Annotation of src/usr.bin/ssh/krl.c, Revision 1.56
1.1 djm 1: /*
2: * Copyright (c) 2012 Damien Miller <djm@mindrot.org>
3: *
4: * Permission to use, copy, modify, and distribute this software for any
5: * purpose with or without fee is hereby granted, provided that the above
6: * copyright notice and this permission notice appear in all copies.
7: *
8: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15: */
16:
1.56 ! djm 17: /* $OpenBSD: krl.c,v 1.55 2023/03/14 07:28:47 dtucker Exp $ */
1.2 djm 18:
1.1 djm 19: #include <sys/types.h>
20: #include <sys/tree.h>
21: #include <sys/queue.h>
22:
23: #include <errno.h>
24: #include <fcntl.h>
25: #include <limits.h>
26: #include <string.h>
27: #include <time.h>
28: #include <unistd.h>
1.44 djm 29: #include <stdlib.h>
1.1 djm 30:
1.20 djm 31: #include "sshbuf.h"
1.25 djm 32: #include "ssherr.h"
1.20 djm 33: #include "sshkey.h"
1.1 djm 34: #include "authfile.h"
35: #include "misc.h"
36: #include "log.h"
1.21 djm 37: #include "digest.h"
1.26 djm 38: #include "bitmap.h"
1.48 djm 39: #include "utf8.h"
1.1 djm 40:
41: #include "krl.h"
42:
43: /* #define DEBUG_KRL */
44: #ifdef DEBUG_KRL
1.52 djm 45: # define KRL_DBG(x) debug3_f x
1.1 djm 46: #else
47: # define KRL_DBG(x)
48: #endif
49:
50: /*
51: * Trees of revoked serial numbers, key IDs and keys. This allows
52: * quick searching, querying and producing lists in canonical order.
53: */
54:
55: /* Tree of serial numbers. XXX make smarter: really need a real sparse bitmap */
56: struct revoked_serial {
57: u_int64_t lo, hi;
58: RB_ENTRY(revoked_serial) tree_entry;
59: };
60: static int serial_cmp(struct revoked_serial *a, struct revoked_serial *b);
61: RB_HEAD(revoked_serial_tree, revoked_serial);
1.53 djm 62: RB_GENERATE_STATIC(revoked_serial_tree, revoked_serial, tree_entry, serial_cmp)
1.1 djm 63:
64: /* Tree of key IDs */
65: struct revoked_key_id {
66: char *key_id;
67: RB_ENTRY(revoked_key_id) tree_entry;
68: };
69: static int key_id_cmp(struct revoked_key_id *a, struct revoked_key_id *b);
70: RB_HEAD(revoked_key_id_tree, revoked_key_id);
1.53 djm 71: RB_GENERATE_STATIC(revoked_key_id_tree, revoked_key_id, tree_entry, key_id_cmp)
1.1 djm 72:
73: /* Tree of blobs (used for keys and fingerprints) */
74: struct revoked_blob {
75: u_char *blob;
1.20 djm 76: size_t len;
1.1 djm 77: RB_ENTRY(revoked_blob) tree_entry;
78: };
79: static int blob_cmp(struct revoked_blob *a, struct revoked_blob *b);
80: RB_HEAD(revoked_blob_tree, revoked_blob);
1.53 djm 81: RB_GENERATE_STATIC(revoked_blob_tree, revoked_blob, tree_entry, blob_cmp)
1.1 djm 82:
83: /* Tracks revoked certs for a single CA */
84: struct revoked_certs {
1.20 djm 85: struct sshkey *ca_key;
1.1 djm 86: struct revoked_serial_tree revoked_serials;
87: struct revoked_key_id_tree revoked_key_ids;
88: TAILQ_ENTRY(revoked_certs) entry;
89: };
90: TAILQ_HEAD(revoked_certs_list, revoked_certs);
91:
92: struct ssh_krl {
93: u_int64_t krl_version;
94: u_int64_t generated_date;
95: u_int64_t flags;
96: char *comment;
97: struct revoked_blob_tree revoked_keys;
98: struct revoked_blob_tree revoked_sha1s;
1.42 djm 99: struct revoked_blob_tree revoked_sha256s;
1.1 djm 100: struct revoked_certs_list revoked_certs;
101: };
102:
103: /* Return equal if a and b overlap */
104: static int
105: serial_cmp(struct revoked_serial *a, struct revoked_serial *b)
106: {
107: if (a->hi >= b->lo && a->lo <= b->hi)
108: return 0;
109: return a->lo < b->lo ? -1 : 1;
110: }
111:
112: static int
113: key_id_cmp(struct revoked_key_id *a, struct revoked_key_id *b)
114: {
115: return strcmp(a->key_id, b->key_id);
116: }
117:
118: static int
119: blob_cmp(struct revoked_blob *a, struct revoked_blob *b)
120: {
121: int r;
122:
123: if (a->len != b->len) {
1.38 deraadt 124: if ((r = memcmp(a->blob, b->blob, MINIMUM(a->len, b->len))) != 0)
1.1 djm 125: return r;
126: return a->len > b->len ? 1 : -1;
127: } else
128: return memcmp(a->blob, b->blob, a->len);
129: }
130:
131: struct ssh_krl *
132: ssh_krl_init(void)
133: {
134: struct ssh_krl *krl;
135:
136: if ((krl = calloc(1, sizeof(*krl))) == NULL)
137: return NULL;
138: RB_INIT(&krl->revoked_keys);
139: RB_INIT(&krl->revoked_sha1s);
1.42 djm 140: RB_INIT(&krl->revoked_sha256s);
1.1 djm 141: TAILQ_INIT(&krl->revoked_certs);
142: return krl;
143: }
144:
145: static void
146: revoked_certs_free(struct revoked_certs *rc)
147: {
148: struct revoked_serial *rs, *trs;
149: struct revoked_key_id *rki, *trki;
150:
151: RB_FOREACH_SAFE(rs, revoked_serial_tree, &rc->revoked_serials, trs) {
152: RB_REMOVE(revoked_serial_tree, &rc->revoked_serials, rs);
153: free(rs);
154: }
155: RB_FOREACH_SAFE(rki, revoked_key_id_tree, &rc->revoked_key_ids, trki) {
156: RB_REMOVE(revoked_key_id_tree, &rc->revoked_key_ids, rki);
157: free(rki->key_id);
158: free(rki);
159: }
1.31 djm 160: sshkey_free(rc->ca_key);
1.1 djm 161: }
162:
163: void
164: ssh_krl_free(struct ssh_krl *krl)
165: {
166: struct revoked_blob *rb, *trb;
167: struct revoked_certs *rc, *trc;
168:
169: if (krl == NULL)
170: return;
171:
172: free(krl->comment);
173: RB_FOREACH_SAFE(rb, revoked_blob_tree, &krl->revoked_keys, trb) {
174: RB_REMOVE(revoked_blob_tree, &krl->revoked_keys, rb);
175: free(rb->blob);
176: free(rb);
177: }
178: RB_FOREACH_SAFE(rb, revoked_blob_tree, &krl->revoked_sha1s, trb) {
179: RB_REMOVE(revoked_blob_tree, &krl->revoked_sha1s, rb);
180: free(rb->blob);
181: free(rb);
182: }
1.42 djm 183: RB_FOREACH_SAFE(rb, revoked_blob_tree, &krl->revoked_sha256s, trb) {
184: RB_REMOVE(revoked_blob_tree, &krl->revoked_sha256s, rb);
185: free(rb->blob);
186: free(rb);
187: }
1.1 djm 188: TAILQ_FOREACH_SAFE(rc, &krl->revoked_certs, entry, trc) {
189: TAILQ_REMOVE(&krl->revoked_certs, rc, entry);
190: revoked_certs_free(rc);
191: }
1.55 dtucker 192: free(krl);
1.1 djm 193: }
194:
195: void
196: ssh_krl_set_version(struct ssh_krl *krl, u_int64_t version)
197: {
198: krl->krl_version = version;
199: }
200:
1.20 djm 201: int
1.1 djm 202: ssh_krl_set_comment(struct ssh_krl *krl, const char *comment)
203: {
204: free(krl->comment);
205: if ((krl->comment = strdup(comment)) == NULL)
1.20 djm 206: return SSH_ERR_ALLOC_FAIL;
207: return 0;
1.1 djm 208: }
209:
210: /*
211: * Find the revoked_certs struct for a CA key. If allow_create is set then
212: * create a new one in the tree if one did not exist already.
213: */
214: static int
1.20 djm 215: revoked_certs_for_ca_key(struct ssh_krl *krl, const struct sshkey *ca_key,
1.1 djm 216: struct revoked_certs **rcp, int allow_create)
217: {
218: struct revoked_certs *rc;
1.20 djm 219: int r;
1.1 djm 220:
221: *rcp = NULL;
222: TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
1.31 djm 223: if ((ca_key == NULL && rc->ca_key == NULL) ||
224: sshkey_equal(rc->ca_key, ca_key)) {
1.1 djm 225: *rcp = rc;
226: return 0;
227: }
228: }
229: if (!allow_create)
230: return 0;
231: /* If this CA doesn't exist in the list then add it now */
232: if ((rc = calloc(1, sizeof(*rc))) == NULL)
1.20 djm 233: return SSH_ERR_ALLOC_FAIL;
1.31 djm 234: if (ca_key == NULL)
235: rc->ca_key = NULL;
236: else if ((r = sshkey_from_private(ca_key, &rc->ca_key)) != 0) {
1.1 djm 237: free(rc);
1.20 djm 238: return r;
1.1 djm 239: }
240: RB_INIT(&rc->revoked_serials);
241: RB_INIT(&rc->revoked_key_ids);
242: TAILQ_INSERT_TAIL(&krl->revoked_certs, rc, entry);
1.52 djm 243: KRL_DBG(("new CA %s", ca_key == NULL ? "*" : sshkey_type(ca_key)));
1.1 djm 244: *rcp = rc;
245: return 0;
246: }
247:
248: static int
249: insert_serial_range(struct revoked_serial_tree *rt, u_int64_t lo, u_int64_t hi)
250: {
251: struct revoked_serial rs, *ers, *crs, *irs;
252:
1.52 djm 253: KRL_DBG(("insert %llu:%llu", lo, hi));
1.14 tedu 254: memset(&rs, 0, sizeof(rs));
1.1 djm 255: rs.lo = lo;
256: rs.hi = hi;
257: ers = RB_NFIND(revoked_serial_tree, rt, &rs);
258: if (ers == NULL || serial_cmp(ers, &rs) != 0) {
259: /* No entry matches. Just insert */
260: if ((irs = malloc(sizeof(rs))) == NULL)
1.20 djm 261: return SSH_ERR_ALLOC_FAIL;
1.1 djm 262: memcpy(irs, &rs, sizeof(*irs));
263: ers = RB_INSERT(revoked_serial_tree, rt, irs);
264: if (ers != NULL) {
1.52 djm 265: KRL_DBG(("bad: ers != NULL"));
1.1 djm 266: /* Shouldn't happen */
1.4 markus 267: free(irs);
1.25 djm 268: return SSH_ERR_INTERNAL_ERROR;
1.1 djm 269: }
270: ers = irs;
271: } else {
1.52 djm 272: KRL_DBG(("overlap found %llu:%llu", ers->lo, ers->hi));
1.1 djm 273: /*
274: * The inserted entry overlaps an existing one. Grow the
275: * existing entry.
276: */
277: if (ers->lo > lo)
278: ers->lo = lo;
279: if (ers->hi < hi)
280: ers->hi = hi;
281: }
1.25 djm 282:
1.1 djm 283: /*
284: * The inserted or revised range might overlap or abut adjacent ones;
285: * coalesce as necessary.
286: */
287:
288: /* Check predecessors */
289: while ((crs = RB_PREV(revoked_serial_tree, rt, ers)) != NULL) {
1.52 djm 290: KRL_DBG(("pred %llu:%llu", crs->lo, crs->hi));
1.1 djm 291: if (ers->lo != 0 && crs->hi < ers->lo - 1)
292: break;
293: /* This entry overlaps. */
294: if (crs->lo < ers->lo) {
295: ers->lo = crs->lo;
1.52 djm 296: KRL_DBG(("pred extend %llu:%llu", ers->lo, ers->hi));
1.1 djm 297: }
298: RB_REMOVE(revoked_serial_tree, rt, crs);
299: free(crs);
300: }
301: /* Check successors */
302: while ((crs = RB_NEXT(revoked_serial_tree, rt, ers)) != NULL) {
1.52 djm 303: KRL_DBG(("succ %llu:%llu", crs->lo, crs->hi));
1.1 djm 304: if (ers->hi != (u_int64_t)-1 && crs->lo > ers->hi + 1)
305: break;
306: /* This entry overlaps. */
307: if (crs->hi > ers->hi) {
308: ers->hi = crs->hi;
1.52 djm 309: KRL_DBG(("succ extend %llu:%llu", ers->lo, ers->hi));
1.1 djm 310: }
311: RB_REMOVE(revoked_serial_tree, rt, crs);
312: free(crs);
313: }
1.52 djm 314: KRL_DBG(("done, final %llu:%llu", ers->lo, ers->hi));
1.1 djm 315: return 0;
316: }
317:
318: int
1.20 djm 319: ssh_krl_revoke_cert_by_serial(struct ssh_krl *krl, const struct sshkey *ca_key,
1.1 djm 320: u_int64_t serial)
321: {
322: return ssh_krl_revoke_cert_by_serial_range(krl, ca_key, serial, serial);
323: }
324:
325: int
1.25 djm 326: ssh_krl_revoke_cert_by_serial_range(struct ssh_krl *krl,
327: const struct sshkey *ca_key, u_int64_t lo, u_int64_t hi)
1.1 djm 328: {
329: struct revoked_certs *rc;
1.20 djm 330: int r;
1.1 djm 331:
332: if (lo > hi || lo == 0)
1.25 djm 333: return SSH_ERR_INVALID_ARGUMENT;
1.20 djm 334: if ((r = revoked_certs_for_ca_key(krl, ca_key, &rc, 1)) != 0)
335: return r;
1.1 djm 336: return insert_serial_range(&rc->revoked_serials, lo, hi);
337: }
338:
339: int
1.20 djm 340: ssh_krl_revoke_cert_by_key_id(struct ssh_krl *krl, const struct sshkey *ca_key,
1.1 djm 341: const char *key_id)
342: {
343: struct revoked_key_id *rki, *erki;
344: struct revoked_certs *rc;
1.20 djm 345: int r;
1.1 djm 346:
1.20 djm 347: if ((r = revoked_certs_for_ca_key(krl, ca_key, &rc, 1)) != 0)
348: return r;
1.1 djm 349:
1.52 djm 350: KRL_DBG(("revoke %s", key_id));
1.1 djm 351: if ((rki = calloc(1, sizeof(*rki))) == NULL ||
352: (rki->key_id = strdup(key_id)) == NULL) {
353: free(rki);
1.20 djm 354: return SSH_ERR_ALLOC_FAIL;
1.1 djm 355: }
356: erki = RB_INSERT(revoked_key_id_tree, &rc->revoked_key_ids, rki);
357: if (erki != NULL) {
358: free(rki->key_id);
359: free(rki);
360: }
361: return 0;
362: }
363:
364: /* Convert "key" to a public key blob without any certificate information */
365: static int
1.20 djm 366: plain_key_blob(const struct sshkey *key, u_char **blob, size_t *blen)
1.1 djm 367: {
1.20 djm 368: struct sshkey *kcopy;
1.1 djm 369: int r;
370:
1.20 djm 371: if ((r = sshkey_from_private(key, &kcopy)) != 0)
372: return r;
373: if (sshkey_is_cert(kcopy)) {
374: if ((r = sshkey_drop_cert(kcopy)) != 0) {
375: sshkey_free(kcopy);
376: return r;
1.1 djm 377: }
378: }
1.20 djm 379: r = sshkey_to_blob(kcopy, blob, blen);
1.23 markus 380: sshkey_free(kcopy);
1.17 djm 381: return r;
1.1 djm 382: }
383:
384: /* Revoke a key blob. Ownership of blob is transferred to the tree */
385: static int
1.25 djm 386: revoke_blob(struct revoked_blob_tree *rbt, u_char *blob, size_t len)
1.1 djm 387: {
388: struct revoked_blob *rb, *erb;
389:
390: if ((rb = calloc(1, sizeof(*rb))) == NULL)
1.20 djm 391: return SSH_ERR_ALLOC_FAIL;
1.1 djm 392: rb->blob = blob;
393: rb->len = len;
394: erb = RB_INSERT(revoked_blob_tree, rbt, rb);
395: if (erb != NULL) {
396: free(rb->blob);
397: free(rb);
398: }
399: return 0;
400: }
401:
402: int
1.20 djm 403: ssh_krl_revoke_key_explicit(struct ssh_krl *krl, const struct sshkey *key)
1.1 djm 404: {
405: u_char *blob;
1.20 djm 406: size_t len;
407: int r;
1.1 djm 408:
1.52 djm 409: debug3_f("revoke type %s", sshkey_type(key));
1.20 djm 410: if ((r = plain_key_blob(key, &blob, &len)) != 0)
411: return r;
1.1 djm 412: return revoke_blob(&krl->revoked_keys, blob, len);
413: }
414:
1.42 djm 415: static int
416: revoke_by_hash(struct revoked_blob_tree *target, const u_char *p, size_t len)
1.1 djm 417: {
418: u_char *blob;
1.20 djm 419: int r;
1.1 djm 420:
1.42 djm 421: /* need to copy hash, as revoke_blob steals ownership */
422: if ((blob = malloc(len)) == NULL)
423: return SSH_ERR_SYSTEM_ERROR;
424: memcpy(blob, p, len);
425: if ((r = revoke_blob(target, blob, len)) != 0) {
426: free(blob);
1.20 djm 427: return r;
1.42 djm 428: }
429: return 0;
430: }
431:
432: int
433: ssh_krl_revoke_key_sha1(struct ssh_krl *krl, const u_char *p, size_t len)
434: {
1.52 djm 435: debug3_f("revoke by sha1");
1.42 djm 436: if (len != 20)
437: return SSH_ERR_INVALID_FORMAT;
438: return revoke_by_hash(&krl->revoked_sha1s, p, len);
439: }
440:
441: int
442: ssh_krl_revoke_key_sha256(struct ssh_krl *krl, const u_char *p, size_t len)
443: {
1.52 djm 444: debug3_f("revoke by sha256");
1.42 djm 445: if (len != 32)
446: return SSH_ERR_INVALID_FORMAT;
447: return revoke_by_hash(&krl->revoked_sha256s, p, len);
1.1 djm 448: }
449:
450: int
1.20 djm 451: ssh_krl_revoke_key(struct ssh_krl *krl, const struct sshkey *key)
1.1 djm 452: {
1.42 djm 453: /* XXX replace with SHA256? */
1.20 djm 454: if (!sshkey_is_cert(key))
1.42 djm 455: return ssh_krl_revoke_key_explicit(krl, key);
1.1 djm 456:
1.33 djm 457: if (key->cert->serial == 0) {
1.1 djm 458: return ssh_krl_revoke_cert_by_key_id(krl,
459: key->cert->signature_key,
460: key->cert->key_id);
461: } else {
462: return ssh_krl_revoke_cert_by_serial(krl,
463: key->cert->signature_key,
464: key->cert->serial);
465: }
466: }
467:
468: /*
1.20 djm 469: * Select the most compact section type to emit next in a KRL based on
470: * the current section type, the run length of contiguous revoked serial
1.1 djm 471: * numbers and the gaps from the last and to the next revoked serial.
472: * Applies a mostly-accurate bit cost model to select the section type
473: * that will minimise the size of the resultant KRL.
474: */
475: static int
476: choose_next_state(int current_state, u_int64_t contig, int final,
477: u_int64_t last_gap, u_int64_t next_gap, int *force_new_section)
478: {
479: int new_state;
480: u_int64_t cost, cost_list, cost_range, cost_bitmap, cost_bitmap_restart;
481:
482: /*
483: * Avoid unsigned overflows.
484: * The limits are high enough to avoid confusing the calculations.
485: */
1.38 deraadt 486: contig = MINIMUM(contig, 1ULL<<31);
487: last_gap = MINIMUM(last_gap, 1ULL<<31);
488: next_gap = MINIMUM(next_gap, 1ULL<<31);
1.1 djm 489:
490: /*
491: * Calculate the cost to switch from the current state to candidates.
492: * NB. range sections only ever contain a single range, so their
493: * switching cost is independent of the current_state.
494: */
495: cost_list = cost_bitmap = cost_bitmap_restart = 0;
496: cost_range = 8;
497: switch (current_state) {
498: case KRL_SECTION_CERT_SERIAL_LIST:
499: cost_bitmap_restart = cost_bitmap = 8 + 64;
500: break;
501: case KRL_SECTION_CERT_SERIAL_BITMAP:
502: cost_list = 8;
503: cost_bitmap_restart = 8 + 64;
504: break;
505: case KRL_SECTION_CERT_SERIAL_RANGE:
506: case 0:
507: cost_bitmap_restart = cost_bitmap = 8 + 64;
508: cost_list = 8;
509: }
510:
511: /* Estimate base cost in bits of each section type */
512: cost_list += 64 * contig + (final ? 0 : 8+64);
513: cost_range += (2 * 64) + (final ? 0 : 8+64);
1.38 deraadt 514: cost_bitmap += last_gap + contig + (final ? 0 : MINIMUM(next_gap, 8+64));
515: cost_bitmap_restart += contig + (final ? 0 : MINIMUM(next_gap, 8+64));
1.1 djm 516:
517: /* Convert to byte costs for actual comparison */
518: cost_list = (cost_list + 7) / 8;
519: cost_bitmap = (cost_bitmap + 7) / 8;
520: cost_bitmap_restart = (cost_bitmap_restart + 7) / 8;
521: cost_range = (cost_range + 7) / 8;
522:
523: /* Now pick the best choice */
524: *force_new_section = 0;
525: new_state = KRL_SECTION_CERT_SERIAL_BITMAP;
526: cost = cost_bitmap;
527: if (cost_range < cost) {
528: new_state = KRL_SECTION_CERT_SERIAL_RANGE;
529: cost = cost_range;
530: }
531: if (cost_list < cost) {
532: new_state = KRL_SECTION_CERT_SERIAL_LIST;
533: cost = cost_list;
534: }
535: if (cost_bitmap_restart < cost) {
536: new_state = KRL_SECTION_CERT_SERIAL_BITMAP;
537: *force_new_section = 1;
538: cost = cost_bitmap_restart;
539: }
1.52 djm 540: KRL_DBG(("contig %llu last_gap %llu next_gap %llu final %d, costs:"
1.1 djm 541: "list %llu range %llu bitmap %llu new bitmap %llu, "
1.52 djm 542: "selected 0x%02x%s", (long long unsigned)contig,
1.11 djm 543: (long long unsigned)last_gap, (long long unsigned)next_gap, final,
544: (long long unsigned)cost_list, (long long unsigned)cost_range,
545: (long long unsigned)cost_bitmap,
546: (long long unsigned)cost_bitmap_restart, new_state,
1.25 djm 547: *force_new_section ? " restart" : ""));
1.1 djm 548: return new_state;
549: }
550:
1.26 djm 551: static int
552: put_bitmap(struct sshbuf *buf, struct bitmap *bitmap)
553: {
554: size_t len;
555: u_char *blob;
556: int r;
557:
558: len = bitmap_nbytes(bitmap);
559: if ((blob = malloc(len)) == NULL)
560: return SSH_ERR_ALLOC_FAIL;
561: if (bitmap_to_string(bitmap, blob, len) != 0) {
562: free(blob);
563: return SSH_ERR_INTERNAL_ERROR;
564: }
565: r = sshbuf_put_bignum2_bytes(buf, blob, len);
566: free(blob);
567: return r;
568: }
569:
1.1 djm 570: /* Generate a KRL_SECTION_CERTIFICATES KRL section */
571: static int
1.20 djm 572: revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf)
1.1 djm 573: {
1.25 djm 574: int final, force_new_sect, r = SSH_ERR_INTERNAL_ERROR;
1.1 djm 575: u_int64_t i, contig, gap, last = 0, bitmap_start = 0;
576: struct revoked_serial *rs, *nrs;
577: struct revoked_key_id *rki;
578: int next_state, state = 0;
1.20 djm 579: struct sshbuf *sect;
1.26 djm 580: struct bitmap *bitmap = NULL;
1.1 djm 581:
1.20 djm 582: if ((sect = sshbuf_new()) == NULL)
583: return SSH_ERR_ALLOC_FAIL;
1.1 djm 584:
1.31 djm 585: /* Store the header: optional CA scope key, reserved */
586: if (rc->ca_key == NULL) {
587: if ((r = sshbuf_put_string(buf, NULL, 0)) != 0)
588: goto out;
589: } else {
590: if ((r = sshkey_puts(rc->ca_key, buf)) != 0)
591: goto out;
592: }
593: if ((r = sshbuf_put_string(buf, NULL, 0)) != 0)
1.20 djm 594: goto out;
1.1 djm 595:
596: /* Store the revoked serials. */
597: for (rs = RB_MIN(revoked_serial_tree, &rc->revoked_serials);
598: rs != NULL;
599: rs = RB_NEXT(revoked_serial_tree, &rc->revoked_serials, rs)) {
1.52 djm 600: KRL_DBG(("serial %llu:%llu state 0x%02x",
1.11 djm 601: (long long unsigned)rs->lo, (long long unsigned)rs->hi,
1.25 djm 602: state));
1.1 djm 603:
604: /* Check contiguous length and gap to next section (if any) */
605: nrs = RB_NEXT(revoked_serial_tree, &rc->revoked_serials, rs);
606: final = nrs == NULL;
607: gap = nrs == NULL ? 0 : nrs->lo - rs->hi;
608: contig = 1 + (rs->hi - rs->lo);
609:
610: /* Choose next state based on these */
611: next_state = choose_next_state(state, contig, final,
612: state == 0 ? 0 : rs->lo - last, gap, &force_new_sect);
613:
614: /*
615: * If the current section is a range section or has a different
616: * type to the next section, then finish it off now.
617: */
618: if (state != 0 && (force_new_sect || next_state != state ||
619: state == KRL_SECTION_CERT_SERIAL_RANGE)) {
1.52 djm 620: KRL_DBG(("finish state 0x%02x", state));
1.1 djm 621: switch (state) {
622: case KRL_SECTION_CERT_SERIAL_LIST:
623: case KRL_SECTION_CERT_SERIAL_RANGE:
624: break;
625: case KRL_SECTION_CERT_SERIAL_BITMAP:
1.26 djm 626: if ((r = put_bitmap(sect, bitmap)) != 0)
1.20 djm 627: goto out;
1.26 djm 628: bitmap_free(bitmap);
1.1 djm 629: bitmap = NULL;
630: break;
631: }
1.20 djm 632: if ((r = sshbuf_put_u8(buf, state)) != 0 ||
633: (r = sshbuf_put_stringb(buf, sect)) != 0)
634: goto out;
635: sshbuf_reset(sect);
1.1 djm 636: }
637:
638: /* If we are starting a new section then prepare it now */
639: if (next_state != state || force_new_sect) {
1.52 djm 640: KRL_DBG(("start state 0x%02x",
1.25 djm 641: next_state));
1.1 djm 642: state = next_state;
1.20 djm 643: sshbuf_reset(sect);
1.1 djm 644: switch (state) {
645: case KRL_SECTION_CERT_SERIAL_LIST:
646: case KRL_SECTION_CERT_SERIAL_RANGE:
647: break;
648: case KRL_SECTION_CERT_SERIAL_BITMAP:
1.26 djm 649: if ((bitmap = bitmap_new()) == NULL) {
1.20 djm 650: r = SSH_ERR_ALLOC_FAIL;
1.1 djm 651: goto out;
1.20 djm 652: }
1.1 djm 653: bitmap_start = rs->lo;
1.20 djm 654: if ((r = sshbuf_put_u64(sect,
655: bitmap_start)) != 0)
656: goto out;
1.1 djm 657: break;
658: }
659: }
660:
661: /* Perform section-specific processing */
662: switch (state) {
663: case KRL_SECTION_CERT_SERIAL_LIST:
1.20 djm 664: for (i = 0; i < contig; i++) {
665: if ((r = sshbuf_put_u64(sect, rs->lo + i)) != 0)
666: goto out;
667: }
1.1 djm 668: break;
669: case KRL_SECTION_CERT_SERIAL_RANGE:
1.20 djm 670: if ((r = sshbuf_put_u64(sect, rs->lo)) != 0 ||
671: (r = sshbuf_put_u64(sect, rs->hi)) != 0)
672: goto out;
1.1 djm 673: break;
674: case KRL_SECTION_CERT_SERIAL_BITMAP:
675: if (rs->lo - bitmap_start > INT_MAX) {
1.52 djm 676: error_f("insane bitmap gap");
1.1 djm 677: goto out;
678: }
679: for (i = 0; i < contig; i++) {
1.26 djm 680: if (bitmap_set_bit(bitmap,
681: rs->lo + i - bitmap_start) != 0) {
1.20 djm 682: r = SSH_ERR_ALLOC_FAIL;
1.1 djm 683: goto out;
1.20 djm 684: }
1.1 djm 685: }
686: break;
687: }
688: last = rs->hi;
689: }
690: /* Flush the remaining section, if any */
691: if (state != 0) {
1.52 djm 692: KRL_DBG(("serial final flush for state 0x%02x", state));
1.1 djm 693: switch (state) {
694: case KRL_SECTION_CERT_SERIAL_LIST:
695: case KRL_SECTION_CERT_SERIAL_RANGE:
696: break;
697: case KRL_SECTION_CERT_SERIAL_BITMAP:
1.26 djm 698: if ((r = put_bitmap(sect, bitmap)) != 0)
1.20 djm 699: goto out;
1.26 djm 700: bitmap_free(bitmap);
1.1 djm 701: bitmap = NULL;
702: break;
703: }
1.20 djm 704: if ((r = sshbuf_put_u8(buf, state)) != 0 ||
705: (r = sshbuf_put_stringb(buf, sect)) != 0)
706: goto out;
1.1 djm 707: }
1.52 djm 708: KRL_DBG(("serial done "));
1.1 djm 709:
710: /* Now output a section for any revocations by key ID */
1.20 djm 711: sshbuf_reset(sect);
1.1 djm 712: RB_FOREACH(rki, revoked_key_id_tree, &rc->revoked_key_ids) {
1.52 djm 713: KRL_DBG(("key ID %s", rki->key_id));
1.20 djm 714: if ((r = sshbuf_put_cstring(sect, rki->key_id)) != 0)
715: goto out;
1.1 djm 716: }
1.20 djm 717: if (sshbuf_len(sect) != 0) {
718: if ((r = sshbuf_put_u8(buf, KRL_SECTION_CERT_KEY_ID)) != 0 ||
719: (r = sshbuf_put_stringb(buf, sect)) != 0)
720: goto out;
1.1 djm 721: }
722: r = 0;
723: out:
1.26 djm 724: bitmap_free(bitmap);
1.20 djm 725: sshbuf_free(sect);
1.1 djm 726: return r;
727: }
728:
729: int
1.20 djm 730: ssh_krl_to_blob(struct ssh_krl *krl, struct sshbuf *buf,
1.43 djm 731: struct sshkey **sign_keys, u_int nsign_keys)
1.1 djm 732: {
1.25 djm 733: int r = SSH_ERR_INTERNAL_ERROR;
1.1 djm 734: struct revoked_certs *rc;
735: struct revoked_blob *rb;
1.20 djm 736: struct sshbuf *sect;
737: u_char *sblob = NULL;
738: size_t slen, i;
1.1 djm 739:
740: if (krl->generated_date == 0)
741: krl->generated_date = time(NULL);
742:
1.20 djm 743: if ((sect = sshbuf_new()) == NULL)
744: return SSH_ERR_ALLOC_FAIL;
1.1 djm 745:
746: /* Store the header */
1.20 djm 747: if ((r = sshbuf_put(buf, KRL_MAGIC, sizeof(KRL_MAGIC) - 1)) != 0 ||
748: (r = sshbuf_put_u32(buf, KRL_FORMAT_VERSION)) != 0 ||
749: (r = sshbuf_put_u64(buf, krl->krl_version)) != 0 ||
1.34 jsg 750: (r = sshbuf_put_u64(buf, krl->generated_date)) != 0 ||
1.20 djm 751: (r = sshbuf_put_u64(buf, krl->flags)) != 0 ||
752: (r = sshbuf_put_string(buf, NULL, 0)) != 0 ||
753: (r = sshbuf_put_cstring(buf, krl->comment)) != 0)
754: goto out;
1.1 djm 755:
756: /* Store sections for revoked certificates */
757: TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
1.20 djm 758: sshbuf_reset(sect);
759: if ((r = revoked_certs_generate(rc, sect)) != 0)
760: goto out;
761: if ((r = sshbuf_put_u8(buf, KRL_SECTION_CERTIFICATES)) != 0 ||
762: (r = sshbuf_put_stringb(buf, sect)) != 0)
1.1 djm 763: goto out;
764: }
765:
766: /* Finally, output sections for revocations by public key/hash */
1.20 djm 767: sshbuf_reset(sect);
1.1 djm 768: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_keys) {
1.52 djm 769: KRL_DBG(("key len %zu ", rb->len));
1.24 markus 770: if ((r = sshbuf_put_string(sect, rb->blob, rb->len)) != 0)
1.20 djm 771: goto out;
1.1 djm 772: }
1.20 djm 773: if (sshbuf_len(sect) != 0) {
774: if ((r = sshbuf_put_u8(buf, KRL_SECTION_EXPLICIT_KEY)) != 0 ||
775: (r = sshbuf_put_stringb(buf, sect)) != 0)
776: goto out;
1.1 djm 777: }
1.20 djm 778: sshbuf_reset(sect);
1.1 djm 779: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha1s) {
1.52 djm 780: KRL_DBG(("hash len %zu ", rb->len));
1.24 markus 781: if ((r = sshbuf_put_string(sect, rb->blob, rb->len)) != 0)
1.20 djm 782: goto out;
1.1 djm 783: }
1.20 djm 784: if (sshbuf_len(sect) != 0) {
785: if ((r = sshbuf_put_u8(buf,
786: KRL_SECTION_FINGERPRINT_SHA1)) != 0 ||
787: (r = sshbuf_put_stringb(buf, sect)) != 0)
788: goto out;
1.1 djm 789: }
1.42 djm 790: sshbuf_reset(sect);
791: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha256s) {
1.52 djm 792: KRL_DBG(("hash len %zu ", rb->len));
1.42 djm 793: if ((r = sshbuf_put_string(sect, rb->blob, rb->len)) != 0)
794: goto out;
795: }
796: if (sshbuf_len(sect) != 0) {
797: if ((r = sshbuf_put_u8(buf,
798: KRL_SECTION_FINGERPRINT_SHA256)) != 0 ||
799: (r = sshbuf_put_stringb(buf, sect)) != 0)
800: goto out;
801: }
1.1 djm 802:
803: for (i = 0; i < nsign_keys; i++) {
1.52 djm 804: KRL_DBG(("sig key %s", sshkey_ssh_name(sign_keys[i])));
1.20 djm 805: if ((r = sshbuf_put_u8(buf, KRL_SECTION_SIGNATURE)) != 0 ||
1.30 djm 806: (r = sshkey_puts(sign_keys[i], buf)) != 0)
1.20 djm 807: goto out;
1.51 djm 808: /* XXX support sk-* keys */
1.20 djm 809: if ((r = sshkey_sign(sign_keys[i], &sblob, &slen,
1.51 djm 810: sshbuf_ptr(buf), sshbuf_len(buf), NULL, NULL,
811: NULL, 0)) != 0)
1.20 djm 812: goto out;
1.52 djm 813: KRL_DBG(("signature sig len %zu", slen));
1.20 djm 814: if ((r = sshbuf_put_string(buf, sblob, slen)) != 0)
1.1 djm 815: goto out;
816: }
817:
818: r = 0;
819: out:
820: free(sblob);
1.20 djm 821: sshbuf_free(sect);
1.1 djm 822: return r;
823: }
824:
825: static void
826: format_timestamp(u_int64_t timestamp, char *ts, size_t nts)
827: {
828: time_t t;
829: struct tm *tm;
830:
831: t = timestamp;
832: tm = localtime(&t);
1.19 djm 833: if (tm == NULL)
1.27 deraadt 834: strlcpy(ts, "<INVALID>", nts);
1.19 djm 835: else {
836: *ts = '\0';
837: strftime(ts, nts, "%Y%m%dT%H%M%S", tm);
838: }
1.1 djm 839: }
840:
841: static int
1.56 ! djm 842: cert_extension_subsection(struct sshbuf *subsect, struct ssh_krl *krl)
! 843: {
! 844: int r = SSH_ERR_INTERNAL_ERROR;
! 845: u_char critical = 1;
! 846: struct sshbuf *value = NULL;
! 847: char *name = NULL;
! 848:
! 849: if ((r = sshbuf_get_cstring(subsect, &name, NULL)) != 0 ||
! 850: (r = sshbuf_get_u8(subsect, &critical)) != 0 ||
! 851: (r = sshbuf_froms(subsect, &value)) != 0) {
! 852: debug_fr(r, "parse");
! 853: error("KRL has invalid certificate extension subsection");
! 854: r = SSH_ERR_INVALID_FORMAT;
! 855: goto out;
! 856: }
! 857: if (sshbuf_len(subsect) != 0) {
! 858: error("KRL has invalid certificate extension subsection: "
! 859: "trailing data");
! 860: r = SSH_ERR_INVALID_FORMAT;
! 861: goto out;
! 862: }
! 863: debug_f("cert extension %s critical %u len %zu",
! 864: name, critical, sshbuf_len(value));
! 865: /* no extensions are currently supported */
! 866: if (critical) {
! 867: error("KRL contains unsupported critical certificate "
! 868: "subsection \"%s\"", name);
! 869: r = SSH_ERR_FEATURE_UNSUPPORTED;
! 870: goto out;
! 871: }
! 872: /* success */
! 873: r = 0;
! 874: out:
! 875: free(name);
! 876: sshbuf_free(value);
! 877: return r;
! 878: }
! 879:
! 880: static int
1.20 djm 881: parse_revoked_certs(struct sshbuf *buf, struct ssh_krl *krl)
1.1 djm 882: {
1.26 djm 883: int r = SSH_ERR_INTERNAL_ERROR;
1.15 djm 884: u_char type;
885: const u_char *blob;
1.26 djm 886: size_t blen, nbits;
1.20 djm 887: struct sshbuf *subsect = NULL;
1.1 djm 888: u_int64_t serial, serial_lo, serial_hi;
1.26 djm 889: struct bitmap *bitmap = NULL;
1.1 djm 890: char *key_id = NULL;
1.20 djm 891: struct sshkey *ca_key = NULL;
1.1 djm 892:
1.20 djm 893: if ((subsect = sshbuf_new()) == NULL)
894: return SSH_ERR_ALLOC_FAIL;
1.1 djm 895:
1.20 djm 896: /* Header: key, reserved */
897: if ((r = sshbuf_get_string_direct(buf, &blob, &blen)) != 0 ||
898: (r = sshbuf_skip_string(buf)) != 0)
1.1 djm 899: goto out;
1.31 djm 900: if (blen != 0 && (r = sshkey_from_blob(blob, blen, &ca_key)) != 0)
1.1 djm 901: goto out;
902:
1.20 djm 903: while (sshbuf_len(buf) > 0) {
1.36 mmcc 904: sshbuf_free(subsect);
905: subsect = NULL;
1.20 djm 906: if ((r = sshbuf_get_u8(buf, &type)) != 0 ||
907: (r = sshbuf_froms(buf, &subsect)) != 0)
1.1 djm 908: goto out;
1.52 djm 909: KRL_DBG(("subsection type 0x%02x", type));
1.25 djm 910: /* sshbuf_dump(subsect, stderr); */
1.1 djm 911:
912: switch (type) {
913: case KRL_SECTION_CERT_SERIAL_LIST:
1.20 djm 914: while (sshbuf_len(subsect) > 0) {
915: if ((r = sshbuf_get_u64(subsect, &serial)) != 0)
1.1 djm 916: goto out;
1.20 djm 917: if ((r = ssh_krl_revoke_cert_by_serial(krl,
918: ca_key, serial)) != 0)
1.1 djm 919: goto out;
920: }
921: break;
922: case KRL_SECTION_CERT_SERIAL_RANGE:
1.20 djm 923: if ((r = sshbuf_get_u64(subsect, &serial_lo)) != 0 ||
924: (r = sshbuf_get_u64(subsect, &serial_hi)) != 0)
1.1 djm 925: goto out;
1.20 djm 926: if ((r = ssh_krl_revoke_cert_by_serial_range(krl,
927: ca_key, serial_lo, serial_hi)) != 0)
1.1 djm 928: goto out;
929: break;
930: case KRL_SECTION_CERT_SERIAL_BITMAP:
1.26 djm 931: if ((bitmap = bitmap_new()) == NULL) {
1.20 djm 932: r = SSH_ERR_ALLOC_FAIL;
1.1 djm 933: goto out;
934: }
1.20 djm 935: if ((r = sshbuf_get_u64(subsect, &serial_lo)) != 0 ||
1.26 djm 936: (r = sshbuf_get_bignum2_bytes_direct(subsect,
937: &blob, &blen)) != 0)
1.1 djm 938: goto out;
1.26 djm 939: if (bitmap_from_string(bitmap, blob, blen) != 0) {
1.20 djm 940: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 941: goto out;
942: }
1.26 djm 943: nbits = bitmap_nbits(bitmap);
1.25 djm 944: for (serial = 0; serial < (u_int64_t)nbits; serial++) {
1.1 djm 945: if (serial > 0 && serial_lo + serial == 0) {
1.52 djm 946: error_f("bitmap wraps u64");
1.20 djm 947: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 948: goto out;
949: }
1.26 djm 950: if (!bitmap_test_bit(bitmap, serial))
1.1 djm 951: continue;
1.20 djm 952: if ((r = ssh_krl_revoke_cert_by_serial(krl,
953: ca_key, serial_lo + serial)) != 0)
1.1 djm 954: goto out;
955: }
1.26 djm 956: bitmap_free(bitmap);
1.1 djm 957: bitmap = NULL;
958: break;
959: case KRL_SECTION_CERT_KEY_ID:
1.20 djm 960: while (sshbuf_len(subsect) > 0) {
961: if ((r = sshbuf_get_cstring(subsect,
962: &key_id, NULL)) != 0)
1.1 djm 963: goto out;
1.20 djm 964: if ((r = ssh_krl_revoke_cert_by_key_id(krl,
965: ca_key, key_id)) != 0)
1.1 djm 966: goto out;
967: free(key_id);
968: key_id = NULL;
969: }
970: break;
1.56 ! djm 971: case KRL_SECTION_CERT_EXTENSION:
! 972: if ((r = cert_extension_subsection(subsect, krl)) != 0)
! 973: goto out;
! 974: break;
1.1 djm 975: default:
976: error("Unsupported KRL certificate section %u", type);
1.20 djm 977: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 978: goto out;
979: }
1.20 djm 980: if (sshbuf_len(subsect) > 0) {
1.1 djm 981: error("KRL certificate section contains unparsed data");
1.20 djm 982: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 983: goto out;
984: }
985: }
986:
1.20 djm 987: r = 0;
1.1 djm 988: out:
989: if (bitmap != NULL)
1.26 djm 990: bitmap_free(bitmap);
1.1 djm 991: free(key_id);
1.20 djm 992: sshkey_free(ca_key);
993: sshbuf_free(subsect);
994: return r;
1.1 djm 995: }
996:
1.42 djm 997: static int
998: blob_section(struct sshbuf *sect, struct revoked_blob_tree *target_tree,
999: size_t expected_len)
1000: {
1001: u_char *rdata = NULL;
1002: size_t rlen = 0;
1003: int r;
1004:
1005: while (sshbuf_len(sect) > 0) {
1006: if ((r = sshbuf_get_string(sect, &rdata, &rlen)) != 0)
1007: return r;
1008: if (expected_len != 0 && rlen != expected_len) {
1.52 djm 1009: error_f("bad length");
1.42 djm 1010: free(rdata);
1011: return SSH_ERR_INVALID_FORMAT;
1012: }
1013: if ((r = revoke_blob(target_tree, rdata, rlen)) != 0) {
1014: free(rdata);
1015: return r;
1016: }
1017: }
1018: return 0;
1019: }
1.1 djm 1020:
1.56 ! djm 1021: static int
! 1022: extension_section(struct sshbuf *sect, struct ssh_krl *krl)
! 1023: {
! 1024: int r = SSH_ERR_INTERNAL_ERROR;
! 1025: u_char critical = 1;
! 1026: struct sshbuf *value = NULL;
! 1027: char *name = NULL;
! 1028:
! 1029: if ((r = sshbuf_get_cstring(sect, &name, NULL)) != 0 ||
! 1030: (r = sshbuf_get_u8(sect, &critical)) != 0 ||
! 1031: (r = sshbuf_froms(sect, &value)) != 0) {
! 1032: debug_fr(r, "parse");
! 1033: error("KRL has invalid extension section");
! 1034: r = SSH_ERR_INVALID_FORMAT;
! 1035: goto out;
! 1036: }
! 1037: if (sshbuf_len(sect) != 0) {
! 1038: error("KRL has invalid extension section: trailing data");
! 1039: r = SSH_ERR_INVALID_FORMAT;
! 1040: goto out;
! 1041: }
! 1042: debug_f("extension %s critical %u len %zu",
! 1043: name, critical, sshbuf_len(value));
! 1044: /* no extensions are currently supported */
! 1045: if (critical) {
! 1046: error("KRL contains unsupported critical section \"%s\"", name);
! 1047: r = SSH_ERR_FEATURE_UNSUPPORTED;
! 1048: goto out;
! 1049: }
! 1050: /* success */
! 1051: r = 0;
! 1052: out:
! 1053: free(name);
! 1054: sshbuf_free(value);
! 1055: return r;
! 1056: }
! 1057:
1.1 djm 1058: /* Attempt to parse a KRL, checking its signature (if any) with sign_ca_keys. */
1059: int
1.20 djm 1060: ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp,
1.25 djm 1061: const struct sshkey **sign_ca_keys, size_t nsign_ca_keys)
1.1 djm 1062: {
1.20 djm 1063: struct sshbuf *copy = NULL, *sect = NULL;
1064: struct ssh_krl *krl = NULL;
1.1 djm 1065: char timestamp[64];
1.25 djm 1066: int r = SSH_ERR_INTERNAL_ERROR, sig_seen;
1.20 djm 1067: struct sshkey *key = NULL, **ca_used = NULL, **tmp_ca_used;
1.42 djm 1068: u_char type;
1.15 djm 1069: const u_char *blob;
1.42 djm 1070: size_t i, j, sig_off, sects_off, blen, nca_used;
1.20 djm 1071: u_int format_version;
1.1 djm 1072:
1.12 markus 1073: nca_used = 0;
1.1 djm 1074: *krlp = NULL;
1.20 djm 1075: if (sshbuf_len(buf) < sizeof(KRL_MAGIC) - 1 ||
1076: memcmp(sshbuf_ptr(buf), KRL_MAGIC, sizeof(KRL_MAGIC) - 1) != 0) {
1.52 djm 1077: debug3_f("not a KRL");
1.20 djm 1078: return SSH_ERR_KRL_BAD_MAGIC;
1.1 djm 1079: }
1080:
1081: /* Take a copy of the KRL buffer so we can verify its signature later */
1.20 djm 1082: if ((copy = sshbuf_fromb(buf)) == NULL) {
1083: r = SSH_ERR_ALLOC_FAIL;
1084: goto out;
1085: }
1086: if ((r = sshbuf_consume(copy, sizeof(KRL_MAGIC) - 1)) != 0)
1087: goto out;
1.1 djm 1088:
1089: if ((krl = ssh_krl_init()) == NULL) {
1.52 djm 1090: error_f("alloc failed");
1.1 djm 1091: goto out;
1092: }
1093:
1.20 djm 1094: if ((r = sshbuf_get_u32(copy, &format_version)) != 0)
1.1 djm 1095: goto out;
1096: if (format_version != KRL_FORMAT_VERSION) {
1.20 djm 1097: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 1098: goto out;
1099: }
1.20 djm 1100: if ((r = sshbuf_get_u64(copy, &krl->krl_version)) != 0 ||
1101: (r = sshbuf_get_u64(copy, &krl->generated_date)) != 0 ||
1102: (r = sshbuf_get_u64(copy, &krl->flags)) != 0 ||
1103: (r = sshbuf_skip_string(copy)) != 0 ||
1104: (r = sshbuf_get_cstring(copy, &krl->comment, NULL)) != 0)
1.1 djm 1105: goto out;
1106:
1107: format_timestamp(krl->generated_date, timestamp, sizeof(timestamp));
1.11 djm 1108: debug("KRL version %llu generated at %s%s%s",
1109: (long long unsigned)krl->krl_version, timestamp,
1110: *krl->comment ? ": " : "", krl->comment);
1.1 djm 1111:
1112: /*
1113: * 1st pass: verify signatures, if any. This is done to avoid
1114: * detailed parsing of data whose provenance is unverified.
1115: */
1116: sig_seen = 0;
1.20 djm 1117: if (sshbuf_len(buf) < sshbuf_len(copy)) {
1118: /* Shouldn't happen */
1119: r = SSH_ERR_INTERNAL_ERROR;
1120: goto out;
1121: }
1122: sects_off = sshbuf_len(buf) - sshbuf_len(copy);
1123: while (sshbuf_len(copy) > 0) {
1124: if ((r = sshbuf_get_u8(copy, &type)) != 0 ||
1125: (r = sshbuf_get_string_direct(copy, &blob, &blen)) != 0)
1.1 djm 1126: goto out;
1.52 djm 1127: KRL_DBG(("first pass, section 0x%02x", type));
1.1 djm 1128: if (type != KRL_SECTION_SIGNATURE) {
1129: if (sig_seen) {
1130: error("KRL contains non-signature section "
1131: "after signature");
1.25 djm 1132: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 1133: goto out;
1134: }
1135: /* Not interested for now. */
1136: continue;
1137: }
1138: sig_seen = 1;
1139: /* First string component is the signing key */
1.20 djm 1140: if ((r = sshkey_from_blob(blob, blen, &key)) != 0) {
1141: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 1142: goto out;
1143: }
1.20 djm 1144: if (sshbuf_len(buf) < sshbuf_len(copy)) {
1145: /* Shouldn't happen */
1146: r = SSH_ERR_INTERNAL_ERROR;
1147: goto out;
1148: }
1149: sig_off = sshbuf_len(buf) - sshbuf_len(copy);
1.1 djm 1150: /* Second string component is the signature itself */
1.20 djm 1151: if ((r = sshbuf_get_string_direct(copy, &blob, &blen)) != 0) {
1152: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 1153: goto out;
1154: }
1155: /* Check signature over entire KRL up to this point */
1.20 djm 1156: if ((r = sshkey_verify(key, blob, blen,
1.46 djm 1157: sshbuf_ptr(buf), sig_off, NULL, 0, NULL)) != 0)
1.1 djm 1158: goto out;
1159: /* Check if this key has already signed this KRL */
1160: for (i = 0; i < nca_used; i++) {
1.20 djm 1161: if (sshkey_equal(ca_used[i], key)) {
1.1 djm 1162: error("KRL signed more than once with "
1163: "the same key");
1.25 djm 1164: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 1165: goto out;
1166: }
1167: }
1168: /* Record keys used to sign the KRL */
1.40 deraadt 1169: tmp_ca_used = recallocarray(ca_used, nca_used, nca_used + 1,
1.20 djm 1170: sizeof(*ca_used));
1171: if (tmp_ca_used == NULL) {
1172: r = SSH_ERR_ALLOC_FAIL;
1173: goto out;
1174: }
1175: ca_used = tmp_ca_used;
1.1 djm 1176: ca_used[nca_used++] = key;
1177: key = NULL;
1178: }
1179:
1.20 djm 1180: if (sshbuf_len(copy) != 0) {
1181: /* Shouldn't happen */
1182: r = SSH_ERR_INTERNAL_ERROR;
1183: goto out;
1184: }
1185:
1.1 djm 1186: /*
1187: * 2nd pass: parse and load the KRL, skipping the header to the point
1188: * where the section start.
1189: */
1.20 djm 1190: sshbuf_free(copy);
1191: if ((copy = sshbuf_fromb(buf)) == NULL) {
1192: r = SSH_ERR_ALLOC_FAIL;
1193: goto out;
1194: }
1195: if ((r = sshbuf_consume(copy, sects_off)) != 0)
1196: goto out;
1197: while (sshbuf_len(copy) > 0) {
1.36 mmcc 1198: sshbuf_free(sect);
1199: sect = NULL;
1.20 djm 1200: if ((r = sshbuf_get_u8(copy, &type)) != 0 ||
1.25 djm 1201: (r = sshbuf_froms(copy, §)) != 0)
1.1 djm 1202: goto out;
1.52 djm 1203: KRL_DBG(("second pass, section 0x%02x", type));
1.1 djm 1204:
1205: switch (type) {
1206: case KRL_SECTION_CERTIFICATES:
1.20 djm 1207: if ((r = parse_revoked_certs(sect, krl)) != 0)
1.1 djm 1208: goto out;
1209: break;
1210: case KRL_SECTION_EXPLICIT_KEY:
1.42 djm 1211: if ((r = blob_section(sect,
1212: &krl->revoked_keys, 0)) != 0)
1213: goto out;
1214: break;
1.1 djm 1215: case KRL_SECTION_FINGERPRINT_SHA1:
1.42 djm 1216: if ((r = blob_section(sect,
1217: &krl->revoked_sha1s, 20)) != 0)
1218: goto out;
1219: break;
1220: case KRL_SECTION_FINGERPRINT_SHA256:
1221: if ((r = blob_section(sect,
1222: &krl->revoked_sha256s, 32)) != 0)
1.56 ! djm 1223: goto out;
! 1224: break;
! 1225: case KRL_SECTION_EXTENSION:
! 1226: if ((r = extension_section(sect, krl)) != 0)
1.42 djm 1227: goto out;
1.1 djm 1228: break;
1229: case KRL_SECTION_SIGNATURE:
1230: /* Handled above, but still need to stay in synch */
1.39 dtucker 1231: sshbuf_free(sect);
1.20 djm 1232: sect = NULL;
1233: if ((r = sshbuf_skip_string(copy)) != 0)
1.1 djm 1234: goto out;
1235: break;
1236: default:
1237: error("Unsupported KRL section %u", type);
1.20 djm 1238: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 1239: goto out;
1240: }
1.37 djm 1241: if (sect != NULL && sshbuf_len(sect) > 0) {
1.1 djm 1242: error("KRL section contains unparsed data");
1.20 djm 1243: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 1244: goto out;
1245: }
1246: }
1247:
1248: /* Check that the key(s) used to sign the KRL weren't revoked */
1249: sig_seen = 0;
1250: for (i = 0; i < nca_used; i++) {
1251: if (ssh_krl_check_key(krl, ca_used[i]) == 0)
1252: sig_seen = 1;
1253: else {
1.20 djm 1254: sshkey_free(ca_used[i]);
1.1 djm 1255: ca_used[i] = NULL;
1256: }
1257: }
1258: if (nca_used && !sig_seen) {
1259: error("All keys used to sign KRL were revoked");
1.25 djm 1260: r = SSH_ERR_KEY_REVOKED;
1.1 djm 1261: goto out;
1262: }
1263:
1264: /* If we have CA keys, then verify that one was used to sign the KRL */
1265: if (sig_seen && nsign_ca_keys != 0) {
1266: sig_seen = 0;
1267: for (i = 0; !sig_seen && i < nsign_ca_keys; i++) {
1268: for (j = 0; j < nca_used; j++) {
1269: if (ca_used[j] == NULL)
1270: continue;
1.20 djm 1271: if (sshkey_equal(ca_used[j], sign_ca_keys[i])) {
1.1 djm 1272: sig_seen = 1;
1273: break;
1274: }
1275: }
1276: }
1277: if (!sig_seen) {
1.20 djm 1278: r = SSH_ERR_SIGNATURE_INVALID;
1.1 djm 1279: error("KRL not signed with any trusted key");
1280: goto out;
1281: }
1282: }
1283:
1284: *krlp = krl;
1.20 djm 1285: r = 0;
1.1 djm 1286: out:
1.20 djm 1287: if (r != 0)
1.1 djm 1288: ssh_krl_free(krl);
1.20 djm 1289: for (i = 0; i < nca_used; i++)
1290: sshkey_free(ca_used[i]);
1.1 djm 1291: free(ca_used);
1.20 djm 1292: sshkey_free(key);
1293: sshbuf_free(copy);
1294: sshbuf_free(sect);
1295: return r;
1.1 djm 1296: }
1297:
1.31 djm 1298: /* Checks certificate serial number and key ID revocation */
1299: static int
1300: is_cert_revoked(const struct sshkey *key, struct revoked_certs *rc)
1301: {
1302: struct revoked_serial rs, *ers;
1303: struct revoked_key_id rki, *erki;
1304:
1305: /* Check revocation by cert key ID */
1306: memset(&rki, 0, sizeof(rki));
1307: rki.key_id = key->cert->key_id;
1308: erki = RB_FIND(revoked_key_id_tree, &rc->revoked_key_ids, &rki);
1309: if (erki != NULL) {
1.52 djm 1310: KRL_DBG(("revoked by key ID"));
1.31 djm 1311: return SSH_ERR_KEY_REVOKED;
1312: }
1313:
1314: /*
1.33 djm 1315: * Zero serials numbers are ignored (it's the default when the
1316: * CA doesn't specify one).
1.31 djm 1317: */
1.33 djm 1318: if (key->cert->serial == 0)
1.31 djm 1319: return 0;
1320:
1321: memset(&rs, 0, sizeof(rs));
1322: rs.lo = rs.hi = key->cert->serial;
1323: ers = RB_FIND(revoked_serial_tree, &rc->revoked_serials, &rs);
1324: if (ers != NULL) {
1.52 djm 1325: KRL_DBG(("revoked serial %llu matched %llu:%llu",
1.31 djm 1326: key->cert->serial, ers->lo, ers->hi));
1327: return SSH_ERR_KEY_REVOKED;
1328: }
1329: return 0;
1330: }
1331:
1.1 djm 1332: /* Checks whether a given key/cert is revoked. Does not check its CA */
1333: static int
1.20 djm 1334: is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
1.1 djm 1335: {
1336: struct revoked_blob rb, *erb;
1337: struct revoked_certs *rc;
1.20 djm 1338: int r;
1.1 djm 1339:
1340: /* Check explicitly revoked hashes first */
1.14 tedu 1341: memset(&rb, 0, sizeof(rb));
1.21 djm 1342: if ((r = sshkey_fingerprint_raw(key, SSH_DIGEST_SHA1,
1.20 djm 1343: &rb.blob, &rb.len)) != 0)
1344: return r;
1.1 djm 1345: erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
1346: free(rb.blob);
1347: if (erb != NULL) {
1.52 djm 1348: KRL_DBG(("revoked by key SHA1"));
1.42 djm 1349: return SSH_ERR_KEY_REVOKED;
1350: }
1351: memset(&rb, 0, sizeof(rb));
1352: if ((r = sshkey_fingerprint_raw(key, SSH_DIGEST_SHA256,
1353: &rb.blob, &rb.len)) != 0)
1354: return r;
1355: erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha256s, &rb);
1356: free(rb.blob);
1357: if (erb != NULL) {
1.52 djm 1358: KRL_DBG(("revoked by key SHA256"));
1.20 djm 1359: return SSH_ERR_KEY_REVOKED;
1.1 djm 1360: }
1361:
1362: /* Next, explicit keys */
1.14 tedu 1363: memset(&rb, 0, sizeof(rb));
1.20 djm 1364: if ((r = plain_key_blob(key, &rb.blob, &rb.len)) != 0)
1365: return r;
1.1 djm 1366: erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb);
1367: free(rb.blob);
1368: if (erb != NULL) {
1.52 djm 1369: KRL_DBG(("revoked by explicit key"));
1.20 djm 1370: return SSH_ERR_KEY_REVOKED;
1.1 djm 1371: }
1372:
1.20 djm 1373: if (!sshkey_is_cert(key))
1.1 djm 1374: return 0;
1375:
1.31 djm 1376: /* Check cert revocation for the specified CA */
1.20 djm 1377: if ((r = revoked_certs_for_ca_key(krl, key->cert->signature_key,
1378: &rc, 0)) != 0)
1379: return r;
1.31 djm 1380: if (rc != NULL) {
1381: if ((r = is_cert_revoked(key, rc)) != 0)
1382: return r;
1383: }
1384: /* Check cert revocation for the wildcard CA */
1385: if ((r = revoked_certs_for_ca_key(krl, NULL, &rc, 0)) != 0)
1386: return r;
1387: if (rc != NULL) {
1388: if ((r = is_cert_revoked(key, rc)) != 0)
1389: return r;
1.1 djm 1390: }
1391:
1.52 djm 1392: KRL_DBG(("%llu no match", key->cert->serial));
1.1 djm 1393: return 0;
1394: }
1395:
1396: int
1.20 djm 1397: ssh_krl_check_key(struct ssh_krl *krl, const struct sshkey *key)
1.1 djm 1398: {
1399: int r;
1400:
1.52 djm 1401: KRL_DBG(("checking key"));
1.1 djm 1402: if ((r = is_key_revoked(krl, key)) != 0)
1403: return r;
1.20 djm 1404: if (sshkey_is_cert(key)) {
1.52 djm 1405: debug2_f("checking CA key");
1.1 djm 1406: if ((r = is_key_revoked(krl, key->cert->signature_key)) != 0)
1407: return r;
1408: }
1.52 djm 1409: KRL_DBG(("key okay"));
1.1 djm 1410: return 0;
1411: }
1412:
1413: int
1.20 djm 1414: ssh_krl_file_contains_key(const char *path, const struct sshkey *key)
1.1 djm 1415: {
1.20 djm 1416: struct sshbuf *krlbuf = NULL;
1417: struct ssh_krl *krl = NULL;
1.47 djm 1418: int oerrno = 0, r;
1.1 djm 1419:
1420: if (path == NULL)
1421: return 0;
1.47 djm 1422: if ((r = sshbuf_load_file(path, &krlbuf)) != 0) {
1.20 djm 1423: oerrno = errno;
1424: goto out;
1.1 djm 1425: }
1.20 djm 1426: if ((r = ssh_krl_from_blob(krlbuf, &krl, NULL, 0)) != 0)
1427: goto out;
1.52 djm 1428: debug2_f("checking KRL %s", path);
1.20 djm 1429: r = ssh_krl_check_key(krl, key);
1430: out:
1431: sshbuf_free(krlbuf);
1.1 djm 1432: ssh_krl_free(krl);
1.20 djm 1433: if (r != 0)
1434: errno = oerrno;
1435: return r;
1.48 djm 1436: }
1437:
1438: int
1439: krl_dump(struct ssh_krl *krl, FILE *f)
1440: {
1441: struct sshkey *key = NULL;
1442: struct revoked_blob *rb;
1443: struct revoked_certs *rc;
1444: struct revoked_serial *rs;
1445: struct revoked_key_id *rki;
1446: int r, ret = 0;
1447: char *fp, timestamp[64];
1448:
1449: /* Try to print in a KRL spec-compatible format */
1450: format_timestamp(krl->generated_date, timestamp, sizeof(timestamp));
1.50 djm 1451: fprintf(f, "# KRL version %llu\n",
1452: (unsigned long long)krl->krl_version);
1.48 djm 1453: fprintf(f, "# Generated at %s\n", timestamp);
1454: if (krl->comment != NULL && *krl->comment != '\0') {
1455: r = INT_MAX;
1456: asmprintf(&fp, INT_MAX, &r, "%s", krl->comment);
1457: fprintf(f, "# Comment: %s\n", fp);
1458: free(fp);
1459: }
1460: fputc('\n', f);
1461:
1462: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_keys) {
1463: if ((r = sshkey_from_blob(rb->blob, rb->len, &key)) != 0) {
1464: ret = SSH_ERR_INVALID_FORMAT;
1.52 djm 1465: error_r(r, "parse KRL key");
1.48 djm 1466: continue;
1467: }
1468: if ((fp = sshkey_fingerprint(key, SSH_FP_HASH_DEFAULT,
1469: SSH_FP_DEFAULT)) == NULL) {
1470: ret = SSH_ERR_INVALID_FORMAT;
1471: error("sshkey_fingerprint failed");
1472: continue;
1473: }
1.54 djm 1474: fprintf(f, "hash: %s # %s\n", fp, sshkey_ssh_name(key));
1.48 djm 1475: free(fp);
1476: free(key);
1477: }
1478: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha256s) {
1479: fp = tohex(rb->blob, rb->len);
1480: fprintf(f, "hash: SHA256:%s\n", fp);
1481: free(fp);
1482: }
1483: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha1s) {
1484: /*
1485: * There is not KRL spec keyword for raw SHA1 hashes, so
1486: * print them as comments.
1487: */
1488: fp = tohex(rb->blob, rb->len);
1489: fprintf(f, "# hash SHA1:%s\n", fp);
1490: free(fp);
1491: }
1492:
1493: TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
1494: fputc('\n', f);
1495: if (rc->ca_key == NULL)
1496: fprintf(f, "# Wildcard CA\n");
1497: else {
1498: if ((fp = sshkey_fingerprint(rc->ca_key,
1499: SSH_FP_HASH_DEFAULT, SSH_FP_DEFAULT)) == NULL) {
1500: ret = SSH_ERR_INVALID_FORMAT;
1501: error("sshkey_fingerprint failed");
1502: continue;
1503: }
1504: fprintf(f, "# CA key %s %s\n",
1505: sshkey_ssh_name(rc->ca_key), fp);
1506: free(fp);
1507: }
1508: RB_FOREACH(rs, revoked_serial_tree, &rc->revoked_serials) {
1.50 djm 1509: if (rs->lo == rs->hi) {
1510: fprintf(f, "serial: %llu\n",
1511: (unsigned long long)rs->lo);
1512: } else {
1.49 djm 1513: fprintf(f, "serial: %llu-%llu\n",
1.50 djm 1514: (unsigned long long)rs->lo,
1515: (unsigned long long)rs->hi);
1.48 djm 1516: }
1517: }
1518: RB_FOREACH(rki, revoked_key_id_tree, &rc->revoked_key_ids) {
1519: /*
1520: * We don't want key IDs with embedded newlines to
1521: * mess up the display.
1522: */
1523: r = INT_MAX;
1524: asmprintf(&fp, INT_MAX, &r, "%s", rki->key_id);
1525: fprintf(f, "id: %s\n", fp);
1526: free(fp);
1527: }
1528: }
1529: return ret;
1.1 djm 1530: }
![[BACK]](/icons/back.gif){kind=icon}
Return to krl.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh