Blob Blame History Raw
From 41c4661b6fd237b156606bfd0d8ca3edd5a16795 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Wed, 14 Nov 2018 21:13:53 +0100
Subject: [PATCH 72/74] utils: add ec_pub_key_to_ssh() (OpenSSL)

Add EC key support for the OpenSSL version of the ssh key extraction
code.

Related to https://pagure.io/SSSD/sssd/issue/3887

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
---
 src/tests/cmocka/test_cert_utils.c |  70 ++++++++++++++++
 src/util/cert/libcrypto/cert.c     | 126 ++++++++++++++++++++++++++++-
 2 files changed, 195 insertions(+), 1 deletion(-)

diff --git a/src/tests/cmocka/test_cert_utils.c b/src/tests/cmocka/test_cert_utils.c
index 26fffb870..9273356eb 100644
--- a/src/tests/cmocka/test_cert_utils.c
+++ b/src/tests/cmocka/test_cert_utils.c
@@ -40,11 +40,15 @@
 #include "tests/test_CA/SSSD_test_cert_x509_0001.h"
 #include "tests/test_CA/SSSD_test_cert_pubsshkey_0002.h"
 #include "tests/test_CA/SSSD_test_cert_x509_0002.h"
+#include "tests/test_ECC_CA/SSSD_test_ECC_cert_pubsshkey_0001.h"
+#include "tests/test_ECC_CA/SSSD_test_ECC_cert_x509_0001.h"
 #else
 #define SSSD_TEST_CERT_0001 ""
 #define SSSD_TEST_CERT_SSH_KEY_0001 ""
 #define SSSD_TEST_CERT_0002 ""
 #define SSSD_TEST_CERT_SSH_KEY_0002 ""
+#define SSSD_TEST_ECC_CERT_0001 ""
+#define SSSD_TEST_ECC_CERT_SSH_KEY_0001 ""
 #endif
 
 /* When run under valgrind with --trace-children=yes we have to increase the
@@ -564,6 +568,70 @@ void test_cert_to_ssh_2keys_invalid_send(void **state)
     talloc_free(ev);
 }
 
+void test_ec_cert_to_ssh_key_done(struct tevent_req *req)
+{
+    int ret;
+    struct test_state *ts = tevent_req_callback_data(req, struct test_state);
+    struct ldb_val *keys;
+    uint8_t *exp_key;
+    size_t exp_key_size;
+    size_t valid_keys;
+
+    assert_non_null(ts);
+    ts->done = true;
+
+    ret = cert_to_ssh_key_recv(req, ts, &keys, &valid_keys);
+    talloc_free(req);
+    assert_int_equal(ret, 0);
+    assert_non_null(keys[0].data);
+    assert_int_equal(valid_keys, 1);
+
+    exp_key = sss_base64_decode(ts, SSSD_TEST_ECC_CERT_SSH_KEY_0001,
+                                &exp_key_size);
+    assert_non_null(exp_key);
+    assert_int_equal(keys[0].length, exp_key_size);
+    assert_memory_equal(keys[0].data, exp_key, exp_key_size);
+
+    talloc_free(exp_key);
+    talloc_free(keys);
+}
+
+void test_ec_cert_to_ssh_key_send(void **state)
+{
+    struct tevent_context *ev;
+    struct tevent_req *req;
+    struct ldb_val val[1];
+
+    struct test_state *ts = talloc_get_type_abort(*state, struct test_state);
+    assert_non_null(ts);
+    ts->done = false;
+
+    val[0].data = sss_base64_decode(ts, SSSD_TEST_ECC_CERT_0001,
+                                    &val[0].length);
+    assert_non_null(val[0].data);
+
+    ev = tevent_context_init(ts);
+    assert_non_null(ev);
+
+    req = cert_to_ssh_key_send(ts, ev, -1, P11_CHILD_TIMEOUT,
+#ifdef HAVE_NSS
+                    "sql:" ABS_BUILD_DIR "/src/tests/test_ECC_CA/p11_ecc_nssdb",
+#else
+                    ABS_BUILD_DIR "/src/tests/test_ECC_CA/SSSD_test_ECC_CA.pem",
+#endif
+                    1, &val[0], NULL);
+    assert_non_null(req);
+
+    tevent_req_set_callback(req, test_ec_cert_to_ssh_key_done, ts);
+
+    while (!ts->done) {
+        tevent_loop_once(ev);
+    }
+
+    talloc_free(val[0].data);
+    talloc_free(ev);
+}
+
 int main(int argc, const char *argv[])
 {
     poptContext pc;
@@ -595,6 +663,8 @@ int main(int argc, const char *argv[])
                                         setup, teardown),
         cmocka_unit_test_setup_teardown(test_cert_to_ssh_2keys_invalid_send,
                                         setup, teardown),
+        cmocka_unit_test_setup_teardown(test_ec_cert_to_ssh_key_send,
+                                        setup, teardown),
 #endif
     };
 
diff --git a/src/util/cert/libcrypto/cert.c b/src/util/cert/libcrypto/cert.c
index d925c5c5b..acca07dd0 100644
--- a/src/util/cert/libcrypto/cert.c
+++ b/src/util/cert/libcrypto/cert.c
@@ -168,6 +168,123 @@ done:
 
 }
 
+/* SSH EC keys are defined in https://tools.ietf.org/html/rfc5656 */
+#define ECDSA_SHA2_HEADER "ecdsa-sha2-"
+/* Looks like OpenSSH currently only supports the following 3 required
+ * curves. */
+#define IDENTIFIER_NISTP256 "nistp256"
+#define IDENTIFIER_NISTP384 "nistp384"
+#define IDENTIFIER_NISTP521 "nistp521"
+
+static errno_t ec_pub_key_to_ssh(TALLOC_CTX *mem_ctx, EVP_PKEY *cert_pub_key,
+                                 uint8_t **key_blob, size_t *key_size)
+{
+    int ret;
+    size_t c;
+    uint8_t *buf = NULL;
+    size_t buf_len;
+    EC_KEY *ec_key = NULL;
+    const EC_GROUP *ec_group = NULL;
+    const EC_POINT *ec_public_key = NULL;
+    BN_CTX *bn_ctx = NULL;
+    int key_len;
+    const char *identifier = NULL;
+    int identifier_len;
+    const char *header = NULL;
+    int header_len;
+
+    ec_key = EVP_PKEY_get1_EC_KEY(cert_pub_key);
+    if (ec_key == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
+    ec_group = EC_KEY_get0_group(ec_key);
+
+    switch(EC_GROUP_get_curve_name(ec_group)) {
+    case NID_X9_62_prime256v1:
+        identifier = IDENTIFIER_NISTP256;
+        header = ECDSA_SHA2_HEADER IDENTIFIER_NISTP256;
+        break;
+    case NID_secp384r1:
+        identifier = IDENTIFIER_NISTP384;
+        header = ECDSA_SHA2_HEADER IDENTIFIER_NISTP384;
+        break;
+    case NID_secp521r1:
+        identifier = IDENTIFIER_NISTP521;
+        header = ECDSA_SHA2_HEADER IDENTIFIER_NISTP521;
+        break;
+    default:
+        DEBUG(SSSDBG_CRIT_FAILURE, "Unsupported curve [%s]\n",
+              OBJ_nid2sn(EC_GROUP_get_curve_name(ec_group)));
+        ret = EINVAL;
+        goto done;
+    }
+
+    header_len = strlen(header);
+    identifier_len = strlen(identifier);
+
+    ec_public_key = EC_KEY_get0_public_key(ec_key);
+
+    bn_ctx =  BN_CTX_new();
+    if (bn_ctx == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "BN_CTX_new failed.\n");
+        ret = ENOMEM;
+        goto done;
+    }
+
+    key_len = EC_POINT_point2oct(ec_group, ec_public_key,
+                             POINT_CONVERSION_UNCOMPRESSED, NULL, 0, bn_ctx);
+    if (key_len == 0) {
+        DEBUG(SSSDBG_OP_FAILURE, "EC_POINT_point2oct failed.\n");
+        ret = EINVAL;
+        goto done;
+    }
+
+    buf_len = header_len + identifier_len + key_len + 3 * sizeof(uint32_t);
+    buf = talloc_size(mem_ctx, buf_len * sizeof(uint8_t));
+    if (buf == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "talloc_size failed.\n");
+        ret = ENOMEM;
+        goto done;
+    }
+
+    c = 0;
+
+    SAFEALIGN_SET_UINT32(buf, htobe32(header_len), &c);
+    safealign_memcpy(&buf[c], header, header_len, &c);
+
+    SAFEALIGN_SET_UINT32(&buf[c], htobe32(identifier_len), &c);
+    safealign_memcpy(&buf[c], identifier , identifier_len, &c);
+
+    SAFEALIGN_SET_UINT32(&buf[c], htobe32(key_len), &c);
+
+    if (EC_POINT_point2oct(ec_group, ec_public_key,
+                           POINT_CONVERSION_UNCOMPRESSED, buf + c, key_len,
+                           bn_ctx)
+            != key_len) {
+        DEBUG(SSSDBG_OP_FAILURE, "EC_POINT_point2oct failed.\n");
+        ret = EINVAL;
+        goto done;
+    }
+
+    *key_size = buf_len;
+    *key_blob = buf;
+
+    ret = EOK;
+
+done:
+    if (ret != EOK) {
+        talloc_free(buf);
+    }
+
+    BN_CTX_free(bn_ctx);
+    EC_KEY_free(ec_key);
+
+    return ret;
+}
+
+
 #define SSH_RSA_HEADER "ssh-rsa"
 #define SSH_RSA_HEADER_LEN (sizeof(SSH_RSA_HEADER) - 1)
 
@@ -277,9 +394,16 @@ errno_t get_ssh_key_from_cert(TALLOC_CTX *mem_ctx,
             goto done;
         }
         break;
+    case EVP_PKEY_EC:
+        ret = ec_pub_key_to_ssh(mem_ctx, cert_pub_key, key_blob, key_size);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE, "rsa_pub_key_to_ssh failed.\n");
+            goto done;
+        }
+        break;
     default:
         DEBUG(SSSDBG_CRIT_FAILURE,
-              "Expected RSA public key, found unsupported [%d].\n",
+              "Expected RSA or EC public key, found unsupported [%d].\n",
               EVP_PKEY_base_id(cert_pub_key));
         ret = EINVAL;
         goto done;
-- 
2.19.1