libssh  0.8.91
The SSH library
pki.h
1 /*
2  * This file is part of the SSH Library
3  *
4  * Copyright (c) 2010 by Aris Adamantiadis
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, write to the Free Software
18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19  */
20 
21 #ifndef PKI_H_
22 #define PKI_H_
23 
24 #include "libssh/priv.h"
25 #ifdef HAVE_OPENSSL_EC_H
26 #include <openssl/ec.h>
27 #endif
28 #ifdef HAVE_OPENSSL_ECDSA_H
29 #include <openssl/ecdsa.h>
30 #endif
31 
32 #include "libssh/crypto.h"
33 #include "libssh/ed25519.h"
34 
35 #define MAX_PUBKEY_SIZE 0x100000 /* 1M */
36 #define MAX_PRIVKEY_SIZE 0x400000 /* 4M */
37 
38 #define SSH_KEY_FLAG_EMPTY 0x0
39 #define SSH_KEY_FLAG_PUBLIC 0x0001
40 #define SSH_KEY_FLAG_PRIVATE 0x0002
41 
43  enum ssh_keytypes_e type;
44  int flags;
45  const char *type_c; /* Don't free it ! it is static */
46  int ecdsa_nid;
47 #if defined(HAVE_LIBGCRYPT)
48  gcry_sexp_t dsa;
49  gcry_sexp_t rsa;
50  gcry_sexp_t ecdsa;
51 #elif defined(HAVE_LIBMBEDCRYPTO)
52  mbedtls_pk_context *rsa;
53  mbedtls_ecdsa_context *ecdsa;
54  void *dsa;
55 #elif defined(HAVE_LIBCRYPTO)
56  DSA *dsa;
57  RSA *rsa;
58 # if defined(HAVE_OPENSSL_ECC)
59  EC_KEY *ecdsa;
60 # else
61  void *ecdsa;
62 # endif /* HAVE_OPENSSL_EC_H */
63 #endif /* HAVE_LIBGCRYPT */
64  ed25519_pubkey *ed25519_pubkey;
65  ed25519_privkey *ed25519_privkey;
66  void *cert;
67  enum ssh_keytypes_e cert_type;
68 };
69 
71  enum ssh_keytypes_e type;
72  enum ssh_digest_e hash_type;
73  const char *type_c;
74 #if defined(HAVE_LIBGCRYPT)
75  gcry_sexp_t dsa_sig;
76  gcry_sexp_t rsa_sig;
77  gcry_sexp_t ecdsa_sig;
78 #elif defined(HAVE_LIBMBEDCRYPTO)
79  ssh_string rsa_sig;
80  struct mbedtls_ecdsa_sig ecdsa_sig;
81 #endif /* HAVE_LIBGCRYPT */
82  ed25519_signature *ed25519_sig;
83  ssh_string raw_sig;
84 };
85 
86 typedef struct ssh_signature_struct *ssh_signature;
87 
88 /* SSH Key Functions */
89 ssh_key ssh_key_dup(const ssh_key key);
90 void ssh_key_clean (ssh_key key);
91 
92 const char *
94  enum ssh_keytypes_e type);
95 enum ssh_keytypes_e ssh_key_type_from_signature_name(const char *name);
96 enum ssh_keytypes_e ssh_key_type_plain(enum ssh_keytypes_e type);
97 enum ssh_digest_e ssh_key_type_to_hash(ssh_session session,
98  enum ssh_keytypes_e type);
99 
100 #define is_ecdsa_key_type(t) \
101  ((t) >= SSH_KEYTYPE_ECDSA_P256 && (t) <= SSH_KEYTYPE_ECDSA_P521)
102 
103 #define is_cert_type(kt)\
104  ((kt) == SSH_KEYTYPE_DSS_CERT01 ||\
105  (kt) == SSH_KEYTYPE_RSA_CERT01 ||\
106  ((kt) >= SSH_KEYTYPE_ECDSA_P256_CERT01 &&\
107  (kt) <= SSH_KEYTYPE_ED25519_CERT01))
108 
109 /* SSH Signature Functions */
110 ssh_signature ssh_signature_new(void);
111 void ssh_signature_free(ssh_signature sign);
112 
113 int ssh_pki_export_signature_blob(const ssh_signature sign,
114  ssh_string *sign_blob);
115 int ssh_pki_import_signature_blob(const ssh_string sig_blob,
116  const ssh_key pubkey,
117  ssh_signature *psig);
118 int ssh_pki_signature_verify(ssh_session session,
119  ssh_signature sig,
120  const ssh_key key,
121  unsigned char *digest,
122  size_t dlen);
123 
124 /* SSH Public Key Functions */
125 int ssh_pki_export_pubkey_blob(const ssh_key key,
126  ssh_string *pblob);
127 int ssh_pki_import_pubkey_blob(const ssh_string key_blob,
128  ssh_key *pkey);
129 
130 int ssh_pki_import_cert_blob(const ssh_string cert_blob,
131  ssh_key *pkey);
132 
133 
134 /* SSH Signing Functions */
135 ssh_string ssh_pki_do_sign(ssh_session session, ssh_buffer sigbuf,
136  const ssh_key privatekey, enum ssh_digest_e hash_type);
137 ssh_string ssh_pki_do_sign_agent(ssh_session session,
138  struct ssh_buffer_struct *buf,
139  const ssh_key pubkey);
140 ssh_string ssh_srv_pki_do_sign_sessionid(ssh_session session,
141  const ssh_key privkey);
142 
143 /* Temporary functions, to be removed after migration to ssh_key */
144 ssh_public_key ssh_pki_convert_key_to_publickey(const ssh_key key);
145 ssh_private_key ssh_pki_convert_key_to_privatekey(const ssh_key key);
146 
147 int ssh_key_algorithm_allowed(ssh_session session, const char *type);
148 #endif /* PKI_H_ */
Definition: pki.h:42
enum ssh_keytypes_e ssh_key_type_from_signature_name(const char *name)
Convert a ssh key algorithm name to a ssh key algorithm type.
Definition: pki.c:450
enum ssh_digest_e ssh_key_type_to_hash(ssh_session session, enum ssh_keytypes_e type)
Convert a key type to a hash type. This is usually unambiguous for all the key types, unless the SHA2 extension (RFC 8332) is negotiated during key exchange.
Definition: pki.c:377
Definition: session.h:109
const char * ssh_key_get_signature_algorithm(ssh_session session, enum ssh_keytypes_e type)
Gets signature algorithm name to be used with the given key type.
Definition: pki.c:433
Definition: keys.h:28
Definition: string.h:29
void ssh_key_clean(ssh_key key)
clean up the key and deallocate all existing keys
Definition: pki.c:134
int ssh_key_algorithm_allowed(ssh_session session, const char *type)
Checks the given key against the configured allowed public key algorithm types.
Definition: pki.c:334
Definition: pki.h:70
Definition: keys.h:43
enum ssh_keytypes_e ssh_key_type_plain(enum ssh_keytypes_e type)
Get the pubic key type corresponding to a certificate type.
Definition: pki.c:518
Definition: buffer.c:47