Annotation of src/usr.bin/ssh/krl.c, Revision 1.58
1.1 djm 1: /*
2: * Copyright (c) 2012 Damien Miller <djm@mindrot.org>
3: *
4: * Permission to use, copy, modify, and distribute this software for any
5: * purpose with or without fee is hereby granted, provided that the above
6: * copyright notice and this permission notice appear in all copies.
7: *
8: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15: */
16:
1.58 ! djm 17: /* $OpenBSD: krl.c,v 1.57 2023/07/17 04:01:10 djm Exp $ */
1.2 djm 18:
1.1 djm 19: #include <sys/types.h>
20: #include <sys/tree.h>
21: #include <sys/queue.h>
22:
23: #include <errno.h>
24: #include <fcntl.h>
25: #include <limits.h>
26: #include <string.h>
27: #include <time.h>
28: #include <unistd.h>
1.44 djm 29: #include <stdlib.h>
1.1 djm 30:
1.20 djm 31: #include "sshbuf.h"
1.25 djm 32: #include "ssherr.h"
1.20 djm 33: #include "sshkey.h"
1.1 djm 34: #include "authfile.h"
35: #include "misc.h"
36: #include "log.h"
1.21 djm 37: #include "digest.h"
1.26 djm 38: #include "bitmap.h"
1.48 djm 39: #include "utf8.h"
1.1 djm 40:
41: #include "krl.h"
42:
43: /* #define DEBUG_KRL */
44: #ifdef DEBUG_KRL
1.52 djm 45: # define KRL_DBG(x) debug3_f x
1.1 djm 46: #else
47: # define KRL_DBG(x)
48: #endif
49:
50: /*
51: * Trees of revoked serial numbers, key IDs and keys. This allows
52: * quick searching, querying and producing lists in canonical order.
53: */
54:
55: /* Tree of serial numbers. XXX make smarter: really need a real sparse bitmap */
56: struct revoked_serial {
57: u_int64_t lo, hi;
58: RB_ENTRY(revoked_serial) tree_entry;
59: };
60: static int serial_cmp(struct revoked_serial *a, struct revoked_serial *b);
61: RB_HEAD(revoked_serial_tree, revoked_serial);
1.53 djm 62: RB_GENERATE_STATIC(revoked_serial_tree, revoked_serial, tree_entry, serial_cmp)
1.1 djm 63:
64: /* Tree of key IDs */
65: struct revoked_key_id {
66: char *key_id;
67: RB_ENTRY(revoked_key_id) tree_entry;
68: };
69: static int key_id_cmp(struct revoked_key_id *a, struct revoked_key_id *b);
70: RB_HEAD(revoked_key_id_tree, revoked_key_id);
1.53 djm 71: RB_GENERATE_STATIC(revoked_key_id_tree, revoked_key_id, tree_entry, key_id_cmp)
1.1 djm 72:
73: /* Tree of blobs (used for keys and fingerprints) */
74: struct revoked_blob {
75: u_char *blob;
1.20 djm 76: size_t len;
1.1 djm 77: RB_ENTRY(revoked_blob) tree_entry;
78: };
79: static int blob_cmp(struct revoked_blob *a, struct revoked_blob *b);
80: RB_HEAD(revoked_blob_tree, revoked_blob);
1.53 djm 81: RB_GENERATE_STATIC(revoked_blob_tree, revoked_blob, tree_entry, blob_cmp)
1.1 djm 82:
83: /* Tracks revoked certs for a single CA */
84: struct revoked_certs {
1.20 djm 85: struct sshkey *ca_key;
1.1 djm 86: struct revoked_serial_tree revoked_serials;
87: struct revoked_key_id_tree revoked_key_ids;
88: TAILQ_ENTRY(revoked_certs) entry;
89: };
90: TAILQ_HEAD(revoked_certs_list, revoked_certs);
91:
92: struct ssh_krl {
93: u_int64_t krl_version;
94: u_int64_t generated_date;
95: u_int64_t flags;
96: char *comment;
97: struct revoked_blob_tree revoked_keys;
98: struct revoked_blob_tree revoked_sha1s;
1.42 djm 99: struct revoked_blob_tree revoked_sha256s;
1.1 djm 100: struct revoked_certs_list revoked_certs;
101: };
102:
103: /* Return equal if a and b overlap */
104: static int
105: serial_cmp(struct revoked_serial *a, struct revoked_serial *b)
106: {
107: if (a->hi >= b->lo && a->lo <= b->hi)
108: return 0;
109: return a->lo < b->lo ? -1 : 1;
110: }
111:
112: static int
113: key_id_cmp(struct revoked_key_id *a, struct revoked_key_id *b)
114: {
115: return strcmp(a->key_id, b->key_id);
116: }
117:
118: static int
119: blob_cmp(struct revoked_blob *a, struct revoked_blob *b)
120: {
121: int r;
122:
123: if (a->len != b->len) {
1.38 deraadt 124: if ((r = memcmp(a->blob, b->blob, MINIMUM(a->len, b->len))) != 0)
1.1 djm 125: return r;
126: return a->len > b->len ? 1 : -1;
127: } else
128: return memcmp(a->blob, b->blob, a->len);
129: }
130:
131: struct ssh_krl *
132: ssh_krl_init(void)
133: {
134: struct ssh_krl *krl;
135:
136: if ((krl = calloc(1, sizeof(*krl))) == NULL)
137: return NULL;
138: RB_INIT(&krl->revoked_keys);
139: RB_INIT(&krl->revoked_sha1s);
1.42 djm 140: RB_INIT(&krl->revoked_sha256s);
1.1 djm 141: TAILQ_INIT(&krl->revoked_certs);
142: return krl;
143: }
144:
145: static void
146: revoked_certs_free(struct revoked_certs *rc)
147: {
148: struct revoked_serial *rs, *trs;
149: struct revoked_key_id *rki, *trki;
150:
151: RB_FOREACH_SAFE(rs, revoked_serial_tree, &rc->revoked_serials, trs) {
152: RB_REMOVE(revoked_serial_tree, &rc->revoked_serials, rs);
153: free(rs);
154: }
155: RB_FOREACH_SAFE(rki, revoked_key_id_tree, &rc->revoked_key_ids, trki) {
156: RB_REMOVE(revoked_key_id_tree, &rc->revoked_key_ids, rki);
157: free(rki->key_id);
158: free(rki);
159: }
1.31 djm 160: sshkey_free(rc->ca_key);
1.1 djm 161: }
162:
163: void
164: ssh_krl_free(struct ssh_krl *krl)
165: {
166: struct revoked_blob *rb, *trb;
167: struct revoked_certs *rc, *trc;
168:
169: if (krl == NULL)
170: return;
171:
172: free(krl->comment);
173: RB_FOREACH_SAFE(rb, revoked_blob_tree, &krl->revoked_keys, trb) {
174: RB_REMOVE(revoked_blob_tree, &krl->revoked_keys, rb);
175: free(rb->blob);
176: free(rb);
177: }
178: RB_FOREACH_SAFE(rb, revoked_blob_tree, &krl->revoked_sha1s, trb) {
179: RB_REMOVE(revoked_blob_tree, &krl->revoked_sha1s, rb);
180: free(rb->blob);
181: free(rb);
182: }
1.42 djm 183: RB_FOREACH_SAFE(rb, revoked_blob_tree, &krl->revoked_sha256s, trb) {
184: RB_REMOVE(revoked_blob_tree, &krl->revoked_sha256s, rb);
185: free(rb->blob);
186: free(rb);
187: }
1.1 djm 188: TAILQ_FOREACH_SAFE(rc, &krl->revoked_certs, entry, trc) {
189: TAILQ_REMOVE(&krl->revoked_certs, rc, entry);
190: revoked_certs_free(rc);
191: }
1.55 dtucker 192: free(krl);
1.1 djm 193: }
194:
195: void
196: ssh_krl_set_version(struct ssh_krl *krl, u_int64_t version)
197: {
198: krl->krl_version = version;
199: }
200:
1.20 djm 201: int
1.1 djm 202: ssh_krl_set_comment(struct ssh_krl *krl, const char *comment)
203: {
204: free(krl->comment);
205: if ((krl->comment = strdup(comment)) == NULL)
1.20 djm 206: return SSH_ERR_ALLOC_FAIL;
207: return 0;
1.1 djm 208: }
209:
210: /*
211: * Find the revoked_certs struct for a CA key. If allow_create is set then
212: * create a new one in the tree if one did not exist already.
213: */
214: static int
1.20 djm 215: revoked_certs_for_ca_key(struct ssh_krl *krl, const struct sshkey *ca_key,
1.1 djm 216: struct revoked_certs **rcp, int allow_create)
217: {
218: struct revoked_certs *rc;
1.20 djm 219: int r;
1.1 djm 220:
221: *rcp = NULL;
222: TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
1.31 djm 223: if ((ca_key == NULL && rc->ca_key == NULL) ||
224: sshkey_equal(rc->ca_key, ca_key)) {
1.1 djm 225: *rcp = rc;
226: return 0;
227: }
228: }
229: if (!allow_create)
230: return 0;
231: /* If this CA doesn't exist in the list then add it now */
232: if ((rc = calloc(1, sizeof(*rc))) == NULL)
1.20 djm 233: return SSH_ERR_ALLOC_FAIL;
1.31 djm 234: if (ca_key == NULL)
235: rc->ca_key = NULL;
236: else if ((r = sshkey_from_private(ca_key, &rc->ca_key)) != 0) {
1.1 djm 237: free(rc);
1.20 djm 238: return r;
1.1 djm 239: }
240: RB_INIT(&rc->revoked_serials);
241: RB_INIT(&rc->revoked_key_ids);
242: TAILQ_INSERT_TAIL(&krl->revoked_certs, rc, entry);
1.52 djm 243: KRL_DBG(("new CA %s", ca_key == NULL ? "*" : sshkey_type(ca_key)));
1.1 djm 244: *rcp = rc;
245: return 0;
246: }
247:
248: static int
249: insert_serial_range(struct revoked_serial_tree *rt, u_int64_t lo, u_int64_t hi)
250: {
251: struct revoked_serial rs, *ers, *crs, *irs;
252:
1.52 djm 253: KRL_DBG(("insert %llu:%llu", lo, hi));
1.14 tedu 254: memset(&rs, 0, sizeof(rs));
1.1 djm 255: rs.lo = lo;
256: rs.hi = hi;
257: ers = RB_NFIND(revoked_serial_tree, rt, &rs);
258: if (ers == NULL || serial_cmp(ers, &rs) != 0) {
259: /* No entry matches. Just insert */
260: if ((irs = malloc(sizeof(rs))) == NULL)
1.20 djm 261: return SSH_ERR_ALLOC_FAIL;
1.1 djm 262: memcpy(irs, &rs, sizeof(*irs));
263: ers = RB_INSERT(revoked_serial_tree, rt, irs);
264: if (ers != NULL) {
1.52 djm 265: KRL_DBG(("bad: ers != NULL"));
1.1 djm 266: /* Shouldn't happen */
1.4 markus 267: free(irs);
1.25 djm 268: return SSH_ERR_INTERNAL_ERROR;
1.1 djm 269: }
270: ers = irs;
271: } else {
1.52 djm 272: KRL_DBG(("overlap found %llu:%llu", ers->lo, ers->hi));
1.1 djm 273: /*
274: * The inserted entry overlaps an existing one. Grow the
275: * existing entry.
276: */
277: if (ers->lo > lo)
278: ers->lo = lo;
279: if (ers->hi < hi)
280: ers->hi = hi;
281: }
1.25 djm 282:
1.1 djm 283: /*
284: * The inserted or revised range might overlap or abut adjacent ones;
285: * coalesce as necessary.
286: */
287:
288: /* Check predecessors */
289: while ((crs = RB_PREV(revoked_serial_tree, rt, ers)) != NULL) {
1.52 djm 290: KRL_DBG(("pred %llu:%llu", crs->lo, crs->hi));
1.1 djm 291: if (ers->lo != 0 && crs->hi < ers->lo - 1)
292: break;
293: /* This entry overlaps. */
294: if (crs->lo < ers->lo) {
295: ers->lo = crs->lo;
1.52 djm 296: KRL_DBG(("pred extend %llu:%llu", ers->lo, ers->hi));
1.1 djm 297: }
298: RB_REMOVE(revoked_serial_tree, rt, crs);
299: free(crs);
300: }
301: /* Check successors */
302: while ((crs = RB_NEXT(revoked_serial_tree, rt, ers)) != NULL) {
1.52 djm 303: KRL_DBG(("succ %llu:%llu", crs->lo, crs->hi));
1.1 djm 304: if (ers->hi != (u_int64_t)-1 && crs->lo > ers->hi + 1)
305: break;
306: /* This entry overlaps. */
307: if (crs->hi > ers->hi) {
308: ers->hi = crs->hi;
1.52 djm 309: KRL_DBG(("succ extend %llu:%llu", ers->lo, ers->hi));
1.1 djm 310: }
311: RB_REMOVE(revoked_serial_tree, rt, crs);
312: free(crs);
313: }
1.52 djm 314: KRL_DBG(("done, final %llu:%llu", ers->lo, ers->hi));
1.1 djm 315: return 0;
316: }
317:
318: int
1.20 djm 319: ssh_krl_revoke_cert_by_serial(struct ssh_krl *krl, const struct sshkey *ca_key,
1.1 djm 320: u_int64_t serial)
321: {
322: return ssh_krl_revoke_cert_by_serial_range(krl, ca_key, serial, serial);
323: }
324:
325: int
1.25 djm 326: ssh_krl_revoke_cert_by_serial_range(struct ssh_krl *krl,
327: const struct sshkey *ca_key, u_int64_t lo, u_int64_t hi)
1.1 djm 328: {
329: struct revoked_certs *rc;
1.20 djm 330: int r;
1.1 djm 331:
332: if (lo > hi || lo == 0)
1.25 djm 333: return SSH_ERR_INVALID_ARGUMENT;
1.20 djm 334: if ((r = revoked_certs_for_ca_key(krl, ca_key, &rc, 1)) != 0)
335: return r;
1.1 djm 336: return insert_serial_range(&rc->revoked_serials, lo, hi);
337: }
338:
339: int
1.20 djm 340: ssh_krl_revoke_cert_by_key_id(struct ssh_krl *krl, const struct sshkey *ca_key,
1.1 djm 341: const char *key_id)
342: {
343: struct revoked_key_id *rki, *erki;
344: struct revoked_certs *rc;
1.20 djm 345: int r;
1.1 djm 346:
1.20 djm 347: if ((r = revoked_certs_for_ca_key(krl, ca_key, &rc, 1)) != 0)
348: return r;
1.1 djm 349:
1.52 djm 350: KRL_DBG(("revoke %s", key_id));
1.1 djm 351: if ((rki = calloc(1, sizeof(*rki))) == NULL ||
352: (rki->key_id = strdup(key_id)) == NULL) {
353: free(rki);
1.20 djm 354: return SSH_ERR_ALLOC_FAIL;
1.1 djm 355: }
356: erki = RB_INSERT(revoked_key_id_tree, &rc->revoked_key_ids, rki);
357: if (erki != NULL) {
358: free(rki->key_id);
359: free(rki);
360: }
361: return 0;
362: }
363:
364: /* Convert "key" to a public key blob without any certificate information */
365: static int
1.20 djm 366: plain_key_blob(const struct sshkey *key, u_char **blob, size_t *blen)
1.1 djm 367: {
1.20 djm 368: struct sshkey *kcopy;
1.1 djm 369: int r;
370:
1.20 djm 371: if ((r = sshkey_from_private(key, &kcopy)) != 0)
372: return r;
373: if (sshkey_is_cert(kcopy)) {
374: if ((r = sshkey_drop_cert(kcopy)) != 0) {
375: sshkey_free(kcopy);
376: return r;
1.1 djm 377: }
378: }
1.20 djm 379: r = sshkey_to_blob(kcopy, blob, blen);
1.23 markus 380: sshkey_free(kcopy);
1.17 djm 381: return r;
1.1 djm 382: }
383:
384: /* Revoke a key blob. Ownership of blob is transferred to the tree */
385: static int
1.25 djm 386: revoke_blob(struct revoked_blob_tree *rbt, u_char *blob, size_t len)
1.1 djm 387: {
388: struct revoked_blob *rb, *erb;
389:
390: if ((rb = calloc(1, sizeof(*rb))) == NULL)
1.20 djm 391: return SSH_ERR_ALLOC_FAIL;
1.1 djm 392: rb->blob = blob;
393: rb->len = len;
394: erb = RB_INSERT(revoked_blob_tree, rbt, rb);
395: if (erb != NULL) {
396: free(rb->blob);
397: free(rb);
398: }
399: return 0;
400: }
401:
402: int
1.20 djm 403: ssh_krl_revoke_key_explicit(struct ssh_krl *krl, const struct sshkey *key)
1.1 djm 404: {
405: u_char *blob;
1.20 djm 406: size_t len;
407: int r;
1.1 djm 408:
1.52 djm 409: debug3_f("revoke type %s", sshkey_type(key));
1.20 djm 410: if ((r = plain_key_blob(key, &blob, &len)) != 0)
411: return r;
1.1 djm 412: return revoke_blob(&krl->revoked_keys, blob, len);
413: }
414:
1.42 djm 415: static int
416: revoke_by_hash(struct revoked_blob_tree *target, const u_char *p, size_t len)
1.1 djm 417: {
418: u_char *blob;
1.20 djm 419: int r;
1.1 djm 420:
1.42 djm 421: /* need to copy hash, as revoke_blob steals ownership */
422: if ((blob = malloc(len)) == NULL)
423: return SSH_ERR_SYSTEM_ERROR;
424: memcpy(blob, p, len);
425: if ((r = revoke_blob(target, blob, len)) != 0) {
426: free(blob);
1.20 djm 427: return r;
1.42 djm 428: }
429: return 0;
430: }
431:
432: int
433: ssh_krl_revoke_key_sha1(struct ssh_krl *krl, const u_char *p, size_t len)
434: {
1.52 djm 435: debug3_f("revoke by sha1");
1.42 djm 436: if (len != 20)
437: return SSH_ERR_INVALID_FORMAT;
438: return revoke_by_hash(&krl->revoked_sha1s, p, len);
439: }
440:
441: int
442: ssh_krl_revoke_key_sha256(struct ssh_krl *krl, const u_char *p, size_t len)
443: {
1.52 djm 444: debug3_f("revoke by sha256");
1.42 djm 445: if (len != 32)
446: return SSH_ERR_INVALID_FORMAT;
447: return revoke_by_hash(&krl->revoked_sha256s, p, len);
1.1 djm 448: }
449:
450: int
1.20 djm 451: ssh_krl_revoke_key(struct ssh_krl *krl, const struct sshkey *key)
1.1 djm 452: {
1.42 djm 453: /* XXX replace with SHA256? */
1.20 djm 454: if (!sshkey_is_cert(key))
1.42 djm 455: return ssh_krl_revoke_key_explicit(krl, key);
1.1 djm 456:
1.33 djm 457: if (key->cert->serial == 0) {
1.1 djm 458: return ssh_krl_revoke_cert_by_key_id(krl,
459: key->cert->signature_key,
460: key->cert->key_id);
461: } else {
462: return ssh_krl_revoke_cert_by_serial(krl,
463: key->cert->signature_key,
464: key->cert->serial);
465: }
466: }
467:
468: /*
1.20 djm 469: * Select the most compact section type to emit next in a KRL based on
470: * the current section type, the run length of contiguous revoked serial
1.1 djm 471: * numbers and the gaps from the last and to the next revoked serial.
472: * Applies a mostly-accurate bit cost model to select the section type
473: * that will minimise the size of the resultant KRL.
474: */
475: static int
476: choose_next_state(int current_state, u_int64_t contig, int final,
477: u_int64_t last_gap, u_int64_t next_gap, int *force_new_section)
478: {
479: int new_state;
480: u_int64_t cost, cost_list, cost_range, cost_bitmap, cost_bitmap_restart;
481:
482: /*
483: * Avoid unsigned overflows.
484: * The limits are high enough to avoid confusing the calculations.
485: */
1.38 deraadt 486: contig = MINIMUM(contig, 1ULL<<31);
487: last_gap = MINIMUM(last_gap, 1ULL<<31);
488: next_gap = MINIMUM(next_gap, 1ULL<<31);
1.1 djm 489:
490: /*
491: * Calculate the cost to switch from the current state to candidates.
492: * NB. range sections only ever contain a single range, so their
493: * switching cost is independent of the current_state.
494: */
495: cost_list = cost_bitmap = cost_bitmap_restart = 0;
496: cost_range = 8;
497: switch (current_state) {
498: case KRL_SECTION_CERT_SERIAL_LIST:
499: cost_bitmap_restart = cost_bitmap = 8 + 64;
500: break;
501: case KRL_SECTION_CERT_SERIAL_BITMAP:
502: cost_list = 8;
503: cost_bitmap_restart = 8 + 64;
504: break;
505: case KRL_SECTION_CERT_SERIAL_RANGE:
506: case 0:
507: cost_bitmap_restart = cost_bitmap = 8 + 64;
508: cost_list = 8;
509: }
510:
511: /* Estimate base cost in bits of each section type */
512: cost_list += 64 * contig + (final ? 0 : 8+64);
513: cost_range += (2 * 64) + (final ? 0 : 8+64);
1.38 deraadt 514: cost_bitmap += last_gap + contig + (final ? 0 : MINIMUM(next_gap, 8+64));
515: cost_bitmap_restart += contig + (final ? 0 : MINIMUM(next_gap, 8+64));
1.1 djm 516:
517: /* Convert to byte costs for actual comparison */
518: cost_list = (cost_list + 7) / 8;
519: cost_bitmap = (cost_bitmap + 7) / 8;
520: cost_bitmap_restart = (cost_bitmap_restart + 7) / 8;
521: cost_range = (cost_range + 7) / 8;
522:
523: /* Now pick the best choice */
524: *force_new_section = 0;
525: new_state = KRL_SECTION_CERT_SERIAL_BITMAP;
526: cost = cost_bitmap;
527: if (cost_range < cost) {
528: new_state = KRL_SECTION_CERT_SERIAL_RANGE;
529: cost = cost_range;
530: }
531: if (cost_list < cost) {
532: new_state = KRL_SECTION_CERT_SERIAL_LIST;
533: cost = cost_list;
534: }
535: if (cost_bitmap_restart < cost) {
536: new_state = KRL_SECTION_CERT_SERIAL_BITMAP;
537: *force_new_section = 1;
538: cost = cost_bitmap_restart;
539: }
1.52 djm 540: KRL_DBG(("contig %llu last_gap %llu next_gap %llu final %d, costs:"
1.1 djm 541: "list %llu range %llu bitmap %llu new bitmap %llu, "
1.52 djm 542: "selected 0x%02x%s", (long long unsigned)contig,
1.11 djm 543: (long long unsigned)last_gap, (long long unsigned)next_gap, final,
544: (long long unsigned)cost_list, (long long unsigned)cost_range,
545: (long long unsigned)cost_bitmap,
546: (long long unsigned)cost_bitmap_restart, new_state,
1.25 djm 547: *force_new_section ? " restart" : ""));
1.1 djm 548: return new_state;
549: }
550:
1.26 djm 551: static int
552: put_bitmap(struct sshbuf *buf, struct bitmap *bitmap)
553: {
554: size_t len;
555: u_char *blob;
556: int r;
557:
558: len = bitmap_nbytes(bitmap);
559: if ((blob = malloc(len)) == NULL)
560: return SSH_ERR_ALLOC_FAIL;
561: if (bitmap_to_string(bitmap, blob, len) != 0) {
562: free(blob);
563: return SSH_ERR_INTERNAL_ERROR;
564: }
565: r = sshbuf_put_bignum2_bytes(buf, blob, len);
566: free(blob);
567: return r;
568: }
569:
1.1 djm 570: /* Generate a KRL_SECTION_CERTIFICATES KRL section */
571: static int
1.20 djm 572: revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf)
1.1 djm 573: {
1.25 djm 574: int final, force_new_sect, r = SSH_ERR_INTERNAL_ERROR;
1.1 djm 575: u_int64_t i, contig, gap, last = 0, bitmap_start = 0;
576: struct revoked_serial *rs, *nrs;
577: struct revoked_key_id *rki;
578: int next_state, state = 0;
1.20 djm 579: struct sshbuf *sect;
1.26 djm 580: struct bitmap *bitmap = NULL;
1.1 djm 581:
1.20 djm 582: if ((sect = sshbuf_new()) == NULL)
583: return SSH_ERR_ALLOC_FAIL;
1.1 djm 584:
1.31 djm 585: /* Store the header: optional CA scope key, reserved */
586: if (rc->ca_key == NULL) {
587: if ((r = sshbuf_put_string(buf, NULL, 0)) != 0)
588: goto out;
589: } else {
590: if ((r = sshkey_puts(rc->ca_key, buf)) != 0)
591: goto out;
592: }
593: if ((r = sshbuf_put_string(buf, NULL, 0)) != 0)
1.20 djm 594: goto out;
1.1 djm 595:
596: /* Store the revoked serials. */
597: for (rs = RB_MIN(revoked_serial_tree, &rc->revoked_serials);
598: rs != NULL;
599: rs = RB_NEXT(revoked_serial_tree, &rc->revoked_serials, rs)) {
1.52 djm 600: KRL_DBG(("serial %llu:%llu state 0x%02x",
1.11 djm 601: (long long unsigned)rs->lo, (long long unsigned)rs->hi,
1.25 djm 602: state));
1.1 djm 603:
604: /* Check contiguous length and gap to next section (if any) */
605: nrs = RB_NEXT(revoked_serial_tree, &rc->revoked_serials, rs);
606: final = nrs == NULL;
607: gap = nrs == NULL ? 0 : nrs->lo - rs->hi;
608: contig = 1 + (rs->hi - rs->lo);
609:
610: /* Choose next state based on these */
611: next_state = choose_next_state(state, contig, final,
612: state == 0 ? 0 : rs->lo - last, gap, &force_new_sect);
613:
614: /*
615: * If the current section is a range section or has a different
616: * type to the next section, then finish it off now.
617: */
618: if (state != 0 && (force_new_sect || next_state != state ||
619: state == KRL_SECTION_CERT_SERIAL_RANGE)) {
1.52 djm 620: KRL_DBG(("finish state 0x%02x", state));
1.1 djm 621: switch (state) {
622: case KRL_SECTION_CERT_SERIAL_LIST:
623: case KRL_SECTION_CERT_SERIAL_RANGE:
624: break;
625: case KRL_SECTION_CERT_SERIAL_BITMAP:
1.26 djm 626: if ((r = put_bitmap(sect, bitmap)) != 0)
1.20 djm 627: goto out;
1.26 djm 628: bitmap_free(bitmap);
1.1 djm 629: bitmap = NULL;
630: break;
631: }
1.20 djm 632: if ((r = sshbuf_put_u8(buf, state)) != 0 ||
633: (r = sshbuf_put_stringb(buf, sect)) != 0)
634: goto out;
635: sshbuf_reset(sect);
1.1 djm 636: }
637:
638: /* If we are starting a new section then prepare it now */
639: if (next_state != state || force_new_sect) {
1.52 djm 640: KRL_DBG(("start state 0x%02x",
1.25 djm 641: next_state));
1.1 djm 642: state = next_state;
1.20 djm 643: sshbuf_reset(sect);
1.1 djm 644: switch (state) {
645: case KRL_SECTION_CERT_SERIAL_LIST:
646: case KRL_SECTION_CERT_SERIAL_RANGE:
647: break;
648: case KRL_SECTION_CERT_SERIAL_BITMAP:
1.26 djm 649: if ((bitmap = bitmap_new()) == NULL) {
1.20 djm 650: r = SSH_ERR_ALLOC_FAIL;
1.1 djm 651: goto out;
1.20 djm 652: }
1.1 djm 653: bitmap_start = rs->lo;
1.20 djm 654: if ((r = sshbuf_put_u64(sect,
655: bitmap_start)) != 0)
656: goto out;
1.1 djm 657: break;
658: }
659: }
660:
661: /* Perform section-specific processing */
662: switch (state) {
663: case KRL_SECTION_CERT_SERIAL_LIST:
1.20 djm 664: for (i = 0; i < contig; i++) {
665: if ((r = sshbuf_put_u64(sect, rs->lo + i)) != 0)
666: goto out;
667: }
1.1 djm 668: break;
669: case KRL_SECTION_CERT_SERIAL_RANGE:
1.20 djm 670: if ((r = sshbuf_put_u64(sect, rs->lo)) != 0 ||
671: (r = sshbuf_put_u64(sect, rs->hi)) != 0)
672: goto out;
1.1 djm 673: break;
674: case KRL_SECTION_CERT_SERIAL_BITMAP:
675: if (rs->lo - bitmap_start > INT_MAX) {
1.52 djm 676: error_f("insane bitmap gap");
1.1 djm 677: goto out;
678: }
679: for (i = 0; i < contig; i++) {
1.26 djm 680: if (bitmap_set_bit(bitmap,
681: rs->lo + i - bitmap_start) != 0) {
1.20 djm 682: r = SSH_ERR_ALLOC_FAIL;
1.1 djm 683: goto out;
1.20 djm 684: }
1.1 djm 685: }
686: break;
687: }
688: last = rs->hi;
689: }
690: /* Flush the remaining section, if any */
691: if (state != 0) {
1.52 djm 692: KRL_DBG(("serial final flush for state 0x%02x", state));
1.1 djm 693: switch (state) {
694: case KRL_SECTION_CERT_SERIAL_LIST:
695: case KRL_SECTION_CERT_SERIAL_RANGE:
696: break;
697: case KRL_SECTION_CERT_SERIAL_BITMAP:
1.26 djm 698: if ((r = put_bitmap(sect, bitmap)) != 0)
1.20 djm 699: goto out;
1.26 djm 700: bitmap_free(bitmap);
1.1 djm 701: bitmap = NULL;
702: break;
703: }
1.20 djm 704: if ((r = sshbuf_put_u8(buf, state)) != 0 ||
705: (r = sshbuf_put_stringb(buf, sect)) != 0)
706: goto out;
1.1 djm 707: }
1.52 djm 708: KRL_DBG(("serial done "));
1.1 djm 709:
710: /* Now output a section for any revocations by key ID */
1.20 djm 711: sshbuf_reset(sect);
1.1 djm 712: RB_FOREACH(rki, revoked_key_id_tree, &rc->revoked_key_ids) {
1.52 djm 713: KRL_DBG(("key ID %s", rki->key_id));
1.20 djm 714: if ((r = sshbuf_put_cstring(sect, rki->key_id)) != 0)
715: goto out;
1.1 djm 716: }
1.20 djm 717: if (sshbuf_len(sect) != 0) {
718: if ((r = sshbuf_put_u8(buf, KRL_SECTION_CERT_KEY_ID)) != 0 ||
719: (r = sshbuf_put_stringb(buf, sect)) != 0)
720: goto out;
1.1 djm 721: }
722: r = 0;
723: out:
1.26 djm 724: bitmap_free(bitmap);
1.20 djm 725: sshbuf_free(sect);
1.1 djm 726: return r;
727: }
728:
729: int
1.57 djm 730: ssh_krl_to_blob(struct ssh_krl *krl, struct sshbuf *buf)
1.1 djm 731: {
1.25 djm 732: int r = SSH_ERR_INTERNAL_ERROR;
1.1 djm 733: struct revoked_certs *rc;
734: struct revoked_blob *rb;
1.20 djm 735: struct sshbuf *sect;
736: u_char *sblob = NULL;
1.1 djm 737:
738: if (krl->generated_date == 0)
739: krl->generated_date = time(NULL);
740:
1.20 djm 741: if ((sect = sshbuf_new()) == NULL)
742: return SSH_ERR_ALLOC_FAIL;
1.1 djm 743:
744: /* Store the header */
1.20 djm 745: if ((r = sshbuf_put(buf, KRL_MAGIC, sizeof(KRL_MAGIC) - 1)) != 0 ||
746: (r = sshbuf_put_u32(buf, KRL_FORMAT_VERSION)) != 0 ||
747: (r = sshbuf_put_u64(buf, krl->krl_version)) != 0 ||
1.34 jsg 748: (r = sshbuf_put_u64(buf, krl->generated_date)) != 0 ||
1.20 djm 749: (r = sshbuf_put_u64(buf, krl->flags)) != 0 ||
750: (r = sshbuf_put_string(buf, NULL, 0)) != 0 ||
751: (r = sshbuf_put_cstring(buf, krl->comment)) != 0)
752: goto out;
1.1 djm 753:
754: /* Store sections for revoked certificates */
755: TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
1.20 djm 756: sshbuf_reset(sect);
757: if ((r = revoked_certs_generate(rc, sect)) != 0)
758: goto out;
759: if ((r = sshbuf_put_u8(buf, KRL_SECTION_CERTIFICATES)) != 0 ||
760: (r = sshbuf_put_stringb(buf, sect)) != 0)
1.1 djm 761: goto out;
762: }
763:
764: /* Finally, output sections for revocations by public key/hash */
1.20 djm 765: sshbuf_reset(sect);
1.1 djm 766: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_keys) {
1.52 djm 767: KRL_DBG(("key len %zu ", rb->len));
1.24 markus 768: if ((r = sshbuf_put_string(sect, rb->blob, rb->len)) != 0)
1.20 djm 769: goto out;
1.1 djm 770: }
1.20 djm 771: if (sshbuf_len(sect) != 0) {
772: if ((r = sshbuf_put_u8(buf, KRL_SECTION_EXPLICIT_KEY)) != 0 ||
773: (r = sshbuf_put_stringb(buf, sect)) != 0)
774: goto out;
1.1 djm 775: }
1.20 djm 776: sshbuf_reset(sect);
1.1 djm 777: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha1s) {
1.52 djm 778: KRL_DBG(("hash len %zu ", rb->len));
1.24 markus 779: if ((r = sshbuf_put_string(sect, rb->blob, rb->len)) != 0)
1.20 djm 780: goto out;
1.1 djm 781: }
1.20 djm 782: if (sshbuf_len(sect) != 0) {
783: if ((r = sshbuf_put_u8(buf,
784: KRL_SECTION_FINGERPRINT_SHA1)) != 0 ||
785: (r = sshbuf_put_stringb(buf, sect)) != 0)
786: goto out;
1.1 djm 787: }
1.42 djm 788: sshbuf_reset(sect);
789: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha256s) {
1.52 djm 790: KRL_DBG(("hash len %zu ", rb->len));
1.42 djm 791: if ((r = sshbuf_put_string(sect, rb->blob, rb->len)) != 0)
792: goto out;
793: }
794: if (sshbuf_len(sect) != 0) {
795: if ((r = sshbuf_put_u8(buf,
796: KRL_SECTION_FINGERPRINT_SHA256)) != 0 ||
797: (r = sshbuf_put_stringb(buf, sect)) != 0)
798: goto out;
799: }
1.57 djm 800: /* success */
1.1 djm 801: r = 0;
802: out:
803: free(sblob);
1.20 djm 804: sshbuf_free(sect);
1.1 djm 805: return r;
806: }
807:
808: static void
809: format_timestamp(u_int64_t timestamp, char *ts, size_t nts)
810: {
811: time_t t;
812: struct tm *tm;
813:
814: t = timestamp;
815: tm = localtime(&t);
1.19 djm 816: if (tm == NULL)
1.27 deraadt 817: strlcpy(ts, "<INVALID>", nts);
1.19 djm 818: else {
819: *ts = '\0';
820: strftime(ts, nts, "%Y%m%dT%H%M%S", tm);
821: }
1.1 djm 822: }
823:
824: static int
1.56 djm 825: cert_extension_subsection(struct sshbuf *subsect, struct ssh_krl *krl)
826: {
827: int r = SSH_ERR_INTERNAL_ERROR;
828: u_char critical = 1;
829: struct sshbuf *value = NULL;
830: char *name = NULL;
831:
832: if ((r = sshbuf_get_cstring(subsect, &name, NULL)) != 0 ||
833: (r = sshbuf_get_u8(subsect, &critical)) != 0 ||
834: (r = sshbuf_froms(subsect, &value)) != 0) {
835: debug_fr(r, "parse");
836: error("KRL has invalid certificate extension subsection");
837: r = SSH_ERR_INVALID_FORMAT;
838: goto out;
839: }
840: if (sshbuf_len(subsect) != 0) {
841: error("KRL has invalid certificate extension subsection: "
842: "trailing data");
843: r = SSH_ERR_INVALID_FORMAT;
844: goto out;
845: }
846: debug_f("cert extension %s critical %u len %zu",
847: name, critical, sshbuf_len(value));
848: /* no extensions are currently supported */
849: if (critical) {
850: error("KRL contains unsupported critical certificate "
851: "subsection \"%s\"", name);
852: r = SSH_ERR_FEATURE_UNSUPPORTED;
853: goto out;
854: }
855: /* success */
856: r = 0;
857: out:
858: free(name);
859: sshbuf_free(value);
860: return r;
861: }
862:
863: static int
1.20 djm 864: parse_revoked_certs(struct sshbuf *buf, struct ssh_krl *krl)
1.1 djm 865: {
1.26 djm 866: int r = SSH_ERR_INTERNAL_ERROR;
1.15 djm 867: u_char type;
868: const u_char *blob;
1.26 djm 869: size_t blen, nbits;
1.20 djm 870: struct sshbuf *subsect = NULL;
1.1 djm 871: u_int64_t serial, serial_lo, serial_hi;
1.26 djm 872: struct bitmap *bitmap = NULL;
1.1 djm 873: char *key_id = NULL;
1.20 djm 874: struct sshkey *ca_key = NULL;
1.1 djm 875:
1.20 djm 876: if ((subsect = sshbuf_new()) == NULL)
877: return SSH_ERR_ALLOC_FAIL;
1.1 djm 878:
1.20 djm 879: /* Header: key, reserved */
880: if ((r = sshbuf_get_string_direct(buf, &blob, &blen)) != 0 ||
881: (r = sshbuf_skip_string(buf)) != 0)
1.1 djm 882: goto out;
1.31 djm 883: if (blen != 0 && (r = sshkey_from_blob(blob, blen, &ca_key)) != 0)
1.1 djm 884: goto out;
885:
1.20 djm 886: while (sshbuf_len(buf) > 0) {
1.36 mmcc 887: sshbuf_free(subsect);
888: subsect = NULL;
1.20 djm 889: if ((r = sshbuf_get_u8(buf, &type)) != 0 ||
890: (r = sshbuf_froms(buf, &subsect)) != 0)
1.1 djm 891: goto out;
1.52 djm 892: KRL_DBG(("subsection type 0x%02x", type));
1.25 djm 893: /* sshbuf_dump(subsect, stderr); */
1.1 djm 894:
895: switch (type) {
896: case KRL_SECTION_CERT_SERIAL_LIST:
1.20 djm 897: while (sshbuf_len(subsect) > 0) {
898: if ((r = sshbuf_get_u64(subsect, &serial)) != 0)
1.1 djm 899: goto out;
1.20 djm 900: if ((r = ssh_krl_revoke_cert_by_serial(krl,
901: ca_key, serial)) != 0)
1.1 djm 902: goto out;
903: }
904: break;
905: case KRL_SECTION_CERT_SERIAL_RANGE:
1.20 djm 906: if ((r = sshbuf_get_u64(subsect, &serial_lo)) != 0 ||
907: (r = sshbuf_get_u64(subsect, &serial_hi)) != 0)
1.1 djm 908: goto out;
1.20 djm 909: if ((r = ssh_krl_revoke_cert_by_serial_range(krl,
910: ca_key, serial_lo, serial_hi)) != 0)
1.1 djm 911: goto out;
912: break;
913: case KRL_SECTION_CERT_SERIAL_BITMAP:
1.26 djm 914: if ((bitmap = bitmap_new()) == NULL) {
1.20 djm 915: r = SSH_ERR_ALLOC_FAIL;
1.1 djm 916: goto out;
917: }
1.20 djm 918: if ((r = sshbuf_get_u64(subsect, &serial_lo)) != 0 ||
1.26 djm 919: (r = sshbuf_get_bignum2_bytes_direct(subsect,
920: &blob, &blen)) != 0)
1.1 djm 921: goto out;
1.26 djm 922: if (bitmap_from_string(bitmap, blob, blen) != 0) {
1.20 djm 923: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 924: goto out;
925: }
1.26 djm 926: nbits = bitmap_nbits(bitmap);
1.25 djm 927: for (serial = 0; serial < (u_int64_t)nbits; serial++) {
1.1 djm 928: if (serial > 0 && serial_lo + serial == 0) {
1.52 djm 929: error_f("bitmap wraps u64");
1.20 djm 930: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 931: goto out;
932: }
1.26 djm 933: if (!bitmap_test_bit(bitmap, serial))
1.1 djm 934: continue;
1.20 djm 935: if ((r = ssh_krl_revoke_cert_by_serial(krl,
936: ca_key, serial_lo + serial)) != 0)
1.1 djm 937: goto out;
938: }
1.26 djm 939: bitmap_free(bitmap);
1.1 djm 940: bitmap = NULL;
941: break;
942: case KRL_SECTION_CERT_KEY_ID:
1.20 djm 943: while (sshbuf_len(subsect) > 0) {
944: if ((r = sshbuf_get_cstring(subsect,
945: &key_id, NULL)) != 0)
1.1 djm 946: goto out;
1.20 djm 947: if ((r = ssh_krl_revoke_cert_by_key_id(krl,
948: ca_key, key_id)) != 0)
1.1 djm 949: goto out;
950: free(key_id);
951: key_id = NULL;
952: }
953: break;
1.56 djm 954: case KRL_SECTION_CERT_EXTENSION:
955: if ((r = cert_extension_subsection(subsect, krl)) != 0)
956: goto out;
957: break;
1.1 djm 958: default:
959: error("Unsupported KRL certificate section %u", type);
1.20 djm 960: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 961: goto out;
962: }
1.20 djm 963: if (sshbuf_len(subsect) > 0) {
1.1 djm 964: error("KRL certificate section contains unparsed data");
1.20 djm 965: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 966: goto out;
967: }
968: }
969:
1.20 djm 970: r = 0;
1.1 djm 971: out:
972: if (bitmap != NULL)
1.26 djm 973: bitmap_free(bitmap);
1.1 djm 974: free(key_id);
1.20 djm 975: sshkey_free(ca_key);
976: sshbuf_free(subsect);
977: return r;
1.1 djm 978: }
979:
1.42 djm 980: static int
981: blob_section(struct sshbuf *sect, struct revoked_blob_tree *target_tree,
982: size_t expected_len)
983: {
984: u_char *rdata = NULL;
985: size_t rlen = 0;
986: int r;
987:
988: while (sshbuf_len(sect) > 0) {
989: if ((r = sshbuf_get_string(sect, &rdata, &rlen)) != 0)
990: return r;
991: if (expected_len != 0 && rlen != expected_len) {
1.52 djm 992: error_f("bad length");
1.42 djm 993: free(rdata);
994: return SSH_ERR_INVALID_FORMAT;
995: }
996: if ((r = revoke_blob(target_tree, rdata, rlen)) != 0) {
997: free(rdata);
998: return r;
999: }
1000: }
1001: return 0;
1002: }
1.1 djm 1003:
1.56 djm 1004: static int
1005: extension_section(struct sshbuf *sect, struct ssh_krl *krl)
1006: {
1007: int r = SSH_ERR_INTERNAL_ERROR;
1008: u_char critical = 1;
1009: struct sshbuf *value = NULL;
1010: char *name = NULL;
1011:
1012: if ((r = sshbuf_get_cstring(sect, &name, NULL)) != 0 ||
1013: (r = sshbuf_get_u8(sect, &critical)) != 0 ||
1014: (r = sshbuf_froms(sect, &value)) != 0) {
1015: debug_fr(r, "parse");
1016: error("KRL has invalid extension section");
1017: r = SSH_ERR_INVALID_FORMAT;
1018: goto out;
1019: }
1020: if (sshbuf_len(sect) != 0) {
1021: error("KRL has invalid extension section: trailing data");
1022: r = SSH_ERR_INVALID_FORMAT;
1023: goto out;
1024: }
1025: debug_f("extension %s critical %u len %zu",
1026: name, critical, sshbuf_len(value));
1027: /* no extensions are currently supported */
1028: if (critical) {
1029: error("KRL contains unsupported critical section \"%s\"", name);
1030: r = SSH_ERR_FEATURE_UNSUPPORTED;
1031: goto out;
1032: }
1033: /* success */
1034: r = 0;
1035: out:
1036: free(name);
1037: sshbuf_free(value);
1038: return r;
1039: }
1040:
1.57 djm 1041: /* Attempt to parse a KRL */
1.1 djm 1042: int
1.57 djm 1043: ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp)
1.1 djm 1044: {
1.20 djm 1045: struct sshbuf *copy = NULL, *sect = NULL;
1046: struct ssh_krl *krl = NULL;
1.1 djm 1047: char timestamp[64];
1.57 djm 1048: int r = SSH_ERR_INTERNAL_ERROR;
1.42 djm 1049: u_char type;
1.20 djm 1050: u_int format_version;
1.1 djm 1051:
1052: *krlp = NULL;
1053:
1.57 djm 1054: /* KRL must begin with magic string */
1055: if ((r = sshbuf_cmp(buf, 0, KRL_MAGIC, sizeof(KRL_MAGIC) - 1)) != 0) {
1056: debug2_f("bad KRL magic header");
1.58 ! djm 1057: return SSH_ERR_KRL_BAD_MAGIC;
1.20 djm 1058: }
1.1 djm 1059:
1060: if ((krl = ssh_krl_init()) == NULL) {
1.52 djm 1061: error_f("alloc failed");
1.1 djm 1062: goto out;
1063: }
1.57 djm 1064: /* Don't modify buffer */
1065: if ((copy = sshbuf_fromb(buf)) == NULL) {
1066: r = SSH_ERR_ALLOC_FAIL;
1067: goto out;
1068: }
1069: if ((r = sshbuf_consume(copy, sizeof(KRL_MAGIC) - 1)) != 0 ||
1070: (r = sshbuf_get_u32(copy, &format_version)) != 0)
1.1 djm 1071: goto out;
1072: if (format_version != KRL_FORMAT_VERSION) {
1.57 djm 1073: error_f("unsupported KRL format version %u", format_version);
1.20 djm 1074: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 1075: goto out;
1076: }
1.20 djm 1077: if ((r = sshbuf_get_u64(copy, &krl->krl_version)) != 0 ||
1078: (r = sshbuf_get_u64(copy, &krl->generated_date)) != 0 ||
1079: (r = sshbuf_get_u64(copy, &krl->flags)) != 0 ||
1080: (r = sshbuf_skip_string(copy)) != 0 ||
1.57 djm 1081: (r = sshbuf_get_cstring(copy, &krl->comment, NULL)) != 0) {
1082: error_fr(r, "parse KRL header");
1.1 djm 1083: goto out;
1.57 djm 1084: }
1.1 djm 1085: format_timestamp(krl->generated_date, timestamp, sizeof(timestamp));
1.11 djm 1086: debug("KRL version %llu generated at %s%s%s",
1087: (long long unsigned)krl->krl_version, timestamp,
1088: *krl->comment ? ": " : "", krl->comment);
1.1 djm 1089:
1.57 djm 1090: /* Parse and load the KRL sections. */
1.20 djm 1091: while (sshbuf_len(copy) > 0) {
1.36 mmcc 1092: sshbuf_free(sect);
1093: sect = NULL;
1.20 djm 1094: if ((r = sshbuf_get_u8(copy, &type)) != 0 ||
1.25 djm 1095: (r = sshbuf_froms(copy, §)) != 0)
1.1 djm 1096: goto out;
1.57 djm 1097: KRL_DBG(("section 0x%02x", type));
1.1 djm 1098:
1099: switch (type) {
1100: case KRL_SECTION_CERTIFICATES:
1.20 djm 1101: if ((r = parse_revoked_certs(sect, krl)) != 0)
1.1 djm 1102: goto out;
1103: break;
1104: case KRL_SECTION_EXPLICIT_KEY:
1.42 djm 1105: if ((r = blob_section(sect,
1106: &krl->revoked_keys, 0)) != 0)
1107: goto out;
1108: break;
1.1 djm 1109: case KRL_SECTION_FINGERPRINT_SHA1:
1.42 djm 1110: if ((r = blob_section(sect,
1111: &krl->revoked_sha1s, 20)) != 0)
1112: goto out;
1113: break;
1114: case KRL_SECTION_FINGERPRINT_SHA256:
1115: if ((r = blob_section(sect,
1116: &krl->revoked_sha256s, 32)) != 0)
1.56 djm 1117: goto out;
1118: break;
1119: case KRL_SECTION_EXTENSION:
1120: if ((r = extension_section(sect, krl)) != 0)
1.42 djm 1121: goto out;
1.1 djm 1122: break;
1123: case KRL_SECTION_SIGNATURE:
1124: /* Handled above, but still need to stay in synch */
1.39 dtucker 1125: sshbuf_free(sect);
1.20 djm 1126: sect = NULL;
1127: if ((r = sshbuf_skip_string(copy)) != 0)
1.1 djm 1128: goto out;
1129: break;
1130: default:
1131: error("Unsupported KRL section %u", type);
1.20 djm 1132: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 1133: goto out;
1134: }
1.37 djm 1135: if (sect != NULL && sshbuf_len(sect) > 0) {
1.1 djm 1136: error("KRL section contains unparsed data");
1.20 djm 1137: r = SSH_ERR_INVALID_FORMAT;
1.1 djm 1138: goto out;
1139: }
1140: }
1141:
1.57 djm 1142: /* Success */
1.1 djm 1143: *krlp = krl;
1.20 djm 1144: r = 0;
1.1 djm 1145: out:
1.20 djm 1146: if (r != 0)
1.1 djm 1147: ssh_krl_free(krl);
1.20 djm 1148: sshbuf_free(copy);
1149: sshbuf_free(sect);
1150: return r;
1.1 djm 1151: }
1152:
1.31 djm 1153: /* Checks certificate serial number and key ID revocation */
1154: static int
1155: is_cert_revoked(const struct sshkey *key, struct revoked_certs *rc)
1156: {
1157: struct revoked_serial rs, *ers;
1158: struct revoked_key_id rki, *erki;
1159:
1160: /* Check revocation by cert key ID */
1161: memset(&rki, 0, sizeof(rki));
1162: rki.key_id = key->cert->key_id;
1163: erki = RB_FIND(revoked_key_id_tree, &rc->revoked_key_ids, &rki);
1164: if (erki != NULL) {
1.52 djm 1165: KRL_DBG(("revoked by key ID"));
1.31 djm 1166: return SSH_ERR_KEY_REVOKED;
1167: }
1168:
1169: /*
1.33 djm 1170: * Zero serials numbers are ignored (it's the default when the
1171: * CA doesn't specify one).
1.31 djm 1172: */
1.33 djm 1173: if (key->cert->serial == 0)
1.31 djm 1174: return 0;
1175:
1176: memset(&rs, 0, sizeof(rs));
1177: rs.lo = rs.hi = key->cert->serial;
1178: ers = RB_FIND(revoked_serial_tree, &rc->revoked_serials, &rs);
1179: if (ers != NULL) {
1.52 djm 1180: KRL_DBG(("revoked serial %llu matched %llu:%llu",
1.31 djm 1181: key->cert->serial, ers->lo, ers->hi));
1182: return SSH_ERR_KEY_REVOKED;
1183: }
1184: return 0;
1185: }
1186:
1.1 djm 1187: /* Checks whether a given key/cert is revoked. Does not check its CA */
1188: static int
1.20 djm 1189: is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
1.1 djm 1190: {
1191: struct revoked_blob rb, *erb;
1192: struct revoked_certs *rc;
1.20 djm 1193: int r;
1.1 djm 1194:
1195: /* Check explicitly revoked hashes first */
1.14 tedu 1196: memset(&rb, 0, sizeof(rb));
1.21 djm 1197: if ((r = sshkey_fingerprint_raw(key, SSH_DIGEST_SHA1,
1.20 djm 1198: &rb.blob, &rb.len)) != 0)
1199: return r;
1.1 djm 1200: erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
1201: free(rb.blob);
1202: if (erb != NULL) {
1.52 djm 1203: KRL_DBG(("revoked by key SHA1"));
1.42 djm 1204: return SSH_ERR_KEY_REVOKED;
1205: }
1206: memset(&rb, 0, sizeof(rb));
1207: if ((r = sshkey_fingerprint_raw(key, SSH_DIGEST_SHA256,
1208: &rb.blob, &rb.len)) != 0)
1209: return r;
1210: erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha256s, &rb);
1211: free(rb.blob);
1212: if (erb != NULL) {
1.52 djm 1213: KRL_DBG(("revoked by key SHA256"));
1.20 djm 1214: return SSH_ERR_KEY_REVOKED;
1.1 djm 1215: }
1216:
1217: /* Next, explicit keys */
1.14 tedu 1218: memset(&rb, 0, sizeof(rb));
1.20 djm 1219: if ((r = plain_key_blob(key, &rb.blob, &rb.len)) != 0)
1220: return r;
1.1 djm 1221: erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb);
1222: free(rb.blob);
1223: if (erb != NULL) {
1.52 djm 1224: KRL_DBG(("revoked by explicit key"));
1.20 djm 1225: return SSH_ERR_KEY_REVOKED;
1.1 djm 1226: }
1227:
1.20 djm 1228: if (!sshkey_is_cert(key))
1.1 djm 1229: return 0;
1230:
1.31 djm 1231: /* Check cert revocation for the specified CA */
1.20 djm 1232: if ((r = revoked_certs_for_ca_key(krl, key->cert->signature_key,
1233: &rc, 0)) != 0)
1234: return r;
1.31 djm 1235: if (rc != NULL) {
1236: if ((r = is_cert_revoked(key, rc)) != 0)
1237: return r;
1238: }
1239: /* Check cert revocation for the wildcard CA */
1240: if ((r = revoked_certs_for_ca_key(krl, NULL, &rc, 0)) != 0)
1241: return r;
1242: if (rc != NULL) {
1243: if ((r = is_cert_revoked(key, rc)) != 0)
1244: return r;
1.1 djm 1245: }
1246:
1.52 djm 1247: KRL_DBG(("%llu no match", key->cert->serial));
1.1 djm 1248: return 0;
1249: }
1250:
1251: int
1.20 djm 1252: ssh_krl_check_key(struct ssh_krl *krl, const struct sshkey *key)
1.1 djm 1253: {
1254: int r;
1255:
1.52 djm 1256: KRL_DBG(("checking key"));
1.1 djm 1257: if ((r = is_key_revoked(krl, key)) != 0)
1258: return r;
1.20 djm 1259: if (sshkey_is_cert(key)) {
1.52 djm 1260: debug2_f("checking CA key");
1.1 djm 1261: if ((r = is_key_revoked(krl, key->cert->signature_key)) != 0)
1262: return r;
1263: }
1.52 djm 1264: KRL_DBG(("key okay"));
1.1 djm 1265: return 0;
1266: }
1267:
1268: int
1.20 djm 1269: ssh_krl_file_contains_key(const char *path, const struct sshkey *key)
1.1 djm 1270: {
1.20 djm 1271: struct sshbuf *krlbuf = NULL;
1272: struct ssh_krl *krl = NULL;
1.47 djm 1273: int oerrno = 0, r;
1.1 djm 1274:
1275: if (path == NULL)
1276: return 0;
1.47 djm 1277: if ((r = sshbuf_load_file(path, &krlbuf)) != 0) {
1.20 djm 1278: oerrno = errno;
1279: goto out;
1.1 djm 1280: }
1.57 djm 1281: if ((r = ssh_krl_from_blob(krlbuf, &krl)) != 0)
1.20 djm 1282: goto out;
1.52 djm 1283: debug2_f("checking KRL %s", path);
1.20 djm 1284: r = ssh_krl_check_key(krl, key);
1285: out:
1286: sshbuf_free(krlbuf);
1.1 djm 1287: ssh_krl_free(krl);
1.20 djm 1288: if (r != 0)
1289: errno = oerrno;
1290: return r;
1.48 djm 1291: }
1292:
1293: int
1294: krl_dump(struct ssh_krl *krl, FILE *f)
1295: {
1296: struct sshkey *key = NULL;
1297: struct revoked_blob *rb;
1298: struct revoked_certs *rc;
1299: struct revoked_serial *rs;
1300: struct revoked_key_id *rki;
1301: int r, ret = 0;
1302: char *fp, timestamp[64];
1303:
1304: /* Try to print in a KRL spec-compatible format */
1305: format_timestamp(krl->generated_date, timestamp, sizeof(timestamp));
1.50 djm 1306: fprintf(f, "# KRL version %llu\n",
1307: (unsigned long long)krl->krl_version);
1.48 djm 1308: fprintf(f, "# Generated at %s\n", timestamp);
1309: if (krl->comment != NULL && *krl->comment != '\0') {
1310: r = INT_MAX;
1311: asmprintf(&fp, INT_MAX, &r, "%s", krl->comment);
1312: fprintf(f, "# Comment: %s\n", fp);
1313: free(fp);
1314: }
1315: fputc('\n', f);
1316:
1317: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_keys) {
1318: if ((r = sshkey_from_blob(rb->blob, rb->len, &key)) != 0) {
1319: ret = SSH_ERR_INVALID_FORMAT;
1.52 djm 1320: error_r(r, "parse KRL key");
1.48 djm 1321: continue;
1322: }
1323: if ((fp = sshkey_fingerprint(key, SSH_FP_HASH_DEFAULT,
1324: SSH_FP_DEFAULT)) == NULL) {
1325: ret = SSH_ERR_INVALID_FORMAT;
1326: error("sshkey_fingerprint failed");
1327: continue;
1328: }
1.54 djm 1329: fprintf(f, "hash: %s # %s\n", fp, sshkey_ssh_name(key));
1.48 djm 1330: free(fp);
1331: free(key);
1332: }
1333: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha256s) {
1334: fp = tohex(rb->blob, rb->len);
1335: fprintf(f, "hash: SHA256:%s\n", fp);
1336: free(fp);
1337: }
1338: RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha1s) {
1339: /*
1340: * There is not KRL spec keyword for raw SHA1 hashes, so
1341: * print them as comments.
1342: */
1343: fp = tohex(rb->blob, rb->len);
1344: fprintf(f, "# hash SHA1:%s\n", fp);
1345: free(fp);
1346: }
1347:
1348: TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
1349: fputc('\n', f);
1350: if (rc->ca_key == NULL)
1351: fprintf(f, "# Wildcard CA\n");
1352: else {
1353: if ((fp = sshkey_fingerprint(rc->ca_key,
1354: SSH_FP_HASH_DEFAULT, SSH_FP_DEFAULT)) == NULL) {
1355: ret = SSH_ERR_INVALID_FORMAT;
1356: error("sshkey_fingerprint failed");
1357: continue;
1358: }
1359: fprintf(f, "# CA key %s %s\n",
1360: sshkey_ssh_name(rc->ca_key), fp);
1361: free(fp);
1362: }
1363: RB_FOREACH(rs, revoked_serial_tree, &rc->revoked_serials) {
1.50 djm 1364: if (rs->lo == rs->hi) {
1365: fprintf(f, "serial: %llu\n",
1366: (unsigned long long)rs->lo);
1367: } else {
1.49 djm 1368: fprintf(f, "serial: %llu-%llu\n",
1.50 djm 1369: (unsigned long long)rs->lo,
1370: (unsigned long long)rs->hi);
1.48 djm 1371: }
1372: }
1373: RB_FOREACH(rki, revoked_key_id_tree, &rc->revoked_key_ids) {
1374: /*
1375: * We don't want key IDs with embedded newlines to
1376: * mess up the display.
1377: */
1378: r = INT_MAX;
1379: asmprintf(&fp, INT_MAX, &r, "%s", rki->key_id);
1380: fprintf(f, "id: %s\n", fp);
1381: free(fp);
1382: }
1383: }
1384: return ret;
1.1 djm 1385: }
![[BACK]](/icons/back.gif){kind=icon}
Return to krl.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh