Annotation of src/usr.bin/ssh/ssh-sk-helper.c, Revision 1.6
1.6 ! djm 1: /* $OpenBSD: ssh-sk-helper.c,v 1.5 2019/12/30 09:21:59 djm Exp $ */
1.1 djm 2: /*
3: * Copyright (c) 2019 Google LLC
4: *
5: * Permission to use, copy, modify, and distribute this software for any
6: * purpose with or without fee is hereby granted, provided that the above
7: * copyright notice and this permission notice appear in all copies.
8: *
9: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16: */
17:
18: /*
19: * This is a tiny program used to isolate the address space used for
20: * security key middleware signing operations from ssh-agent. It is similar
1.4 djm 21: * to ssh-pkcs11-helper.c but considerably simpler as the operations for
22: * security keys are stateless.
1.1 djm 23: *
1.4 djm 24: * Please crank SSH_SK_HELPER_VERSION in sshkey.h for any incompatible
25: * protocol changes.
1.1 djm 26: */
27:
1.4 djm 28: #include <limits.h>
1.1 djm 29: #include <stdarg.h>
30: #include <stdio.h>
31: #include <stdlib.h>
32: #include <string.h>
33: #include <unistd.h>
34: #include <errno.h>
35:
36: #include "xmalloc.h"
37: #include "log.h"
38: #include "sshkey.h"
39: #include "authfd.h"
40: #include "misc.h"
41: #include "sshbuf.h"
42: #include "msg.h"
43: #include "uidswap.h"
44: #include "sshkey.h"
45: #include "ssherr.h"
46: #include "ssh-sk.h"
47:
48: extern char *__progname;
49:
1.6 ! djm 50: static struct sshbuf *reply_error(int r, char *fmt, ...)
! 51: __attribute__((__format__ (printf, 2, 3)));
! 52:
! 53: static struct sshbuf *
! 54: reply_error(int r, char *fmt, ...)
! 55: {
! 56: char *msg;
! 57: va_list ap;
! 58: struct sshbuf *resp;
! 59:
! 60: va_start(ap, fmt);
! 61: xvasprintf(&msg, fmt, ap);
! 62: va_end(ap);
! 63: error("%s: %s", __progname, msg);
! 64: free(msg);
! 65:
! 66: if (r >= 0)
! 67: fatal("%s: invalid error code %d", __func__, r);
! 68:
! 69: if ((resp = sshbuf_new()) == NULL)
! 70: fatal("%s: sshbuf_new failed", __progname);
! 71: if (sshbuf_put_u32(resp, SSH_SK_HELPER_ERROR) != 0 ||
! 72: sshbuf_put_u32(resp, (u_int)-r) != 0)
! 73: fatal("%s: buffer error", __progname);
! 74: return resp;
! 75: }
! 76:
1.4 djm 77: static struct sshbuf *
78: process_sign(struct sshbuf *req)
1.1 djm 79: {
1.4 djm 80: int r = SSH_ERR_INTERNAL_ERROR;
81: struct sshbuf *resp, *kbuf;
1.1 djm 82: struct sshkey *key;
83: uint32_t compat;
84: const u_char *message;
1.4 djm 85: u_char *sig;
1.1 djm 86: size_t msglen, siglen;
1.6 ! djm 87: char *provider, *pin;
1.4 djm 88:
89: if ((r = sshbuf_froms(req, &kbuf)) != 0 ||
90: (r = sshbuf_get_cstring(req, &provider, NULL)) != 0 ||
91: (r = sshbuf_get_string_direct(req, &message, &msglen)) != 0 ||
92: (r = sshbuf_get_cstring(req, NULL, NULL)) != 0 || /* alg */
1.6 ! djm 93: (r = sshbuf_get_u32(req, &compat)) != 0 ||
! 94: (r = sshbuf_get_cstring(req, &pin, NULL)) != 0)
1.4 djm 95: fatal("%s: buffer error: %s", __progname, ssh_err(r));
96: if (sshbuf_len(req) != 0)
97: fatal("%s: trailing data in request", __progname);
98:
99: if ((r = sshkey_private_deserialize(kbuf, &key)) != 0)
100: fatal("Unable to parse private key: %s", ssh_err(r));
101: if (!sshkey_is_sk(key))
102: fatal("Unsupported key type %s", sshkey_ssh_name(key));
103:
104: debug("%s: ready to sign with key %s, provider %s: "
105: "msg len %zu, compat 0x%lx", __progname, sshkey_type(key),
106: provider, msglen, (u_long)compat);
107:
1.6 ! djm 108: if (*pin == 0) {
! 109: free(pin);
! 110: pin = NULL;
! 111: }
! 112:
1.4 djm 113: if ((r = sshsk_sign(provider, key, &sig, &siglen,
1.6 ! djm 114: message, msglen, compat, pin)) != 0) {
! 115: resp = reply_error(r, "Signing failed: %s", ssh_err(r));
! 116: goto out;
! 117: }
1.4 djm 118:
119: if ((resp = sshbuf_new()) == NULL)
120: fatal("%s: sshbuf_new failed", __progname);
121:
1.6 ! djm 122: if ((r = sshbuf_put_u32(resp, SSH_SK_HELPER_SIGN)) != 0 ||
! 123: (r = sshbuf_put_string(resp, sig, siglen)) != 0)
1.4 djm 124: fatal("%s: buffer error: %s", __progname, ssh_err(r));
1.6 ! djm 125: out:
1.4 djm 126: sshbuf_free(kbuf);
127: free(provider);
1.6 ! djm 128: if (pin != NULL)
! 129: freezero(pin, strlen(pin));
1.4 djm 130: return resp;
131: }
132:
133: static struct sshbuf *
134: process_enroll(struct sshbuf *req)
135: {
136: int r;
137: u_int type;
1.6 ! djm 138: char *provider, *application, *pin;
1.4 djm 139: uint8_t flags;
140: struct sshbuf *challenge, *attest, *kbuf, *resp;
141: struct sshkey *key;
142:
1.6 ! djm 143: if ((attest = sshbuf_new()) == NULL ||
1.4 djm 144: (kbuf = sshbuf_new()) == NULL)
145: fatal("%s: sshbuf_new failed", __progname);
146:
147: if ((r = sshbuf_get_u32(req, &type)) != 0 ||
148: (r = sshbuf_get_cstring(req, &provider, NULL)) != 0 ||
149: (r = sshbuf_get_cstring(req, &application, NULL)) != 0 ||
150: (r = sshbuf_get_u8(req, &flags)) != 0 ||
1.6 ! djm 151: (r = sshbuf_get_cstring(req, &pin, NULL)) != 0 ||
1.4 djm 152: (r = sshbuf_froms(req, &challenge)) != 0)
153: fatal("%s: buffer error: %s", __progname, ssh_err(r));
154: if (sshbuf_len(req) != 0)
155: fatal("%s: trailing data in request", __progname);
156:
157: if (type > INT_MAX)
158: fatal("%s: bad type %u", __progname, type);
159: if (sshbuf_len(challenge) == 0) {
160: sshbuf_free(challenge);
161: challenge = NULL;
162: }
1.6 ! djm 163: if (*pin == 0) {
! 164: free(pin);
! 165: pin = NULL;
! 166: }
1.4 djm 167:
1.6 ! djm 168: if ((r = sshsk_enroll((int)type, provider, application, flags, pin,
! 169: challenge, &key, attest)) != 0) {
! 170: resp = reply_error(r, "Enrollment failed: %s", ssh_err(r));
! 171: goto out;
! 172: }
1.4 djm 173:
1.6 ! djm 174: if ((resp = sshbuf_new()) == NULL)
! 175: fatal("%s: sshbuf_new failed", __progname);
1.4 djm 176: if ((r = sshkey_private_serialize(key, kbuf)) != 0)
177: fatal("%s: serialize private key: %s", __progname, ssh_err(r));
1.6 ! djm 178: if ((r = sshbuf_put_u32(resp, SSH_SK_HELPER_ENROLL)) != 0 ||
! 179: (r = sshbuf_put_stringb(resp, kbuf)) != 0 ||
1.4 djm 180: (r = sshbuf_put_stringb(resp, attest)) != 0)
181: fatal("%s: buffer error: %s", __progname, ssh_err(r));
182:
1.6 ! djm 183: out:
1.4 djm 184: sshkey_free(key);
185: sshbuf_free(kbuf);
186: sshbuf_free(attest);
187: sshbuf_free(challenge);
188: free(provider);
189: free(application);
1.6 ! djm 190: if (pin != NULL)
! 191: freezero(pin, strlen(pin));
1.4 djm 192:
193: return resp;
194: }
195:
1.5 djm 196: static struct sshbuf *
197: process_load_resident(struct sshbuf *req)
198: {
199: int r;
200: char *provider, *pin;
201: struct sshbuf *kbuf, *resp;
202: struct sshkey **keys = NULL;
203: size_t nkeys = 0, i;
204:
1.6 ! djm 205: if ((kbuf = sshbuf_new()) == NULL)
1.5 djm 206: fatal("%s: sshbuf_new failed", __progname);
207:
208: if ((r = sshbuf_get_cstring(req, &provider, NULL)) != 0 ||
209: (r = sshbuf_get_cstring(req, &pin, NULL)) != 0)
210: fatal("%s: buffer error: %s", __progname, ssh_err(r));
211: if (sshbuf_len(req) != 0)
212: fatal("%s: trailing data in request", __progname);
213:
1.6 ! djm 214: if (*pin == 0) {
! 215: free(pin);
! 216: pin = NULL;
! 217: }
! 218:
! 219: if ((r = sshsk_load_resident(provider, pin, &keys, &nkeys)) != 0) {
! 220: resp = reply_error(r, " sshsk_load_resident failed: %s",
! 221: ssh_err(r));
! 222: goto out;
! 223: }
! 224:
! 225: if ((resp = sshbuf_new()) == NULL)
! 226: fatal("%s: sshbuf_new failed", __progname);
! 227:
! 228: if ((r = sshbuf_put_u32(resp, SSH_SK_HELPER_LOAD_RESIDENT)) != 0)
! 229: fatal("%s: buffer error: %s", __progname, ssh_err(r));
1.5 djm 230:
231: for (i = 0; i < nkeys; i++) {
232: debug("%s: key %zu %s %s", __func__, i,
233: sshkey_type(keys[i]), keys[i]->sk_application);
234: sshbuf_reset(kbuf);
235: if ((r = sshkey_private_serialize(keys[i], kbuf)) != 0)
236: fatal("%s: serialize private key: %s",
237: __progname, ssh_err(r));
238: if ((r = sshbuf_put_stringb(resp, kbuf)) != 0 ||
239: (r = sshbuf_put_cstring(resp, "")) != 0) /* comment */
240: fatal("%s: buffer error: %s", __progname, ssh_err(r));
241: }
242:
1.6 ! djm 243: out:
1.5 djm 244: for (i = 0; i < nkeys; i++)
245: sshkey_free(keys[i]);
246: free(keys);
247: sshbuf_free(kbuf);
248: free(provider);
1.6 ! djm 249: if (pin != NULL)
! 250: freezero(pin, strlen(pin));
1.5 djm 251: return resp;
252: }
253:
1.4 djm 254: int
255: main(int argc, char **argv)
256: {
257: SyslogFacility log_facility = SYSLOG_FACILITY_AUTH;
258: LogLevel log_level = SYSLOG_LEVEL_ERROR;
259: struct sshbuf *req, *resp;
1.1 djm 260: int in, out, ch, r, log_stderr = 0;
1.4 djm 261: u_int rtype;
262: uint8_t version;
1.1 djm 263:
264: sanitise_stdfd();
265: log_init(__progname, log_level, log_facility, log_stderr);
266:
267: while ((ch = getopt(argc, argv, "v")) != -1) {
268: switch (ch) {
269: case 'v':
270: log_stderr = 1;
271: if (log_level == SYSLOG_LEVEL_ERROR)
272: log_level = SYSLOG_LEVEL_DEBUG1;
273: else if (log_level < SYSLOG_LEVEL_DEBUG3)
274: log_level++;
275: break;
276: default:
277: fprintf(stderr, "usage: %s [-v]\n", __progname);
278: exit(1);
279: }
280: }
281: log_init(__progname, log_level, log_facility, log_stderr);
282:
283: /*
284: * Rearrange our file descriptors a little; we don't trust the
285: * providers not to fiddle with stdin/out.
286: */
287: closefrom(STDERR_FILENO + 1);
288: if ((in = dup(STDIN_FILENO)) == -1 || (out = dup(STDOUT_FILENO)) == -1)
289: fatal("%s: dup: %s", __progname, strerror(errno));
290: close(STDIN_FILENO);
291: close(STDOUT_FILENO);
292: sanitise_stdfd(); /* resets to /dev/null */
293:
1.4 djm 294: if ((req = sshbuf_new()) == NULL)
1.1 djm 295: fatal("%s: sshbuf_new failed", __progname);
296: if (ssh_msg_recv(in, req) < 0)
297: fatal("ssh_msg_recv failed");
298: close(in);
299: debug("%s: received message len %zu", __progname, sshbuf_len(req));
300:
301: if ((r = sshbuf_get_u8(req, &version)) != 0)
302: fatal("%s: buffer error: %s", __progname, ssh_err(r));
303: if (version != SSH_SK_HELPER_VERSION) {
304: fatal("unsupported version: received %d, expected %d",
305: version, SSH_SK_HELPER_VERSION);
306: }
307:
1.4 djm 308: if ((r = sshbuf_get_u32(req, &rtype)) != 0)
1.1 djm 309: fatal("%s: buffer error: %s", __progname, ssh_err(r));
310:
1.4 djm 311: switch (rtype) {
312: case SSH_SK_HELPER_SIGN:
313: resp = process_sign(req);
314: break;
315: case SSH_SK_HELPER_ENROLL:
316: resp = process_enroll(req);
1.5 djm 317: break;
318: case SSH_SK_HELPER_LOAD_RESIDENT:
319: resp = process_load_resident(req);
1.4 djm 320: break;
321: default:
322: fatal("%s: unsupported request type %u", __progname, rtype);
323: }
324: sshbuf_free(req);
325: debug("%s: reply len %zu", __progname, sshbuf_len(resp));
1.1 djm 326:
327: if (ssh_msg_send(out, SSH_SK_HELPER_VERSION, resp) == -1)
328: fatal("ssh_msg_send failed");
1.4 djm 329: sshbuf_free(resp);
1.1 djm 330: close(out);
331:
332: return (0);
333: }
![[BACK]](/icons/back.gif){kind=icon}
Return to ssh-sk-helper.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh