blob: d529c83408fafd8c9f12e4952461186551b2ecb1 [file] [log] [blame]
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001/*
Damien Miller95def091999-11-25 00:26:21 +11002 * Author: Tatu Ylonen <ylo@cs.hut.fi>
Damien Miller95def091999-11-25 00:26:21 +11003 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4 * All rights reserved
Damien Miller95def091999-11-25 00:26:21 +11005 * This file contains functions for reading and writing identity files, and
6 * for reading the passphrase from the user.
Damien Miller4af51302000-04-16 11:18:38 +10007 *
Damien Millere4340be2000-09-16 13:29:08 +11008 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose. Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
13 *
14 *
15 * Copyright (c) 2000 Markus Friedl. All rights reserved.
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions
19 * are met:
20 * 1. Redistributions of source code must retain the above copyright
21 * notice, this list of conditions and the following disclaimer.
22 * 2. Redistributions in binary form must reproduce the above copyright
23 * notice, this list of conditions and the following disclaimer in the
24 * documentation and/or other materials provided with the distribution.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Damien Miller95def091999-11-25 00:26:21 +110036 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100037
38#include "includes.h"
Damien Millerf17883e2006-03-15 11:45:54 +110039
40#include <sys/types.h>
41#include <sys/stat.h>
Damien Millerd4a8b7e1999-10-27 13:42:43 +100042
Damien Miller0bc1bd82000-11-13 22:57:25 +110043#include <openssl/err.h>
Damien Millereba71ba2000-04-29 23:57:08 +100044#include <openssl/evp.h>
Ben Lindstrom226cfa02001-01-22 05:34:40 +000045#include <openssl/pem.h>
Damien Millereba71ba2000-04-29 23:57:08 +100046
Ben Lindstrom226cfa02001-01-22 05:34:40 +000047#include "cipher.h"
Damien Millerd4a8b7e1999-10-27 13:42:43 +100048#include "xmalloc.h"
49#include "buffer.h"
50#include "bufaux.h"
Damien Millereba71ba2000-04-29 23:57:08 +100051#include "key.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000052#include "ssh.h"
53#include "log.h"
Ben Lindstrom31ca54a2001-02-09 02:11:24 +000054#include "authfile.h"
Damien Miller040b64f2002-01-22 23:10:04 +110055#include "rsa.h"
Darren Tuckerf0f90982004-12-11 13:39:50 +110056#include "misc.h"
Damien Millereccb9de2005-06-17 12:59:34 +100057#include "atomicio.h"
Damien Millerd4a8b7e1999-10-27 13:42:43 +100058
Ben Lindstromd0fca422001-03-26 13:44:06 +000059/* Version identification string for SSH v1 identity files. */
Ben Lindstrom1170d712001-01-29 07:51:26 +000060static const char authfile_id_string[] =
61 "SSH PRIVATE KEY FILE FORMAT 1.1\n";
Damien Millerd4a8b7e1999-10-27 13:42:43 +100062
Damien Miller5428f641999-11-25 11:54:57 +110063/*
64 * Saves the authentication (private) key in a file, encrypting it with
65 * passphrase. The identification of the file (lowest 64 bits of n) will
66 * precede the key to provide identification of the key without needing a
67 * passphrase.
68 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100069
Ben Lindstrombba81212001-06-25 05:01:22 +000070static int
Ben Lindstromd0fca422001-03-26 13:44:06 +000071key_save_private_rsa1(Key *key, const char *filename, const char *passphrase,
72 const char *comment)
Damien Millerd4a8b7e1999-10-27 13:42:43 +100073{
Damien Miller95def091999-11-25 00:26:21 +110074 Buffer buffer, encrypted;
Damien Miller708d21c2002-01-22 23:18:15 +110075 u_char buf[100], *cp;
Damien Miller963f6b22002-02-19 15:21:23 +110076 int fd, i, cipher_num;
Damien Miller874d77b2000-10-14 16:23:11 +110077 CipherContext ciphercontext;
78 Cipher *cipher;
Darren Tucker3f9fdc72004-06-22 12:56:01 +100079 u_int32_t rnd;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100080
Damien Miller5428f641999-11-25 11:54:57 +110081 /*
82 * If the passphrase is empty, use SSH_CIPHER_NONE to ease converting
83 * to another cipher; otherwise use SSH_AUTHFILE_CIPHER.
84 */
Damien Miller963f6b22002-02-19 15:21:23 +110085 cipher_num = (strcmp(passphrase, "") == 0) ?
86 SSH_CIPHER_NONE : SSH_AUTHFILE_CIPHER;
87 if ((cipher = cipher_by_number(cipher_num)) == NULL)
Damien Miller874d77b2000-10-14 16:23:11 +110088 fatal("save_private_key_rsa: bad cipher");
Damien Millerd4a8b7e1999-10-27 13:42:43 +100089
Damien Miller95def091999-11-25 00:26:21 +110090 /* This buffer is used to built the secret part of the private key. */
91 buffer_init(&buffer);
Damien Millerd4a8b7e1999-10-27 13:42:43 +100092
Damien Miller95def091999-11-25 00:26:21 +110093 /* Put checkbytes for checking passphrase validity. */
Darren Tucker3f9fdc72004-06-22 12:56:01 +100094 rnd = arc4random();
95 buf[0] = rnd & 0xff;
96 buf[1] = (rnd >> 8) & 0xff;
Damien Miller95def091999-11-25 00:26:21 +110097 buf[2] = buf[0];
98 buf[3] = buf[1];
99 buffer_append(&buffer, buf, 4);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000100
Damien Miller5428f641999-11-25 11:54:57 +1100101 /*
102 * Store the private key (n and e will not be stored because they
103 * will be stored in plain text, and storing them also in encrypted
104 * format would just give known plaintext).
105 */
Ben Lindstromd0fca422001-03-26 13:44:06 +0000106 buffer_put_bignum(&buffer, key->rsa->d);
107 buffer_put_bignum(&buffer, key->rsa->iqmp);
108 buffer_put_bignum(&buffer, key->rsa->q); /* reverse from SSL p */
109 buffer_put_bignum(&buffer, key->rsa->p); /* reverse from SSL q */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000110
Damien Miller95def091999-11-25 00:26:21 +1100111 /* Pad the part to be encrypted until its size is a multiple of 8. */
112 while (buffer_len(&buffer) % 8 != 0)
113 buffer_put_char(&buffer, 0);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000114
Damien Miller95def091999-11-25 00:26:21 +1100115 /* This buffer will be used to contain the data in the file. */
116 buffer_init(&encrypted);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000117
Damien Miller95def091999-11-25 00:26:21 +1100118 /* First store keyfile id string. */
Ben Lindstrom1170d712001-01-29 07:51:26 +0000119 for (i = 0; authfile_id_string[i]; i++)
120 buffer_put_char(&encrypted, authfile_id_string[i]);
Damien Miller95def091999-11-25 00:26:21 +1100121 buffer_put_char(&encrypted, 0);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000122
Damien Miller95def091999-11-25 00:26:21 +1100123 /* Store cipher type. */
Damien Miller963f6b22002-02-19 15:21:23 +1100124 buffer_put_char(&encrypted, cipher_num);
Damien Miller95def091999-11-25 00:26:21 +1100125 buffer_put_int(&encrypted, 0); /* For future extension */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000126
Damien Miller95def091999-11-25 00:26:21 +1100127 /* Store public key. This will be in plain text. */
Ben Lindstromd0fca422001-03-26 13:44:06 +0000128 buffer_put_int(&encrypted, BN_num_bits(key->rsa->n));
129 buffer_put_bignum(&encrypted, key->rsa->n);
130 buffer_put_bignum(&encrypted, key->rsa->e);
Ben Lindstrom664408d2001-06-09 01:42:01 +0000131 buffer_put_cstring(&encrypted, comment);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000132
Damien Miller95def091999-11-25 00:26:21 +1100133 /* Allocate space for the private part of the key in the buffer. */
Damien Miller5a6b4fe2001-12-21 14:56:54 +1100134 cp = buffer_append_space(&encrypted, buffer_len(&buffer));
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000135
Damien Miller963f6b22002-02-19 15:21:23 +1100136 cipher_set_key_string(&ciphercontext, cipher, passphrase,
137 CIPHER_ENCRYPT);
138 cipher_crypt(&ciphercontext, cp,
Damien Miller708d21c2002-01-22 23:18:15 +1100139 buffer_ptr(&buffer), buffer_len(&buffer));
Damien Miller963f6b22002-02-19 15:21:23 +1100140 cipher_cleanup(&ciphercontext);
Damien Miller874d77b2000-10-14 16:23:11 +1100141 memset(&ciphercontext, 0, sizeof(ciphercontext));
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000142
Damien Miller95def091999-11-25 00:26:21 +1100143 /* Destroy temporary data. */
144 memset(buf, 0, sizeof(buf));
145 buffer_free(&buffer);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000146
Damien Miller037a0dc1999-12-07 15:38:31 +1100147 fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC, 0600);
Ben Lindstrom15f33862001-04-16 02:00:02 +0000148 if (fd < 0) {
149 error("open %s failed: %s.", filename, strerror(errno));
Darren Tuckerd1d41b32003-09-22 21:01:27 +1000150 buffer_free(&encrypted);
Damien Miller95def091999-11-25 00:26:21 +1100151 return 0;
Ben Lindstrom15f33862001-04-16 02:00:02 +0000152 }
Damien Millereccb9de2005-06-17 12:59:34 +1000153 if (atomicio(vwrite, fd, buffer_ptr(&encrypted),
154 buffer_len(&encrypted)) != buffer_len(&encrypted)) {
Ben Lindstrom15f33862001-04-16 02:00:02 +0000155 error("write to key file %s failed: %s", filename,
Damien Miller9f0f5c62001-12-21 14:45:46 +1100156 strerror(errno));
Damien Miller95def091999-11-25 00:26:21 +1100157 buffer_free(&encrypted);
Damien Miller037a0dc1999-12-07 15:38:31 +1100158 close(fd);
Damien Miller78315eb2000-09-29 23:01:36 +1100159 unlink(filename);
Damien Miller95def091999-11-25 00:26:21 +1100160 return 0;
161 }
Damien Miller037a0dc1999-12-07 15:38:31 +1100162 close(fd);
Damien Miller95def091999-11-25 00:26:21 +1100163 buffer_free(&encrypted);
164 return 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000165}
166
Ben Lindstromd0fca422001-03-26 13:44:06 +0000167/* save SSH v2 key in OpenSSL PEM format */
Ben Lindstrombba81212001-06-25 05:01:22 +0000168static int
Ben Lindstromd0fca422001-03-26 13:44:06 +0000169key_save_private_pem(Key *key, const char *filename, const char *_passphrase,
170 const char *comment)
Damien Millereba71ba2000-04-29 23:57:08 +1000171{
172 FILE *fp;
173 int fd;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100174 int success = 0;
175 int len = strlen(_passphrase);
Ben Lindstrom90fd8142002-02-26 18:09:42 +0000176 u_char *passphrase = (len > 0) ? (u_char *)_passphrase : NULL;
Ben Lindstrom80cb27d2002-03-05 01:33:36 +0000177 const EVP_CIPHER *cipher = (len > 0) ? EVP_des_ede3_cbc() : NULL;
Damien Millereba71ba2000-04-29 23:57:08 +1000178
179 if (len > 0 && len <= 4) {
Ben Lindstrom15f33862001-04-16 02:00:02 +0000180 error("passphrase too short: have %d bytes, need > 4", len);
Damien Millereba71ba2000-04-29 23:57:08 +1000181 return 0;
182 }
183 fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC, 0600);
184 if (fd < 0) {
Ben Lindstrom15f33862001-04-16 02:00:02 +0000185 error("open %s failed: %s.", filename, strerror(errno));
Damien Millereba71ba2000-04-29 23:57:08 +1000186 return 0;
187 }
188 fp = fdopen(fd, "w");
189 if (fp == NULL ) {
Ben Lindstrom15f33862001-04-16 02:00:02 +0000190 error("fdopen %s failed: %s.", filename, strerror(errno));
Damien Millereba71ba2000-04-29 23:57:08 +1000191 close(fd);
192 return 0;
193 }
Damien Miller0bc1bd82000-11-13 22:57:25 +1100194 switch (key->type) {
Ben Lindstromc1116602001-03-29 00:28:37 +0000195 case KEY_DSA:
196 success = PEM_write_DSAPrivateKey(fp, key->dsa,
197 cipher, passphrase, len, NULL, NULL);
198 break;
199 case KEY_RSA:
200 success = PEM_write_RSAPrivateKey(fp, key->rsa,
201 cipher, passphrase, len, NULL, NULL);
202 break;
Damien Millereba71ba2000-04-29 23:57:08 +1000203 }
204 fclose(fp);
205 return success;
206}
207
208int
Ben Lindstromd0fca422001-03-26 13:44:06 +0000209key_save_private(Key *key, const char *filename, const char *passphrase,
Damien Millereba71ba2000-04-29 23:57:08 +1000210 const char *comment)
211{
212 switch (key->type) {
Damien Miller0bc1bd82000-11-13 22:57:25 +1100213 case KEY_RSA1:
Ben Lindstromd0fca422001-03-26 13:44:06 +0000214 return key_save_private_rsa1(key, filename, passphrase,
215 comment);
Damien Millereba71ba2000-04-29 23:57:08 +1000216 break;
217 case KEY_DSA:
Damien Miller0bc1bd82000-11-13 22:57:25 +1100218 case KEY_RSA:
Ben Lindstromd0fca422001-03-26 13:44:06 +0000219 return key_save_private_pem(key, filename, passphrase,
220 comment);
Damien Millereba71ba2000-04-29 23:57:08 +1000221 break;
222 default:
223 break;
224 }
Ben Lindstrom15f33862001-04-16 02:00:02 +0000225 error("key_save_private: cannot save key type %d", key->type);
Damien Millereba71ba2000-04-29 23:57:08 +1000226 return 0;
227}
228
Damien Miller5428f641999-11-25 11:54:57 +1100229/*
Ben Lindstromd0fca422001-03-26 13:44:06 +0000230 * Loads the public part of the ssh v1 key file. Returns NULL if an error was
231 * encountered (the file does not exist or is not readable), and the key
Damien Miller5428f641999-11-25 11:54:57 +1100232 * otherwise.
233 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000234
Ben Lindstrombba81212001-06-25 05:01:22 +0000235static Key *
Ben Lindstromd0fca422001-03-26 13:44:06 +0000236key_load_public_rsa1(int fd, const char *filename, char **commentp)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000237{
Damien Miller95def091999-11-25 00:26:21 +1100238 Buffer buffer;
Ben Lindstromd0fca422001-03-26 13:44:06 +0000239 Key *pub;
Ben Lindstrom44adb8f2002-12-23 02:00:23 +0000240 struct stat st;
Damien Miller95def091999-11-25 00:26:21 +1100241 char *cp;
Damien Millereccb9de2005-06-17 12:59:34 +1000242 u_int i;
Darren Tucker1f8311c2004-05-13 16:39:33 +1000243 size_t len;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000244
Ben Lindstrom44adb8f2002-12-23 02:00:23 +0000245 if (fstat(fd, &st) < 0) {
246 error("fstat for key file %.200s failed: %.100s",
247 filename, strerror(errno));
248 return NULL;
249 }
Darren Tuckerf4b43712004-08-29 16:28:39 +1000250 if (st.st_size > 1*1024*1024) {
251 error("key file %.200s too large", filename);
252 return NULL;
253 }
Darren Tucker1f8311c2004-05-13 16:39:33 +1000254 len = (size_t)st.st_size; /* truncated */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000255
Damien Miller95def091999-11-25 00:26:21 +1100256 buffer_init(&buffer);
Damien Miller5a6b4fe2001-12-21 14:56:54 +1100257 cp = buffer_append_space(&buffer, len);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000258
Damien Millereccb9de2005-06-17 12:59:34 +1000259 if (atomicio(read, fd, cp, len) != len) {
Damien Miller95def091999-11-25 00:26:21 +1100260 debug("Read from key file %.200s failed: %.100s", filename,
Damien Millereba71ba2000-04-29 23:57:08 +1000261 strerror(errno));
Damien Miller95def091999-11-25 00:26:21 +1100262 buffer_free(&buffer);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000263 return NULL;
Damien Miller95def091999-11-25 00:26:21 +1100264 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000265
Ben Lindstrom1170d712001-01-29 07:51:26 +0000266 /* Check that it is at least big enough to contain the ID string. */
267 if (len < sizeof(authfile_id_string)) {
Damien Miller058655c2001-10-10 15:03:36 +1000268 debug3("Not a RSA1 key file %.200s.", filename);
Damien Miller95def091999-11-25 00:26:21 +1100269 buffer_free(&buffer);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000270 return NULL;
Damien Miller95def091999-11-25 00:26:21 +1100271 }
Damien Miller5428f641999-11-25 11:54:57 +1100272 /*
273 * Make sure it begins with the id string. Consume the id string
274 * from the buffer.
275 */
Ben Lindstrom1170d712001-01-29 07:51:26 +0000276 for (i = 0; i < sizeof(authfile_id_string); i++)
277 if (buffer_get_char(&buffer) != authfile_id_string[i]) {
Damien Miller058655c2001-10-10 15:03:36 +1000278 debug3("Not a RSA1 key file %.200s.", filename);
Damien Miller95def091999-11-25 00:26:21 +1100279 buffer_free(&buffer);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000280 return NULL;
Damien Miller95def091999-11-25 00:26:21 +1100281 }
282 /* Skip cipher type and reserved data. */
283 (void) buffer_get_char(&buffer); /* cipher type */
284 (void) buffer_get_int(&buffer); /* reserved */
285
286 /* Read the public key from the buffer. */
Ben Lindstromc5a7f4f2002-06-25 23:19:13 +0000287 (void) buffer_get_int(&buffer);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000288 pub = key_new(KEY_RSA1);
289 buffer_get_bignum(&buffer, pub->rsa->n);
290 buffer_get_bignum(&buffer, pub->rsa->e);
291 if (commentp)
292 *commentp = buffer_get_string(&buffer, NULL);
Damien Miller95def091999-11-25 00:26:21 +1100293 /* The encrypted private part is not parsed by this function. */
294
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000295 buffer_free(&buffer);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000296 return pub;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000297}
298
Ben Lindstromd0fca422001-03-26 13:44:06 +0000299/* load public key from private-key file, works only for SSH v1 */
300Key *
301key_load_public_type(int type, const char *filename, char **commentp)
Damien Millereba71ba2000-04-29 23:57:08 +1000302{
Ben Lindstromd0fca422001-03-26 13:44:06 +0000303 Key *pub;
304 int fd;
305
306 if (type == KEY_RSA1) {
307 fd = open(filename, O_RDONLY);
308 if (fd < 0)
309 return NULL;
310 pub = key_load_public_rsa1(fd, filename, commentp);
311 close(fd);
312 return pub;
Damien Millereba71ba2000-04-29 23:57:08 +1000313 }
Ben Lindstromd0fca422001-03-26 13:44:06 +0000314 return NULL;
Damien Millereba71ba2000-04-29 23:57:08 +1000315}
316
Damien Miller5428f641999-11-25 11:54:57 +1100317/*
318 * Loads the private key from the file. Returns 0 if an error is encountered
319 * (file does not exist or is not readable, or passphrase is bad). This
320 * initializes the private key.
321 * Assumes we are called under uid of the owner of the file.
322 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000323
Ben Lindstrombba81212001-06-25 05:01:22 +0000324static Key *
Ben Lindstromd0fca422001-03-26 13:44:06 +0000325key_load_private_rsa1(int fd, const char *filename, const char *passphrase,
326 char **commentp)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000327{
Damien Millereccb9de2005-06-17 12:59:34 +1000328 u_int i;
329 int check1, check2, cipher_type;
Darren Tucker1f8311c2004-05-13 16:39:33 +1000330 size_t len;
Damien Miller95def091999-11-25 00:26:21 +1100331 Buffer buffer, decrypted;
Damien Miller708d21c2002-01-22 23:18:15 +1100332 u_char *cp;
Damien Miller874d77b2000-10-14 16:23:11 +1100333 CipherContext ciphercontext;
334 Cipher *cipher;
Ben Lindstromd0fca422001-03-26 13:44:06 +0000335 Key *prv = NULL;
Ben Lindstrom44adb8f2002-12-23 02:00:23 +0000336 struct stat st;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000337
Ben Lindstrom44adb8f2002-12-23 02:00:23 +0000338 if (fstat(fd, &st) < 0) {
339 error("fstat for key file %.200s failed: %.100s",
340 filename, strerror(errno));
341 close(fd);
342 return NULL;
343 }
Darren Tucker1f8311c2004-05-13 16:39:33 +1000344 if (st.st_size > 1*1024*1024) {
Darren Tuckerf4b43712004-08-29 16:28:39 +1000345 error("key file %.200s too large", filename);
Darren Tucker1f8311c2004-05-13 16:39:33 +1000346 close(fd);
347 return (NULL);
348 }
349 len = (size_t)st.st_size; /* truncated */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000350
Damien Miller95def091999-11-25 00:26:21 +1100351 buffer_init(&buffer);
Damien Miller5a6b4fe2001-12-21 14:56:54 +1100352 cp = buffer_append_space(&buffer, len);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000353
Damien Millereccb9de2005-06-17 12:59:34 +1000354 if (atomicio(read, fd, cp, len) != len) {
Damien Miller95def091999-11-25 00:26:21 +1100355 debug("Read from key file %.200s failed: %.100s", filename,
Damien Miller0bc1bd82000-11-13 22:57:25 +1100356 strerror(errno));
Damien Miller95def091999-11-25 00:26:21 +1100357 buffer_free(&buffer);
Damien Miller037a0dc1999-12-07 15:38:31 +1100358 close(fd);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000359 return NULL;
Damien Miller95def091999-11-25 00:26:21 +1100360 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000361
Ben Lindstrom1170d712001-01-29 07:51:26 +0000362 /* Check that it is at least big enough to contain the ID string. */
363 if (len < sizeof(authfile_id_string)) {
Damien Miller058655c2001-10-10 15:03:36 +1000364 debug3("Not a RSA1 key file %.200s.", filename);
Damien Miller95def091999-11-25 00:26:21 +1100365 buffer_free(&buffer);
Ben Lindstromb257cca2001-03-05 04:59:27 +0000366 close(fd);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000367 return NULL;
Damien Miller95def091999-11-25 00:26:21 +1100368 }
Damien Miller5428f641999-11-25 11:54:57 +1100369 /*
370 * Make sure it begins with the id string. Consume the id string
371 * from the buffer.
372 */
Ben Lindstrom1170d712001-01-29 07:51:26 +0000373 for (i = 0; i < sizeof(authfile_id_string); i++)
374 if (buffer_get_char(&buffer) != authfile_id_string[i]) {
Damien Miller058655c2001-10-10 15:03:36 +1000375 debug3("Not a RSA1 key file %.200s.", filename);
Damien Miller95def091999-11-25 00:26:21 +1100376 buffer_free(&buffer);
Ben Lindstromb257cca2001-03-05 04:59:27 +0000377 close(fd);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000378 return NULL;
Damien Miller95def091999-11-25 00:26:21 +1100379 }
Ben Lindstromb257cca2001-03-05 04:59:27 +0000380
Damien Miller95def091999-11-25 00:26:21 +1100381 /* Read cipher type. */
382 cipher_type = buffer_get_char(&buffer);
383 (void) buffer_get_int(&buffer); /* Reserved data. */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000384
Damien Miller95def091999-11-25 00:26:21 +1100385 /* Read the public key from the buffer. */
Ben Lindstromc5a7f4f2002-06-25 23:19:13 +0000386 (void) buffer_get_int(&buffer);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000387 prv = key_new_private(KEY_RSA1);
388
389 buffer_get_bignum(&buffer, prv->rsa->n);
390 buffer_get_bignum(&buffer, prv->rsa->e);
391 if (commentp)
392 *commentp = buffer_get_string(&buffer, NULL);
Damien Miller95def091999-11-25 00:26:21 +1100393 else
394 xfree(buffer_get_string(&buffer, NULL));
395
396 /* Check that it is a supported cipher. */
Damien Miller874d77b2000-10-14 16:23:11 +1100397 cipher = cipher_by_number(cipher_type);
398 if (cipher == NULL) {
399 debug("Unsupported cipher %d used in key file %.200s.",
400 cipher_type, filename);
Damien Miller95def091999-11-25 00:26:21 +1100401 buffer_free(&buffer);
402 goto fail;
403 }
404 /* Initialize space for decrypted data. */
405 buffer_init(&decrypted);
Damien Miller5a6b4fe2001-12-21 14:56:54 +1100406 cp = buffer_append_space(&decrypted, buffer_len(&buffer));
Damien Miller95def091999-11-25 00:26:21 +1100407
408 /* Rest of the buffer is encrypted. Decrypt it using the passphrase. */
Damien Miller963f6b22002-02-19 15:21:23 +1100409 cipher_set_key_string(&ciphercontext, cipher, passphrase,
410 CIPHER_DECRYPT);
411 cipher_crypt(&ciphercontext, cp,
Damien Miller708d21c2002-01-22 23:18:15 +1100412 buffer_ptr(&buffer), buffer_len(&buffer));
Damien Miller963f6b22002-02-19 15:21:23 +1100413 cipher_cleanup(&ciphercontext);
Damien Miller874d77b2000-10-14 16:23:11 +1100414 memset(&ciphercontext, 0, sizeof(ciphercontext));
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000415 buffer_free(&buffer);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000416
Damien Miller95def091999-11-25 00:26:21 +1100417 check1 = buffer_get_char(&decrypted);
418 check2 = buffer_get_char(&decrypted);
419 if (check1 != buffer_get_char(&decrypted) ||
420 check2 != buffer_get_char(&decrypted)) {
421 if (strcmp(passphrase, "") != 0)
Ben Lindstromd0fca422001-03-26 13:44:06 +0000422 debug("Bad passphrase supplied for key file %.200s.",
423 filename);
Damien Miller95def091999-11-25 00:26:21 +1100424 /* Bad passphrase. */
425 buffer_free(&decrypted);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000426 goto fail;
Damien Miller95def091999-11-25 00:26:21 +1100427 }
428 /* Read the rest of the private key. */
Ben Lindstromd0fca422001-03-26 13:44:06 +0000429 buffer_get_bignum(&decrypted, prv->rsa->d);
430 buffer_get_bignum(&decrypted, prv->rsa->iqmp); /* u */
431 /* in SSL and SSH v1 p and q are exchanged */
432 buffer_get_bignum(&decrypted, prv->rsa->q); /* p */
433 buffer_get_bignum(&decrypted, prv->rsa->p); /* q */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000434
Ben Lindstromd0fca422001-03-26 13:44:06 +0000435 /* calculate p-1 and q-1 */
Damien Millerda755162002-01-22 23:09:22 +1100436 rsa_generate_additional_parameters(prv->rsa);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000437
Damien Miller95def091999-11-25 00:26:21 +1100438 buffer_free(&decrypted);
Damien Millered33d3b2003-03-15 11:36:18 +1100439
440 /* enable blinding */
441 if (RSA_blinding_on(prv->rsa, NULL) != 1) {
442 error("key_load_private_rsa1: RSA_blinding_on failed");
443 goto fail;
444 }
Ben Lindstromb257cca2001-03-05 04:59:27 +0000445 close(fd);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000446 return prv;
447
448fail:
449 if (commentp)
450 xfree(*commentp);
451 close(fd);
452 key_free(prv);
453 return NULL;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000454}
Damien Millereba71ba2000-04-29 23:57:08 +1000455
Ben Lindstrom1bad2562002-06-06 19:57:33 +0000456Key *
Ben Lindstromd0fca422001-03-26 13:44:06 +0000457key_load_private_pem(int fd, int type, const char *passphrase,
458 char **commentp)
Damien Millereba71ba2000-04-29 23:57:08 +1000459{
Damien Millereba71ba2000-04-29 23:57:08 +1000460 FILE *fp;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100461 EVP_PKEY *pk = NULL;
Ben Lindstromd0fca422001-03-26 13:44:06 +0000462 Key *prv = NULL;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100463 char *name = "<no key>";
Damien Millereba71ba2000-04-29 23:57:08 +1000464
Damien Millereba71ba2000-04-29 23:57:08 +1000465 fp = fdopen(fd, "r");
466 if (fp == NULL) {
Ben Lindstrom15f33862001-04-16 02:00:02 +0000467 error("fdopen failed: %s", strerror(errno));
Ben Lindstromb257cca2001-03-05 04:59:27 +0000468 close(fd);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000469 return NULL;
Damien Millereba71ba2000-04-29 23:57:08 +1000470 }
Damien Miller0bc1bd82000-11-13 22:57:25 +1100471 pk = PEM_read_PrivateKey(fp, NULL, NULL, (char *)passphrase);
472 if (pk == NULL) {
Ben Lindstrom648772f2001-04-19 20:47:10 +0000473 debug("PEM_read_PrivateKey failed");
Damien Miller0bc1bd82000-11-13 22:57:25 +1100474 (void)ERR_get_error();
Ben Lindstromd0fca422001-03-26 13:44:06 +0000475 } else if (pk->type == EVP_PKEY_RSA &&
Damien Miller9f0f5c62001-12-21 14:45:46 +1100476 (type == KEY_UNSPEC||type==KEY_RSA)) {
Ben Lindstromd0fca422001-03-26 13:44:06 +0000477 prv = key_new(KEY_UNSPEC);
478 prv->rsa = EVP_PKEY_get1_RSA(pk);
479 prv->type = KEY_RSA;
480 name = "rsa w/o comment";
Damien Miller0bc1bd82000-11-13 22:57:25 +1100481#ifdef DEBUG_PK
Ben Lindstromd0fca422001-03-26 13:44:06 +0000482 RSA_print_fp(stderr, prv->rsa, 8);
Damien Millereba71ba2000-04-29 23:57:08 +1000483#endif
Damien Millered33d3b2003-03-15 11:36:18 +1100484 if (RSA_blinding_on(prv->rsa, NULL) != 1) {
485 error("key_load_private_pem: RSA_blinding_on failed");
486 key_free(prv);
487 prv = NULL;
488 }
Ben Lindstromd0fca422001-03-26 13:44:06 +0000489 } else if (pk->type == EVP_PKEY_DSA &&
Damien Miller9f0f5c62001-12-21 14:45:46 +1100490 (type == KEY_UNSPEC||type==KEY_DSA)) {
Ben Lindstromd0fca422001-03-26 13:44:06 +0000491 prv = key_new(KEY_UNSPEC);
492 prv->dsa = EVP_PKEY_get1_DSA(pk);
493 prv->type = KEY_DSA;
494 name = "dsa w/o comment";
Damien Miller0bc1bd82000-11-13 22:57:25 +1100495#ifdef DEBUG_PK
Ben Lindstromd0fca422001-03-26 13:44:06 +0000496 DSA_print_fp(stderr, prv->dsa, 8);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100497#endif
Damien Miller0bc1bd82000-11-13 22:57:25 +1100498 } else {
499 error("PEM_read_PrivateKey: mismatch or "
500 "unknown EVP_PKEY save_type %d", pk->save_type);
501 }
502 fclose(fp);
503 if (pk != NULL)
504 EVP_PKEY_free(pk);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000505 if (prv != NULL && commentp)
506 *commentp = xstrdup(name);
507 debug("read PEM private key done: type %s",
508 prv ? key_type(prv) : "<unknown>");
509 return prv;
Damien Millereba71ba2000-04-29 23:57:08 +1000510}
511
Damien Miller8275fad2006-03-15 12:06:23 +1100512int
Ben Lindstromd0fca422001-03-26 13:44:06 +0000513key_perm_ok(int fd, const char *filename)
Damien Millereba71ba2000-04-29 23:57:08 +1000514{
Damien Millereba71ba2000-04-29 23:57:08 +1000515 struct stat st;
516
Ben Lindstrom7aff2612001-09-23 13:53:22 +0000517 if (fstat(fd, &st) < 0)
518 return 0;
519 /*
520 * if a key owned by the user is accessed, then we check the
521 * permissions of the file. if the key owned by a different user,
522 * then we don't care.
523 */
Damien Millerb70b61f2000-09-16 16:25:12 +1100524#ifdef HAVE_CYGWIN
Damien Millercb5e44a2000-09-29 12:12:36 +1100525 if (check_ntsec(filename))
Damien Millerb70b61f2000-09-16 16:25:12 +1100526#endif
Ben Lindstrom7aff2612001-09-23 13:53:22 +0000527 if ((st.st_uid == getuid()) && (st.st_mode & 077) != 0) {
Damien Millereba71ba2000-04-29 23:57:08 +1000528 error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
529 error("@ WARNING: UNPROTECTED PRIVATE KEY FILE! @");
530 error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
Ben Lindstrom7aff2612001-09-23 13:53:22 +0000531 error("Permissions 0%3.3o for '%s' are too open.",
Damien Miller04bd8b02003-05-25 14:38:33 +1000532 (u_int)st.st_mode & 0777, filename);
Damien Millereba71ba2000-04-29 23:57:08 +1000533 error("It is recommended that your private key files are NOT accessible by others.");
Ben Lindstromd0fca422001-03-26 13:44:06 +0000534 error("This private key will be ignored.");
Damien Millereba71ba2000-04-29 23:57:08 +1000535 return 0;
536 }
Ben Lindstromd0fca422001-03-26 13:44:06 +0000537 return 1;
538}
Ben Lindstromb257cca2001-03-05 04:59:27 +0000539
Ben Lindstromd0fca422001-03-26 13:44:06 +0000540Key *
541key_load_private_type(int type, const char *filename, const char *passphrase,
542 char **commentp)
543{
544 int fd;
545
546 fd = open(filename, O_RDONLY);
547 if (fd < 0)
548 return NULL;
549 if (!key_perm_ok(fd, filename)) {
Ben Lindstrom15f33862001-04-16 02:00:02 +0000550 error("bad permissions: ignore key: %s", filename);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000551 close(fd);
552 return NULL;
553 }
554 switch (type) {
555 case KEY_RSA1:
556 return key_load_private_rsa1(fd, filename, passphrase,
557 commentp);
558 /* closes fd */
Damien Millereba71ba2000-04-29 23:57:08 +1000559 break;
560 case KEY_DSA:
Damien Miller0bc1bd82000-11-13 22:57:25 +1100561 case KEY_RSA:
562 case KEY_UNSPEC:
Ben Lindstromd0fca422001-03-26 13:44:06 +0000563 return key_load_private_pem(fd, type, passphrase, commentp);
564 /* closes fd */
Ben Lindstromb257cca2001-03-05 04:59:27 +0000565 break;
Damien Millereba71ba2000-04-29 23:57:08 +1000566 default:
Ben Lindstromb257cca2001-03-05 04:59:27 +0000567 close(fd);
Damien Millereba71ba2000-04-29 23:57:08 +1000568 break;
569 }
Ben Lindstromd0fca422001-03-26 13:44:06 +0000570 return NULL;
571}
572
573Key *
574key_load_private(const char *filename, const char *passphrase,
575 char **commentp)
576{
Ben Lindstrom322915d2001-06-05 20:46:32 +0000577 Key *pub, *prv;
Ben Lindstromd0fca422001-03-26 13:44:06 +0000578 int fd;
579
580 fd = open(filename, O_RDONLY);
581 if (fd < 0)
582 return NULL;
583 if (!key_perm_ok(fd, filename)) {
Ben Lindstrom15f33862001-04-16 02:00:02 +0000584 error("bad permissions: ignore key: %s", filename);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000585 close(fd);
586 return NULL;
587 }
588 pub = key_load_public_rsa1(fd, filename, commentp);
589 lseek(fd, (off_t) 0, SEEK_SET); /* rewind */
590 if (pub == NULL) {
591 /* closes fd */
Ben Lindstrom322915d2001-06-05 20:46:32 +0000592 prv = key_load_private_pem(fd, KEY_UNSPEC, passphrase, NULL);
593 /* use the filename as a comment for PEM */
594 if (commentp && prv)
Ben Lindstrom2d0356f2001-06-05 21:13:57 +0000595 *commentp = xstrdup(filename);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000596 } else {
597 /* it's a SSH v1 key if the public key part is readable */
598 key_free(pub);
599 /* closes fd */
Ben Lindstrom322915d2001-06-05 20:46:32 +0000600 prv = key_load_private_rsa1(fd, filename, passphrase, NULL);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000601 }
Ben Lindstrom322915d2001-06-05 20:46:32 +0000602 return prv;
Damien Millereba71ba2000-04-29 23:57:08 +1000603}
Damien Millere4340be2000-09-16 13:29:08 +1100604
Ben Lindstrombba81212001-06-25 05:01:22 +0000605static int
Ben Lindstromd0fca422001-03-26 13:44:06 +0000606key_try_load_public(Key *k, const char *filename, char **commentp)
Damien Millere4340be2000-09-16 13:29:08 +1100607{
608 FILE *f;
Darren Tucker22cc7412004-12-06 22:47:41 +1100609 char line[SSH_MAX_PUBKEY_BYTES];
Damien Millere4340be2000-09-16 13:29:08 +1100610 char *cp;
Darren Tuckerf0f90982004-12-11 13:39:50 +1100611 u_long linenum = 0;
Damien Millere4340be2000-09-16 13:29:08 +1100612
613 f = fopen(filename, "r");
614 if (f != NULL) {
Darren Tucker22cc7412004-12-06 22:47:41 +1100615 while (read_keyfile_line(f, filename, line, sizeof(line),
616 &linenum) != -1) {
Damien Millere4340be2000-09-16 13:29:08 +1100617 cp = line;
Ben Lindstrom1c37c6a2001-12-06 18:00:18 +0000618 switch (*cp) {
Damien Millere4340be2000-09-16 13:29:08 +1100619 case '#':
620 case '\n':
621 case '\0':
622 continue;
623 }
624 /* Skip leading whitespace. */
625 for (; *cp && (*cp == ' ' || *cp == '\t'); cp++)
626 ;
627 if (*cp) {
Damien Miller0bc1bd82000-11-13 22:57:25 +1100628 if (key_read(k, &cp) == 1) {
Damien Millere4340be2000-09-16 13:29:08 +1100629 if (commentp)
630 *commentp=xstrdup(filename);
631 fclose(f);
632 return 1;
633 }
634 }
635 }
636 fclose(f);
637 }
638 return 0;
639}
640
Ben Lindstromd0fca422001-03-26 13:44:06 +0000641/* load public key from ssh v1 private or any pubkey file */
642Key *
643key_load_public(const char *filename, char **commentp)
Damien Millere4340be2000-09-16 13:29:08 +1100644{
Ben Lindstromd0fca422001-03-26 13:44:06 +0000645 Key *pub;
646 char file[MAXPATHLEN];
Damien Millere4340be2000-09-16 13:29:08 +1100647
Damien Millerdb274722003-05-14 13:45:22 +1000648 /* try rsa1 private key */
Ben Lindstromd0fca422001-03-26 13:44:06 +0000649 pub = key_load_public_type(KEY_RSA1, filename, commentp);
650 if (pub != NULL)
651 return pub;
Damien Millerdb274722003-05-14 13:45:22 +1000652
653 /* try rsa1 public key */
654 pub = key_new(KEY_RSA1);
655 if (key_try_load_public(pub, filename, commentp) == 1)
656 return pub;
657 key_free(pub);
658
659 /* try ssh2 public key */
Ben Lindstromd0fca422001-03-26 13:44:06 +0000660 pub = key_new(KEY_UNSPEC);
661 if (key_try_load_public(pub, filename, commentp) == 1)
662 return pub;
663 if ((strlcpy(file, filename, sizeof file) < sizeof(file)) &&
664 (strlcat(file, ".pub", sizeof file) < sizeof(file)) &&
665 (key_try_load_public(pub, file, commentp) == 1))
666 return pub;
667 key_free(pub);
668 return NULL;
Damien Millere4340be2000-09-16 13:29:08 +1100669}