diff options
| author | Ben Toews <mastahyeti@gmail.com> | 2019-02-13 13:00:53 -0700 |
|---|---|---|
| committer | Andreas Schneider <asn@cryptomilk.org> | 2019-04-17 10:21:42 +0200 |
| commit | 2f26b5d63cde0da954e237aff176701d51760ea1 (patch) | |
| tree | cdacbc257622d275a6958bbdb8776df893d5a01f /src/pki_crypto.c | |
| parent | 7c0719e53dceb688009e12ba80a3e335205ecc51 (diff) | |
| download | libssh-2f26b5d63cde0da954e237aff176701d51760ea1.tar.gz libssh-2f26b5d63cde0da954e237aff176701d51760ea1.tar.xz libssh-2f26b5d63cde0da954e237aff176701d51760ea1.zip | |
pki: allow certificates to be used in signature verification
A number of places checked that the signature type matched the key type. We
losen these checks to, for example, allow an RSA signature with an RSA-cert
key.
Signed-off-by: Ben Toews <mastahyeti@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
Diffstat (limited to 'src/pki_crypto.c')
| -rw-r--r-- | src/pki_crypto.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/src/pki_crypto.c b/src/pki_crypto.c index 11f0754a..c8ac33d1 100644 --- a/src/pki_crypto.c +++ b/src/pki_crypto.c @@ -1625,7 +1625,7 @@ ssh_signature pki_signature_from_blob(const ssh_key pubkey, int rc; BIGNUM *pr = NULL, *ps = NULL; - if (type != pubkey->type) { + if (ssh_key_type_plain(pubkey->type) != type) { SSH_LOG(SSH_LOG_WARN, "Incompatible public key provided (%d) expecting (%d)", type, @@ -1833,7 +1833,7 @@ int pki_signature_verify(ssh_session session, int rc; int nid; - if (key->type != sig->type) { + if (ssh_key_type_plain(key->type) != sig->type) { SSH_LOG(SSH_LOG_WARN, "Can not verify %s signature with %s key", sig->type_c, @@ -1843,6 +1843,7 @@ int pki_signature_verify(ssh_session session, switch (key->type) { case SSH_KEYTYPE_DSS: + case SSH_KEYTYPE_DSS_CERT01: rc = DSA_do_verify(hash, hlen, sig->dsa_sig, @@ -1857,6 +1858,7 @@ int pki_signature_verify(ssh_session session, break; case SSH_KEYTYPE_RSA: case SSH_KEYTYPE_RSA1: + case SSH_KEYTYPE_RSA_CERT01: switch (sig->hash_type) { case SSH_DIGEST_AUTO: case SSH_DIGEST_SHA1: @@ -1892,6 +1894,7 @@ int pki_signature_verify(ssh_session session, } break; case SSH_KEYTYPE_ED25519: + case SSH_KEYTYPE_ED25519_CERT01: rc = pki_ed25519_verify(key, sig, hash, hlen); if (rc != SSH_OK){ ssh_set_error(session, @@ -1903,6 +1906,9 @@ int pki_signature_verify(ssh_session session, case SSH_KEYTYPE_ECDSA_P256: case SSH_KEYTYPE_ECDSA_P384: case SSH_KEYTYPE_ECDSA_P521: + case SSH_KEYTYPE_ECDSA_P256_CERT01: + case SSH_KEYTYPE_ECDSA_P384_CERT01: + case SSH_KEYTYPE_ECDSA_P521_CERT01: #ifdef HAVE_OPENSSL_ECC rc = ECDSA_do_verify(hash, hlen, |