libssh 0.9.5 The SSH library

pki.h
1/*
2 * This file is part of the SSH Library
3 *
4 * Copyright (c) 2010 by Aris Adamantiadis
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
19 */
20
21#ifndef PKI_H_
22#define PKI_H_
23
24#include "libssh/priv.h"
25#ifdef HAVE_OPENSSL_EC_H
26#include <openssl/ec.h>
27#endif
28#ifdef HAVE_OPENSSL_ECDSA_H
29#include <openssl/ecdsa.h>
30#endif
31
32#include "libssh/crypto.h"
33#ifdef HAVE_OPENSSL_ED25519
34/* If using OpenSSL implementation, define the signature lenght which would be
35 * defined in libssh/ed25519.h otherwise */
36#define ED25519_SIG_LEN 64
37#else
38#include "libssh/ed25519.h"
39#endif
40/* This definition is used for both OpenSSL and internal implementations */
41#define ED25519_KEY_LEN 32
42
43#define MAX_PUBKEY_SIZE 0x100000 /* 1M */
44#define MAX_PRIVKEY_SIZE 0x400000 /* 4M */
45
46#define SSH_KEY_FLAG_EMPTY 0x0
47#define SSH_KEY_FLAG_PUBLIC 0x0001
48#define SSH_KEY_FLAG_PRIVATE 0x0002
49
50 struct ssh_key_struct {
51 enum ssh_keytypes_e type;
52 int flags;
53 const char *type_c; /* Don't free it ! it is static */
54 int ecdsa_nid;
55#if defined(HAVE_LIBGCRYPT)
56 gcry_sexp_t dsa;
57 gcry_sexp_t rsa;
58 gcry_sexp_t ecdsa;
59#elif defined(HAVE_LIBMBEDCRYPTO)
60 mbedtls_pk_context *rsa;
61 mbedtls_ecdsa_context *ecdsa;
62 void *dsa;
63#elif defined(HAVE_LIBCRYPTO)
64 DSA *dsa;
65 RSA *rsa;
66# if defined(HAVE_OPENSSL_ECC)
67 EC_KEY *ecdsa;
68# else
69 void *ecdsa;
70# endif /* HAVE_OPENSSL_EC_H */
71#endif /* HAVE_LIBGCRYPT */
72#ifdef HAVE_OPENSSL_ED25519
73 uint8_t *ed25519_pubkey;
74 uint8_t *ed25519_privkey;
75#else
76 ed25519_pubkey *ed25519_pubkey;
77 ed25519_privkey *ed25519_privkey;
78#endif
79 void *cert;
80 enum ssh_keytypes_e cert_type;
81};
82
83 struct ssh_signature_struct {
84 enum ssh_keytypes_e type;
85 enum ssh_digest_e hash_type;
86 const char *type_c;
87#if defined(HAVE_LIBGCRYPT)
88 gcry_sexp_t dsa_sig;
89 gcry_sexp_t rsa_sig;
90 gcry_sexp_t ecdsa_sig;
91#elif defined(HAVE_LIBMBEDCRYPTO)
92 ssh_string rsa_sig;
93 struct mbedtls_ecdsa_sig ecdsa_sig;
94#endif /* HAVE_LIBGCRYPT */
95#ifndef HAVE_OPENSSL_ED25519
96 ed25519_signature *ed25519_sig;
97#endif
98 ssh_string raw_sig;
99};
100
101 typedef struct ssh_signature_struct *ssh_signature;
102
103/* SSH Key Functions */
104 ssh_key ssh_key_dup(const ssh_key key);
105 void ssh_key_clean (ssh_key key);
106
107 const char *
108 ssh_key_get_signature_algorithm(ssh_session session,
109 enum ssh_keytypes_e type);
110 enum ssh_keytypes_e ssh_key_type_from_signature_name(const char *name);
111 enum ssh_keytypes_e ssh_key_type_plain(enum ssh_keytypes_e type);
112 enum ssh_digest_e ssh_key_type_to_hash(ssh_session session,
113 enum ssh_keytypes_e type);
114 enum ssh_digest_e ssh_key_hash_from_name(const char *name);
115
116#define is_ecdsa_key_type(t) \
117 ((t) >= SSH_KEYTYPE_ECDSA_P256 && (t) <= SSH_KEYTYPE_ECDSA_P521)
118
119#define is_cert_type(kt)\
120 ((kt) == SSH_KEYTYPE_DSS_CERT01 ||\
121 (kt) == SSH_KEYTYPE_RSA_CERT01 ||\
122 ((kt) >= SSH_KEYTYPE_ECDSA_P256_CERT01 &&\
123 (kt) <= SSH_KEYTYPE_ED25519_CERT01))
124
125/* SSH Signature Functions */
126 ssh_signature ssh_signature_new(void);
127 void ssh_signature_free(ssh_signature sign);
128
129 int ssh_pki_export_signature_blob(const ssh_signature sign,
130 ssh_string *sign_blob);
131 int ssh_pki_import_signature_blob(const ssh_string sig_blob,
132 const ssh_key pubkey,
133 ssh_signature *psig);
134 int ssh_pki_signature_verify(ssh_session session,
135 ssh_signature sig,
136 const ssh_key key,
137 const unsigned char *digest,
138 size_t dlen);
139
140/* SSH Public Key Functions */
141 int ssh_pki_export_pubkey_blob(const ssh_key key,
142 ssh_string *pblob);
143 int ssh_pki_import_pubkey_blob(const ssh_string key_blob,
144 ssh_key *pkey);
145
146 int ssh_pki_import_cert_blob(const ssh_string cert_blob,
147 ssh_key *pkey);
148
149
150/* SSH Signing Functions */
151 ssh_string ssh_pki_do_sign(ssh_session session, ssh_buffer sigbuf,
152 const ssh_key privatekey, enum ssh_digest_e hash_type);
153 ssh_string ssh_pki_do_sign_agent(ssh_session session,
154 struct ssh_buffer_struct *buf,
155 const ssh_key pubkey);
156 ssh_string ssh_srv_pki_do_sign_sessionid(ssh_session session,
157 const ssh_key privkey,
158 const enum ssh_digest_e digest);
159
160/* Temporary functions, to be removed after migration to ssh_key */
161 ssh_public_key ssh_pki_convert_key_to_publickey(const ssh_key key);
162 ssh_private_key ssh_pki_convert_key_to_privatekey(const ssh_key key);
163
164 int ssh_key_algorithm_allowed(ssh_session session, const char *type);
165#endif /* PKI_H_ */
ssh_key_type_to_hash
enum ssh_digest_e ssh_key_type_to_hash(ssh_session session, enum ssh_keytypes_e type)
Convert a key type to a hash type. This is usually unambiguous for all the key types,...
Definition: pki.c:390
ssh_key_type_plain
enum ssh_keytypes_e ssh_key_type_plain(enum ssh_keytypes_e type)
Get the pubic key type corresponding to a certificate type.
Definition: pki.c:559
ssh_key_type_from_signature_name
enum ssh_keytypes_e ssh_key_type_from_signature_name(const char *name)
Convert a ssh key algorithm name to a ssh key algorithm type.
Definition: pki.c:491
ssh_key_algorithm_allowed
int ssh_key_algorithm_allowed(ssh_session session, const char *type)
Checks the given key against the configured allowed public key algorithm types.
Definition: pki.c:347
ssh_key_clean
void ssh_key_clean(ssh_key key)
clean up the key and deallocate all existing keys
Definition: pki.c:140
ssh_key_get_signature_algorithm
const char * ssh_key_get_signature_algorithm(ssh_session session, enum ssh_keytypes_e type)
Gets signature algorithm name to be used with the given key type.
Definition: pki.c:459
ssh_buffer_struct
Definition: buffer.c:47
ssh_key_struct
Definition: pki.h:50
ssh_private_key_struct
Definition: keys.h:43
ssh_public_key_struct
Definition: keys.h:28
ssh_session_struct
Definition: session.h:109
ssh_signature_struct
Definition: pki.h:83
ssh_string_struct
Definition: string.h:29