rsassa.c 8.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331
  1. /* vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: */
  2. /*
  3. * Copyright 2016 Red Hat, Inc.
  4. *
  5. * Licensed under the Apache License, Version 2.0 (the "License");
  6. * you may not use this file except in compliance with the License.
  7. * You may obtain a copy of the License at
  8. *
  9. * http://www.apache.org/licenses/LICENSE-2.0
  10. *
  11. * Unless required by applicable law or agreed to in writing, software
  12. * distributed under the License is distributed on an "AS IS" BASIS,
  13. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14. * See the License for the specific language governing permissions and
  15. * limitations under the License.
  16. */
  17. #include "misc.h"
  18. #include <jose/b64.h>
  19. #include "../hooks.h"
  20. #include <jose/openssl.h>
  21. #include <openssl/sha.h>
  22. #include <string.h>
  23. #define NAMES "RS256", "RS384", "RS512", "PS256", "PS384", "PS512"
  24. typedef typeof(EVP_DigestSignInit) init_t;
  25. declare_cleanup(EVP_PKEY)
  26. typedef struct {
  27. jose_io_t io;
  28. EVP_MD_CTX *emc;
  29. json_t *obj;
  30. json_t *sig;
  31. } io_t;
  32. static void
  33. io_free(jose_io_t *io)
  34. {
  35. io_t *i = containerof(io, io_t, io);
  36. EVP_MD_CTX_free(i->emc);
  37. json_decref(i->obj);
  38. json_decref(i->sig);
  39. free(i);
  40. }
  41. static bool
  42. io_feed(jose_io_t *io, const void *in, size_t len)
  43. {
  44. io_t *i = containerof(io, io_t, io);
  45. return EVP_DigestUpdate(i->emc, in, len) > 0;
  46. }
  47. static bool
  48. sig_done(jose_io_t *io)
  49. {
  50. io_t *i = containerof(io, io_t, io);
  51. size_t len = 0;
  52. if (EVP_DigestSignFinal(i->emc, NULL, &len) <= 0)
  53. return false;
  54. uint8_t buf[len];
  55. if (EVP_DigestSignFinal(i->emc, buf, &len) <= 0)
  56. return false;
  57. if (json_object_set_new(i->sig, "signature",
  58. jose_b64_enc(buf, len)) < 0)
  59. return false;
  60. return add_entity(i->obj, i->sig,
  61. "signatures", "signature", "protected", "header", NULL);
  62. }
  63. static bool
  64. ver_done(jose_io_t *io)
  65. {
  66. io_t *i = containerof(io, io_t, io);
  67. const json_t *sig = NULL;
  68. uint8_t *buf = NULL;
  69. bool ret = false;
  70. size_t len = 0;
  71. sig = json_object_get(i->sig, "signature");
  72. if (!sig)
  73. return false;
  74. len = jose_b64_dec(sig, NULL, 0);
  75. if (len == SIZE_MAX)
  76. return false;
  77. buf = malloc(len);
  78. if (!buf)
  79. return false;
  80. if (jose_b64_dec(sig, buf, len) != len) {
  81. free(buf);
  82. return false;
  83. }
  84. ret = EVP_DigestVerifyFinal(i->emc, buf, len) == 1;
  85. free(buf);
  86. return ret;
  87. }
  88. static EVP_MD_CTX *
  89. setup(jose_cfg_t *cfg, const json_t *jwk, const json_t *sig, const char *alg,
  90. init_t *func)
  91. {
  92. openssl_auto(EVP_PKEY) *key = NULL;
  93. EVP_PKEY_CTX *epc = NULL;
  94. const EVP_MD *md = NULL;
  95. EVP_MD_CTX *emc = NULL;
  96. const RSA *rsa = NULL;
  97. int slen = 0;
  98. int pad = 0;
  99. switch (str2enum(alg, NAMES, NULL)) {
  100. case 0: md = EVP_sha256(); pad = RSA_PKCS1_PADDING; break;
  101. case 1: md = EVP_sha384(); pad = RSA_PKCS1_PADDING; break;
  102. case 2: md = EVP_sha512(); pad = RSA_PKCS1_PADDING; break;
  103. case 3: md = EVP_sha256(); pad = RSA_PKCS1_PSS_PADDING; slen = -1; break;
  104. case 4: md = EVP_sha384(); pad = RSA_PKCS1_PSS_PADDING; slen = -1; break;
  105. case 5: md = EVP_sha512(); pad = RSA_PKCS1_PSS_PADDING; slen = -1; break;
  106. default: return NULL;
  107. }
  108. key = jose_openssl_jwk_to_EVP_PKEY(cfg, jwk);
  109. if (!key || EVP_PKEY_base_id(key) != EVP_PKEY_RSA)
  110. return NULL;
  111. /* Don't use small keys. RFC 7518 3.3 */
  112. rsa = EVP_PKEY_get0_RSA(key);
  113. if (!rsa)
  114. return NULL;
  115. if (RSA_size(rsa) < 2048 / 8)
  116. return NULL;
  117. emc = EVP_MD_CTX_new();
  118. if (!emc)
  119. return NULL;
  120. if (func(emc, &epc, md, NULL, key) <= 0)
  121. goto error;
  122. if (EVP_PKEY_CTX_set_rsa_padding(epc, pad) <= 0)
  123. goto error;
  124. if (slen != 0) {
  125. if (EVP_PKEY_CTX_set_rsa_pss_saltlen(epc, slen) <= 0)
  126. goto error;
  127. }
  128. return emc;
  129. error:
  130. EVP_MD_CTX_free(emc);
  131. return NULL;
  132. }
  133. static bool
  134. jwk_prep_handles(jose_cfg_t *cfg, const json_t *jwk)
  135. {
  136. const char *alg = NULL;
  137. if (json_unpack((json_t *) jwk, "{s:s}", "alg", &alg) == -1)
  138. return false;
  139. return str2enum(alg, NAMES, NULL) != SIZE_MAX;
  140. }
  141. static bool
  142. jwk_prep_execute(jose_cfg_t *cfg, json_t *jwk)
  143. {
  144. const char *kty = NULL;
  145. if (!jwk_prep_handles(cfg, jwk))
  146. return false;
  147. if (json_unpack(jwk, "{s?s}", "kty", &kty) < 0)
  148. return false;
  149. if (kty && strcmp(kty, "RSA") != 0)
  150. return false;
  151. if (json_object_set_new(jwk, "kty", json_string("RSA")) < 0)
  152. return false;
  153. return true;
  154. }
  155. static const char *
  156. alg_sign_sug(const jose_hook_alg_t *alg, jose_cfg_t *cfg, const json_t *jwk)
  157. {
  158. const char *name = NULL;
  159. const char *type = NULL;
  160. size_t len = 0;
  161. if (json_unpack((json_t *) jwk, "{s?s,s?s}",
  162. "alg", &name, "kty", &type) < 0)
  163. return NULL;
  164. if (name)
  165. return str2enum(name, NAMES, NULL) != SIZE_MAX ? name : NULL;
  166. if (!type || strcmp(type, "RSA") != 0)
  167. return NULL;
  168. len = jose_b64_dec(json_object_get(jwk, "n"), NULL, 0) * 8;
  169. switch ((len < 4096 ? len : 4096) & (4096 | 3072 | 2048)) {
  170. case 4096: return "RS512";
  171. case 3072: return "RS384";
  172. case 2048: return "RS256";
  173. default: return NULL;
  174. }
  175. }
  176. static jose_io_t *
  177. alg_sign_sig(const jose_hook_alg_t *alg, jose_cfg_t *cfg, json_t *jws,
  178. json_t *sig, const json_t *jwk)
  179. {
  180. jose_io_auto_t *io = NULL;
  181. io_t *i = NULL;
  182. i = calloc(1, sizeof(*i));
  183. if (!i)
  184. return NULL;
  185. io = jose_io_incref(&i->io);
  186. io->feed = io_feed;
  187. io->done = sig_done;
  188. io->free = io_free;
  189. i->obj = json_incref(jws);
  190. i->sig = json_incref(sig);
  191. i->emc = setup(cfg, jwk, sig, alg->name, EVP_DigestSignInit);
  192. if (!i->obj || !i->sig || !i->emc)
  193. return NULL;
  194. return jose_io_incref(io);
  195. }
  196. static jose_io_t *
  197. alg_sign_ver(const jose_hook_alg_t *alg, jose_cfg_t *cfg, const json_t *jws,
  198. const json_t *sig, const json_t *jwk)
  199. {
  200. jose_io_auto_t *io = NULL;
  201. io_t *i = NULL;
  202. i = calloc(1, sizeof(*i));
  203. if (!i)
  204. return NULL;
  205. io = jose_io_incref(&i->io);
  206. io->feed = io_feed;
  207. io->done = ver_done;
  208. io->free = io_free;
  209. i->sig = json_incref((json_t *) sig);
  210. i->emc = setup(cfg, jwk, sig, alg->name, EVP_DigestVerifyInit);
  211. if (!i->sig || !i->emc)
  212. return NULL;
  213. return jose_io_incref(io);
  214. }
  215. static void __attribute__((constructor))
  216. constructor(void)
  217. {
  218. static jose_hook_jwk_t jwk = {
  219. .kind = JOSE_HOOK_JWK_KIND_PREP,
  220. .prep.handles = jwk_prep_handles,
  221. .prep.execute = jwk_prep_execute,
  222. };
  223. static jose_hook_alg_t algs[] = {
  224. { .kind = JOSE_HOOK_ALG_KIND_SIGN,
  225. .name = "RS256",
  226. .sign.sprm = "sign",
  227. .sign.vprm = "verify",
  228. .sign.sug = alg_sign_sug,
  229. .sign.sig = alg_sign_sig,
  230. .sign.ver = alg_sign_ver },
  231. { .kind = JOSE_HOOK_ALG_KIND_SIGN,
  232. .name = "RS384",
  233. .sign.sprm = "sign",
  234. .sign.vprm = "verify",
  235. .sign.sug = alg_sign_sug,
  236. .sign.sig = alg_sign_sig,
  237. .sign.ver = alg_sign_ver },
  238. { .kind = JOSE_HOOK_ALG_KIND_SIGN,
  239. .name = "RS512",
  240. .sign.sprm = "sign",
  241. .sign.vprm = "verify",
  242. .sign.sug = alg_sign_sug,
  243. .sign.sig = alg_sign_sig,
  244. .sign.ver = alg_sign_ver },
  245. { .kind = JOSE_HOOK_ALG_KIND_SIGN,
  246. .name = "PS256",
  247. .sign.sprm = "sign",
  248. .sign.vprm = "verify",
  249. .sign.sug = alg_sign_sug,
  250. .sign.sig = alg_sign_sig,
  251. .sign.ver = alg_sign_ver },
  252. { .kind = JOSE_HOOK_ALG_KIND_SIGN,
  253. .name = "PS384",
  254. .sign.sprm = "sign",
  255. .sign.vprm = "verify",
  256. .sign.sug = alg_sign_sug,
  257. .sign.sig = alg_sign_sig,
  258. .sign.ver = alg_sign_ver },
  259. { .kind = JOSE_HOOK_ALG_KIND_SIGN,
  260. .name = "PS512",
  261. .sign.sprm = "sign",
  262. .sign.vprm = "verify",
  263. .sign.sug = alg_sign_sug,
  264. .sign.sig = alg_sign_sig,
  265. .sign.ver = alg_sign_ver },
  266. {}
  267. };
  268. jose_hook_jwk_push(&jwk);
  269. for (size_t i = 0; algs[i].name; i++)
  270. jose_hook_alg_push(&algs[i]);
  271. }