shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-09 18:04:25 +09:00
Code Issues Packages Projects Releases Wiki Activity

pki: allow certificates to be used in signature verification

Browse Source 
A number of places checked that the signature type matched the key type. We
losen these checks to, for example, allow an RSA signature with an RSA-cert
key.

Signed-off-by: Ben Toews <mastahyeti@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
This commit is contained in:
Ben Toews
2019-02-13 13:00:53 -07:00
committed by Andreas Schneider
parent 7c0719e53d
commit 2f26b5d63c
5 changed files with 55 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/pki_crypto.c
View File

@@ -1625,7 +1625,7 @@ ssh_signature pki_signature_from_blob(const ssh_key pubkey,
int rc;
BIGNUM *pr = NULL, *ps = NULL;
if (type != pubkey->type) {
if (ssh_key_type_plain(pubkey->type) != type) {
SSH_LOG(SSH_LOG_WARN,
"Incompatible public key provided (%d) expecting (%d)",
type,
@@ -1833,7 +1833,7 @@ int pki_signature_verify(ssh_session session,
int rc;
int nid;
if (key->type != sig->type) {
if (ssh_key_type_plain(key->type) != sig->type) {
SSH_LOG(SSH_LOG_WARN,
"Can not verify %s signature with %s key",
sig->type_c,
@@ -1843,6 +1843,7 @@ int pki_signature_verify(ssh_session session,
switch (key->type) {
case SSH_KEYTYPE_DSS:
case SSH_KEYTYPE_DSS_CERT01:
rc = DSA_do_verify(hash,
hlen,
sig->dsa_sig,
@@ -1857,6 +1858,7 @@ int pki_signature_verify(ssh_session session,
break;
case SSH_KEYTYPE_RSA:
case SSH_KEYTYPE_RSA1:
case SSH_KEYTYPE_RSA_CERT01:
switch (sig->hash_type) {
case SSH_DIGEST_AUTO:
case SSH_DIGEST_SHA1:
@@ -1892,6 +1894,7 @@ int pki_signature_verify(ssh_session session,
}
break;
case SSH_KEYTYPE_ED25519:
case SSH_KEYTYPE_ED25519_CERT01:
rc = pki_ed25519_verify(key, sig, hash, hlen);
if (rc != SSH_OK){
ssh_set_error(session,
@@ -1903,6 +1906,9 @@ int pki_signature_verify(ssh_session session,
case SSH_KEYTYPE_ECDSA_P256:
case SSH_KEYTYPE_ECDSA_P384:
case SSH_KEYTYPE_ECDSA_P521:
case SSH_KEYTYPE_ECDSA_P256_CERT01:
case SSH_KEYTYPE_ECDSA_P384_CERT01:
case SSH_KEYTYPE_ECDSA_P521_CERT01:
#ifdef HAVE_OPENSSL_ECC
rc = ECDSA_do_verify(hash,
hlen,