X-Git-Url: http://git.tuebingen.mpg.de/?a=blobdiff_plain;f=crypt.c;h=f1e42d4a228f7c0c498ac505575b6a0f3667bf27;hb=9d849535e30c6b6a3ebb746fd3002d18927f62ea;hp=73eebe180dbe2c32718b5dc7fd271f7ca4b329b1;hpb=00e4d4da1b2c00da139b09d3ed4ab9ad9fba2691;p=paraslash.git

diff --git a/crypt.c b/crypt.c
index 73eebe18..f1e42d4a 100644
--- a/crypt.c
+++ b/crypt.c
@@ -1,172 +1,299 @@
 /*
- * Copyright (C) 2005-2009 Andre Noll <maan@systemlinux.org>
+ * Copyright (C) 2005 Andre Noll <maan@tuebingen.mpg.de>
  *
  * Licensed under the GPL v2. For licencing details see COPYING.
  */
 
-/** \file crypt.c openssl-based RSA encryption/decryption routines */
+/** \file crypt.c Openssl-based encryption/decryption routines. */
+
+#include <regex.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <openssl/rand.h>
+#include <openssl/err.h>
+#include <openssl/pem.h>
+#include <openssl/sha.h>
+#include <openssl/bn.h>
+#include <openssl/aes.h>
 
 #include "para.h"
 #include "error.h"
 #include "string.h"
 #include "crypt.h"
+#include "fd.h"
+#include "crypt_backend.h"
+#include "base64.h"
+
+struct asymmetric_key {
+	RSA *rsa;
+};
 
-static EVP_PKEY *load_key(const char *file, int private)
+void get_random_bytes_or_die(unsigned char *buf, int num)
 {
-	BIO *key;
-	EVP_PKEY *pkey = NULL;
+	unsigned long err;
 
-	key = BIO_new(BIO_s_file());
-	if (!key)
-		return NULL;
-	if (BIO_read_filename(key, file) > 0) {
-		if (private == LOAD_PRIVATE_KEY)
-			pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, NULL);
-		else
-			pkey = PEM_read_bio_PUBKEY(key, NULL, NULL, NULL);
-	}
-	BIO_free(key);
-	return pkey;
+	/* RAND_bytes() returns 1 on success, 0 otherwise. */
+	if (RAND_bytes(buf, num) == 1)
+		return;
+	err = ERR_get_error();
+	PARA_EMERG_LOG("%s\n", ERR_reason_error_string(err));
+	exit(EXIT_FAILURE);
 }
 
-/**
- * read an RSA key from a file
- *
- * \param key_file the file containing the key
- * \param rsa RSA structure is returned here
- * \param private if non-zero, read the private key, otherwise the public key
- *
- * \return The size of the RSA key on success, negative on errors.
+/*
+ * Read 64 bytes from /dev/urandom and adds them to the SSL PRNG. Seed the PRNG
+ * used by random() with a random seed obtained from SSL. If /dev/random is not
+ * readable the function calls exit().
  *
- * \sa openssl(1), rsa(1).
+ * \sa RAND_load_file(3), \ref get_random_bytes_or_die(), srandom(3),
+ * random(3), \ref para_random().
  */
-int get_rsa_key(char *key_file, RSA **rsa, int private)
+void init_random_seed_or_die(void)
 {
-	EVP_PKEY *key = load_key(key_file, private);
+	int seed, ret = RAND_load_file("/dev/urandom", 64);
 
-	if (!key)
-		return (private == LOAD_PRIVATE_KEY)? -E_PRIVATE_KEY
-			: -E_PUBLIC_KEY;
-	*rsa = EVP_PKEY_get1_RSA(key);
-	EVP_PKEY_free(key);
-	if (!*rsa)
-		return -E_RSA;
-	return RSA_size(*rsa);
+	if (ret != 64) {
+		PARA_EMERG_LOG("could not seed PRNG (ret = %d)\n", ret);
+		exit(EXIT_FAILURE);
+	}
+	get_random_bytes_or_die((unsigned char *)&seed, sizeof(seed));
+	srandom(seed);
 }
 
-/**
- * free an RSA structure
- *
- * \param rsa pointer to the RSA struct to free
- *
- * This must be called for any key obtained by get_rsa_key().
+static int get_private_key(const char *path, RSA **rsa)
+{
+	EVP_PKEY *pkey;
+	BIO *bio = BIO_new(BIO_s_file());
+
+	*rsa = NULL;
+	if (!bio)
+		return -E_PRIVATE_KEY;
+	if (BIO_read_filename(bio, path) <= 0)
+		goto bio_free;
+	pkey = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);
+	if (!pkey)
+		goto bio_free;
+	*rsa = EVP_PKEY_get1_RSA(pkey);
+	EVP_PKEY_free(pkey);
+bio_free:
+	BIO_free(bio);
+	return *rsa? RSA_size(*rsa) : -E_PRIVATE_KEY;
+}
+
+/*
+ * The public key loading functions below were inspired by corresponding code
+ * of openssh-5.2p1, Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo,
+ * Finland. However, not much of the original code remains.
  */
-void rsa_free(RSA *rsa)
+
+static int read_bignum(const unsigned char *buf, size_t len, BIGNUM **result)
 {
-	if (rsa)
-		RSA_free(rsa);
+	const unsigned char *p = buf, *end = buf + len;
+	uint32_t bnsize;
+	BIGNUM *bn;
+
+	if (p + 4 < p)
+		return -E_BIGNUM;
+	if (p + 4 > end)
+		return -E_BIGNUM;
+	bnsize = read_ssh_u32(p);
+	PARA_DEBUG_LOG("bnsize: %u\n", bnsize);
+	p += 4;
+	if (p + bnsize < p)
+		return -E_BIGNUM;
+	if (p + bnsize > end)
+		return -E_BIGNUM;
+	if (bnsize > 8192)
+		return -E_BIGNUM;
+	bn = BN_bin2bn(p, bnsize, NULL);
+	if (!bn)
+		return -E_BIGNUM;
+	*result = bn;
+	return bnsize + 4;
 }
 
-/**
- * decrypt a buffer using an RSA key
- *
- * \param key_file full path of the rsa key
- * \param outbuf the output buffer
- * \param inbuf the encrypted input buffer
- * \param rsa_inlen the length of \a inbuf
- *
- * The \a outbuf must be large enough to hold at least \a rsa_inlen bytes.
- *
- * \return The size of the recovered plaintext on success, negative on errors.
- *
- * \sa RSA_private_decrypt(3)
- **/
-int para_decrypt_buffer(char *key_file, unsigned char *outbuf, unsigned char *inbuf,
-			unsigned rsa_inlen)
+static int read_rsa_bignums(const unsigned char *blob, int blen, RSA **result)
 {
+	int ret;
 	RSA *rsa;
-	int ret, inlen = rsa_inlen;
+	BIGNUM *n, *e;
+	const unsigned char *p = blob, *end = blob + blen;
 
-	if (inlen < 0)
-		return -E_RSA;
-	ret = get_rsa_key(key_file, &rsa, LOAD_PRIVATE_KEY);
+	rsa = RSA_new();
+	if (!rsa)
+		return -E_BIGNUM;
+	ret = read_bignum(p, end - p, &e);
 	if (ret < 0)
-		return ret;
-	ret = RSA_private_decrypt(inlen, inbuf, outbuf, rsa, RSA_PKCS1_PADDING);
-	rsa_free(rsa);
-	return (ret > 0)? ret : -E_DECRYPT;
+		goto fail;
+	p += ret;
+	ret = read_bignum(p, end - p, &n);
+	if (ret < 0)
+		goto fail;
+#ifdef HAVE_RSA_SET0_KEY
+	RSA_set0_key(rsa, n, e, NULL);
+#else
+	rsa->n = n;
+	rsa->e = e;
+#endif
+	*result = rsa;
+	return 1;
+fail:
+	RSA_free(rsa);
+	return ret;
 }
 
-/**
- * decrypt the challenge number sent by para_server
- *
- * \param key_file full path of the rsa key
- * \param challenge_nr result is stored here
- * \param inbuf the input buffer
- * \param rsa_inlen the length of \a inbuf
- *
- * \return positive on success, negative on errors
- *
- * \sa para_decrypt_buffer()
- */
-int para_decrypt_challenge(char *key_file, long unsigned *challenge_nr,
-		unsigned char *inbuf, unsigned rsa_inlen)
+int get_public_key(const char *key_file, struct asymmetric_key **result)
 {
-	unsigned char *rsa_out = OPENSSL_malloc(rsa_inlen + 1);
-	int ret = para_decrypt_buffer(key_file, rsa_out, inbuf, rsa_inlen);
+	struct asymmetric_key *key = NULL;
+	void *map = NULL;
+	unsigned char *blob = NULL;
+	size_t map_size, encoded_size, decoded_size;
+	int ret, ret2;
+	char *cp;
 
-	if (ret >= 0) {
-		rsa_out[ret] = '\0';
-		ret = sscanf((char *)rsa_out, "%lu", challenge_nr) == 1?
-			1 : -E_CHALLENGE;
+	key = para_malloc(sizeof(*key));
+	ret = mmap_full_file(key_file, O_RDONLY, &map, &map_size, NULL);
+	if (ret < 0)
+		goto out;
+	ret = is_ssh_rsa_key(map, map_size);
+	if (!ret) {
+		para_munmap(map, map_size);
+		return -E_SSH_PARSE;
 	}
-	OPENSSL_free(rsa_out);
+	cp = map + ret;
+	encoded_size = map_size - ret;
+	PARA_INFO_LOG("decoding public rsa-ssh key %s\n", key_file);
+	ret = uudecode(cp, encoded_size, (char **)&blob, &decoded_size);
+	if (ret < 0)
+		goto out_unmap;
+	ret = check_ssh_key_header(blob, decoded_size);
+	if (ret < 0)
+		goto out_unmap;
+	ret = read_rsa_bignums(blob + ret, decoded_size - ret, &key->rsa);
+	if (ret < 0)
+		goto out_unmap;
+	ret = RSA_size(key->rsa);
+out_unmap:
+	ret2 = para_munmap(map, map_size);
+	if (ret >= 0 && ret2 < 0)
+		ret = ret2;
+out:
+	if (ret < 0) {
+		free(key);
+		*result = NULL;
+		PARA_ERROR_LOG("key %s: %s\n", key_file, para_strerror(-ret));
+	} else
+		*result = key;
+	free(blob);
 	return ret;
 }
 
-/**
- * encrypt a buffer using an RSA key
- *
- * \param rsa: public rsa key
- * \param inbuf the input buffer
- * \param len the length of \a inbuf
- * \param outbuf the output buffer
- *
- * \return The size of the encrypted data on success, negative on errors
- *
- * \sa RSA_public_encrypt(3)
- */
-int para_encrypt_buffer(RSA *rsa, unsigned char *inbuf,
+void free_public_key(struct asymmetric_key *key)
+{
+	if (!key)
+		return;
+	RSA_free(key->rsa);
+	free(key);
+}
+
+int priv_decrypt(const char *key_file, unsigned char *outbuf,
+		unsigned char *inbuf, int inlen)
+{
+	struct asymmetric_key *priv;
+	int ret;
+
+	ret = check_private_key_file(key_file);
+	if (ret < 0)
+		return ret;
+	if (inlen < 0)
+		return -E_RSA;
+	priv = para_malloc(sizeof(*priv));
+	ret = get_private_key(key_file, &priv->rsa);
+	if (ret < 0) {
+		free(priv);
+		return ret;
+	}
+	/*
+	 * RSA is vulnerable to timing attacks. Generate a random blinding
+	 * factor to protect against this kind of attack.
+	 */
+	ret = -E_BLINDING;
+	if (RSA_blinding_on(priv->rsa, NULL) == 0)
+		goto out;
+	ret = RSA_private_decrypt(inlen, inbuf, outbuf, priv->rsa,
+		RSA_PKCS1_OAEP_PADDING);
+	RSA_blinding_off(priv->rsa);
+	if (ret <= 0)
+		ret = -E_DECRYPT;
+out:
+	RSA_free(priv->rsa);
+	free(priv);
+	return ret;
+}
+
+int pub_encrypt(struct asymmetric_key *pub, unsigned char *inbuf,
 		unsigned len, unsigned char *outbuf)
 {
 	int ret, flen = len; /* RSA_public_encrypt expects a signed int */
 
 	if (flen < 0)
 		return -E_ENCRYPT;
-	ret = RSA_public_encrypt(flen, inbuf, outbuf, rsa, RSA_PKCS1_PADDING);
-	return ret < 0?  -E_ENCRYPT : ret;
+	ret = RSA_public_encrypt(flen, inbuf, outbuf, pub->rsa,
+		RSA_PKCS1_OAEP_PADDING);
+	return ret < 0? -E_ENCRYPT : ret;
 }
 
-/**
- * encrypt the given challenge number
- *
- * \param rsa: public rsa key
- * \param challenge_nr the number to be encrypted
- * \param outbuf the output buffer
- *
- * \a outbuf must be at least 64 bytes long
- *
- * \return The size of the encrypted data on success, negative on errors
- *
- * \sa para_encrypt_buffer()
- *
- */
-int para_encrypt_challenge(RSA* rsa, long unsigned challenge_nr,
-	unsigned char *outbuf)
+struct stream_cipher {
+	EVP_CIPHER_CTX *aes;
+};
+
+struct stream_cipher *sc_new(const unsigned char *data, int len)
 {
-	unsigned char *inbuf = (unsigned char*) make_message("%lu", challenge_nr);
-	int ret = para_encrypt_buffer(rsa, inbuf, strlen((char *)inbuf), outbuf);
-	free(inbuf);
-	return ret;
+	struct stream_cipher *sc = para_malloc(sizeof(*sc));
+
+	assert(len >= 2 * AES_CRT128_BLOCK_SIZE);
+	sc->aes = EVP_CIPHER_CTX_new();
+	EVP_EncryptInit_ex(sc->aes, EVP_aes_128_ctr(), NULL, data,
+		data + AES_CRT128_BLOCK_SIZE);
+	return sc;
+}
+
+void sc_free(struct stream_cipher *sc)
+{
+	if (!sc)
+		return;
+	EVP_CIPHER_CTX_free(sc->aes);
+	free(sc);
 }
 
+static void aes_ctr128_crypt(EVP_CIPHER_CTX *ctx, struct iovec *src,
+		struct iovec *dst)
+{
+	int ret, inlen = src->iov_len, outlen, tmplen;
+
+	*dst = (typeof(*dst)) {
+		/* Add one for the terminating zero byte. */
+		.iov_base = para_malloc(inlen + 1),
+		.iov_len = inlen
+	};
+	ret = EVP_EncryptUpdate(ctx, dst->iov_base, &outlen, src->iov_base, inlen);
+	assert(ret != 0);
+	ret = EVP_EncryptFinal_ex(ctx, dst->iov_base + outlen, &tmplen);
+	assert(ret != 0);
+	outlen += tmplen;
+	((char *)dst->iov_base)[outlen] = '\0';
+	dst->iov_len = outlen;
+}
+
+void sc_crypt(struct stream_cipher *sc, struct iovec *src, struct iovec *dst)
+{
+	return aes_ctr128_crypt(sc->aes, src, dst);
+}
+
+void hash_function(const char *data, unsigned long len, unsigned char *hash)
+{
+	SHA_CTX c;
+	SHA1_Init(&c);
+	SHA1_Update(&c, data, len);
+	SHA1_Final(hash, &c);
+}