shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-09 18:04:25 +09:00
Code Issues Packages Projects Releases Wiki Activity

Add more error checks to ssh_do_sign().

Browse Source 
git-svn-id: svn+ssh://svn.berlios.de/svnroot/repos/libssh/trunk@534 7dcaeef0-15fb-0310-b436-a5af3365683c
This commit is contained in:
Andreas Schneider
2009-04-18 08:31:26 +00:00
parent e4c521d896
commit b9e91ce95a
1 changed files with 89 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files

155
libssh/keys.c
View File

@@ -964,83 +964,106 @@ STRING *ssh_do_sign_with_agent(struct ssh_session *session,
} }
#endif /* _WIN32 */ #endif /* _WIN32 */
/* this function signs the session id (known as H) as a string then the content of sigbuf */ /*
STRING *ssh_do_sign(SSH_SESSION *session,BUFFER *sigbuf, PRIVATE_KEY *privatekey){ * This function signs the session id (known as H) as a string then
SHACTX ctx; * the content of sigbuf */
STRING *session_str; STRING *ssh_do_sign(SSH_SESSION *session, BUFFER *sigbuf,
unsigned char hash[SHA_DIGEST_LEN+1]; PRIVATE_KEY *privatekey) {
CRYPTO *crypto = session->current_crypto ? session->current_crypto :
session->next_crypto;
unsigned char hash[SHA_DIGEST_LEN + 1] = {0};
STRING *session_str = NULL;
STRING *signature = NULL;
SIGNATURE *sign = NULL;
SHACTX ctx = NULL;
#ifdef HAVE_LIBGCRYPT #ifdef HAVE_LIBGCRYPT
gcry_sexp_t gcryhash; gcry_sexp_t gcryhash;
#endif #endif
SIGNATURE *sign;
STRING *signature;
CRYPTO *crypto = session->current_crypto?session->current_crypto:session->next_crypto;
session_str = string_new(SHA_DIGEST_LEN); session_str = string_new(SHA_DIGEST_LEN);
if (session_str == NULL) { if (session_str == NULL) {
return NULL; return NULL;
} }
string_fill(session_str,crypto->session_id,SHA_DIGEST_LEN); string_fill(session_str, crypto->session_id, SHA_DIGEST_LEN);
ctx = sha1_init();
if (ctx == NULL) { ctx = sha1_init();
SAFE_FREE(session_str); if (ctx == NULL) {
return NULL; string_free(session_str);
} return NULL;
sha1_update(ctx,session_str,string_len(session_str)+4); }
SAFE_FREE(session_str);
sha1_update(ctx,buffer_get(sigbuf),buffer_get_len(sigbuf)); sha1_update(ctx, session_str, string_len(session_str) + 4);
sha1_final(hash+1,ctx); string_free(session_str);
hash[0]=0; sha1_update(ctx, buffer_get(sigbuf), buffer_get_len(sigbuf));
sha1_final(hash + 1,ctx);
hash[0] = 0;
#ifdef DEBUG_CRYPTO #ifdef DEBUG_CRYPTO
ssh_print_hexa("Hash being signed with dsa",hash+1,SHA_DIGEST_LEN); ssh_print_hexa("Hash being signed with dsa", hash + 1, SHA_DIGEST_LEN);
#endif #endif
sign = malloc(sizeof(SIGNATURE)); sign = malloc(sizeof(SIGNATURE));
if (sign == NULL) { if (sign == NULL) {
return NULL; return NULL;
} }
switch(privatekey->type){ switch(privatekey->type) {
case TYPE_DSS: case TYPE_DSS:
#ifdef HAVE_LIBGCRYPT #ifdef HAVE_LIBGCRYPT
gcry_sexp_build(&gcryhash,NULL,"%b",SHA_DIGEST_LEN+1,hash); if (gcry_sexp_build(&gcryhash, NULL, "%b", SHA_DIGEST_LEN + 1, hash) ||
gcry_pk_sign(&sign->dsa_sign,gcryhash,privatekey->dsa_priv); gcry_pk_sign(&sign->dsa_sign, gcryhash, privatekey->dsa_priv)) {
#elif defined HAVE_LIBCRYPTO ssh_set_error(session, SSH_FATAL, "Signing: libcrypt error");
sign->dsa_sign=DSA_do_sign(hash+1,SHA_DIGEST_LEN,privatekey->dsa_priv); gcry_sexp_release(gcryhash);
#ifdef DEBUG_CRYPTO
ssh_print_bignum("r",sign->dsa_sign->r);
ssh_print_bignum("s",sign->dsa_sign->s);
#endif
#endif
sign->rsa_sign=NULL;
break;
case TYPE_RSA:
#ifdef HAVE_LIBGCRYPT
gcry_sexp_build(&gcryhash,NULL,"(data(flags pkcs1)(hash sha1 %b))",SHA_DIGEST_LEN,hash+1);
gcry_pk_sign(&sign->rsa_sign,gcryhash,privatekey->rsa_priv);
#elif defined HAVE_LIBCRYPTO
sign->rsa_sign=RSA_do_sign(hash+1,SHA_DIGEST_LEN,privatekey->rsa_priv);
#endif
sign->dsa_sign=NULL;
break;
}
#ifdef HAVE_LIBGCRYPT
gcry_sexp_release(gcryhash);
#endif
sign->type=privatekey->type;
if(!sign->dsa_sign && !sign->rsa_sign){
#ifdef HAVE_LIBGCRYPT
ssh_set_error(session,SSH_FATAL,"Signing : libcrypt error");
#elif HAVE_LIBCRYPTO
ssh_set_error(session,SSH_FATAL,"Signing : openssl error");
#endif
signature_free(sign); signature_free(sign);
return NULL; return NULL;
} }
signature=signature_to_string(sign); #elif defined HAVE_LIBCRYPTO
signature_free(sign); sign->dsa_sign = DSA_do_sign(hash + 1, SHA_DIGEST_LEN,
return signature; privatekey->dsa_priv);
if (sign->dsa_sign == NULL) {
ssh_set_error(session, SSH_FATAL, "Signing: openssl error");
signature_free(sign);
return NULL;
}
#ifdef DEBUG_CRYPTO
ssh_print_bignum("r", sign->dsa_sign->r);
ssh_print_bignum("s", sign->dsa_sign->s);
#endif
#endif /* HAVE_LIBCRYPTO */
sign->rsa_sign = NULL;
break;
case TYPE_RSA:
#ifdef HAVE_LIBGCRYPT
if (gcry_sexp_build(&gcryhash, NULL, "(data(flags pkcs1)(hash sha1 %b))",
SHA_DIGEST_LEN, hash + 1) ||
gcry_pk_sign(&sign->rsa_sign, gcryhash, privatekey->rsa_priv)) {
ssh_set_error(session, SSH_FATAL, "Signing: libcrypt error");
gcry_sexp_release(gcryhash);
signature_free(sign);
return NULL;
}
#elif defined HAVE_LIBCRYPTO
sign->rsa_sign = RSA_do_sign(hash + 1, SHA_DIGEST_LEN,
privatekey->rsa_priv);
if (sign->rsa_sign == NULL) {
ssh_set_error(session, SSH_FATAL, "Signing: openssl error");
signature_free(sign);
return NULL;
}
#endif
sign->dsa_sign = NULL;
break;
}
#ifdef HAVE_LIBGCRYPT
gcry_sexp_release(gcryhash);
#endif
sign->type = privatekey->type;
signature = signature_to_string(sign);
signature_free(sign);
return signature;
} }
STRING *ssh_encrypt_rsa1(SSH_SESSION *session, STRING *data, PUBLIC_KEY *key){ STRING *ssh_encrypt_rsa1(SSH_SESSION *session, STRING *data, PUBLIC_KEY *key){