lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-12-08 03:42:12 +03:00
Code Activity

refactor(pki): Define RSA_MIN_KEY_SIZE and update related checks

Browse Source 
Signed-off-by: Praneeth Sarode <praneethsarode@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
This commit is contained in:
Praneeth Sarode
2025-08-28 17:13:48 +05:30
committed by Jakub Jelen
parent df4e907dff
commit e8bbd194c7
4 changed files with 23 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/libssh/pki.h
View File

@@ -45,6 +45,7 @@
#define MAX_PUBKEY_SIZE 0x100000 /* 1M */ #define MAX_PUBKEY_SIZE 0x100000 /* 1M */
#define MAX_PRIVKEY_SIZE 0x400000 /* 4M */ #define MAX_PRIVKEY_SIZE 0x400000 /* 4M */
#define RSA_MIN_KEY_SIZE 768
#define SSH_KEY_FLAG_EMPTY 0x0 #define SSH_KEY_FLAG_EMPTY 0x0
#define SSH_KEY_FLAG_PUBLIC 0x0001 #define SSH_KEY_FLAG_PUBLIC 0x0001

26
src/options.c
View File

@@ -31,13 +31,14 @@
#else #else
#include <winsock2.h> #include <winsock2.h>
#endif #endif
#include <sys/types.h> #include "libssh/config_parser.h"
#include "libssh/misc.h"
#include "libssh/options.h"
#include "libssh/pki.h"
#include "libssh/pki_priv.h" #include "libssh/pki_priv.h"
#include "libssh/priv.h" #include "libssh/priv.h"
#include "libssh/session.h" #include "libssh/session.h"
#include "libssh/misc.h" #include <sys/types.h>
#include "libssh/options.h"
#include "libssh/config_parser.h"
#ifdef WITH_SERVER #ifdef WITH_SERVER
#include "libssh/server.h" #include "libssh/server.h"
#include "libssh/bind.h" #include "libssh/bind.h"
@@ -1288,11 +1289,13 @@ int ssh_options_set(ssh_session session, enum ssh_options_e type,
/* (*x == 0) is allowed as it is used to revert to default */ /* (*x == 0) is allowed as it is used to revert to default */
if (*x > 0 && *x < 768) { if (*x > 0 && *x < RSA_MIN_KEY_SIZE) {
ssh_set_error(session, SSH_REQUEST_DENIED, ssh_set_error(session,
SSH_REQUEST_DENIED,
"The provided value (%d) for minimal RSA key " "The provided value (%d) for minimal RSA key "
"size is too small. Use at least 768 bits.", "size is too small. Use at least %d bits.",
*x); *x,
RSA_MIN_KEY_SIZE);
return -1; return -1;
} }
session->opts.rsa_min_size = *x; session->opts.rsa_min_size = *x;
@@ -2590,12 +2593,13 @@ ssh_bind_options_set(ssh_bind sshbind,
/* (*x == 0) is allowed as it is used to revert to default */ /* (*x == 0) is allowed as it is used to revert to default */
if (*x > 0 && *x < 768) { if (*x > 0 && *x < RSA_MIN_KEY_SIZE) {
ssh_set_error(sshbind, ssh_set_error(sshbind,
SSH_REQUEST_DENIED, SSH_REQUEST_DENIED,
"The provided value (%d) for minimal RSA key " "The provided value (%d) for minimal RSA key "
"size is too small. Use at least 768 bits.", "size is too small. Use at least %d bits.",
*x); *x,
RSA_MIN_KEY_SIZE);
return -1; return -1;
} }
sshbind->rsa_min_size = *x; sshbind->rsa_min_size = *x;

2
src/pki.c
View File

@@ -447,7 +447,7 @@ bool ssh_key_size_allowed_rsa(int min_size, ssh_key key)
{ {
int key_size = ssh_key_size(key); int key_size = ssh_key_size(key);
if (min_size < 768) { if (min_size < RSA_MIN_KEY_SIZE) {
if (ssh_fips_mode()) { if (ssh_fips_mode()) {
min_size = 2048; min_size = 2048;
} else { } else {

11
tests/unittests/torture_options.c
View File

@@ -8,13 +8,14 @@
#endif #endif
#include <sys/stat.h> #include <sys/stat.h>
#include <errno.h>
#include "torture.h" #include "torture.h"
#include "torture_key.h" #include "torture_key.h"
#include <libssh/session.h> #include <errno.h>
#include <libssh/misc.h> #include <libssh/misc.h>
#include <libssh/pki_priv.h>
#include <libssh/options.h> #include <libssh/options.h>
#include <libssh/pki.h>
#include <libssh/pki_priv.h>
#include <libssh/session.h>
#ifdef WITH_SERVER #ifdef WITH_SERVER
#include <libssh/bind.h> #include <libssh/bind.h>
#define LIBSSH_CUSTOM_BIND_CONFIG_FILE "my_bind_config" #define LIBSSH_CUSTOM_BIND_CONFIG_FILE "my_bind_config"
@@ -1997,7 +1998,7 @@ static void torture_options_set_verbosity (void **state)
static void torture_options_set_rsa_min_size(void **state) static void torture_options_set_rsa_min_size(void **state)
{ {
ssh_session session = *state; ssh_session session = *state;
int min_allowed = 768, key_size, rc; int min_allowed = RSA_MIN_KEY_SIZE, key_size, rc;
/* Check that passing NULL leads to failure */ /* Check that passing NULL leads to failure */
rc = ssh_options_set(session, SSH_OPTIONS_RSA_MIN_SIZE, NULL); rc = ssh_options_set(session, SSH_OPTIONS_RSA_MIN_SIZE, NULL);
@@ -2422,7 +2423,7 @@ static void torture_bind_options_set_rsa_min_size(void **state)
{ {
struct bind_st *test_state = NULL; struct bind_st *test_state = NULL;
ssh_bind bind = NULL; ssh_bind bind = NULL;
int rc, min_allowed = 768, key_size; int rc, min_allowed = RSA_MIN_KEY_SIZE, key_size;
assert_non_null(state); assert_non_null(state);
test_state = *((struct bind_st **)state); test_state = *((struct bind_st **)state);