Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix verification when key specifies hash algorithm #168

Open
wants to merge 7 commits into
base: develop
Choose a base branch
from
Open

Fix verification when key specifies hash algorithm #168

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
66271ed
Fix verification when key specifies hash algorithm
abeverley Feb 3, 2024
8323d34
Sanity check inputs to arc_parse_algorithm
abeverley Feb 4, 2024
00345b1
Check nid is correctly defined after algorithm parse
abeverley Feb 4, 2024
6be659f
Handle missing algorithm gracefully
abeverley Feb 4, 2024
8499dc6
Check status from arc_parse_algorithm
abeverley Feb 4, 2024
6edc760
Simplifed error handling
abeverley Feb 5, 2024
043a8d1
Add assert for function input
abeverley Feb 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
75 changes: 65 additions & 10 deletions libopenarc/arc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,6 +289,57 @@ arc_key_hashesok(ARC_LIB *lib, u_char *hashlist)
/* NOTREACHED */
}

/*
** ARC_PARSE_ALGORITHM -- parse an algorithm and set the msg hash and key,
** as well as set the message digest algorithm for
** RSA_verify in the variable nid
**
** Parameters:
** msg -- ARC_MESSAGE handle
** alg -- string containing the algorithm to parse
** nid -- variable to write the message digest algorithm
**
** Return value:
** An ARC_STAT_* constant.
*/

ARC_STAT
arc_parse_algorithm(ARC_MESSAGE *msg, u_char *alg, int *nid)
{
arc_alg_t algtype;

assert(msg != NULL);
assert(nid != NULL);

if (alg == NULL)
{
arc_error(msg, "missing algorithm passed to arc_parse_algorithm");
return ARC_STAT_BADALG;
}

algtype = arc_name_to_code(algorithms, alg);
abeverley marked this conversation as resolved.
Show resolved Hide resolved

if (algtype == ARC_SIGN_RSASHA1)
{
msg->arc_hashtype = ARC_HASHTYPE_SHA1;
msg->arc_keytype = ARC_KEYTYPE_RSA;
*nid = NID_sha1;
}
else if (algtype == ARC_SIGN_RSASHA256)
{
msg->arc_hashtype = ARC_HASHTYPE_SHA256;
msg->arc_keytype = ARC_KEYTYPE_RSA;
*nid = NID_sha256;
}
else
{
arc_error(msg, "unknown or invalid algorithm: %s", alg);
return ARC_STAT_BADALG;
}

return ARC_STAT_OK;
}

/*
** ARC_GENAMSHDR -- generate a signature or seal header field
**
Expand Down Expand Up @@ -1965,6 +2016,13 @@ arc_validate_msg(ARC_MESSAGE *msg, u_int setnum)
msg->arc_selector = arc_param_get(kvset, "s");
msg->arc_domain = arc_param_get(kvset, "d");

/* store algorithm in msg, needed for arc_get_key() */
alg = arc_param_get(kvset, "a");
status = arc_parse_algorithm(msg, alg, &nid);
if (status != ARC_STAT_OK)
// arc_error already set by arc_parse_algorithm()
return status;

/* get the key from DNS (or wherever) */
status = arc_get_key(msg, FALSE);
if (status != ARC_STAT_OK)
Expand Down Expand Up @@ -2039,11 +2097,6 @@ arc_validate_msg(ARC_MESSAGE *msg, u_int setnum)
return ARC_STAT_CANTVRFY;
}

alg = arc_param_get(kvset, "a");
nid = NID_sha1;
if (alg != NULL && strcmp(alg, "rsa-sha256") == 0)
nid = NID_sha256;

rsastat = RSA_verify(nid, hh, hhlen, sig, siglen, rsa);

RSA_free(rsa);
Expand Down Expand Up @@ -2119,6 +2172,13 @@ arc_validate_seal(ARC_MESSAGE *msg, u_int setnum)
msg->arc_selector = arc_param_get(kvset, "s");
msg->arc_domain = arc_param_get(kvset, "d");

/* store algorithm in msg, needed for arc_get_key() */
alg = arc_param_get(kvset, "a");
status = arc_parse_algorithm(msg, alg, &nid);
if (status != ARC_STAT_OK)
// arc_error already set by arc_parse_algorithm()
return status;

if (msg->arc_selector == NULL)
{
arc_error(msg, "seal at i=%u has no selector", setnum);
Expand Down Expand Up @@ -2191,11 +2251,6 @@ arc_validate_seal(ARC_MESSAGE *msg, u_int setnum)
return ARC_STAT_INTERNAL;
}

alg = arc_param_get(kvset, "a");
nid = NID_sha1;
if (alg != NULL && strcmp(alg, "rsa-sha256") == 0)
nid = NID_sha256;

rsastat = RSA_verify(nid, sh, shlen, sig, siglen, rsa);

RSA_free(rsa);
Expand Down
1 change: 1 addition & 0 deletions libopenarc/arc.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@ typedef int ARC_STAT;
#define ARC_STAT_KEYFAIL 11 /* key retrieval failed */
#define ARC_STAT_MULTIDNSREPLY 12 /* multiple DNS replies */
#define ARC_STAT_SIGGEN 13 /* seal generation failed */
#define ARC_STAT_BADALG 14 /* unknown or invalid algorithm */

/*
** ARC_CHAIN -- chain state
Expand Down