nhyatt/putty-source
1
0
Fork 0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-07-01 03:22:48 -05:00
Code Issues Projects Releases Wiki Activity

Reject multilayer certificates in check_cert.

Browse Source 
Rejecting them in the CA config box reminded me that the main checking
code also ought to do the same thing.
This commit is contained in:
Simon Tatham
2022-05-07 12:25:54 +01:00
parent 4b0e54c22a
commit b753cf6e3b
2 changed files with 67 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
test/cryptsuite.py
View File

@ -2715,6 +2715,43 @@ Private-MAC: 5b1f6f4cc43eb0060d2c3e181bc0129343adba2b
False, b'username', 1000, '')
self.assertEqual(result, True)
# Make a certificate on the CA key, and re-sign the main
# key using that, to ensure that two-level certs are rejected
ca_self_certificate = sign_cert_via_testcrypt(
make_signature_preimage(
key_to_certify = ca_key.public_blob(),
ca_key = ca_key,
certtype = CertType.user,
keyid = b'id',
serial = 111,
principals = [b"doesn't matter"],
valid_after = 1000,
valid_before = 2000), ca_key, signflags=ca_signflags)
import base64
print(base64.b64encode(ca_self_certificate))
self_signed_ca_key = ssh_key_new_pub(
alg + '-cert', ca_self_certificate)
print(self_signed_ca_key)
cert_pub = sign_cert_via_testcrypt(
make_signature_preimage(
key_to_certify = base_key.public_blob(),
ca_key = self_signed_ca_key,
certtype = CertType.user,
keyid = b'id',
serial = 111,
principals = [b'username'],
valid_after = 1000,
valid_before = 2000), ca_key, signflags=ca_signflags)
print(base64.b64encode(cert_pub))
certified_key = ssh_key_new_priv(alg + '-cert', cert_pub,
base_key.private_blob())
result, err = certified_key.check_cert(
False, b'username', 1500, '')
self.assertEqual(result, False)
self.assertEqual(
err, b'Certificate is signed with a certified key '
b'(forbidden by OpenSSH certificate specification)')
# Now try a host certificate. We don't need to do _all_ the
# checks over again, but at least make sure that setting
# CertType.host leads to the certificate validating with