X-Git-Url: http://git.tuebingen.mpg.de/?p=paraslash.git;a=blobdiff_plain;f=crypt.c;h=7b602d995d3deccaba5e2e6ab76f4dec5570c95b;hp=ba2e7df0c4c8cd2b88200f198c5dff8ae0db1155;hb=6a7393e2abdcf30dd4201b84a417d08f6136e8d6;hpb=df3c03e72911edb31e7f1e32ebe29dad063e3b70 diff --git a/crypt.c b/crypt.c index ba2e7df0..7b602d99 100644 --- a/crypt.c +++ b/crypt.c @@ -1,33 +1,89 @@ /* - * Copyright (C) 2005-2007 Andre Noll + * Copyright (C) 2005-2011 Andre Noll * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111, USA. + * Licensed under the GPL v2. For licencing details see COPYING. */ -/** \file crypt.c openssl-based RSA encryption/decryption routines */ +/** \file crypt.c Openssl-based encryption/decryption routines. */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include #include "para.h" #include "error.h" #include "string.h" #include "crypt.h" +#include "fd.h" +#include "crypt_backend.h" + +struct asymmetric_key { + RSA *rsa; +}; + +/** + * Fill a buffer with random content. + * + * \param buf The buffer to fill. + * \param num The size of \a buf in bytes. + * + * This function puts \a num cryptographically strong pseudo-random bytes into + * buf. If libssl can not guarantee an unpredictable byte sequence (for example + * because the PRNG has not been seeded with enough randomness) the function + * logs an error message and calls exit(). + */ +void get_random_bytes_or_die(unsigned char *buf, int num) +{ + unsigned long err; + + /* RAND_bytes() returns 1 on success, 0 otherwise. */ + if (RAND_bytes(buf, num) == 1) + return; + err = ERR_get_error(); + PARA_EMERG_LOG("%s\n", ERR_reason_error_string(err)); + exit(EXIT_FAILURE); +} + +/** + * Seed pseudo random number generators. + * + * This function reads 64 bytes from /dev/urandom and adds them to the SSL + * PRNG. It also seeds the PRNG used by random() with a random seed obtained + * from SSL. If /dev/random could not be read, an error message is logged and + * the function calls exit(). + * + * \sa RAND_load_file(3), \ref get_random_bytes_or_die(), srandom(3), + * random(3), \ref para_random(). + */ +void init_random_seed_or_die(void) +{ + int seed, ret = RAND_load_file("/dev/urandom", 64); + + if (ret != 64) { + PARA_EMERG_LOG("could not seed PRNG (ret = %d)\n", ret); + exit(EXIT_FAILURE); + } + get_random_bytes_or_die((unsigned char *)&seed, sizeof(seed)); + srandom(seed); +} static EVP_PKEY *load_key(const char *file, int private) { BIO *key; EVP_PKEY *pkey = NULL; + int ret = check_key_file(file, private); + if (ret < 0) { + PARA_ERROR_LOG("%s\n", para_strerror(-ret)); + return NULL; + } key = BIO_new(BIO_s_file()); if (!key) return NULL; @@ -41,18 +97,7 @@ static EVP_PKEY *load_key(const char *file, int private) return pkey; } -/** - * read an RSA key from a file - * - * \param key_file the file containing the key - * \param rsa RSA structure is returned here - * \param private if non-zero, read the private key, otherwise the public key - * - * \return The size of the RSA key on success, negative on errors. - * - * \sa openssl(1), rsa(1). - */ -int get_rsa_key(char *key_file, RSA **rsa, int private) +static int get_openssl_key(const char *key_file, RSA **rsa, int private) { EVP_PKEY *key = load_key(key_file, private); @@ -66,26 +111,154 @@ int get_rsa_key(char *key_file, RSA **rsa, int private) return RSA_size(*rsa); } +/* + * The public key loading functions below were inspired by corresponding code + * of openssh-5.2p1, Copyright (c) 1995 Tatu Ylonen , Espoo, + * Finland. However, not much of the original code remains. + */ + +static int read_bignum(const unsigned char *buf, size_t len, BIGNUM **result) +{ + const unsigned char *p = buf, *end = buf + len; + uint32_t bnsize; + BIGNUM *bn; + + if (p + 4 < p) + return -E_BIGNUM; + if (p + 4 > end) + return -E_BIGNUM; + bnsize = read_ssh_u32(p); + PARA_DEBUG_LOG("bnsize: %u\n", bnsize); + p += 4; + if (p + bnsize < p) + return -E_BIGNUM; + if (p + bnsize > end) + return -E_BIGNUM; + if (bnsize > 8192) + return -E_BIGNUM; + bn = BN_bin2bn(p, bnsize, NULL); + if (!bn) + return -E_BIGNUM; + *result = bn; + return bnsize + 4; +} + +static int read_rsa_bignums(const unsigned char *blob, int blen, RSA **result) +{ + int ret; + RSA *rsa; + const unsigned char *p = blob, *end = blob + blen; + + rsa = RSA_new(); + if (!rsa) + return -E_BIGNUM; + ret = read_bignum(p, end - p, &rsa->e); + if (ret < 0) + goto fail; + p += ret; + ret = read_bignum(p, end - p, &rsa->n); + if (ret < 0) + goto fail; + *result = rsa; + return 1; +fail: + if (rsa) + RSA_free(rsa); + return ret; +} + /** - * free an RSA structure + * Read an asymmetric key from a file. + * + * \param key_file The file containing the key. + * \param private if non-zero, read the private key, otherwise the public key. + * \param result The key structure is returned here. * - * \param rsa pointer to the RSA struct to free + * \return The size of the key on success, negative on errors. * - * This must be called for any key obtained by get_rsa_key(). + * \sa openssl(1), rsa(1). */ -void rsa_free(RSA *rsa) +int get_asymmetric_key(const char *key_file, int private, + struct asymmetric_key **result) { - if (rsa) - RSA_free(rsa); + struct asymmetric_key *key = NULL; + void *map = NULL; + unsigned char *blob = NULL; + size_t map_size, blob_size, decoded_size; + int ret, ret2; + char *cp; + + key = para_malloc(sizeof(*key)); + if (private) { + ret = get_openssl_key(key_file, &key->rsa, LOAD_PRIVATE_KEY); + goto out; + } + ret = mmap_full_file(key_file, O_RDONLY, &map, &map_size, NULL); + if (ret < 0) + goto out; + ret = is_ssh_rsa_key(map, map_size); + if (!ret) { + ret = para_munmap(map, map_size); + map = NULL; + if (ret < 0) + goto out; + ret = get_openssl_key(key_file, &key->rsa, LOAD_PUBLIC_KEY); + goto out; + } + cp = map + ret; + PARA_INFO_LOG("decoding public rsa-ssh key %s\n", key_file); + ret = -ERRNO_TO_PARA_ERROR(EOVERFLOW); + if (map_size > INT_MAX / 4) + goto out; + blob_size = 2 * map_size; + blob = para_malloc(blob_size); + ret = uudecode(cp, blob, blob_size); + if (ret < 0) + goto out; + decoded_size = ret; + ret = check_ssh_key_header(blob, decoded_size); + if (ret < 0) + goto out; + ret = read_rsa_bignums(blob + ret, decoded_size - ret, &key->rsa); + if (ret < 0) + goto out; + ret = RSA_size(key->rsa); +out: + ret2 = para_munmap(map, map_size); + if (ret >= 0 && ret2 < 0) + ret = ret2; + if (ret < 0) { + free(key); + result = NULL; + PARA_ERROR_LOG("key %s: %s\n", key_file, para_strerror(-ret)); + } else + *result = key; + free(blob); + return ret; +} + +/** + * Deallocate an asymmetric key structure. + * + * \param key Pointer to the key structure to free. + * + * This must be called for any key obtained by get_asymmetric_key(). + */ +void free_asymmetric_key(struct asymmetric_key *key) +{ + if (!key) + return; + RSA_free(key->rsa); + free(key); } /** - * decrypt a buffer using an RSA key + * Decrypt a buffer using a private key. * - * \param key_file full path of the rsa key - * \param outbuf the output buffer - * \param inbuf the encrypted input buffer - * \param rsa_inlen the length of \a inbuf + * \param key_file Full path of the key. + * \param outbuf The output buffer. + * \param inbuf The encrypted input buffer. + * \param inlen The length of \a inbuf in bytes. * * The \a outbuf must be large enough to hold at least \a rsa_inlen bytes. * @@ -93,92 +266,166 @@ void rsa_free(RSA *rsa) * * \sa RSA_private_decrypt(3) **/ -int para_decrypt_buffer(char *key_file, unsigned char *outbuf, unsigned char *inbuf, - unsigned rsa_inlen) +int priv_decrypt(const char *key_file, unsigned char *outbuf, + unsigned char *inbuf, int inlen) { - RSA *rsa; - int ret, inlen = rsa_inlen; + struct asymmetric_key *priv; + int ret; if (inlen < 0) return -E_RSA; - ret = get_rsa_key(key_file, &rsa, LOAD_PRIVATE_KEY); + ret = get_asymmetric_key(key_file, LOAD_PRIVATE_KEY, &priv); if (ret < 0) return ret; - ret = RSA_private_decrypt(inlen, inbuf, outbuf, rsa, RSA_PKCS1_PADDING); - rsa_free(rsa); - return (ret > 0)? ret : -E_DECRYPT; + /* + * RSA is vulnerable to timing attacks. Generate a random blinding + * factor to protect against this kind of attack. + */ + ret = -E_BLINDING; + if (RSA_blinding_on(priv->rsa, NULL) == 0) + goto out; + ret = RSA_private_decrypt(inlen, inbuf, outbuf, priv->rsa, + RSA_PKCS1_OAEP_PADDING); + RSA_blinding_off(priv->rsa); + if (ret <= 0) + ret = -E_DECRYPT; +out: + free_asymmetric_key(priv); + return ret; } /** - * decrypt the challenge number sent by para_server + * Encrypt a buffer using an RSA key * - * \param key_file full path of the rsa key - * \param challenge_nr result is stored here - * \param inbuf the input buffer - * \param rsa_inlen the length of \a inbuf + * \param pub: The public key. + * \param inbuf The input buffer. + * \param len The length of \a inbuf. + * \param outbuf The output buffer. * - * \return positive on success, negative on errors + * \return The size of the encrypted data on success, negative on errors. * - * \sa para_decrypt_buffer() + * \sa RSA_public_encrypt(3) */ -int para_decrypt_challenge(char *key_file, long unsigned *challenge_nr, - unsigned char *inbuf, unsigned rsa_inlen) +int pub_encrypt(struct asymmetric_key *pub, unsigned char *inbuf, + unsigned len, unsigned char *outbuf) { - unsigned char *rsa_out = OPENSSL_malloc(rsa_inlen + 1); - int ret = para_decrypt_buffer(key_file, rsa_out, inbuf, rsa_inlen); + int ret, flen = len; /* RSA_public_encrypt expects a signed int */ - if (ret >= 0) { - rsa_out[ret] = '\0'; - ret = sscanf((char *)rsa_out, "%lu", challenge_nr) == 1? - 1 : -E_CHALLENGE; - } - OPENSSL_free(rsa_out); - return ret; + if (flen < 0) + return -E_ENCRYPT; + ret = RSA_public_encrypt(flen, inbuf, outbuf, pub->rsa, + RSA_PKCS1_OAEP_PADDING); + return ret < 0? -E_ENCRYPT : ret; } +struct stream_cipher { + RC4_KEY key; +}; + /** - * encrypt a buffer using an RSA key - * - * \param rsa: public rsa key - * \param inbuf the input buffer - * \param len the length of \a inbuf - * \param outbuf the output buffer + * Allocate and initialize a stream cipher structure. * - * \return The size of the encrypted data on success, negative on errors + * \param data The key. + * \param len The size of the key. * - * \sa RSA_public_encrypt(3) + * \return A new stream cipher structure. */ -int para_encrypt_buffer(RSA *rsa, unsigned char *inbuf, - unsigned len, unsigned char *outbuf) +struct stream_cipher *sc_new(const unsigned char *data, int len) { - int ret, flen = len; /* RSA_public_encrypt expects a signed int */ + struct stream_cipher *sc = para_malloc(sizeof(*sc)); + RC4_set_key(&sc->key, len, data); + return sc; +} - if (flen < 0) - return -E_ENCRYPT; - ret = RSA_public_encrypt(flen, inbuf, outbuf, rsa, RSA_PKCS1_PADDING); - return ret < 0? -E_ENCRYPT : ret; +/** + * Deallocate a stream cipher structure. + * + * \param sc A stream cipher previously obtained by sc_new(). + */ +void sc_free(struct stream_cipher *sc) +{ + free(sc); } /** - * encrypt the given challenge number + * The RC4() implementation of openssl apparently reads and writes data in + * blocks of 8 bytes. So we have to make sure our buffer sizes are a multiple + * of this. + */ +#define RC4_ALIGN 8 + +/** + * Encrypt and send a buffer. * - * \param rsa: public rsa key - * \param challenge_nr the number to be encrypted - * \param outbuf the output buffer + * \param scc The context. + * \param buf The buffer to send. + * \param len The size of \a buf in bytes. * - * \a outbuf must be at least 64 bytes long + * \return The return value of the underyling call to write_all(). + * + * \sa \ref write_all(), RC4(3). + */ +int sc_send_bin_buffer(struct stream_cipher_context *scc, const char *buf, + size_t len) +{ + int ret; + unsigned char *tmp; + static unsigned char remainder[RC4_ALIGN]; + size_t l1 = ROUND_DOWN(len, RC4_ALIGN), l2 = ROUND_UP(len, RC4_ALIGN); + + assert(len); + tmp = para_malloc(l2); + RC4(&scc->send->key, l1, (const unsigned char *)buf, tmp); + if (len > l1) { + memcpy(remainder, buf + l1, len - l1); + RC4(&scc->send->key, len - l1, remainder, tmp + l1); + } + ret = write_all(scc->fd, (char *)tmp, &len); + free(tmp); + return ret; +} + +/** + * Receive a buffer and decrypt it. * - * \return The size of the encrypted data on success, negative on errors + * \param scc The context. + * \param buf The buffer to write the decrypted data to. + * \param size The size of \a buf. * - * \sa para_encrypt_buffer() + * \return The number of bytes received on success, negative on errors, zero if + * the peer has performed an orderly shutdown. * + * \sa recv(2), RC4(3). */ -int para_encrypt_challenge(RSA* rsa, long unsigned challenge_nr, - unsigned char *outbuf) +int sc_recv_bin_buffer(struct stream_cipher_context *scc, char *buf, + size_t size) { - unsigned char *inbuf = (unsigned char*) make_message("%lu", challenge_nr); - int ret = para_encrypt_buffer(rsa, inbuf, strlen((char *)inbuf), outbuf); - free(inbuf); + unsigned char *tmp = para_malloc(size); + ssize_t ret = recv(scc->fd, tmp, size, 0); + + if (ret > 0) + RC4(&scc->recv->key, ret, tmp, (unsigned char *)buf); + else if (ret < 0) + ret = -ERRNO_TO_PARA_ERROR(errno); + free(tmp); return ret; } +/** + * Compute the hash of the given input data. + * + * \param data Pointer to the data to compute the hash value from. + * \param len The length of \a data in bytes. + * \param hash Result pointer. + * + * \a hash must point to an area at least \p HASH_SIZE bytes large. + * + * \sa sha(3), openssl(1). + * */ +void hash_function(const char *data, unsigned long len, unsigned char *hash) +{ + SHA_CTX c; + SHA1_Init(&c); + SHA1_Update(&c, data, len); + SHA1_Final(hash, &c); +}