mirror of
https://github.com/libssh2/libssh2.git
synced 2026-10-24 03:48:58 +03:00
c704efcc7d
Implement server hostkey verification for the six ECDSA/RSA OpenSSH certificate hostkey variants: - `ecdsa-sha2-nistp256-cert-v01@openssh.com` - `ecdsa-sha2-nistp384-cert-v01@openssh.com` - `ecdsa-sha2-nistp521-cert-v01@openssh.com` - `ssh-rsa-cert-v01@openssh.com` - `rsa-sha2-256-cert-v01@openssh.com` - `rsa-sha2-512-cert-v01@openssh.com` This fixes #2434, where these algorithms were advertised and accepted as preferences but had `NULL` hostkey `init`/`sig_verify` callbacks. A certificate-only hostkey offer therefore caused `LIBSSH2_ERROR_KEX_FAILURE (-5)`. ## Implementation - ECDSA certificate parsing uses one shared init path for all three curves. It validates the certificate type, nonce, inner curve name, and EC point before constructing the verification context. - RSA certificate parsing uses one shared init path for all three RSA signature variants. - Per-algorithm RSA `sig_verify` callbacks remain distinct. - Per `PROTOCOL.certkeys`, the RSA/SHA-2 certificate blob itself carries the type string `ssh-rsa-cert-v01@openssh.com`; the negotiated SHA-2 algorithm is represented by KEXINIT and the exchange signature. - Certificate CA trust validation remains out of scope, consistent with existing plain-hostkey handling. ## Tests - Host CA fixtures (`keys/ca_host_ecdsa`, `keys/ca_host_rsa`) and CA-signed host certificates for the ECDSA P-256 and RSA host keys in the Docker OpenSSH fixture. - The certificate algorithms are exercised through `test_read_algos.txt` and `FIXTURE_TEST_HOSTKEY`: `ecdsa-sha2-nistp256-cert-v01@openssh.com`, `rsa-sha2-256-cert-v01@openssh.com`, `rsa-sha2-512-cert-v01@openssh.com`, `ssh-rsa-cert-v01@openssh.com`, plus the pre-existing `ssh-ed25519-cert-v01@openssh.com`. - The ECDSA P-384/P-521 certificate variants share the same codepath and are covered by it; only P-256 is tested directly to keep the fixture matrix lean (per maintainer review feedback). - Disabled-backend skip entries in `tests/session_fixture.c` for the new certificate algorithms. - Preserved the existing ed25519 certificate test path. Fixes #2434 Follow-up to6036e57720#2513 Follow-up to65a276e8fe#2064 Closes #2539
28 lines
1.8 KiB
Plaintext
28 lines
1.8 KiB
Plaintext
-----BEGIN OPENSSH PRIVATE KEY-----
|
|
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
|
|
NhAAAAAwEAAQAAAQEA0PjSC7sc64NaOaHHj8gYIcTIAKavjCo+9eEATejbkTxCK7QuKyTr
|
|
k8T4+wZsaqHaGCci5SB+4YsVHbe0LmDkizCh8Kf1uergo/MFXVn4hS72cotv9eJ/+Eqy1i
|
|
J3BciSIDqtiS5MxGd8dg+L789jXmraKT5UKvNjjbzZ8MU/m34EGlqgDV51ylDQI79i+AQC
|
|
3YfwT/KbiALa1anDqzmu3A/qVtqx2ymbta5131IxMZtNgCwpx645MiIs/nl4CRTEkV/S4s
|
|
pwTLx2njWSdEbA6MrPqyDVGRwZOutqvns7uYIDhzeT4aPs+FJNdR5zpqR6keO3/0wyTeDJ
|
|
FehzJtWD6QAAA8iMaN+sjGjfrAAAAAdzc2gtcnNhAAABAQDQ+NILuxzrg1o5ocePyBghxM
|
|
gApq+MKj714QBN6NuRPEIrtC4rJOuTxPj7BmxqodoYJyLlIH7hixUdt7QuYOSLMKHwp/W5
|
|
6uCj8wVdWfiFLvZyi2/14n/4SrLWIncFyJIgOq2JLkzEZ3x2D4vvz2NeatopPlQq82ONvN
|
|
nwxT+bfgQaWqANXnXKUNAjv2L4BALdh/BP8puIAtrVqcOrOa7cD+pW2rHbKZu1rnXfUjEx
|
|
m02ALCnHrjkyIiz+eXgJFMSRX9LiynBMvHaeNZJ0RsDoys+rINUZHBk662q+ezu5ggOHN5
|
|
Pho+z4Uk11HnOmpHqR47f/TDJN4MkV6HMm1YPpAAAAAwEAAQAAAQAENwaWj7w8OFqnJ68U
|
|
pHivIq7Vi4cmLLp3H2YQDDq0hdqAUuqs+lpJkVsjxgwFBRV28AAlTrfccP+YqTpIRrJJZ+
|
|
5WQi8DxFvqVqYkrUJE3m8AXbVhCGPkJE6R4OFVc6eV4JUcO5u3CO7S20qraDuU/ZL/qrcM
|
|
JDtdciITuAjJyDIwjmB8PZymLlAiw7Ch8xK2RJ5p1/kre2n5XmIzgKsHHFeByTAVt4OmCj
|
|
HcfI2JA6FhWkdRYIxwLjTGr7ziGQD+PDTohopE8wy3VxLlPUThQ9+8IskWV0VNKQofpxbE
|
|
5NyHd6vTTnQmrA7AOgVT2QVEG+vLyZ9xBaUXsF6Re+ExAAAAgQCQ8XoeS7J9zKLvPPwjA7
|
|
AxxqRC4EfxE+/1Bd4vsnkspxgzy2nvvjFyHf3ogDzVJitNmEi54mhwkxvvq64xJrEHwUCf
|
|
xJwXrH6PD7wcHBTcMyTrsBp0rJOGzrCHqOY7UKLh/6lQ+kfLE7aGhqCJYmjo91HFh68lVq
|
|
G9zJzNj1iVygAAAIEA9TXbRdZonoGjDAZ6jKQ7ocjWr3uGBoMBhcnXZ8yhq+cFIte2oISG
|
|
tjM+tf59fFzw+3DHznU57nr8FmMvyYI2Ly3p3302kD/mEKDDN1Q9NbA8bGuuwYHo2ib0Hq
|
|
sqsLjXc2UcEbZh3rg077qJ8bzBcMSuCkTIs4MfyPebZEnMjLkAAACBANoqwrDt5+TtzyLT
|
|
THVfDEzG30MECgEd+L8xLZXequNPzJDoMLSE4PGN/Wjvr+G5QQMGL7g6AXwUZPcJMIpRuw
|
|
EdzLumLLdPXz0TWORS9p0/0V8O1Pi4LMFa1Fu/zdvijOYa2srF8RaHiVMee4OoaMo0yKn7
|
|
/OcTjhGawwvwPfixAAAAC2NhX2hvc3RfcnNhAQIDBAUGBw==
|
|
-----END OPENSSH PRIVATE KEY-----
|