shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-09 18:04:25 +09:00
Code Issues Packages Projects Releases Wiki Activity

pki: Add workarounds for old OpenSSH

Browse Source 
When we are talking to old OpenSSH versions which does not support
rsa-sha2-{256,512}-cert-v01@openssh.com or SHA2 in certificates,
fallback to old supported values.

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit 4b7ce75e1f)
This commit is contained in:
Anderson Toshiyuki Sasaki
2019-06-25 19:47:36 +02:00
committed by Andreas Schneider
parent 1f7889f271
commit e8510043d2
1 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
src/pki.c
View File

@@ -388,6 +388,19 @@ enum ssh_digest_e ssh_key_type_to_hash(ssh_session session,
case SSH_KEYTYPE_DSS: case SSH_KEYTYPE_DSS:
return SSH_DIGEST_SHA1; return SSH_DIGEST_SHA1;
case SSH_KEYTYPE_RSA_CERT01: case SSH_KEYTYPE_RSA_CERT01:
/* If we are talking to an old OpenSSH version which does not support
* SHA2 in certificates */
if ((session->openssh > 0) &&
(session->openssh < SSH_VERSION_INT(7, 2, 0)))
{
SSH_LOG(SSH_LOG_DEBUG,
"We are talking to an old OpenSSH (%x); "
"returning SSH_DIGEST_SHA1",
session->openssh);
return SSH_DIGEST_SHA1;
}
FALL_THROUGH;
case SSH_KEYTYPE_RSA: case SSH_KEYTYPE_RSA:
if (ssh_key_algorithm_allowed(session, "rsa-sha2-512") && if (ssh_key_algorithm_allowed(session, "rsa-sha2-512") &&
(session->extensions & SSH_EXT_SIG_RSA_SHA512)) { (session->extensions & SSH_EXT_SIG_RSA_SHA512)) {
@@ -441,6 +454,21 @@ ssh_key_get_signature_algorithm(ssh_session session,
{ {
enum ssh_digest_e hash_type; enum ssh_digest_e hash_type;
if (type == SSH_KEYTYPE_RSA_CERT01) {
/* If we are talking to an old OpenSSH version which does not support
* rsa-sha2-{256,512}-cert-v01@openssh.com */
if ((session->openssh > 0) &&
(session->openssh < SSH_VERSION_INT(7, 8, 0)))
{
SSH_LOG(SSH_LOG_DEBUG,
"We are talking to an old OpenSSH (%x); "
"using old cert format",
session->openssh);
return "ssh-rsa-cert-v01@openssh.com";
}
}
hash_type = ssh_key_type_to_hash(session, type); hash_type = ssh_key_type_to_hash(session, type);
return ssh_key_signature_to_char(type, hash_type); return ssh_key_signature_to_char(type, hash_type);