From 80b775bdbb852aa4a80292c9357e5b1876110c00 Mon Sep 17 00:00:00 2001 From: NIIBE Yutaka Date: Fri, 6 Apr 2018 14:58:14 +0900 Subject: [PATCH] agent: Support SSH signature flags. * agent/command-ssh.c (SSH_AGENT_RSA_SHA2_256): New. (SSH_AGENT_RSA_SHA2_512): New. (ssh_handler_sign_request): Override SPEC when FLAGS is specified. -- GnuPG-bug-id: 3880 Reported-by: Daniel Kahn Gillmor Signed-off-by: NIIBE Yutaka --- agent/command-ssh.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/agent/command-ssh.c b/agent/command-ssh.c index 517231a8c..d1158e70b 100644 --- a/agent/command-ssh.c +++ b/agent/command-ssh.c @@ -83,6 +83,8 @@ /* Other constants. */ #define SSH_DSA_SIGNATURE_PADDING 20 #define SSH_DSA_SIGNATURE_ELEMS 2 +#define SSH_AGENT_RSA_SHA2_256 0x02 +#define SSH_AGENT_RSA_SHA2_512 0x04 #define SPEC_FLAG_USE_PKCS1V2 (1 << 0) #define SPEC_FLAG_IS_ECDSA (1 << 1) #define SPEC_FLAG_IS_EdDSA (1 << 2) /*(lowercase 'd' on purpose.)*/ @@ -2880,11 +2882,24 @@ ssh_handler_sign_request (ctrl_t ctrl, estream_t request, estream_t response) if (err) goto out; - /* FIXME? */ err = stream_read_uint32 (request, &flags); if (err) goto out; + if (spec.algo == GCRY_PK_RSA) + { + if ((flags & SSH_AGENT_RSA_SHA2_256)) + { + spec.ssh_identifier = "rsa-sha2-256"; + spec.hash_algo = GCRY_MD_SHA256; + } + else if ((flags & SSH_AGENT_RSA_SHA2_512)) + { + spec.ssh_identifier = "rsa-sha2-512"; + spec.hash_algo = GCRY_MD_SHA512; + } + } + hash_algo = spec.hash_algo; if (!hash_algo) hash_algo = GCRY_MD_SHA1; /* Use the default. */