res_crypto.c File Reference

Provide Cryptographic Signature capability. More...

#include "asterisk.h"
#include <dirent.h>
#include <sys/stat.h>
#include <openssl/err.h>
#include <openssl/ssl.h>
#include <openssl/evp.h>
#include <openssl/md5.h>
#include <openssl/sha.h>
#include "asterisk/cli.h"
#include "asterisk/compat.h"
#include "asterisk/io.h"
#include "asterisk/linkedlists.h"
#include "asterisk/logger.h"
#include "asterisk/md5.h"
#include "asterisk/module.h"
#include "asterisk/options.h"
#include "asterisk/paths.h"
#include "asterisk/utils.h"
#include "asterisk/file.h"
#include "asterisk/crypto.h"

Include dependency graph for res_crypto.c:

Go to the source code of this file.

Data Structures
struct	ast_key
struct	crypto_load_on_file
struct	keys

Macros
#define	AST_API_MODULE
#define	FILE_MODE_BITS   (S_ISUID|S_ISGID|S_ISVTX|S_IRWXU|S_IRWXG|S_IRWXO)
#define	FORMAT   "%-18s %-8s %-16s %-33s\n"
#define	KEY_NEEDS_PASSCODE   (1 << 16)
#define	RSA_PKCS1_OAEP_PADDING_SIZE   (1 + 2 * SHA_DIGEST_LENGTH)

Functions
static void	__reg_module (void)
static void	__unreg_module (void)
int AST_OPTIONAL_API_NAME()	ast_aes_decrypt (const unsigned char *in, unsigned char *out, const ast_aes_decrypt_key *key)
	AES decrypt data. More...
int AST_OPTIONAL_API_NAME()	ast_aes_encrypt (const unsigned char *in, unsigned char *out, const ast_aes_encrypt_key *key)
	AES encrypt data. More...
int AST_OPTIONAL_API_NAME()	ast_aes_set_decrypt_key (const unsigned char *key, ast_aes_decrypt_key *ctx)
	Set a decryption key. More...
int AST_OPTIONAL_API_NAME()	ast_aes_set_encrypt_key (const unsigned char *key, ast_aes_encrypt_key *ctx)
	Set an encryption key. More...
int AST_OPTIONAL_API_NAME()	ast_check_signature (struct ast_key *key, const char *msg, const char *sig)
	base64 decode then sent to __ast_check_signature_bin More...
int AST_OPTIONAL_API_NAME()	ast_check_signature_bin (struct ast_key *key, const char *msg, int msglen, const unsigned char *dsig)
	check signature of a message More...
int AST_OPTIONAL_API_NAME()	ast_crypto_loaded (void)
int AST_OPTIONAL_API_NAME()	ast_crypto_reload (void)
int AST_OPTIONAL_API_NAME()	ast_decrypt_bin (unsigned char *dst, const unsigned char *src, int srclen, struct ast_key *key)
	decrypt a message More...
int AST_OPTIONAL_API_NAME()	ast_encrypt_bin (unsigned char *dst, const unsigned char *src, int srclen, struct ast_key *key)
	encrypt a message More...
struct ast_key *AST_OPTIONAL_API_NAME()	ast_key_get (const char *kname, int ktype)
	return the ast_key structure for name More...
struct ast_module *	AST_MODULE_SELF_SYM (void)
int AST_OPTIONAL_API_NAME()	ast_sign (struct ast_key *key, char *msg, char *sig)
	wrapper for __ast_sign_bin then base64 encode it More...
int AST_OPTIONAL_API_NAME()	ast_sign_bin (struct ast_key *key, const char *msg, int msglen, unsigned char *dsig)
	signs outgoing message with public key More...
static int	crypto_init (void)
	initialise the res_crypto module More...
static void	crypto_load (int ifd, int ofd)
	refresh RSA keys from file More...
static int	crypto_load_cb (const char *directory, const char *file, void *obj)
static int	evp_cipher_aes_decrypt (const unsigned char *in, unsigned char *out, unsigned inlen, const ast_aes_decrypt_key *key)
static int	evp_cipher_aes_encrypt (const unsigned char *in, unsigned char *out, unsigned inlen, const ast_aes_encrypt_key *key)
static int	evp_pkey_decrypt (EVP_PKEY *pkey, const unsigned char *in, unsigned inlen, unsigned char *out, unsigned *outlen, unsigned padding)
static int	evp_pkey_encrypt (EVP_PKEY *pkey, const unsigned char *in, unsigned inlen, unsigned char *out, unsigned *outlen, unsigned padding)
static int	evp_pkey_sign (EVP_PKEY *pkey, const unsigned char *in, unsigned inlen, unsigned char *sig, unsigned *siglen, unsigned padding)
static int	evp_pkey_verify (EVP_PKEY *pkey, const unsigned char *in, unsigned inlen, const unsigned char *sig, unsigned siglen, unsigned padding)
static char *	handle_cli_keys_init (struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
	initialize all RSA keys More...
static char *	handle_cli_keys_show (struct ast_cli_entry *e, int cmd, struct ast_cli_args *a)
	show the list of RSA keys More...
static int	load_module (void)
static void	md52sum (char *sum, unsigned char *md5)
static int	pw_cb (char *buf, int size, int rwflag, void *userdata)
	setting of priv key More...
static int	reload (void)
static struct ast_key *	try_load_key (const char *dir, const char *fname, int ifd, int ofd, int *not2)
	load RSA key from file More...
static int	unload_module (void)

Variables
static struct ast_module_info	__mod_info = { .name = AST_MODULE, .flags = AST_MODFLAG_GLOBAL_SYMBOLS | AST_MODFLAG_LOAD_ORDER , .description = "Cryptographic Digital Signatures" , .key = "This paragraph is copyright (c) 2006 by Digium, Inc. \In order for your module to load, it must return this \key via a function called \"key\". Any code which \includes this paragraph must be licensed under the GNU \General Public License version 2 or later (at your \option). In addition to Digium's general reservations \of rights, Digium expressly reserves the right to \allow other parties to license this paragraph under \different terms. Any use of Digium, Inc. trademarks or \logos (including \"Asterisk\" or \"Digium\") without \express written permission of Digium, Inc. is prohibited.\n" , .buildopt_sum = AST_BUILDOPT_SUM, .support_level = AST_MODULE_SUPPORT_CORE, .load = load_module, .unload = unload_module, .reload = reload, .load_pri = AST_MODPRI_CHANNEL_DEPEND, }
static const struct ast_module_info *	ast_module_info = &__mod_info
static struct ast_cli_entry	cli_crypto []
static struct keys	keys = { .first = NULL, .last = NULL, .lock = { PTHREAD_RWLOCK_INITIALIZER , NULL, {1, 0} } , }

Detailed Description

Provide Cryptographic Signature capability.

Author

Mark Spencer marks.nosp@m.ter@.nosp@m.digiu.nosp@m.m.co.nosp@m.m

Uses the OpenSSL library, available at http://www.openssl.org/

Definition in file res_crypto.c.

Macro Definition Documentation

AST_API_MODULE

#define AST_API_MODULE

Definition at line 57 of file res_crypto.c.

FILE_MODE_BITS

#define FILE_MODE_BITS   (S_ISUID|S_ISGID|S_ISVTX|S_IRWXU|S_IRWXG|S_IRWXO)

FORMAT

#define FORMAT   "%-18s %-8s %-16s %-33s\n"

KEY_NEEDS_PASSCODE

#define KEY_NEEDS_PASSCODE   (1 << 16)

Definition at line 73 of file res_crypto.c.

RSA_PKCS1_OAEP_PADDING_SIZE

#define RSA_PKCS1_OAEP_PADDING_SIZE   (1 + 2 * SHA_DIGEST_LENGTH)

Definition at line 78 of file res_crypto.c.

Function Documentation

__reg_module()

static void __reg_module ( void  )

static

Definition at line 996 of file res_crypto.c.

__unreg_module()

static void __unreg_module ( void  )

static

Definition at line 996 of file res_crypto.c.

ast_aes_decrypt()

int AST_OPTIONAL_API_NAME() ast_aes_decrypt	(	const unsigned char *	in,
		unsigned char *	out,
		const ast_aes_decrypt_key *	key
	)

AES decrypt data.

Parameters

in	encrypted data
out	pointer to a buffer to hold the decrypted output
key	pointer to the ast_aes_decrypt_key to use for decryption

Return values

<=	0 failure
otherwise	number of bytes in output buffer

Definition at line 790 of file res_crypto.c.

{
    int res;
 
    if ((res = evp_cipher_aes_decrypt(in, out, AST_CRYPTO_AES_BLOCKSIZE / 8, key)) <= 0) {
        ast_log(LOG_ERROR, "AES decryption failed\n");
    }
    return res;
}

References AST_CRYPTO_AES_BLOCKSIZE, ast_log, evp_cipher_aes_decrypt(), in, LOG_ERROR, and out.

Referenced by aes_helper(), AST_TEST_DEFINE(), decrypt_memcpy(), and memcpy_decrypt().

ast_aes_encrypt()

int AST_OPTIONAL_API_NAME() ast_aes_encrypt	(	const unsigned char *	in,
		unsigned char *	out,
		const ast_aes_encrypt_key *	key
	)

AES encrypt data.

Parameters

in	data to be encrypted
out	pointer to a buffer to hold the encrypted output
key	pointer to the ast_aes_encrypt_key to use for encryption

Return values

<=	0 failure
otherwise	number of bytes in output buffer

Definition at line 749 of file res_crypto.c.

{
    int res;
 
    if ((res = evp_cipher_aes_encrypt(in, out, AST_CRYPTO_AES_BLOCKSIZE / 8, key)) <= 0) {
        ast_log(LOG_ERROR, "AES encryption failed\n");
    }
    return res;
}

References AST_CRYPTO_AES_BLOCKSIZE, ast_log, evp_cipher_aes_encrypt(), in, LOG_ERROR, and out.

Referenced by aes_helper(), AST_TEST_DEFINE(), encrypt_memcpy(), and memcpy_encrypt().

ast_aes_set_decrypt_key()

int AST_OPTIONAL_API_NAME() ast_aes_set_decrypt_key	(	const unsigned char *	key,
		ast_aes_decrypt_key *	ctx
	)

Set a decryption key.

Parameters

key	a 16 char key
ctx	address of an aes encryption context

Return values

0	success
nonzero	failure

Definition at line 709 of file res_crypto.c.

{
    if (key == NULL || ctx == NULL) {
        return -1;
    }
    memcpy(ctx->raw, key, AST_CRYPTO_AES_BLOCKSIZE / 8);
    return 0;
}

References AST_CRYPTO_AES_BLOCKSIZE, and NULL.

Referenced by aes_helper(), AST_TEST_DEFINE(), build_ecx_key(), build_encryption_keys(), check_key(), socket_process_helper(), and update_key().

ast_aes_set_encrypt_key()

int AST_OPTIONAL_API_NAME() ast_aes_set_encrypt_key	(	const unsigned char *	key,
		ast_aes_encrypt_key *	ctx
	)

Set an encryption key.

Parameters

key	a 16 char key
ctx	address of an aes encryption context

Return values

0	success
nonzero	failure

Definition at line 700 of file res_crypto.c.

{
    if (key == NULL || ctx == NULL) {
        return -1;
    }
    memcpy(ctx->raw, key, AST_CRYPTO_AES_BLOCKSIZE / 8);
    return 0;
}

References AST_CRYPTO_AES_BLOCKSIZE, and NULL.

Referenced by aes_helper(), AST_TEST_DEFINE(), build_ecx_key(), check_key(), and update_key().

ast_check_signature()

int AST_OPTIONAL_API_NAME() ast_check_signature	(	struct ast_key *	key,
		const char *	msg,
		const char *	sig
	)

base64 decode then sent to __ast_check_signature_bin

Check the authenticity of a message signature using a given public key.

See also

ast_check_signature

Definition at line 673 of file res_crypto.c.

{
    unsigned char dsig[128];
    int res;
 
    /* Decode signature */
    if ((res = ast_base64decode(dsig, sig, sizeof(dsig))) != sizeof(dsig)) {
        ast_log(LOG_WARNING, "Signature improper length (expect %d, got %d)\n", (int)sizeof(dsig), (int)res);
        return -1;
    }
 
    res = ast_check_signature_bin(key, msg, strlen(msg), dsig);
 
    return res;
}

References ast_base64decode(), ast_check_signature_bin(), ast_log, and LOG_WARNING.

Referenced by authenticate_verify(), and register_verify().

ast_check_signature_bin()

int AST_OPTIONAL_API_NAME() ast_check_signature_bin	(	struct ast_key *	key,
		const char *	msg,
		int	msglen,
		const unsigned char *	dsig
	)

check signature of a message

Check the authenticity of a message signature using a given public key.

See also

ast_check_signature_bin

Definition at line 634 of file res_crypto.c.

{
    unsigned char digest[SHA_DIGEST_LENGTH];
    unsigned digestlen;
    int res;
    EVP_MD_CTX *ctx = NULL;
 
    if (key->ktype != AST_KEY_PUBLIC) {
        /* Okay, so of course you really *can* but for our purposes
           we're going to say you can't */
        ast_log(LOG_WARNING, "Cannot check message signature with a private key\n");
        return -1;
    }
 
    /* Calculate digest of message */
    ctx = EVP_MD_CTX_create();
    if (ctx == NULL) {
        ast_log(LOG_ERROR, "Out of memory\n");
        return -1;
    }
    EVP_DigestInit(ctx, EVP_sha1());
    EVP_DigestUpdate(ctx, msg, msglen);
    EVP_DigestFinal(ctx, digest, &digestlen);
    EVP_MD_CTX_destroy(ctx);
 
    /* Verify signature */
    if (!(res = evp_pkey_verify(key->pkey, (const unsigned char *)digest, sizeof(digest), (unsigned char *)dsig, 128, RSA_PKCS1_PADDING))) {
        ast_debug(1, "Key failed verification: %s\n", key->name);
        return -1;
    }
 
    /* Pass */
    return 0;
}

References ast_debug, AST_KEY_PUBLIC, ast_log, ast_key::digest, evp_pkey_verify(), ast_key::ktype, LOG_ERROR, LOG_WARNING, ast_key::name, NULL, and ast_key::pkey.

Referenced by ast_check_signature(), AST_TEST_DEFINE(), and check_key().

ast_crypto_loaded()

int AST_OPTIONAL_API_NAME() ast_crypto_loaded

(

void

)

Definition at line 689 of file res_crypto.c.

{
    return 1;
}

Referenced by AST_TEST_DEFINE().

ast_crypto_reload()

int AST_OPTIONAL_API_NAME() ast_crypto_reload

(

void

)

Definition at line 694 of file res_crypto.c.

{
    crypto_load(-1, -1);
    return 1;
}

References crypto_load().

Referenced by AST_TEST_DEFINE().

ast_decrypt_bin()

int AST_OPTIONAL_API_NAME() ast_decrypt_bin	(	unsigned char *	dst,
		const unsigned char *	src,
		int	srclen,
		struct ast_key *	key
	)

decrypt a message

Decrypt a message using a given private key.

See also

ast_decrypt_bin

Definition at line 472 of file res_crypto.c.

{
    int res;
    unsigned pos = 0, dstlen, blocksize;
 
    if (key->ktype != AST_KEY_PRIVATE) {
        ast_log(LOG_WARNING, "Cannot decrypt with a public key\n");
        return -1;
    }
 
    blocksize = EVP_PKEY_size(key->pkey);
 
    if (srclen % blocksize) {
        ast_log(LOG_NOTICE, "Tried to decrypt something not a multiple of %u bytes\n", blocksize);
        return -1;
    }
 
    while (srclen > 0) {
        /* Process chunks 128 bytes at a time */
        dstlen = blocksize;
        if ((res = evp_pkey_decrypt(key->pkey, src, blocksize, dst, &dstlen, RSA_PKCS1_OAEP_PADDING)) <= 0) {
            return -1;
        }
        pos += dstlen;
        src += blocksize;
        srclen -= blocksize;
        dst += dstlen;
    }
 
    return pos;
}

References AST_KEY_PRIVATE, ast_log, evp_pkey_decrypt(), ast_key::ktype, LOG_NOTICE, LOG_WARNING, and ast_key::pkey.

Referenced by AST_TEST_DEFINE(), and check_key().

ast_encrypt_bin()

int AST_OPTIONAL_API_NAME() ast_encrypt_bin	(	unsigned char *	dst,
		const unsigned char *	src,
		int	srclen,
		struct ast_key *	key
	)

encrypt a message

Encrypt a message using a given private key.

See also

ast_encrypt_bin

Definition at line 549 of file res_crypto.c.

{
    unsigned bytes, pos = 0, dstlen, blocksize;
    int res;
 
    if (key->ktype != AST_KEY_PUBLIC) {
        ast_log(LOG_WARNING, "Cannot encrypt with a private key\n");
        return -1;
    }
 
    blocksize = EVP_PKEY_size(key->pkey);
 
    while (srclen) {
        bytes = srclen;
        if (bytes > blocksize - RSA_PKCS1_OAEP_PADDING_SIZE) {
            bytes = blocksize - RSA_PKCS1_OAEP_PADDING_SIZE;
        }
        /* Process chunks 128-41 bytes at a time */
        dstlen = blocksize;
        if ((res = evp_pkey_encrypt(key->pkey, src, bytes, dst, &dstlen, RSA_PKCS1_OAEP_PADDING)) != blocksize) {
            ast_log(LOG_NOTICE, "How odd, encrypted size is %d\n", res);
            return -1;
        }
        src += bytes;
        srclen -= bytes;
        pos += dstlen;
        dst += dstlen;
    }
    return pos;
}

References AST_KEY_PUBLIC, ast_log, evp_pkey_encrypt(), ast_key::ktype, LOG_NOTICE, LOG_WARNING, ast_key::pkey, and RSA_PKCS1_OAEP_PADDING_SIZE.

Referenced by AST_TEST_DEFINE(), and update_key().

ast_key_get()

struct ast_key *AST_OPTIONAL_API_NAME() ast_key_get	(	const char *	kname,
		int	ktype
	)

return the ast_key structure for name

Retrieve a key.

See also

ast_key_get

Definition at line 149 of file res_crypto.c.

{
    struct ast_key *key;
 
    AST_RWLIST_RDLOCK(&keys);
    AST_RWLIST_TRAVERSE(&keys, key, list) {
        if (!strcmp(kname, key->name) &&
            (ktype == key->ktype)) {
            break;
        }
    }
    AST_RWLIST_UNLOCK(&keys);
 
    return key;
}

References AST_RWLIST_RDLOCK, AST_RWLIST_TRAVERSE, AST_RWLIST_UNLOCK, ast_key::ktype, and ast_key::name.

Referenced by AST_TEST_DEFINE(), authenticate(), authenticate_verify(), check_key(), register_verify(), and update_key().

AST_MODULE_SELF_SYM()

struct ast_module * AST_MODULE_SELF_SYM

(

void

)

Definition at line 996 of file res_crypto.c.

ast_sign()

int AST_OPTIONAL_API_NAME() ast_sign	(	struct ast_key *	key,
		char *	msg,
		char *	sig
	)

wrapper for __ast_sign_bin then base64 encode it

Sign a message signature using a given private key.

See also

ast_sign

Definition at line 584 of file res_crypto.c.

{
    /* assumes 1024 bit RSA key size */
    unsigned char dsig[128];
    int siglen = sizeof(dsig), res;
 
    if (!(res = ast_sign_bin(key, msg, strlen(msg), dsig))) {
        /* Success -- encode (256 bytes max as documented) */
        ast_base64encode(sig, dsig, siglen, 256);
    }
 
    return res;
}

References ast_base64encode(), and ast_sign_bin().

Referenced by authenticate().

ast_sign_bin()

int AST_OPTIONAL_API_NAME() ast_sign_bin	(	struct ast_key *	key,
		const char *	msg,
		int	msglen,
		unsigned char *	dsig
	)

signs outgoing message with public key

Sign a message signature using a given private key.

See also

ast_sign_bin

Definition at line 390 of file res_crypto.c.

{
    unsigned char digest[SHA_DIGEST_LENGTH];
    unsigned digestlen, siglen = 128;
    int res;
    EVP_MD_CTX *ctx = NULL;
 
    if (key->ktype != AST_KEY_PRIVATE) {
        ast_log(LOG_WARNING, "Cannot sign with a public key\n");
        return -1;
    }
 
    if (siglen < EVP_PKEY_size(key->pkey)) {
        ast_log(LOG_WARNING, "Signature buffer too small\n");
        return -1;
    }
 
    /* Calculate digest of message */
    ctx = EVP_MD_CTX_create();
    if (ctx == NULL) {
        ast_log(LOG_ERROR, "Out of memory\n");
        return -1;
    }
    EVP_DigestInit(ctx, EVP_sha1());
    EVP_DigestUpdate(ctx, msg, msglen);
    EVP_DigestFinal(ctx, digest, &digestlen);
    EVP_MD_CTX_destroy(ctx);
 
    /* Verify signature */
    if ((res = evp_pkey_sign(key->pkey, digest, sizeof(digest), dsig, &siglen, RSA_PKCS1_PADDING)) <= 0) {
        ast_log(LOG_WARNING, "RSA Signature (key %s) failed %d\n", key->name, res);
        return -1;
    }
 
    if (siglen != EVP_PKEY_size(key->pkey)) {
        ast_log(LOG_WARNING, "Unexpected signature length %u, expecting %d\n", siglen, EVP_PKEY_size(key->pkey));
        return -1;
    }
 
    return 0;
}

References AST_KEY_PRIVATE, ast_log, ast_key::digest, evp_pkey_sign(), ast_key::ktype, LOG_ERROR, LOG_WARNING, ast_key::name, NULL, and ast_key::pkey.

Referenced by ast_sign(), AST_TEST_DEFINE(), and update_key().

crypto_init()

static int crypto_init ( void  )

static

initialise the res_crypto module

Definition at line 959 of file res_crypto.c.

{
    ast_cli_register_multiple(cli_crypto, ARRAY_LEN(cli_crypto));
    return 0;
}

References ARRAY_LEN, ast_cli_register_multiple, and cli_crypto.

Referenced by load_module().

crypto_load()

static void crypto_load ( int  ifd, int  ofd  )

static

refresh RSA keys from file

Parameters

ifd	file descriptor
ofd	file descriptor

Definition at line 819 of file res_crypto.c.

{
    struct ast_key *key;
    struct crypto_load_on_file on_file = { ifd, ofd, 0 };
 
    AST_RWLIST_WRLOCK(&keys);
 
    /* Mark all keys for deletion */
    AST_RWLIST_TRAVERSE(&keys, key, list) {
        key->delme = 1;
    }
 
    if (ast_file_read_dirs(ast_config_AST_KEY_DIR, crypto_load_cb, &on_file, 1) == -1) {
        ast_log(LOG_WARNING, "Unable to open key directory '%s'\n", ast_config_AST_KEY_DIR);
    }
 
    if (on_file.note) {
        ast_log(LOG_NOTICE, "Please run the command 'keys init' to enter the passcodes for the keys\n");
    }
 
    /* Delete any keys that are no longer present */
    AST_RWLIST_TRAVERSE_SAFE_BEGIN(&keys, key, list) {
        if (key->delme) {
            ast_debug(1, "Deleting key %s type %d\n", key->name, key->ktype);
            AST_RWLIST_REMOVE_CURRENT(list);
            if (key->pkey) {
                EVP_PKEY_free(key->pkey);
            }
            ast_free(key);
        }
    }
    AST_RWLIST_TRAVERSE_SAFE_END;
 
    AST_RWLIST_UNLOCK(&keys);
}

References ast_config_AST_KEY_DIR, ast_debug, ast_file_read_dirs(), ast_free, ast_log, AST_RWLIST_REMOVE_CURRENT, AST_RWLIST_TRAVERSE, AST_RWLIST_TRAVERSE_SAFE_BEGIN, AST_RWLIST_TRAVERSE_SAFE_END, AST_RWLIST_UNLOCK, AST_RWLIST_WRLOCK, crypto_load_cb(), ast_key::delme, crypto_load_on_file::ifd, ast_key::ktype, LOG_NOTICE, LOG_WARNING, ast_key::name, crypto_load_on_file::note, crypto_load_on_file::ofd, and ast_key::pkey.

Referenced by ast_crypto_reload(), load_module(), and reload().

crypto_load_cb()

static int crypto_load_cb ( const char *  directory, const char *  file, void *  obj  )

static

Definition at line 806 of file res_crypto.c.

{
    struct crypto_load_on_file *on_file = obj;
 
    try_load_key(directory, file, on_file->ifd, on_file->ofd, &on_file->note);
    return 0;
}

References make_ari_stubs::file, crypto_load_on_file::ifd, crypto_load_on_file::note, crypto_load_on_file::ofd, and try_load_key().

Referenced by crypto_load().

evp_cipher_aes_decrypt()

static int evp_cipher_aes_decrypt ( const unsigned char *  in, unsigned char *  out, unsigned  inlen, const ast_aes_decrypt_key *  key  )

static

Definition at line 759 of file res_crypto.c.

{
    EVP_CIPHER_CTX *ctx = NULL;
    int res, outlen, finallen;
    unsigned char final[AST_CRYPTO_AES_BLOCKSIZE / 8];
 
    if ((ctx = EVP_CIPHER_CTX_new()) == NULL) {
        return -1;
    }
 
    do {
        if ((res = EVP_CipherInit(ctx, EVP_aes_128_ecb(), key->raw, NULL, 0)) <= 0) {
            break;
        }
        EVP_CIPHER_CTX_set_padding(ctx, 0);
        if ((res = EVP_CipherUpdate(ctx, out, &outlen, in, inlen)) <= 0) {
            break;
        }
        /* for ECB, this is a no-op */
        if ((res = EVP_CipherFinal(ctx, final, &finallen)) <= 0) {
            break;
        }
 
        res = outlen;
    } while (0);
 
    EVP_CIPHER_CTX_free(ctx);
 
    return res;
}

References AST_CRYPTO_AES_BLOCKSIZE, in, NULL, out, and aes_key::raw.

Referenced by ast_aes_decrypt().

evp_cipher_aes_encrypt()

static int evp_cipher_aes_encrypt ( const unsigned char *  in, unsigned char *  out, unsigned  inlen, const ast_aes_encrypt_key *  key  )

static

Definition at line 718 of file res_crypto.c.

{
    EVP_CIPHER_CTX *ctx = NULL;
    int res, outlen, finallen;
    unsigned char final[AST_CRYPTO_AES_BLOCKSIZE / 8];
 
    if ((ctx = EVP_CIPHER_CTX_new()) == NULL) {
        return -1;
    }
 
    do {
        if ((res = EVP_CipherInit(ctx, EVP_aes_128_ecb(), key->raw, NULL, 1)) <= 0) {
            break;
        }
        EVP_CIPHER_CTX_set_padding(ctx, 0);
        if ((res = EVP_CipherUpdate(ctx, out, &outlen, in, inlen)) <= 0) {
            break;
        }
        /* for ECB, this is a no-op */
        if ((res = EVP_CipherFinal(ctx, final, &finallen)) <= 0) {
            break;
        }
 
        res = outlen;
    } while (0);
 
    EVP_CIPHER_CTX_free(ctx);
 
    return res;
}

References AST_CRYPTO_AES_BLOCKSIZE, in, NULL, out, and aes_key::raw.

Referenced by ast_aes_encrypt().

evp_pkey_decrypt()

static int evp_pkey_decrypt ( EVP_PKEY *  pkey, const unsigned char *  in, unsigned  inlen, unsigned char *  out, unsigned *  outlen, unsigned  padding  )

static

Definition at line 432 of file res_crypto.c.

{
    EVP_PKEY_CTX *ctx = NULL;
    int res = -1;
    size_t _outlen;
 
    if (*outlen < EVP_PKEY_size(pkey)) {
        return -1;
    }
 
    if (inlen != EVP_PKEY_size(pkey)) {
        return -1;
    }
 
    if ((ctx = EVP_PKEY_CTX_new(pkey, NULL)) == NULL) {
        return -1;
    }
 
    do {
        if ((res = EVP_PKEY_decrypt_init(ctx)) <= 0) {
            break;
        }
        if ((res = EVP_PKEY_CTX_set_rsa_padding(ctx, padding)) <= 0) {
            break;
        }
        _outlen = *outlen;
        if ((res = EVP_PKEY_decrypt(ctx, out, &_outlen, in, inlen)) <= 0) {
            break;
        }
        res = *outlen = _outlen;
    } while (0);
 
    EVP_PKEY_CTX_free(ctx);
    return res;
}

References in, NULL, out, and ast_key::pkey.

Referenced by ast_decrypt_bin().

evp_pkey_encrypt()

static int evp_pkey_encrypt ( EVP_PKEY *  pkey, const unsigned char *  in, unsigned  inlen, unsigned char *  out, unsigned *  outlen, unsigned  padding  )

static

Definition at line 504 of file res_crypto.c.

{
    EVP_PKEY_CTX *ctx = NULL;
    int res = -1;
    size_t _outlen;
 
    if (padding != RSA_PKCS1_OAEP_PADDING) {
        ast_log(LOG_WARNING, "Only OAEP padding is supported for now\n");
        return -1;
    }
 
    if (inlen > EVP_PKEY_size(pkey) - RSA_PKCS1_OAEP_PADDING_SIZE) {
        return -1;
    }
 
    if (*outlen < EVP_PKEY_size(pkey)) {
        return -1;
    }
 
    do {
        if ((ctx = EVP_PKEY_CTX_new(pkey, NULL)) == NULL) {
            break;
        }
 
        if ((res = EVP_PKEY_encrypt_init(ctx)) <= 0) {
            break;
        }
        if ((res = EVP_PKEY_CTX_set_rsa_padding(ctx, padding)) <= 0) {
            break;
        }
        _outlen = *outlen;
        if ((res = EVP_PKEY_encrypt(ctx, out, &_outlen, in, inlen)) <= 0) {
            break;
        }
        res = *outlen = _outlen;
    } while (0);
 
    EVP_PKEY_CTX_free(ctx);
    return res;
}

References ast_log, in, LOG_WARNING, NULL, out, ast_key::pkey, and RSA_PKCS1_OAEP_PADDING_SIZE.

Referenced by ast_encrypt_bin().

evp_pkey_sign()

static int evp_pkey_sign ( EVP_PKEY *  pkey, const unsigned char *  in, unsigned  inlen, unsigned char *  sig, unsigned *  siglen, unsigned  padding  )

static

Definition at line 351 of file res_crypto.c.

{
    EVP_PKEY_CTX *ctx = NULL;
    int res = -1;
    size_t _siglen;
 
    if (*siglen < EVP_PKEY_size(pkey)) {
        return -1;
    }
 
    if ((ctx = EVP_PKEY_CTX_new(pkey, NULL)) == NULL) {
        return -1;
    }
 
    do {
        if ((res = EVP_PKEY_sign_init(ctx)) <= 0) {
            break;
        }
        if ((res = EVP_PKEY_CTX_set_rsa_padding(ctx, padding)) <= 0) {
            break;
        }
        if ((res = EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha1())) <= 0) {
            break;
        }
        _siglen = *siglen;
        if ((res = EVP_PKEY_sign(ctx, sig, &_siglen, in, inlen)) <= 0) {
            break;
        }
        *siglen = _siglen;
    } while (0);
 
    EVP_PKEY_CTX_free(ctx);
    return res;
}

References in, and NULL.

Referenced by ast_sign_bin().

evp_pkey_verify()

static int evp_pkey_verify ( EVP_PKEY *  pkey, const unsigned char *  in, unsigned  inlen, const unsigned char *  sig, unsigned  siglen, unsigned  padding  )

static

Definition at line 598 of file res_crypto.c.

{
    EVP_PKEY_CTX *ctx = NULL;
    int res = -1;
 
    if (siglen < EVP_PKEY_size(pkey)) {
        return -1;
    }
 
    if ((ctx = EVP_PKEY_CTX_new(pkey, NULL)) == NULL) {
        return -1;
    }
 
    do {
        if ((res = EVP_PKEY_verify_init(ctx)) <= 0) {
            break;
        }
        if ((res = EVP_PKEY_CTX_set_rsa_padding(ctx, padding)) <= 0) {
            break;
        }
        if ((res = EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha1())) <= 0) {
            break;
        }
        if ((res = EVP_PKEY_verify(ctx, sig, siglen, in, inlen)) <= 0) {
            break;
        }
    } while (0);
 
    EVP_PKEY_CTX_free(ctx);
    return res;
}

References in, NULL, and ast_key::pkey.

Referenced by ast_check_signature_bin().

handle_cli_keys_init()

static char * handle_cli_keys_init ( struct ast_cli_entry *  e, int  cmd, struct ast_cli_args *  a  )

static

initialize all RSA keys

Parameters

e	CLI command
cmd
a	list of CLI arguments

Return values

CLI_SUCCESS

Definition at line 916 of file res_crypto.c.

{
    struct ast_key *key;
    int ign;
    char *kn, tmp[256] = "";
 
    switch (cmd) {
    case CLI_INIT:
        e->command = "keys init";
        e->usage =
            "Usage: keys init\n"
            "       Initializes private keys (by reading in pass code from\n"
            "       the user)\n";
        return NULL;
    case CLI_GENERATE:
        return NULL;
    }
 
    if (a->argc != 2) {
        return CLI_SHOWUSAGE;
    }
 
    AST_RWLIST_WRLOCK(&keys);
    AST_RWLIST_TRAVERSE_SAFE_BEGIN(&keys, key, list) {
        /* Reload keys that need pass codes now */
        if (key->ktype & KEY_NEEDS_PASSCODE) {
            kn = key->fn + strlen(ast_config_AST_KEY_DIR) + 1;
            ast_copy_string(tmp, kn, sizeof(tmp));
            try_load_key(ast_config_AST_KEY_DIR, tmp, a->fd, a->fd, &ign);
        }
    }
    AST_RWLIST_TRAVERSE_SAFE_END
    AST_RWLIST_UNLOCK(&keys);
 
    return CLI_SUCCESS;
}

References a, ast_config_AST_KEY_DIR, ast_copy_string(), AST_RWLIST_TRAVERSE_SAFE_BEGIN, AST_RWLIST_TRAVERSE_SAFE_END, AST_RWLIST_UNLOCK, AST_RWLIST_WRLOCK, CLI_GENERATE, CLI_INIT, CLI_SHOWUSAGE, CLI_SUCCESS, ast_cli_entry::command, ast_key::fn, KEY_NEEDS_PASSCODE, ast_key::ktype, NULL, tmp(), try_load_key(), and ast_cli_entry::usage.

handle_cli_keys_show()

static char * handle_cli_keys_show ( struct ast_cli_entry *  e, int  cmd, struct ast_cli_args *  a  )

static

show the list of RSA keys

Parameters

e	CLI command
cmd
a	list of CLI arguments

Return values

CLI_SUCCESS

Definition at line 870 of file res_crypto.c.

{
#define FORMAT "%-18s %-8s %-16s %-33s\n"
 
    struct ast_key *key;
    char sum[MD5_DIGEST_LENGTH * 2 + 1];
    int count_keys = 0;
 
    switch (cmd) {
    case CLI_INIT:
        e->command = "keys show";
        e->usage =
            "Usage: keys show\n"
            "       Displays information about RSA keys known by Asterisk\n";
        return NULL;
    case CLI_GENERATE:
        return NULL;
    }
 
    ast_cli(a->fd, FORMAT, "Key Name", "Type", "Status", "Sum");
    ast_cli(a->fd, FORMAT, "------------------", "--------", "----------------", "--------------------------------");
 
    AST_RWLIST_RDLOCK(&keys);
    AST_RWLIST_TRAVERSE(&keys, key, list) {
        md52sum(sum, key->digest);
        ast_cli(a->fd, FORMAT, key->name,
            (key->ktype & 0xf) == AST_KEY_PUBLIC ? "PUBLIC" : "PRIVATE",
            key->ktype & KEY_NEEDS_PASSCODE ? "[Needs Passcode]" : "[Loaded]", sum);
        count_keys++;
    }
    AST_RWLIST_UNLOCK(&keys);
 
    ast_cli(a->fd, "\n%d known RSA keys.\n", count_keys);
 
    return CLI_SUCCESS;
 
#undef FORMAT
}

References a, ast_cli(), AST_KEY_PUBLIC, AST_RWLIST_RDLOCK, AST_RWLIST_TRAVERSE, AST_RWLIST_UNLOCK, CLI_GENERATE, CLI_INIT, CLI_SUCCESS, ast_cli_entry::command, ast_key::digest, FORMAT, KEY_NEEDS_PASSCODE, ast_key::ktype, md52sum(), ast_key::name, NULL, and ast_cli_entry::usage.

load_module()

static int load_module ( void  )

static

Definition at line 971 of file res_crypto.c.

{
    crypto_init();
    if (ast_opt_init_keys) {
        crypto_load(STDIN_FILENO, STDOUT_FILENO);
    } else {
        crypto_load(-1, -1);
    }
 
    return AST_MODULE_LOAD_SUCCESS;
}

References AST_MODULE_LOAD_SUCCESS, ast_opt_init_keys, crypto_init(), and crypto_load().

md52sum()

static void md52sum ( char *  sum, unsigned char *  md5  )

static

Definition at line 855 of file res_crypto.c.

{
    int x;
    for (x = 0; x < MD5_DIGEST_LENGTH; x++) {
        sum += sprintf(sum, "%02hhx", *(md5++));
    }
}

References md5().

Referenced by handle_cli_keys_show().

pw_cb()

static int pw_cb ( char *  buf, int  size, int  rwflag, void *  userdata  )

static

setting of priv key

Parameters

buf
size
rwflag
userdata

Returns

length of string,-1 on failure

Definition at line 112 of file res_crypto.c.

{
    struct ast_key *key = (struct ast_key *)userdata;
    char prompt[256];
    int tmp;
    int res;
 
    if (key->infd < 0) {
        /* Note that we were at least called */
        key->infd = -2;
        return -1;
    }
 
    snprintf(prompt, sizeof(prompt), ">>>> passcode for %s key '%s': ",
         key->ktype == AST_KEY_PRIVATE ? "PRIVATE" : "PUBLIC", key->name);
    if (write(key->outfd, prompt, strlen(prompt)) < 0) {
        ast_log(LOG_WARNING, "write() failed: %s\n", strerror(errno));
        key->infd = -2;
        return -1;
    }
    tmp = ast_hide_password(key->infd);
    memset(buf, 0, size);
    res = read(key->infd, buf, size);
    if (res == -1) {
        ast_log(LOG_WARNING, "read() failed: %s\n", strerror(errno));
    }
    ast_restore_tty(key->infd, tmp);
    if (buf[strlen(buf) -1] == '\n') {
        buf[strlen(buf) - 1] = '\0';
    }
    return strlen(buf);
}

References ast_hide_password(), AST_KEY_PRIVATE, ast_log, ast_restore_tty(), buf, errno, ast_key::infd, ast_key::ktype, LOG_WARNING, ast_key::name, ast_key::outfd, prompt, and tmp().

Referenced by try_load_key().

reload()

static int reload ( void  )

static

Definition at line 965 of file res_crypto.c.

{
    crypto_load(-1, -1);
    return 0;
}

References crypto_load().

try_load_key()

static struct ast_key * try_load_key ( const char *  dir, const char *  fname, int  ifd, int  ofd, int *  not2  )

static

load RSA key from file

Parameters

dir	directory string
fname	name of file
ifd	incoming file descriptor
ofd	outgoing file descriptor
not2

Returns

key on success.

Return values

NULL	on failure.

Definition at line 175 of file res_crypto.c.

{
    int n, ktype = 0, found = 0;
    const char *c = NULL;
    char ffname[256];
    unsigned char digest[MD5_DIGEST_LENGTH];
    unsigned digestlen;
    FILE *f;
    EVP_MD_CTX *ctx = NULL;
    struct ast_key *key;
    static int notice = 0;
    struct stat st;
    size_t fnamelen = strlen(fname);
 
    /* Make sure its name is a public or private key */
    if (fnamelen > 4 && !strcmp((c = &fname[fnamelen - 4]), ".pub")) {
        ktype = AST_KEY_PUBLIC;
    } else if (fnamelen > 4 && !strcmp((c = &fname[fnamelen - 4]), ".key")) {
        ktype = AST_KEY_PRIVATE;
    } else {
        return NULL;
    }
 
    /* Get actual filename */
    n = snprintf(ffname, sizeof(ffname), "%s/%s", dir, fname);
    if (n >= sizeof(ffname)) {
        ast_log(LOG_WARNING,
            "Key filenames can be up to %zu bytes long, but the filename for the"
            " key we are currently trying to load (%s/%s) is %d bytes long.",
            sizeof(ffname) - 1, dir, fname, n);
        return NULL;
    }
 
    /* Open file */
    if (!(f = fopen(ffname, "r"))) {
        ast_log(LOG_WARNING, "Unable to open key file %s: %s\n", ffname, strerror(errno));
        return NULL;
    }
 
    n = fstat(fileno(f), &st);
    if (n != 0) {
        ast_log(LOG_ERROR, "Unable to stat key file: %s: %s\n", ffname, strerror(errno));
        fclose(f);
        return NULL;
    }
 
    if (!S_ISREG(st.st_mode)) {
        ast_log(LOG_ERROR, "Key file is not a regular file: %s\n", ffname);
        fclose(f);
        return NULL;
    }
 
    /* FILE_MODE_BITS is a bitwise OR of all possible file mode bits encoded in
     * the `st_mode` member of `struct stat`. For POSIX compatible systems this
     * will be 07777. */
#define FILE_MODE_BITS (S_ISUID|S_ISGID|S_ISVTX|S_IRWXU|S_IRWXG|S_IRWXO)
 
    /* only user read or read/write modes allowed */
    if (ktype == AST_KEY_PRIVATE &&
        ((st.st_mode & FILE_MODE_BITS) & ~(S_IRUSR | S_IWUSR)) != 0) {
        ast_log(LOG_ERROR, "Private key file has bad permissions: %s: %#4o\n", ffname, st.st_mode & FILE_MODE_BITS);
        fclose(f);
        return NULL;
    }
 
    ctx = EVP_MD_CTX_create();
    if (ctx == NULL) {
        ast_log(LOG_ERROR, "Out of memory\n");
        fclose(f);
        return NULL;
    }
    EVP_DigestInit(ctx, EVP_md5());
 
    while (!feof(f)) {
        /* Calculate a "whatever" quality md5sum of the key */
        char buf[256] = "";
        if (!fgets(buf, sizeof(buf), f)) {
            continue;
        }
        if (!feof(f)) {
            EVP_DigestUpdate(ctx, (unsigned char *)buf, strlen(buf));
        }
    }
    EVP_DigestFinal(ctx, digest, &digestlen);
    EVP_MD_CTX_destroy(ctx);
 
    /* Look for an existing key */
    AST_RWLIST_TRAVERSE(&keys, key, list) {
        if (!strcasecmp(key->fn, ffname)) {
            break;
        }
    }
 
    if (key) {
        /* If the MD5 sum is the same, and it isn't awaiting a passcode
           then this is far enough */
        if (!memcmp(digest, key->digest, sizeof(digest)) &&
            !(key->ktype & KEY_NEEDS_PASSCODE)) {
            fclose(f);
            key->delme = 0;
            return NULL;
        } else {
            /* Preserve keytype */
            ktype = key->ktype;
            /* Recycle the same structure */
            found++;
        }
    }
 
    if (!key) {
        if (!(key = ast_calloc(1, sizeof(*key)))) {
            fclose(f);
            return NULL;
        }
    }
    /* First the filename */
    ast_copy_string(key->fn, ffname, sizeof(key->fn));
    /* Then the name minus the suffix */
    snprintf(key->name, sizeof(key->name), "%.*s", (int)(c - fname), fname);
    key->ktype = ktype;
    /* Yes, assume we're going to be deleted */
    key->delme = 1;
    /* Keep the key type */
    memcpy(key->digest, digest, sizeof(key->digest));
    /* Can I/O takes the FD we're given */
    key->infd = ifd;
    key->outfd = ofd;
    /* Reset the file back to the beginning */
    rewind(f);
    /* Now load the key with the right method */
    if (ktype == AST_KEY_PUBLIC) {
        PEM_read_PUBKEY(f, &key->pkey, pw_cb, key);
    } else {
        PEM_read_PrivateKey(f, &key->pkey, pw_cb, key);
    }
    fclose(f);
    if (key->pkey) {
        if (EVP_PKEY_size(key->pkey) == (AST_CRYPTO_RSA_KEY_BITS / 8)) {
            /* Key loaded okay */
            key->ktype &= ~KEY_NEEDS_PASSCODE;
            ast_verb(3, "Loaded %s key '%s'\n", key->ktype == AST_KEY_PUBLIC ? "PUBLIC" : "PRIVATE", key->name);
            ast_debug(1, "Key '%s' loaded OK\n", key->name);
            key->delme = 0;
        } else {
            ast_log(LOG_NOTICE, "Key '%s' is not expected size.\n", key->name);
        }
    } else if (key->infd != -2) {
        ast_log(LOG_WARNING, "Key load %s '%s' failed\n", key->ktype == AST_KEY_PUBLIC ? "PUBLIC" : "PRIVATE", key->name);
        if (ofd > -1) {
            ERR_print_errors_fp(stderr);
        } else {
            ERR_print_errors_fp(stderr);
        }
    } else {
        ast_log(LOG_NOTICE, "Key '%s' needs passcode.\n", key->name);
        key->ktype |= KEY_NEEDS_PASSCODE;
        if (!notice) {
            if (!ast_opt_init_keys) {
                ast_log(LOG_NOTICE, "Add the '-i' flag to the asterisk command line if you want to automatically initialize passcodes at launch.\n");
            }
            notice++;
        }
        /* Keep it anyway */
        key->delme = 0;
        /* Print final notice about "keys init" when done */
        *not2 = 1;
    }
 
    /* If this is a new key add it to the list */
    if (!found) {
        AST_RWLIST_INSERT_TAIL(&keys, key, list);
    }
 
    return key;
}

References ast_calloc, ast_copy_string(), AST_CRYPTO_RSA_KEY_BITS, ast_debug, AST_KEY_PRIVATE, AST_KEY_PUBLIC, ast_log, ast_opt_init_keys, AST_RWLIST_INSERT_TAIL, AST_RWLIST_TRAVERSE, ast_verb, buf, c, ast_key::delme, ast_key::digest, errno, FILE_MODE_BITS, ast_key::fn, ast_key::infd, KEY_NEEDS_PASSCODE, ast_key::ktype, LOG_ERROR, LOG_NOTICE, LOG_WARNING, ast_key::name, NULL, ast_key::outfd, ast_key::pkey, and pw_cb().

Referenced by crypto_load_cb(), and handle_cli_keys_init().

unload_module()

static int unload_module ( void  )

static

Since we don't have a config file, we could move up to REALTIME_DEPEND, if necessary

Definition at line 983 of file res_crypto.c.

References ARRAY_LEN, ast_cli_unregister_multiple(), and cli_crypto.

Variable Documentation

__mod_info

struct ast_module_info __mod_info = { .name = AST_MODULE, .flags = AST_MODFLAG_GLOBAL_SYMBOLS | AST_MODFLAG_LOAD_ORDER , .description = "Cryptographic Digital Signatures" , .key = "This paragraph is copyright (c) 2006 by Digium, Inc. \In order for your module to load, it must return this \key via a function called \"key\". Any code which \includes this paragraph must be licensed under the GNU \General Public License version 2 or later (at your \option). In addition to Digium's general reservations \of rights, Digium expressly reserves the right to \allow other parties to license this paragraph under \different terms. Any use of Digium, Inc. trademarks or \logos (including \"Asterisk\" or \"Digium\") without \express written permission of Digium, Inc. is prohibited.\n" , .buildopt_sum = AST_BUILDOPT_SUM, .support_level = AST_MODULE_SUPPORT_CORE, .load = load_module, .unload = unload_module, .reload = reload, .load_pri = AST_MODPRI_CHANNEL_DEPEND, }

static

Definition at line 996 of file res_crypto.c.

ast_module_info

const struct ast_module_info* ast_module_info = &__mod_info

static

Definition at line 996 of file res_crypto.c.

cli_crypto

struct ast_cli_entry cli_crypto[]

static

Initial value:

= {
    { .handler =  handle_cli_keys_show , .summary =  "Displays RSA key information" ,},
    { .handler =  handle_cli_keys_init , .summary =  "Initialize RSA key passcodes" ,}
}

Definition at line 953 of file res_crypto.c.

Referenced by crypto_init(), and unload_module().

keys

struct keys keys = { .first = NULL, .last = NULL, .lock = { PTHREAD_RWLOCK_INITIALIZER , NULL, {1, 0} } , }

static

Referenced by store_odbc().