Annotation of src/usr.bin/ssh/authfile.c, Revision 1.20
1.1 deraadt 1: /*
1.9 deraadt 2: * Author: Tatu Ylonen <ylo@cs.hut.fi>
3: * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4: * All rights reserved
5: * This file contains functions for reading and writing identity files, and
6: * for reading the passphrase from the user.
1.14 markus 7: *
1.19 deraadt 8: * As far as I am concerned, the code I have written for this software
9: * can be used freely for any purpose. Any derived versions of this
10: * software must be clearly marked as such, and if the derived work is
11: * incompatible with the protocol description in the RFC file, it must be
12: * called by a name other than "ssh" or "Secure Shell".
13: *
14: *
15: * Copyright (c) 2000 Markus Friedl. All rights reserved.
16: *
17: * Redistribution and use in source and binary forms, with or without
18: * modification, are permitted provided that the following conditions
19: * are met:
20: * 1. Redistributions of source code must retain the above copyright
21: * notice, this list of conditions and the following disclaimer.
22: * 2. Redistributions in binary form must reproduce the above copyright
23: * notice, this list of conditions and the following disclaimer in the
24: * documentation and/or other materials provided with the distribution.
25: *
26: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.9 deraadt 36: */
1.1 deraadt 37:
38: #include "includes.h"
1.20 ! markus 39: RCSID("$OpenBSD: authfile.c,v 1.19 2000/09/07 20:27:49 deraadt Exp $");
1.1 deraadt 40:
1.13 markus 41: #include <openssl/bn.h>
1.15 markus 42: #include <openssl/dsa.h>
43: #include <openssl/rsa.h>
44: #include <openssl/pem.h>
45: #include <openssl/evp.h>
46:
1.1 deraadt 47: #include "xmalloc.h"
48: #include "buffer.h"
49: #include "bufaux.h"
50: #include "ssh.h"
1.15 markus 51: #include "key.h"
1.1 deraadt 52:
53: /* Version identification string for identity files. */
54: #define AUTHFILE_ID_STRING "SSH PRIVATE KEY FILE FORMAT 1.1\n"
55:
1.10 markus 56: /*
57: * Saves the authentication (private) key in a file, encrypting it with
58: * passphrase. The identification of the file (lowest 64 bits of n) will
59: * precede the key to provide identification of the key without needing a
60: * passphrase.
61: */
1.1 deraadt 62:
1.3 provos 63: int
1.15 markus 64: save_private_key_rsa(const char *filename, const char *passphrase,
65: RSA *key, const char *comment)
1.1 deraadt 66: {
1.8 markus 67: Buffer buffer, encrypted;
68: char buf[100], *cp;
1.11 deraadt 69: int fd, i;
1.20 ! markus 70: CipherContext ciphercontext;
! 71: Cipher *cipher;
1.8 markus 72: u_int32_t rand;
73:
1.10 markus 74: /*
75: * If the passphrase is empty, use SSH_CIPHER_NONE to ease converting
76: * to another cipher; otherwise use SSH_AUTHFILE_CIPHER.
77: */
1.8 markus 78: if (strcmp(passphrase, "") == 0)
1.20 ! markus 79: cipher = cipher_by_number(SSH_CIPHER_NONE);
1.8 markus 80: else
1.20 ! markus 81: cipher = cipher_by_number(SSH_AUTHFILE_CIPHER);
! 82: if (cipher == NULL)
! 83: fatal("save_private_key_rsa: bad cipher");
1.8 markus 84:
85: /* This buffer is used to built the secret part of the private key. */
86: buffer_init(&buffer);
87:
88: /* Put checkbytes for checking passphrase validity. */
89: rand = arc4random();
90: buf[0] = rand & 0xff;
91: buf[1] = (rand >> 8) & 0xff;
92: buf[2] = buf[0];
93: buf[3] = buf[1];
94: buffer_append(&buffer, buf, 4);
95:
1.10 markus 96: /*
97: * Store the private key (n and e will not be stored because they
98: * will be stored in plain text, and storing them also in encrypted
99: * format would just give known plaintext).
100: */
1.8 markus 101: buffer_put_bignum(&buffer, key->d);
102: buffer_put_bignum(&buffer, key->iqmp);
103: buffer_put_bignum(&buffer, key->q); /* reverse from SSL p */
104: buffer_put_bignum(&buffer, key->p); /* reverse from SSL q */
105:
106: /* Pad the part to be encrypted until its size is a multiple of 8. */
107: while (buffer_len(&buffer) % 8 != 0)
108: buffer_put_char(&buffer, 0);
109:
110: /* This buffer will be used to contain the data in the file. */
111: buffer_init(&encrypted);
112:
113: /* First store keyfile id string. */
114: cp = AUTHFILE_ID_STRING;
115: for (i = 0; cp[i]; i++)
116: buffer_put_char(&encrypted, cp[i]);
117: buffer_put_char(&encrypted, 0);
118:
119: /* Store cipher type. */
1.20 ! markus 120: buffer_put_char(&encrypted, cipher->number);
1.8 markus 121: buffer_put_int(&encrypted, 0); /* For future extension */
122:
123: /* Store public key. This will be in plain text. */
124: buffer_put_int(&encrypted, BN_num_bits(key->n));
125: buffer_put_bignum(&encrypted, key->n);
126: buffer_put_bignum(&encrypted, key->e);
127: buffer_put_string(&encrypted, comment, strlen(comment));
128:
129: /* Allocate space for the private part of the key in the buffer. */
130: buffer_append_space(&encrypted, &cp, buffer_len(&buffer));
131:
1.20 ! markus 132: cipher_set_key_string(&ciphercontext, cipher, passphrase);
! 133: cipher_encrypt(&ciphercontext, (unsigned char *) cp,
! 134: (unsigned char *) buffer_ptr(&buffer), buffer_len(&buffer));
! 135: memset(&ciphercontext, 0, sizeof(ciphercontext));
1.8 markus 136:
137: /* Destroy temporary data. */
138: memset(buf, 0, sizeof(buf));
139: buffer_free(&buffer);
140:
1.11 deraadt 141: fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC, 0600);
142: if (fd < 0)
1.8 markus 143: return 0;
1.11 deraadt 144: if (write(fd, buffer_ptr(&encrypted), buffer_len(&encrypted)) !=
1.8 markus 145: buffer_len(&encrypted)) {
146: debug("Write to key file %.200s failed: %.100s", filename,
147: strerror(errno));
148: buffer_free(&encrypted);
1.11 deraadt 149: close(fd);
1.8 markus 150: remove(filename);
151: return 0;
152: }
1.11 deraadt 153: close(fd);
1.8 markus 154: buffer_free(&encrypted);
155: return 1;
1.1 deraadt 156: }
157:
1.15 markus 158: /* save DSA key in OpenSSL PEM format */
159:
160: int
161: save_private_key_dsa(const char *filename, const char *passphrase,
162: DSA *dsa, const char *comment)
163: {
164: FILE *fp;
165: int fd;
166: int success = 1;
167: int len = strlen(passphrase);
168:
169: if (len > 0 && len <= 4) {
170: error("passphrase too short: %d bytes", len);
171: errno = 0;
172: return 0;
173: }
174: fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC, 0600);
175: if (fd < 0) {
176: debug("open %s failed", filename);
177: return 0;
178: }
179: fp = fdopen(fd, "w");
180: if (fp == NULL ) {
181: debug("fdopen %s failed", filename);
182: close(fd);
183: return 0;
184: }
185: if (len > 0) {
186: if (!PEM_write_DSAPrivateKey(fp, dsa, EVP_des_ede3_cbc(),
187: (char *)passphrase, strlen(passphrase), NULL, NULL))
188: success = 0;
189: } else {
190: if (!PEM_write_DSAPrivateKey(fp, dsa, NULL,
191: NULL, 0, NULL, NULL))
192: success = 0;
193: }
194: fclose(fp);
195: return success;
196: }
197:
198: int
199: save_private_key(const char *filename, const char *passphrase, Key *key,
200: const char *comment)
201: {
202: switch (key->type) {
203: case KEY_RSA:
204: return save_private_key_rsa(filename, passphrase, key->rsa, comment);
205: break;
206: case KEY_DSA:
207: return save_private_key_dsa(filename, passphrase, key->dsa, comment);
208: break;
209: default:
210: break;
211: }
212: return 0;
213: }
214:
1.10 markus 215: /*
216: * Loads the public part of the key file. Returns 0 if an error was
217: * encountered (the file does not exist or is not readable), and non-zero
218: * otherwise.
219: */
1.1 deraadt 220:
1.3 provos 221: int
1.15 markus 222: load_public_key_rsa(const char *filename, RSA * pub, char **comment_return)
1.1 deraadt 223: {
1.11 deraadt 224: int fd, i;
1.8 markus 225: off_t len;
226: Buffer buffer;
227: char *cp;
228:
1.11 deraadt 229: fd = open(filename, O_RDONLY);
230: if (fd < 0)
1.8 markus 231: return 0;
1.11 deraadt 232: len = lseek(fd, (off_t) 0, SEEK_END);
233: lseek(fd, (off_t) 0, SEEK_SET);
1.8 markus 234:
235: buffer_init(&buffer);
236: buffer_append_space(&buffer, &cp, len);
237:
1.11 deraadt 238: if (read(fd, cp, (size_t) len) != (size_t) len) {
1.8 markus 239: debug("Read from key file %.200s failed: %.100s", filename,
1.15 markus 240: strerror(errno));
1.8 markus 241: buffer_free(&buffer);
1.11 deraadt 242: close(fd);
1.8 markus 243: return 0;
244: }
1.11 deraadt 245: close(fd);
1.8 markus 246:
247: /* Check that it is at least big enought to contain the ID string. */
248: if (len < strlen(AUTHFILE_ID_STRING) + 1) {
249: debug("Bad key file %.200s.", filename);
250: buffer_free(&buffer);
251: return 0;
252: }
1.10 markus 253: /*
254: * Make sure it begins with the id string. Consume the id string
255: * from the buffer.
256: */
1.8 markus 257: for (i = 0; i < (unsigned int) strlen(AUTHFILE_ID_STRING) + 1; i++)
1.11 deraadt 258: if (buffer_get_char(&buffer) != (u_char) AUTHFILE_ID_STRING[i]) {
1.8 markus 259: debug("Bad key file %.200s.", filename);
260: buffer_free(&buffer);
261: return 0;
262: }
263: /* Skip cipher type and reserved data. */
264: (void) buffer_get_char(&buffer); /* cipher type */
265: (void) buffer_get_int(&buffer); /* reserved */
266:
267: /* Read the public key from the buffer. */
268: buffer_get_int(&buffer);
1.15 markus 269: /* XXX alloc */
270: if (pub->n == NULL)
271: pub->n = BN_new();
1.8 markus 272: buffer_get_bignum(&buffer, pub->n);
1.15 markus 273: /* XXX alloc */
274: if (pub->e == NULL)
275: pub->e = BN_new();
1.8 markus 276: buffer_get_bignum(&buffer, pub->e);
277: if (comment_return)
278: *comment_return = buffer_get_string(&buffer, NULL);
279: /* The encrypted private part is not parsed by this function. */
280:
1.1 deraadt 281: buffer_free(&buffer);
282:
1.8 markus 283: return 1;
1.1 deraadt 284: }
285:
1.18 markus 286: /* load public key from private-key file */
1.15 markus 287: int
288: load_public_key(const char *filename, Key * key, char **comment_return)
289: {
290: switch (key->type) {
291: case KEY_RSA:
292: return load_public_key_rsa(filename, key->rsa, comment_return);
293: break;
294: case KEY_DSA:
295: default:
296: break;
297: }
298: return 0;
299: }
300:
1.10 markus 301: /*
302: * Loads the private key from the file. Returns 0 if an error is encountered
303: * (file does not exist or is not readable, or passphrase is bad). This
304: * initializes the private key.
305: * Assumes we are called under uid of the owner of the file.
306: */
1.1 deraadt 307:
1.3 provos 308: int
1.15 markus 309: load_private_key_rsa(int fd, const char *filename,
310: const char *passphrase, RSA * prv, char **comment_return)
1.1 deraadt 311: {
1.15 markus 312: int i, check1, check2, cipher_type;
1.8 markus 313: off_t len;
314: Buffer buffer, decrypted;
315: char *cp;
1.20 ! markus 316: CipherContext ciphercontext;
! 317: Cipher *cipher;
1.8 markus 318: BN_CTX *ctx;
319: BIGNUM *aux;
320:
1.11 deraadt 321: len = lseek(fd, (off_t) 0, SEEK_END);
322: lseek(fd, (off_t) 0, SEEK_SET);
1.8 markus 323:
324: buffer_init(&buffer);
325: buffer_append_space(&buffer, &cp, len);
326:
1.11 deraadt 327: if (read(fd, cp, (size_t) len) != (size_t) len) {
1.8 markus 328: debug("Read from key file %.200s failed: %.100s", filename,
329: strerror(errno));
330: buffer_free(&buffer);
1.11 deraadt 331: close(fd);
1.8 markus 332: return 0;
333: }
1.11 deraadt 334: close(fd);
1.8 markus 335:
336: /* Check that it is at least big enought to contain the ID string. */
337: if (len < strlen(AUTHFILE_ID_STRING) + 1) {
338: debug("Bad key file %.200s.", filename);
339: buffer_free(&buffer);
340: return 0;
341: }
1.10 markus 342: /*
343: * Make sure it begins with the id string. Consume the id string
344: * from the buffer.
345: */
1.8 markus 346: for (i = 0; i < (unsigned int) strlen(AUTHFILE_ID_STRING) + 1; i++)
347: if (buffer_get_char(&buffer) != (unsigned char) AUTHFILE_ID_STRING[i]) {
348: debug("Bad key file %.200s.", filename);
349: buffer_free(&buffer);
350: return 0;
351: }
352: /* Read cipher type. */
353: cipher_type = buffer_get_char(&buffer);
354: (void) buffer_get_int(&buffer); /* Reserved data. */
355:
356: /* Read the public key from the buffer. */
357: buffer_get_int(&buffer);
358: prv->n = BN_new();
359: buffer_get_bignum(&buffer, prv->n);
360: prv->e = BN_new();
361: buffer_get_bignum(&buffer, prv->e);
362: if (comment_return)
363: *comment_return = buffer_get_string(&buffer, NULL);
364: else
365: xfree(buffer_get_string(&buffer, NULL));
366:
367: /* Check that it is a supported cipher. */
1.20 ! markus 368: cipher = cipher_by_number(cipher_type);
! 369: if (cipher == NULL) {
! 370: debug("Unsupported cipher %d used in key file %.200s.",
! 371: cipher_type, filename);
1.8 markus 372: buffer_free(&buffer);
373: goto fail;
374: }
375: /* Initialize space for decrypted data. */
376: buffer_init(&decrypted);
377: buffer_append_space(&decrypted, &cp, buffer_len(&buffer));
378:
379: /* Rest of the buffer is encrypted. Decrypt it using the passphrase. */
1.20 ! markus 380: cipher_set_key_string(&ciphercontext, cipher, passphrase);
! 381: cipher_decrypt(&ciphercontext, (unsigned char *) cp,
! 382: (unsigned char *) buffer_ptr(&buffer), buffer_len(&buffer));
! 383: memset(&ciphercontext, 0, sizeof(ciphercontext));
1.1 deraadt 384: buffer_free(&buffer);
385:
1.8 markus 386: check1 = buffer_get_char(&decrypted);
387: check2 = buffer_get_char(&decrypted);
388: if (check1 != buffer_get_char(&decrypted) ||
389: check2 != buffer_get_char(&decrypted)) {
390: if (strcmp(passphrase, "") != 0)
391: debug("Bad passphrase supplied for key file %.200s.", filename);
392: /* Bad passphrase. */
393: buffer_free(&decrypted);
394: fail:
395: BN_clear_free(prv->n);
1.15 markus 396: prv->n = NULL;
1.8 markus 397: BN_clear_free(prv->e);
1.15 markus 398: prv->e = NULL;
1.8 markus 399: if (comment_return)
400: xfree(*comment_return);
401: return 0;
402: }
403: /* Read the rest of the private key. */
404: prv->d = BN_new();
405: buffer_get_bignum(&decrypted, prv->d);
406: prv->iqmp = BN_new();
407: buffer_get_bignum(&decrypted, prv->iqmp); /* u */
408: /* in SSL and SSH p and q are exchanged */
409: prv->q = BN_new();
410: buffer_get_bignum(&decrypted, prv->q); /* p */
411: prv->p = BN_new();
412: buffer_get_bignum(&decrypted, prv->p); /* q */
413:
414: ctx = BN_CTX_new();
415: aux = BN_new();
416:
417: BN_sub(aux, prv->q, BN_value_one());
418: prv->dmq1 = BN_new();
419: BN_mod(prv->dmq1, prv->d, aux, ctx);
420:
421: BN_sub(aux, prv->p, BN_value_one());
422: prv->dmp1 = BN_new();
423: BN_mod(prv->dmp1, prv->d, aux, ctx);
424:
425: BN_clear_free(aux);
426: BN_CTX_free(ctx);
427:
428: buffer_free(&decrypted);
1.1 deraadt 429:
1.8 markus 430: return 1;
1.15 markus 431: }
432:
433: int
434: load_private_key_dsa(int fd, const char *passphrase, Key *k, char **comment_return)
435: {
436: DSA *dsa;
437: BIO *in;
438: FILE *fp;
439:
440: in = BIO_new(BIO_s_file());
441: if (in == NULL) {
442: error("BIO_new failed");
443: return 0;
444: }
445: fp = fdopen(fd, "r");
446: if (fp == NULL) {
447: error("fdopen failed");
448: return 0;
449: }
450: BIO_set_fp(in, fp, BIO_NOCLOSE);
451: dsa = PEM_read_bio_DSAPrivateKey(in, NULL, NULL, (char *)passphrase);
452: if (dsa == NULL) {
453: debug("PEM_read_bio_DSAPrivateKey failed");
454: } else {
455: /* replace k->dsa with loaded key */
456: DSA_free(k->dsa);
457: k->dsa = dsa;
458: }
459: BIO_free(in);
460: fclose(fp);
461: if (comment_return)
462: *comment_return = xstrdup("dsa w/o comment");
463: debug("read DSA private key done");
464: #ifdef DEBUG_DSS
465: DSA_print_fp(stderr, dsa, 8);
466: #endif
467: return dsa != NULL ? 1 : 0;
468: }
469:
470: int
471: load_private_key(const char *filename, const char *passphrase, Key *key,
472: char **comment_return)
473: {
474: int fd;
475: int ret = 0;
476: struct stat st;
477:
478: fd = open(filename, O_RDONLY);
479: if (fd < 0)
480: return 0;
481:
482: /* check owner and modes */
483: if (fstat(fd, &st) < 0 ||
484: (st.st_uid != 0 && st.st_uid != getuid()) ||
485: (st.st_mode & 077) != 0) {
486: close(fd);
487: error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
488: error("@ WARNING: UNPROTECTED PRIVATE KEY FILE! @");
489: error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
490: error("Bad ownership or mode(0%3.3o) for '%s'.",
491: st.st_mode & 0777, filename);
492: error("It is recommended that your private key files are NOT accessible by others.");
493: return 0;
494: }
495: switch (key->type) {
496: case KEY_RSA:
497: if (key->rsa->e != NULL) {
498: BN_clear_free(key->rsa->e);
499: key->rsa->e = NULL;
500: }
501: if (key->rsa->n != NULL) {
502: BN_clear_free(key->rsa->n);
503: key->rsa->n = NULL;
504: }
505: ret = load_private_key_rsa(fd, filename, passphrase,
506: key->rsa, comment_return);
507: break;
508: case KEY_DSA:
509: ret = load_private_key_dsa(fd, passphrase, key, comment_return);
510: default:
511: break;
512: }
513: close(fd);
514: return ret;
1.18 markus 515: }
516:
517: int
518: do_load_public_key(const char *filename, Key *k, char **commentp)
519: {
520: FILE *f;
521: unsigned int bits;
522: char line[1024];
523: char *cp;
524:
525: f = fopen(filename, "r");
526: if (f != NULL) {
527: while (fgets(line, sizeof(line), f)) {
528: line[sizeof(line)-1] = '\0';
529: cp = line;
530: switch(*cp){
531: case '#':
532: case '\n':
533: case '\0':
534: continue;
535: }
536: /* Skip leading whitespace. */
537: for (; *cp && (*cp == ' ' || *cp == '\t'); cp++)
538: ;
539: if (*cp) {
540: bits = key_read(k, &cp);
541: if (bits != 0) {
542: if (commentp)
543: *commentp=xstrdup(filename);
544: fclose(f);
545: return 1;
546: }
547: }
548: }
549: fclose(f);
550: }
551: return 0;
552: }
553:
554: /* load public key from pubkey file */
555: int
556: try_load_public_key(const char *filename, Key *k, char **commentp)
557: {
558: char pub[MAXPATHLEN];
559:
560: if (do_load_public_key(filename, k, commentp) == 1)
561: return 1;
562: if (strlcpy(pub, filename, sizeof pub) >= MAXPATHLEN)
563: return 0;
564: if (strlcat(pub, ".pub", sizeof pub) >= MAXPATHLEN)
565: return 0;
566: if (do_load_public_key(pub, k, commentp) == 1)
567: return 1;
568: return 0;
1.1 deraadt 569: }