1 86693a33 2023-06-11 op /*
  2 86693a33 2023-06-11 op  * Copyright (c) 2023 Omar Polo <op@omarpolo.com>
  3 86693a33 2023-06-11 op  * Copyright (c) 2014 Reyk Floeter <reyk@openbsd.org>
  4 86693a33 2023-06-11 op  * Copyright (c) 2012 Gilles Chehade <gilles@poolp.org>
  5 86693a33 2023-06-11 op  *
  6 86693a33 2023-06-11 op  * Permission to use, copy, modify, and distribute this software for any
  7 86693a33 2023-06-11 op  * purpose with or without fee is hereby granted, provided that the above
  8 86693a33 2023-06-11 op  * copyright notice and this permission notice appear in all copies.
  9 86693a33 2023-06-11 op  *
 10 86693a33 2023-06-11 op  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 11 86693a33 2023-06-11 op  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 12 86693a33 2023-06-11 op  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 13 86693a33 2023-06-11 op  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 14 86693a33 2023-06-11 op  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 15 86693a33 2023-06-11 op  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 16 86693a33 2023-06-11 op  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 17 86693a33 2023-06-11 op  */
 18 86693a33 2023-06-11 op 
 19 86693a33 2023-06-11 op #include "gmid.h"
 20 86693a33 2023-06-11 op 
 21 86693a33 2023-06-11 op #include <string.h>
 22 86693a33 2023-06-11 op 
 23 86693a33 2023-06-11 op #include <openssl/err.h>
 24 86693a33 2023-06-11 op #include <openssl/pem.h>
 25 86693a33 2023-06-11 op 
 26 86693a33 2023-06-11 op #include "log.h"
 27 86693a33 2023-06-11 op #include "proc.h"
 28 86693a33 2023-06-11 op 
 29 86693a33 2023-06-11 op #ifndef nitems
 30 86693a33 2023-06-11 op #define nitems(_a) (sizeof((_a)) / sizeof((_a)[0]))
 31 86693a33 2023-06-11 op #endif
 32 86693a33 2023-06-11 op 
 33 86693a33 2023-06-11 op static void crypto_init(struct privsep *, struct privsep_proc *, void *);
 34 86693a33 2023-06-11 op static int crypto_dispatch_parent(int, struct privsep_proc *, struct imsg *);
 35 86693a33 2023-06-11 op static int crypto_dispatch_server(int, struct privsep_proc *, struct imsg *);
 36 86693a33 2023-06-11 op 
 37 86693a33 2023-06-11 op static struct privsep_proc procs[] = {
 38 86693a33 2023-06-11 op 	{ "parent",	PROC_PARENT,	crypto_dispatch_parent },
 39 86693a33 2023-06-11 op 	{ "server",	PROC_SERVER,	crypto_dispatch_server },
 40 86693a33 2023-06-11 op };
 41 86693a33 2023-06-11 op 
 42 86693a33 2023-06-11 op struct imsg_crypto_req {
 43 86693a33 2023-06-11 op 	uint64_t	 id;
 44 86693a33 2023-06-11 op 	char		 hash[TLS_CERT_HASH_SIZE];
 45 86693a33 2023-06-11 op 	size_t		 flen;
 46 86693a33 2023-06-11 op 	size_t		 tlen;
 47 86693a33 2023-06-11 op 	int		 padding;
 48 86693a33 2023-06-11 op 	/* followed by flen bytes of `from'. */
 49 86693a33 2023-06-11 op };
 50 86693a33 2023-06-11 op 
 51 86693a33 2023-06-11 op struct imsg_crypto_res {
 52 86693a33 2023-06-11 op 	uint64_t	 id;
 53 86693a33 2023-06-11 op 	int		 ret;
 54 86693a33 2023-06-11 op 	size_t		 len;
 55 86693a33 2023-06-11 op 	/* followed by len bytes of reply */
 56 86693a33 2023-06-11 op };
 57 86693a33 2023-06-11 op 
 58 86693a33 2023-06-11 op static uint64_t		 reqid;
 59 86693a33 2023-06-11 op static struct conf	*conf;
 60 86693a33 2023-06-11 op 
 61 86693a33 2023-06-11 op void
 62 86693a33 2023-06-11 op crypto(struct privsep *ps, struct privsep_proc *p)
 63 86693a33 2023-06-11 op {
 64 86693a33 2023-06-11 op 	proc_run(ps, p, procs, nitems(procs), crypto_init, NULL);
 65 86693a33 2023-06-11 op }
 66 86693a33 2023-06-11 op 
 67 86693a33 2023-06-11 op static void
 68 86693a33 2023-06-11 op crypto_init(struct privsep *ps, struct privsep_proc *p, void *arg)
 69 86693a33 2023-06-11 op {
 70 86693a33 2023-06-11 op #if 0
 71 86693a33 2023-06-11 op 	static volatile int attached;
 72 86693a33 2023-06-11 op 	while (!attached) sleep(1);
 73 86693a33 2023-06-11 op #endif
 74 86693a33 2023-06-11 op 
 75 86693a33 2023-06-11 op 	conf = ps->ps_env;
 76 86693a33 2023-06-11 op 
 77 86693a33 2023-06-11 op 	sandbox_crypto_process();
 78 86693a33 2023-06-11 op }
 79 86693a33 2023-06-11 op 
 80 86693a33 2023-06-11 op static int
 81 86693a33 2023-06-11 op crypto_dispatch_parent(int fd, struct privsep_proc *p, struct imsg *imsg)
 82 86693a33 2023-06-11 op {
 83 86693a33 2023-06-11 op 	switch (imsg->hdr.type) {
 84 86693a33 2023-06-11 op 	case IMSG_RECONF_START:
 85 86693a33 2023-06-11 op 	case IMSG_RECONF_CERT:
 86 86693a33 2023-06-11 op 	case IMSG_RECONF_KEY:
 87 86693a33 2023-06-11 op 	case IMSG_RECONF_END:
 88 86693a33 2023-06-11 op 		if (config_recv(conf, imsg) == -1)
 89 86693a33 2023-06-11 op 			return -1;
 90 86693a33 2023-06-11 op 		break;
 91 86693a33 2023-06-11 op 	default:
 92 86693a33 2023-06-11 op 		return -1;
 93 86693a33 2023-06-11 op 	}
 94 86693a33 2023-06-11 op 
 95 86693a33 2023-06-11 op 	return 0;
 96 86693a33 2023-06-11 op }
 97 86693a33 2023-06-11 op 
 98 86693a33 2023-06-11 op static EVP_PKEY *
 99 86693a33 2023-06-11 op get_pkey(const char *hash)
100 86693a33 2023-06-11 op {
101 86693a33 2023-06-11 op 	struct pki *pki;
102 86693a33 2023-06-11 op 
103 86693a33 2023-06-11 op 	TAILQ_FOREACH(pki, &conf->pkis, pkis) {
104 86693a33 2023-06-11 op 		if (!strcmp(pki->hash, hash))
105 86693a33 2023-06-11 op 			return pki->pkey;
106 86693a33 2023-06-11 op 	}
107 86693a33 2023-06-11 op 
108 86693a33 2023-06-11 op 	return NULL;
109 86693a33 2023-06-11 op }
110 86693a33 2023-06-11 op 
111 86693a33 2023-06-11 op static int
112 86693a33 2023-06-11 op crypto_dispatch_server(int fd, struct privsep_proc *p, struct imsg *imsg)
113 86693a33 2023-06-11 op {
114 86693a33 2023-06-11 op 	struct privsep		*ps = p->p_ps;
115 51340784 2023-06-23 op 	RSA			*rsa = NULL;
116 51340784 2023-06-23 op 	EC_KEY			*ecdsa = NULL;
117 86693a33 2023-06-11 op 	EVP_PKEY		*pkey;
118 86693a33 2023-06-11 op 	struct imsg_crypto_req	 req;
119 86693a33 2023-06-11 op 	struct imsg_crypto_res	 res;
120 86693a33 2023-06-11 op 	struct iovec		 iov[2];
121 86693a33 2023-06-11 op 	const void		*from;
122 10cc8193 2023-06-13 op 	unsigned char		*data, *to;
123 86693a33 2023-06-11 op 	size_t			 datalen;
124 b8d68fc8 2023-06-11 op 	int			 n, ret;
125 b8d68fc8 2023-06-11 op 	unsigned int		 len;
126 86693a33 2023-06-11 op 
127 10cc8193 2023-06-13 op 	data = imsg->data;
128 86693a33 2023-06-11 op 	datalen = IMSG_DATA_SIZE(imsg);
129 86693a33 2023-06-11 op 
130 86693a33 2023-06-11 op 	switch (imsg->hdr.type) {
131 86693a33 2023-06-11 op 	case IMSG_CRYPTO_RSA_PRIVENC:
132 86693a33 2023-06-11 op 	case IMSG_CRYPTO_RSA_PRIVDEC:
133 86693a33 2023-06-11 op 		if (datalen < sizeof(req))
134 86693a33 2023-06-11 op 			fatalx("size mismatch for imsg %d", imsg->hdr.type);
135 10cc8193 2023-06-13 op 		memcpy(&req, data, sizeof(req));
136 86693a33 2023-06-11 op 		if (datalen != sizeof(req) + req.flen)
137 86693a33 2023-06-11 op 			fatalx("size mismatch for imsg %d", imsg->hdr.type);
138 10cc8193 2023-06-13 op 		from = data + sizeof(req);
139 86693a33 2023-06-11 op 
140 86693a33 2023-06-11 op 		if ((pkey = get_pkey(req.hash)) == NULL ||
141 86693a33 2023-06-11 op 		    (rsa = EVP_PKEY_get1_RSA(pkey)) == NULL)
142 86693a33 2023-06-11 op 			fatalx("invalid pkey hash");
143 86693a33 2023-06-11 op 
144 86693a33 2023-06-11 op 		if ((to = calloc(1, req.tlen)) == NULL)
145 86693a33 2023-06-11 op 			fatal("calloc");
146 86693a33 2023-06-11 op 
147 b90faa16 2023-06-13 op 		if (imsg->hdr.type == IMSG_CRYPTO_RSA_PRIVENC)
148 86693a33 2023-06-11 op 			ret = RSA_private_encrypt(req.flen, from,
149 86693a33 2023-06-11 op 			    to, rsa, req.padding);
150 b90faa16 2023-06-13 op 		else
151 86693a33 2023-06-11 op 			ret = RSA_private_decrypt(req.flen, from,
152 86693a33 2023-06-11 op 			    to, rsa, req.padding);
153 86693a33 2023-06-11 op 
154 86693a33 2023-06-11 op 		memset(&res, 0, sizeof(res));
155 86693a33 2023-06-11 op 		res.id = req.id;
156 86693a33 2023-06-11 op 		res.ret = ret;
157 86693a33 2023-06-11 op 
158 86693a33 2023-06-11 op 		memset(&iov, 0, sizeof(iov));
159 86693a33 2023-06-11 op 		n = 0;
160 86693a33 2023-06-11 op 		iov[n].iov_base = &res;
161 86693a33 2023-06-11 op 		iov[n].iov_len = sizeof(res);
162 86693a33 2023-06-11 op 		n++;
163 86693a33 2023-06-11 op 
164 86693a33 2023-06-11 op 		if (ret > 0) {
165 86693a33 2023-06-11 op 			res.len = ret;
166 86693a33 2023-06-11 op 			iov[n].iov_base = to;
167 86693a33 2023-06-11 op 			iov[n].iov_len = ret;
168 86693a33 2023-06-11 op 			n++;
169 86693a33 2023-06-11 op 		}
170 86693a33 2023-06-11 op 
171 86693a33 2023-06-11 op 		log_debug("replying to server #%d", imsg->hdr.pid);
172 86693a33 2023-06-11 op 		if (proc_composev_imsg(ps, PROC_SERVER, imsg->hdr.pid - 1,
173 86693a33 2023-06-11 op 		    imsg->hdr.type, 0, -1, iov, n) == -1)
174 86693a33 2023-06-11 op 			fatal("proc_composev_imsg");
175 86693a33 2023-06-11 op 
176 86693a33 2023-06-11 op 		if (proc_flush_imsg(ps, PROC_SERVER, imsg->hdr.pid - 1) == -1)
177 86693a33 2023-06-11 op 			fatal("proc_flush_imsg");
178 86693a33 2023-06-11 op 
179 86693a33 2023-06-11 op 		free(to);
180 86693a33 2023-06-11 op 		RSA_free(rsa);
181 86693a33 2023-06-11 op 		break;
182 86693a33 2023-06-11 op 
183 86693a33 2023-06-11 op 	case IMSG_CRYPTO_ECDSA_SIGN:
184 86693a33 2023-06-11 op 		if (datalen < sizeof(req))
185 86693a33 2023-06-11 op 			fatalx("size mismatch for imsg %d", imsg->hdr.type);
186 10cc8193 2023-06-13 op 		memcpy(&req, data, sizeof(req));
187 86693a33 2023-06-11 op 		if (datalen != sizeof(req) + req.flen)
188 86693a33 2023-06-11 op 			fatalx("size mismatch for imsg %d", imsg->hdr.type);
189 10cc8193 2023-06-13 op 		from = data + sizeof(req);
190 86693a33 2023-06-11 op 
191 86693a33 2023-06-11 op 		if ((pkey = get_pkey(req.hash)) == NULL ||
192 86693a33 2023-06-11 op 		    (ecdsa = EVP_PKEY_get1_EC_KEY(pkey)) == NULL)
193 86693a33 2023-06-11 op 			fatalx("invalid pkey hash");
194 86693a33 2023-06-11 op 
195 86693a33 2023-06-11 op 		len = ECDSA_size(ecdsa);
196 86693a33 2023-06-11 op 		if ((to = calloc(1, len)) == NULL)
197 86693a33 2023-06-11 op 			fatal("calloc");
198 86693a33 2023-06-11 op 		ret = ECDSA_sign(0, from, req.flen, to, &len, ecdsa);
199 86693a33 2023-06-11 op 
200 86693a33 2023-06-11 op 		memset(&res, 0, sizeof(res));
201 86693a33 2023-06-11 op 		res.id = req.id;
202 86693a33 2023-06-11 op 		res.ret = ret;
203 86693a33 2023-06-11 op 
204 86693a33 2023-06-11 op 		memset(&iov, 0, sizeof(iov));
205 86693a33 2023-06-11 op 		n = 0;
206 86693a33 2023-06-11 op 		iov[0].iov_base = &res;
207 6c86d810 2023-08-28 op 		iov[0].iov_len = sizeof(res);
208 86693a33 2023-06-11 op 		n++;
209 86693a33 2023-06-11 op 
210 86693a33 2023-06-11 op 		if (ret > 0) {
211 86693a33 2023-06-11 op 			res.len = len;
212 86693a33 2023-06-11 op 			iov[n].iov_base = to;
213 86693a33 2023-06-11 op 			iov[n].iov_len = len;
214 86693a33 2023-06-11 op 			n++;
215 86693a33 2023-06-11 op 		}
216 86693a33 2023-06-11 op 
217 86693a33 2023-06-11 op 		log_debug("replying to server #%d", imsg->hdr.pid);
218 86693a33 2023-06-11 op 		if (proc_composev_imsg(ps, PROC_SERVER, imsg->hdr.pid - 1,
219 86693a33 2023-06-11 op 		    imsg->hdr.type, 0, -1, iov, n) == -1)
220 86693a33 2023-06-11 op 			fatal("proc_composev_imsg");
221 86693a33 2023-06-11 op 
222 86693a33 2023-06-11 op 		if (proc_flush_imsg(ps, PROC_SERVER, imsg->hdr.pid - 1) == -1)
223 86693a33 2023-06-11 op 			fatal("proc_flush_imsg");
224 86693a33 2023-06-11 op 
225 86693a33 2023-06-11 op 		free(to);
226 86693a33 2023-06-11 op 		EC_KEY_free(ecdsa);
227 86693a33 2023-06-11 op 		break;
228 86693a33 2023-06-11 op 
229 86693a33 2023-06-11 op 	default:
230 86693a33 2023-06-11 op 		return -1;
231 86693a33 2023-06-11 op 	}
232 86693a33 2023-06-11 op 
233 86693a33 2023-06-11 op 	return 0;
234 86693a33 2023-06-11 op }
235 86693a33 2023-06-11 op 
236 86693a33 2023-06-11 op 
237 86693a33 2023-06-11 op /*
238 86693a33 2023-06-11 op  * RSA privsep engine (called from unprivileged processes)
239 86693a33 2023-06-11 op  */
240 86693a33 2023-06-11 op 
241 86693a33 2023-06-11 op static const RSA_METHOD	*rsa_default;
242 86693a33 2023-06-11 op static RSA_METHOD	*rsae_method;
243 86693a33 2023-06-11 op 
244 86693a33 2023-06-11 op static int
245 86693a33 2023-06-11 op rsae_send_imsg(int flen, const unsigned char *from, unsigned char *to,
246 86693a33 2023-06-11 op     RSA *rsa, int padding, unsigned int cmd)
247 86693a33 2023-06-11 op {
248 86693a33 2023-06-11 op 	struct imsg_crypto_req	 req;
249 86693a33 2023-06-11 op 	struct iovec		 iov[2];
250 86693a33 2023-06-11 op 	struct imsg_crypto_res	 res;
251 86693a33 2023-06-11 op 	struct imsgev		*iev;
252 86693a33 2023-06-11 op 	struct privsep_proc	*p;
253 86693a33 2023-06-11 op 	struct privsep		*ps = conf->ps;
254 86693a33 2023-06-11 op 	struct imsgbuf		*ibuf;
255 86693a33 2023-06-11 op 	struct imsg		 imsg;
256 86693a33 2023-06-11 op 	int			 ret = 0;
257 86693a33 2023-06-11 op 	int			 n, done = 0;
258 86693a33 2023-06-11 op 	const void		*toptr;
259 86693a33 2023-06-11 op 	char			*hash;
260 10cc8193 2023-06-13 op 	unsigned char		*data;
261 86693a33 2023-06-11 op 	size_t			 datalen;
262 86693a33 2023-06-11 op 
263 86693a33 2023-06-11 op 	if ((hash = RSA_get_ex_data(rsa, 0)) == NULL)
264 86693a33 2023-06-11 op 		return (0);
265 86693a33 2023-06-11 op 
266 86693a33 2023-06-11 op 	/*
267 86693a33 2023-06-11 op 	 * Send a synchronous imsg because we cannot defer the RSA
268 86693a33 2023-06-11 op 	 * operation in OpenSSL's engine layer.
269 86693a33 2023-06-11 op 	 */
270 86693a33 2023-06-11 op 	memset(&req, 0, sizeof(req));
271 86693a33 2023-06-11 op 	req.id = ++reqid;
272 86693a33 2023-06-11 op 	if (strlcpy(req.hash, hash, sizeof(req.hash)) >= sizeof(req.hash))
273 86693a33 2023-06-11 op 		fatalx("%s: hash too long (%zu)", __func__, strlen(hash));
274 86693a33 2023-06-11 op 	req.flen = flen;
275 86693a33 2023-06-11 op 	req.tlen = RSA_size(rsa);
276 86693a33 2023-06-11 op 	req.padding = padding;
277 86693a33 2023-06-11 op 
278 86693a33 2023-06-11 op 	memset(&iov, 0, sizeof(iov));
279 86693a33 2023-06-11 op 	iov[0].iov_base = &req;
280 86693a33 2023-06-11 op 	iov[0].iov_len = sizeof(req);
281 86693a33 2023-06-11 op 	iov[1].iov_base = (void *)from;
282 86693a33 2023-06-11 op 	iov[1].iov_len = flen;
283 86693a33 2023-06-11 op 
284 86693a33 2023-06-11 op 	if (proc_composev(ps, PROC_CRYPTO, cmd, iov, 2) == -1)
285 86693a33 2023-06-11 op 		fatal("proc_composev");
286 86693a33 2023-06-11 op 
287 86693a33 2023-06-11 op 	if (proc_flush_imsg(ps, PROC_CRYPTO, -1) == -1)
288 86693a33 2023-06-11 op 		fatal("proc_flush_imsg");
289 86693a33 2023-06-11 op 
290 86693a33 2023-06-11 op 	iev = ps->ps_ievs[PROC_CRYPTO];
291 86693a33 2023-06-11 op 	p = iev->proc;
292 86693a33 2023-06-11 op 	ibuf = &iev->ibuf;
293 86693a33 2023-06-11 op 
294 86693a33 2023-06-11 op 	while (!done) {
295 86693a33 2023-06-11 op 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
296 86693a33 2023-06-11 op 			fatalx("imsg_read");
297 86693a33 2023-06-11 op 		if (n == 0)
298 86693a33 2023-06-11 op 			fatalx("pipe closed");
299 86693a33 2023-06-11 op 
300 86693a33 2023-06-11 op 		while (!done) {
301 86693a33 2023-06-11 op 			if ((n = imsg_get(ibuf, &imsg)) == -1)
302 86693a33 2023-06-11 op 				fatalx("imsg_get error");
303 86693a33 2023-06-11 op 			if (n == 0)
304 86693a33 2023-06-11 op 				break;
305 86693a33 2023-06-11 op 
306 86693a33 2023-06-11 op #if DEBUG > 1
307 86693a33 2023-06-11 op 			log_debug(
308 86693a33 2023-06-11 op 			    "%s: %s %d got imsg %d peerid %d from %s %d",
309 86693a33 2023-06-11 op 			    __func__, title, 1, imsg.hdr.type,
310 86693a33 2023-06-11 op 			    imsg.hdr.peerid, "crypto", imsg.hdr.pid);
311 86693a33 2023-06-11 op #endif
312 86693a33 2023-06-11 op 
313 86693a33 2023-06-11 op 			if ((p->p_cb)(ibuf->fd, p, &imsg) == 0) {
314 86693a33 2023-06-11 op 				/* Message was handled by the callback */
315 86693a33 2023-06-11 op 				imsg_free(&imsg);
316 86693a33 2023-06-11 op 				continue;
317 86693a33 2023-06-11 op 			}
318 86693a33 2023-06-11 op 
319 86693a33 2023-06-11 op 			switch (imsg.hdr.type) {
320 86693a33 2023-06-11 op 			case IMSG_CRYPTO_RSA_PRIVENC:
321 86693a33 2023-06-11 op 			case IMSG_CRYPTO_RSA_PRIVDEC:
322 86693a33 2023-06-11 op 				break;
323 86693a33 2023-06-11 op 			default:
324 86693a33 2023-06-11 op 				fatalx("%s: %s %d got invalid imsg %d"
325 86693a33 2023-06-11 op 				    " peerid %d from %s %d",
326 86693a33 2023-06-11 op 				    __func__, "server", ps->ps_instance + 1,
327 86693a33 2023-06-11 op 				    imsg.hdr.type, imsg.hdr.peerid,
328 86693a33 2023-06-11 op 				    "crypto", imsg.hdr.pid);
329 86693a33 2023-06-11 op 			}
330 86693a33 2023-06-11 op 
331 10cc8193 2023-06-13 op 			data = imsg.data;
332 86693a33 2023-06-11 op 			datalen = IMSG_DATA_SIZE(&imsg);
333 86693a33 2023-06-11 op 			if (datalen < sizeof(res))
334 86693a33 2023-06-11 op 				fatalx("size mismatch for imsg %d",
335 86693a33 2023-06-11 op 				    imsg.hdr.type);
336 10cc8193 2023-06-13 op 			memcpy(&res, data, sizeof(res));
337 86693a33 2023-06-11 op 			if (datalen != sizeof(res) + res.ret)
338 86693a33 2023-06-11 op 				fatalx("size mismatch for imsg %d",
339 86693a33 2023-06-11 op 				    imsg.hdr.type);
340 86693a33 2023-06-11 op 			ret = res.ret;
341 10cc8193 2023-06-13 op 			toptr = data + sizeof(res);
342 86693a33 2023-06-11 op 
343 86693a33 2023-06-11 op 			if (res.id != reqid)
344 d1739e3f 2023-06-11 op 				fatalx("invalid id; got %llu, want %llu",
345 d1739e3f 2023-06-11 op 				    (unsigned long long)res.id,
346 d1739e3f 2023-06-11 op 				    (unsigned long long)reqid);
347 86693a33 2023-06-11 op 			if (res.ret > 0)
348 86693a33 2023-06-11 op 				memcpy(to, toptr, res.len);
349 86693a33 2023-06-11 op 
350 86693a33 2023-06-11 op 			done = 1;
351 86693a33 2023-06-11 op 
352 86693a33 2023-06-11 op 			imsg_free(&imsg);
353 86693a33 2023-06-11 op 		}
354 86693a33 2023-06-11 op 	}
355 86693a33 2023-06-11 op 	imsg_event_add(iev);
356 86693a33 2023-06-11 op 
357 86693a33 2023-06-11 op 	return (ret);
358 86693a33 2023-06-11 op }
359 86693a33 2023-06-11 op 
360 86693a33 2023-06-11 op static int
361 86693a33 2023-06-11 op rsae_priv_enc(int flen, const unsigned char *from, unsigned char *to, RSA *rsa,
362 86693a33 2023-06-11 op     int padding)
363 86693a33 2023-06-11 op {
364 86693a33 2023-06-11 op 	log_debug("debug: %s", __func__);
365 86693a33 2023-06-11 op 	if (RSA_get_ex_data(rsa, 0) != NULL)
366 86693a33 2023-06-11 op 		return (rsae_send_imsg(flen, from, to, rsa, padding,
367 86693a33 2023-06-11 op 		    IMSG_CRYPTO_RSA_PRIVENC));
368 86693a33 2023-06-11 op 	return (RSA_meth_get_priv_enc(rsa_default)(flen, from, to, rsa, padding));
369 86693a33 2023-06-11 op }
370 86693a33 2023-06-11 op 
371 86693a33 2023-06-11 op static int
372 86693a33 2023-06-11 op rsae_priv_dec(int flen, const unsigned char *from, unsigned char *to, RSA *rsa,
373 86693a33 2023-06-11 op     int padding)
374 86693a33 2023-06-11 op {
375 86693a33 2023-06-11 op 	log_debug("debug: %s", __func__);
376 86693a33 2023-06-11 op 	if (RSA_get_ex_data(rsa, 0) != NULL)
377 86693a33 2023-06-11 op 		return (rsae_send_imsg(flen, from, to, rsa, padding,
378 86693a33 2023-06-11 op 		    IMSG_CRYPTO_RSA_PRIVDEC));
379 86693a33 2023-06-11 op 
380 86693a33 2023-06-11 op 	return (RSA_meth_get_priv_dec(rsa_default)(flen, from, to, rsa, padding));
381 86693a33 2023-06-11 op }
382 86693a33 2023-06-11 op 
383 86693a33 2023-06-11 op 
384 86693a33 2023-06-11 op /*
385 86693a33 2023-06-11 op  * ECDSA privsep engine (called from unprivileged processes)
386 86693a33 2023-06-11 op  */
387 86693a33 2023-06-11 op 
388 86693a33 2023-06-11 op static const EC_KEY_METHOD	*ecdsa_default;
389 86693a33 2023-06-11 op static EC_KEY_METHOD		*ecdsae_method;
390 86693a33 2023-06-11 op 
391 86693a33 2023-06-11 op static ECDSA_SIG *
392 86693a33 2023-06-11 op ecdsae_send_enc_imsg(const unsigned char *dgst, int dgst_len,
393 86693a33 2023-06-11 op     const BIGNUM *inv, const BIGNUM *rp, EC_KEY *eckey)
394 86693a33 2023-06-11 op {
395 86693a33 2023-06-11 op 	ECDSA_SIG		*sig = NULL;
396 86693a33 2023-06-11 op 	struct imsg_crypto_req	 req;
397 86693a33 2023-06-11 op 	struct iovec		 iov[2];
398 86693a33 2023-06-11 op 	struct imsg_crypto_res	 res;
399 86693a33 2023-06-11 op 	struct imsgev		*iev;
400 86693a33 2023-06-11 op 	struct privsep_proc	*p;
401 86693a33 2023-06-11 op 	struct privsep		*ps = conf->ps;
402 86693a33 2023-06-11 op 	struct imsgbuf		*ibuf;
403 86693a33 2023-06-11 op 	struct imsg		 imsg;
404 86693a33 2023-06-11 op 	int			 n, done = 0;
405 86693a33 2023-06-11 op 	const void		*toptr;
406 86693a33 2023-06-11 op 	char			*hash;
407 10cc8193 2023-06-13 op 	unsigned char		*data;
408 86693a33 2023-06-11 op 	size_t			 datalen;
409 86693a33 2023-06-11 op 
410 86693a33 2023-06-11 op 	if ((hash = EC_KEY_get_ex_data(eckey, 0)) == NULL)
411 86693a33 2023-06-11 op 		return (0);
412 86693a33 2023-06-11 op 
413 86693a33 2023-06-11 op 	/*
414 86693a33 2023-06-11 op 	 * Send a synchronous imsg because we cannot defer the RSA
415 86693a33 2023-06-11 op 	 * operation in OpenSSL's engine layer.
416 86693a33 2023-06-11 op 	 */
417 86693a33 2023-06-11 op 	memset(&req, 0, sizeof(req));
418 3cba037a 2023-08-28 op 	req.id = ++reqid;
419 86693a33 2023-06-11 op 	if (strlcpy(req.hash, hash, sizeof(req.hash)) >= sizeof(req.hash))
420 86693a33 2023-06-11 op 		fatalx("%s: hash too long (%zu)", __func__, strlen(hash));
421 86693a33 2023-06-11 op 	req.flen = dgst_len;
422 86693a33 2023-06-11 op 
423 86693a33 2023-06-11 op 	memset(&iov, 0, sizeof(iov));
424 86693a33 2023-06-11 op 	iov[0].iov_base = &req;
425 86693a33 2023-06-11 op 	iov[0].iov_len = sizeof(req);
426 86693a33 2023-06-11 op 	iov[1].iov_base = (void *)dgst;
427 86693a33 2023-06-11 op 	iov[1].iov_len = dgst_len;
428 86693a33 2023-06-11 op 
429 86693a33 2023-06-11 op 	if (proc_composev(ps, PROC_CRYPTO, IMSG_CRYPTO_ECDSA_SIGN, iov, 2) == -1)
430 86693a33 2023-06-11 op 		fatal("proc_composev");
431 86693a33 2023-06-11 op 
432 86693a33 2023-06-11 op 	if (proc_flush_imsg(ps, PROC_CRYPTO, -1) == -1)
433 86693a33 2023-06-11 op 		fatal("proc_flush_imsg");
434 86693a33 2023-06-11 op 
435 86693a33 2023-06-11 op 	iev = ps->ps_ievs[PROC_CRYPTO];
436 86693a33 2023-06-11 op 	p = iev->proc;
437 86693a33 2023-06-11 op 	ibuf = &iev->ibuf;
438 86693a33 2023-06-11 op 
439 86693a33 2023-06-11 op 	while (!done) {
440 86693a33 2023-06-11 op 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
441 86693a33 2023-06-11 op 			fatalx("imsg_read");
442 86693a33 2023-06-11 op 		if (n == 0)
443 86693a33 2023-06-11 op 			fatalx("pipe closed");
444 86693a33 2023-06-11 op 
445 86693a33 2023-06-11 op 		while (!done) {
446 86693a33 2023-06-11 op 			if ((n = imsg_get(ibuf, &imsg)) == -1)
447 86693a33 2023-06-11 op 				fatalx("imsg_get error");
448 86693a33 2023-06-11 op 			if (n == 0)
449 86693a33 2023-06-11 op 				break;
450 86693a33 2023-06-11 op 
451 86693a33 2023-06-11 op #if DEBUG > 1
452 86693a33 2023-06-11 op 			log_debug(
453 86693a33 2023-06-11 op 			    "%s: %s %d got imsg %d peerid %d from %s %d",
454 86693a33 2023-06-11 op 			    __func__, title, 1, imsg.hdr.type,
455 86693a33 2023-06-11 op 			    imsg.hdr.peerid, "crypto", imsg.hdr.pid);
456 86693a33 2023-06-11 op #endif
457 86693a33 2023-06-11 op 
458 a6c8b805 2023-08-28 op 			if (imsg.hdr.type != IMSG_CRYPTO_ECDSA_SIGN &&
459 a6c8b805 2023-08-28 op 			    crypto_dispatch_server(ibuf->fd, p, &imsg) == 0) {
460 86693a33 2023-06-11 op 				/* Message was handled by the callback */
461 86693a33 2023-06-11 op 				imsg_free(&imsg);
462 86693a33 2023-06-11 op 				continue;
463 86693a33 2023-06-11 op 			}
464 86693a33 2023-06-11 op 
465 86693a33 2023-06-11 op 			if (imsg.hdr.type != IMSG_CRYPTO_ECDSA_SIGN)
466 86693a33 2023-06-11 op 				fatalx("%s: %s %d got invalid imsg %d"
467 86693a33 2023-06-11 op 				    " peerid %d from %s %d",
468 86693a33 2023-06-11 op 				    __func__, "server", ps->ps_instance + 1,
469 86693a33 2023-06-11 op 				    imsg.hdr.type, imsg.hdr.peerid,
470 86693a33 2023-06-11 op 				    "crypto", imsg.hdr.pid);
471 86693a33 2023-06-11 op 
472 10cc8193 2023-06-13 op 			data = imsg.data;
473 86693a33 2023-06-11 op 			datalen = IMSG_DATA_SIZE(&imsg);
474 86693a33 2023-06-11 op 			if (datalen < sizeof(res))
475 86693a33 2023-06-11 op 				fatalx("size mismatch for imsg %d",
476 86693a33 2023-06-11 op 				    imsg.hdr.type);
477 10cc8193 2023-06-13 op 			memcpy(&res, data, sizeof(res));
478 b894573a 2023-08-29 op 			if (datalen != sizeof(res) + res.len)
479 86693a33 2023-06-11 op 				fatalx("size mismatch for imsg %d",
480 86693a33 2023-06-11 op 				    imsg.hdr.type);
481 10cc8193 2023-06-13 op 			toptr = data + sizeof(res);
482 86693a33 2023-06-11 op 
483 86693a33 2023-06-11 op 			if (res.id != reqid)
484 86693a33 2023-06-11 op 				fatalx("invalid response id");
485 86693a33 2023-06-11 op 			if (res.ret > 0) {
486 86693a33 2023-06-11 op 				d2i_ECDSA_SIG(&sig,
487 86693a33 2023-06-11 op 				    (const unsigned char **)&toptr, res.len);
488 86693a33 2023-06-11 op 			}
489 86693a33 2023-06-11 op 
490 86693a33 2023-06-11 op 			done = 1;
491 86693a33 2023-06-11 op 
492 86693a33 2023-06-11 op 			imsg_free(&imsg);
493 86693a33 2023-06-11 op 		}
494 86693a33 2023-06-11 op 	}
495 86693a33 2023-06-11 op 	imsg_event_add(iev);
496 86693a33 2023-06-11 op 
497 86693a33 2023-06-11 op 	return (sig);
498 86693a33 2023-06-11 op }
499 86693a33 2023-06-11 op 
500 86693a33 2023-06-11 op static ECDSA_SIG *
501 86693a33 2023-06-11 op ecdsae_do_sign(const unsigned char *dgst, int dgst_len, const BIGNUM *inv,
502 86693a33 2023-06-11 op     const BIGNUM *rp, EC_KEY *eckey)
503 86693a33 2023-06-11 op {
504 86693a33 2023-06-11 op 	ECDSA_SIG *(*psign_sig)(const unsigned char *, int, const BIGNUM *,
505 86693a33 2023-06-11 op 	    const BIGNUM *, EC_KEY *);
506 86693a33 2023-06-11 op 
507 86693a33 2023-06-11 op 	log_debug("debug: %s", __func__);
508 86693a33 2023-06-11 op 	if (EC_KEY_get_ex_data(eckey, 0) != NULL)
509 86693a33 2023-06-11 op 		return (ecdsae_send_enc_imsg(dgst, dgst_len, inv, rp, eckey));
510 86693a33 2023-06-11 op 	EC_KEY_METHOD_get_sign(ecdsa_default, NULL, NULL, &psign_sig);
511 86693a33 2023-06-11 op 	return (psign_sig(dgst, dgst_len, inv, rp, eckey));
512 86693a33 2023-06-11 op }
513 86693a33 2023-06-11 op 
514 86693a33 2023-06-11 op 
515 86693a33 2023-06-11 op /*
516 86693a33 2023-06-11 op  * Initialize the two engines.
517 86693a33 2023-06-11 op  */
518 86693a33 2023-06-11 op 
519 86693a33 2023-06-11 op static void
520 86693a33 2023-06-11 op rsa_engine_init(void)
521 86693a33 2023-06-11 op {
522 bd233076 2023-07-22 op 	const char	*errstr;
523 86693a33 2023-06-11 op 
524 bd233076 2023-07-22 op 	if ((rsa_default = RSA_get_default_method()) == NULL) {
525 bd233076 2023-07-22 op 		errstr = "RSA_get_default_method";
526 86693a33 2023-06-11 op 		goto fail;
527 86693a33 2023-06-11 op 	}
528 86693a33 2023-06-11 op 
529 21617eda 2023-07-22 op 	if ((rsae_method = RSA_meth_dup(rsa_default)) == NULL) {
530 21617eda 2023-07-22 op 		errstr = "RSA_meth_dup";
531 21617eda 2023-07-22 op 		goto fail;
532 21617eda 2023-07-22 op 	}
533 21617eda 2023-07-22 op 
534 21617eda 2023-07-22 op 	RSA_meth_set_priv_enc(rsae_method, rsae_priv_enc);
535 21617eda 2023-07-22 op 	RSA_meth_set_priv_dec(rsae_method, rsae_priv_dec);
536 21617eda 2023-07-22 op 
537 86693a33 2023-06-11 op 	RSA_meth_set_flags(rsae_method,
538 6a996ec2 2023-07-22 op 	    RSA_meth_get_flags(rsa_default) | RSA_METHOD_FLAG_NO_CHECK);
539 86693a33 2023-06-11 op 	RSA_meth_set0_app_data(rsae_method,
540 6a996ec2 2023-07-22 op 	    RSA_meth_get0_app_data(rsa_default));
541 86693a33 2023-06-11 op 
542 bd233076 2023-07-22 op 	RSA_set_default_method(rsae_method);
543 86693a33 2023-06-11 op 
544 86693a33 2023-06-11 op 	return;
545 86693a33 2023-06-11 op 
546 86693a33 2023-06-11 op  fail:
547 86693a33 2023-06-11 op 	ssl_error(errstr);
548 86693a33 2023-06-11 op 	fatalx("%s", errstr);
549 86693a33 2023-06-11 op }
550 86693a33 2023-06-11 op 
551 86693a33 2023-06-11 op static void
552 86693a33 2023-06-11 op ecdsa_engine_init(void)
553 86693a33 2023-06-11 op {
554 21617eda 2023-07-22 op 	int (*sign)(int, const unsigned char *, int, unsigned char *,
555 21617eda 2023-07-22 op 	    unsigned int *, const BIGNUM *, const BIGNUM *, EC_KEY *);
556 21617eda 2023-07-22 op 	int (*sign_setup)(EC_KEY *, BN_CTX *, BIGNUM **, BIGNUM **);
557 bd233076 2023-07-22 op 	const char *errstr;
558 86693a33 2023-06-11 op 
559 bd233076 2023-07-22 op 	if ((ecdsa_default = EC_KEY_get_default_method()) == NULL) {
560 bd233076 2023-07-22 op 		errstr = "EC_KEY_get_default_method";
561 86693a33 2023-06-11 op 		goto fail;
562 86693a33 2023-06-11 op 	}
563 86693a33 2023-06-11 op 
564 21617eda 2023-07-22 op 	if ((ecdsae_method = EC_KEY_METHOD_new(ecdsa_default)) == NULL) {
565 21617eda 2023-07-22 op 		errstr = "EC_KEY_METHOD_new";
566 21617eda 2023-07-22 op 		goto fail;
567 21617eda 2023-07-22 op 	}
568 21617eda 2023-07-22 op 
569 21617eda 2023-07-22 op 	EC_KEY_METHOD_get_sign(ecdsa_default, &sign, &sign_setup, NULL);
570 21617eda 2023-07-22 op 	EC_KEY_METHOD_set_sign(ecdsae_method, sign, sign_setup,
571 21617eda 2023-07-22 op 	    ecdsae_do_sign);
572 21617eda 2023-07-22 op 
573 bd233076 2023-07-22 op 	EC_KEY_set_default_method(ecdsae_method);
574 86693a33 2023-06-11 op 
575 86693a33 2023-06-11 op 	return;
576 86693a33 2023-06-11 op 
577 86693a33 2023-06-11 op  fail:
578 86693a33 2023-06-11 op 	ssl_error(errstr);
579 86693a33 2023-06-11 op 	fatalx("%s", errstr);
580 86693a33 2023-06-11 op }
581 86693a33 2023-06-11 op 
582 86693a33 2023-06-11 op void
583 86693a33 2023-06-11 op crypto_engine_init(struct conf *c)
584 86693a33 2023-06-11 op {
585 86693a33 2023-06-11 op 	conf = c;
586 86693a33 2023-06-11 op 
587 86693a33 2023-06-11 op 	rsa_engine_init();
588 86693a33 2023-06-11 op 	ecdsa_engine_init();
589 86693a33 2023-06-11 op }
590 86693a33 2023-06-11 op