3 ### Common key management functions.
5 ### (c) 2011 Mark Wooding
8 ###----- Licensing notice ---------------------------------------------------
10 ### This file is part of the distorted.org.uk key management suite.
12 ### distorted-keys is free software; you can redistribute it and/or modify
13 ### it under the terms of the GNU General Public License as published by
14 ### the Free Software Foundation; either version 2 of the License, or
15 ### (at your option) any later version.
17 ### distorted-keys is distributed in the hope that it will be useful,
18 ### but WITHOUT ANY WARRANTY; without even the implied warranty of
19 ### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 ### GNU General Public License for more details.
22 ### You should have received a copy of the GNU General Public License
23 ### along with distorted-keys; if not, write to the Free Software Foundation,
24 ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
28 ###--------------------------------------------------------------------------
29 ### Configuration variables.
31 ## Automatically configured pathnames.
32 PACKAGE
="@PACKAGE@" VERSION
="@VERSION@"
35 ## Read user configuration.
36 if [ -f
$ETC/keys.conf
]; then .
$ETC/keys.conf
; fi
38 ## Maybe turn on debugging.
39 case "${KEYS_DEBUG+t}" in t
) set -x
;; esac
41 ## Fake up caller credentials if not called via userv.
42 case "${USERV_USER+t}" in
44 *) USERV_USER
=${LOGNAME-${USER-$(id -un)}} USERV_UID
=$
(id
-u
) ;;
46 case "${USERV_GROUP+t}" in
48 *) USERV_GROUP
=$
(id
-Gn
) USERV_GID
=$
(id
-gn
) ;;
51 ###--------------------------------------------------------------------------
55 cleanup
() { cleanups
=${cleanups+$cleanups }$1; }
56 runcleanups
() { for i
in $cleanups; do $i; done; }
57 trap 'rc=$?; runcleanups; exit $rc' EXIT
58 trap 'trap "" EXIT; runcleanups; exit 127' INT TERM
60 ###--------------------------------------------------------------------------
61 ### Utility functions.
64 ## Fail unless a safe directory is set.
66 err
="$quis: (CONFIGURATION ERROR)"
69 *) echo >&2 "$err: no SAFE directory"; exit 1 ;;
71 if [ ! -d
"$SAFE" ]; then
72 echo >&2 "$err: SAFE path \`$SAFE' isn't a directory"
76 [!/]* |
*[][[:space
:]*?
]*)
77 echo >&2 "$err: SAFE path \`$SAFE' contains bad characters"
83 read perm _ user stuff
87 echo >&2 "$err: SAFE path \`$SAFE' has bad owner or permissions"
94 ## Temporary directory.
96 rmtmp
() { case ${tmp+t} in t
) cd /; rm -rf
$tmp ;; esac; }
99 ## Make a temporary directory and store its name in `tmp'.
101 case "${tmp+t}" in t
) return ;; esac
103 tmp
="$SAFE/keys.tmp.$$"
109 ## Fail unless a temporary directory is set.
113 *) echo >&2 "$quis (INTERNAL): no tmp directory set"; exit 127 ;;
119 ## Parse the key label string KEY. Set `kdir' to the base path to use for
120 ## the key's storage, and `kowner' to the key owner's name.
123 *:*) kowner
=${key%%:*} klabel
=${key#*:} ;;
124 *) kowner
=$USERV_USER klabel
=$key ;;
126 checkword
"key owner name" "$kowner"
127 checklabel
"key" "$klabel"
128 kdir
=$KEYS/store
/$kowner/$klabel
129 knub
=$KEYS/nub
/$kowner/$klabel
133 user
=$1 service
=$2; shift 2
134 ## If the current (effective) user is not USER then reinvoke via `userv',
135 ## as the specified service, with the remaining arguments.
139 *) exec userv
"$user" "$service" "$@" ;;
143 ###--------------------------------------------------------------------------
144 ### Input validation functions.
149 ckwhat
=$1 ckpat
=$2 thing
=$3
150 ## Verify that THING matches the (anchored, basic) regular expression
151 ## CKPAT. Since matching newlines is hard to do portably, also check that
152 ## THING doesn't contain any. If the checks fail, report an error and
161 if ! expr >/dev
/null
"Q$thing" : "\(Q$ckpat\)\$"; then
167 nil
) echo >&2 "$quis: bad $ckwhat \`$thing'"; exit 1 ;;
171 ## Regular expressions for validating input.
172 R_IDENTCHARS
="A-Za-z0-9_"
174 R_WORDCHARS
="-$R_IDENTCHARS$R_GOODPUNCT"
175 R_IDENT
="[$R_IDENTCHARS][$R_IDENTCHARS]*"
176 R_WORD
="[$R_WORDCHARS][$R_WORDCHARS]*"
177 R_ACLCHARS
="][$R_IDENTCHARS$R_GOODPUNCT*?:.#"
178 R_WORDSEQ
="[$R_WORDCHARS[:space:]][$R_WORDCHARS[:space:]]*"
179 R_ACL
="[$R_ACLCHARS[:space:]-][$R_ACLCHARS[:space:]-]*"
180 R_NUMERIC
='\(\([1-9][0-9]*\)\{0,1\}0\{0,1\}\)'
181 R_LABEL
="\($R_WORD\(/$R_WORD\)*\)"
184 ## Various validation functions.
185 checknumber
() { check
"$1" "$R_NUMERIC" "$2"; }
186 checkident
() { check
"$1" "$R_IDENT" "$2"; }
187 checkword
() { check
"$1" "$R_WORD" "$2"; }
188 checklabel
() { check
"$1 label" "$R_LABEL" "$2"; }
190 ###--------------------------------------------------------------------------
191 ### Key storage and properties.
195 ## Write the named system PROFILE to standard output.
197 $bindir/extract-profile
"$profile" $ETC/profile.d
/
201 what
=$1 prefix
=$2; shift 2
202 ## Set variables based on the NAME=VALUE assignments in the arguments. The
203 ## value for property NAME is stored in the shell variable PREFIX_NAME.
208 *\
=*) name
=${assg%%=*} value
=${assg#*=} ;;
211 case "$goodp,$name" in t
,*[!0-9A-Za-z_
]*=*) goodp
=nil
;; esac
213 nil
) echo >&2 "$quis: bad $what assignment \`$assg'"; exit 1 ;;
215 eval "$prefix$name=\$value"
220 whatprop
=$1 prefix
=$2; shift 2
221 ## Check that property variables are set in accordance with the remaining
222 ## TABLE arguments. Each row of TABLE has the form
226 ## A table row is satisfied if there is a variable PREFIXNAME whose value
227 ## matces the (basic) regular expression PAT, or if the variable is unset
230 for table
in "$@"; do
231 case "$table" in ?
*) ;; *) continue ;; esac
232 while read -r name omit pat
; do
233 eval foundp
=\
${$prefix$name+t}
234 case "$foundp,$omit" in
237 echo >&2 "$quis: missing $whatprop \`$name' required"
241 eval value
=\$
$prefix$name
242 check
"value for $whatprop \`$name'" "$pat" "$value"
251 ## Write the properties stored in the variables beginning with PREFIX.
253 set |
sed -n
"/^$prefix/{s/=.*\$//;p}" |
sort |
while read name
; do
255 echo "${name#$prefix}=$value"
261 ## Define a properties table NAME.
267 defprops g_props
<<EOF
269 recovery t $R_WORDSEQ
273 nub_random_bytes t $R_NUMERIC
283 ## Read a profile from a file. This doesn't check the form of the
284 ## filename, so it's not suitable for unchecked input. Properties are set
285 ## using `setprops' with prefix `kprop_'.
287 ## Parse the settings from the file.
290 case "$line" in "" | \
#*) continue ;; esac
291 setprops
"property" kprop_
"$line"
294 checkprops
"property" kprop_
"$g_props"
296 ## Fetch the key-type handling library.
297 if [ ! -f
$KEYSLIB/ktype.
$kprop_type ]; then
298 echo >&2 "$quis: unknown key type \`$kprop_type'"
301 .
$KEYSLIB/ktype.
$kprop_type
302 checkprops
"property" kprop_
"$k_props"
307 ## Read key metadata from KDIR.
309 { read profile
; } <"$kdir"/meta
313 ## Generate a key nub in the default way, and write it to standard output.
314 ## The properties `random', `nub_random_bytes' and `nub_hash' are referred
318 if=/dev
/${kprop_random-random} bs
=1 count
=${kprop_nub_random_bytes-64} |
319 openssl dgst
-${kprop_nub_hash-sha256} -binary |
324 ## Compute a hash of the key nub in stdin, and write it to stdout in hex.
325 ## The property `nubid_hash' is used.
327 ## Stupid dance because the output incompatibly grew a filename, in order
328 ## to demonstrate the same idiocy as GNU mumblesum.
329 set _ $
({ echo "distorted-keys nubid"; cat -; } |
330 openssl dgst
-${kprop_nubid_hash-sha256})
331 if [ $# -gt
2 ]; then shift; fi
336 what
=$1 templ
=$2 prefix
=$3 pat
=$4
337 ## Substitute option values into the template TEMPL. Each occurrence of
338 ## %{VAR} is replaced by the value of the variable PREFIXVAR. Finally, an
339 ## error is reported unless the final value matches the regular expression
346 ## If there are no more markers to substitute, then finish.
347 case "$rest" in *"%{"*"}"*) ;; *) out
=$out$rest; break ;; esac
349 ## Split the template into three parts.
350 left
=${rest%%\%\{*} right
=${rest#*\%\{}
351 var
=${right%%\}*} rest
=${right#*\}}
353 *-*) default
=${var#*-} var
=${var%%-*} defaultp
=t
;;
357 ## Find the variable value.
358 checkident
"template variable name" "$var"
359 eval foundp
=\
${$prefix$var+t}
360 case $foundp,$defaultp in
361 t
,*) eval value
=\$
$prefix$var ;;
362 ,t
) value
=$default ;;
364 echo >&2 "$quis: option \`$var' unset, used in template \`$templ'"
369 ## Do the substitution.
373 ## Check the final result.
374 check
"$what" "$pat" "$out"
382 ## Read property settings from a profile. The PROFILE name has the form
383 ## [USER:]LABEL; USER defaults to OWNER. Properties are set using
384 ## `setprops' with prefix `kprop_'.
389 label
=${profile#:} uservp
=nil
392 user
=$kowner label
=$profile uservp
=t
395 user
=${profile%%:*} label
=${profile#*:} uservp
=t
398 checkword
"profile label" "$label"
400 ## Fetch the profile settings from the user.
404 checkword
"profile user" "$user"
405 userv
"$user" cryptop-profile
"$label" >$tmp/profile
</dev
/null
408 $bindir/extract-profile
"$label" $ETC/profile.d
/ >$tmp/profile
413 readprops
$tmp/profile
416 ###--------------------------------------------------------------------------
417 ### General crypto operations.
420 profile
=$1 kdir
=$2 knub
=$3 hook
=$4; shift 4
421 ## Generate a key, and associate it with the named PROFILE (which is
422 ## assumed already to have been read!); store the main data in KDIR, and
423 ## the nub separately in the file KNUB; run HOOK after generation, passing
424 ## it the working key directory and nub file. Remaining arguments are
425 ## options to the key type.
427 ## Set options and check them.
428 kopt_owner
=$kowner kopt_label
=$klabel
429 setprops
"option" kopt_
"$@"
430 checkprops
"option" kopt_
"$k_genopts"
432 ## Create directory structure and start writing metadata.
434 mkdir
-m755
-p
"$kdir.new"
435 case "$knub" in */*) mkdir
-m755
-p
"${knub%/*}" ;; esac
436 cat >"$kdir.new/meta" <<EOF
441 (umask 077; makenub
>"$knub.new")
442 k_generate
"$kdir.new" "$knub.new"
443 $hook "$kdir.new" "$knub.new"
446 nubid
<"$knub.new" >"$kdir.new/nubid"
448 ## Juggle everything into place. Doing this atomically is very difficult,
449 ## and requires more machinery than I can really justify here. If
450 ## something goes wrong halfway, it should always be possible to fix it,
451 ## either by backing out (if $kdir.new still exists) or pressing on
452 ## forwards (if not).
454 if [ -e
"$kdir" ]; then mv "$kdir" "$kdir.old"; fi
455 mv "$kdir.new" "$kdir"
456 mv "$knub.new" "$knub"
460 c_encrypt
() { k_encrypt
"$@"; }
462 if k_decrypt
"$@" >$tmp/plain
; then cat $tmp/plain
466 c_sign
() { k_sign
"$@"; }
467 c_verify
() { k_verify
"$@"; }
469 ## Stub implementations.
470 notsupp
() { op
=$1; echo >&2 "$quis: operation \`$op' not supported"; }
473 k_encrypt
() { notsupp encrypt
; }
474 k_decrypt
() { notsupp decrypt
; }
475 k_sign
() { notsupp sign
; }
476 k_verify
() { notsupp verify
; }
480 ## Prepare for a crypto operation OP, using the KEY. This validates the
481 ## key label, reads the profile, and checks the access-control list. If OP
482 ## is `-' then allow the operation unconditionally.
484 ## Find the key properties.
485 parse_keylabel
"$key"
486 if [ ! -d
$kdir ]; then echo >&2 "$quis: unknown key \`$key'"; exit 1; fi
488 read_profile
$kowner "$profile"
490 ## Check whether we're allowed to do this thing. This is annoyingly
492 case $op in -) return ;; esac
493 eval acl
=\
${kprop_acl_$op-!owner}
497 ## Remove leading whitespace.
500 [[:space
:]]*) acl
=${acl#?} ;;
505 ## If there's nothing left, leave.
506 case "$acl" in ?
*) ;; *) break ;; esac
508 ## Split off the leading word.
510 *[[:space
:]]*) word
=${acl%%[[:space:]]*} acl
=${acl#*[[:space:]]} ;;
511 *) word
=$acl acl
="" ;;
514 ## See what sense it has if it matches.
516 -*) sense
=forbid rest
=${word#-} ;;
517 *) sense
=allow rest
=$word ;;
520 ## See whether the calling user matches.
522 !owner
) pat
=$kowner list
=$USERV_USER ;;
523 !*) echo >&2 "$quis: unknown ACL token \`$word'" ;;
524 %*) pat
=${rest#%} list
="$USERV_GROUP $USERV_GID" ;;
525 *) pat
=$rest list
="$USERV_USER $USERV_UID" ;;
528 for i
in $list; do case "$i" in $pat) matchp
=t
; break ;; esac; done
529 case $matchp in t
) verdict
=$sense; break ;; esac
533 forbid
) echo >&2 "$quis: $op access to key \`$key' forbidden"; exit 1 ;;
537 ###--------------------------------------------------------------------------
538 ### Crypto operations for infrastructure purposes.
542 ## Select the profile in FILE for future crypto operations.
544 unset $
(set |
sed -n
'/^kprop_/s/=.*$//p')
546 getsysprofile
"$profile" >$tmp/profile
547 readprops
$tmp/profile
551 profile
=$1 kdir
=$2 knub
=$3; shift 3
552 ## Generate a system key using PROFILE; store the data in KDIR and the nub
553 ## in KNUB. Remaining arguments are options.
555 c_sysprofile
"$profile"
556 c_genkey
"$profile" "$kdir" "$knub" : "$@"
562 c_sysprofile
"$profile"
566 op
=$1 kdir
=$2; shift 1
571 c_sysencrypt
() { c_sysop encrypt
"$1" /dev
/null
; }
572 c_sysdecrypt
() { c_sysop decrypt
"$1" "$2"; }
573 c_syssign
() { c_sysop sign
"$1" "$2"; }
574 c_sysverify
() { c_sysop verify
"$1" /dev
/null
; }
576 ###--------------------------------------------------------------------------
577 ### Recovery operations.
581 ## Return the sharing threshold from the parameter file PARAM.
587 echo >&2 "$quis: secret sharing parameter file damaged (wrong header)"
595 echo >&2 "$quis: secret sharing parameter file damaged (missing t)"
606 ## Stash a copy of stdin encrypted under the recovery key RECOV, with a
608 checkword
"recovery key label" "$recov"
609 checklabel
"secret" "$label"
611 rdir
=$KEYS/recov
/$recov/current
612 if [ ! -d
$rdir/store
]; then
613 echo >&2 "$quis: unknown recovery key \`$recov'"
616 case $label in */*) mkdir
-m755
-p
$rdir/${label%/*} ;; esac
617 (c_sysencrypt
$rdir/store
>$rdir/$label.new
)
618 mv $rdir/$label.new
$rdir/$label.recov
622 recov
=$1 inst
=$2 label
=$3
623 ## Recover a stashed secret, protected by RECOV and stored as LABEL, and
624 ## write it to stdout.
625 checkword
"recovery key label" "$recov"
626 checkword
"recovery instance" "$inst"
627 checklabel
"secret" "$label"
629 rdir
=$KEYS/recov
/$recov/$inst
630 if [ ! -f
$rdir/$label.recov
]; then
631 echo >&2 "$quis: recovery key \`$recov/$inst' has no blob for \`$label'"
636 nub
=$SAFE/keys.reveal
/$tag/nub
637 if [ ! -f
$nub ]; then
638 echo >&2 "$quis: recovery key \`$recov/$inst' not revealed"
642 c_sysdecrypt
$rdir/store
$nub <$rdir/$label.recov
645 ###--------------------------------------------------------------------------
652 case "$KEYS_HELP" in t
) help; exit ;; esac
655 help () { showhelp
; }
658 Usage: $quis${usage:+ $usage}
666 echo "usage: $quis${cmdname:+ $cmdname}${cmdargs:+ $cmdargs}"
668 usage_err
() { usage
>&2; exit 1; }
670 ###--------------------------------------------------------------------------
671 ### Subcommand handling.
674 echo "$quis, $PACKAGE version $VERSION"
681 cmd
=$1; shift; args
=$
*
683 eval help_
$cmd=\
$help
688 defcmd
help "[COMMAND ...]" <<EOF
689 Show help about the COMMANDs, or about $quis if none are named.
698 Usage: $quis${usage:+ $usage}
701 -h Show this help text.
702 -v Show the program version number.
706 while read cmd args
; do echo " $cmd${args:+ $args}"; done <<EOF
712 for i
in $prefix.
*; do
713 if [ ! -x
"$i" ]; then continue; fi
714 sed -n
"/<<HELP/{n;s/^/ ${i#$prefix.} /;p;q;}" "$i"
723 while read cmdname cmdargs
; do
724 case $cmdname in "$cmd") foundp
=t
; break ;; esac
731 eval help=\
$help_$cmdname; echo "$help"
734 if [ ! -x
"$KEYSLIB/$prefix.$cmd" ]; then
735 echo >&2 "$quis: unrecognized command \`$cmd'"
738 elif ! KEYS_HELP
=t
"$KEYSLIB/$prefix.$cmd"; then
750 case $# in 0) usage_err
;; esac
753 while read cmdname cmdargs
; do
754 case $cmdname in "$cmd") foundp
=t
; break ;; esac
764 if [ ! -x
"$KEYSLIB/$prefix.$cmd" ]; then
765 echo >&2 "$quis: unrecognized command \`$cmd'"
769 exec "$KEYSLIB/$prefix.$cmd" "$@"
774 ###----- That's all, folks --------------------------------------------------