Mercurial > dropbear

comparison signkey.c @ 1674:ba6fc7afe1c5

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
use sigtype where appropriate
author Matt Johnston <matt@ucc.asn.au>
date Mon, 06 Apr 2020 23:18:26 +0800
parents d32bcb5c557d
children ae41624c2198
comparison
equal deleted inserted replaced
1668:49cb3cf4bd6f 1674:ba6fc7afe1c5
26 #include "dbutil.h" 26 #include "dbutil.h"
27 #include "signkey.h" 27 #include "signkey.h"
28 #include "buffer.h" 28 #include "buffer.h"
29 #include "ssh.h" 29 #include "ssh.h"
30 #include "ecdsa.h" 30 #include "ecdsa.h"
31 #include "rsa.h"
32 #include "dss.h"
33 #include "ed25519.h"
31 34
32 static const char * const signkey_names[DROPBEAR_SIGNKEY_NUM_NAMED] = { 35 static const char * const signkey_names[DROPBEAR_SIGNKEY_NUM_NAMED] = {
33 #if DROPBEAR_RSA 36 #if DROPBEAR_RSA
34 "ssh-rsa", 37 "ssh-rsa",
35 #endif 38 #endif
42 "ecdsa-sha2-nistp521", 45 "ecdsa-sha2-nistp521",
43 #endif /* DROPBEAR_ECDSA */ 46 #endif /* DROPBEAR_ECDSA */
44 #if DROPBEAR_ED25519 47 #if DROPBEAR_ED25519
45 "ssh-ed25519", 48 "ssh-ed25519",
46 #endif /* DROPBEAR_ED25519 */ 49 #endif /* DROPBEAR_ED25519 */
50 /* "rsa-sha2-256" is special-cased below since it is only a signature name, not key type */
47 }; 51 };
48 52
49 /* malloc a new sign_key and set the dss and rsa keys to NULL */ 53 /* malloc a new sign_key and set the dss and rsa keys to NULL */
50 sign_key * new_sign_key() { 54 sign_key * new_sign_key() {
51 55
101 } 105 }
102 106
103 TRACE(("signkey_type_from_name unexpected key type.")) 107 TRACE(("signkey_type_from_name unexpected key type."))
104 108
105 return DROPBEAR_SIGNKEY_NONE; 109 return DROPBEAR_SIGNKEY_NONE;
110 }
111
112 /* Special case for rsa-sha2-256. This could be generalised if more
113 signature names are added that aren't 1-1 with public key names */
114 const char* signature_name_from_type(enum signkey_type type, unsigned int *namelen) {
115 #if DROPBEAR_RSA_SHA256
116 if (type == DROPBEAR_SIGNKEY_RSA_SHA256) {
117 *namelen = strlen(SSH_SIGNKEY_RSA_SHA256);
118 return SSH_SIGNKEY_RSA_SHA256;
119 }
120 #endif
121 return signkey_name_from_type(type, namelen);
122 }
123
124 enum signkey_type signature_type_from_name(const char* name, unsigned int namelen) {
125 #if DROPBEAR_RSA_SHA256
126 if (namelen == strlen(SSH_SIGNKEY_RSA_SHA256)
127 && memcmp(name, SSH_SIGNKEY_RSA_SHA256, namelen) == 0) {
128 return DROPBEAR_SIGNKEY_RSA_SHA256;
129 }
130 #endif
131 return signkey_type_from_name(name, namelen);
132 }
133
134 enum signkey_type signkey_type_from_signature(enum signkey_type sigtype) {
135 #if DROPBEAR_RSA_SHA256
136 if (sigtype == DROPBEAR_SIGNKEY_RSA_SHA256) {
137 return DROPBEAR_SIGNKEY_RSA;
138 }
139 #endif
140 assert(sigtype < DROPBEAR_SIGNKEY_NUM_NAMED);
141 return sigtype;
106 } 142 }
107 143
108 /* Returns a pointer to the key part specific to "type". 144 /* Returns a pointer to the key part specific to "type".
109 Be sure to check both (ret != NULL) and (*ret != NULL) */ 145 Be sure to check both (ret != NULL) and (*ret != NULL) */
110 void ** 146 void **
524 #else 560 #else
525 return sign_key_sha1_fingerprint(keyblob, keybloblen); 561 return sign_key_sha1_fingerprint(keyblob, keybloblen);
526 #endif 562 #endif
527 } 563 }
528 564
529 void buf_put_sign(buffer* buf, sign_key *key, enum signkey_type type, 565 void buf_put_sign(buffer* buf, sign_key *key, enum signkey_type sigtype,
530 const buffer *data_buf) { 566 const buffer *data_buf) {
531 buffer *sigblob; 567 buffer *sigblob = buf_new(MAX_PUBKEY_SIZE);
532 sigblob = buf_new(MAX_PUBKEY_SIZE); 568 enum signkey_type keytype = signkey_type_from_signature(sigtype);
533 569
534 #if DROPBEAR_DSS 570 #if DROPBEAR_DSS
535 if (type == DROPBEAR_SIGNKEY_DSS) { 571 if (keytype == DROPBEAR_SIGNKEY_DSS) {
536 buf_put_dss_sign(sigblob, key->dsskey, data_buf); 572 buf_put_dss_sign(sigblob, key->dsskey, data_buf);
537 } 573 }
538 #endif 574 #endif
539 #if DROPBEAR_RSA 575 #if DROPBEAR_RSA
540 if (type == DROPBEAR_SIGNKEY_RSA) { 576 if (keytype == DROPBEAR_SIGNKEY_RSA) {
541 buf_put_rsa_sign(sigblob, key->rsakey, data_buf); 577 buf_put_rsa_sign(sigblob, key->rsakey, sigtype, data_buf);
542 } 578 }
543 #endif 579 #endif
544 #if DROPBEAR_ECDSA 580 #if DROPBEAR_ECDSA
545 if (signkey_is_ecdsa(type)) { 581 if (signkey_is_ecdsa(keytype)) {
546 ecc_key **eck = (ecc_key**)signkey_key_ptr(key, type); 582 ecc_key **eck = (ecc_key**)signkey_key_ptr(key, keytype);
547 if (eck && *eck) { 583 if (eck && *eck) {
548 buf_put_ecdsa_sign(sigblob, *eck, data_buf); 584 buf_put_ecdsa_sign(sigblob, *eck, data_buf);
549 } 585 }
550 } 586 }
551 #endif 587 #endif
552 #if DROPBEAR_ED25519 588 #if DROPBEAR_ED25519
553 if (type == DROPBEAR_SIGNKEY_ED25519) { 589 if (keytype == DROPBEAR_SIGNKEY_ED25519) {
554 buf_put_ed25519_sign(sigblob, key->ed25519key, data_buf); 590 buf_put_ed25519_sign(sigblob, key->ed25519key, data_buf);
555 } 591 }
556 #endif 592 #endif
557 if (sigblob->len == 0) { 593 if (sigblob->len == 0) {
558 dropbear_exit("Non-matching signing type"); 594 dropbear_exit("Non-matching signing type");
565 #if DROPBEAR_SIGNKEY_VERIFY 601 #if DROPBEAR_SIGNKEY_VERIFY
566 /* Return DROPBEAR_SUCCESS or DROPBEAR_FAILURE. 602 /* Return DROPBEAR_SUCCESS or DROPBEAR_FAILURE.
567 * If FAILURE is returned, the position of 603 * If FAILURE is returned, the position of
568 * buf is undefined. If SUCCESS is returned, buf will be positioned after the 604 * buf is undefined. If SUCCESS is returned, buf will be positioned after the
569 * signature blob */ 605 * signature blob */
570 int buf_verify(buffer * buf, sign_key *key, const buffer *data_buf) { 606 int buf_verify(buffer * buf, sign_key *key, enum signkey_type expect_sigtype, const buffer *data_buf) {
571 607
572 char *type_name = NULL; 608 char *type_name = NULL;
573 unsigned int type_name_len = 0; 609 unsigned int type_name_len = 0;
574 enum signkey_type type; 610 enum signkey_type sigtype, keytype;
575 611
576 TRACE(("enter buf_verify")) 612 TRACE(("enter buf_verify"))
577 613
578 buf_getint(buf); /* blob length */ 614 buf_getint(buf); /* blob length */
579 type_name = buf_getstring(buf, &type_name_len); 615 type_name = buf_getstring(buf, &type_name_len);
580 type = signkey_type_from_name(type_name, type_name_len); 616 sigtype = signature_type_from_name(type_name, type_name_len);
581 m_free(type_name); 617 m_free(type_name);
582 618
583 #if DROPBEAR_DSS 619 if (expect_sigtype != DROPBEAR_SIGNKEY_ANY
584 if (type == DROPBEAR_SIGNKEY_DSS) { 620 && expect_sigtype != sigtype) {
621 dropbear_exit("Non-matching signing type");
622 }
623
624 keytype = signkey_type_from_signature(sigtype);
625 #if DROPBEAR_DSS
626 if (keytype == DROPBEAR_SIGNKEY_DSS) {
585 if (key->dsskey == NULL) { 627 if (key->dsskey == NULL) {
586 dropbear_exit("No DSS key to verify signature"); 628 dropbear_exit("No DSS key to verify signature");
587 } 629 }
588 return buf_dss_verify(buf, key->dsskey, data_buf); 630 return buf_dss_verify(buf, key->dsskey, data_buf);
589 } 631 }
590 #endif 632 #endif
591 633
592 #if DROPBEAR_RSA 634 #if DROPBEAR_RSA
593 if (type == DROPBEAR_SIGNKEY_RSA) { 635 if (keytype == DROPBEAR_SIGNKEY_RSA) {
594 if (key->rsakey == NULL) { 636 if (key->rsakey == NULL) {
595 dropbear_exit("No RSA key to verify signature"); 637 dropbear_exit("No RSA key to verify signature");
596 } 638 }
597 return buf_rsa_verify(buf, key->rsakey, data_buf); 639 return buf_rsa_verify(buf, key->rsakey, sigtype, data_buf);
598 } 640 }
599 #endif 641 #endif
600 #if DROPBEAR_ECDSA 642 #if DROPBEAR_ECDSA
601 if (signkey_is_ecdsa(type)) { 643 if (signkey_is_ecdsa(keytype)) {
602 ecc_key **eck = (ecc_key**)signkey_key_ptr(key, type); 644 ecc_key **eck = (ecc_key**)signkey_key_ptr(key, keytype);
603 if (eck && *eck) { 645 if (eck && *eck) {
604 return buf_ecdsa_verify(buf, *eck, data_buf); 646 return buf_ecdsa_verify(buf, *eck, data_buf);
605 } 647 }
606 } 648 }
607 #endif 649 #endif
608 #if DROPBEAR_ED25519 650 #if DROPBEAR_ED25519
609 if (type == DROPBEAR_SIGNKEY_ED25519) { 651 if (keytype == DROPBEAR_SIGNKEY_ED25519) {
610 if (key->ed25519key == NULL) { 652 if (key->ed25519key == NULL) {
611 dropbear_exit("No Ed25519 key to verify signature"); 653 dropbear_exit("No Ed25519 key to verify signature");
612 } 654 }
613 return buf_ed25519_verify(buf, key->ed25519key, data_buf); 655 return buf_ed25519_verify(buf, key->ed25519key, data_buf);
614 } 656 }