lib/libssh2
1
0
Fork 0
mirror of https://github.com/libssh2/libssh2.git synced 2025-11-21 14:00:51 +03:00
Code Activity

crypto: add/fix algo guards and extend NO options

Browse Source 
Add new guard `LIBSSH2_RSA_SHA1`. Add missing guards for `LIBSSH2_RSA`,
`LIBSSH2_DSA`.

Fix warnings when all options are disabled.

This is still not complete and it's possible to break a build with
certain crypto backends (e.g. mbedTLS) and/or combination of options.
It's not guaranteed that all bits everywhere get disabled by these
settings. Consider this a "best effort".

Add these new options to disable certain crypto elements:
- `LIBSSH2_NO_3DES`
- `LIBSSH2_NO_AES_CTR`
- `LIBSSH2_NO_BLOWFISH`
- `LIBSSH2_NO_CAST`
- `LIBSSH2_NO_ECDSA`
- `LIBSSH2_NO_RC4`
- `LIBSSH2_NO_RSA_SHA1`
- `LIBSSH2_NO_RSA`

The goal is to offer a way to disable legacy/obsolete/insecure ones.

See also: 146a25a06d `LIBSSH2_NO_HMAC_RIPEMD`
See also: 38015f4e46 `LIBSSH2_NO_DSA`
See also: be31457f30 `LIBSSH2_NO_MD5`

Closes #986
This commit is contained in:
Viktor Szakats
2023-04-20 09:44:56 +00:00
parent 9a54f212a6
commit 857e431648
14 changed files with 141 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
src/crypto.h
View File

@@ -67,6 +67,46 @@
#define LIBSSH2_DSA 0
#endif
#ifdef LIBSSH2_NO_RSA
#undef LIBSSH2_RSA
#define LIBSSH2_RSA 0
#endif
#ifdef LIBSSH2_NO_RSA_SHA1
#undef LIBSSH2_RSA_SHA1
#define LIBSSH2_RSA_SHA1 0
#endif
#ifdef LIBSSH2_NO_ECDSA
#undef LIBSSH2_ECDSA
#define LIBSSH2_ECDSA 0
#endif
#ifdef LIBSSH2_NO_AES_CTR
#undef LIBSSH2_AES_CTR
#define LIBSSH2_AES_CTR 0
#endif
#ifdef LIBSSH2_NO_BLOWFISH
#undef LIBSSH2_BLOWFISH
#define LIBSSH2_BLOWFISH 0
#endif
#ifdef LIBSSH2_NO_RC4
#undef LIBSSH2_RC4
#define LIBSSH2_RC4 0
#endif
#ifdef LIBSSH2_NO_CAST
#undef LIBSSH2_CAST
#define LIBSSH2_CAST 0
#endif
#ifdef LIBSSH2_NO_3DES
#undef LIBSSH2_3DES
#define LIBSSH2_3DES 0
#endif
#define LIBSSH2_ED25519_KEY_LEN 32
#define LIBSSH2_ED25519_PRIVATE_KEY_LEN 64
#define LIBSSH2_ED25519_SIG_LEN 64
@@ -92,6 +132,7 @@ int _libssh2_rsa_new_private(libssh2_rsa_ctx ** rsa,
LIBSSH2_SESSION * session,
const char *filename,
unsigned const char *passphrase);
#if LIBSSH2_RSA_SHA1
int _libssh2_rsa_sha1_verify(libssh2_rsa_ctx * rsa,
const unsigned char *sig,
size_t sig_len,
@@ -102,6 +143,7 @@ int _libssh2_rsa_sha1_sign(LIBSSH2_SESSION * session,
size_t hash_len,
unsigned char **signature,
size_t *signature_len);
#endif
#if LIBSSH2_RSA_SHA2
int _libssh2_rsa_sha2_sign(LIBSSH2_SESSION * session,
libssh2_rsa_ctx * rsactx,

20
src/hostkey.c
View File

@@ -87,18 +87,22 @@ hostkey_method_ssh_rsa_init(LIBSSH2_SESSION * session,
}
/* we accept one of 3 header types */
#if LIBSSH2_RSA_SHA1
if(type_len == 7 && strncmp("ssh-rsa", (char *)type, 7) == 0) {
/* ssh-rsa */
}
else
#endif
#if LIBSSH2_RSA_SHA2
else if(type_len == 12 && strncmp("rsa-sha2-256", (char *)type, 12) == 0) {
if(type_len == 12 && strncmp("rsa-sha2-256", (char *)type, 12) == 0) {
/* rsa-sha2-256 */
}
else if(type_len == 12 && strncmp("rsa-sha2-512", (char *)type, 12) == 0) {
/* rsa-sha2-512 */
}
else
#endif
else {
{
_libssh2_debug((session, LIBSSH2_TRACE_ERROR,
"unexpected rsa type: %.*s", type_len, type));
return -1;
@@ -187,6 +191,7 @@ hostkey_method_ssh_rsa_initPEMFromMemory(LIBSSH2_SESSION * session,
return 0;
}
#if LIBSSH2_RSA_SHA1
/*
* hostkey_method_ssh_rsa_sign
*
@@ -250,6 +255,7 @@ hostkey_method_ssh_rsa_signv(LIBSSH2_SESSION * session,
return 0;
#endif
}
#endif
/*
* hostkey_method_ssh_rsa_sha2_256_sig_verify
@@ -413,6 +419,8 @@ hostkey_method_ssh_rsa_dtor(LIBSSH2_SESSION * session, void **abstract)
return 0;
}
#if LIBSSH2_RSA_SHA1
static const LIBSSH2_HOSTKEY_METHOD hostkey_method_ssh_rsa = {
"ssh-rsa",
SHA_DIGEST_LENGTH,
@@ -425,6 +433,8 @@ static const LIBSSH2_HOSTKEY_METHOD hostkey_method_ssh_rsa = {
hostkey_method_ssh_rsa_dtor,
};
#endif /* LIBSSH2_RSA_SHA1 */
#if LIBSSH2_RSA_SHA2
static const LIBSSH2_HOSTKEY_METHOD hostkey_method_ssh_rsa_sha2_256 = {
@@ -453,6 +463,8 @@ static const LIBSSH2_HOSTKEY_METHOD hostkey_method_ssh_rsa_sha2_512 = {
#endif /* LIBSSH2_RSA_SHA2 */
#if LIBSSH2_RSA_SHA1
static const LIBSSH2_HOSTKEY_METHOD hostkey_method_ssh_rsa_cert = {
"ssh-rsa-cert-v01@openssh.com",
SHA_DIGEST_LENGTH,
@@ -465,6 +477,8 @@ static const LIBSSH2_HOSTKEY_METHOD hostkey_method_ssh_rsa_cert = {
hostkey_method_ssh_rsa_dtor,
};
#endif /* LIBSSH2_RSA_SHA1 */
#endif /* LIBSSH2_RSA */
#if LIBSSH2_DSA
@@ -1263,8 +1277,10 @@ static const LIBSSH2_HOSTKEY_METHOD *hostkey_methods[] = {
&hostkey_method_ssh_rsa_sha2_512,
&hostkey_method_ssh_rsa_sha2_256,
#endif /* LIBSSH2_RSA_SHA2 */
#if LIBSSH2_RSA_SHA1
&hostkey_method_ssh_rsa,
&hostkey_method_ssh_rsa_cert,
#endif /* LIBSSH2_RSA_SHA1 */
#endif /* LIBSSH2_RSA */
#if LIBSSH2_DSA
&hostkey_method_ssh_dss,

16
src/libgcrypt.c
View File

@@ -40,6 +40,7 @@
#include <string.h>
#if LIBSSH2_RSA
int
_libssh2_rsa_new(libssh2_rsa_ctx ** rsa,
const unsigned char *edata,
@@ -83,6 +84,7 @@ _libssh2_rsa_new(libssh2_rsa_ctx ** rsa,
return 0;
}
#if LIBSSH2_RSA_SHA1
int
_libssh2_rsa_sha1_verify(libssh2_rsa_ctx * rsa,
const unsigned char *sig,
@@ -114,7 +116,10 @@ _libssh2_rsa_sha1_verify(libssh2_rsa_ctx * rsa,
return (rc == 0) ? 0 : -1;
}
#endif
#endif
#if LIBSSH2_DSA
int
_libssh2_dsa_new(libssh2_dsa_ctx ** dsactx,
const unsigned char *p,
@@ -147,7 +152,9 @@ _libssh2_dsa_new(libssh2_dsa_ctx ** dsactx,
return 0;
}
#endif
#if LIBSSH2_RSA
int
_libssh2_rsa_new_private_frommemory(libssh2_rsa_ctx ** rsa,
LIBSSH2_SESSION * session,
@@ -265,7 +272,9 @@ _libssh2_rsa_new_private(libssh2_rsa_ctx ** rsa,
LIBSSH2_FREE(session, save_data);
return ret;
}
#endif
#if LIBSSH2_DSA
int
_libssh2_dsa_new_private_frommemory(libssh2_dsa_ctx ** dsa,
LIBSSH2_SESSION * session,
@@ -369,7 +378,10 @@ _libssh2_dsa_new_private(libssh2_dsa_ctx ** dsa,
LIBSSH2_FREE(session, save_data);
return ret;
}
#endif
#if LIBSSH2_RSA
#if LIBSSH2_RSA_SHA1
int
_libssh2_rsa_sha1_sign(LIBSSH2_SESSION * session,
libssh2_rsa_ctx * rsactx,
@@ -429,7 +441,10 @@ _libssh2_rsa_sha1_sign(LIBSSH2_SESSION * session,
return rc;
}
#endif
#endif
#if LIBSSH2_DSA
int
_libssh2_dsa_sha1_sign(libssh2_dsa_ctx * dsactx,
const unsigned char *hash,
@@ -549,6 +564,7 @@ _libssh2_dsa_sha1_verify(libssh2_dsa_ctx * dsactx,
return (rc == 0) ? 0 : -1;
}
#endif
int
_libssh2_cipher_init(_libssh2_cipher_ctx * h,

1
src/libgcrypt.h
View File

@@ -57,6 +57,7 @@
#define LIBSSH2_3DES 1
#define LIBSSH2_RSA 1
#define LIBSSH2_RSA_SHA1 1
#define LIBSSH2_RSA_SHA2 0
#define LIBSSH2_DSA 1
#define LIBSSH2_ECDSA 0

1
src/mbedtls.h
View File

@@ -81,6 +81,7 @@
#define LIBSSH2_3DES 1
#define LIBSSH2_RSA 1
#define LIBSSH2_RSA_SHA1 1
#define LIBSSH2_RSA_SHA2 1
#define LIBSSH2_DSA 0
#ifdef MBEDTLS_ECDSA_C

31
src/openssl.c
View File

@@ -70,6 +70,7 @@ _libssh2_sk_pub_openssh_keyfilememory(LIBSSH2_SESSION *session,
size_t privatekeydata_len,
unsigned const char *passphrase);
#if LIBSSH2_RSA || LIBSSH2_DSA || LIBSSH2_ECDSA
static unsigned char *
write_bn(unsigned char *buf, const BIGNUM *bn, int bn_bytes)
{
@@ -87,6 +88,7 @@ write_bn(unsigned char *buf, const BIGNUM *bn, int bn_bytes)
return p + bn_bytes;
}
#endif
int
_libssh2_openssl_random(void *buf, size_t len)
@@ -98,6 +100,7 @@ _libssh2_openssl_random(void *buf, size_t len)
return RAND_bytes(buf, (int)len) == 1 ? 0 : -1;
}
#if LIBSSH2_RSA
int
_libssh2_rsa_new(libssh2_rsa_ctx ** rsa,
const unsigned char *edata,
@@ -226,6 +229,7 @@ _libssh2_rsa_sha2_verify(libssh2_rsa_ctx * rsactx,
return (ret == 1) ? 0 : -1;
}
#if LIBSSH2_RSA_SHA1
int
_libssh2_rsa_sha1_verify(libssh2_rsa_ctx * rsactx,
const unsigned char *sig,
@@ -235,6 +239,8 @@ _libssh2_rsa_sha1_verify(libssh2_rsa_ctx * rsactx,
return _libssh2_rsa_sha2_verify(rsactx, SHA_DIGEST_LENGTH, sig, sig_len, m,
m_len);
}
#endif
#endif
#if LIBSSH2_DSA
int
@@ -587,7 +593,7 @@ read_private_key_from_memory(void **key_ctx,
}
#if LIBSSH2_RSA || LIBSSH2_DSA || LIBSSH2_ECDSA
static int
read_private_key_from_file(void **key_ctx,
pem_read_bio_func read_private_key,
@@ -609,7 +615,9 @@ read_private_key_from_file(void **key_ctx,
BIO_free(bp);
return (*key_ctx) ? 0 : -1;
}
#endif
#if LIBSSH2_RSA
int
_libssh2_rsa_new_private_frommemory(libssh2_rsa_ctx ** rsa,
LIBSSH2_SESSION * session,
@@ -989,6 +997,7 @@ _libssh2_rsa_new_private(libssh2_rsa_ctx ** rsa,
return rc;
}
#endif
#if LIBSSH2_DSA
int
@@ -1296,7 +1305,6 @@ _libssh2_dsa_new_private(libssh2_dsa_ctx ** dsa,
return rc;
}
#endif /* LIBSSH_DSA */
#if LIBSSH2_ECDSA
@@ -2024,6 +2032,7 @@ _libssh2_ed25519_new_public(libssh2_ed25519_ctx ** ed_ctx,
#endif /* LIBSSH2_ED25519 */
#if LIBSSH2_RSA
int
_libssh2_rsa_sha2_sign(LIBSSH2_SESSION * session,
libssh2_rsa_ctx * rsactx,
@@ -2068,7 +2077,7 @@ _libssh2_rsa_sha2_sign(LIBSSH2_SESSION * session,
return 0;
}
#if LIBSSH2_RSA_SHA1
int
_libssh2_rsa_sha1_sign(LIBSSH2_SESSION * session,
libssh2_rsa_ctx * rsactx,
@@ -2079,7 +2088,8 @@ _libssh2_rsa_sha1_sign(LIBSSH2_SESSION * session,
return _libssh2_rsa_sha2_sign(session, rsactx, hash, hash_len,
signature, signature_len);
}
#endif
#endif
#if LIBSSH2_DSA
int
@@ -3447,25 +3457,24 @@ _libssh2_pub_priv_keyfile(LIBSSH2_SESSION *session,
session, method, method_len, pubkeydata, pubkeydata_len, pk);
break;
#endif /* LIBSSH2_ED25519 */
#if LIBSSH2_RSA
case EVP_PKEY_RSA:
st = gen_publickey_from_rsa_evp(
session, method, method_len, pubkeydata, pubkeydata_len, pk);
break;
#endif /* LIBSSH2_RSA */
#if LIBSSH2_DSA
case EVP_PKEY_DSA:
st = gen_publickey_from_dsa_evp(
session, method, method_len, pubkeydata, pubkeydata_len, pk);
break;
#endif /* LIBSSH_DSA */
#endif /* LIBSSH2_DSA */
#if LIBSSH2_ECDSA
case EVP_PKEY_EC:
st = gen_publickey_from_ec_evp(
session, method, method_len, pubkeydata, pubkeydata_len, 0, pk);
break;
#endif
#endif /* LIBSSH2_ECDSA */
default :
st = _libssh2_error(session,
LIBSSH2_ERROR_FILE,
@@ -3787,16 +3796,18 @@ _libssh2_pub_priv_keyfilememory(LIBSSH2_SESSION *session,
session, method, method_len, pubkeydata, pubkeydata_len, pk);
break;
#endif /* LIBSSH2_ED25519 */
#if LIBSSH2_RSA
case EVP_PKEY_RSA:
st = gen_publickey_from_rsa_evp(session, method, method_len,
pubkeydata, pubkeydata_len, pk);
break;
#endif /* LIBSSH2_RSA */
#if LIBSSH2_DSA
case EVP_PKEY_DSA:
st = gen_publickey_from_dsa_evp(session, method, method_len,
pubkeydata, pubkeydata_len, pk);
break;
#endif /* LIBSSH_DSA */
#endif /* LIBSSH2_DSA */
#if LIBSSH2_ECDSA
case EVP_PKEY_EC:
st = gen_publickey_from_ec_evp(session, method, method_len,

6
src/openssl.h
View File

@@ -105,9 +105,11 @@
#ifdef OPENSSL_NO_RSA
# define LIBSSH2_RSA 0
# define LIBSSH2_RSA_SHA1 0
# define LIBSSH2_RSA_SHA2 0
#else
# define LIBSSH2_RSA 1
# define LIBSSH2_RSA_SHA1 1
# define LIBSSH2_RSA_SHA2 1
#endif
@@ -353,13 +355,17 @@ extern void _libssh2_openssl_crypto_exit(void);
#define libssh2_crypto_init() _libssh2_openssl_crypto_init()
#define libssh2_crypto_exit() _libssh2_openssl_crypto_exit()
#if LIBSSH2_RSA
#define libssh2_rsa_ctx RSA
#define _libssh2_rsa_free(rsactx) RSA_free(rsactx)
#endif
#if LIBSSH2_DSA
#define libssh2_dsa_ctx DSA
#define _libssh2_dsa_free(dsactx) DSA_free(dsactx)
#endif
#if LIBSSH2_ECDSA
#define libssh2_ecdsa_ctx EC_KEY

1
src/os400qc3.h
View File

@@ -177,6 +177,7 @@
#define LIBSSH2_3DES 1
#define LIBSSH2_RSA 1
#define LIBSSH2_RSA_SHA1 1
#define LIBSSH2_RSA_SHA2 1
#define LIBSSH2_DSA 0
#define LIBSSH2_ECDSA 0

15
src/wincng.c
View File

@@ -953,6 +953,7 @@ _libssh2_wincng_asn_decode_bns(unsigned char *pbEncoded,
}
#endif /* HAVE_LIBCRYPT32 */
#if LIBSSH2_RSA || LIBSSH2_DSA
static unsigned long
_libssh2_wincng_bn_size(const unsigned char *bignum,
unsigned long length)
@@ -972,8 +973,10 @@ _libssh2_wincng_bn_size(const unsigned char *bignum,
return length - offset;
}
#endif
#if LIBSSH2_RSA
/*******************************************************************/
/*
* Windows CNG backend: RSA functions
@@ -1238,6 +1241,7 @@ _libssh2_wincng_rsa_new_private_frommemory(libssh2_rsa_ctx **rsa,
#endif /* HAVE_LIBCRYPT32 */
}
#if LIBSSH2_RSA_SHA1
int
_libssh2_wincng_rsa_sha1_verify(libssh2_rsa_ctx *rsa,
const unsigned char *sig,
@@ -1250,7 +1254,9 @@ _libssh2_wincng_rsa_sha1_verify(libssh2_rsa_ctx *rsa,
m, (unsigned long)m_len,
BCRYPT_PAD_PKCS1);
}
#endif
#if LIBSSH2_RSA_SHA2
int
_libssh2_wincng_rsa_sha2_verify(libssh2_rsa_ctx* rsa,
size_t hash_len,
@@ -1264,6 +1270,7 @@ _libssh2_wincng_rsa_sha2_verify(libssh2_rsa_ctx* rsa,
m, (unsigned long)m_len,
BCRYPT_PAD_PKCS1);
}
#endif
int
_libssh2_wincng_rsa_sha_sign(LIBSSH2_SESSION *session,
@@ -1338,7 +1345,7 @@ _libssh2_wincng_rsa_free(libssh2_rsa_ctx *rsa)
_libssh2_wincng_safe_free(rsa->pbKeyObject, rsa->cbKeyObject);
_libssh2_wincng_safe_free(rsa, sizeof(libssh2_rsa_ctx));
}
#endif
/*******************************************************************/
/*
@@ -1665,11 +1672,11 @@ _libssh2_wincng_pub_priv_keyfile_parse(LIBSSH2_SESSION *session,
unsigned char *pbEncoded,
size_t cbEncoded)
{
unsigned char **rpbDecoded;
unsigned long *rcbDecoded;
unsigned char **rpbDecoded = NULL;
unsigned long *rcbDecoded = NULL;
unsigned char *key = NULL, *mth = NULL;
unsigned long keylen = 0, mthlen = 0;
unsigned long index, offset, length;
unsigned long index, offset, length = 0;
int ret;
ret = _libssh2_wincng_asn_decode_bns(pbEncoded, cbEncoded,

1
src/wincng.h
View File

@@ -65,6 +65,7 @@
#define LIBSSH2_3DES 1
#define LIBSSH2_RSA 1
#define LIBSSH2_RSA_SHA1 1
#define LIBSSH2_RSA_SHA2 1
#define LIBSSH2_DSA 1
#define LIBSSH2_ECDSA 0

5
tests/test_auth_pubkey_ok_rsa.c
View File

@@ -2,10 +2,15 @@
int test(LIBSSH2_SESSION *session)
{
#if LIBSSH2_RSA_SHA1
/* set in Dockerfile */
return test_auth_pubkey(session, 0,
"libssh2",
NULL,
"key_rsa.pub",
"key_rsa");
#else
(void)session;
return 0;
#endif
}

5
tests/test_auth_pubkey_ok_rsa_encrypted.c
View File

@@ -2,10 +2,15 @@
int test(LIBSSH2_SESSION *session)
{
#if LIBSSH2_RSA_SHA1
/* set in Dockerfile */
return test_auth_pubkey(session, 0,
"libssh2",
"libssh2",
"key_rsa_encrypted.pub",
"key_rsa_encrypted");
#else
(void)session;
return 0;
#endif
}

3
tests/test_auth_pubkey_ok_rsa_openssh.c
View File

@@ -2,7 +2,8 @@
int test(LIBSSH2_SESSION *session)
{
#if defined(LIBSSH2_OPENSSL) || defined(LIBSSH2_WOLFSSL)
#if LIBSSH2_RSA_SHA1 && \
(defined(LIBSSH2_OPENSSL) || defined(LIBSSH2_WOLFSSL))
/* set in Dockerfile */
return test_auth_pubkey(session, 0,
"libssh2",

3
tests/test_auth_pubkey_ok_rsa_signed.c
View File

@@ -2,7 +2,8 @@
int test(LIBSSH2_SESSION *session)
{
#if defined(LIBSSH2_OPENSSL) || defined(LIBSSH2_WOLFSSL)
#if LIBSSH2_RSA_SHA1 && \
(defined(LIBSSH2_OPENSSL) || defined(LIBSSH2_WOLFSSL))
/* set in Dockerfile */
return test_auth_pubkey(session, 0,
"libssh2",