From 6eefda74f445e23d20f1fa8f846addb1db8f44e5 Mon Sep 17 00:00:00 2001 From: Damien Miller Date: Thu, 17 Jan 2013 23:00:02 +0000 Subject: add support for Key Revocation Lists (KRLs). These are a compact way to represent lists of revoked keys and certificates, taking as little as a single bit of incremental cost to revoke a certificate by serial number. KRLs are loaded via the existing RevokedKeys sshd_config option. feedback and ok markus@ --- usr.bin/ssh/key.c | 40 +++++++++++++++++++++++++--------------- 1 file changed, 25 insertions(+), 15 deletions(-) (limited to 'usr.bin/ssh/key.c') diff --git a/usr.bin/ssh/key.c b/usr.bin/ssh/key.c index 62ed607713c..126bd398298 100644 --- a/usr.bin/ssh/key.c +++ b/usr.bin/ssh/key.c @@ -1,4 +1,4 @@ -/* $OpenBSD: key.c,v 1.99 2012/05/23 03:28:28 djm Exp $ */ +/* $OpenBSD: key.c,v 1.100 2013/01/17 23:00:01 djm Exp $ */ /* * read_bignum(): * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -51,6 +51,8 @@ #include "misc.h" #include "ssh2.h" +static int to_blob(const Key *, u_char **, u_int *, int); + static struct KeyCert * cert_new(void) { @@ -312,14 +314,15 @@ key_equal(const Key *a, const Key *b) } u_char* -key_fingerprint_raw(Key *k, enum fp_type dgst_type, u_int *dgst_raw_length) +key_fingerprint_raw(const Key *k, enum fp_type dgst_type, + u_int *dgst_raw_length) { const EVP_MD *md = NULL; EVP_MD_CTX ctx; u_char *blob = NULL; u_char *retval = NULL; u_int len = 0; - int nlen, elen, otype; + int nlen, elen; *dgst_raw_length = 0; @@ -357,10 +360,7 @@ key_fingerprint_raw(Key *k, enum fp_type dgst_type, u_int *dgst_raw_length) case KEY_ECDSA_CERT: case KEY_RSA_CERT: /* We want a fingerprint of the _key_ not of the cert */ - otype = k->type; - k->type = key_type_plain(k->type); - key_to_blob(k, &blob, &len); - k->type = otype; + to_blob(k, &blob, &len, 1); break; case KEY_UNSPEC: return retval; @@ -1530,18 +1530,19 @@ key_from_blob(const u_char *blob, u_int blen) return key; } -int -key_to_blob(const Key *key, u_char **blobp, u_int *lenp) +static int +to_blob(const Key *key, u_char **blobp, u_int *lenp, int force_plain) { Buffer b; - int len; + int len, type; if (key == NULL) { error("key_to_blob: key == NULL"); return 0; } buffer_init(&b); - switch (key->type) { + type = force_plain ? key_type_plain(key->type) : key->type; + switch (type) { case KEY_DSA_CERT_V00: case KEY_RSA_CERT_V00: case KEY_DSA_CERT: @@ -1552,20 +1553,23 @@ key_to_blob(const Key *key, u_char **blobp, u_int *lenp) buffer_len(&key->cert->certblob)); break; case KEY_DSA: - buffer_put_cstring(&b, key_ssh_name(key)); + buffer_put_cstring(&b, + key_ssh_name_from_type_nid(type, key->ecdsa_nid)); buffer_put_bignum2(&b, key->dsa->p); buffer_put_bignum2(&b, key->dsa->q); buffer_put_bignum2(&b, key->dsa->g); buffer_put_bignum2(&b, key->dsa->pub_key); break; case KEY_ECDSA: - buffer_put_cstring(&b, key_ssh_name(key)); + buffer_put_cstring(&b, + key_ssh_name_from_type_nid(type, key->ecdsa_nid)); buffer_put_cstring(&b, key_curve_nid_to_name(key->ecdsa_nid)); buffer_put_ecpoint(&b, EC_KEY_get0_group(key->ecdsa), EC_KEY_get0_public_key(key->ecdsa)); break; case KEY_RSA: - buffer_put_cstring(&b, key_ssh_name(key)); + buffer_put_cstring(&b, + key_ssh_name_from_type_nid(type, key->ecdsa_nid)); buffer_put_bignum2(&b, key->rsa->e); buffer_put_bignum2(&b, key->rsa->n); break; @@ -1586,6 +1590,12 @@ key_to_blob(const Key *key, u_char **blobp, u_int *lenp) return len; } +int +key_to_blob(const Key *key, u_char **blobp, u_int *lenp) +{ + return to_blob(key, blobp, lenp, 0); +} + int key_sign( const Key *key, @@ -1957,7 +1967,7 @@ key_cert_check_authority(const Key *k, int want_host, int require_principal, } int -key_cert_is_legacy(Key *k) +key_cert_is_legacy(const Key *k) { switch (k->type) { case KEY_DSA_CERT_V00: -- cgit v1.2.3