version 1.430, 2021/07/05 01:16:46 |
version 1.432, 2021/07/23 03:37:52 |
|
|
} |
} |
|
|
static int |
static int |
|
sig_process_opts(char * const *opts, size_t nopts, uint64_t *verify_timep) |
|
{ |
|
size_t i; |
|
time_t now; |
|
|
|
*verify_timep = 0; |
|
for (i = 0; i < nopts; i++) { |
|
if (strncasecmp(opts[i], "verify-time=", 12) == 0) { |
|
if (parse_absolute_time(opts[i] + 12, |
|
verify_timep) != 0 || *verify_timep == 0) { |
|
error("Invalid \"verify-time\" option"); |
|
return SSH_ERR_INVALID_ARGUMENT; |
|
} |
|
} else { |
|
error("Invalid option \"%s\"", opts[i]); |
|
return SSH_ERR_INVALID_ARGUMENT; |
|
} |
|
} |
|
if (*verify_timep == 0) { |
|
if ((now = time(NULL)) < 0) { |
|
error("Time is before epoch"); |
|
return SSH_ERR_INVALID_ARGUMENT; |
|
} |
|
*verify_timep = (uint64_t)now; |
|
} |
|
return 0; |
|
} |
|
|
|
static int |
sig_verify(const char *signature, const char *sig_namespace, |
sig_verify(const char *signature, const char *sig_namespace, |
const char *principal, const char *allowed_keys, const char *revoked_keys) |
const char *principal, const char *allowed_keys, const char *revoked_keys, |
|
char * const *opts, size_t nopts) |
{ |
{ |
int r, ret = -1; |
int r, ret = -1; |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
struct sshkey *sign_key = NULL; |
struct sshkey *sign_key = NULL; |
char *fp = NULL; |
char *fp = NULL; |
struct sshkey_sig_details *sig_details = NULL; |
struct sshkey_sig_details *sig_details = NULL; |
|
uint64_t verify_time = 0; |
|
|
|
if (sig_process_opts(opts, nopts, &verify_time) != 0) |
|
goto done; /* error already logged */ |
|
|
memset(&sig_details, 0, sizeof(sig_details)); |
memset(&sig_details, 0, sizeof(sig_details)); |
if ((r = sshbuf_load_file(signature, &abuf)) != 0) { |
if ((r = sshbuf_load_file(signature, &abuf)) != 0) { |
error_r(r, "Couldn't read signature file"); |
error_r(r, "Couldn't read signature file"); |
|
|
} |
} |
|
|
if (allowed_keys != NULL && (r = sshsig_check_allowed_keys(allowed_keys, |
if (allowed_keys != NULL && (r = sshsig_check_allowed_keys(allowed_keys, |
sign_key, principal, sig_namespace)) != 0) { |
sign_key, principal, sig_namespace, verify_time)) != 0) { |
debug3_fr(r, "sshsig_check_allowed_keys"); |
debug3_fr(r, "sshsig_check_allowed_keys"); |
goto done; |
goto done; |
} |
} |
|
|
} |
} |
|
|
static int |
static int |
sig_find_principals(const char *signature, const char *allowed_keys) { |
sig_find_principals(const char *signature, const char *allowed_keys, |
|
char * const *opts, size_t nopts) |
|
{ |
int r, ret = -1; |
int r, ret = -1; |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
struct sshkey *sign_key = NULL; |
struct sshkey *sign_key = NULL; |
char *principals = NULL, *cp, *tmp; |
char *principals = NULL, *cp, *tmp; |
|
uint64_t verify_time = 0; |
|
|
|
if (sig_process_opts(opts, nopts, &verify_time) != 0) |
|
goto done; /* error already logged */ |
|
|
if ((r = sshbuf_load_file(signature, &abuf)) != 0) { |
if ((r = sshbuf_load_file(signature, &abuf)) != 0) { |
error_r(r, "Couldn't read signature file"); |
error_r(r, "Couldn't read signature file"); |
goto done; |
goto done; |
|
|
goto done; |
goto done; |
} |
} |
if ((r = sshsig_find_principals(allowed_keys, sign_key, |
if ((r = sshsig_find_principals(allowed_keys, sign_key, |
&principals)) != 0) { |
verify_time, &principals)) != 0) { |
error_fr(r, "sshsig_get_principal"); |
if (r != SSH_ERR_KEY_NOT_FOUND) |
|
error_fr(r, "sshsig_find_principal"); |
goto done; |
goto done; |
} |
} |
ret = 0; |
ret = 0; |
|
|
"missing allowed keys file"); |
"missing allowed keys file"); |
exit(1); |
exit(1); |
} |
} |
return sig_find_principals(ca_key_path, identity_file); |
return sig_find_principals(ca_key_path, identity_file, |
|
opts, nopts); |
} else if (strncmp(sign_op, "sign", 4) == 0) { |
} else if (strncmp(sign_op, "sign", 4) == 0) { |
if (cert_principals == NULL || |
if (cert_principals == NULL || |
*cert_principals == '\0') { |
*cert_principals == '\0') { |
|
|
exit(1); |
exit(1); |
} |
} |
return sig_verify(ca_key_path, cert_principals, |
return sig_verify(ca_key_path, cert_principals, |
NULL, NULL, NULL); |
NULL, NULL, NULL, opts, nopts); |
} else if (strncmp(sign_op, "verify", 6) == 0) { |
} else if (strncmp(sign_op, "verify", 6) == 0) { |
if (cert_principals == NULL || |
if (cert_principals == NULL || |
*cert_principals == '\0') { |
*cert_principals == '\0') { |
|
|
exit(1); |
exit(1); |
} |
} |
return sig_verify(ca_key_path, cert_principals, |
return sig_verify(ca_key_path, cert_principals, |
cert_key_id, identity_file, rr_hostname); |
cert_key_id, identity_file, rr_hostname, |
|
opts, nopts); |
} |
} |
error("Unsupported operation for -Y: \"%s\"", sign_op); |
error("Unsupported operation for -Y: \"%s\"", sign_op); |
usage(); |
usage(); |