1 /* $OpenBSD: krl.c,v 1.60 2025/02/18 08:02:48 djm Exp $ */
2 /*
3 * Copyright (c) 2012 Damien Miller <djm@mindrot.org>
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18 #include "includes.h"
19
20 #include <sys/types.h>
21 #include <openbsd-compat/sys-tree.h>
22 #include <openbsd-compat/sys-queue.h>
23
24 #include <errno.h>
25 #include <fcntl.h>
26 #include <limits.h>
27 #include <stdlib.h>
28 #include <string.h>
29 #include <time.h>
30 #include <unistd.h>
31
32 #include "sshbuf.h"
33 #include "ssherr.h"
34 #include "sshkey.h"
35 #include "authfile.h"
36 #include "misc.h"
37 #include "log.h"
38 #include "digest.h"
39 #include "bitmap.h"
40 #include "utf8.h"
41
42 #include "krl.h"
43
44 /* #define DEBUG_KRL */
45 #ifdef DEBUG_KRL
46 # define KRL_DBG(x) debug3_f x
47 #else
48 # define KRL_DBG(x)
49 #endif
50
51 /*
52 * Trees of revoked serial numbers, key IDs and keys. This allows
53 * quick searching, querying and producing lists in canonical order.
54 */
55
56 /* Tree of serial numbers. XXX make smarter: really need a real sparse bitmap */
57 struct revoked_serial {
58 u_int64_t lo, hi;
59 RB_ENTRY(revoked_serial) tree_entry;
60 };
61 static int serial_cmp(struct revoked_serial *a, struct revoked_serial *b);
62 RB_HEAD(revoked_serial_tree, revoked_serial);
63 RB_GENERATE_STATIC(revoked_serial_tree, revoked_serial, tree_entry, serial_cmp)
64
65 /* Tree of key IDs */
66 struct revoked_key_id {
67 char *key_id;
68 RB_ENTRY(revoked_key_id) tree_entry;
69 };
70 static int key_id_cmp(struct revoked_key_id *a, struct revoked_key_id *b);
71 RB_HEAD(revoked_key_id_tree, revoked_key_id);
72 RB_GENERATE_STATIC(revoked_key_id_tree, revoked_key_id, tree_entry, key_id_cmp)
73
74 /* Tree of blobs (used for keys and fingerprints) */
75 struct revoked_blob {
76 u_char *blob;
77 size_t len;
78 RB_ENTRY(revoked_blob) tree_entry;
79 };
80 static int blob_cmp(struct revoked_blob *a, struct revoked_blob *b);
81 RB_HEAD(revoked_blob_tree, revoked_blob);
82 RB_GENERATE_STATIC(revoked_blob_tree, revoked_blob, tree_entry, blob_cmp)
83
84 /* Tracks revoked certs for a single CA */
85 struct revoked_certs {
86 struct sshkey *ca_key;
87 struct revoked_serial_tree revoked_serials;
88 struct revoked_key_id_tree revoked_key_ids;
89 TAILQ_ENTRY(revoked_certs) entry;
90 };
91 TAILQ_HEAD(revoked_certs_list, revoked_certs);
92
93 struct ssh_krl {
94 u_int64_t krl_version;
95 u_int64_t generated_date;
96 u_int64_t flags;
97 char *comment;
98 struct revoked_blob_tree revoked_keys;
99 struct revoked_blob_tree revoked_sha1s;
100 struct revoked_blob_tree revoked_sha256s;
101 struct revoked_certs_list revoked_certs;
102 };
103
104 /* Return equal if a and b overlap */
105 static int
serial_cmp(struct revoked_serial * a,struct revoked_serial * b)106 serial_cmp(struct revoked_serial *a, struct revoked_serial *b)
107 {
108 if (a->hi >= b->lo && a->lo <= b->hi)
109 return 0;
110 return a->lo < b->lo ? -1 : 1;
111 }
112
113 static int
key_id_cmp(struct revoked_key_id * a,struct revoked_key_id * b)114 key_id_cmp(struct revoked_key_id *a, struct revoked_key_id *b)
115 {
116 return strcmp(a->key_id, b->key_id);
117 }
118
119 static int
blob_cmp(struct revoked_blob * a,struct revoked_blob * b)120 blob_cmp(struct revoked_blob *a, struct revoked_blob *b)
121 {
122 int r;
123
124 if (a->len != b->len) {
125 if ((r = memcmp(a->blob, b->blob, MINIMUM(a->len, b->len))) != 0)
126 return r;
127 return a->len > b->len ? 1 : -1;
128 } else
129 return memcmp(a->blob, b->blob, a->len);
130 }
131
132 struct ssh_krl *
ssh_krl_init(void)133 ssh_krl_init(void)
134 {
135 struct ssh_krl *krl;
136
137 if ((krl = calloc(1, sizeof(*krl))) == NULL)
138 return NULL;
139 RB_INIT(&krl->revoked_keys);
140 RB_INIT(&krl->revoked_sha1s);
141 RB_INIT(&krl->revoked_sha256s);
142 TAILQ_INIT(&krl->revoked_certs);
143 return krl;
144 }
145
146 static void
revoked_certs_free(struct revoked_certs * rc)147 revoked_certs_free(struct revoked_certs *rc)
148 {
149 struct revoked_serial *rs, *trs;
150 struct revoked_key_id *rki, *trki;
151
152 RB_FOREACH_SAFE(rs, revoked_serial_tree, &rc->revoked_serials, trs) {
153 RB_REMOVE(revoked_serial_tree, &rc->revoked_serials, rs);
154 free(rs);
155 }
156 RB_FOREACH_SAFE(rki, revoked_key_id_tree, &rc->revoked_key_ids, trki) {
157 RB_REMOVE(revoked_key_id_tree, &rc->revoked_key_ids, rki);
158 free(rki->key_id);
159 free(rki);
160 }
161 sshkey_free(rc->ca_key);
162 }
163
164 void
ssh_krl_free(struct ssh_krl * krl)165 ssh_krl_free(struct ssh_krl *krl)
166 {
167 struct revoked_blob *rb, *trb;
168 struct revoked_certs *rc, *trc;
169
170 if (krl == NULL)
171 return;
172
173 free(krl->comment);
174 RB_FOREACH_SAFE(rb, revoked_blob_tree, &krl->revoked_keys, trb) {
175 RB_REMOVE(revoked_blob_tree, &krl->revoked_keys, rb);
176 free(rb->blob);
177 free(rb);
178 }
179 RB_FOREACH_SAFE(rb, revoked_blob_tree, &krl->revoked_sha1s, trb) {
180 RB_REMOVE(revoked_blob_tree, &krl->revoked_sha1s, rb);
181 free(rb->blob);
182 free(rb);
183 }
184 RB_FOREACH_SAFE(rb, revoked_blob_tree, &krl->revoked_sha256s, trb) {
185 RB_REMOVE(revoked_blob_tree, &krl->revoked_sha256s, rb);
186 free(rb->blob);
187 free(rb);
188 }
189 TAILQ_FOREACH_SAFE(rc, &krl->revoked_certs, entry, trc) {
190 TAILQ_REMOVE(&krl->revoked_certs, rc, entry);
191 revoked_certs_free(rc);
192 }
193 free(krl);
194 }
195
196 void
ssh_krl_set_version(struct ssh_krl * krl,u_int64_t version)197 ssh_krl_set_version(struct ssh_krl *krl, u_int64_t version)
198 {
199 krl->krl_version = version;
200 }
201
202 int
ssh_krl_set_comment(struct ssh_krl * krl,const char * comment)203 ssh_krl_set_comment(struct ssh_krl *krl, const char *comment)
204 {
205 free(krl->comment);
206 if ((krl->comment = strdup(comment)) == NULL)
207 return SSH_ERR_ALLOC_FAIL;
208 return 0;
209 }
210
211 /*
212 * Find the revoked_certs struct for a CA key. If allow_create is set then
213 * create a new one in the tree if one did not exist already.
214 */
215 static int
revoked_certs_for_ca_key(struct ssh_krl * krl,const struct sshkey * ca_key,struct revoked_certs ** rcp,int allow_create)216 revoked_certs_for_ca_key(struct ssh_krl *krl, const struct sshkey *ca_key,
217 struct revoked_certs **rcp, int allow_create)
218 {
219 struct revoked_certs *rc;
220 int r;
221
222 *rcp = NULL;
223 TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
224 if ((ca_key == NULL && rc->ca_key == NULL) ||
225 sshkey_equal(rc->ca_key, ca_key)) {
226 *rcp = rc;
227 return 0;
228 }
229 }
230 if (!allow_create)
231 return 0;
232 /* If this CA doesn't exist in the list then add it now */
233 if ((rc = calloc(1, sizeof(*rc))) == NULL)
234 return SSH_ERR_ALLOC_FAIL;
235 if (ca_key == NULL)
236 rc->ca_key = NULL;
237 else if ((r = sshkey_from_private(ca_key, &rc->ca_key)) != 0) {
238 free(rc);
239 return r;
240 }
241 RB_INIT(&rc->revoked_serials);
242 RB_INIT(&rc->revoked_key_ids);
243 TAILQ_INSERT_TAIL(&krl->revoked_certs, rc, entry);
244 KRL_DBG(("new CA %s", ca_key == NULL ? "*" : sshkey_type(ca_key)));
245 *rcp = rc;
246 return 0;
247 }
248
249 static int
insert_serial_range(struct revoked_serial_tree * rt,u_int64_t lo,u_int64_t hi)250 insert_serial_range(struct revoked_serial_tree *rt, u_int64_t lo, u_int64_t hi)
251 {
252 struct revoked_serial rs, *ers, *crs, *irs;
253
254 KRL_DBG(("insert %llu:%llu", lo, hi));
255 memset(&rs, 0, sizeof(rs));
256 rs.lo = lo;
257 rs.hi = hi;
258 ers = RB_NFIND(revoked_serial_tree, rt, &rs);
259 if (ers == NULL || serial_cmp(ers, &rs) != 0) {
260 /* No entry matches. Just insert */
261 if ((irs = malloc(sizeof(rs))) == NULL)
262 return SSH_ERR_ALLOC_FAIL;
263 memcpy(irs, &rs, sizeof(*irs));
264 ers = RB_INSERT(revoked_serial_tree, rt, irs);
265 if (ers != NULL) {
266 KRL_DBG(("bad: ers != NULL"));
267 /* Shouldn't happen */
268 free(irs);
269 return SSH_ERR_INTERNAL_ERROR;
270 }
271 ers = irs;
272 } else {
273 KRL_DBG(("overlap found %llu:%llu", ers->lo, ers->hi));
274 /*
275 * The inserted entry overlaps an existing one. Grow the
276 * existing entry.
277 */
278 if (ers->lo > lo)
279 ers->lo = lo;
280 if (ers->hi < hi)
281 ers->hi = hi;
282 }
283
284 /*
285 * The inserted or revised range might overlap or abut adjacent ones;
286 * coalesce as necessary.
287 */
288
289 /* Check predecessors */
290 while ((crs = RB_PREV(revoked_serial_tree, rt, ers)) != NULL) {
291 KRL_DBG(("pred %llu:%llu", crs->lo, crs->hi));
292 if (ers->lo != 0 && crs->hi < ers->lo - 1)
293 break;
294 /* This entry overlaps. */
295 if (crs->lo < ers->lo) {
296 ers->lo = crs->lo;
297 KRL_DBG(("pred extend %llu:%llu", ers->lo, ers->hi));
298 }
299 RB_REMOVE(revoked_serial_tree, rt, crs);
300 free(crs);
301 }
302 /* Check successors */
303 while ((crs = RB_NEXT(revoked_serial_tree, rt, ers)) != NULL) {
304 KRL_DBG(("succ %llu:%llu", crs->lo, crs->hi));
305 if (ers->hi != (u_int64_t)-1 && crs->lo > ers->hi + 1)
306 break;
307 /* This entry overlaps. */
308 if (crs->hi > ers->hi) {
309 ers->hi = crs->hi;
310 KRL_DBG(("succ extend %llu:%llu", ers->lo, ers->hi));
311 }
312 RB_REMOVE(revoked_serial_tree, rt, crs);
313 free(crs);
314 }
315 KRL_DBG(("done, final %llu:%llu", ers->lo, ers->hi));
316 return 0;
317 }
318
319 int
ssh_krl_revoke_cert_by_serial(struct ssh_krl * krl,const struct sshkey * ca_key,u_int64_t serial)320 ssh_krl_revoke_cert_by_serial(struct ssh_krl *krl, const struct sshkey *ca_key,
321 u_int64_t serial)
322 {
323 return ssh_krl_revoke_cert_by_serial_range(krl, ca_key, serial, serial);
324 }
325
326 int
ssh_krl_revoke_cert_by_serial_range(struct ssh_krl * krl,const struct sshkey * ca_key,u_int64_t lo,u_int64_t hi)327 ssh_krl_revoke_cert_by_serial_range(struct ssh_krl *krl,
328 const struct sshkey *ca_key, u_int64_t lo, u_int64_t hi)
329 {
330 struct revoked_certs *rc;
331 int r;
332
333 if (lo > hi || lo == 0)
334 return SSH_ERR_INVALID_ARGUMENT;
335 if ((r = revoked_certs_for_ca_key(krl, ca_key, &rc, 1)) != 0)
336 return r;
337 return insert_serial_range(&rc->revoked_serials, lo, hi);
338 }
339
340 int
ssh_krl_revoke_cert_by_key_id(struct ssh_krl * krl,const struct sshkey * ca_key,const char * key_id)341 ssh_krl_revoke_cert_by_key_id(struct ssh_krl *krl, const struct sshkey *ca_key,
342 const char *key_id)
343 {
344 struct revoked_key_id *rki, *erki;
345 struct revoked_certs *rc;
346 int r;
347
348 if ((r = revoked_certs_for_ca_key(krl, ca_key, &rc, 1)) != 0)
349 return r;
350
351 KRL_DBG(("revoke %s", key_id));
352 if ((rki = calloc(1, sizeof(*rki))) == NULL ||
353 (rki->key_id = strdup(key_id)) == NULL) {
354 free(rki);
355 return SSH_ERR_ALLOC_FAIL;
356 }
357 erki = RB_INSERT(revoked_key_id_tree, &rc->revoked_key_ids, rki);
358 if (erki != NULL) {
359 free(rki->key_id);
360 free(rki);
361 }
362 return 0;
363 }
364
365 /* Convert "key" to a public key blob without any certificate information */
366 static int
plain_key_blob(const struct sshkey * key,u_char ** blob,size_t * blen)367 plain_key_blob(const struct sshkey *key, u_char **blob, size_t *blen)
368 {
369 struct sshkey *kcopy;
370 int r;
371
372 if ((r = sshkey_from_private(key, &kcopy)) != 0)
373 return r;
374 if (sshkey_is_cert(kcopy)) {
375 if ((r = sshkey_drop_cert(kcopy)) != 0) {
376 sshkey_free(kcopy);
377 return r;
378 }
379 }
380 r = sshkey_to_blob(kcopy, blob, blen);
381 sshkey_free(kcopy);
382 return r;
383 }
384
385 /* Revoke a key blob. Ownership of blob is transferred to the tree */
386 static int
revoke_blob(struct revoked_blob_tree * rbt,u_char * blob,size_t len)387 revoke_blob(struct revoked_blob_tree *rbt, u_char *blob, size_t len)
388 {
389 struct revoked_blob *rb, *erb;
390
391 if ((rb = calloc(1, sizeof(*rb))) == NULL)
392 return SSH_ERR_ALLOC_FAIL;
393 rb->blob = blob;
394 rb->len = len;
395 erb = RB_INSERT(revoked_blob_tree, rbt, rb);
396 if (erb != NULL) {
397 free(rb->blob);
398 free(rb);
399 }
400 return 0;
401 }
402
403 int
ssh_krl_revoke_key_explicit(struct ssh_krl * krl,const struct sshkey * key)404 ssh_krl_revoke_key_explicit(struct ssh_krl *krl, const struct sshkey *key)
405 {
406 u_char *blob;
407 size_t len;
408 int r;
409
410 debug3_f("revoke type %s", sshkey_type(key));
411 if ((r = plain_key_blob(key, &blob, &len)) != 0)
412 return r;
413 return revoke_blob(&krl->revoked_keys, blob, len);
414 }
415
416 static int
revoke_by_hash(struct revoked_blob_tree * target,const u_char * p,size_t len)417 revoke_by_hash(struct revoked_blob_tree *target, const u_char *p, size_t len)
418 {
419 u_char *blob;
420 int r;
421
422 /* need to copy hash, as revoke_blob steals ownership */
423 if ((blob = malloc(len)) == NULL)
424 return SSH_ERR_SYSTEM_ERROR;
425 memcpy(blob, p, len);
426 if ((r = revoke_blob(target, blob, len)) != 0) {
427 free(blob);
428 return r;
429 }
430 return 0;
431 }
432
433 int
ssh_krl_revoke_key_sha1(struct ssh_krl * krl,const u_char * p,size_t len)434 ssh_krl_revoke_key_sha1(struct ssh_krl *krl, const u_char *p, size_t len)
435 {
436 debug3_f("revoke by sha1");
437 if (len != 20)
438 return SSH_ERR_INVALID_FORMAT;
439 return revoke_by_hash(&krl->revoked_sha1s, p, len);
440 }
441
442 int
ssh_krl_revoke_key_sha256(struct ssh_krl * krl,const u_char * p,size_t len)443 ssh_krl_revoke_key_sha256(struct ssh_krl *krl, const u_char *p, size_t len)
444 {
445 debug3_f("revoke by sha256");
446 if (len != 32)
447 return SSH_ERR_INVALID_FORMAT;
448 return revoke_by_hash(&krl->revoked_sha256s, p, len);
449 }
450
451 int
ssh_krl_revoke_key(struct ssh_krl * krl,const struct sshkey * key)452 ssh_krl_revoke_key(struct ssh_krl *krl, const struct sshkey *key)
453 {
454 /* XXX replace with SHA256? */
455 if (!sshkey_is_cert(key))
456 return ssh_krl_revoke_key_explicit(krl, key);
457
458 if (key->cert->serial == 0) {
459 return ssh_krl_revoke_cert_by_key_id(krl,
460 key->cert->signature_key,
461 key->cert->key_id);
462 } else {
463 return ssh_krl_revoke_cert_by_serial(krl,
464 key->cert->signature_key,
465 key->cert->serial);
466 }
467 }
468
469 /*
470 * Select the most compact section type to emit next in a KRL based on
471 * the current section type, the run length of contiguous revoked serial
472 * numbers and the gaps from the last and to the next revoked serial.
473 * Applies a mostly-accurate bit cost model to select the section type
474 * that will minimise the size of the resultant KRL.
475 */
476 static int
choose_next_state(int current_state,u_int64_t contig,int final,u_int64_t last_gap,u_int64_t next_gap,int * force_new_section)477 choose_next_state(int current_state, u_int64_t contig, int final,
478 u_int64_t last_gap, u_int64_t next_gap, int *force_new_section)
479 {
480 int new_state;
481 u_int64_t cost, cost_list, cost_range, cost_bitmap, cost_bitmap_restart;
482
483 /*
484 * Avoid unsigned overflows.
485 * The limits are high enough to avoid confusing the calculations.
486 */
487 contig = MINIMUM(contig, 1ULL<<31);
488 last_gap = MINIMUM(last_gap, 1ULL<<31);
489 next_gap = MINIMUM(next_gap, 1ULL<<31);
490
491 /*
492 * Calculate the cost to switch from the current state to candidates.
493 * NB. range sections only ever contain a single range, so their
494 * switching cost is independent of the current_state.
495 */
496 cost_list = cost_bitmap = cost_bitmap_restart = 0;
497 cost_range = 8;
498 switch (current_state) {
499 case KRL_SECTION_CERT_SERIAL_LIST:
500 cost_bitmap_restart = cost_bitmap = 8 + 64;
501 break;
502 case KRL_SECTION_CERT_SERIAL_BITMAP:
503 cost_list = 8;
504 cost_bitmap_restart = 8 + 64;
505 break;
506 case KRL_SECTION_CERT_SERIAL_RANGE:
507 case 0:
508 cost_bitmap_restart = cost_bitmap = 8 + 64;
509 cost_list = 8;
510 }
511
512 /* Estimate base cost in bits of each section type */
513 cost_list += 64 * contig + (final ? 0 : 8+64);
514 cost_range += (2 * 64) + (final ? 0 : 8+64);
515 cost_bitmap += last_gap + contig + (final ? 0 : MINIMUM(next_gap, 8+64));
516 cost_bitmap_restart += contig + (final ? 0 : MINIMUM(next_gap, 8+64));
517
518 /* Convert to byte costs for actual comparison */
519 cost_list = (cost_list + 7) / 8;
520 cost_bitmap = (cost_bitmap + 7) / 8;
521 cost_bitmap_restart = (cost_bitmap_restart + 7) / 8;
522 cost_range = (cost_range + 7) / 8;
523
524 /* Now pick the best choice */
525 *force_new_section = 0;
526 new_state = KRL_SECTION_CERT_SERIAL_BITMAP;
527 cost = cost_bitmap;
528 if (cost_range < cost) {
529 new_state = KRL_SECTION_CERT_SERIAL_RANGE;
530 cost = cost_range;
531 }
532 if (cost_list < cost) {
533 new_state = KRL_SECTION_CERT_SERIAL_LIST;
534 cost = cost_list;
535 }
536 if (cost_bitmap_restart < cost) {
537 new_state = KRL_SECTION_CERT_SERIAL_BITMAP;
538 *force_new_section = 1;
539 cost = cost_bitmap_restart;
540 }
541 KRL_DBG(("contig %llu last_gap %llu next_gap %llu final %d, costs:"
542 "list %llu range %llu bitmap %llu new bitmap %llu, "
543 "selected 0x%02x%s", (long long unsigned)contig,
544 (long long unsigned)last_gap, (long long unsigned)next_gap, final,
545 (long long unsigned)cost_list, (long long unsigned)cost_range,
546 (long long unsigned)cost_bitmap,
547 (long long unsigned)cost_bitmap_restart, new_state,
548 *force_new_section ? " restart" : ""));
549 return new_state;
550 }
551
552 static int
put_bitmap(struct sshbuf * buf,struct bitmap * bitmap)553 put_bitmap(struct sshbuf *buf, struct bitmap *bitmap)
554 {
555 size_t len;
556 u_char *blob;
557 int r;
558
559 len = bitmap_nbytes(bitmap);
560 if ((blob = malloc(len)) == NULL)
561 return SSH_ERR_ALLOC_FAIL;
562 if (bitmap_to_string(bitmap, blob, len) != 0) {
563 free(blob);
564 return SSH_ERR_INTERNAL_ERROR;
565 }
566 r = sshbuf_put_bignum2_bytes(buf, blob, len);
567 free(blob);
568 return r;
569 }
570
571 /* Generate a KRL_SECTION_CERTIFICATES KRL section */
572 static int
revoked_certs_generate(struct revoked_certs * rc,struct sshbuf * buf)573 revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf)
574 {
575 int final, force_new_sect, r = SSH_ERR_INTERNAL_ERROR;
576 u_int64_t i, contig, gap, last = 0, bitmap_start = 0;
577 struct revoked_serial *rs, *nrs;
578 struct revoked_key_id *rki;
579 int next_state, state = 0;
580 struct sshbuf *sect;
581 struct bitmap *bitmap = NULL;
582
583 if ((sect = sshbuf_new()) == NULL)
584 return SSH_ERR_ALLOC_FAIL;
585
586 /* Store the header: optional CA scope key, reserved */
587 if (rc->ca_key == NULL) {
588 if ((r = sshbuf_put_string(buf, NULL, 0)) != 0)
589 goto out;
590 } else {
591 if ((r = sshkey_puts(rc->ca_key, buf)) != 0)
592 goto out;
593 }
594 if ((r = sshbuf_put_string(buf, NULL, 0)) != 0)
595 goto out;
596
597 /* Store the revoked serials. */
598 for (rs = RB_MIN(revoked_serial_tree, &rc->revoked_serials);
599 rs != NULL;
600 rs = RB_NEXT(revoked_serial_tree, &rc->revoked_serials, rs)) {
601 KRL_DBG(("serial %llu:%llu state 0x%02x",
602 (long long unsigned)rs->lo, (long long unsigned)rs->hi,
603 state));
604
605 /* Check contiguous length and gap to next section (if any) */
606 nrs = RB_NEXT(revoked_serial_tree, &rc->revoked_serials, rs);
607 final = nrs == NULL;
608 gap = nrs == NULL ? 0 : nrs->lo - rs->hi;
609 contig = 1 + (rs->hi - rs->lo);
610
611 /* Choose next state based on these */
612 next_state = choose_next_state(state, contig, final,
613 state == 0 ? 0 : rs->lo - last, gap, &force_new_sect);
614
615 /*
616 * If the current section is a range section or has a different
617 * type to the next section, then finish it off now.
618 */
619 if (state != 0 && (force_new_sect || next_state != state ||
620 state == KRL_SECTION_CERT_SERIAL_RANGE)) {
621 KRL_DBG(("finish state 0x%02x", state));
622 switch (state) {
623 case KRL_SECTION_CERT_SERIAL_LIST:
624 case KRL_SECTION_CERT_SERIAL_RANGE:
625 break;
626 case KRL_SECTION_CERT_SERIAL_BITMAP:
627 if ((r = put_bitmap(sect, bitmap)) != 0)
628 goto out;
629 bitmap_free(bitmap);
630 bitmap = NULL;
631 break;
632 }
633 if ((r = sshbuf_put_u8(buf, state)) != 0 ||
634 (r = sshbuf_put_stringb(buf, sect)) != 0)
635 goto out;
636 sshbuf_reset(sect);
637 }
638
639 /* If we are starting a new section then prepare it now */
640 if (next_state != state || force_new_sect) {
641 KRL_DBG(("start state 0x%02x",
642 next_state));
643 state = next_state;
644 sshbuf_reset(sect);
645 switch (state) {
646 case KRL_SECTION_CERT_SERIAL_LIST:
647 case KRL_SECTION_CERT_SERIAL_RANGE:
648 break;
649 case KRL_SECTION_CERT_SERIAL_BITMAP:
650 if ((bitmap = bitmap_new()) == NULL) {
651 r = SSH_ERR_ALLOC_FAIL;
652 goto out;
653 }
654 bitmap_start = rs->lo;
655 if ((r = sshbuf_put_u64(sect,
656 bitmap_start)) != 0)
657 goto out;
658 break;
659 }
660 }
661
662 /* Perform section-specific processing */
663 switch (state) {
664 case KRL_SECTION_CERT_SERIAL_LIST:
665 for (i = 0; i < contig; i++) {
666 if ((r = sshbuf_put_u64(sect, rs->lo + i)) != 0)
667 goto out;
668 }
669 break;
670 case KRL_SECTION_CERT_SERIAL_RANGE:
671 if ((r = sshbuf_put_u64(sect, rs->lo)) != 0 ||
672 (r = sshbuf_put_u64(sect, rs->hi)) != 0)
673 goto out;
674 break;
675 case KRL_SECTION_CERT_SERIAL_BITMAP:
676 if (rs->lo - bitmap_start > INT_MAX) {
677 r = SSH_ERR_INVALID_FORMAT;
678 error_f("insane bitmap gap");
679 goto out;
680 }
681 for (i = 0; i < contig; i++) {
682 if (bitmap_set_bit(bitmap,
683 rs->lo + i - bitmap_start) != 0) {
684 r = SSH_ERR_ALLOC_FAIL;
685 goto out;
686 }
687 }
688 break;
689 }
690 last = rs->hi;
691 }
692 /* Flush the remaining section, if any */
693 if (state != 0) {
694 KRL_DBG(("serial final flush for state 0x%02x", state));
695 switch (state) {
696 case KRL_SECTION_CERT_SERIAL_LIST:
697 case KRL_SECTION_CERT_SERIAL_RANGE:
698 break;
699 case KRL_SECTION_CERT_SERIAL_BITMAP:
700 if ((r = put_bitmap(sect, bitmap)) != 0)
701 goto out;
702 bitmap_free(bitmap);
703 bitmap = NULL;
704 break;
705 }
706 if ((r = sshbuf_put_u8(buf, state)) != 0 ||
707 (r = sshbuf_put_stringb(buf, sect)) != 0)
708 goto out;
709 }
710 KRL_DBG(("serial done "));
711
712 /* Now output a section for any revocations by key ID */
713 sshbuf_reset(sect);
714 RB_FOREACH(rki, revoked_key_id_tree, &rc->revoked_key_ids) {
715 KRL_DBG(("key ID %s", rki->key_id));
716 if ((r = sshbuf_put_cstring(sect, rki->key_id)) != 0)
717 goto out;
718 }
719 if (sshbuf_len(sect) != 0) {
720 if ((r = sshbuf_put_u8(buf, KRL_SECTION_CERT_KEY_ID)) != 0 ||
721 (r = sshbuf_put_stringb(buf, sect)) != 0)
722 goto out;
723 }
724 r = 0;
725 out:
726 bitmap_free(bitmap);
727 sshbuf_free(sect);
728 return r;
729 }
730
731 int
ssh_krl_to_blob(struct ssh_krl * krl,struct sshbuf * buf)732 ssh_krl_to_blob(struct ssh_krl *krl, struct sshbuf *buf)
733 {
734 int r = SSH_ERR_INTERNAL_ERROR;
735 struct revoked_certs *rc;
736 struct revoked_blob *rb;
737 struct sshbuf *sect;
738 u_char *sblob = NULL;
739
740 if (krl->generated_date == 0)
741 krl->generated_date = time(NULL);
742
743 if ((sect = sshbuf_new()) == NULL)
744 return SSH_ERR_ALLOC_FAIL;
745
746 /* Store the header */
747 if ((r = sshbuf_put(buf, KRL_MAGIC, sizeof(KRL_MAGIC) - 1)) != 0 ||
748 (r = sshbuf_put_u32(buf, KRL_FORMAT_VERSION)) != 0 ||
749 (r = sshbuf_put_u64(buf, krl->krl_version)) != 0 ||
750 (r = sshbuf_put_u64(buf, krl->generated_date)) != 0 ||
751 (r = sshbuf_put_u64(buf, krl->flags)) != 0 ||
752 (r = sshbuf_put_string(buf, NULL, 0)) != 0 ||
753 (r = sshbuf_put_cstring(buf, krl->comment)) != 0)
754 goto out;
755
756 /* Store sections for revoked certificates */
757 TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
758 sshbuf_reset(sect);
759 if ((r = revoked_certs_generate(rc, sect)) != 0)
760 goto out;
761 if ((r = sshbuf_put_u8(buf, KRL_SECTION_CERTIFICATES)) != 0 ||
762 (r = sshbuf_put_stringb(buf, sect)) != 0)
763 goto out;
764 }
765
766 /* Finally, output sections for revocations by public key/hash */
767 sshbuf_reset(sect);
768 RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_keys) {
769 KRL_DBG(("key len %zu ", rb->len));
770 if ((r = sshbuf_put_string(sect, rb->blob, rb->len)) != 0)
771 goto out;
772 }
773 if (sshbuf_len(sect) != 0) {
774 if ((r = sshbuf_put_u8(buf, KRL_SECTION_EXPLICIT_KEY)) != 0 ||
775 (r = sshbuf_put_stringb(buf, sect)) != 0)
776 goto out;
777 }
778 sshbuf_reset(sect);
779 RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha1s) {
780 KRL_DBG(("hash len %zu ", rb->len));
781 if ((r = sshbuf_put_string(sect, rb->blob, rb->len)) != 0)
782 goto out;
783 }
784 if (sshbuf_len(sect) != 0) {
785 if ((r = sshbuf_put_u8(buf,
786 KRL_SECTION_FINGERPRINT_SHA1)) != 0 ||
787 (r = sshbuf_put_stringb(buf, sect)) != 0)
788 goto out;
789 }
790 sshbuf_reset(sect);
791 RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha256s) {
792 KRL_DBG(("hash len %zu ", rb->len));
793 if ((r = sshbuf_put_string(sect, rb->blob, rb->len)) != 0)
794 goto out;
795 }
796 if (sshbuf_len(sect) != 0) {
797 if ((r = sshbuf_put_u8(buf,
798 KRL_SECTION_FINGERPRINT_SHA256)) != 0 ||
799 (r = sshbuf_put_stringb(buf, sect)) != 0)
800 goto out;
801 }
802 /* success */
803 r = 0;
804 out:
805 free(sblob);
806 sshbuf_free(sect);
807 return r;
808 }
809
810 static void
format_timestamp(u_int64_t timestamp,char * ts,size_t nts)811 format_timestamp(u_int64_t timestamp, char *ts, size_t nts)
812 {
813 time_t t;
814 struct tm *tm;
815
816 t = timestamp;
817 tm = localtime(&t);
818 if (tm == NULL)
819 strlcpy(ts, "<INVALID>", nts);
820 else {
821 *ts = '\0';
822 strftime(ts, nts, "%Y%m%dT%H%M%S", tm);
823 }
824 }
825
826 static int
cert_extension_subsection(struct sshbuf * subsect,struct ssh_krl * krl)827 cert_extension_subsection(struct sshbuf *subsect, struct ssh_krl *krl)
828 {
829 int r = SSH_ERR_INTERNAL_ERROR;
830 u_char critical = 1;
831 struct sshbuf *value = NULL;
832 char *name = NULL;
833
834 if ((r = sshbuf_get_cstring(subsect, &name, NULL)) != 0 ||
835 (r = sshbuf_get_u8(subsect, &critical)) != 0 ||
836 (r = sshbuf_froms(subsect, &value)) != 0) {
837 debug_fr(r, "parse");
838 error("KRL has invalid certificate extension subsection");
839 r = SSH_ERR_INVALID_FORMAT;
840 goto out;
841 }
842 if (sshbuf_len(subsect) != 0) {
843 error("KRL has invalid certificate extension subsection: "
844 "trailing data");
845 r = SSH_ERR_INVALID_FORMAT;
846 goto out;
847 }
848 debug_f("cert extension %s critical %u len %zu",
849 name, critical, sshbuf_len(value));
850 /* no extensions are currently supported */
851 if (critical) {
852 error("KRL contains unsupported critical certificate "
853 "subsection \"%s\"", name);
854 r = SSH_ERR_FEATURE_UNSUPPORTED;
855 goto out;
856 }
857 /* success */
858 r = 0;
859 out:
860 free(name);
861 sshbuf_free(value);
862 return r;
863 }
864
865 static int
parse_revoked_certs(struct sshbuf * buf,struct ssh_krl * krl)866 parse_revoked_certs(struct sshbuf *buf, struct ssh_krl *krl)
867 {
868 int r = SSH_ERR_INTERNAL_ERROR;
869 u_char type;
870 const u_char *blob;
871 size_t blen, nbits;
872 struct sshbuf *subsect = NULL;
873 u_int64_t serial, serial_lo, serial_hi;
874 struct bitmap *bitmap = NULL;
875 char *key_id = NULL;
876 struct sshkey *ca_key = NULL;
877
878 if ((subsect = sshbuf_new()) == NULL)
879 return SSH_ERR_ALLOC_FAIL;
880
881 /* Header: key, reserved */
882 if ((r = sshbuf_get_string_direct(buf, &blob, &blen)) != 0 ||
883 (r = sshbuf_skip_string(buf)) != 0)
884 goto out;
885 if (blen != 0 && (r = sshkey_from_blob(blob, blen, &ca_key)) != 0)
886 goto out;
887
888 while (sshbuf_len(buf) > 0) {
889 sshbuf_free(subsect);
890 subsect = NULL;
891 if ((r = sshbuf_get_u8(buf, &type)) != 0 ||
892 (r = sshbuf_froms(buf, &subsect)) != 0)
893 goto out;
894 KRL_DBG(("subsection type 0x%02x", type));
895 /* sshbuf_dump(subsect, stderr); */
896
897 switch (type) {
898 case KRL_SECTION_CERT_SERIAL_LIST:
899 while (sshbuf_len(subsect) > 0) {
900 if ((r = sshbuf_get_u64(subsect, &serial)) != 0)
901 goto out;
902 if ((r = ssh_krl_revoke_cert_by_serial(krl,
903 ca_key, serial)) != 0)
904 goto out;
905 }
906 break;
907 case KRL_SECTION_CERT_SERIAL_RANGE:
908 if ((r = sshbuf_get_u64(subsect, &serial_lo)) != 0 ||
909 (r = sshbuf_get_u64(subsect, &serial_hi)) != 0)
910 goto out;
911 if ((r = ssh_krl_revoke_cert_by_serial_range(krl,
912 ca_key, serial_lo, serial_hi)) != 0)
913 goto out;
914 break;
915 case KRL_SECTION_CERT_SERIAL_BITMAP:
916 if ((bitmap = bitmap_new()) == NULL) {
917 r = SSH_ERR_ALLOC_FAIL;
918 goto out;
919 }
920 if ((r = sshbuf_get_u64(subsect, &serial_lo)) != 0 ||
921 (r = sshbuf_get_bignum2_bytes_direct(subsect,
922 &blob, &blen)) != 0)
923 goto out;
924 if (bitmap_from_string(bitmap, blob, blen) != 0) {
925 r = SSH_ERR_INVALID_FORMAT;
926 goto out;
927 }
928 nbits = bitmap_nbits(bitmap);
929 for (serial = 0; serial < (u_int64_t)nbits; serial++) {
930 if (serial > 0 && serial_lo + serial == 0) {
931 error_f("bitmap wraps u64");
932 r = SSH_ERR_INVALID_FORMAT;
933 goto out;
934 }
935 if (!bitmap_test_bit(bitmap, serial))
936 continue;
937 if ((r = ssh_krl_revoke_cert_by_serial(krl,
938 ca_key, serial_lo + serial)) != 0)
939 goto out;
940 }
941 bitmap_free(bitmap);
942 bitmap = NULL;
943 break;
944 case KRL_SECTION_CERT_KEY_ID:
945 while (sshbuf_len(subsect) > 0) {
946 if ((r = sshbuf_get_cstring(subsect,
947 &key_id, NULL)) != 0)
948 goto out;
949 if ((r = ssh_krl_revoke_cert_by_key_id(krl,
950 ca_key, key_id)) != 0)
951 goto out;
952 free(key_id);
953 key_id = NULL;
954 }
955 break;
956 case KRL_SECTION_CERT_EXTENSION:
957 if ((r = cert_extension_subsection(subsect, krl)) != 0)
958 goto out;
959 break;
960 default:
961 error("Unsupported KRL certificate section %u", type);
962 r = SSH_ERR_INVALID_FORMAT;
963 goto out;
964 }
965 if (sshbuf_len(subsect) > 0) {
966 error("KRL certificate section contains unparsed data");
967 r = SSH_ERR_INVALID_FORMAT;
968 goto out;
969 }
970 }
971
972 r = 0;
973 out:
974 if (bitmap != NULL)
975 bitmap_free(bitmap);
976 free(key_id);
977 sshkey_free(ca_key);
978 sshbuf_free(subsect);
979 return r;
980 }
981
982 static int
blob_section(struct sshbuf * sect,struct revoked_blob_tree * target_tree,size_t expected_len)983 blob_section(struct sshbuf *sect, struct revoked_blob_tree *target_tree,
984 size_t expected_len)
985 {
986 u_char *rdata = NULL;
987 size_t rlen = 0;
988 int r;
989
990 while (sshbuf_len(sect) > 0) {
991 if ((r = sshbuf_get_string(sect, &rdata, &rlen)) != 0)
992 return r;
993 if (expected_len != 0 && rlen != expected_len) {
994 error_f("bad length");
995 free(rdata);
996 return SSH_ERR_INVALID_FORMAT;
997 }
998 if ((r = revoke_blob(target_tree, rdata, rlen)) != 0) {
999 free(rdata);
1000 return r;
1001 }
1002 }
1003 return 0;
1004 }
1005
1006 static int
extension_section(struct sshbuf * sect,struct ssh_krl * krl)1007 extension_section(struct sshbuf *sect, struct ssh_krl *krl)
1008 {
1009 int r = SSH_ERR_INTERNAL_ERROR;
1010 u_char critical = 1;
1011 struct sshbuf *value = NULL;
1012 char *name = NULL;
1013
1014 if ((r = sshbuf_get_cstring(sect, &name, NULL)) != 0 ||
1015 (r = sshbuf_get_u8(sect, &critical)) != 0 ||
1016 (r = sshbuf_froms(sect, &value)) != 0) {
1017 debug_fr(r, "parse");
1018 error("KRL has invalid extension section");
1019 r = SSH_ERR_INVALID_FORMAT;
1020 goto out;
1021 }
1022 if (sshbuf_len(sect) != 0) {
1023 error("KRL has invalid extension section: trailing data");
1024 r = SSH_ERR_INVALID_FORMAT;
1025 goto out;
1026 }
1027 debug_f("extension %s critical %u len %zu",
1028 name, critical, sshbuf_len(value));
1029 /* no extensions are currently supported */
1030 if (critical) {
1031 error("KRL contains unsupported critical section \"%s\"", name);
1032 r = SSH_ERR_FEATURE_UNSUPPORTED;
1033 goto out;
1034 }
1035 /* success */
1036 r = 0;
1037 out:
1038 free(name);
1039 sshbuf_free(value);
1040 return r;
1041 }
1042
1043 /* Attempt to parse a KRL */
1044 int
ssh_krl_from_blob(struct sshbuf * buf,struct ssh_krl ** krlp)1045 ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp)
1046 {
1047 struct sshbuf *copy = NULL, *sect = NULL;
1048 struct ssh_krl *krl = NULL;
1049 char timestamp[64];
1050 int r = SSH_ERR_INTERNAL_ERROR;
1051 u_char type;
1052 u_int format_version;
1053
1054 *krlp = NULL;
1055
1056 /* KRL must begin with magic string */
1057 if ((r = sshbuf_cmp(buf, 0, KRL_MAGIC, sizeof(KRL_MAGIC) - 1)) != 0) {
1058 debug2_f("bad KRL magic header");
1059 return SSH_ERR_KRL_BAD_MAGIC;
1060 }
1061
1062 if ((krl = ssh_krl_init()) == NULL) {
1063 r = SSH_ERR_ALLOC_FAIL;
1064 error_f("alloc failed");
1065 goto out;
1066 }
1067 /* Don't modify buffer */
1068 if ((copy = sshbuf_fromb(buf)) == NULL) {
1069 r = SSH_ERR_ALLOC_FAIL;
1070 goto out;
1071 }
1072 if ((r = sshbuf_consume(copy, sizeof(KRL_MAGIC) - 1)) != 0 ||
1073 (r = sshbuf_get_u32(copy, &format_version)) != 0)
1074 goto out;
1075 if (format_version != KRL_FORMAT_VERSION) {
1076 error_f("unsupported KRL format version %u", format_version);
1077 r = SSH_ERR_INVALID_FORMAT;
1078 goto out;
1079 }
1080 if ((r = sshbuf_get_u64(copy, &krl->krl_version)) != 0 ||
1081 (r = sshbuf_get_u64(copy, &krl->generated_date)) != 0 ||
1082 (r = sshbuf_get_u64(copy, &krl->flags)) != 0 ||
1083 (r = sshbuf_skip_string(copy)) != 0 ||
1084 (r = sshbuf_get_cstring(copy, &krl->comment, NULL)) != 0) {
1085 error_fr(r, "parse KRL header");
1086 goto out;
1087 }
1088 format_timestamp(krl->generated_date, timestamp, sizeof(timestamp));
1089 debug("KRL version %llu generated at %s%s%s",
1090 (long long unsigned)krl->krl_version, timestamp,
1091 *krl->comment ? ": " : "", krl->comment);
1092
1093 /* Parse and load the KRL sections. */
1094 while (sshbuf_len(copy) > 0) {
1095 sshbuf_free(sect);
1096 sect = NULL;
1097 if ((r = sshbuf_get_u8(copy, &type)) != 0 ||
1098 (r = sshbuf_froms(copy, §)) != 0)
1099 goto out;
1100 KRL_DBG(("section 0x%02x", type));
1101
1102 switch (type) {
1103 case KRL_SECTION_CERTIFICATES:
1104 if ((r = parse_revoked_certs(sect, krl)) != 0)
1105 goto out;
1106 break;
1107 case KRL_SECTION_EXPLICIT_KEY:
1108 if ((r = blob_section(sect,
1109 &krl->revoked_keys, 0)) != 0)
1110 goto out;
1111 break;
1112 case KRL_SECTION_FINGERPRINT_SHA1:
1113 if ((r = blob_section(sect,
1114 &krl->revoked_sha1s, 20)) != 0)
1115 goto out;
1116 break;
1117 case KRL_SECTION_FINGERPRINT_SHA256:
1118 if ((r = blob_section(sect,
1119 &krl->revoked_sha256s, 32)) != 0)
1120 goto out;
1121 break;
1122 case KRL_SECTION_EXTENSION:
1123 if ((r = extension_section(sect, krl)) != 0)
1124 goto out;
1125 break;
1126 case KRL_SECTION_SIGNATURE:
1127 /* Handled above, but still need to stay in synch */
1128 sshbuf_free(sect);
1129 sect = NULL;
1130 if ((r = sshbuf_skip_string(copy)) != 0)
1131 goto out;
1132 break;
1133 default:
1134 error("Unsupported KRL section %u", type);
1135 r = SSH_ERR_INVALID_FORMAT;
1136 goto out;
1137 }
1138 if (sect != NULL && sshbuf_len(sect) > 0) {
1139 error("KRL section contains unparsed data");
1140 r = SSH_ERR_INVALID_FORMAT;
1141 goto out;
1142 }
1143 }
1144
1145 /* Success */
1146 *krlp = krl;
1147 r = 0;
1148 out:
1149 if (r != 0)
1150 ssh_krl_free(krl);
1151 sshbuf_free(copy);
1152 sshbuf_free(sect);
1153 return r;
1154 }
1155
1156 /* Checks certificate serial number and key ID revocation */
1157 static int
is_cert_revoked(const struct sshkey * key,struct revoked_certs * rc)1158 is_cert_revoked(const struct sshkey *key, struct revoked_certs *rc)
1159 {
1160 struct revoked_serial rs, *ers;
1161 struct revoked_key_id rki, *erki;
1162
1163 /* Check revocation by cert key ID */
1164 memset(&rki, 0, sizeof(rki));
1165 rki.key_id = key->cert->key_id;
1166 erki = RB_FIND(revoked_key_id_tree, &rc->revoked_key_ids, &rki);
1167 if (erki != NULL) {
1168 KRL_DBG(("revoked by key ID"));
1169 return SSH_ERR_KEY_REVOKED;
1170 }
1171
1172 /*
1173 * Zero serials numbers are ignored (it's the default when the
1174 * CA doesn't specify one).
1175 */
1176 if (key->cert->serial == 0)
1177 return 0;
1178
1179 memset(&rs, 0, sizeof(rs));
1180 rs.lo = rs.hi = key->cert->serial;
1181 ers = RB_FIND(revoked_serial_tree, &rc->revoked_serials, &rs);
1182 if (ers != NULL) {
1183 KRL_DBG(("revoked serial %llu matched %llu:%llu",
1184 key->cert->serial, ers->lo, ers->hi));
1185 return SSH_ERR_KEY_REVOKED;
1186 }
1187 return 0;
1188 }
1189
1190 /* Checks whether a given key/cert is revoked. Does not check its CA */
1191 static int
is_key_revoked(struct ssh_krl * krl,const struct sshkey * key)1192 is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
1193 {
1194 struct revoked_blob rb, *erb;
1195 struct revoked_certs *rc;
1196 int r;
1197
1198 /* Check explicitly revoked hashes first */
1199 memset(&rb, 0, sizeof(rb));
1200 if ((r = sshkey_fingerprint_raw(key, SSH_DIGEST_SHA1,
1201 &rb.blob, &rb.len)) != 0)
1202 return r;
1203 erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
1204 free(rb.blob);
1205 if (erb != NULL) {
1206 KRL_DBG(("revoked by key SHA1"));
1207 return SSH_ERR_KEY_REVOKED;
1208 }
1209 memset(&rb, 0, sizeof(rb));
1210 if ((r = sshkey_fingerprint_raw(key, SSH_DIGEST_SHA256,
1211 &rb.blob, &rb.len)) != 0)
1212 return r;
1213 erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha256s, &rb);
1214 free(rb.blob);
1215 if (erb != NULL) {
1216 KRL_DBG(("revoked by key SHA256"));
1217 return SSH_ERR_KEY_REVOKED;
1218 }
1219
1220 /* Next, explicit keys */
1221 memset(&rb, 0, sizeof(rb));
1222 if ((r = plain_key_blob(key, &rb.blob, &rb.len)) != 0)
1223 return r;
1224 erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb);
1225 free(rb.blob);
1226 if (erb != NULL) {
1227 KRL_DBG(("revoked by explicit key"));
1228 return SSH_ERR_KEY_REVOKED;
1229 }
1230
1231 if (!sshkey_is_cert(key))
1232 return 0;
1233
1234 /* Check cert revocation for the specified CA */
1235 if ((r = revoked_certs_for_ca_key(krl, key->cert->signature_key,
1236 &rc, 0)) != 0)
1237 return r;
1238 if (rc != NULL) {
1239 if ((r = is_cert_revoked(key, rc)) != 0)
1240 return r;
1241 }
1242 /* Check cert revocation for the wildcard CA */
1243 if ((r = revoked_certs_for_ca_key(krl, NULL, &rc, 0)) != 0)
1244 return r;
1245 if (rc != NULL) {
1246 if ((r = is_cert_revoked(key, rc)) != 0)
1247 return r;
1248 }
1249
1250 KRL_DBG(("%llu no match", key->cert->serial));
1251 return 0;
1252 }
1253
1254 int
ssh_krl_check_key(struct ssh_krl * krl,const struct sshkey * key)1255 ssh_krl_check_key(struct ssh_krl *krl, const struct sshkey *key)
1256 {
1257 int r;
1258
1259 KRL_DBG(("checking key"));
1260 if ((r = is_key_revoked(krl, key)) != 0)
1261 return r;
1262 if (sshkey_is_cert(key)) {
1263 debug2_f("checking CA key");
1264 if ((r = is_key_revoked(krl, key->cert->signature_key)) != 0)
1265 return r;
1266 }
1267 KRL_DBG(("key okay"));
1268 return 0;
1269 }
1270
1271 int
ssh_krl_file_contains_key(const char * path,const struct sshkey * key)1272 ssh_krl_file_contains_key(const char *path, const struct sshkey *key)
1273 {
1274 struct sshbuf *krlbuf = NULL;
1275 struct ssh_krl *krl = NULL;
1276 int oerrno = 0, r;
1277
1278 if (path == NULL)
1279 return 0;
1280 if ((r = sshbuf_load_file(path, &krlbuf)) != 0) {
1281 oerrno = errno;
1282 goto out;
1283 }
1284 if ((r = ssh_krl_from_blob(krlbuf, &krl)) != 0)
1285 goto out;
1286 debug2_f("checking KRL %s", path);
1287 r = ssh_krl_check_key(krl, key);
1288 out:
1289 sshbuf_free(krlbuf);
1290 ssh_krl_free(krl);
1291 if (r != 0)
1292 errno = oerrno;
1293 return r;
1294 }
1295
1296 int
krl_dump(struct ssh_krl * krl,FILE * f)1297 krl_dump(struct ssh_krl *krl, FILE *f)
1298 {
1299 struct sshkey *key = NULL;
1300 struct revoked_blob *rb;
1301 struct revoked_certs *rc;
1302 struct revoked_serial *rs;
1303 struct revoked_key_id *rki;
1304 int r, ret = 0;
1305 char *fp, timestamp[64];
1306
1307 /* Try to print in a KRL spec-compatible format */
1308 format_timestamp(krl->generated_date, timestamp, sizeof(timestamp));
1309 fprintf(f, "# KRL version %llu\n",
1310 (unsigned long long)krl->krl_version);
1311 fprintf(f, "# Generated at %s\n", timestamp);
1312 if (krl->comment != NULL && *krl->comment != '\0') {
1313 r = INT_MAX;
1314 asmprintf(&fp, INT_MAX, &r, "%s", krl->comment);
1315 fprintf(f, "# Comment: %s\n", fp);
1316 free(fp);
1317 }
1318 fputc('\n', f);
1319
1320 RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_keys) {
1321 if ((r = sshkey_from_blob(rb->blob, rb->len, &key)) != 0) {
1322 ret = SSH_ERR_INVALID_FORMAT;
1323 error_r(r, "parse KRL key");
1324 continue;
1325 }
1326 if ((fp = sshkey_fingerprint(key, SSH_FP_HASH_DEFAULT,
1327 SSH_FP_DEFAULT)) == NULL) {
1328 ret = SSH_ERR_INVALID_FORMAT;
1329 error("sshkey_fingerprint failed");
1330 continue;
1331 }
1332 fprintf(f, "hash: %s # %s\n", fp, sshkey_ssh_name(key));
1333 free(fp);
1334 free(key);
1335 }
1336 RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha256s) {
1337 fp = tohex(rb->blob, rb->len);
1338 fprintf(f, "hash: SHA256:%s\n", fp);
1339 free(fp);
1340 }
1341 RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha1s) {
1342 /*
1343 * There is not KRL spec keyword for raw SHA1 hashes, so
1344 * print them as comments.
1345 */
1346 fp = tohex(rb->blob, rb->len);
1347 fprintf(f, "# hash SHA1:%s\n", fp);
1348 free(fp);
1349 }
1350
1351 TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
1352 fputc('\n', f);
1353 if (rc->ca_key == NULL)
1354 fprintf(f, "# Wildcard CA\n");
1355 else {
1356 if ((fp = sshkey_fingerprint(rc->ca_key,
1357 SSH_FP_HASH_DEFAULT, SSH_FP_DEFAULT)) == NULL) {
1358 ret = SSH_ERR_INVALID_FORMAT;
1359 error("sshkey_fingerprint failed");
1360 continue;
1361 }
1362 fprintf(f, "# CA key %s %s\n",
1363 sshkey_ssh_name(rc->ca_key), fp);
1364 free(fp);
1365 }
1366 RB_FOREACH(rs, revoked_serial_tree, &rc->revoked_serials) {
1367 if (rs->lo == rs->hi) {
1368 fprintf(f, "serial: %llu\n",
1369 (unsigned long long)rs->lo);
1370 } else {
1371 fprintf(f, "serial: %llu-%llu\n",
1372 (unsigned long long)rs->lo,
1373 (unsigned long long)rs->hi);
1374 }
1375 }
1376 RB_FOREACH(rki, revoked_key_id_tree, &rc->revoked_key_ids) {
1377 /*
1378 * We don't want key IDs with embedded newlines to
1379 * mess up the display.
1380 */
1381 r = INT_MAX;
1382 asmprintf(&fp, INT_MAX, &r, "%s", rki->key_id);
1383 fprintf(f, "id: %s\n", fp);
1384 free(fp);
1385 }
1386 }
1387 return ret;
1388 }
1389