libssh  0.10.1
The SSH library
pki.h
1/*
2 * This file is part of the SSH Library
3 *
4 * Copyright (c) 2010 by Aris Adamantiadis
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21#ifndef PKI_H_
22#define PKI_H_
23
24#include <stdint.h>
25#include "libssh/priv.h"
26#ifdef HAVE_OPENSSL_EC_H
27#include <openssl/ec.h>
28#endif
29#ifdef HAVE_OPENSSL_ECDSA_H
30#include <openssl/ecdsa.h>
31#endif
32#ifdef HAVE_LIBCRYPTO
33#include <openssl/evp.h>
34#endif
35#include "libssh/crypto.h"
36#if defined(HAVE_LIBCRYPTO) && defined(HAVE_OPENSSL_ED25519)
37/* If using OpenSSL implementation, define the signature lenght which would be
38 * defined in libssh/ed25519.h otherwise */
39#define ED25519_SIG_LEN 64
40#else
41#include "libssh/ed25519.h"
42#endif
43/* This definition is used for both OpenSSL and internal implementations */
44#define ED25519_KEY_LEN 32
45
46#define MAX_PUBKEY_SIZE 0x100000 /* 1M */
47#define MAX_PRIVKEY_SIZE 0x400000 /* 4M */
48
49#define SSH_KEY_FLAG_EMPTY 0x0
50#define SSH_KEY_FLAG_PUBLIC 0x0001
51#define SSH_KEY_FLAG_PRIVATE 0x0002
52#define SSH_KEY_FLAG_PKCS11_URI 0x0004
53
55 enum ssh_keytypes_e type;
56 int flags;
57 const char *type_c; /* Don't free it ! it is static */
58 int ecdsa_nid;
59#if defined(HAVE_LIBGCRYPT)
60 gcry_sexp_t dsa;
61 gcry_sexp_t rsa;
62 gcry_sexp_t ecdsa;
63#elif defined(HAVE_LIBMBEDCRYPTO)
64 mbedtls_pk_context *rsa;
65 mbedtls_ecdsa_context *ecdsa;
66 void *dsa;
67#elif defined(HAVE_LIBCRYPTO)
68#if OPENSSL_VERSION_NUMBER < 0x30000000L
69 DSA *dsa;
70 RSA *rsa;
71#endif /* OPENSSL_VERSION_NUMBER */
72/* TODO Change to new API when the OpenSSL will support export of uncompressed EC keys
73 * https://github.com/openssl/openssl/pull/16624
74 * Move into the #if above
75 */
76# if defined(HAVE_OPENSSL_ECC)
77 EC_KEY *ecdsa;
78# else
79 void *ecdsa;
80# endif /* HAVE_OPENSSL_EC_H */
81 /* This holds either ENGINE key for PKCS#11 support or just key in
82 * high-level format required by OpenSSL 3.0 */
83 EVP_PKEY *key;
84#endif /* HAVE_LIBGCRYPT */
85#if defined(HAVE_LIBCRYPTO) && defined(HAVE_OPENSSL_ED25519)
86 uint8_t *ed25519_pubkey;
87 uint8_t *ed25519_privkey;
88#else
89 ed25519_pubkey *ed25519_pubkey;
90 ed25519_privkey *ed25519_privkey;
91#endif
92 ssh_string sk_application;
93 void *cert;
94 enum ssh_keytypes_e cert_type;
95};
96
98 enum ssh_keytypes_e type;
99 enum ssh_digest_e hash_type;
100 const char *type_c;
101#if defined(HAVE_LIBGCRYPT)
102 gcry_sexp_t dsa_sig;
103 gcry_sexp_t rsa_sig;
104 gcry_sexp_t ecdsa_sig;
105#elif defined(HAVE_LIBMBEDCRYPTO)
106 ssh_string rsa_sig;
107 struct mbedtls_ecdsa_sig ecdsa_sig;
108#endif /* HAVE_LIBGCRYPT */
109#if !defined(HAVE_LIBCRYPTO) || !defined(HAVE_OPENSSL_ED25519)
110 ed25519_signature *ed25519_sig;
111#endif
112 ssh_string raw_sig;
113
114 /* Security Key specific additions */
115 uint8_t sk_flags;
116 uint32_t sk_counter;
117};
118
119typedef struct ssh_signature_struct *ssh_signature;
120
121/* SSH Key Functions */
122void ssh_key_clean (ssh_key key);
123
124const char *
126 enum ssh_keytypes_e type);
127enum ssh_keytypes_e ssh_key_type_from_signature_name(const char *name);
128enum ssh_keytypes_e ssh_key_type_plain(enum ssh_keytypes_e type);
129enum ssh_digest_e ssh_key_type_to_hash(ssh_session session,
130 enum ssh_keytypes_e type);
131enum ssh_digest_e ssh_key_hash_from_name(const char *name);
132
133#define is_ecdsa_key_type(t) \
134 ((t) >= SSH_KEYTYPE_ECDSA_P256 && (t) <= SSH_KEYTYPE_ECDSA_P521)
135
136#define is_cert_type(kt)\
137 ((kt) == SSH_KEYTYPE_DSS_CERT01 ||\
138 (kt) == SSH_KEYTYPE_RSA_CERT01 ||\
139 (kt) == SSH_KEYTYPE_SK_ECDSA_CERT01 ||\
140 (kt) == SSH_KEYTYPE_SK_ED25519_CERT01 ||\
141 ((kt) >= SSH_KEYTYPE_ECDSA_P256_CERT01 &&\
142 (kt) <= SSH_KEYTYPE_ED25519_CERT01))
143
144/* SSH Signature Functions */
145ssh_signature ssh_signature_new(void);
146void ssh_signature_free(ssh_signature sign);
147#define SSH_SIGNATURE_FREE(x) \
148 do { ssh_signature_free(x); x = NULL; } while(0)
149
150int ssh_pki_export_signature_blob(const ssh_signature sign,
151 ssh_string *sign_blob);
152int ssh_pki_import_signature_blob(const ssh_string sig_blob,
153 const ssh_key pubkey,
154 ssh_signature *psig);
155int ssh_pki_signature_verify(ssh_session session,
156 ssh_signature sig,
157 const ssh_key key,
158 const unsigned char *digest,
159 size_t dlen);
160
161/* SSH Public Key Functions */
162int ssh_pki_export_pubkey_blob(const ssh_key key,
163 ssh_string *pblob);
164int ssh_pki_import_pubkey_blob(const ssh_string key_blob,
165 ssh_key *pkey);
166
167int ssh_pki_import_cert_blob(const ssh_string cert_blob,
168 ssh_key *pkey);
169
170
171/* SSH Signing Functions */
172ssh_string ssh_pki_do_sign(ssh_session session, ssh_buffer sigbuf,
173 const ssh_key privatekey, enum ssh_digest_e hash_type);
174ssh_string ssh_pki_do_sign_agent(ssh_session session,
175 struct ssh_buffer_struct *buf,
176 const ssh_key pubkey);
177ssh_string ssh_srv_pki_do_sign_sessionid(ssh_session session,
178 const ssh_key privkey,
179 const enum ssh_digest_e digest);
180
181/* Temporary functions, to be removed after migration to ssh_key */
182ssh_public_key ssh_pki_convert_key_to_publickey(const ssh_key key);
183ssh_private_key ssh_pki_convert_key_to_privatekey(const ssh_key key);
184
185int ssh_key_algorithm_allowed(ssh_session session, const char *type);
186bool ssh_key_size_allowed(ssh_session session, ssh_key key);
187
188/* Return the key size in bits */
189int ssh_key_size(ssh_key key);
190
191/* PKCS11 URI function to check if filename is a path or a PKCS11 URI */
192bool ssh_pki_is_uri(const char *filename);
193char *ssh_pki_export_pub_uri_from_priv_uri(const char *priv_uri);
194
195#endif /* PKI_H_ */
enum ssh_digest_e ssh_key_type_to_hash(ssh_session session, enum ssh_keytypes_e type)
Convert a key type to a hash type. This is usually unambiguous for all the key types,...
Definition: pki.c:440
enum ssh_keytypes_e ssh_key_type_plain(enum ssh_keytypes_e type)
Get the pubic key type corresponding to a certificate type.
Definition: pki.c:618
enum ssh_keytypes_e ssh_key_type_from_signature_name(const char *name)
Convert a ssh key algorithm name to a ssh key algorithm type.
Definition: pki.c:541
char * ssh_pki_export_pub_uri_from_priv_uri(const char *priv_uri)
export a Public PKCS #11 URI from a Private PKCS #11 URI by replacing "type=private" to "type=public"...
Definition: pki.c:1750
int ssh_key_algorithm_allowed(ssh_session session, const char *type)
Checks the given key against the configured allowed public key algorithm types.
Definition: pki.c:361
bool ssh_pki_is_uri(const char *filename)
Detect if the pathname in cmp is a PKCS #11 URI.
Definition: pki.c:1726
void ssh_key_clean(ssh_key key)
clean up the key and deallocate all existing keys
Definition: pki.c:153
const char * ssh_key_get_signature_algorithm(ssh_session session, enum ssh_keytypes_e type)
Gets signature algorithm name to be used with the given key type.
Definition: pki.c:509
bool ssh_key_size_allowed(ssh_session session, ssh_key key)
Check the given key is acceptable in regards to the key size policy specified by the configuration.
Definition: pki.c:415
Definition: buffer.c:47
Definition: pki.h:54
Definition: keys.h:47
Definition: keys.h:28
Definition: session.h:110
Definition: pki.h:97
Definition: string.h:29