[Ttssh2-commit] [4572] RSA/ DSA で SHA-256 な SSHFP RR に対応

svnno****@sourc***** svnno****@sourc*****
2011年 8月 4日 (木) 19:59:58 JST


Revision: 4572
          http://sourceforge.jp/projects/ttssh2/svn/view?view=rev&revision=4572
Author:   doda
Date:     2011-08-04 19:59:57 +0900 (Thu, 04 Aug 2011)

Log Message:
-----------
RSA/DSA で SHA-256 な SSHFP RR に対応

Modified Paths:
--------------
    trunk/ttssh2/ttxssh/dns.c


-------------- next part --------------
Modified: trunk/ttssh2/ttxssh/dns.c
===================================================================
--- trunk/ttssh2/ttxssh/dns.c	2011-08-04 06:43:46 UTC (rev 4571)
+++ trunk/ttssh2/ttxssh/dns.c	2011-08-04 10:59:57 UTC (rev 4572)
@@ -56,8 +56,8 @@
 	DNS_STATUS status;
 	PDNS_RECORD rec, p;
 	PDNS_SSHFP_DATA t;
-	int hostkey_alg, hostkey_dtype, hostkey_dlen;
-	BYTE *hostkey_digest;
+	int hostkey_alg, hostkey_dtype, hostkey_dlen, fp_type;
+	BYTE *hostkey_digest = NULL;
 	int found = DNS_VERIFY_NOTFOUND;
 	OSVERSIONINFO osvi;
 
@@ -71,37 +71,52 @@
 	switch (key->type) {
 	case KEY_RSA:
 		hostkey_alg = SSHFP_KEY_RSA;
-		hostkey_dtype = SSHFP_HASH_SHA1;
 		break;
 	case KEY_DSA:
 		hostkey_alg = SSHFP_KEY_DSA;
-		hostkey_dtype = SSHFP_HASH_SHA1;
 		break;
 	case KEY_ECDSA256:
 	case KEY_ECDSA384:
 	case KEY_ECDSA521:
 		hostkey_alg = SSHFP_KEY_ECDSA;
-		hostkey_dtype = SSHFP_HASH_SHA256;
 		break;
 	default: // Un-supported algorithm
 		hostkey_alg = SSHFP_KEY_RESERVED;
-		hostkey_dtype = SSHFP_HASH_RESERVED;
 	}
 
-	if (hostkey_alg) {
-		hostkey_digest = key_fingerprint_raw(key, hostkey_dtype, &hostkey_dlen);
-	}
-	else {
-		hostkey_digest = NULL;
-	}
-
 	status = DnsQuery(hostname, DNS_TYPE_SSHFP, DNS_QUERY_STANDARD, NULL, &rec, NULL);
 
 	if (status == 0) {
 		for (p=rec; p!=NULL; p=p->pNext) {
 			if (p->wType == DNS_TYPE_SSHFP) {
 				t = (PDNS_SSHFP_DATA)&(p->Data.Null);
-				if (t->Algorithm == hostkey_alg && t->DigestType == hostkey_dtype) {
+				if (t->Algorithm == SSHFP_KEY_RESERVED)
+					continue; // skip invalid record
+				if (t->Algorithm == hostkey_alg) {
+					if (hostkey_digest == NULL || t->DigestType != hostkey_dtype) {
+						switch (t->DigestType) {
+						case SSHFP_HASH_SHA1:
+							if (hostkey_alg != SSHFP_KEY_RSA && hostkey_alg != SSHFP_KEY_DSA)
+								fp_type = -1; // SHA1 does not allowed to use with ECDSA key
+							else
+								fp_type = SSH_FP_SHA1;
+							break;
+						case SSHFP_HASH_SHA256:
+							fp_type = SSH_FP_SHA256;
+							break;
+						default:
+							fp_type = -1;
+						}
+
+						if (fp_type == -1)
+							continue; // skip invalid/un-supported hash type.
+
+						hostkey_dtype = t->DigestType;
+						free(hostkey_digest);
+						hostkey_digest = key_fingerprint_raw(key, fp_type, &hostkey_dlen);
+						if (!hostkey_digest)
+							continue;
+					}
 					if (hostkey_dlen == p->wDataLength-2 && memcmp(hostkey_digest, t->Digest, hostkey_dlen) == 0) {
 						found = DNS_VERIFY_MATCH;
 						break;



Ttssh2-commit メーリングリストの案内