Introduce a signer interface intented to make TLS privsep simpler

to implement.

Add a tls_config_set_sign_cb() function that allows to register
a callback for the signing operation on a tls_config. When used,
the context installs fake pivate keys internally, and the callback
receives the hash of the public key.

Add a tls_signer_*() set of functions to manage tls_signer objects.
A tls_signer is an opaque structure on which keys are added.
It is used to compute signatures with private keys identified by
their associated public key hash.

Discussed with and ok jsing@ tb@

7 files changed, 438 insertions, 5 deletions

diff --git a/src/lib/libtls/Makefile b/src/lib/libtls/Makefile
index 23a6ed1f2a..78ff99b585 100644
--- a/src/lib/libtls/Makefile
+++ b/src/lib/libtls/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.36 2020/06/09 16:53:53 deraadt Exp $
+#       $OpenBSD: Makefile,v 1.37 2022/01/25 21:51:24 eric Exp $
 
 .include <bsd.own.mk>
 .ifndef NOMAN
@@ -35,6 +35,7 @@ SRCS=	tls.c \
         tls_keypair.c \
         tls_peer.c \
         tls_server.c \
+        tls_signer.c \
         tls_util.c \
         tls_ocsp.c \
         tls_verify.c
diff --git a/src/lib/libtls/Symbols.list b/src/lib/libtls/Symbols.list
index 42c039d294..d00e5e0ce6 100644
--- a/src/lib/libtls/Symbols.list
+++ b/src/lib/libtls/Symbols.list
@@ -43,6 +43,7 @@ tls_config_set_protocols
 tls_config_set_session_id
 tls_config_set_session_lifetime
 tls_config_set_session_fd
+tls_config_set_sign_cb
 tls_config_set_verify_depth
 tls_config_skip_private_key_check
 tls_config_use_fake_private_key
@@ -87,5 +88,10 @@ tls_peer_ocsp_url
 tls_read
 tls_reset
 tls_server
+tls_signer_add_keypair_file
+tls_signer_add_keypair_mem
+tls_signer_free
+tls_signer_new
+tls_signer_sign
 tls_unload_file
 tls_write
diff --git a/src/lib/libtls/tls.c b/src/lib/libtls/tls.c
index 608f0a3acd..fd525aa428 100644
--- a/src/lib/libtls/tls.c
+++ b/src/lib/libtls/tls.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls.c,v 1.92 2021/10/21 14:31:21 tb Exp $ */
+/* $OpenBSD: tls.c,v 1.93 2022/01/25 21:51:24 eric Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -387,6 +387,8 @@ tls_keypair_to_pkey(struct tls *ctx, struct tls_keypair *keypair, EVP_PKEY **pke
 static int
 tls_keypair_setup_pkey(struct tls *ctx, struct tls_keypair *keypair, EVP_PKEY *pkey)
 {
+        RSA_METHOD *rsa_method;
+        ECDSA_METHOD *ecdsa_method;
         RSA *rsa = NULL;
         EC_KEY *eckey = NULL;
         int ret = -1;
@@ -407,6 +409,14 @@ tls_keypair_setup_pkey(struct tls *ctx, struct tls_keypair *keypair, EVP_PKEY *p
                         tls_set_errorx(ctx, "RSA key setup failure");
                         goto err;
                 }
+                if (ctx->config->sign_cb == NULL)
+                        break;
+                if ((rsa_method = tls_signer_rsa_method()) == NULL ||
+                    RSA_set_ex_data(rsa, 1, ctx->config) == 0 ||
+                    RSA_set_method(rsa, rsa_method) == 0) {
+                        tls_set_errorx(ctx, "failed to setup RSA key");
+                        goto err;
+                }
                 break;
         case EVP_PKEY_EC:
                 if ((eckey = EVP_PKEY_get1_EC_KEY(pkey)) == NULL ||
@@ -414,6 +424,14 @@ tls_keypair_setup_pkey(struct tls *ctx, struct tls_keypair *keypair, EVP_PKEY *p
                         tls_set_errorx(ctx, "EC key setup failure");
                         goto err;
                 }
+                if (ctx->config->sign_cb == NULL)
+                        break;
+                if ((ecdsa_method = tls_signer_ecdsa_method()) == NULL ||
+                    ECDSA_set_ex_data(eckey, 1, ctx->config) == 0 ||
+                    ECDSA_set_method(eckey, ecdsa_method) == 0) {
+                        tls_set_errorx(ctx, "failed to setup EC key");
+                        goto err;
+                }
                 break;
         default:
                 tls_set_errorx(ctx, "incorrect key type");
diff --git a/src/lib/libtls/tls.h b/src/lib/libtls/tls.h
index 20f55dcabd..22f04f4023 100644
--- a/src/lib/libtls/tls.h
+++ b/src/lib/libtls/tls.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls.h,v 1.58 2020/01/22 06:44:02 beck Exp $ */
+/* $OpenBSD: tls.h,v 1.59 2022/01/25 21:51:24 eric Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -79,6 +79,9 @@ typedef ssize_t (*tls_read_cb)(struct tls *_ctx, void *_buf, size_t _buflen,
     void *_cb_arg);
 typedef ssize_t (*tls_write_cb)(struct tls *_ctx, const void *_buf,
     size_t _buflen, void *_cb_arg);
+typedef int (*tls_sign_cb)(void *_cb_arg, const char *_hash,
+    const uint8_t *_dgst, size_t _dgstlen, uint8_t *_psig, size_t *_psiglen,
+    int _padding);
 
 int tls_init(void);
 
@@ -135,6 +138,8 @@ int tls_config_set_ocsp_staple_file(struct tls_config *_config,
 int tls_config_set_protocols(struct tls_config *_config, uint32_t _protocols);
 int tls_config_set_session_fd(struct tls_config *_config, int _session_fd);
 int tls_config_set_verify_depth(struct tls_config *_config, int _verify_depth);
+int tls_config_set_sign_cb(struct tls_config *_config, tls_sign_cb _cb,
+    void *_cb_arg);
 
 void tls_config_prefer_ciphers_client(struct tls_config *_config);
 void tls_config_prefer_ciphers_server(struct tls_config *_config);
@@ -212,6 +217,17 @@ time_t tls_peer_ocsp_revocation_time(struct tls *_ctx);
 time_t tls_peer_ocsp_this_update(struct tls *_ctx);
 const char *tls_peer_ocsp_url(struct tls *_ctx);
 
+struct tls_signer* tls_signer_new(void);
+void tls_signer_free(struct tls_signer * _signer);
+const char *tls_signer_error(struct tls_signer * _signer);
+int tls_signer_add_keypair_file(struct tls_signer *_signer,
+    const char *_cert_file, const char *_key_file);
+int tls_signer_add_keypair_mem(struct tls_signer *_signer, const uint8_t *_cert,
+    size_t _cert_len, const uint8_t *_key, size_t _key_len);
+int tls_signer_sign(struct tls_signer *_signer, const char *_hash,
+    const uint8_t *_dgst, size_t _dgstlen, uint8_t **_psig, size_t *_psiglen,
+    int _padding);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/src/lib/libtls/tls_config.c b/src/lib/libtls/tls_config.c
index 4ca497a032..15e218b4e0 100644
--- a/src/lib/libtls/tls_config.c
+++ b/src/lib/libtls/tls_config.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_config.c,v 1.64 2021/10/21 08:33:07 tb Exp $ */
+/* $OpenBSD: tls_config.c,v 1.65 2022/01/25 21:51:24 eric Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -738,6 +738,17 @@ tls_config_set_session_fd(struct tls_config *config, int session_fd)
 }
 
 int
+tls_config_set_sign_cb(struct tls_config *config, tls_sign_cb cb, void *cb_arg)
+{
+        config->use_fake_private_key = 1;
+        config->skip_private_key_check = 1;
+        config->sign_cb = cb;
+        config->sign_cb_arg = cb_arg;
+
+        return (0);
+}
+
+int
 tls_config_set_verify_depth(struct tls_config *config, int verify_depth)
 {
         config->verify_depth = verify_depth;
diff --git a/src/lib/libtls/tls_internal.h b/src/lib/libtls/tls_internal.h
index 5487b123ec..bc5044518b 100644
--- a/src/lib/libtls/tls_internal.h
+++ b/src/lib/libtls/tls_internal.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_internal.h,v 1.78 2021/01/21 19:09:10 eric Exp $ */
+/* $OpenBSD: tls_internal.h,v 1.79 2022/01/25 21:51:24 eric Exp $ */
 /*
  * Copyright (c) 2014 Jeremie Courreges-Anglas <jca@openbsd.org>
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
@@ -112,6 +112,8 @@ struct tls_config {
         int verify_time;
         int skip_private_key_check;
         int use_fake_private_key;
+        tls_sign_cb sign_cb;
+        void *sign_cb_arg;
 };
 
 struct tls_conninfo {
@@ -291,6 +293,9 @@ int tls_cert_pubkey_hash(X509 *_cert, char **_hash);
 
 int tls_password_cb(char *_buf, int _size, int _rwflag, void *_u);
 
+RSA_METHOD *tls_signer_rsa_method(void);
+ECDSA_METHOD *tls_signer_ecdsa_method(void);
+
 __END_HIDDEN_DECLS
 
 /* XXX this function is not fully hidden so relayd can use it */
diff --git a/src/lib/libtls/tls_signer.c b/src/lib/libtls/tls_signer.c
new file mode 100644
index 0000000000..690cb51615
--- /dev/null
+++ b/src/lib/libtls/tls_signer.c
@@ -0,0 +1,376 @@
+/* $OpenBSD: tls_signer.c,v 1.1 2022/01/25 21:51:24 eric Exp $ */
+/*
+ * Copyright (c) 2021 Eric Faurot <eric@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <openssl/err.h>
+
+#include "tls.h"
+#include "tls_internal.h"
+
+struct tls_signer_key {
+        char *hash;
+        RSA *rsa;
+        EC_KEY *ecdsa;
+        struct tls_signer_key *next;
+};
+
+struct tls_signer {
+        struct tls_error error;
+        struct tls_signer_key *keys;
+};
+
+static pthread_mutex_t signer_method_lock = PTHREAD_MUTEX_INITIALIZER;
+
+struct tls_signer *
+tls_signer_new(void)
+{
+        struct tls_signer *signer;
+
+        if ((signer = calloc(1, sizeof(*signer))) == NULL)
+                return (NULL);
+
+        return (signer);
+}
+
+void
+tls_signer_free(struct tls_signer *signer)
+{
+        struct tls_signer_key *skey;
+
+        if (signer == NULL)
+                return;
+
+        tls_error_clear(&signer->error);
+
+        while (signer->keys) {
+                skey = signer->keys;
+                signer->keys = skey->next;
+                RSA_free(skey->rsa);
+                EC_KEY_free(skey->ecdsa);
+                free(skey->hash);
+                free(skey);
+        }
+
+        free(signer);
+}
+
+const char *
+tls_signer_error(struct tls_signer *signer)
+{
+        return (signer->error.msg);
+}
+
+int
+tls_signer_add_keypair_mem(struct tls_signer *signer, const uint8_t *cert,
+    size_t cert_len, const uint8_t *key, size_t key_len)
+{
+        struct tls_signer_key *skey = NULL;
+        char *errstr = "unknown";
+        int ssl_err;
+        EVP_PKEY *pkey = NULL;
+        X509 *x509 = NULL;
+        BIO *bio = NULL;
+        char *hash = NULL;
+
+        /* Compute certificate hash */
+        if ((bio = BIO_new_mem_buf(cert, cert_len)) == NULL) {
+                tls_error_setx(&signer->error,
+                    "failed to create certificate bio");
+                goto err;
+        }
+        if ((x509 = PEM_read_bio_X509(bio, NULL, tls_password_cb,
+            NULL)) == NULL) {
+                if ((ssl_err = ERR_peek_error()) != 0)
+                        errstr = ERR_error_string(ssl_err, NULL);
+                tls_error_setx(&signer->error, "failed to load certificate: %s",
+                    errstr);
+                goto err;
+        }
+        if (tls_cert_pubkey_hash(x509, &hash) == -1) {
+                tls_error_setx(&signer->error,
+                    "failed to get certificate hash");
+                goto err;
+        }
+
+        X509_free(x509);
+        x509 = NULL;
+        BIO_free(bio);
+        bio = NULL;
+
+        /* Read private key */
+        if ((bio = BIO_new_mem_buf(key, key_len)) == NULL) {
+                tls_error_setx(&signer->error, "failed to create key bio");
+                goto err;
+        }
+        if ((pkey = PEM_read_bio_PrivateKey(bio, NULL, tls_password_cb,
+            NULL)) == NULL) {
+                tls_error_setx(&signer->error, "failed to read private key");
+                goto err;
+        }
+
+        if ((skey = calloc(1, sizeof(*skey))) == NULL) {
+                tls_error_set(&signer->error, "failed to create key entry");
+                goto err;
+        }
+        skey->hash = hash;
+        if ((skey->rsa = EVP_PKEY_get1_RSA(pkey)) == NULL &&
+            (skey->ecdsa = EVP_PKEY_get1_EC_KEY(pkey)) == NULL) {
+                tls_error_setx(&signer->error, "unknown key type");
+                goto err;
+        }
+
+        skey->next = signer->keys;
+        signer->keys = skey;
+        EVP_PKEY_free(pkey);
+        BIO_free(bio);
+
+        return (0);
+
+ err:
+        EVP_PKEY_free(pkey);
+        X509_free(x509);
+        BIO_free(bio);
+        free(hash);
+        free(skey);
+
+        return (-1);
+}
+
+int
+tls_signer_add_keypair_file(struct tls_signer *signer, const char *cert_file,
+    const char *key_file)
+{
+        char *cert = NULL, *key = NULL;
+        size_t cert_len, key_len;
+        int rv = -1;
+
+        if (tls_config_load_file(&signer->error, "certificate", cert_file,
+            &cert, &cert_len) == -1)
+                goto err;
+
+        if (tls_config_load_file(&signer->error, "key", key_file, &key,
+            &key_len) == -1)
+                goto err;
+
+        rv = tls_signer_add_keypair_mem(signer, cert, cert_len, key, key_len);
+
+ err:
+        free(cert);
+        free(key);
+
+        return (rv);
+}
+
+static int
+tls_sign_rsa(struct tls_signer *signer, struct tls_signer_key *skey,
+    const uint8_t *dgst, size_t dgstlen, uint8_t **psig, size_t *psiglen,
+    int padding)
+{
+
+        char *buf;
+        int siglen, r;
+
+        *psig = NULL;
+        *psiglen = 0;
+
+        siglen = RSA_size(skey->rsa);
+        if (siglen <= 0) {
+                tls_error_setx(&signer->error, "incorrect RSA_size: %d",
+                    siglen);
+                return (-1);
+        }
+
+        if ((buf = malloc(siglen)) == NULL) {
+                tls_error_set(&signer->error, "RSA sign");
+                return (-1);
+        }
+
+        r = RSA_private_encrypt((int)dgstlen, dgst, buf, skey->rsa, padding);
+        if (r == -1) {
+                tls_error_setx(&signer->error, "RSA_private_encrypt failed");
+                free(buf);
+                return (-1);
+        }
+
+        *psig = buf;
+        *psiglen = (size_t)r;
+
+        return (0);
+}
+
+static int
+tls_sign_ecdsa(struct tls_signer *signer, struct tls_signer_key *skey,
+    const uint8_t *dgst, size_t dgstlen, uint8_t **psig, size_t *psiglen)
+{
+        unsigned char *sig;
+        unsigned int siglen;
+
+        *psig = NULL;
+        *psiglen = 0;
+
+        siglen = ECDSA_size(skey->ecdsa);
+        if (siglen == 0) {
+                tls_error_setx(&signer->error, "incorrect ECDSA_size: %u",
+                    siglen);
+                return (-1);
+        }
+        if ((sig = malloc(siglen)) == NULL) {
+                tls_error_set(&signer->error, "ECDSA sign");
+                return (-1);
+        }
+
+        if (!ECDSA_sign(0, dgst, dgstlen, sig, &siglen, skey->ecdsa)) {
+                tls_error_setx(&signer->error, "ECDSA_sign failed");
+                free(sig);
+                return (-1);
+        }
+
+        *psig = sig;
+        *psiglen = siglen;
+
+        return (0);
+}
+
+int
+tls_signer_sign(struct tls_signer *signer, const char *hash,
+    const uint8_t *dgst, size_t dgstlen, uint8_t **psig, size_t *psiglen,
+    int padding)
+{
+        struct tls_signer_key *skey;
+
+        for (skey = signer->keys; skey; skey = skey->next)
+                if (!strcmp(hash, skey->hash))
+                        break;
+
+        if (skey == NULL) {
+                tls_error_setx(&signer->error, "key not found");
+                return (-1);
+        }
+
+        if (skey->rsa != NULL)
+                return tls_sign_rsa(signer, skey, dgst, dgstlen, psig, psiglen,
+                    padding);
+
+        if (skey->ecdsa != NULL)
+                return tls_sign_ecdsa(signer, skey, dgst, dgstlen, psig, psiglen);
+
+        tls_error_setx(&signer->error, "unknown key type");
+        return (-1);
+}
+
+static int
+tls_rsa_priv_enc(int srclen, const unsigned char *src, unsigned char *to,
+    RSA *rsa, int padding)
+{
+        struct tls_config *config;
+        const char *hash;
+        size_t tolen;
+
+        hash = RSA_get_ex_data(rsa, 0);
+        config = RSA_get_ex_data(rsa, 1);
+
+        if (hash == NULL || config == NULL)
+                return (-1);
+
+        if (config->sign_cb(config->sign_cb_arg, hash, (const uint8_t *)src,
+            srclen, (uint8_t *)to, &tolen, padding) == -1)
+                return (-1);
+
+        if (tolen > INT_MAX)
+                return (-1);
+
+        return ((int)tolen);
+}
+
+RSA_METHOD *
+tls_signer_rsa_method(void)
+{
+        static RSA_METHOD *rsa_method = NULL;
+
+        pthread_mutex_lock(&signer_method_lock);
+
+        if (rsa_method != NULL)
+                goto out;
+
+        rsa_method = RSA_meth_new("libtls RSA method", 0);
+        if (rsa_method == NULL)
+                goto out;
+
+        RSA_meth_set_priv_enc(rsa_method, tls_rsa_priv_enc);
+
+ out:
+        pthread_mutex_unlock(&signer_method_lock);
+
+        return (rsa_method);
+}
+
+static ECDSA_SIG *
+tls_ecdsa_do_sign(const unsigned char *dgst, int dgst_len, const BIGNUM *inv,
+    const BIGNUM *rp, EC_KEY *eckey)
+{
+        struct tls_config *config;
+        ECDSA_SIG *sig = NULL;
+        const unsigned char *tsigbuf;
+        const char *hash;
+        char *sigbuf;
+        size_t siglen;
+
+        hash = ECDSA_get_ex_data(eckey, 0);
+        config = ECDSA_get_ex_data(eckey, 1);
+
+        if (hash == NULL || config == NULL)
+                return (NULL);
+
+        siglen = ECDSA_size(eckey);
+        if ((sigbuf = malloc(siglen)) == NULL)
+                return (NULL);
+
+        if (config->sign_cb(config->sign_cb_arg, hash, dgst, dgst_len, sigbuf,
+            &siglen, 0) != -1) {
+                tsigbuf = sigbuf;
+                sig = d2i_ECDSA_SIG(NULL, &tsigbuf, siglen);
+        }
+        free(sigbuf);
+
+        return (sig);
+}
+
+ECDSA_METHOD *
+tls_signer_ecdsa_method(void)
+{
+        static ECDSA_METHOD *ecdsa_method = NULL;
+
+        pthread_mutex_lock(&signer_method_lock);
+
+        if (ecdsa_method != NULL)
+                goto out;
+
+        ecdsa_method = calloc(1, sizeof(*ecdsa_method));
+        if (ecdsa_method == NULL)
+                goto out;
+
+        ecdsa_method->ecdsa_do_sign = tls_ecdsa_do_sign;
+        ecdsa_method->name = strdup("libtls ECDSA method");
+        if (ecdsa_method->name == NULL) {
+                free(ecdsa_method);
+                ecdsa_method = NULL;
+        }
+
+ out:
+        pthread_mutex_unlock(&signer_method_lock);
+
+        return (ecdsa_method);
+}