lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-12-17 06:18:58 +03:00
Code Activity

server: reply with PK_OK with correct algorithm

Browse Source 
RFC 4252 §7 states that the public key algorithm in a
SSH_MSG_USERAUTH_PK_OK response is the public key algorithm name from
the request.  When using RSA with SHA-2, this will be either
"rsa-sha2-256" or "rsa-sha2-512" as specified by RFC 8332 §3.2.

However, currently libssh emits the public key type instead, which is
"ssh-rsa".  This is not in conformance with the RFCs, so let's fix this
by storing the signature type and emitting it in our response instead of
the public key when sending SSH_MSG_USERAUTH_PK_OK in the server.

Signed-off-by: brian m. carlson <bk2204@github.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
This commit is contained in:
brian m. carlson
2021-11-30 16:35:15 +00:00
committed by Jakub Jelen
parent 42d1efe4f9
commit c573adced4
3 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/messages.c
View File

@@ -593,6 +593,7 @@ void ssh_message_free(ssh_message msg){
switch(msg->type) {
case SSH_REQUEST_AUTH:
SAFE_FREE(msg->auth_request.username);
SAFE_FREE(msg->auth_request.sigtype);
if (msg->auth_request.password) {
explicit_bzero(msg->auth_request.password,
strlen(msg->auth_request.password));
@@ -852,6 +853,14 @@ SSH_PACKET_CALLBACK(ssh_packet_userauth_request){
goto error;
}
msg->auth_request.signature_state = SSH_PUBLICKEY_STATE_NONE;
msg->auth_request.sigtype = strdup(ssh_string_get_char(algo));
if (msg->auth_request.sigtype == NULL) {
msg->auth_request.signature_state = SSH_PUBLICKEY_STATE_ERROR;
SSH_STRING_FREE(algo);
algo = NULL;
goto error;
}
// has a valid signature ?
if(has_sign) {
ssh_string sig_blob = NULL;