1  /*
  2   * Copyright (c) 2006,2011-2014 Apple Inc. All Rights Reserved.
  3   * 
  4   * @APPLE_LICENSE_HEADER_START@
  5   * 
  6   * This file contains Original Code and/or Modifications of Original Code
  7   * as defined in and that are subject to the Apple Public Source License
  8   * Version 2.0 (the 'License'). You may not use this file except in
  9   * compliance with the License. Please obtain a copy of the License at
 10   * http://www.opensource.apple.com/apsl/ and read it before using this
 11   * file.
 12   * 
 13   * The Original Code and all software distributed under the License are
 14   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 15   * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 16   * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 17   * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 18   * Please see the License for the specific language governing rights and
 19   * limitations under the License.
 20   * 
 21   * @APPLE_LICENSE_HEADER_END@
 22   */
 23  
 24  
 25  /*
 26   * opensshCoding.cpp - Encoding and decoding of OpenSSH format public keys.
 27   *
 28   */
 29  
 30  #include "SecImportExportOpenSSH.h"
 31  #include "SecImportExportUtils.h"
 32  #include "SecImportExportCrypto.h"
 33  #include <ctype.h>
 34  #include <CommonCrypto/CommonDigest.h>	/* for CC_MD5_DIGEST_LENGTH */
 35  #include <security_utilities/debugging.h>
 36  #include <security_cdsa_utils/cuCdsaUtils.h>
 37  
 38  #define SecSSHDbg(args...)	secinfo("openssh", ## args)
 39  
 40  #define SSHv2_PUB_KEY_NAME		"OpenSSHv2 Public Key"
 41  #define SSHv1_PUB_KEY_NAME		"OpenSSHv1 Public Key"
 42  #define SSHv1_PRIV_KEY_NAME		"OpenSSHv1 Private Key"
 43  
 44  #pragma mark --- Utility functions ---
 45  
 46  /* skip whitespace */
 47  static void skipWhite(
 48  	const unsigned char *&cp,
 49  	unsigned &bytesLeft)
 50  {
 51  	while(bytesLeft != 0) {
 52  		if(isspace((int)(*cp))) {
 53  			cp++;
 54  			bytesLeft--;
 55  		}
 56  		else {
 57  			return;
 58  		}
 59  	}
 60  }
 61  
 62  /* find next whitespace or EOF - if EOF, rtn pointer points to one past EOF */
 63  static const unsigned char *findNextWhite(
 64  	const unsigned char *cp,
 65  	unsigned &bytesLeft)
 66  {
 67  	while(bytesLeft != 0) {
 68  		if(isspace((int)(*cp))) {
 69  			return cp;
 70  		}
 71  		cp++;
 72  		bytesLeft--;
 73  	}
 74  	return cp;
 75  }
 76  
 77  /* obtain comment as the n'th whitespace-delimited field */
 78  static char *commentAsNthField(
 79  	const unsigned char *key,
 80  	unsigned keyLen,
 81  	unsigned n)
 82  
 83  {
 84  	unsigned dex;
 85  	
 86  	skipWhite(key, keyLen);
 87  	if(keyLen == 0) {
 88  		return NULL;
 89  	}
 90  	for(dex=0; dex<(n-1); dex++) {
 91  		key = findNextWhite(key, keyLen);
 92  		if(keyLen == 0) {
 93  			return NULL;
 94  		}
 95  		skipWhite(key, keyLen);
 96  		if(keyLen == 0) {
 97  			return NULL;
 98  		}
 99  	}
100  	
101  	/* cp points to start of nth field */
102  	char *rtnStr = (char *)malloc(keyLen + 1);
103  	memmove(rtnStr, key, keyLen);
104  	if(rtnStr[keyLen - 1] == '\n') {
105  		/* normal terminator - snip it off */
106  		rtnStr[keyLen - 1] = '\0';
107  	}
108  	else {
109  		rtnStr[keyLen] = '\0';
110  	}
111  	return rtnStr;
112  
113  }
114  
115  static uint32_t readUint32(
116  	const unsigned char *&cp,		// IN/OUT
117  	unsigned &len)					// IN/OUT 
118  {
119  	uint32_t r = 0;
120  	
121  	for(unsigned dex=0; dex<sizeof(uint32_t); dex++) {
122  		r <<= 8;
123  		r |= *cp++;
124  	}
125  	len -= 4;
126  	return r;
127  }
128  
129  static uint16_t readUint16(
130  	const unsigned char *&cp,		// IN/OUT
131  	unsigned &len)					// IN/OUT 
132  {
133  	uint16_t r = *cp++;
134  	r <<= 8;
135  	r |= *cp++;
136  	len -= 2;
137  	return r;
138  }
139  
140  /* Skip over an SSHv1 private key formatted bignum */
141  static void skipBigNum(
142  	const unsigned char *&cp,		// IN/OUT
143  	unsigned &len)					// IN/OUT 
144  {
145  	if(len < 2) {
146  		cp += len;
147  		len = 0;
148  		return;
149  	}
150  	uint16 numBits = readUint16(cp, len);
151  	unsigned numBytes = (numBits + 7) / 8;
152  	if(numBytes > len) {
153  		cp += len;
154  		len = 0;
155  		return;
156  	}
157  	cp += numBytes;
158  	len -= numBytes;
159  }
160  
161  static char *genPrintName(
162  	const char *header,		// e.g. SSHv2_PUB_KEY_NAME
163  	const char *comment)	// optional, from key 
164  {
165  	size_t totalLen = strlen(header) + 1;
166  	if(comment) {
167  		/* append ": <comment>" */
168  		totalLen += strlen(comment);
169  		totalLen += 2;
170  	}
171  	char *rtnStr = (char *)malloc(totalLen);
172  	if(comment) {
173  		snprintf(rtnStr, totalLen, "%s: %s", header, comment);
174  	}
175  	else {
176  		strcpy(rtnStr, header);
177  	}
178  	return rtnStr;
179  }
180  
181  #pragma mark --- Infer PrintName attribute from raw keys ---
182  
183  /* obtain comment from OpenSSHv2 public key */
184  static char *opensshV2PubComment(
185  	const unsigned char *key,
186  	unsigned keyLen)
187  {
188  	/*
189  	 * The format here is
190  	 * header
191  	 * <space>
192  	 * keyblob
193  	 * <space>
194  	 * optional comment
195  	 * \n
196  	 */
197  	char *comment = commentAsNthField(key, keyLen, 3);
198  	char *rtnStr = genPrintName(SSHv2_PUB_KEY_NAME, comment);
199  	if(comment) {
200  		free(comment);
201  	}
202  	return rtnStr;
203  }
204  
205  /* obtain comment from OpenSSHv1 public key */
206  static char *opensshV1PubComment(
207  	const unsigned char *key,
208  	unsigned keyLen)
209  {
210  	/*
211  	 * Format:
212  	 * numbits
213  	 * <space>
214  	 * e (bignum in decimal)
215  	 * <space>
216  	 * n (bignum in decimal) 
217  	 * <space>
218  	 * optional comment 
219  	 * \n
220  	 */
221  	char *comment = commentAsNthField(key, keyLen, 4);
222  	char *rtnStr = genPrintName(SSHv1_PUB_KEY_NAME, comment);
223  	if(comment) {
224  		free(comment);
225  	}
226  	return rtnStr;
227  }
228  
229  static const char *authfile_id_string = "SSH PRIVATE KEY FILE FORMAT 1.1\n";
230  
231  /* obtain comment from OpenSSHv1 private key, wrapped or clear */
232  static char *opensshV1PrivComment(
233  	const unsigned char *key,
234  	unsigned keyLen)
235  {
236  	/* 
237  	 * Format:
238  	 * "SSH PRIVATE KEY FILE FORMAT 1.1\n"
239  	 * 1 byte cipherSpec
240  	 * 4 byte spares
241  	 * 4 bytes numBits
242  	 * bignum n
243  	 * bignum e
244  	 * 4 byte comment length 
245  	 * comment
246  	 * private key components, possibly encrypted 
247  	 *
248  	 * A bignum is encoded like so:
249  	 * 2 bytes numBits
250  	 * (numBits + 7)/8 bytes of data
251  	 */
252  	/* length: ID string, NULL, Cipher, 4-byte spare */
253  	size_t len = strlen(authfile_id_string);
254  	if(keyLen < (len + 6)) {
255  		return NULL;
256  	}
257  	if(memcmp(authfile_id_string, key, len)) {
258  		return NULL;
259  	}
260  	key    += (len + 6);
261  	keyLen -= (len + 6);
262  	
263  	/* key points to numBits */
264  	if(keyLen < 4) {
265  		return NULL;
266  	}
267  	key += 4;
268  	keyLen -= 4;
269  	
270  	/* key points to n */
271  	skipBigNum(key, keyLen);
272  	if(keyLen == 0) {
273  		return NULL;
274  	}
275  	skipBigNum(key, keyLen);
276  	if(keyLen == 0) {
277  		return NULL;
278  	}
279  	
280  	char *comment = NULL;
281  	uint32 commentLen = readUint32(key, keyLen);
282  	if((commentLen != 0) && (commentLen <= keyLen)) {
283  		comment = (char *)malloc(commentLen + 1);
284  		memmove(comment, key, commentLen);
285  		comment[commentLen] = '\0';
286  	}
287  	
288  	char *rtnStr = genPrintName(SSHv1_PRIV_KEY_NAME, comment);
289  	if(comment) {
290  		free(comment);
291  	}
292  	return rtnStr;
293  }
294  
295  /* 
296   * Infer PrintName attribute from raw key's 'comment' field. 
297   * Returned string is mallocd and must be freed by caller. 
298   */
299  char *impExpOpensshInferPrintName(
300  	CFDataRef external, 
301  	SecExternalItemType externType, 
302  	SecExternalFormat externFormat)
303  {
304  	const unsigned char *key = (const unsigned char *)CFDataGetBytePtr(external);
305  	unsigned keyLen = (unsigned)CFDataGetLength(external);
306  	switch(externType) {
307  		case kSecItemTypePublicKey:
308  			switch(externFormat) {
309  				case kSecFormatSSH:
310  					return opensshV1PubComment(key, keyLen);
311  				case kSecFormatSSHv2:
312  					return opensshV2PubComment(key, keyLen);
313  				default:
314  					/* impossible, right? */
315  					break;
316  			}
317  			break;
318  		case kSecItemTypePrivateKey:
319  			switch(externFormat) {
320  				case kSecFormatSSH:
321  				case kSecFormatWrappedSSH:
322  					return opensshV1PrivComment(key, keyLen);
323  				default:
324  					break;
325  			}
326  			break;
327  		default:
328  			break;
329  	}
330  	return NULL;
331  }
332  
333  #pragma mark --- Infer DescriptiveData from PrintName ---
334  
335  /* 
336   * Infer DescriptiveData (i.e., comment) from a SecKeyRef's PrintName
337   * attribute.
338   */
339  void impExpOpensshInferDescData(
340  	SecKeyRef keyRef,
341  	CssmOwnedData &descData)
342  {
343  	OSStatus ortn;
344  	SecKeychainAttributeInfo attrInfo;
345  	SecKeychainAttrType	attrType = kSecKeyPrintName;
346  	attrInfo.count = 1;
347  	attrInfo.tag = &attrType;
348  	attrInfo.format = NULL;	
349  	SecKeychainAttributeList *attrList = NULL;
350  	
351  	ortn = SecKeychainItemCopyAttributesAndData(
352  		(SecKeychainItemRef)keyRef, 
353  		&attrInfo,
354  		NULL,			// itemClass
355  		&attrList, 
356  		NULL,			// don't need the data
357  		NULL);
358  	if(ortn) {
359  		SecSSHDbg("SecKeychainItemCopyAttributesAndData returned %ld", (unsigned long)ortn);
360  		return;
361  	}
362  	/* subsequent errors to errOut: */
363  	SecKeychainAttribute *attr = attrList->attr;
364  		
365  	/*
366  	 * On a previous import, we would have set this to something like 
367  	 * "OpenSSHv2 Public Key: comment".
368  	 * We want to strip off everything up to the actual comment.
369  	 */
370  	unsigned toStrip = 0;	
371  	
372  	/* min length of attribute value for this code to be meaningful */
373  	unsigned len = strlen(SSHv2_PUB_KEY_NAME) + 1;	
374  	char *printNameStr = NULL;
375  	if(len < attr->length) {
376  		printNameStr = (char *)malloc(attr->length + 1);
377  		memmove(printNameStr, attr->data, attr->length);
378  		printNameStr[attr->length] = '\0';
379  		if(strstr(printNameStr, SSHv2_PUB_KEY_NAME) == printNameStr) {
380  			toStrip = strlen(SSHv2_PUB_KEY_NAME);
381  		}
382  		else if(strstr(printNameStr, SSHv1_PUB_KEY_NAME) == printNameStr) {
383  			toStrip = strlen(SSHv1_PUB_KEY_NAME);
384  		}
385  		else if(strstr(printNameStr, SSHv1_PRIV_KEY_NAME) == printNameStr) {
386  			toStrip = strlen(SSHv1_PRIV_KEY_NAME);
387  		}
388  		if(toStrip) {
389  			/* only strip if we have ": " after toStrip bytes */
390  			if((printNameStr[toStrip] == ':') && (printNameStr[toStrip+1] == ' ')) {
391  				toStrip += 2;
392  			}
393  		}
394  	}
395  	if(printNameStr) {
396  		free(printNameStr);
397  	}
398  	len = attr->length;
399  
400  	unsigned char *attrVal;
401  
402  	if(len < toStrip) {
403  		SecSSHDbg("impExpOpensshInferDescData: string parse screwup");
404  		goto errOut;
405  	}
406  	if(len > toStrip) {
407  		/* Normal case of stripping off leading header */
408  		len -= toStrip;
409  	}
410  	else {
411  		/* 
412  		 * If equal, then the attr value *is* "OpenSSHv2 Public Key: " with 
413  		 * no comment. Not sure how that could happen, but let's be careful.
414  		 */
415  		toStrip = 0;
416  	}
417  	
418  	attrVal = ((unsigned char *)attr->data) + toStrip;
419  	descData.copy(attrVal, len);
420  errOut:
421  	SecKeychainItemFreeAttributesAndData(attrList, NULL);
422  	return;
423  }
424  
425  #pragma mark --- Derive SSHv1 wrap/unwrap key ---
426  
427  /* 
428   * Common code to derive a wrap/unwrap key for OpenSSHv1.
429   * Caller must CSSM_FreeKey when done.
430   */
431  static CSSM_RETURN openSSHv1DeriveKey(
432  	CSSM_CSP_HANDLE		cspHand,
433  	const SecKeyImportExportParameters	*keyParams,		// required 
434  	impExpVerifyPhrase  verifyPhrase,					// for secure passphrase
435  	CSSM_KEY_PTR		symKey)							// RETURNED
436  {
437  	CSSM_KEY					*passKey = NULL;
438  	CFDataRef					cfPhrase = NULL;
439  	CSSM_RETURN					crtn;
440  	OSStatus					ortn;
441  	CSSM_DATA					dummyLabel;
442  	uint32						keyAttr;
443  	CSSM_CC_HANDLE 				ccHand = 0;
444  	CSSM_ACCESS_CREDENTIALS		creds;
445  	CSSM_CRYPTO_DATA			seed;
446  	CSSM_DATA					nullParam = {0, NULL};
447  	
448  	memset(symKey, 0, sizeof(CSSM_KEY));
449  	
450  	/* passphrase or passkey? */
451  	ortn = impExpPassphraseCommon(keyParams, cspHand, SPF_Data, verifyPhrase,
452  		(CFTypeRef *)&cfPhrase, &passKey);
453  	if(ortn) {
454  		return ortn;
455  	}
456  	/* subsequent errors to errOut: */
457  
458  	memset(&seed, 0, sizeof(seed));
459  	if(cfPhrase != NULL) {
460  		/* TBD - caller-supplied empty passphrase means "export in the clear" */
461  		size_t len = CFDataGetLength(cfPhrase);
462  		seed.Param.Data = (uint8 *)malloc(len);
463  		seed.Param.Length = len;
464  		memmove(seed.Param.Data, CFDataGetBytePtr(cfPhrase), len);
465  		CFRelease(cfPhrase);
466  	}
467  
468  	memset(&creds, 0, sizeof(CSSM_ACCESS_CREDENTIALS));
469  	crtn = CSSM_CSP_CreateDeriveKeyContext(cspHand,
470  		CSSM_ALGID_OPENSSH1,
471  		CSSM_ALGID_OPENSSH1,
472  		CC_MD5_DIGEST_LENGTH * 8,
473  		&creds,
474  		passKey,		// BaseKey
475  		0,				// iterationCount
476  		NULL,			// salt
477  		&seed,
478  		&ccHand);
479  	if(crtn) {
480  		SecSSHDbg("openSSHv1DeriveKey CSSM_CSP_CreateDeriveKeyContext failure");
481  		goto errOut;
482  	}
483  	
484  	/* not extractable even for the short time this key lives */
485  	keyAttr = CSSM_KEYATTR_RETURN_REF | CSSM_KEYATTR_SENSITIVE;
486  	dummyLabel.Data = (uint8 *)"temp unwrap key";
487  	dummyLabel.Length = strlen((char *)dummyLabel.Data);
488  	
489  	crtn = CSSM_DeriveKey(ccHand,
490  		&nullParam,
491  		CSSM_KEYUSE_ANY,
492  		keyAttr,
493  		&dummyLabel,
494  		NULL,			// cred and acl
495  		symKey);
496  	if(crtn) {
497  		SecSSHDbg("openSSHv1DeriveKey CSSM_DeriveKey failure");
498  	}
499  errOut:
500  	if(ccHand != 0) {
501  		CSSM_DeleteContext(ccHand);
502  	}
503  	if(passKey != NULL) {
504  		CSSM_FreeKey(cspHand, NULL, passKey, CSSM_FALSE);
505  		free(passKey);
506  	}
507  	if(seed.Param.Data) {
508  		memset(seed.Param.Data, 0, seed.Param.Length);
509  		free(seed.Param.Data);
510  	}
511  	return crtn;
512  }
513  
514  #pragma mark -- OpenSSHv1 Wrap/Unwrap ---
515  
516  /*
517   * If cspHand is provided instead of importKeychain, the CSP 
518   * handle MUST be for the CSPDL, not for the raw CSP.
519   */
520  OSStatus impExpWrappedOpenSSHImport(
521  	CFDataRef							inData,
522  	SecKeychainRef						importKeychain, // optional
523  	CSSM_CSP_HANDLE						cspHand,		// required
524  	SecItemImportExportFlags			flags,
525  	const SecKeyImportExportParameters	*keyParams,		// optional 
526  	const char							*printName,
527  	CFMutableArrayRef					outArray)		// optional, append here 
528  {
529  	OSStatus				ortn;
530  	impExpKeyUnwrapParams   unwrapParams;
531  
532  	assert(cspHand != 0);
533  	if(keyParams == NULL) {
534  		return errSecParam;
535  	}
536  	memset(&unwrapParams, 0, sizeof(unwrapParams));
537  
538  	/* derive unwrapping key */
539  	CSSM_KEY unwrappingKey;
540  	
541  	ortn = openSSHv1DeriveKey(cspHand, keyParams, VP_Import, &unwrappingKey);
542  	if(ortn) {
543  		return ortn;
544  	}
545  	
546  	/* set up key to unwrap */
547  	CSSM_KEY				wrappedKey;
548  	CSSM_KEYHEADER			&hdr = wrappedKey.KeyHeader;
549  	memset(&wrappedKey, 0, sizeof(CSSM_KEY));
550  	hdr.HeaderVersion = CSSM_KEYHEADER_VERSION;
551  	/* CspId : don't care */
552  	hdr.BlobType = CSSM_KEYBLOB_WRAPPED;
553  	hdr.Format = CSSM_KEYBLOB_WRAPPED_FORMAT_OPENSSH1;
554  	hdr.AlgorithmId = CSSM_ALGID_RSA;		/* the oly algorithm supported in SSHv1 */
555  	hdr.KeyClass = CSSM_KEYCLASS_PRIVATE_KEY;
556  	/* LogicalKeySizeInBits : calculated by CSP during unwrap */
557  	hdr.KeyAttr = CSSM_KEYATTR_EXTRACTABLE;
558  	hdr.KeyUsage = CSSM_KEYUSE_ANY;
559  
560  	wrappedKey.KeyData.Data = (uint8 *)CFDataGetBytePtr(inData);
561  	wrappedKey.KeyData.Length = CFDataGetLength(inData);
562  	
563  	unwrapParams.unwrappingKey = &unwrappingKey;
564  	unwrapParams.encrAlg = CSSM_ALGID_OPENSSH1;
565  	
566  	/* GO */
567  	ortn =  impExpImportKeyCommon(&wrappedKey, importKeychain, cspHand,
568  		flags, keyParams, &unwrapParams, printName, outArray);
569  		
570  	if(unwrappingKey.KeyData.Data != NULL) {
571  		CSSM_FreeKey(cspHand, NULL, &unwrappingKey, CSSM_FALSE);
572  	}
573  	return ortn;
574  }
575  
576  OSStatus impExpWrappedOpenSSHExport(
577  	SecKeyRef							secKey,
578  	SecItemImportExportFlags			flags,		
579  	const SecKeyImportExportParameters	*keyParams,		// optional 
580  	const CssmData						&descData,
581  	CFMutableDataRef					outData)		// output appended here
582  {
583  	CSSM_CSP_HANDLE cspdlHand = 0;
584  	OSStatus ortn;
585  	bool releaseCspHand = false;
586  	CSSM_RETURN crtn;
587  	
588  	if(keyParams == NULL) {
589  		return errSecParam;
590  	}
591  
592  	/* we need a CSPDL handle - try to get it from the key */	
593  	ortn = SecKeyGetCSPHandle(secKey, &cspdlHand);
594  	if(ortn) {
595  		cspdlHand = cuCspStartup(CSSM_FALSE);
596  		if(cspdlHand == 0) {
597  			return CSSMERR_CSSM_ADDIN_LOAD_FAILED;
598  		}
599  		releaseCspHand = true;
600  	}
601  	/* subsequent errors to errOut: */
602  
603  	/* derive wrapping key */
604  	CSSM_KEY wrappingKey;
605  	crtn = openSSHv1DeriveKey(cspdlHand, keyParams, VP_Export, &wrappingKey);
606  	if(crtn) {
607  		goto errOut;
608  	}
609  	
610  	/* GO */
611  	CSSM_KEY wrappedKey;
612  	memset(&wrappedKey, 0, sizeof(CSSM_KEY));
613  	
614  	crtn = impExpExportKeyCommon(cspdlHand, secKey, &wrappingKey, &wrappedKey,
615  		CSSM_ALGID_OPENSSH1, CSSM_ALGMODE_NONE, CSSM_PADDING_NONE,
616  		CSSM_KEYBLOB_WRAPPED_FORMAT_OPENSSH1, CSSM_ATTRIBUTE_NONE, CSSM_KEYBLOB_RAW_FORMAT_NONE, 
617  		&descData,
618  		NULL);	// IV
619  	if(crtn) {
620  		goto errOut;
621  	}
622  	
623  	/* the wrappedKey's KeyData is out output */
624  	CFDataAppendBytes(outData, wrappedKey.KeyData.Data, wrappedKey.KeyData.Length);
625  	CSSM_FreeKey(cspdlHand, NULL, &wrappedKey, CSSM_FALSE);
626  	
627  errOut:
628  	if(releaseCspHand) {
629  		cuCspDetachUnload(cspdlHand, CSSM_FALSE);
630  	}
631  	return crtn;
632  
633  }