Filippo Valsorda
1baeb1ce4c
The server implementation looks at the HostKeys to advertise and
negotiate host key signature algorithms. A fundamental issue of the
Signer and AlgorithmSigner interfaces is that they don't expose the
supported signature algorithms, so really the server has to guess.
Currently, it would guess exclusively based on the PublicKey.Type,
regardless of whether the host key implemented AlgorithmSigner. This
means that a legacy Signer that only supports ssh-rsa still led the
server to negotiate rsa-sha2 algorithms. The server would then fail to
find a suitable host key to make the signature and crash.
This won't happen if only Signers from this package are used, but if a
custom Signer that doesn't support SignWithAlgorithm() but returns
"ssh-rsa" from PublicKey().Type() is used as a HostKey, the server is
vulnerable to DoS.
The only workable rules to determine what to advertise seems to be:
1. a pure Signer will always Sign with the PublicKey.Type
2. an AlgorithmSigner supports all algorithms associated with the
PublicKey.Type
Rule number two means that we can't add new supported algorithms in the
future, which is not great, but it's too late to fix that.
rsaSigner was breaking rule number one, and although it would have been
fine where it's used, I didn't want to break our own interface contract.
It's unclear why we had separate test key entries for rsa-sha2
algorithms, since we can use the ssh-rsa key for those. The only test
that used them, TestCertTypes, seemed broken: the init was actually
failing at making the corresponding signers rsaSigners, and indeed the
test for the SHA-256 signer expected and checked a SHA-512 signature.
Pending CVE
For golang/go#49952
Change-Id: Ie658eefcadd87906e63fc7faae8249376aa96c79
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392355
Trust: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
64 lines
2.1 KiB
Go
64 lines
2.1 KiB
Go
// Copyright 2014 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
// IMPLEMENTATION NOTE: To avoid a package loop, this file is in three places:
|
|
// ssh/, ssh/agent, and ssh/test/. It should be kept in sync across all three
|
|
// instances.
|
|
|
|
package ssh
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"fmt"
|
|
|
|
"golang.org/x/crypto/ssh/testdata"
|
|
)
|
|
|
|
var (
|
|
testPrivateKeys map[string]interface{}
|
|
testSigners map[string]Signer
|
|
testPublicKeys map[string]PublicKey
|
|
)
|
|
|
|
func init() {
|
|
var err error
|
|
|
|
n := len(testdata.PEMBytes)
|
|
testPrivateKeys = make(map[string]interface{}, n)
|
|
testSigners = make(map[string]Signer, n)
|
|
testPublicKeys = make(map[string]PublicKey, n)
|
|
for t, k := range testdata.PEMBytes {
|
|
testPrivateKeys[t], err = ParseRawPrivateKey(k)
|
|
if err != nil {
|
|
panic(fmt.Sprintf("Unable to parse test key %s: %v", t, err))
|
|
}
|
|
testSigners[t], err = NewSignerFromKey(testPrivateKeys[t])
|
|
if err != nil {
|
|
panic(fmt.Sprintf("Unable to create signer for test key %s: %v", t, err))
|
|
}
|
|
testPublicKeys[t] = testSigners[t].PublicKey()
|
|
}
|
|
|
|
// Create a cert and sign it for use in tests.
|
|
testCert := &Certificate{
|
|
Nonce: []byte{}, // To pass reflect.DeepEqual after marshal & parse, this must be non-nil
|
|
ValidPrincipals: []string{"gopher1", "gopher2"}, // increases test coverage
|
|
ValidAfter: 0, // unix epoch
|
|
ValidBefore: CertTimeInfinity, // The end of currently representable time.
|
|
Reserved: []byte{}, // To pass reflect.DeepEqual after marshal & parse, this must be non-nil
|
|
Key: testPublicKeys["ecdsa"],
|
|
SignatureKey: testPublicKeys["rsa"],
|
|
Permissions: Permissions{
|
|
CriticalOptions: map[string]string{},
|
|
Extensions: map[string]string{},
|
|
},
|
|
}
|
|
testCert.SignCert(rand.Reader, testSigners["rsa"])
|
|
testPrivateKeys["cert"] = testPrivateKeys["ecdsa"]
|
|
testSigners["cert"], err = NewCertSigner(testCert, testSigners["ecdsa"])
|
|
if err != nil {
|
|
panic(fmt.Sprintf("Unable to create certificate signer: %v", err))
|
|
}
|
|
}
|