *sign_key, const char *principal,
782     const char *sig_namespace)
783 {
784 	struct sshkey *found_key = NULL;
785 	int r, found = 0;
786 	const char *reason = NULL;
787 	struct sshsigopt *sigopts = NULL;
788 
789 	/* Parse the line */
790 	if ((r = parse_principals_key_and_options(path, linenum, line,
791 	    principal, NULL, &found_key, &sigopts)) != 0) {
792 		/* error already logged */
793 		goto done;
794 	}
795 
796 	/* Check whether options preclude the use of this key */
797 	if (sigopts->namespaces != NULL &&
798 	    match_pattern_list(sig_namespace, sigopts->namespaces, 0) != 1) {
799 		error("%s:%lu: key is not permitted for use in signature "
800 		    "namespace \"%s\"", path, linenum, sig_namespace);
801 		goto done;
802 	}
803 
804 	if (!sigopts->ca && sshkey_equal(found_key, sign_key)) {
805 		/* Exact match of key */
806 		debug("%s:%lu: matched key and principal", path, linenum);
807 		/* success */
808 		found = 1;
809 	} else if (sigopts->ca && sshkey_is_cert(sign_key) &&
810 	    sshkey_equal_public(sign_key->cert->signature_key, found_key)) {
811 		/* Match of certificate's CA key */
812 		if ((r = sshkey_cert_check_authority(sign_key, 0, 1, 0,
813 		    principal, &reason)) != 0) {
814 			error("%s:%lu: certificate not authorized: %s",
815 			    path, linenum, reason);
816 			goto done;
817 		}
818 		debug("%s:%lu: matched certificate CA key", path, linenum);
819 		/* success */
820 		found = 1;
821 	} else {
822 		/* Principal matched but key didn't */
823 		goto done;
824 	}
825  done:
826 	sshkey_free(found_key);
827 	sshsigopt_free(sigopts);
828 	return found ? 0 : SSH_ERR_KEY_NOT_FOUND;
829 }
830 
831 int
sshsig_check_allowed_keys(const char * path,const struct sshkey * sign_key,const char * principal,const char * sig_namespace)832 sshsig_check_allowed_keys(const char *path, const struct sshkey *sign_key,
833     const char *principal, const char *sig_namespace)
834 {
835 	FILE *f = NULL;
836 	char *line = NULL;
837 	size_t linesize = 0;
838 	u_long linenum = 0;
839 	int r = SSH_ERR_INTERNAL_ERROR, oerrno;
840 
841 	/* Check key and principal against file */
842 	if ((f = fopen(path, "r")) == NULL) {
843 		oerrno = errno;
844 		error("Unable to open allowed keys file \"%s\": %s",
845 		    path, strerror(errno));
846 		errno = oerrno;
847 		return SSH_ERR_SYSTEM_ERROR;
848 	}
849 
850 	while (getline(&line, &linesize, f) != -1) {
851 		linenum++;
852 		r = check_allowed_keys_line(path, linenum, line, sign_key,
853 		    principal, sig_namespace);
854 		free(line);
855 		line = NULL;
856 		linesize = 0;
857 		if (r == SSH_ERR_KEY_NOT_FOUND)
858 			continue;
859 		else if (r == 0) {
860 			/* success */
861 			fclose(f);
862 			return 0;
863 		} else
864 			break;
865 	}
866 	/* Either we hit an error parsing or we simply didn't find the key */
867 	fclose(f);
868 	free(line);
869 	return r == 0 ? SSH_ERR_KEY_NOT_FOUND : r;
870 }
871 
872 static int
cert_filter_principals(const char * path,u_long linenum,char ** principalsp,const struct sshkey * cert)873 cert_filter_principals(const char *path, u_long linenum,
874     char **principalsp, const struct sshkey *cert)
875 {
876 	char *cp, *oprincipals, *principals;
877 	const char *reason;
878 	struct sshbuf *nprincipals;
879 	int r = SSH_ERR_INTERNAL_ERROR, success = 0;
880 
881 	oprincipals = principals = *principalsp;
882 	*principalsp = NULL;
883 
884 	if ((nprincipals = sshbuf_new()) == NULL) {
885 		r = SSH_ERR_ALLOC_FAIL;
886 		goto out;
887 	}
888 
889 	while ((cp = strsep(&principals, ",")) != NULL && *cp != '\0') {
890 		if (strcspn(cp, "!?*") != strlen(cp)) {
891 			debug("%s:%lu: principal \"%s\" not authorized: "
892 			    "contains wildcards", path, linenum, cp);
893 			continue;
894 		}
895 		/* Check against principals list in certificate */
896 		if ((r = sshkey_cert_check_authority(cert, 0, 1, 0,
897 		    cp, &reason)) != 0) {
898 			debug("%s:%lu: principal \"%s\" not authorized: %s",
899 			    path, linenum, cp, reason);
900 			continue;
901 		}
902 		if ((r = sshbuf_putf(nprincipals, "%s%s",
903 		    sshbuf_len(nprincipals) != 0 ? "," : "", cp)) != 0) {
904 			error_f("buffer error");
905 			goto out;
906 		}
907 	}
908 	if (sshbuf_len(nprincipals) == 0) {
909 		error("%s:%lu: no valid principals found", path, linenum);
910 		r = SSH_ERR_KEY_CERT_INVALID;
911 		goto out;
912 	}
913 	if ((principals = sshbuf_dup_string(nprincipals)) == NULL) {
914 		error_f("buffer error");
915 		goto out;
916 	}
917 	/* success */
918 	success = 1;
919 	*principalsp = principals;
920  out:
921 	sshbuf_free(nprincipals);
922 	free(oprincipals);
923 	return success ? 0 : r;
924 }
925 
926 static int
get_matching_principals_from_line(const char * path,u_long linenum,char * line,const struct sshkey * sign_key,char ** principalsp)927 get_matching_principals_from_line(const char *path, u_long linenum, char *line,
928     const struct sshkey *sign_key, char **principalsp)
929 {
930 	struct sshkey *found_key = NULL;
931 	char *principals = NULL;
932 	int r, found = 0;
933 	struct sshsigopt *sigopts = NULL;
934 
935 	if (principalsp != NULL)
936 		*principalsp = NULL;
937 
938 	/* Parse the line */
939 	if ((r = parse_principals_key_and_options(path, linenum, line,
940 	    NULL, &principals, &found_key, &sigopts)) != 0) {
941 		/* error already logged */
942 		goto done;
943 	}
944 
945 	if (!sigopts->ca && sshkey_equal(found_key, sign_key)) {
946 		/* Exact match of key */
947 		debug("%s:%lu: matched key", path, linenum);
948 		/* success */
949 		found = 1;
950 	} else if (sigopts->ca && sshkey_is_cert(sign_key) &&
951 	    sshkey_equal_public(sign_key->cert->signature_key, found_key)) {
952 		/* Remove principals listed in file but not allowed by cert */
953 		if ((r = cert_filter_principals(path, linenum,
954 		    &principals, sign_key)) != 0) {
955 			/* error already displayed */
956 			debug_r(r, "%s:%lu: cert_filter_principals",
957 			    path, linenum);
958 			goto done;
959 		}
960 		debug("%s:%lu: matched certificate CA key", path, linenum);
961 		/* success */
962 		found = 1;
963 	} else {
964 		/* Key didn't match */
965 		goto done;
966 	}
967  done:
968 	if (found && principalsp != NULL) {
969 		*principalsp = principals;
970 		principals = NULL; /* transferred */
971 	}
972 	free(principals);
973 	sshkey_free(found_key);
974 	sshsigopt_free(sigopts);
975 	return found ? 0 : SSH_ERR_KEY_NOT_FOUND;
976 }
977 
978 int
sshsig_find_principals(const char * path,const struct sshkey * sign_key,char ** principals)979 sshsig_find_principals(const char *path, const struct sshkey *sign_key,
980     char **principals)
981 {
982 	FILE *f = NULL;
983 	char *line = NULL;
984 	size_t linesize = 0;
985 	u_long linenum = 0;
986 	int r = SSH_ERR_INTERNAL_ERROR, oerrno;
987 
988 	if ((f = fopen(path, "r")) == NULL) {
989 		oerrno = errno;
990 		error("Unable to open allowed keys file \"%s\": %s",
991 		    path, strerror(errno));
992 		errno = oerrno;
993 		return SSH_ERR_SYSTEM_ERROR;
994 	}
995 
996 	while (getline(&line, &linesize, f) != -1) {
997 		linenum++;
998 		r = get_matching_principals_from_line(path, linenum, line,
999 		    sign_key, principals);
1000 		free(line);
1001 		line = NULL;
1002 		linesize = 0;
1003 		if (r == SSH_ERR_KEY_NOT_FOUND)
1004 			continue;
1005 		else if (r == 0) {
1006 			/* success */
1007 			fclose(f);
1008 			return 0;
1009 		} else
1010 			break;
1011 	}
1012 	free(line);
1013 	/* Either we hit an error parsing or we simply didn't find the key */
1014 	if (ferror(f) != 0) {
1015 		oerrno = errno;
1016 		fclose(f);
1017 		error("Unable to read allowed keys file \"%s\": %s",
1018 		    path, strerror(errno));
1019 		errno = oerrno;
1020 		return SSH_ERR_SYSTEM_ERROR;
1021 	}
1022 	fclose(f);
1023 	return r == 0 ? SSH_ERR_KEY_NOT_FOUND : r;
1024 }
1025 
1026 int
sshsig_get_pubkey(struct sshbuf * signature,struct sshkey ** pubkey)1027 sshsig_get_pubkey(struct sshbuf *signature, struct sshkey **pubkey)
1028 {
1029 	struct sshkey *pk = NULL;
1030 	int r = SSH_ERR_SIGNATURE_INVALID;
1031 
1032 	if (pubkey == NULL)
1033 		return SSH_ERR_INTERNAL_ERROR;
1034 	if ((r = sshsig_parse_preamble(signature)) != 0)
1035 		return r;
1036 	if ((r = sshkey_froms(signature, &pk)) != 0)
1037 		return r;
1038 
1039 	*pubkey = pk;
1040 	pk = NULL;
1041 	return 0;
1042 }
1043