Annotation of src/usr.bin/ssh/krl.c, Revision 1.55
1.1 djm 1: /*
2: * Copyright (c) 2012 Damien Miller <djm@mindrot.org>
3: *
4: * Permission to use, copy, modify, and distribute this software for any
5: * purpose with or without fee is hereby granted, provided that the above
6: * copyright notice and this permission notice appear in all copies.
7: *
8: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15: */
16:
1.55 ! dtucker 17: /* $OpenBSD: krl.c,v 1.54 2022/04/28 02:53:31 djm Exp $ */
1.2 djm 18:
1.1 djm 19: #include <sys/types.h>
20: #include <sys/tree.h>
21: #include <sys/queue.h>
22:
23: #include <errno.h>
24: #include <fcntl.h>
25: #include <limits.h>
26: #include <string.h>
27: #include <time.h>
28: #include <unistd.h>
1.44 djm 29: #include <stdlib.h>
1.1 djm 30:
1.20 djm 31: #include "sshbuf.h"
1.25 djm 32: #include "ssherr.h"
1.20 djm 33: #include "sshkey.h"
1.1 djm 34: #include "authfile.h"
35: #include "misc.h"
36: #include "log.h"
1.21 djm 37: #include "digest.h"
1.26 djm 38: #include "bitmap.h"
1.48 djm 39: #include "utf8.h"
1.1 djm 40:
41: #include "krl.h"
42:
43: /* #define DEBUG_KRL */
44: #ifdef DEBUG_KRL
1.52 djm 45: # define KRL_DBG(x) debug3_f x
1.1 djm 46: #else
47: # define KRL_DBG(x)
48: #endif
49:
50: /*
51: * Trees of revoked serial numbers, key IDs and keys. This allows
52: * quick searching, querying and producing lists in canonical order.
53: */
54:
55: /* Tree of serial numbers. XXX make smarter: really need a real sparse bitmap */
56: struct revoked_serial {
57: u_int64_t lo, hi;
58: RB_ENTRY(revoked_serial) tree_entry;
59: };
60: static int serial_cmp(struct revoked_serial *a, struct revoked_serial *b);
61: RB_HEAD(revoked_serial_tree, revoked_serial);
1.53 djm 62: RB_GENERATE_STATIC(revoked_serial_tree, revoked_serial, tree_entry, serial_cmp)
1.1 djm 63:
64: /* Tree of key IDs */
65: struct revoked_key_id {
66: char *key_id;
67: RB_ENTRY(revoked_key_id) tree_entry;
68: };
69: static int key_id_cmp(struct revoked_key_id *a, struct revoked_key_id *b);
70: RB_HEAD(revoked_key_id_tree, revoked_key_id);
1.53 djm 71: RB_GENERATE_STATIC(revoked_key_id_tree, revoked_key_id, tree_entry, key_id_cmp)
1.1 djm 72:
73: /* Tree of blobs (used for keys and fingerprints) */
74: struct revoked_blob {
75: u_char *blob;
1.20 djm 76: size_t len;
1.1 djm 77: RB_ENTRY(revoked_blob) tree_entry;
78: };
79: static int blob_cmp(struct revoked_blob *a, struct revoked_blob *b);
80: RB_HEAD(revoked_blob_tree, revoked_blob);
1.53 djm 81: RB_GENERATE_STATIC(revoked_blob_tree, revoked_blob, tree_entry, blob_cmp)
1.1 djm 82:
83: /* Tracks revoked certs for a single CA */
84: struct revoked_certs {
1.20 djm 85: struct sshkey *ca_key;
1.1 djm 86: struct revoked_serial_tree revoked_serials;
87: struct revoked_key_id_tree revoked_key_ids;
88: TAILQ_ENTRY(revoked_certs) entry;
89: };
90: TAILQ_HEAD(revoked_certs_list, revoked_certs);
91:
92: struct ssh_krl {
93: u_int64_t krl_version;
94: u_int64_t generated_date;
95: u_int64_t flags;
96: char *comment;
97: struct revoked_blob_tree revoked_keys;
98: struct revoked_blob_tree revoked_sha1s;
1.42 djm 99: struct revoked_blob_tree revoked_sha256s;
1.1 djm 100: struct revoked_certs_list revoked_certs;
101: };
102:
103: /* Return equal if a and b overlap */
104: static int
105: serial_cmp(struct revoked_serial *a, struct revoked_serial *b)
106: {
107: if (a->hi >= b->lo && a->lo <= b->hi)
108: return 0;
109: return a->lo < b->lo ? -1 : 1;
110: }
111:
112: static int
113: key_id_cmp(struct revoked_key_id *a, struct revoked_key_id *b)
114: {
115: return strcmp(a->key_id, b->key_id);
116: }
117:
118: static int
119: blob_cmp(struct revoked_blob *a, struct revoked_blob *b)
120: {
121: int r;
122:
123: if (a->len != b->len) {
1.38 deraadt 124: if ((r = memcmp(a->blob, b->blob, MINIMUM(a->len, b->len))) != 0)
1.1 djm 125: return r;
126: return a->len > b->len ? 1 : -1;
127: } else
128: return memcmp(a->blob, b->blob, a->len);
129: }
130:
131: struct ssh_krl *
132: ssh_krl_init(void)
133: {
134: struct ssh_krl *krl;
135:
136: if ((krl = calloc(1, sizeof(*krl))) == NULL)
137: return NULL;
138: RB_INIT(&krl->revoked_keys);
139: RB_INIT(&krl->revoked_sha1s);
1.42 djm 140: RB_INIT(&krl->revoked_sha256s);
1.1 djm 141: TAILQ_INIT(&krl->revoked_certs);
142: return krl;
143: }
144:
145: static void
146: revoked_certs_free(struct revoked_certs *rc)
147: {
148: struct revoked_serial *rs, *trs;
149: struct revoked_key_id *rki, *trki;
150:
151: RB_FOREACH_SAFE(rs, revoked_serial_tree, &rc->revoked_serials, trs) {
152: RB_REMOVE(revoked_serial_tree, &rc->revoked_serials, rs);
153: free(rs);
154: }
155: RB_FOREACH_SAFE(rki, revoked_key_id_tree, &rc->revoked_key_ids, trki) {
156: RB_REMOVE(revoked_key_id_tree, &rc->revoked_key_ids, rki);
157: free(rki->key_id);
158: free(rki);
159: }
1.31 djm 160: sshkey_free(rc->ca_key);
1.1 djm 161: }
162:
163: void
164: ssh_krl_free(struct ssh_krl *krl)
165: {
166: struct revoked_blob *rb, *trb;
167: struct revoked_certs *rc, *trc;
168:
169: if (krl == NULL)
170: return;
171:
172: free(krl->comment);
173: RB_FOREACH_SAFE(rb, revoked_blob_tree, &krl->revoked_keys, trb) {
174: RB_REMOVE(revoked_blob_tree, &krl->revoked_keys, rb);
175: free(rb->blob);
176: free(rb);
177: }
178: RB_FOREACH_SAFE(rb, revoked_blob_tree, &krl->revoked_sha1s, trb) {
179: RB_REMOVE(revoked_blob_tree, &krl->revoked_sha1s, rb);
180: free(rb->blob);
181: free(rb);
182: }
1.42 djm 183: RB_FOREACH_SAFE(rb, revoked_blob_tree, &krl->revoked_sha256s, trb) {
184: RB_REMOVE(revoked_blob_tree, &krl->revoked_sha256s, rb);
185: free(rb->blob);
186: free(rb);
187: }
1.1 djm 188: TAILQ_FOREACH_SAFE(rc, &krl->revoked_certs, entry, trc) {
189: TAILQ_REMOVE(&krl->revoked_certs, rc, entry);
190: revoked_certs_free(rc);
191: }
1.55 ! dtucker 192: free(krl);
1.1 djm 193: }
194:
195: void
196: ssh_krl_set_version(struct ssh_krl *krl, u_int64_t version)
197: {
198: krl->krl_version = version;
199: }
200:
1.20 djm 201: int
1.1 djm 202: ssh_krl_set_comment(struct ssh_krl *krl, const char *comment)
203: {
204: free(krl->comment);
205: if ((krl->comment = strdup(comment)) == NULL)
1.20 djm 206: return SSH_ERR_ALLOC_FAIL;
207: return 0;
1.1 djm 208: }
209:
210: /*
211: * Find the revoked_certs struct for a CA key. If allow_create is set then
212: * create a new one in the tree if one did not exist already.
213: */
214: static int
1.20 djm 215: revoked_certs_for_ca_key(struct ssh_krl *krl, const struct sshkey *ca_key,
1.1 djm 216: struct revoked_certs **rcp, int allow_create)
217: {
218: struct revoked_certs *rc;
1.20 djm 219: int r;
1.1 djm 220:
221: *rcp = NULL;
222: TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
1.31 djm 223: if ((ca_key == NULL && rc->ca_key == NULL) ||
224: sshkey_equal(rc->ca_key, ca_key)) {
1.1 djm 225: *rcp = rc;
226: return 0;
227: }
228: }
229: if (!allow_create)
230: return 0;
231: /* If this CA doesn't exist in the list then add it now */
232: if ((rc = calloc(1, sizeof(*rc))) == NULL)
1.20 djm 233: return SSH_ERR_ALLOC_FAIL;
1.31 djm 234: if (ca_key == NULL)
235: rc->ca_key = NULL;
236: else if ((r = sshkey_from_private(ca_key, &rc->ca_key)) != 0) {
1.1 djm 237: free(rc);
1.20 djm 238: return r;
1.1 djm 239: }
240: RB_INIT(&rc->revoked_serials);
241: RB_INIT(&rc->revoked_key_ids);
242: TAILQ_INSERT_TAIL(&krl->revoked_certs, rc, entry);
1.52 djm 243: KRL_DBG(("new CA %s", ca_key == NULL ? "*" : sshkey_type(ca_key)));
1.1 djm 244: *rcp = rc;
245: return 0;
246: }
247:
248: static int
249: insert_serial_range(struct revoked_serial_tree *rt, u_int64_t lo, u_int64_t hi)
250: {
251: struct revoked_serial rs, *ers, *crs, *irs;
252:
1.52 djm 253: KRL_DBG(("insert %llu:%llu", lo, hi));
1.14 tedu 254: memset(&rs, 0, sizeof(rs));
1.1 djm 255: rs.lo = lo;
256: rs.hi = hi;
257: ers = RB_NFIND(revoked_serial_tree, rt, &rs);
258: if (ers == NULL || serial_cmp(ers, &rs) != 0) {
259: /* No entry matches. Just insert */
260: if ((irs = malloc(sizeof(rs))) == NULL)
1.20 djm 261: return SSH_ERR_ALLOC_FAIL;
1.1 djm 262: memcpy(irs, &rs, sizeof(*irs));
263: ers = RB_INSERT(revoked_serial_tree, rt, irs);
264: if (ers != NULL) {
1.52 djm 265: KRL_DBG(("bad: ers != NULL"));
1.1 djm 266: /* Shouldn't happen */
1.4 markus 267: free(irs);
1.25 djm 268: return SSH_ERR_INTERNAL_ERROR;
1.1 djm 269: }
270: ers = irs;
271: } else {
1.52 djm 272: KRL_DBG(("overlap found %llu:%llu", ers->lo, ers->hi));
1.1 djm 273: /*
274: * The inserted entry overlaps an existing one. Grow the
275: * existing entry.
276: */
277: if (ers->lo > lo)
278: ers->lo = lo;
279: if (ers->hi < hi)
280: ers->hi = hi;
281: }
1.25 djm 282:
1.1 djm 283: /*
284: * The inserted or revised range might overlap or abut adjacent ones;
285: * coalesce as necessary.
286: */
287:
288: /* Check predecessors */
289: while ((crs = RB_PREV(revoked_serial_tree, rt, ers)) != NULL) {
1.52 djm 290: KRL_DBG(("pred %llu:%llu", crs->lo, crs->hi));
1.1 djm 291: if (ers->lo != 0 && crs->hi < ers->lo - 1)
292: break;
293: /* This entry overlaps. */
294: if (crs->lo < ers->lo) {
295: ers->lo = crs->lo;
1.52 djm 296: KRL_DBG(("pred extend %llu:%llu", ers->lo, ers->hi));
1.1 djm 297: }
298: RB_REMOVE(revoked_serial_tree, rt, crs);
299: free(crs);
300: }
301: /* Check successors */
302: while ((crs = RB_NEXT(revoked_serial_tree, rt, ers)) != NULL) {
1.52 djm 303: KRL_DBG(("succ %llu:%llu", crs->lo, crs->hi));
1.1 djm 304: if (ers->hi != (u_int64_t)-1 && crs->lo > ers->hi + 1)
305: break;
306: /* This entry overlaps. */
307: if (crs->hi > ers->hi) {
308: ers->hi = crs->hi;
1.52 djm 309: KRL_DBG(("succ extend %llu:%llu", ers->lo, ers->hi));
1.1 djm 310: }
311: RB_REMOVE(revoked_serial_tree, rt, crs);
312: free(crs);
313: }
1.52 djm 314: KRL_DBG(("done, final %llu:%llu", ers->lo, ers->hi));
1.1 djm 315: return 0;
316: }
317:
318: int
1.20 djm 319: ssh_krl_revoke_cert_by_serial(struct ssh_krl *krl, const struct sshkey *ca_key,
1.1 djm 320: u_int64_t serial)
321: {
322: return ssh_krl_revoke_cert_by_serial_range(krl, ca_key, serial, serial);
323: }
324:
325: int
1.25 djm 326: ssh_krl_revoke_cert_by_serial_range(struct ssh_krl *krl,
327: const struct sshkey *ca_key, u_int64_t lo, u_int64_t hi)
1.1 djm 328: {
329: struct revoked_certs *rc;
1.20 djm 330: int r;
1.1 djm 331:
332: if (lo > hi || lo == 0)
1.25 djm 333: return SSH_ERR_INVALID_ARGUMENT;
1.20 djm 334: if ((r = revoked_certs_for_ca_key(krl, ca_key, &rc, 1)) != 0)
335: return r;
1.1 djm 336: return insert_serial_range(&rc->revoked_serials, lo, hi);
337: }
338:
339: int
1.20 djm 340: ssh_krl_revoke_cert_by_key_id(struct ssh_krl *krl, const struct sshkey *ca_key,
1.1 djm 341: const char *key_id)
342: {
343: struct revoked_key_id *rki, *erki;
344: struct revoked_certs *rc;
1.20 djm 345: int r;
1.1 djm 346:
1.20 djm 347: if ((r = revoked_certs_for_ca_key(krl, ca_key, &rc, 1)) != 0)
348: return r;
1.1 djm 349:
1.52 djm 350: KRL_DBG(("revoke %s", key_id));
1.1 djm 351: if ((rki = calloc(1, sizeof(*rki))) == NULL ||
352: (rki->key_id = strdup(key_id)) == NULL) {
353: free(rki);
1.20 djm 354: return SSH_ERR_ALLOC_FAIL;
1.1 djm 355: }
356: erki = RB_INSERT(revoked_key_id_tree, &rc->revoked_key_ids, rki);
357: if (erki != NULL) {
358: free(rki->key_id);
359: free(rki);
360: }
361: return 0;
362: }
363:
364: /* Convert "key" to a public key blob without any certificate information */
365: static int
1.20 djm 366: plain_key_blob(const struct sshkey *key, u_char **blob, size_t *blen)
1.1 djm 367: {
1.20 djm 368: struct sshkey *kcopy;
1.1 djm 369: int r;
370:
1.20 djm 371: if ((r = sshkey_from_private(key, &kcopy)) != 0)
372: return r;
373: if (sshkey_is_cert(kcopy)) {
374: if ((r = sshkey_drop_cert(kcopy)) != 0) {
375: sshkey_free(kcopy);
376: return r;
1.1 djm 377: }
378: }
1.20 djm 379: r = sshkey_to_blob(kcopy, blob, blen);
1.23 markus 380: sshkey_free(kcopy);
1.17 djm 381: return r;
1.1 djm 382: }
383:
384: /* Revoke a key blob. Ownership of blob is transferred to the tree */
385: static int
1.25 djm 386: revoke_blob(struct revoked_blob_tree *rbt, u_char *blob, size_t len)
1.1 djm 387: {
388: struct revoked_blob *rb, *erb;
389:
390: if ((rb = calloc(1, sizeof(*rb))) == NULL)
1.20 djm 391: return SSH_ERR_ALLOC_FAIL;
1.1 djm 392: rb->blob = blob;
393: rb->len = len;
394: erb = RB_INSERT(revoked_blob_tree, rbt, rb);
395: if (erb != NULL) {
396: free(rb->blob);
397: free(rb);
398: }
399: return 0;
400: }
401:
402: int
1.20 djm 403: ssh_krl_revoke_key_explicit(struct ssh_krl *krl, const struct sshkey *key)
1.1 djm 404: {
405: u_char *blob;
1.20 djm 406: size_t len;
407: int r;
1.1 djm 408:
1.52 djm 409: debug3_f("revoke type %s", sshkey_type(key));
1.20 djm 410: if ((r = plain_key_blob(key, &blob, &len)) != 0)
411: return r;
1.1 djm 412: return revoke_blob(&krl->revoked_keys, blob, len);
413: }
414:
1.42 djm 415: static int
416: revoke_by_hash(struct revoked_blob_tree *target, const u_char *p, size_t len)
1.1 djm 417: {
418: u_char *blob;
1.20 djm 419: int r;
1.1 djm 420:
1.42 djm 421: /* need to copy hash, as revoke_blob steals ownership */
422: if ((blob = malloc(len)) == NULL)
423: return SSH_ERR_SYSTEM_ERROR;
424: memcpy(blob, p, len);
425: if ((r = revoke_blob(target, blob, len)) != 0) {
426: free(blob);
1.20 djm 427: return r;
1.42 djm 428: }
429: return 0;
430: }
431:
432: int
433: ssh_krl_revoke_key_sha1(struct ssh_krl *krl, const u_char *p, size_t len)
434: {
1.52 djm 435: debug3_f("revoke by sha1");
1.42 djm 436: if (len != 20)
437: return SSH_ERR_INVALID_FORMAT;
438: return revoke_by_hash(&krl->revoked_sha1s, p, len);
439: }
440:
441: int
442: ssh_krl_revoke_key_sha256(struct ssh_krl *krl, const u_char *p, size_t len)
443: {
1.52 djm 444: debug3_f("revoke by sha256");
1.42 djm 445: if (len != 32)
446: return SSH_ERR_INVALID_FORMAT;
447: return revoke_by_hash(&krl->revoked_sha256s, p, len);
1.1 djm 448: }
449:
450: int
1.20 djm 451: ssh_krl_revoke_key(struct ssh_krl *krl, const struct sshkey *key)
1.1 djm 452: {
1.42 djm 453: /* XXX replace with SHA256? */
1.20 djm 454: if (!sshkey_is_cert(key))
1.42 djm 455: return ssh_krl_revoke_key_explicit(krl, key);
1.1 djm 456:
1.33 djm 457: if (key->cert->serial == 0) {
1.1 djm 458: return ssh_krl_revoke_cert_by_key_id(krl,
459: key->cert->signature_key,
460: key->cert->key_id);
461: } else {
462: return ssh_krl_revoke_cert_by_serial(krl,
463: key->cert->signature_key,
464: key->cert->serial);
465: }
466: }
467:
468: /*
1.20 djm 469: * Select the most compact section type to emit next in a KRL based on
470: * the current section type, the run length of contiguous revoked serial
1.1 djm 471: * numbers and the gaps from the last and to the next revoked serial.
472: * Applies a mostly-accurate bit cost model to select the section type
473: * that will minimise the size of the resultant KRL.
474: */
475: static int
476: choose_next_state(int current_state, u_int64_t contig, int final,
477: u_int64_t last_gap, u_int64_t next_gap, int *force_new_section)
478: {
479: int new_state;
480: u_int64_t cost, cost_list, cost_range, cost_bitmap, cost_bitmap_restart;
481:
482: /*
483: * Avoid unsigned overflows.
484: * The limits are high enough to avoid confusing the calculations.
485: */
1.38 deraadt 486: contig = MINIMUM(contig, 1ULL<<31);
487: last_gap = MINIMUM(last_gap, 1ULL<<31);
488: next_gap = MINIMUM(next_gap, 1ULL<<31);
1.1 djm 489:
490: /*
491: * Calculate the cost to switch from the current state to candidates.
492: * NB. range sections only ever contain a single range, so their
493: * switching cost is independent of the current_state.
494: */
495: cost_list = cost_bitmap = cost_bitmap_restart = 0;
496: cost_range = 8;
497: switch (current_state) {
498: case KRL_SECTION_CERT_SERIAL_LIST:
499: cost_bitmap_restart = cost_bitmap = 8 + 64;
500: break;
501: case KRL_SECTION_CERT_SERIAL_BITMAP:
502: cost_list = 8;
503: cost_bitmap_restart = 8 + 64;
504: break;
505: case KRL_SECTION_CERT_SERIAL_RANGE:
506: case 0:
507: cost_bitmap_restart = cost_bitmap = 8 + 64;
508: cost_list = 8;
509: }
510:
511: /* Estimate base cost in bits of each section type */
512: cost_list += 64 * contig + (final ? 0 : 8+64);
513: cost_range += (2 * 64) + (final ? 0 : 8+64);
1.38 deraadt 514: cost_bitmap += last_gap + contig + (final ? 0 : MINIMUM(next_gap, 8+64));
515: cost_bitmap_restart += contig + (final ? 0 : MINIMUM(next_gap, 8+64));
1.1 djm 516:
517: /* Convert to byte costs for actual comparison */
518: cost_list = (cost_list + 7) / 8;
519: cost_bitmap = (cost_bitmap + 7) / 8;
520: cost_bitmap_restart = (cost_bitmap_restart + 7) / 8;
521: cost_range = (cost_range + 7) / 8;
522:
523: /* Now pick the best choice */
524: *force_new_section = 0;
525: new_state = KRL_SECTION_CERT_SERIAL_BITMAP;
526: cost = cost_bitmap;
527: if (cost_range < cost) {
528: new_state = KRL_SECTION_CERT_SERIAL_RANGE;
529: cost = cost_range;
530: }
531: if (cost_list < cost) {
532: new_state = KRL_SECTION_CERT_SERIAL_LIST;
533: cost = cost_list;
534: }
535: if (cost_bitmap_restart < cost) {
536: new_state = KRL_SECTION_CERT_SERIAL_BITMAP;
537: *force_new_section = 1;
538: cost = cost_bitmap_restart;
539: }
1.52 djm 540: KRL_DBG(("contig %llu last_gap %llu next_gap %llu final %d, costs:"
1.1 djm 541: "list %llu range %llu bitmap %llu new bitmap %llu, "
1.52 djm 542: "selected 0x%02x%s", (long long unsigned)contig,
1.11 djm 543: (long long unsigned)last_gap, (long long unsigned)next_gap, final,
544: (long long unsigned)cost_list, (long long unsigned)cost_range,
545: (long long unsigned)cost_bitmap,
546: (long long unsigned)cost_bitmap_restart, new_state,
1.25 djm 547: *force_new_section ? " restart" : ""));
1.1 djm 548: return new_state;
549: }
550:
1.26 djm 551: static int
552: put_bitmap(struct sshbuf *buf, struct bitmap *bitmap)
553: {
554: size_t len;
555: u_char *blob;
556: int r;
557:
558: len = bitmap_nbytes(bitmap);
559: if ((blob = malloc(len)) == NULL)
560: return SSH_ERR_ALLOC_FAIL;
561: if (bitmap_to_string(bitmap, blob, len) != 0) {
562: free(blob);
563: return SSH_ERR_INTERNAL_ERROR;
564: }
565: r = sshbuf_put_bignum2_bytes(buf, blob, len);
566: free(blob);
567: return r;
568: }
569:
1.1 djm 570: /* Generate a KRL_SECTION_CERTIFICATES KRL section */
571: static int
1.20 djm 572: revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf)
1.1 djm 573: {
1.25 djm 574: int final, force_new_sect, r = SSH_ERR_INTERNAL_ERROR;
1.1 djm 575: u_int64_t i, contig, gap, last = 0, bitmap_start = 0;
576: struct revoked_serial *rs, *nrs;
577: struct revoked_key_id *rki;
578: int next_state, state = 0;
1.20 djm 579: struct sshbuf *sect;
1.26 djm 580: struct bitmap *bitmap = NULL;
1.1 djm 581:
1.20 djm 582: if ((sect = sshbuf_new()) == NULL)
583: return SSH_ERR_ALLOC_FAIL;
1.1 djm 584:
1.31 djm 585: /* Store the header: optional CA scope key, reserved */
586: if (rc->ca_key == NULL) {
587: if ((r = sshbuf_put_string(buf, NULL, 0)) != 0)
588: goto out;
589: } else {
590: if ((r = sshkey_puts(rc->ca_key, buf)) != 0)
591: goto out;
592: }
593: if ((r = sshbuf_put_string(buf, NULL, 0)) != 0)
1.20 djm 594: goto out;
1.1 djm 595:
596: /* Store the revoked serials. */
597: for (rs = RB_MIN(revoked_serial_tree, &rc->revoked_serials);
598: rs != NULL;
599: rs = RB_NEXT(revoked_serial_tree, &rc->revoked_serials, rs)) {
1.52 djm 600: KRL_DBG(("serial %llu:%llu state 0x%02x",
1.11 djm 601: (long long unsigned)rs->lo, (long long unsigned)rs->hi,
1.25 djm 602: state));
1.1 djm 603:
604: /* Check contiguous length and gap to next section (if any) */
605: nrs = RB_NEXT(revoked_serial_tree, &rc->revoked_serials, rs);
606: final = nrs == NULL;
607: gap = nrs == NULL ? 0 : nrs->lo - rs->hi;
608: contig = 1 + (rs->hi - rs->lo);
609:
610: /* Choose next state based on these */
611: next_state = choose_next_state(state, contig, final,
612: state == 0 ? 0 : rs->lo - last, gap, &force_new_sect);
613:
614: /*
615: * If the current section is a range section or has a different
616: * type to the next section, then finish it off now.
617: */
618: if (state != 0 && (force_new_sect || next_state != state ||
619: state == KRL_SECTION_CERT_SERIAL_RANGE)) {
1.52 djm 620: KRL_DBG(("finish state 0x%02x", state));
1.1 djm 621: switch (state) {
622: case KRL_SECTION_CERT_SERIAL_LIST:
623: case KRL_SECTION_CERT_SERIAL_RANGE:
624: break;
625: case KRL_SECTION_CERT_SERIAL_BITMAP:
1.26 djm 626: if ((r = put_bitmap(sect, bitmap)) != 0)
1.20 djm 627: goto out;
1.26 djm 628: bitmap_free(bitmap);
1.1 djm 629: bitmap = NULL;
630: break;
631: }
1.20 djm 632: if ((r = sshbuf_put_u8(buf, state)) != 0 ||
633: (r = sshbuf_put_stringb(buf, sect)) != 0)
634: goto out;
635: sshbuf_reset(sect);
1.1 djm 636: }
637:
638: /* If we are starting a new section then prepare it now */
639: if (next_state != state || force_new_sect) {
1.52 djm 640: KRL_DBG(("start state 0x%02x",
1.25 djm 641: next_state));
1.1 djm 642: state = next_state;
1.20 djm 643: sshbuf_reset(sect);
1.1 djm 644: switch (state) {
645: case KRL_SECTION_CERT_SERIAL_LIST:
646: case KRL_SECTION_CERT_SERIAL_RANGE:
647: break;
648: case KRL_SECTION_CERT_SERIAL_BITMAP:
1.26 djm 649: if ((bitmap = bitmap_new()) == NULL) {
1.20 djm 650: r = SSH_ERR_ALLOC_FAIL;
1.1 djm 651: goto out;
1.20 djm 652: }
1.1 djm 653: bitmap_start = rs->lo;
1.20 djm 654: if ((r = sshbuf_put_u64(sect,
655: bitmap_start)) != 0)
656: goto out;
1.1 djm 657: break;
658: }
659: }
660:
661: /* Perform section-specific processing */
662: switch (state) {
663: case KRL_SECTION_CERT_SERIAL_LIST:
1.20 djm 664: for (i = 0; i < contig; i++) {
665: if ((r = sshbuf_put_u64(sect, rs->lo + i)) != 0)
666: goto out;
667: }
1.1 djm 668: break;
669: case KRL_SECTION_CERT_SERIAL_RANGE:
1.20 djm 670: if ((r = sshbuf_put_u64(sect, rs->lo)) != 0 ||
671: (r = sshbuf_put_u64(sect, rs->hi)) != 0)
672: goto out;
1.1 djm 673: break;
674: case KRL_SECTION_CERT_SERIAL_BITMAP:
675: if (rs->lo - bitmap_start > INT_MAX) {
1.52 djm 676: error_f("insane bitmap gap");
1.1 djm 677: goto out;
678: }
679: for (i = 0; i < contig; i++) {
1.26 djm 680: if (bitmap_set_bit(bitmap,
681: rs->lo + i - bitmap_start) != 0) {
1.20 djm 682: r = SSH_ERR_ALLOC_FAIL;
1.1 djm 683: goto out;
1.20 djm 684: }
1.1 djm 685: }
686: break;
687: }
688: last = rs->hi;
689: }
690: /* Flush the remaining section, if any */
691: if (state != 0) {
1.52 djm 692: KRL_DBG(("serial final flush for state 0x%02x", state));
1.1 djm 693: switch (state) {
694: case KRL_SECTION_CERT_SERIAL_LIST:
695: case KRL_SECTION_CERT_SERIAL_RANGE:
696: break;
697: case KRL_SECTION_CERT_SERIAL_BITMAP:
1.26 djm 698: if ((r = put_bitmap(sect, bitmap)) != 0)
1.20 djm 699: goto out;
1.26 djm 700: bitmap_free(bitmap);
1.1 djm 701: bitmap = NULL;
702: break;
703: }
1.20 djm 704: if ((r = sshbuf_put_u8(buf, state)) != 0 ||
705: (r = sshbuf_put_stringb(buf, sect)) != 0)
706: goto out;
1.1 djm 707: }
1.52 djm 708: KRL_DBG(("serial done "));
1.1 djm 709:
710: /* Now output a section for any revocations by key ID */
1.20 djm 711: sshbuf_reset(sect);
1.1 djm 712: RB_FOREACH(rki, revoked_key_id_tree, &rc->revoked_key_ids) {
1.52 djm 713: KRL_DBG(("key ID %s", rki->key_id));
1.20 djm 714: if ((r = sshbuf_put_cstring(sect, rki->key_id)) != 0)
715: goto out;
1.1 djm 716: }
1.20 djm 717: if (sshbuf_len(sect) != 0) {
718: if ((r = sshbuf_put_u8(buf, KRL_SECTION_CERT_KEY_ID)) != 0 ||
719: (r = sshbuf_put_stringb(buf, sect)) != 0)
720: goto out;
1.1 djm 721: }
722: r = 0;
723: out:
1.26 djm 724: bitmap_free(bitmap);
1.20 djm 725: sshbuf_free(sect);
1.1 djm 726: return r;
727: }
728:
729: int
1.20 djm 730: ssh_krl_to_blob(struct ssh_krl *krl, struct sshbuf *buf,
1.43 djm 731: struct sshkey **sign_keys, u_int nsign_keys)
1.1 djm 732: {
1.25 djm 733: int r = SSH_ERR_INTERNAL_ERROR;
1.1 djm 734: struct revoked_certs *rc;
735: struct revoked_blob *rb;
1.20 djm 736: struct sshbuf *sect;
737: u_char *sblob = NULL;
738: size_t slen, i;
1.1 djm 739:
740: if (krl->generated_date == 0)
741: krl->generated_date = time(NULL);
742:
1.20 djm 743: if ((sect = sshbuf_new()) == NULL)
744: return SSH_ERR_ALLOC_FAIL;
1.1 djm 745:
746: /* Store the header */
1.20 djm 747: if ((r = sshbuf_put(buf, KRL_MAGIC, sizeof(KRL_MAGIC) - 1)) != 0 ||
748: (r = sshbuf_put_u32(buf, KRL_FORMAT_VERSION)) != 0 ||
749: (r = sshbuf_put_u64(buf, krl->krl_version)) != 0 ||
1.34 jsg 750: (r = sshbuf_put_u64(buf, krl->generated_date)) != 0 ||
1.20 djm 751: (r = sshbuf_put_u64(buf, krl->flags)) != 0 ||
752: (r = sshbuf_put_string(buf, NULL, 0)) != 0 ||
753: (r = sshbuf_put_cstring(buf, krl->comment)) != 0)
754: goto out;
1.1 djm 755:
756: /* Store sections for revoked certificates */
757: TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
1.20 djm 758: sshbuf_reset(sect);
759: if ((r = revoked_certs_generate(rc, sect)) != 0)
760: goto out;
761: if ((r = sshbuf_put_u8(buf, KRL_SECTION_CERTIFICATES)) != 0 ||
762: (r = sshbuf_put_stringb(buf, sect)) != 0)
1.1 djm 763: goto out;
764: }
765:
766: /* Finally, output sections for revocations by public key/hash */
1.20 djm 767: sshbuf_reset(sect);
1.1 djm 768: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_keys) {
1.52 djm 769: KRL_DBG(("key len %zu ", rb->len));
1.24 markus 770: if ((r = sshbuf_put_string(sect, rb->blob, rb->len)) != 0)
1.20 djm 771: goto out;
1.1 djm 772: }
1.20 djm 773: if (sshbuf_len(sect) != 0) {
774: if ((r = sshbuf_put_u8(buf, KRL_SECTION_EXPLICIT_KEY)) != 0 ||
775: (r = sshbuf_put_stringb(buf, sect)) != 0)
776: goto out;
1.1 djm 777: }
1.20 djm 778: sshbuf_reset(sect);
1.1 djm 779: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha1s) {
1.52 djm 780: KRL_DBG(("hash len %zu ", rb->len));
1.24 markus 781: if ((r = sshbuf_put_string(sect, rb->blob, rb->len)) != 0)
1.20 djm 782: goto out;
1.1 djm 783: }
1.20 djm 784: if (sshbuf_len(sect) != 0) {
785: if ((r = sshbuf_put_u8(buf,
786: KRL_SECTION_FINGERPRINT_SHA1)) != 0 ||
787: (r = sshbuf_put_stringb(buf, sect)) != 0)
788: goto out;
1.1 djm 789: }
1.42 djm 790: sshbuf_reset(sect);
791: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha256s) {
1.52 djm 792: KRL_DBG(("hash len %zu ", rb->len));
1.42 djm 793: if ((r = sshbuf_put_string(sect, rb->blob, rb->len)) != 0)
794: goto out;
795: }
796: if (sshbuf_len(sect) != 0) {
797: if ((r = sshbuf_put_u8(buf,
798: KRL_SECTION_FINGERPRINT_SHA256)) != 0 ||
799: (r = sshbuf_put_stringb(buf, sect)) != 0)
800: goto out;
801: }
1.1 djm 802:
803: for (i = 0; i < nsign_keys; i++) {
1.52 djm 804: KRL_DBG(("sig key %s", sshkey_ssh_name(sign_keys[i])));
1.20 djm 805: if ((r = sshbuf_put_u8(buf, KRL_SECTION_SIGNATURE)) != 0 ||
1.30 djm 806: (r = sshkey_puts(sign_keys[i], buf)) != 0)
1.20 djm 807: goto out;
1.51 djm 808: /* XXX support sk-* keys */
1.20 djm 809: if ((r = sshkey_sign(sign_keys[i], &sblob, &slen,
1.51 djm 810: sshbuf_ptr(buf), sshbuf_len(buf), NULL, NULL,
811: NULL, 0)) != 0)
1.20 djm 812: goto out;
1.52 djm 813: KRL_DBG(("signature sig len %zu", slen));
1.20 djm 814: if ((r = sshbuf_put_string(buf, sblob, slen)) != 0)
1.1 djm 815: goto out;
816: }
817:
818: r = 0;
819: out:
820: free(sblob);
1.20 djm 821: sshbuf_free(sect);
1.1 djm 822: return r;
823: }
824:
825: static void
826: format_timestamp(u_int64_t timestamp, char *ts, size_t nts)
827: {
828: time_t t;
829: struct tm *tm;
830:
831: t = timestamp;
832: tm = localtime(&t);
1.19 djm 833: if (tm == NULL)
1.27 deraadt 834: strlcpy(ts, "<INVALID>", nts);
1.19 djm 835: else {
836: *ts = '\0';
837: strftime(ts, nts, "%Y%m%dT%H%M%S", tm);
838: }
1.1 djm 839: }
840:
841: static int
1.20 djm 842: parse_revoked_certs(struct sshbuf *buf, struct ssh_krl *krl)
1.1 djm 843: {
1.26 djm 844: int r = SSH_ERR_INTERNAL_ERROR;
1.15 djm 845: u_char type;
846: const u_char *blob;
1.26 djm 847: size_t blen, nbits;
1.20 djm 848: struct sshbuf *subsect = NULL;
1.1 djm 849: u_int64_t serial, serial_lo, serial_hi;
1.26 djm 850: struct bitmap *bitmap = NULL;
1.1 djm 851: char *key_id = NULL;
1.20 djm 852: struct sshkey *ca_key = NULL;
1.1 djm 853:
1.20 djm 854: if ((subsect = sshbuf_new()) == NULL)
855: return SSH_ERR_ALLOC_FAIL;
1.1 djm 856:
1.20 djm 857: /* Header: key, reserved */
858: if ((r = sshbuf_get_string_direct(buf, &blob, &blen)) != 0 ||
859: (r = sshbuf_skip_string(buf)) != 0)
1.1 djm 860: goto out;
1.31 djm 861: if (blen != 0 && (r = sshkey_from_blob(blob, blen, &ca_key)) != 0)
1.1 djm 862: goto out;
863:
1.20 djm 864: while (sshbuf_len(buf) > 0) {
1.36 mmcc 865: sshbuf_free(subsect);
866: subsect = NULL;
1.20 djm 867: if ((r = sshbuf_get_u8(buf, &type)) != 0 ||
868: (r = sshbuf_froms(buf, &subsect)) != 0)
1.1 djm 869: goto out;
1.52 djm 870: KRL_DBG(("subsection type 0x%02x", type));
1.25 djm 871: /* sshbuf_dump(subsect, stderr); */
1.1 djm 872:
873: switch (type) {
874: case KRL_SECTION_CERT_SERIAL_LIST:
1.20 djm 875: while (sshbuf_len(subsect) > 0) {
876: if ((r = sshbuf_get_u64(subsect, &serial)) != 0)
1.1 djm 877: goto out;
1.20 djm 878: if ((r = ssh_krl_revoke_cert_by_serial(krl,
879: ca_key, serial)) != 0)
1.1 djm 880: goto out;
881: }
882: break;
883: case KRL_SECTION_CERT_SERIAL_RANGE:
1.20 djm 884: if ((r = sshbuf_get_u64(subsect, &serial_lo)) != 0 ||
885: (r = sshbuf_get_u64(subsect, &serial_hi)) != 0)
1.1 djm 886: goto out;
1.20 djm 887: if ((r = ssh_krl_revoke_cert_by_serial_range(krl,
888: ca_key, serial_lo, serial_hi)) != 0)
1.1 djm 889: goto out;
890: break;
891: case KRL_SECTION_CERT_SERIAL_BITMAP:
1.26 djm 892: if ((bitmap = bitmap_new()) == NULL) {
1.20 djm 893: r = SSH_ERR_ALLOC_FAIL;
1.1 djm 894: goto out;
895: }
1.20 djm 896: if ((r = sshbuf_get_u64(subsect, &serial_lo)) != 0 ||
1.26 djm 897: (r = sshbuf_get_bignum2_bytes_direct(subsect,
898: &blob, &blen)) != 0)
1.1 djm 899: goto out;
1.26 djm 900: if (bitmap_from_string(bitmap, blob, blen) != 0) {
1.20 djm 901: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 902: goto out;
903: }
1.26 djm 904: nbits = bitmap_nbits(bitmap);
1.25 djm 905: for (serial = 0; serial < (u_int64_t)nbits; serial++) {
1.1 djm 906: if (serial > 0 && serial_lo + serial == 0) {
1.52 djm 907: error_f("bitmap wraps u64");
1.20 djm 908: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 909: goto out;
910: }
1.26 djm 911: if (!bitmap_test_bit(bitmap, serial))
1.1 djm 912: continue;
1.20 djm 913: if ((r = ssh_krl_revoke_cert_by_serial(krl,
914: ca_key, serial_lo + serial)) != 0)
1.1 djm 915: goto out;
916: }
1.26 djm 917: bitmap_free(bitmap);
1.1 djm 918: bitmap = NULL;
919: break;
920: case KRL_SECTION_CERT_KEY_ID:
1.20 djm 921: while (sshbuf_len(subsect) > 0) {
922: if ((r = sshbuf_get_cstring(subsect,
923: &key_id, NULL)) != 0)
1.1 djm 924: goto out;
1.20 djm 925: if ((r = ssh_krl_revoke_cert_by_key_id(krl,
926: ca_key, key_id)) != 0)
1.1 djm 927: goto out;
928: free(key_id);
929: key_id = NULL;
930: }
931: break;
932: default:
933: error("Unsupported KRL certificate section %u", type);
1.20 djm 934: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 935: goto out;
936: }
1.20 djm 937: if (sshbuf_len(subsect) > 0) {
1.1 djm 938: error("KRL certificate section contains unparsed data");
1.20 djm 939: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 940: goto out;
941: }
942: }
943:
1.20 djm 944: r = 0;
1.1 djm 945: out:
946: if (bitmap != NULL)
1.26 djm 947: bitmap_free(bitmap);
1.1 djm 948: free(key_id);
1.20 djm 949: sshkey_free(ca_key);
950: sshbuf_free(subsect);
951: return r;
1.1 djm 952: }
953:
1.42 djm 954: static int
955: blob_section(struct sshbuf *sect, struct revoked_blob_tree *target_tree,
956: size_t expected_len)
957: {
958: u_char *rdata = NULL;
959: size_t rlen = 0;
960: int r;
961:
962: while (sshbuf_len(sect) > 0) {
963: if ((r = sshbuf_get_string(sect, &rdata, &rlen)) != 0)
964: return r;
965: if (expected_len != 0 && rlen != expected_len) {
1.52 djm 966: error_f("bad length");
1.42 djm 967: free(rdata);
968: return SSH_ERR_INVALID_FORMAT;
969: }
970: if ((r = revoke_blob(target_tree, rdata, rlen)) != 0) {
971: free(rdata);
972: return r;
973: }
974: }
975: return 0;
976: }
1.1 djm 977:
978: /* Attempt to parse a KRL, checking its signature (if any) with sign_ca_keys. */
979: int
1.20 djm 980: ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp,
1.25 djm 981: const struct sshkey **sign_ca_keys, size_t nsign_ca_keys)
1.1 djm 982: {
1.20 djm 983: struct sshbuf *copy = NULL, *sect = NULL;
984: struct ssh_krl *krl = NULL;
1.1 djm 985: char timestamp[64];
1.25 djm 986: int r = SSH_ERR_INTERNAL_ERROR, sig_seen;
1.20 djm 987: struct sshkey *key = NULL, **ca_used = NULL, **tmp_ca_used;
1.42 djm 988: u_char type;
1.15 djm 989: const u_char *blob;
1.42 djm 990: size_t i, j, sig_off, sects_off, blen, nca_used;
1.20 djm 991: u_int format_version;
1.1 djm 992:
1.12 markus 993: nca_used = 0;
1.1 djm 994: *krlp = NULL;
1.20 djm 995: if (sshbuf_len(buf) < sizeof(KRL_MAGIC) - 1 ||
996: memcmp(sshbuf_ptr(buf), KRL_MAGIC, sizeof(KRL_MAGIC) - 1) != 0) {
1.52 djm 997: debug3_f("not a KRL");
1.20 djm 998: return SSH_ERR_KRL_BAD_MAGIC;
1.1 djm 999: }
1000:
1001: /* Take a copy of the KRL buffer so we can verify its signature later */
1.20 djm 1002: if ((copy = sshbuf_fromb(buf)) == NULL) {
1003: r = SSH_ERR_ALLOC_FAIL;
1004: goto out;
1005: }
1006: if ((r = sshbuf_consume(copy, sizeof(KRL_MAGIC) - 1)) != 0)
1007: goto out;
1.1 djm 1008:
1009: if ((krl = ssh_krl_init()) == NULL) {
1.52 djm 1010: error_f("alloc failed");
1.1 djm 1011: goto out;
1012: }
1013:
1.20 djm 1014: if ((r = sshbuf_get_u32(copy, &format_version)) != 0)
1.1 djm 1015: goto out;
1016: if (format_version != KRL_FORMAT_VERSION) {
1.20 djm 1017: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 1018: goto out;
1019: }
1.20 djm 1020: if ((r = sshbuf_get_u64(copy, &krl->krl_version)) != 0 ||
1021: (r = sshbuf_get_u64(copy, &krl->generated_date)) != 0 ||
1022: (r = sshbuf_get_u64(copy, &krl->flags)) != 0 ||
1023: (r = sshbuf_skip_string(copy)) != 0 ||
1024: (r = sshbuf_get_cstring(copy, &krl->comment, NULL)) != 0)
1.1 djm 1025: goto out;
1026:
1027: format_timestamp(krl->generated_date, timestamp, sizeof(timestamp));
1.11 djm 1028: debug("KRL version %llu generated at %s%s%s",
1029: (long long unsigned)krl->krl_version, timestamp,
1030: *krl->comment ? ": " : "", krl->comment);
1.1 djm 1031:
1032: /*
1033: * 1st pass: verify signatures, if any. This is done to avoid
1034: * detailed parsing of data whose provenance is unverified.
1035: */
1036: sig_seen = 0;
1.20 djm 1037: if (sshbuf_len(buf) < sshbuf_len(copy)) {
1038: /* Shouldn't happen */
1039: r = SSH_ERR_INTERNAL_ERROR;
1040: goto out;
1041: }
1042: sects_off = sshbuf_len(buf) - sshbuf_len(copy);
1043: while (sshbuf_len(copy) > 0) {
1044: if ((r = sshbuf_get_u8(copy, &type)) != 0 ||
1045: (r = sshbuf_get_string_direct(copy, &blob, &blen)) != 0)
1.1 djm 1046: goto out;
1.52 djm 1047: KRL_DBG(("first pass, section 0x%02x", type));
1.1 djm 1048: if (type != KRL_SECTION_SIGNATURE) {
1049: if (sig_seen) {
1050: error("KRL contains non-signature section "
1051: "after signature");
1.25 djm 1052: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 1053: goto out;
1054: }
1055: /* Not interested for now. */
1056: continue;
1057: }
1058: sig_seen = 1;
1059: /* First string component is the signing key */
1.20 djm 1060: if ((r = sshkey_from_blob(blob, blen, &key)) != 0) {
1061: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 1062: goto out;
1063: }
1.20 djm 1064: if (sshbuf_len(buf) < sshbuf_len(copy)) {
1065: /* Shouldn't happen */
1066: r = SSH_ERR_INTERNAL_ERROR;
1067: goto out;
1068: }
1069: sig_off = sshbuf_len(buf) - sshbuf_len(copy);
1.1 djm 1070: /* Second string component is the signature itself */
1.20 djm 1071: if ((r = sshbuf_get_string_direct(copy, &blob, &blen)) != 0) {
1072: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 1073: goto out;
1074: }
1075: /* Check signature over entire KRL up to this point */
1.20 djm 1076: if ((r = sshkey_verify(key, blob, blen,
1.46 djm 1077: sshbuf_ptr(buf), sig_off, NULL, 0, NULL)) != 0)
1.1 djm 1078: goto out;
1079: /* Check if this key has already signed this KRL */
1080: for (i = 0; i < nca_used; i++) {
1.20 djm 1081: if (sshkey_equal(ca_used[i], key)) {
1.1 djm 1082: error("KRL signed more than once with "
1083: "the same key");
1.25 djm 1084: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 1085: goto out;
1086: }
1087: }
1088: /* Record keys used to sign the KRL */
1.40 deraadt 1089: tmp_ca_used = recallocarray(ca_used, nca_used, nca_used + 1,
1.20 djm 1090: sizeof(*ca_used));
1091: if (tmp_ca_used == NULL) {
1092: r = SSH_ERR_ALLOC_FAIL;
1093: goto out;
1094: }
1095: ca_used = tmp_ca_used;
1.1 djm 1096: ca_used[nca_used++] = key;
1097: key = NULL;
1098: }
1099:
1.20 djm 1100: if (sshbuf_len(copy) != 0) {
1101: /* Shouldn't happen */
1102: r = SSH_ERR_INTERNAL_ERROR;
1103: goto out;
1104: }
1105:
1.1 djm 1106: /*
1107: * 2nd pass: parse and load the KRL, skipping the header to the point
1108: * where the section start.
1109: */
1.20 djm 1110: sshbuf_free(copy);
1111: if ((copy = sshbuf_fromb(buf)) == NULL) {
1112: r = SSH_ERR_ALLOC_FAIL;
1113: goto out;
1114: }
1115: if ((r = sshbuf_consume(copy, sects_off)) != 0)
1116: goto out;
1117: while (sshbuf_len(copy) > 0) {
1.36 mmcc 1118: sshbuf_free(sect);
1119: sect = NULL;
1.20 djm 1120: if ((r = sshbuf_get_u8(copy, &type)) != 0 ||
1.25 djm 1121: (r = sshbuf_froms(copy, §)) != 0)
1.1 djm 1122: goto out;
1.52 djm 1123: KRL_DBG(("second pass, section 0x%02x", type));
1.1 djm 1124:
1125: switch (type) {
1126: case KRL_SECTION_CERTIFICATES:
1.20 djm 1127: if ((r = parse_revoked_certs(sect, krl)) != 0)
1.1 djm 1128: goto out;
1129: break;
1130: case KRL_SECTION_EXPLICIT_KEY:
1.42 djm 1131: if ((r = blob_section(sect,
1132: &krl->revoked_keys, 0)) != 0)
1133: goto out;
1134: break;
1.1 djm 1135: case KRL_SECTION_FINGERPRINT_SHA1:
1.42 djm 1136: if ((r = blob_section(sect,
1137: &krl->revoked_sha1s, 20)) != 0)
1138: goto out;
1139: break;
1140: case KRL_SECTION_FINGERPRINT_SHA256:
1141: if ((r = blob_section(sect,
1142: &krl->revoked_sha256s, 32)) != 0)
1143: goto out;
1.1 djm 1144: break;
1145: case KRL_SECTION_SIGNATURE:
1146: /* Handled above, but still need to stay in synch */
1.39 dtucker 1147: sshbuf_free(sect);
1.20 djm 1148: sect = NULL;
1149: if ((r = sshbuf_skip_string(copy)) != 0)
1.1 djm 1150: goto out;
1151: break;
1152: default:
1153: error("Unsupported KRL section %u", type);
1.20 djm 1154: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 1155: goto out;
1156: }
1.37 djm 1157: if (sect != NULL && sshbuf_len(sect) > 0) {
1.1 djm 1158: error("KRL section contains unparsed data");
1.20 djm 1159: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 1160: goto out;
1161: }
1162: }
1163:
1164: /* Check that the key(s) used to sign the KRL weren't revoked */
1165: sig_seen = 0;
1166: for (i = 0; i < nca_used; i++) {
1167: if (ssh_krl_check_key(krl, ca_used[i]) == 0)
1168: sig_seen = 1;
1169: else {
1.20 djm 1170: sshkey_free(ca_used[i]);
1.1 djm 1171: ca_used[i] = NULL;
1172: }
1173: }
1174: if (nca_used && !sig_seen) {
1175: error("All keys used to sign KRL were revoked");
1.25 djm 1176: r = SSH_ERR_KEY_REVOKED;
1.1 djm 1177: goto out;
1178: }
1179:
1180: /* If we have CA keys, then verify that one was used to sign the KRL */
1181: if (sig_seen && nsign_ca_keys != 0) {
1182: sig_seen = 0;
1183: for (i = 0; !sig_seen && i < nsign_ca_keys; i++) {
1184: for (j = 0; j < nca_used; j++) {
1185: if (ca_used[j] == NULL)
1186: continue;
1.20 djm 1187: if (sshkey_equal(ca_used[j], sign_ca_keys[i])) {
1.1 djm 1188: sig_seen = 1;
1189: break;
1190: }
1191: }
1192: }
1193: if (!sig_seen) {
1.20 djm 1194: r = SSH_ERR_SIGNATURE_INVALID;
1.1 djm 1195: error("KRL not signed with any trusted key");
1196: goto out;
1197: }
1198: }
1199:
1200: *krlp = krl;
1.20 djm 1201: r = 0;
1.1 djm 1202: out:
1.20 djm 1203: if (r != 0)
1.1 djm 1204: ssh_krl_free(krl);
1.20 djm 1205: for (i = 0; i < nca_used; i++)
1206: sshkey_free(ca_used[i]);
1.1 djm 1207: free(ca_used);
1.20 djm 1208: sshkey_free(key);
1209: sshbuf_free(copy);
1210: sshbuf_free(sect);
1211: return r;
1.1 djm 1212: }
1213:
1.31 djm 1214: /* Checks certificate serial number and key ID revocation */
1215: static int
1216: is_cert_revoked(const struct sshkey *key, struct revoked_certs *rc)
1217: {
1218: struct revoked_serial rs, *ers;
1219: struct revoked_key_id rki, *erki;
1220:
1221: /* Check revocation by cert key ID */
1222: memset(&rki, 0, sizeof(rki));
1223: rki.key_id = key->cert->key_id;
1224: erki = RB_FIND(revoked_key_id_tree, &rc->revoked_key_ids, &rki);
1225: if (erki != NULL) {
1.52 djm 1226: KRL_DBG(("revoked by key ID"));
1.31 djm 1227: return SSH_ERR_KEY_REVOKED;
1228: }
1229:
1230: /*
1.33 djm 1231: * Zero serials numbers are ignored (it's the default when the
1232: * CA doesn't specify one).
1.31 djm 1233: */
1.33 djm 1234: if (key->cert->serial == 0)
1.31 djm 1235: return 0;
1236:
1237: memset(&rs, 0, sizeof(rs));
1238: rs.lo = rs.hi = key->cert->serial;
1239: ers = RB_FIND(revoked_serial_tree, &rc->revoked_serials, &rs);
1240: if (ers != NULL) {
1.52 djm 1241: KRL_DBG(("revoked serial %llu matched %llu:%llu",
1.31 djm 1242: key->cert->serial, ers->lo, ers->hi));
1243: return SSH_ERR_KEY_REVOKED;
1244: }
1245: return 0;
1246: }
1247:
1.1 djm 1248: /* Checks whether a given key/cert is revoked. Does not check its CA */
1249: static int
1.20 djm 1250: is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
1.1 djm 1251: {
1252: struct revoked_blob rb, *erb;
1253: struct revoked_certs *rc;
1.20 djm 1254: int r;
1.1 djm 1255:
1256: /* Check explicitly revoked hashes first */
1.14 tedu 1257: memset(&rb, 0, sizeof(rb));
1.21 djm 1258: if ((r = sshkey_fingerprint_raw(key, SSH_DIGEST_SHA1,
1.20 djm 1259: &rb.blob, &rb.len)) != 0)
1260: return r;
1.1 djm 1261: erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
1262: free(rb.blob);
1263: if (erb != NULL) {
1.52 djm 1264: KRL_DBG(("revoked by key SHA1"));
1.42 djm 1265: return SSH_ERR_KEY_REVOKED;
1266: }
1267: memset(&rb, 0, sizeof(rb));
1268: if ((r = sshkey_fingerprint_raw(key, SSH_DIGEST_SHA256,
1269: &rb.blob, &rb.len)) != 0)
1270: return r;
1271: erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha256s, &rb);
1272: free(rb.blob);
1273: if (erb != NULL) {
1.52 djm 1274: KRL_DBG(("revoked by key SHA256"));
1.20 djm 1275: return SSH_ERR_KEY_REVOKED;
1.1 djm 1276: }
1277:
1278: /* Next, explicit keys */
1.14 tedu 1279: memset(&rb, 0, sizeof(rb));
1.20 djm 1280: if ((r = plain_key_blob(key, &rb.blob, &rb.len)) != 0)
1281: return r;
1.1 djm 1282: erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb);
1283: free(rb.blob);
1284: if (erb != NULL) {
1.52 djm 1285: KRL_DBG(("revoked by explicit key"));
1.20 djm 1286: return SSH_ERR_KEY_REVOKED;
1.1 djm 1287: }
1288:
1.20 djm 1289: if (!sshkey_is_cert(key))
1.1 djm 1290: return 0;
1291:
1.31 djm 1292: /* Check cert revocation for the specified CA */
1.20 djm 1293: if ((r = revoked_certs_for_ca_key(krl, key->cert->signature_key,
1294: &rc, 0)) != 0)
1295: return r;
1.31 djm 1296: if (rc != NULL) {
1297: if ((r = is_cert_revoked(key, rc)) != 0)
1298: return r;
1299: }
1300: /* Check cert revocation for the wildcard CA */
1301: if ((r = revoked_certs_for_ca_key(krl, NULL, &rc, 0)) != 0)
1302: return r;
1303: if (rc != NULL) {
1304: if ((r = is_cert_revoked(key, rc)) != 0)
1305: return r;
1.1 djm 1306: }
1307:
1.52 djm 1308: KRL_DBG(("%llu no match", key->cert->serial));
1.1 djm 1309: return 0;
1310: }
1311:
1312: int
1.20 djm 1313: ssh_krl_check_key(struct ssh_krl *krl, const struct sshkey *key)
1.1 djm 1314: {
1315: int r;
1316:
1.52 djm 1317: KRL_DBG(("checking key"));
1.1 djm 1318: if ((r = is_key_revoked(krl, key)) != 0)
1319: return r;
1.20 djm 1320: if (sshkey_is_cert(key)) {
1.52 djm 1321: debug2_f("checking CA key");
1.1 djm 1322: if ((r = is_key_revoked(krl, key->cert->signature_key)) != 0)
1323: return r;
1324: }
1.52 djm 1325: KRL_DBG(("key okay"));
1.1 djm 1326: return 0;
1327: }
1328:
1329: int
1.20 djm 1330: ssh_krl_file_contains_key(const char *path, const struct sshkey *key)
1.1 djm 1331: {
1.20 djm 1332: struct sshbuf *krlbuf = NULL;
1333: struct ssh_krl *krl = NULL;
1.47 djm 1334: int oerrno = 0, r;
1.1 djm 1335:
1336: if (path == NULL)
1337: return 0;
1.47 djm 1338: if ((r = sshbuf_load_file(path, &krlbuf)) != 0) {
1.20 djm 1339: oerrno = errno;
1340: goto out;
1.1 djm 1341: }
1.20 djm 1342: if ((r = ssh_krl_from_blob(krlbuf, &krl, NULL, 0)) != 0)
1343: goto out;
1.52 djm 1344: debug2_f("checking KRL %s", path);
1.20 djm 1345: r = ssh_krl_check_key(krl, key);
1346: out:
1347: sshbuf_free(krlbuf);
1.1 djm 1348: ssh_krl_free(krl);
1.20 djm 1349: if (r != 0)
1350: errno = oerrno;
1351: return r;
1.48 djm 1352: }
1353:
1354: int
1355: krl_dump(struct ssh_krl *krl, FILE *f)
1356: {
1357: struct sshkey *key = NULL;
1358: struct revoked_blob *rb;
1359: struct revoked_certs *rc;
1360: struct revoked_serial *rs;
1361: struct revoked_key_id *rki;
1362: int r, ret = 0;
1363: char *fp, timestamp[64];
1364:
1365: /* Try to print in a KRL spec-compatible format */
1366: format_timestamp(krl->generated_date, timestamp, sizeof(timestamp));
1.50 djm 1367: fprintf(f, "# KRL version %llu\n",
1368: (unsigned long long)krl->krl_version);
1.48 djm 1369: fprintf(f, "# Generated at %s\n", timestamp);
1370: if (krl->comment != NULL && *krl->comment != '\0') {
1371: r = INT_MAX;
1372: asmprintf(&fp, INT_MAX, &r, "%s", krl->comment);
1373: fprintf(f, "# Comment: %s\n", fp);
1374: free(fp);
1375: }
1376: fputc('\n', f);
1377:
1378: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_keys) {
1379: if ((r = sshkey_from_blob(rb->blob, rb->len, &key)) != 0) {
1380: ret = SSH_ERR_INVALID_FORMAT;
1.52 djm 1381: error_r(r, "parse KRL key");
1.48 djm 1382: continue;
1383: }
1384: if ((fp = sshkey_fingerprint(key, SSH_FP_HASH_DEFAULT,
1385: SSH_FP_DEFAULT)) == NULL) {
1386: ret = SSH_ERR_INVALID_FORMAT;
1387: error("sshkey_fingerprint failed");
1388: continue;
1389: }
1.54 djm 1390: fprintf(f, "hash: %s # %s\n", fp, sshkey_ssh_name(key));
1.48 djm 1391: free(fp);
1392: free(key);
1393: }
1394: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha256s) {
1395: fp = tohex(rb->blob, rb->len);
1396: fprintf(f, "hash: SHA256:%s\n", fp);
1397: free(fp);
1398: }
1399: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha1s) {
1400: /*
1401: * There is not KRL spec keyword for raw SHA1 hashes, so
1402: * print them as comments.
1403: */
1404: fp = tohex(rb->blob, rb->len);
1405: fprintf(f, "# hash SHA1:%s\n", fp);
1406: free(fp);
1407: }
1408:
1409: TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
1410: fputc('\n', f);
1411: if (rc->ca_key == NULL)
1412: fprintf(f, "# Wildcard CA\n");
1413: else {
1414: if ((fp = sshkey_fingerprint(rc->ca_key,
1415: SSH_FP_HASH_DEFAULT, SSH_FP_DEFAULT)) == NULL) {
1416: ret = SSH_ERR_INVALID_FORMAT;
1417: error("sshkey_fingerprint failed");
1418: continue;
1419: }
1420: fprintf(f, "# CA key %s %s\n",
1421: sshkey_ssh_name(rc->ca_key), fp);
1422: free(fp);
1423: }
1424: RB_FOREACH(rs, revoked_serial_tree, &rc->revoked_serials) {
1.50 djm 1425: if (rs->lo == rs->hi) {
1426: fprintf(f, "serial: %llu\n",
1427: (unsigned long long)rs->lo);
1428: } else {
1.49 djm 1429: fprintf(f, "serial: %llu-%llu\n",
1.50 djm 1430: (unsigned long long)rs->lo,
1431: (unsigned long long)rs->hi);
1.48 djm 1432: }
1433: }
1434: RB_FOREACH(rki, revoked_key_id_tree, &rc->revoked_key_ids) {
1435: /*
1436: * We don't want key IDs with embedded newlines to
1437: * mess up the display.
1438: */
1439: r = INT_MAX;
1440: asmprintf(&fp, INT_MAX, &r, "%s", rki->key_id);
1441: fprintf(f, "id: %s\n", fp);
1442: free(fp);
1443: }
1444: }
1445: return ret;
1.1 djm 1446: }
![[BACK]](/icons/back.gif){kind=icon}
Return to krl.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh