1 /* 2 * This file is part of the SSH Library 3 * 4 * Copyright (c) 2010 by Aris Adamantiadis 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2.1 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, write to the Free Software 18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19 */ 20 21 #ifndef PKI_H_ 22 #define PKI_H_ 23 24 #include "libssh/priv.h" 25 #ifdef HAVE_OPENSSL_EC_H 26 #include <openssl/ec.h> 27 #endif 28 #ifdef HAVE_OPENSSL_ECDSA_H 29 #include <openssl/ecdsa.h> 30 #endif 31 32 #include "libssh/crypto.h" 33 #ifdef HAVE_OPENSSL_ED25519 34 /* If using OpenSSL implementation, define the signature lenght which would be 35 * defined in libssh/ed25519.h otherwise */ 36 #define ED25519_SIG_LEN 64 37 #else 38 #include "libssh/ed25519.h" 39 #endif 40 /* This definition is used for both OpenSSL and internal implementations */ 41 #define ED25519_KEY_LEN 32 42 43 #define MAX_PUBKEY_SIZE 0x100000 /* 1M */ 44 #define MAX_PRIVKEY_SIZE 0x400000 /* 4M */ 45 46 #define SSH_KEY_FLAG_EMPTY 0x0 47 #define SSH_KEY_FLAG_PUBLIC 0x0001 48 #define SSH_KEY_FLAG_PRIVATE 0x0002 49 50 struct ssh_key_struct { 51 enum ssh_keytypes_e type; 52 int flags; 53 const char *type_c; /* Don't free it ! it is static */ 54 int ecdsa_nid; 55 #if defined(HAVE_LIBGCRYPT) 56 gcry_sexp_t dsa; 57 gcry_sexp_t rsa; 58 gcry_sexp_t ecdsa; 59 #elif defined(HAVE_LIBMBEDCRYPTO) 60 mbedtls_pk_context *rsa; 61 mbedtls_ecdsa_context *ecdsa; 62 void *dsa; 63 #elif defined(HAVE_LIBCRYPTO) 64 DSA *dsa; 65 RSA *rsa; 66 # if defined(HAVE_OPENSSL_ECC) 67 EC_KEY *ecdsa; 68 # else 69 void *ecdsa; 70 # endif /* HAVE_OPENSSL_EC_H */ 71 #endif /* HAVE_LIBGCRYPT */ 72 #ifdef HAVE_OPENSSL_ED25519 73 uint8_t *ed25519_pubkey; 74 uint8_t *ed25519_privkey; 75 #else 76 ed25519_pubkey *ed25519_pubkey; 77 ed25519_privkey *ed25519_privkey; 78 #endif 79 void *cert; 80 enum ssh_keytypes_e cert_type; 81 }; 82 83 struct ssh_signature_struct { 84 enum ssh_keytypes_e type; 85 enum ssh_digest_e hash_type; 86 const char *type_c; 87 #if defined(HAVE_LIBGCRYPT) 88 gcry_sexp_t dsa_sig; 89 gcry_sexp_t rsa_sig; 90 gcry_sexp_t ecdsa_sig; 91 #elif defined(HAVE_LIBMBEDCRYPTO) 92 ssh_string rsa_sig; 93 struct mbedtls_ecdsa_sig ecdsa_sig; 94 #endif /* HAVE_LIBGCRYPT */ 95 #ifndef HAVE_OPENSSL_ED25519 96 ed25519_signature *ed25519_sig; 97 #endif 98 ssh_string raw_sig; 99 }; 100 101 typedef struct ssh_signature_struct *ssh_signature; 102 103 /* SSH Key Functions */ 104 ssh_key ssh_key_dup(const ssh_key key); 105 void ssh_key_clean (ssh_key key); 106 107 const char * 108 ssh_key_get_signature_algorithm(ssh_session session, 109 enum ssh_keytypes_e type); 110 enum ssh_keytypes_e ssh_key_type_from_signature_name(const char *name); 111 enum ssh_keytypes_e ssh_key_type_plain(enum ssh_keytypes_e type); 112 enum ssh_digest_e ssh_key_type_to_hash(ssh_session session, 113 enum ssh_keytypes_e type); 114 enum ssh_digest_e ssh_key_hash_from_name(const char *name); 115 116 #define is_ecdsa_key_type(t) \ 117 ((t) >= SSH_KEYTYPE_ECDSA_P256 && (t) <= SSH_KEYTYPE_ECDSA_P521) 118 119 #define is_cert_type(kt)\ 120 ((kt) == SSH_KEYTYPE_DSS_CERT01 ||\ 121 (kt) == SSH_KEYTYPE_RSA_CERT01 ||\ 122 ((kt) >= SSH_KEYTYPE_ECDSA_P256_CERT01 &&\ 123 (kt) <= SSH_KEYTYPE_ED25519_CERT01)) 124 125 /* SSH Signature Functions */ 126 ssh_signature ssh_signature_new(void); 127 void ssh_signature_free(ssh_signature sign); 128 #define SSH_SIGNATURE_FREE(x) \ 129 do { ssh_signature_free(x); x = NULL; } while(0) 130 131 int ssh_pki_export_signature_blob(const ssh_signature sign, 132 ssh_string *sign_blob); 133 int ssh_pki_import_signature_blob(const ssh_string sig_blob, 134 const ssh_key pubkey, 135 ssh_signature *psig); 136 int ssh_pki_signature_verify(ssh_session session, 137 ssh_signature sig, 138 const ssh_key key, 139 const unsigned char *digest, 140 size_t dlen); 141 142 /* SSH Public Key Functions */ 143 int ssh_pki_export_pubkey_blob(const ssh_key key, 144 ssh_string *pblob); 145 int ssh_pki_import_pubkey_blob(const ssh_string key_blob, 146 ssh_key *pkey); 147 148 int ssh_pki_import_cert_blob(const ssh_string cert_blob, 149 ssh_key *pkey); 150 151 152 /* SSH Signing Functions */ 153 ssh_string ssh_pki_do_sign(ssh_session session, ssh_buffer sigbuf, 154 const ssh_key privatekey, enum ssh_digest_e hash_type); 155 ssh_string ssh_pki_do_sign_agent(ssh_session session, 156 struct ssh_buffer_struct *buf, 157 const ssh_key pubkey); 158 ssh_string ssh_srv_pki_do_sign_sessionid(ssh_session session, 159 const ssh_key privkey, 160 const enum ssh_digest_e digest); 161 162 /* Temporary functions, to be removed after migration to ssh_key */ 163 ssh_public_key ssh_pki_convert_key_to_publickey(const ssh_key key); 164 ssh_private_key ssh_pki_convert_key_to_privatekey(const ssh_key key); 165 166 int ssh_key_algorithm_allowed(ssh_session session, const char *type); 167 #endif /* PKI_H_ */ 168