/* prepares a certificate, signs it and writes it to file */ int cert_sign_n_write (const dckey *ca, const char *id, const dckey *pk, unsigned int ndays, const char *cert_file) { int fdcert; cert *cert = NULL; char *cert_msg = NULL; if (!(cert = cert_init (ca, id, pk, ndays)) || !(cert_msg = cert_export (cert, 0)) || !(cert->sig = dcsign (ca, cert_msg)) || (xfree (cert_msg), !(cert_msg = cert_export (cert, 1)))) { printf ("%s: error creating the certificate\n", getprogname ()); cert_clr (cert); cert = NULL; check_n_free (&cert_msg); return -2; } /* write certificate and signature to fdcert */ else { if ((fdcert = open (cert_file,O_WRONLY|O_TRUNC|O_CREAT,0644)) == -1){ printf ("%s: trouble opening %s\n", getprogname (), cert_file); perror (getprogname ()); cert_clr (cert); cert = NULL; check_n_free (&cert_msg); return -1; } else if ((write_chunk (fdcert, cert_msg, strlen (cert_msg)) == -1) || (write_chunk (fdcert, "\n", 1) == -1)) { printf ("%s: trouble writing certificate to %s\n", getprogname (), cert_file); perror (getprogname ()); cert_clr (cert); cert = NULL; check_n_free (&cert_msg); return -1; } else { cert_clr (cert); cert = NULL; check_n_free (&cert_msg); close (fdcert); fdcert = -1; return 0; } } }
void cert_clr (cert *c) { if (c) { check_n_free (&(c->version)); check_n_free (&(c->issuer)); check_n_free (&(c->identity)); check_n_free (&(c->public_key)); xfree (c); } }
dckey * g_option (const char *sk_file) { char *raw_pk = NULL; dckey *pk = NULL; dckey *sk = dckeygen (DC_RABIN, 1024, NULL); write_skfile (sk_file, sk); if (!(raw_pk = dcexport_pub (sk)) || ! (pk = dcimport_pub (raw_pk))) { fprintf (stderr, "%s: trouble exporting public key\n", getprogname ()); check_n_free (&raw_pk); dcfree (sk); exit (1); } check_n_free (&raw_pk); return pk; }
static void *search_multi_page(struct page_allocator *allocator, size_t page_q) { size_t page_n = 0; size_t found_page_q; while (-1 != (page_n = search_first_free(allocator, page_n))) { if (page_q == (found_page_q = check_n_free(allocator, page_n, page_q))) { mark_n_busy(allocator, page_n, page_q); return page_i2ptr(allocator, page_n); } page_n += found_page_q; } return NULL; }
/* verify the signature on a certificate */ int cert_verify (const cert *c) { int res; char *raw_cert = cert_export (c, 0); /* don't append sig to cert */ if (!raw_cert || (dcverify (c->issuer, raw_cert, c->sig) == -1) || ((c->day_issued != c->day_expires) && (difftime (c->day_expires, time (NULL)) < -EXP_CERT_GRACE))) { res = 0; } else { res = 1; } check_n_free (&raw_cert); return res; }
int main (int argc, char **argv) { int fdca, fdpk; dckey *ca = NULL, *pk = NULL; char *id = NULL; char *cert_file = NULL, *pk_file = NULL; int duration = -1; ri (); if (argc < 2) usage (argv[0]); else if (argc == 2) { if (strcmp (argv[1], "init") != 0) usage (argv[0]); else { setprogname (argv[0]); pki_init (); } } else if (argc == 5) { if (strcmp (argv[1], "check") != 0) usage (argv[0]); else { setprogname (argv[0]); pki_check (argv[2], argv[3], argv[4]); } } else if (strcmp (argv[1], "cert") != 0) { usage (argv[0]); } else { /* cert commnad */ setprogname (argv[0]); /* first, let's take care of the options, if any */ parse_options (&pk, &cert_file, &duration, argc, argv); /* the last two args are ID and PK-FILE */ pk_file = argv[argc - 2]; id = argv[argc - 1]; /* set up default values for parameters not affected by the options */ if (!cert_file) { /* default cert_file is ID.cert */ if (cat_str (&cert_file, id) || cat_str (&cert_file, ".cert")) { xfree (cert_file); exit (1); } } if (duration == -1) /* default duration is 30 days */ duration = 30; /* take care of the public key that we are certifying */ /* if the -g option was used, we have to write the pk to pk_file */ if (pk) write_pkfile (pk_file, pk); /* otherwise, import pk from pk_file */ else { if ((fdpk = open (pk_file, O_RDONLY)) == -1) { if (errno == ENOENT) { usage (argv[0]); } else { perror (argv[0]); exit (1); } } else if (!(pk = import_pub_from_file (fdpk))) { fprintf (stderr, "%s: no public key found in %s\n", argv[0], pk_file); close (fdpk); exit (1); } close (fdpk); fdpk = -1; } /* now read the ca private key from ./.pki/ca.priv */ if ((fdca = open ("./.pki/ca.priv", O_RDONLY)) == -1) { if (errno == ENOENT) { usage (argv[0]); } else { perror (argv[0]); exit (1); } } else { if (!(ca = import_priv_from_file (fdca))) { fprintf (stderr, "%s: no private key found in %s\n", argv[0], "./.pki/ca.priv"); close (fdca); exit (1); } close (fdca); fdca = -1; /* prepare a cert, sign it and write it to cert_file */ switch (cert_sign_n_write (ca, id, pk, duration, cert_file)) { case 0: /* no error */ /* the ca signing key is not needed anymore: wipe it out */ dcfree (ca); ca = NULL; break; case -1: /* trouble with the write system call */ check_n_free (&cert_file); dcfree (ca); exit (1); case -2: /* trouble preparing/signinig the certificate */ check_n_free (&cert_file); dcfree (ca); exit (1); default: check_n_free (&cert_file); dcfree (ca); exit (1); } assert (cert_verify (cert_read (cert_file))); dcfree (pk); pk = NULL; } } check_n_free (&cert_file); return 0; }
int main (int argc, char **argv) { const char *ke_msg1 = NULL; char *ke_msg2 = NULL; char *ca_file = NULL; char *sk_file = NULL; char *cert_file = NULL; char *resp_id = NULL; int out_fd; flow1 *to_b = NULL; flow2 *from_b = NULL; cert *own_cert = NULL; dckey *sk = NULL; dckey *ca_pk = NULL; u_char seskey[sha1_hashsize], secret[aes_blocklen]; char *pretty_secret = NULL; if ((argc == 5) && argv[1][0] != '-') { /* no -p option */ ca_file = "./.pki/ca.pub"; } else if ((argc == 6) && (argv[1][0] != '-') && (argv[1] + 1) && (argv[1][1] != 'p') && (argv[1] + 2)) { /* -p option present, followed by CERT-FILE without separating blank */ ca_file = argv[1] + 2; } else if ((argc == 7) && !strcmp (argv[1], "-p")) { /* -p option present, followed by blank and CERT-FILE */ ca_file = argv[2]; } else { usage (argv[0]); /* does not return */ } setprogname (argv[0]); ri (); sk_file = argv[argc - 4]; cert_file = argv[argc - 3]; resp_id = argv[argc - 2]; out_fd = atoi (argv[argc - 1]); if (!cert_verify (own_cert = cert_read (cert_file))) { fprintf (stderr, "%s: trouble reading certificate from %s, or certificate expired\n", getprogname (), cert_file); perror (getprogname ()); exit (1); } else { to_b = prepare_ke_msg (own_cert, xstrdup (resp_id)); sk = sk_from_file (sk_file); ke_msg1 = export_ke_msg (to_b, sk); dcfree (sk); sk = NULL; write_chunk (1, ke_msg1, strlen (ke_msg1)); check_n_free ((char **) &ke_msg1); ca_pk = pk_from_file (ca_file); if (!(ke_msg2 = read_line (0)) || !(from_b = process_ke_reply (to_b, ke_msg2, ca_pk))) { fprintf (stderr, "error reading/parsing bob's message:\n%s", ke_msg2); dcfree (ca_pk); ca_pk = NULL; check_n_free(&ke_msg2); exit (1); } dcfree (ca_pk); ca_pk = NULL; check_n_free(&ke_msg2); /* derive_key looks at seskey to know if it the caller is alice or bob */ seskey[0] = 'a'; if (derive_key (seskey, to_b, from_b) == -1) { fprintf (stderr, "error deriving session key for alice.\n"); flow1_clr (to_b); flow2_clr (from_b); exit (1); } else { /* choose a random number to send */ prng_getbytes (secret, aes_blocklen); cat_buf (&pretty_secret, secret, aes_blocklen); /* send it to bob, encrypted under the newly established session key */ send_secret (1, secret, seskey); /* dump the chosen secret to standard error */ if ((write_chunk (out_fd, pretty_secret, strlen (pretty_secret)) == -1) || (write_chunk (out_fd, "\n", 1) == -1)) { fprintf (stderr, "error writing to the launcher.\n"); bzero (seskey, sha1_hashsize); bzero (secret, sizeof (secret)); bzero (pretty_secret, strlen (pretty_secret)); xfree (pretty_secret); pretty_secret = NULL; flow1_clr (to_b); flow2_clr (from_b); exit (1); } /* wipe out sensitive data */ bzero (seskey, sha1_hashsize); bzero (secret, sizeof (secret)); bzero (pretty_secret, strlen (pretty_secret)); xfree (pretty_secret); pretty_secret = NULL; flow1_clr (to_b); flow2_clr (from_b); } } /* fprintf (stderr, "alice:done.\n"); */ return 0; }