1 /* $NetBSD: krl.c,v 1.25 2025/04/09 15:49:32 christos Exp $ */
2 /* $OpenBSD: krl.c,v 1.60 2025/02/18 08:02:48 djm Exp $ */
3
4 /*
5 * Copyright (c) 2012 Damien Miller <djm@mindrot.org>
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 */
19
20 #include "includes.h"
21 __RCSID("$NetBSD: krl.c,v 1.25 2025/04/09 15:49:32 christos Exp $");
22
23 #include <sys/types.h>
24 #include <sys/tree.h>
25 #include <sys/queue.h>
26
27 #include <errno.h>
28 #include <fcntl.h>
29 #include <limits.h>
30 #include <string.h>
31 #include <time.h>
32 #include <unistd.h>
33 #include <stdlib.h>
34
35 #include "sshbuf.h"
36 #include "ssherr.h"
37 #include "sshkey.h"
38 #include "authfile.h"
39 #include "misc.h"
40 #include "log.h"
41 #include "digest.h"
42 #include "bitmap.h"
43 #include "utf8.h"
44
45 #include "krl.h"
46
47 /* #define DEBUG_KRL */
48 #ifdef DEBUG_KRL
49 # define KRL_DBG(x) debug3_f x
50 #else
51 # define KRL_DBG(x)
52 #endif
53
54 /*
55 * Trees of revoked serial numbers, key IDs and keys. This allows
56 * quick searching, querying and producing lists in canonical order.
57 */
58
59 /* Tree of serial numbers. XXX make smarter: really need a real sparse bitmap */
60 struct revoked_serial {
61 u_int64_t lo, hi;
62 RB_ENTRY(revoked_serial) tree_entry;
63 };
64 static int serial_cmp(struct revoked_serial *a, struct revoked_serial *b);
65 RB_HEAD(revoked_serial_tree, revoked_serial);
66 RB_GENERATE_STATIC(revoked_serial_tree, revoked_serial, tree_entry, serial_cmp)
67
68 /* Tree of key IDs */
69 struct revoked_key_id {
70 char *key_id;
71 RB_ENTRY(revoked_key_id) tree_entry;
72 };
73 static int key_id_cmp(struct revoked_key_id *a, struct revoked_key_id *b);
74 RB_HEAD(revoked_key_id_tree, revoked_key_id);
75 RB_GENERATE_STATIC(revoked_key_id_tree, revoked_key_id, tree_entry, key_id_cmp)
76
77 /* Tree of blobs (used for keys and fingerprints) */
78 struct revoked_blob {
79 u_char *blob;
80 size_t len;
81 RB_ENTRY(revoked_blob) tree_entry;
82 };
83 static int blob_cmp(struct revoked_blob *a, struct revoked_blob *b);
84 RB_HEAD(revoked_blob_tree, revoked_blob);
85 RB_GENERATE_STATIC(revoked_blob_tree, revoked_blob, tree_entry, blob_cmp)
86
87 /* Tracks revoked certs for a single CA */
88 struct revoked_certs {
89 struct sshkey *ca_key;
90 struct revoked_serial_tree revoked_serials;
91 struct revoked_key_id_tree revoked_key_ids;
92 TAILQ_ENTRY(revoked_certs) entry;
93 };
94 TAILQ_HEAD(revoked_certs_list, revoked_certs);
95
96 struct ssh_krl {
97 u_int64_t krl_version;
98 u_int64_t generated_date;
99 u_int64_t flags;
100 char *comment;
101 struct revoked_blob_tree revoked_keys;
102 struct revoked_blob_tree revoked_sha1s;
103 struct revoked_blob_tree revoked_sha256s;
104 struct revoked_certs_list revoked_certs;
105 };
106
107 /* Return equal if a and b overlap */
108 static int
serial_cmp(struct revoked_serial * a,struct revoked_serial * b)109 serial_cmp(struct revoked_serial *a, struct revoked_serial *b)
110 {
111 if (a->hi >= b->lo && a->lo <= b->hi)
112 return 0;
113 return a->lo < b->lo ? -1 : 1;
114 }
115
116 static int
key_id_cmp(struct revoked_key_id * a,struct revoked_key_id * b)117 key_id_cmp(struct revoked_key_id *a, struct revoked_key_id *b)
118 {
119 return strcmp(a->key_id, b->key_id);
120 }
121
122 static int
blob_cmp(struct revoked_blob * a,struct revoked_blob * b)123 blob_cmp(struct revoked_blob *a, struct revoked_blob *b)
124 {
125 int r;
126
127 if (a->len != b->len) {
128 if ((r = memcmp(a->blob, b->blob, MINIMUM(a->len, b->len))) != 0)
129 return r;
130 return a->len > b->len ? 1 : -1;
131 } else
132 return memcmp(a->blob, b->blob, a->len);
133 }
134
135 struct ssh_krl *
ssh_krl_init(void)136 ssh_krl_init(void)
137 {
138 struct ssh_krl *krl;
139
140 if ((krl = calloc(1, sizeof(*krl))) == NULL)
141 return NULL;
142 RB_INIT(&krl->revoked_keys);
143 RB_INIT(&krl->revoked_sha1s);
144 RB_INIT(&krl->revoked_sha256s);
145 TAILQ_INIT(&krl->revoked_certs);
146 return krl;
147 }
148
149 static void
revoked_certs_free(struct revoked_certs * rc)150 revoked_certs_free(struct revoked_certs *rc)
151 {
152 struct revoked_serial *rs, *trs;
153 struct revoked_key_id *rki, *trki;
154
155 RB_FOREACH_SAFE(rs, revoked_serial_tree, &rc->revoked_serials, trs) {
156 RB_REMOVE(revoked_serial_tree, &rc->revoked_serials, rs);
157 free(rs);
158 }
159 RB_FOREACH_SAFE(rki, revoked_key_id_tree, &rc->revoked_key_ids, trki) {
160 RB_REMOVE(revoked_key_id_tree, &rc->revoked_key_ids, rki);
161 free(rki->key_id);
162 free(rki);
163 }
164 sshkey_free(rc->ca_key);
165 }
166
167 void
ssh_krl_free(struct ssh_krl * krl)168 ssh_krl_free(struct ssh_krl *krl)
169 {
170 struct revoked_blob *rb, *trb;
171 struct revoked_certs *rc, *trc;
172
173 if (krl == NULL)
174 return;
175
176 free(krl->comment);
177 RB_FOREACH_SAFE(rb, revoked_blob_tree, &krl->revoked_keys, trb) {
178 RB_REMOVE(revoked_blob_tree, &krl->revoked_keys, rb);
179 free(rb->blob);
180 free(rb);
181 }
182 RB_FOREACH_SAFE(rb, revoked_blob_tree, &krl->revoked_sha1s, trb) {
183 RB_REMOVE(revoked_blob_tree, &krl->revoked_sha1s, rb);
184 free(rb->blob);
185 free(rb);
186 }
187 RB_FOREACH_SAFE(rb, revoked_blob_tree, &krl->revoked_sha256s, trb) {
188 RB_REMOVE(revoked_blob_tree, &krl->revoked_sha256s, rb);
189 free(rb->blob);
190 free(rb);
191 }
192 TAILQ_FOREACH_SAFE(rc, &krl->revoked_certs, entry, trc) {
193 TAILQ_REMOVE(&krl->revoked_certs, rc, entry);
194 revoked_certs_free(rc);
195 }
196 free(krl);
197 }
198
199 void
ssh_krl_set_version(struct ssh_krl * krl,u_int64_t version)200 ssh_krl_set_version(struct ssh_krl *krl, u_int64_t version)
201 {
202 krl->krl_version = version;
203 }
204
205 int
ssh_krl_set_comment(struct ssh_krl * krl,const char * comment)206 ssh_krl_set_comment(struct ssh_krl *krl, const char *comment)
207 {
208 free(krl->comment);
209 if ((krl->comment = strdup(comment)) == NULL)
210 return SSH_ERR_ALLOC_FAIL;
211 return 0;
212 }
213
214 /*
215 * Find the revoked_certs struct for a CA key. If allow_create is set then
216 * create a new one in the tree if one did not exist already.
217 */
218 static int
revoked_certs_for_ca_key(struct ssh_krl * krl,const struct sshkey * ca_key,struct revoked_certs ** rcp,int allow_create)219 revoked_certs_for_ca_key(struct ssh_krl *krl, const struct sshkey *ca_key,
220 struct revoked_certs **rcp, int allow_create)
221 {
222 struct revoked_certs *rc;
223 int r;
224
225 *rcp = NULL;
226 TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
227 if ((ca_key == NULL && rc->ca_key == NULL) ||
228 sshkey_equal(rc->ca_key, ca_key)) {
229 *rcp = rc;
230 return 0;
231 }
232 }
233 if (!allow_create)
234 return 0;
235 /* If this CA doesn't exist in the list then add it now */
236 if ((rc = calloc(1, sizeof(*rc))) == NULL)
237 return SSH_ERR_ALLOC_FAIL;
238 if (ca_key == NULL)
239 rc->ca_key = NULL;
240 else if ((r = sshkey_from_private(ca_key, &rc->ca_key)) != 0) {
241 free(rc);
242 return r;
243 }
244 RB_INIT(&rc->revoked_serials);
245 RB_INIT(&rc->revoked_key_ids);
246 TAILQ_INSERT_TAIL(&krl->revoked_certs, rc, entry);
247 KRL_DBG(("new CA %s", ca_key == NULL ? "*" : sshkey_type(ca_key)));
248 *rcp = rc;
249 return 0;
250 }
251
252 static int
insert_serial_range(struct revoked_serial_tree * rt,u_int64_t lo,u_int64_t hi)253 insert_serial_range(struct revoked_serial_tree *rt, u_int64_t lo, u_int64_t hi)
254 {
255 struct revoked_serial rs, *ers, *crs, *irs;
256
257 KRL_DBG(("insert %"PRIu64":%"PRIu64, lo, hi));
258 memset(&rs, 0, sizeof(rs));
259 rs.lo = lo;
260 rs.hi = hi;
261 ers = RB_NFIND(revoked_serial_tree, rt, &rs);
262 if (ers == NULL || serial_cmp(ers, &rs) != 0) {
263 /* No entry matches. Just insert */
264 if ((irs = malloc(sizeof(rs))) == NULL)
265 return SSH_ERR_ALLOC_FAIL;
266 memcpy(irs, &rs, sizeof(*irs));
267 ers = RB_INSERT(revoked_serial_tree, rt, irs);
268 if (ers != NULL) {
269 KRL_DBG(("bad: ers != NULL"));
270 /* Shouldn't happen */
271 free(irs);
272 return SSH_ERR_INTERNAL_ERROR;
273 }
274 ers = irs;
275 } else {
276 KRL_DBG(("overlap found %"PRIu64":%"PRIu64,
277 ers->lo, ers->hi));
278 /*
279 * The inserted entry overlaps an existing one. Grow the
280 * existing entry.
281 */
282 if (ers->lo > lo)
283 ers->lo = lo;
284 if (ers->hi < hi)
285 ers->hi = hi;
286 }
287
288 /*
289 * The inserted or revised range might overlap or abut adjacent ones;
290 * coalesce as necessary.
291 */
292
293 /* Check predecessors */
294 while ((crs = RB_PREV(revoked_serial_tree, rt, ers)) != NULL) {
295 KRL_DBG(("pred %"PRIu64":%"PRIu64,
296 crs->lo, crs->hi));
297 if (ers->lo != 0 && crs->hi < ers->lo - 1)
298 break;
299 /* This entry overlaps. */
300 if (crs->lo < ers->lo) {
301 ers->lo = crs->lo;
302 KRL_DBG(("pred extend %"PRIu64":%"PRIu64,
303 ers->lo, ers->hi));
304 }
305 RB_REMOVE(revoked_serial_tree, rt, crs);
306 free(crs);
307 }
308 /* Check successors */
309 while ((crs = RB_NEXT(revoked_serial_tree, rt, ers)) != NULL) {
310 KRL_DBG(("succ %"PRIu64":%"PRIu64, crs->lo, crs->hi));
311 if (ers->hi != (u_int64_t)-1 && crs->lo > ers->hi + 1)
312 break;
313 /* This entry overlaps. */
314 if (crs->hi > ers->hi) {
315 ers->hi = crs->hi;
316 KRL_DBG(("succ extend %"PRIu64":%"PRIu64,
317 ers->lo, ers->hi));
318 }
319 RB_REMOVE(revoked_serial_tree, rt, crs);
320 free(crs);
321 }
322 KRL_DBG(("done, final %"PRIu64":%"PRIu64, ers->lo, ers->hi));
323 return 0;
324 }
325
326 int
ssh_krl_revoke_cert_by_serial(struct ssh_krl * krl,const struct sshkey * ca_key,u_int64_t serial)327 ssh_krl_revoke_cert_by_serial(struct ssh_krl *krl, const struct sshkey *ca_key,
328 u_int64_t serial)
329 {
330 return ssh_krl_revoke_cert_by_serial_range(krl, ca_key, serial, serial);
331 }
332
333 int
ssh_krl_revoke_cert_by_serial_range(struct ssh_krl * krl,const struct sshkey * ca_key,u_int64_t lo,u_int64_t hi)334 ssh_krl_revoke_cert_by_serial_range(struct ssh_krl *krl,
335 const struct sshkey *ca_key, u_int64_t lo, u_int64_t hi)
336 {
337 struct revoked_certs *rc;
338 int r;
339
340 if (lo > hi || lo == 0)
341 return SSH_ERR_INVALID_ARGUMENT;
342 if ((r = revoked_certs_for_ca_key(krl, ca_key, &rc, 1)) != 0)
343 return r;
344 return insert_serial_range(&rc->revoked_serials, lo, hi);
345 }
346
347 int
ssh_krl_revoke_cert_by_key_id(struct ssh_krl * krl,const struct sshkey * ca_key,const char * key_id)348 ssh_krl_revoke_cert_by_key_id(struct ssh_krl *krl, const struct sshkey *ca_key,
349 const char *key_id)
350 {
351 struct revoked_key_id *rki, *erki;
352 struct revoked_certs *rc;
353 int r;
354
355 if ((r = revoked_certs_for_ca_key(krl, ca_key, &rc, 1)) != 0)
356 return r;
357
358 KRL_DBG(("revoke %s", key_id));
359 if ((rki = calloc(1, sizeof(*rki))) == NULL ||
360 (rki->key_id = strdup(key_id)) == NULL) {
361 free(rki);
362 return SSH_ERR_ALLOC_FAIL;
363 }
364 erki = RB_INSERT(revoked_key_id_tree, &rc->revoked_key_ids, rki);
365 if (erki != NULL) {
366 free(rki->key_id);
367 free(rki);
368 }
369 return 0;
370 }
371
372 /* Convert "key" to a public key blob without any certificate information */
373 static int
plain_key_blob(const struct sshkey * key,u_char ** blob,size_t * blen)374 plain_key_blob(const struct sshkey *key, u_char **blob, size_t *blen)
375 {
376 struct sshkey *kcopy;
377 int r;
378
379 if ((r = sshkey_from_private(key, &kcopy)) != 0)
380 return r;
381 if (sshkey_is_cert(kcopy)) {
382 if ((r = sshkey_drop_cert(kcopy)) != 0) {
383 sshkey_free(kcopy);
384 return r;
385 }
386 }
387 r = sshkey_to_blob(kcopy, blob, blen);
388 sshkey_free(kcopy);
389 return r;
390 }
391
392 /* Revoke a key blob. Ownership of blob is transferred to the tree */
393 static int
revoke_blob(struct revoked_blob_tree * rbt,u_char * blob,size_t len)394 revoke_blob(struct revoked_blob_tree *rbt, u_char *blob, size_t len)
395 {
396 struct revoked_blob *rb, *erb;
397
398 if ((rb = calloc(1, sizeof(*rb))) == NULL)
399 return SSH_ERR_ALLOC_FAIL;
400 rb->blob = blob;
401 rb->len = len;
402 erb = RB_INSERT(revoked_blob_tree, rbt, rb);
403 if (erb != NULL) {
404 free(rb->blob);
405 free(rb);
406 }
407 return 0;
408 }
409
410 int
ssh_krl_revoke_key_explicit(struct ssh_krl * krl,const struct sshkey * key)411 ssh_krl_revoke_key_explicit(struct ssh_krl *krl, const struct sshkey *key)
412 {
413 u_char *blob;
414 size_t len;
415 int r;
416
417 debug3_f("revoke type %s", sshkey_type(key));
418 if ((r = plain_key_blob(key, &blob, &len)) != 0)
419 return r;
420 return revoke_blob(&krl->revoked_keys, blob, len);
421 }
422
423 static int
revoke_by_hash(struct revoked_blob_tree * target,const u_char * p,size_t len)424 revoke_by_hash(struct revoked_blob_tree *target, const u_char *p, size_t len)
425 {
426 u_char *blob;
427 int r;
428
429 /* need to copy hash, as revoke_blob steals ownership */
430 if ((blob = malloc(len)) == NULL)
431 return SSH_ERR_SYSTEM_ERROR;
432 memcpy(blob, p, len);
433 if ((r = revoke_blob(target, blob, len)) != 0) {
434 free(blob);
435 return r;
436 }
437 return 0;
438 }
439
440 int
ssh_krl_revoke_key_sha1(struct ssh_krl * krl,const u_char * p,size_t len)441 ssh_krl_revoke_key_sha1(struct ssh_krl *krl, const u_char *p, size_t len)
442 {
443 debug3_f("revoke by sha1");
444 if (len != 20)
445 return SSH_ERR_INVALID_FORMAT;
446 return revoke_by_hash(&krl->revoked_sha1s, p, len);
447 }
448
449 int
ssh_krl_revoke_key_sha256(struct ssh_krl * krl,const u_char * p,size_t len)450 ssh_krl_revoke_key_sha256(struct ssh_krl *krl, const u_char *p, size_t len)
451 {
452 debug3_f("revoke by sha256");
453 if (len != 32)
454 return SSH_ERR_INVALID_FORMAT;
455 return revoke_by_hash(&krl->revoked_sha256s, p, len);
456 }
457
458 int
ssh_krl_revoke_key(struct ssh_krl * krl,const struct sshkey * key)459 ssh_krl_revoke_key(struct ssh_krl *krl, const struct sshkey *key)
460 {
461 /* XXX replace with SHA256? */
462 if (!sshkey_is_cert(key))
463 return ssh_krl_revoke_key_explicit(krl, key);
464
465 if (key->cert->serial == 0) {
466 return ssh_krl_revoke_cert_by_key_id(krl,
467 key->cert->signature_key,
468 key->cert->key_id);
469 } else {
470 return ssh_krl_revoke_cert_by_serial(krl,
471 key->cert->signature_key,
472 key->cert->serial);
473 }
474 }
475
476 /*
477 * Select the most compact section type to emit next in a KRL based on
478 * the current section type, the run length of contiguous revoked serial
479 * numbers and the gaps from the last and to the next revoked serial.
480 * Applies a mostly-accurate bit cost model to select the section type
481 * that will minimise the size of the resultant KRL.
482 */
483 static int
choose_next_state(int current_state,u_int64_t contig,int final,u_int64_t last_gap,u_int64_t next_gap,int * force_new_section)484 choose_next_state(int current_state, u_int64_t contig, int final,
485 u_int64_t last_gap, u_int64_t next_gap, int *force_new_section)
486 {
487 int new_state;
488 u_int64_t cost, cost_list, cost_range, cost_bitmap, cost_bitmap_restart;
489
490 /*
491 * Avoid unsigned overflows.
492 * The limits are high enough to avoid confusing the calculations.
493 */
494 contig = MINIMUM(contig, 1ULL<<31);
495 last_gap = MINIMUM(last_gap, 1ULL<<31);
496 next_gap = MINIMUM(next_gap, 1ULL<<31);
497
498 /*
499 * Calculate the cost to switch from the current state to candidates.
500 * NB. range sections only ever contain a single range, so their
501 * switching cost is independent of the current_state.
502 */
503 cost_list = cost_bitmap = cost_bitmap_restart = 0;
504 cost_range = 8;
505 switch (current_state) {
506 case KRL_SECTION_CERT_SERIAL_LIST:
507 cost_bitmap_restart = cost_bitmap = 8 + 64;
508 break;
509 case KRL_SECTION_CERT_SERIAL_BITMAP:
510 cost_list = 8;
511 cost_bitmap_restart = 8 + 64;
512 break;
513 case KRL_SECTION_CERT_SERIAL_RANGE:
514 case 0:
515 cost_bitmap_restart = cost_bitmap = 8 + 64;
516 cost_list = 8;
517 }
518
519 /* Estimate base cost in bits of each section type */
520 cost_list += 64 * contig + (final ? 0 : 8+64);
521 cost_range += (2 * 64) + (final ? 0 : 8+64);
522 cost_bitmap += last_gap + contig + (final ? 0 : MINIMUM(next_gap, 8+64));
523 cost_bitmap_restart += contig + (final ? 0 : MINIMUM(next_gap, 8+64));
524
525 /* Convert to byte costs for actual comparison */
526 cost_list = (cost_list + 7) / 8;
527 cost_bitmap = (cost_bitmap + 7) / 8;
528 cost_bitmap_restart = (cost_bitmap_restart + 7) / 8;
529 cost_range = (cost_range + 7) / 8;
530
531 /* Now pick the best choice */
532 *force_new_section = 0;
533 new_state = KRL_SECTION_CERT_SERIAL_BITMAP;
534 cost = cost_bitmap;
535 if (cost_range < cost) {
536 new_state = KRL_SECTION_CERT_SERIAL_RANGE;
537 cost = cost_range;
538 }
539 if (cost_list < cost) {
540 new_state = KRL_SECTION_CERT_SERIAL_LIST;
541 cost = cost_list;
542 }
543 if (cost_bitmap_restart < cost) {
544 new_state = KRL_SECTION_CERT_SERIAL_BITMAP;
545 *force_new_section = 1;
546 cost = cost_bitmap_restart;
547 }
548 KRL_DBG(("contig %llu last_gap %llu next_gap %llu final %d, costs:"
549 "list %llu range %llu bitmap %llu new bitmap %llu, "
550 "selected 0x%02x%s", (long long unsigned)contig,
551 (long long unsigned)last_gap, (long long unsigned)next_gap, final,
552 (long long unsigned)cost_list, (long long unsigned)cost_range,
553 (long long unsigned)cost_bitmap,
554 (long long unsigned)cost_bitmap_restart, new_state,
555 *force_new_section ? " restart" : ""));
556 return new_state;
557 }
558
559 static int
put_bitmap(struct sshbuf * buf,struct bitmap * bitmap)560 put_bitmap(struct sshbuf *buf, struct bitmap *bitmap)
561 {
562 size_t len;
563 u_char *blob;
564 int r;
565
566 len = bitmap_nbytes(bitmap);
567 if ((blob = malloc(len)) == NULL)
568 return SSH_ERR_ALLOC_FAIL;
569 if (bitmap_to_string(bitmap, blob, len) != 0) {
570 free(blob);
571 return SSH_ERR_INTERNAL_ERROR;
572 }
573 r = sshbuf_put_bignum2_bytes(buf, blob, len);
574 free(blob);
575 return r;
576 }
577
578 /* Generate a KRL_SECTION_CERTIFICATES KRL section */
579 static int
revoked_certs_generate(struct revoked_certs * rc,struct sshbuf * buf)580 revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf)
581 {
582 int final, force_new_sect, r = SSH_ERR_INTERNAL_ERROR;
583 u_int64_t i, contig, gap, last = 0, bitmap_start = 0;
584 struct revoked_serial *rs, *nrs;
585 struct revoked_key_id *rki;
586 int next_state, state = 0;
587 struct sshbuf *sect;
588 struct bitmap *bitmap = NULL;
589
590 if ((sect = sshbuf_new()) == NULL)
591 return SSH_ERR_ALLOC_FAIL;
592
593 /* Store the header: optional CA scope key, reserved */
594 if (rc->ca_key == NULL) {
595 if ((r = sshbuf_put_string(buf, NULL, 0)) != 0)
596 goto out;
597 } else {
598 if ((r = sshkey_puts(rc->ca_key, buf)) != 0)
599 goto out;
600 }
601 if ((r = sshbuf_put_string(buf, NULL, 0)) != 0)
602 goto out;
603
604 /* Store the revoked serials. */
605 for (rs = RB_MIN(revoked_serial_tree, &rc->revoked_serials);
606 rs != NULL;
607 rs = RB_NEXT(revoked_serial_tree, &rc->revoked_serials, rs)) {
608 KRL_DBG(("serial %llu:%llu state 0x%02x",
609 (long long unsigned)rs->lo, (long long unsigned)rs->hi,
610 state));
611
612 /* Check contiguous length and gap to next section (if any) */
613 nrs = RB_NEXT(revoked_serial_tree, &rc->revoked_serials, rs);
614 final = nrs == NULL;
615 gap = nrs == NULL ? 0 : nrs->lo - rs->hi;
616 contig = 1 + (rs->hi - rs->lo);
617
618 /* Choose next state based on these */
619 next_state = choose_next_state(state, contig, final,
620 state == 0 ? 0 : rs->lo - last, gap, &force_new_sect);
621
622 /*
623 * If the current section is a range section or has a different
624 * type to the next section, then finish it off now.
625 */
626 if (state != 0 && (force_new_sect || next_state != state ||
627 state == KRL_SECTION_CERT_SERIAL_RANGE)) {
628 KRL_DBG(("finish state 0x%02x", state));
629 switch (state) {
630 case KRL_SECTION_CERT_SERIAL_LIST:
631 case KRL_SECTION_CERT_SERIAL_RANGE:
632 break;
633 case KRL_SECTION_CERT_SERIAL_BITMAP:
634 if ((r = put_bitmap(sect, bitmap)) != 0)
635 goto out;
636 bitmap_free(bitmap);
637 bitmap = NULL;
638 break;
639 }
640 if ((r = sshbuf_put_u8(buf, state)) != 0 ||
641 (r = sshbuf_put_stringb(buf, sect)) != 0)
642 goto out;
643 sshbuf_reset(sect);
644 }
645
646 /* If we are starting a new section then prepare it now */
647 if (next_state != state || force_new_sect) {
648 KRL_DBG(("start state 0x%02x",
649 next_state));
650 state = next_state;
651 sshbuf_reset(sect);
652 switch (state) {
653 case KRL_SECTION_CERT_SERIAL_LIST:
654 case KRL_SECTION_CERT_SERIAL_RANGE:
655 break;
656 case KRL_SECTION_CERT_SERIAL_BITMAP:
657 if ((bitmap = bitmap_new()) == NULL) {
658 r = SSH_ERR_ALLOC_FAIL;
659 goto out;
660 }
661 bitmap_start = rs->lo;
662 if ((r = sshbuf_put_u64(sect,
663 bitmap_start)) != 0)
664 goto out;
665 break;
666 }
667 }
668
669 /* Perform section-specific processing */
670 switch (state) {
671 case KRL_SECTION_CERT_SERIAL_LIST:
672 for (i = 0; i < contig; i++) {
673 if ((r = sshbuf_put_u64(sect, rs->lo + i)) != 0)
674 goto out;
675 }
676 break;
677 case KRL_SECTION_CERT_SERIAL_RANGE:
678 if ((r = sshbuf_put_u64(sect, rs->lo)) != 0 ||
679 (r = sshbuf_put_u64(sect, rs->hi)) != 0)
680 goto out;
681 break;
682 case KRL_SECTION_CERT_SERIAL_BITMAP:
683 if (rs->lo - bitmap_start > INT_MAX) {
684 r = SSH_ERR_INVALID_FORMAT;
685 error_f("insane bitmap gap");
686 goto out;
687 }
688 for (i = 0; i < contig; i++) {
689 if (bitmap_set_bit(bitmap,
690 rs->lo + i - bitmap_start) != 0) {
691 r = SSH_ERR_ALLOC_FAIL;
692 goto out;
693 }
694 }
695 break;
696 }
697 last = rs->hi;
698 }
699 /* Flush the remaining section, if any */
700 if (state != 0) {
701 KRL_DBG(("serial final flush for state 0x%02x", state));
702 switch (state) {
703 case KRL_SECTION_CERT_SERIAL_LIST:
704 case KRL_SECTION_CERT_SERIAL_RANGE:
705 break;
706 case KRL_SECTION_CERT_SERIAL_BITMAP:
707 if ((r = put_bitmap(sect, bitmap)) != 0)
708 goto out;
709 bitmap_free(bitmap);
710 bitmap = NULL;
711 break;
712 }
713 if ((r = sshbuf_put_u8(buf, state)) != 0 ||
714 (r = sshbuf_put_stringb(buf, sect)) != 0)
715 goto out;
716 }
717 KRL_DBG(("serial done "));
718
719 /* Now output a section for any revocations by key ID */
720 sshbuf_reset(sect);
721 RB_FOREACH(rki, revoked_key_id_tree, &rc->revoked_key_ids) {
722 KRL_DBG(("key ID %s", rki->key_id));
723 if ((r = sshbuf_put_cstring(sect, rki->key_id)) != 0)
724 goto out;
725 }
726 if (sshbuf_len(sect) != 0) {
727 if ((r = sshbuf_put_u8(buf, KRL_SECTION_CERT_KEY_ID)) != 0 ||
728 (r = sshbuf_put_stringb(buf, sect)) != 0)
729 goto out;
730 }
731 r = 0;
732 out:
733 bitmap_free(bitmap);
734 sshbuf_free(sect);
735 return r;
736 }
737
738 int
ssh_krl_to_blob(struct ssh_krl * krl,struct sshbuf * buf)739 ssh_krl_to_blob(struct ssh_krl *krl, struct sshbuf *buf)
740 {
741 int r = SSH_ERR_INTERNAL_ERROR;
742 struct revoked_certs *rc;
743 struct revoked_blob *rb;
744 struct sshbuf *sect;
745 u_char *sblob = NULL;
746
747 if (krl->generated_date == 0)
748 krl->generated_date = time(NULL);
749
750 if ((sect = sshbuf_new()) == NULL)
751 return SSH_ERR_ALLOC_FAIL;
752
753 /* Store the header */
754 if ((r = sshbuf_put(buf, KRL_MAGIC, sizeof(KRL_MAGIC) - 1)) != 0 ||
755 (r = sshbuf_put_u32(buf, KRL_FORMAT_VERSION)) != 0 ||
756 (r = sshbuf_put_u64(buf, krl->krl_version)) != 0 ||
757 (r = sshbuf_put_u64(buf, krl->generated_date)) != 0 ||
758 (r = sshbuf_put_u64(buf, krl->flags)) != 0 ||
759 (r = sshbuf_put_string(buf, NULL, 0)) != 0 ||
760 (r = sshbuf_put_cstring(buf, krl->comment)) != 0)
761 goto out;
762
763 /* Store sections for revoked certificates */
764 TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
765 sshbuf_reset(sect);
766 if ((r = revoked_certs_generate(rc, sect)) != 0)
767 goto out;
768 if ((r = sshbuf_put_u8(buf, KRL_SECTION_CERTIFICATES)) != 0 ||
769 (r = sshbuf_put_stringb(buf, sect)) != 0)
770 goto out;
771 }
772
773 /* Finally, output sections for revocations by public key/hash */
774 sshbuf_reset(sect);
775 RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_keys) {
776 KRL_DBG(("key len %zu ", rb->len));
777 if ((r = sshbuf_put_string(sect, rb->blob, rb->len)) != 0)
778 goto out;
779 }
780 if (sshbuf_len(sect) != 0) {
781 if ((r = sshbuf_put_u8(buf, KRL_SECTION_EXPLICIT_KEY)) != 0 ||
782 (r = sshbuf_put_stringb(buf, sect)) != 0)
783 goto out;
784 }
785 sshbuf_reset(sect);
786 RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha1s) {
787 KRL_DBG(("hash len %zu ", rb->len));
788 if ((r = sshbuf_put_string(sect, rb->blob, rb->len)) != 0)
789 goto out;
790 }
791 if (sshbuf_len(sect) != 0) {
792 if ((r = sshbuf_put_u8(buf,
793 KRL_SECTION_FINGERPRINT_SHA1)) != 0 ||
794 (r = sshbuf_put_stringb(buf, sect)) != 0)
795 goto out;
796 }
797 sshbuf_reset(sect);
798 RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha256s) {
799 KRL_DBG(("hash len %zu ", rb->len));
800 if ((r = sshbuf_put_string(sect, rb->blob, rb->len)) != 0)
801 goto out;
802 }
803 if (sshbuf_len(sect) != 0) {
804 if ((r = sshbuf_put_u8(buf,
805 KRL_SECTION_FINGERPRINT_SHA256)) != 0 ||
806 (r = sshbuf_put_stringb(buf, sect)) != 0)
807 goto out;
808 }
809 /* success */
810 r = 0;
811 out:
812 free(sblob);
813 sshbuf_free(sect);
814 return r;
815 }
816
817 static void
format_timestamp(u_int64_t timestamp,char * ts,size_t nts)818 format_timestamp(u_int64_t timestamp, char *ts, size_t nts)
819 {
820 time_t t;
821 struct tm *tm;
822
823 t = timestamp;
824 tm = localtime(&t);
825 if (tm == NULL)
826 strlcpy(ts, "<INVALID>", nts);
827 else {
828 *ts = '\0';
829 strftime(ts, nts, "%Y%m%dT%H%M%S", tm);
830 }
831 }
832
833 static int
cert_extension_subsection(struct sshbuf * subsect,struct ssh_krl * krl)834 cert_extension_subsection(struct sshbuf *subsect, struct ssh_krl *krl)
835 {
836 int r = SSH_ERR_INTERNAL_ERROR;
837 u_char critical = 1;
838 struct sshbuf *value = NULL;
839 char *name = NULL;
840
841 if ((r = sshbuf_get_cstring(subsect, &name, NULL)) != 0 ||
842 (r = sshbuf_get_u8(subsect, &critical)) != 0 ||
843 (r = sshbuf_froms(subsect, &value)) != 0) {
844 debug_fr(r, "parse");
845 error("KRL has invalid certificate extension subsection");
846 r = SSH_ERR_INVALID_FORMAT;
847 goto out;
848 }
849 if (sshbuf_len(subsect) != 0) {
850 error("KRL has invalid certificate extension subsection: "
851 "trailing data");
852 r = SSH_ERR_INVALID_FORMAT;
853 goto out;
854 }
855 debug_f("cert extension %s critical %u len %zu",
856 name, critical, sshbuf_len(value));
857 /* no extensions are currently supported */
858 if (critical) {
859 error("KRL contains unsupported critical certificate "
860 "subsection \"%s\"", name);
861 r = SSH_ERR_FEATURE_UNSUPPORTED;
862 goto out;
863 }
864 /* success */
865 r = 0;
866 out:
867 free(name);
868 sshbuf_free(value);
869 return r;
870 }
871
872 static int
parse_revoked_certs(struct sshbuf * buf,struct ssh_krl * krl)873 parse_revoked_certs(struct sshbuf *buf, struct ssh_krl *krl)
874 {
875 int r = SSH_ERR_INTERNAL_ERROR;
876 u_char type;
877 const u_char *blob;
878 size_t blen, nbits;
879 struct sshbuf *subsect = NULL;
880 u_int64_t serial, serial_lo, serial_hi;
881 struct bitmap *bitmap = NULL;
882 char *key_id = NULL;
883 struct sshkey *ca_key = NULL;
884
885 if ((subsect = sshbuf_new()) == NULL)
886 return SSH_ERR_ALLOC_FAIL;
887
888 /* Header: key, reserved */
889 if ((r = sshbuf_get_string_direct(buf, &blob, &blen)) != 0 ||
890 (r = sshbuf_skip_string(buf)) != 0)
891 goto out;
892 if (blen != 0 && (r = sshkey_from_blob(blob, blen, &ca_key)) != 0)
893 goto out;
894
895 while (sshbuf_len(buf) > 0) {
896 sshbuf_free(subsect);
897 subsect = NULL;
898 if ((r = sshbuf_get_u8(buf, &type)) != 0 ||
899 (r = sshbuf_froms(buf, &subsect)) != 0)
900 goto out;
901 KRL_DBG(("subsection type 0x%02x", type));
902 /* sshbuf_dump(subsect, stderr); */
903
904 switch (type) {
905 case KRL_SECTION_CERT_SERIAL_LIST:
906 while (sshbuf_len(subsect) > 0) {
907 if ((r = sshbuf_get_u64(subsect, &serial)) != 0)
908 goto out;
909 if ((r = ssh_krl_revoke_cert_by_serial(krl,
910 ca_key, serial)) != 0)
911 goto out;
912 }
913 break;
914 case KRL_SECTION_CERT_SERIAL_RANGE:
915 if ((r = sshbuf_get_u64(subsect, &serial_lo)) != 0 ||
916 (r = sshbuf_get_u64(subsect, &serial_hi)) != 0)
917 goto out;
918 if ((r = ssh_krl_revoke_cert_by_serial_range(krl,
919 ca_key, serial_lo, serial_hi)) != 0)
920 goto out;
921 break;
922 case KRL_SECTION_CERT_SERIAL_BITMAP:
923 if ((bitmap = bitmap_new()) == NULL) {
924 r = SSH_ERR_ALLOC_FAIL;
925 goto out;
926 }
927 if ((r = sshbuf_get_u64(subsect, &serial_lo)) != 0 ||
928 (r = sshbuf_get_bignum2_bytes_direct(subsect,
929 &blob, &blen)) != 0)
930 goto out;
931 if (bitmap_from_string(bitmap, blob, blen) != 0) {
932 r = SSH_ERR_INVALID_FORMAT;
933 goto out;
934 }
935 nbits = bitmap_nbits(bitmap);
936 for (serial = 0; serial < (u_int64_t)nbits; serial++) {
937 if (serial > 0 && serial_lo + serial == 0) {
938 error_f("bitmap wraps u64");
939 r = SSH_ERR_INVALID_FORMAT;
940 goto out;
941 }
942 if (!bitmap_test_bit(bitmap, serial))
943 continue;
944 if ((r = ssh_krl_revoke_cert_by_serial(krl,
945 ca_key, serial_lo + serial)) != 0)
946 goto out;
947 }
948 bitmap_free(bitmap);
949 bitmap = NULL;
950 break;
951 case KRL_SECTION_CERT_KEY_ID:
952 while (sshbuf_len(subsect) > 0) {
953 if ((r = sshbuf_get_cstring(subsect,
954 &key_id, NULL)) != 0)
955 goto out;
956 if ((r = ssh_krl_revoke_cert_by_key_id(krl,
957 ca_key, key_id)) != 0)
958 goto out;
959 free(key_id);
960 key_id = NULL;
961 }
962 break;
963 case KRL_SECTION_CERT_EXTENSION:
964 if ((r = cert_extension_subsection(subsect, krl)) != 0)
965 goto out;
966 break;
967 default:
968 error("Unsupported KRL certificate section %u", type);
969 r = SSH_ERR_INVALID_FORMAT;
970 goto out;
971 }
972 if (sshbuf_len(subsect) > 0) {
973 error("KRL certificate section contains unparsed data");
974 r = SSH_ERR_INVALID_FORMAT;
975 goto out;
976 }
977 }
978
979 r = 0;
980 out:
981 if (bitmap != NULL)
982 bitmap_free(bitmap);
983 free(key_id);
984 sshkey_free(ca_key);
985 sshbuf_free(subsect);
986 return r;
987 }
988
989 static int
blob_section(struct sshbuf * sect,struct revoked_blob_tree * target_tree,size_t expected_len)990 blob_section(struct sshbuf *sect, struct revoked_blob_tree *target_tree,
991 size_t expected_len)
992 {
993 u_char *rdata = NULL;
994 size_t rlen = 0;
995 int r;
996
997 while (sshbuf_len(sect) > 0) {
998 if ((r = sshbuf_get_string(sect, &rdata, &rlen)) != 0)
999 return r;
1000 if (expected_len != 0 && rlen != expected_len) {
1001 error_f("bad length");
1002 free(rdata);
1003 return SSH_ERR_INVALID_FORMAT;
1004 }
1005 if ((r = revoke_blob(target_tree, rdata, rlen)) != 0) {
1006 free(rdata);
1007 return r;
1008 }
1009 }
1010 return 0;
1011 }
1012
1013 static int
extension_section(struct sshbuf * sect,struct ssh_krl * krl)1014 extension_section(struct sshbuf *sect, struct ssh_krl *krl)
1015 {
1016 int r = SSH_ERR_INTERNAL_ERROR;
1017 u_char critical = 1;
1018 struct sshbuf *value = NULL;
1019 char *name = NULL;
1020
1021 if ((r = sshbuf_get_cstring(sect, &name, NULL)) != 0 ||
1022 (r = sshbuf_get_u8(sect, &critical)) != 0 ||
1023 (r = sshbuf_froms(sect, &value)) != 0) {
1024 debug_fr(r, "parse");
1025 error("KRL has invalid extension section");
1026 r = SSH_ERR_INVALID_FORMAT;
1027 goto out;
1028 }
1029 if (sshbuf_len(sect) != 0) {
1030 error("KRL has invalid extension section: trailing data");
1031 r = SSH_ERR_INVALID_FORMAT;
1032 goto out;
1033 }
1034 debug_f("extension %s critical %u len %zu",
1035 name, critical, sshbuf_len(value));
1036 /* no extensions are currently supported */
1037 if (critical) {
1038 error("KRL contains unsupported critical section \"%s\"", name);
1039 r = SSH_ERR_FEATURE_UNSUPPORTED;
1040 goto out;
1041 }
1042 /* success */
1043 r = 0;
1044 out:
1045 free(name);
1046 sshbuf_free(value);
1047 return r;
1048 }
1049
1050 /* Attempt to parse a KRL */
1051 int
ssh_krl_from_blob(struct sshbuf * buf,struct ssh_krl ** krlp)1052 ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp)
1053 {
1054 struct sshbuf *copy = NULL, *sect = NULL;
1055 struct ssh_krl *krl = NULL;
1056 char timestamp[64];
1057 int r = SSH_ERR_INTERNAL_ERROR;
1058 u_char type;
1059 u_int format_version;
1060
1061 *krlp = NULL;
1062
1063 /* KRL must begin with magic string */
1064 if ((r = sshbuf_cmp(buf, 0, KRL_MAGIC, sizeof(KRL_MAGIC) - 1)) != 0) {
1065 debug2_f("bad KRL magic header");
1066 return SSH_ERR_KRL_BAD_MAGIC;
1067 }
1068
1069 if ((krl = ssh_krl_init()) == NULL) {
1070 r = SSH_ERR_ALLOC_FAIL;
1071 error_f("alloc failed");
1072 goto out;
1073 }
1074 /* Don't modify buffer */
1075 if ((copy = sshbuf_fromb(buf)) == NULL) {
1076 r = SSH_ERR_ALLOC_FAIL;
1077 goto out;
1078 }
1079 if ((r = sshbuf_consume(copy, sizeof(KRL_MAGIC) - 1)) != 0 ||
1080 (r = sshbuf_get_u32(copy, &format_version)) != 0)
1081 goto out;
1082 if (format_version != KRL_FORMAT_VERSION) {
1083 error_f("unsupported KRL format version %u", format_version);
1084 r = SSH_ERR_INVALID_FORMAT;
1085 goto out;
1086 }
1087 if ((r = sshbuf_get_u64(copy, &krl->krl_version)) != 0 ||
1088 (r = sshbuf_get_u64(copy, &krl->generated_date)) != 0 ||
1089 (r = sshbuf_get_u64(copy, &krl->flags)) != 0 ||
1090 (r = sshbuf_skip_string(copy)) != 0 ||
1091 (r = sshbuf_get_cstring(copy, &krl->comment, NULL)) != 0) {
1092 error_fr(r, "parse KRL header");
1093 goto out;
1094 }
1095 format_timestamp(krl->generated_date, timestamp, sizeof(timestamp));
1096 debug("KRL version %llu generated at %s%s%s",
1097 (long long unsigned)krl->krl_version, timestamp,
1098 *krl->comment ? ": " : "", krl->comment);
1099
1100 /* Parse and load the KRL sections. */
1101 while (sshbuf_len(copy) > 0) {
1102 sshbuf_free(sect);
1103 sect = NULL;
1104 if ((r = sshbuf_get_u8(copy, &type)) != 0 ||
1105 (r = sshbuf_froms(copy, §)) != 0)
1106 goto out;
1107 KRL_DBG(("section 0x%02x", type));
1108
1109 switch (type) {
1110 case KRL_SECTION_CERTIFICATES:
1111 if ((r = parse_revoked_certs(sect, krl)) != 0)
1112 goto out;
1113 break;
1114 case KRL_SECTION_EXPLICIT_KEY:
1115 if ((r = blob_section(sect,
1116 &krl->revoked_keys, 0)) != 0)
1117 goto out;
1118 break;
1119 case KRL_SECTION_FINGERPRINT_SHA1:
1120 if ((r = blob_section(sect,
1121 &krl->revoked_sha1s, 20)) != 0)
1122 goto out;
1123 break;
1124 case KRL_SECTION_FINGERPRINT_SHA256:
1125 if ((r = blob_section(sect,
1126 &krl->revoked_sha256s, 32)) != 0)
1127 goto out;
1128 break;
1129 case KRL_SECTION_EXTENSION:
1130 if ((r = extension_section(sect, krl)) != 0)
1131 goto out;
1132 break;
1133 case KRL_SECTION_SIGNATURE:
1134 /* Handled above, but still need to stay in synch */
1135 sshbuf_free(sect);
1136 sect = NULL;
1137 if ((r = sshbuf_skip_string(copy)) != 0)
1138 goto out;
1139 break;
1140 default:
1141 error("Unsupported KRL section %u", type);
1142 r = SSH_ERR_INVALID_FORMAT;
1143 goto out;
1144 }
1145 if (sect != NULL && sshbuf_len(sect) > 0) {
1146 error("KRL section contains unparsed data");
1147 r = SSH_ERR_INVALID_FORMAT;
1148 goto out;
1149 }
1150 }
1151
1152 /* Success */
1153 *krlp = krl;
1154 r = 0;
1155 out:
1156 if (r != 0)
1157 ssh_krl_free(krl);
1158 sshbuf_free(copy);
1159 sshbuf_free(sect);
1160 return r;
1161 }
1162
1163 /* Checks certificate serial number and key ID revocation */
1164 static int
is_cert_revoked(const struct sshkey * key,struct revoked_certs * rc)1165 is_cert_revoked(const struct sshkey *key, struct revoked_certs *rc)
1166 {
1167 struct revoked_serial rs, *ers;
1168 struct revoked_key_id rki, *erki;
1169
1170 /* Check revocation by cert key ID */
1171 memset(&rki, 0, sizeof(rki));
1172 rki.key_id = key->cert->key_id;
1173 erki = RB_FIND(revoked_key_id_tree, &rc->revoked_key_ids, &rki);
1174 if (erki != NULL) {
1175 KRL_DBG(("revoked by key ID"));
1176 return SSH_ERR_KEY_REVOKED;
1177 }
1178
1179 /*
1180 * Zero serials numbers are ignored (it's the default when the
1181 * CA doesn't specify one).
1182 */
1183 if (key->cert->serial == 0)
1184 return 0;
1185
1186 memset(&rs, 0, sizeof(rs));
1187 rs.lo = rs.hi = key->cert->serial;
1188 ers = RB_FIND(revoked_serial_tree, &rc->revoked_serials, &rs);
1189 if (ers != NULL) {
1190 KRL_DBG(("revoked serial %llu matched %llu:%llu",
1191 key->cert->serial, ers->lo, ers->hi));
1192 return SSH_ERR_KEY_REVOKED;
1193 }
1194 return 0;
1195 }
1196
1197 /* Checks whether a given key/cert is revoked. Does not check its CA */
1198 static int
is_key_revoked(struct ssh_krl * krl,const struct sshkey * key)1199 is_key_revoked(struct ssh_krl *krl, const struct sshkey *key)
1200 {
1201 struct revoked_blob rb, *erb;
1202 struct revoked_certs *rc;
1203 int r;
1204
1205 /* Check explicitly revoked hashes first */
1206 memset(&rb, 0, sizeof(rb));
1207 if ((r = sshkey_fingerprint_raw(key, SSH_DIGEST_SHA1,
1208 &rb.blob, &rb.len)) != 0)
1209 return r;
1210 erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
1211 free(rb.blob);
1212 if (erb != NULL) {
1213 KRL_DBG(("revoked by key SHA1"));
1214 return SSH_ERR_KEY_REVOKED;
1215 }
1216 memset(&rb, 0, sizeof(rb));
1217 if ((r = sshkey_fingerprint_raw(key, SSH_DIGEST_SHA256,
1218 &rb.blob, &rb.len)) != 0)
1219 return r;
1220 erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha256s, &rb);
1221 free(rb.blob);
1222 if (erb != NULL) {
1223 KRL_DBG(("revoked by key SHA256"));
1224 return SSH_ERR_KEY_REVOKED;
1225 }
1226
1227 /* Next, explicit keys */
1228 memset(&rb, 0, sizeof(rb));
1229 if ((r = plain_key_blob(key, &rb.blob, &rb.len)) != 0)
1230 return r;
1231 erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb);
1232 free(rb.blob);
1233 if (erb != NULL) {
1234 KRL_DBG(("revoked by explicit key"));
1235 return SSH_ERR_KEY_REVOKED;
1236 }
1237
1238 if (!sshkey_is_cert(key))
1239 return 0;
1240
1241 /* Check cert revocation for the specified CA */
1242 if ((r = revoked_certs_for_ca_key(krl, key->cert->signature_key,
1243 &rc, 0)) != 0)
1244 return r;
1245 if (rc != NULL) {
1246 if ((r = is_cert_revoked(key, rc)) != 0)
1247 return r;
1248 }
1249 /* Check cert revocation for the wildcard CA */
1250 if ((r = revoked_certs_for_ca_key(krl, NULL, &rc, 0)) != 0)
1251 return r;
1252 if (rc != NULL) {
1253 if ((r = is_cert_revoked(key, rc)) != 0)
1254 return r;
1255 }
1256
1257 KRL_DBG(("%llu no match", key->cert->serial));
1258 return 0;
1259 }
1260
1261 int
ssh_krl_check_key(struct ssh_krl * krl,const struct sshkey * key)1262 ssh_krl_check_key(struct ssh_krl *krl, const struct sshkey *key)
1263 {
1264 int r;
1265
1266 KRL_DBG(("checking key"));
1267 if ((r = is_key_revoked(krl, key)) != 0)
1268 return r;
1269 if (sshkey_is_cert(key)) {
1270 debug2_f("checking CA key");
1271 if ((r = is_key_revoked(krl, key->cert->signature_key)) != 0)
1272 return r;
1273 }
1274 KRL_DBG(("key okay"));
1275 return 0;
1276 }
1277
1278 int
ssh_krl_file_contains_key(const char * path,const struct sshkey * key)1279 ssh_krl_file_contains_key(const char *path, const struct sshkey *key)
1280 {
1281 struct sshbuf *krlbuf = NULL;
1282 struct ssh_krl *krl = NULL;
1283 int oerrno = 0, r;
1284
1285 if (path == NULL)
1286 return 0;
1287 if ((r = sshbuf_load_file(path, &krlbuf)) != 0) {
1288 oerrno = errno;
1289 goto out;
1290 }
1291 if ((r = ssh_krl_from_blob(krlbuf, &krl)) != 0)
1292 goto out;
1293 debug2_f("checking KRL %s", path);
1294 r = ssh_krl_check_key(krl, key);
1295 out:
1296 sshbuf_free(krlbuf);
1297 ssh_krl_free(krl);
1298 if (r != 0)
1299 errno = oerrno;
1300 return r;
1301 }
1302
1303 int
krl_dump(struct ssh_krl * krl,FILE * f)1304 krl_dump(struct ssh_krl *krl, FILE *f)
1305 {
1306 struct sshkey *key = NULL;
1307 struct revoked_blob *rb;
1308 struct revoked_certs *rc;
1309 struct revoked_serial *rs;
1310 struct revoked_key_id *rki;
1311 int r, ret = 0;
1312 char *fp, timestamp[64];
1313
1314 /* Try to print in a KRL spec-compatible format */
1315 format_timestamp(krl->generated_date, timestamp, sizeof(timestamp));
1316 fprintf(f, "# KRL version %llu\n",
1317 (unsigned long long)krl->krl_version);
1318 fprintf(f, "# Generated at %s\n", timestamp);
1319 if (krl->comment != NULL && *krl->comment != '\0') {
1320 r = INT_MAX;
1321 asmprintf(&fp, INT_MAX, &r, "%s", krl->comment);
1322 fprintf(f, "# Comment: %s\n", fp);
1323 free(fp);
1324 }
1325 fputc('\n', f);
1326
1327 RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_keys) {
1328 if ((r = sshkey_from_blob(rb->blob, rb->len, &key)) != 0) {
1329 ret = SSH_ERR_INVALID_FORMAT;
1330 error_r(r, "parse KRL key");
1331 continue;
1332 }
1333 if ((fp = sshkey_fingerprint(key, SSH_FP_HASH_DEFAULT,
1334 SSH_FP_DEFAULT)) == NULL) {
1335 ret = SSH_ERR_INVALID_FORMAT;
1336 error("sshkey_fingerprint failed");
1337 continue;
1338 }
1339 fprintf(f, "hash: %s # %s\n", fp, sshkey_ssh_name(key));
1340 free(fp);
1341 free(key);
1342 }
1343 RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha256s) {
1344 fp = tohex(rb->blob, rb->len);
1345 fprintf(f, "hash: SHA256:%s\n", fp);
1346 free(fp);
1347 }
1348 RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha1s) {
1349 /*
1350 * There is not KRL spec keyword for raw SHA1 hashes, so
1351 * print them as comments.
1352 */
1353 fp = tohex(rb->blob, rb->len);
1354 fprintf(f, "# hash SHA1:%s\n", fp);
1355 free(fp);
1356 }
1357
1358 TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
1359 fputc('\n', f);
1360 if (rc->ca_key == NULL)
1361 fprintf(f, "# Wildcard CA\n");
1362 else {
1363 if ((fp = sshkey_fingerprint(rc->ca_key,
1364 SSH_FP_HASH_DEFAULT, SSH_FP_DEFAULT)) == NULL) {
1365 ret = SSH_ERR_INVALID_FORMAT;
1366 error("sshkey_fingerprint failed");
1367 continue;
1368 }
1369 fprintf(f, "# CA key %s %s\n",
1370 sshkey_ssh_name(rc->ca_key), fp);
1371 free(fp);
1372 }
1373 RB_FOREACH(rs, revoked_serial_tree, &rc->revoked_serials) {
1374 if (rs->lo == rs->hi) {
1375 fprintf(f, "serial: %llu\n",
1376 (unsigned long long)rs->lo);
1377 } else {
1378 fprintf(f, "serial: %llu-%llu\n",
1379 (unsigned long long)rs->lo,
1380 (unsigned long long)rs->hi);
1381 }
1382 }
1383 RB_FOREACH(rki, revoked_key_id_tree, &rc->revoked_key_ids) {
1384 /*
1385 * We don't want key IDs with embedded newlines to
1386 * mess up the display.
1387 */
1388 r = INT_MAX;
1389 asmprintf(&fp, INT_MAX, &r, "%s", rki->key_id);
1390 fprintf(f, "id: %s\n", fp);
1391 free(fp);
1392 }
1393 }
1394 return ret;
1395 }
1396