Skip to content

internal: gate public-key auth on every compiled signing algorithm #1183

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
yosuke-wolfssl wants to merge 1 commit into
base: master
Choose a base branch
from
Open

internal: gate public-key auth on every compiled signing algorithm #1183

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 7 additions & 11 deletions src/internal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9798,8 +9798,7 @@ static int DoUserAuthRequestEd25519(WOLFSSH* ssh,
}
#endif /* !WOLFSSH_NO_ED25519 */

#if !defined(WOLFSSH_NO_RSA) || !defined(WOLFSSH_NO_ECDSA) \
|| !defined(WOLFSSH_NO_ED25519) || !defined(WOLFSSH_NO_MLDSA)
#ifndef WOLFSSH_NO_PUBKEY_AUTH
/* Utility for DoUserAuthRequest() */
static int DoUserAuthRequestPublicKey(WOLFSSH* ssh, WS_UserAuthData* authData,
byte* buf, word32 len, word32* idx)
Expand Down Expand Up @@ -10342,7 +10341,7 @@ static int DoUserAuthRequestPublicKey(WOLFSSH* ssh, WS_UserAuthData* authData,
WLOG(WS_LOG_DEBUG, "Leaving DoUserAuthRequestPublicKey(), ret = %d", ret);
return ret;
}
#endif /* !WOLFSSH_NO_RSA/ECDSA/ED25519/MLDSA */
#endif /* !WOLFSSH_NO_PUBKEY_AUTH */


static int DoUserAuthRequest(WOLFSSH* ssh,
Expand Down Expand Up @@ -10437,8 +10436,7 @@ static int DoUserAuthRequest(WOLFSSH* ssh,
ret = SendUserAuthKeyboardRequest(ssh, &authData);
}
#endif
#if !defined(WOLFSSH_NO_RSA) || !defined(WOLFSSH_NO_ECDSA) \
|| !defined(WOLFSSH_NO_ED25519) || !defined(WOLFSSH_NO_MLDSA)
#ifndef WOLFSSH_NO_PUBKEY_AUTH
else if (authNameId == ID_USERAUTH_PUBLICKEY) {
authData.sf.publicKey.dataToSign = buf + *idx;
ret = DoUserAuthRequestPublicKey(ssh, &authData, buf, len, &begin);
Expand Down Expand Up @@ -10515,8 +10513,7 @@ static int DoUserAuthFailure(WOLFSSH* ssh,
}
break;
#endif
#if !defined(WOLFSSH_NO_RSA) || !defined(WOLFSSH_NO_ECDSA) || \
defined(WOLFSSH_TPM)
#ifndef WOLFSSH_NO_PUBKEY_AUTH
case ID_USERAUTH_PUBLICKEY:
authType |= WOLFSSH_USERAUTH_PUBLICKEY;
break;
Expand Down Expand Up @@ -18816,8 +18813,7 @@ static int BuildUserAuthRequestMlDsa(WOLFSSH* ssh,
#endif /* !WOLFSSH_NO_MLDSA */


#if !defined(WOLFSSH_NO_RSA) || !defined(WOLFSSH_NO_ECDSA) \
|| !defined(WOLFSSH_NO_ED25519) || !defined(WOLFSSH_NO_MLDSA)
#ifndef WOLFSSH_NO_PUBKEY_AUTH
static int PrepareUserAuthRequestPublicKey(WOLFSSH* ssh, word32* payloadSz,
WS_UserAuthData* authData, WS_KeySignature* keySig)
{
Expand Down Expand Up @@ -19181,7 +19177,7 @@ static int BuildUserAuthRequestPublicKey(WOLFSSH* ssh,
}


#endif /* !WOLFSSH_NO_RSA/ECDSA/ED25519/MLDSA */
#endif /* !WOLFSSH_NO_PUBKEY_AUTH */

#ifdef WOLFSSH_KEYBOARD_INTERACTIVE
int SendUserAuthKeyboardResponse(WOLFSSH* ssh)
Expand Down Expand Up @@ -19527,7 +19523,7 @@ static int GetAllowedAuth(WOLFSSH* ssh, char* authStr)
#ifdef WOLFSSH_KEYBOARD_INTERACTIVE
typeAllowed |= WOLFSSH_USERAUTH_KEYBOARD;
#endif
#if !defined(WOLFSSH_NO_RSA) || !defined(WOLFSSH_NO_ECDSA)
#ifndef WOLFSSH_NO_PUBKEY_AUTH
typeAllowed |= WOLFSSH_USERAUTH_PUBLICKEY;
#endif

Expand Down
5 changes: 5 additions & 0 deletions wolfssh/internal.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -365,6 +365,11 @@ extern "C" {
#undef WOLFSSH_NO_ECDSA
#define WOLFSSH_NO_ECDSA
#endif
#if defined(WOLFSSH_NO_RSA) && defined(WOLFSSH_NO_ECDSA) && \
Comment thread
yosuke-wolfssl marked this conversation as resolved.
defined(WOLFSSH_NO_ED25519) && defined(WOLFSSH_NO_MLDSA)
#undef WOLFSSH_NO_PUBKEY_AUTH
#define WOLFSSH_NO_PUBKEY_AUTH
#endif
#if defined(WOLFSSH_NO_RSA) || \
(defined(WOLFSSH_NO_RSA_SHA2_256) && defined(WOLFSSH_NO_RSA_SHA2_512))
#undef WOLFSSH_NO_OSSH_CERT_RSA
Expand Down
Loading