signature security level check were moved to lower level functions

That way all callers (including PKI functions) get protected by
the available checks.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

diff --git a/lib/abstract_int.h b/lib/abstract_int.h
index b3f99c2505caa22a5d29ada3e02fd403b90deb62..be87039b1870d6bca8444a5911805d3adde52d9c 100644 (file)
--- a/lib/abstract_int.h
+++ b/lib/abstract_int.h
@@ -103,7 +103,8 @@ int pubkey_verify_data(const gnutls_sign_entry_st *se,
                       const gnutls_datum_t * data,
                       const gnutls_datum_t * signature,
                       gnutls_pk_params_st * params,
-                      gnutls_x509_spki_st * sign_params);
+                      gnutls_x509_spki_st * sign_params,
+                      unsigned vflags);
 
 
 

diff --git a/lib/pubkey.c b/lib/pubkey.c
index 8c522a76a9f13c3cb28155b9f8fa7a894b0be1bd..6266ca260a6c926460c7403a33ebe82b6abe670c 100644 (file)
--- a/lib/pubkey.c
+++ b/lib/pubkey.c
@@ -43,7 +43,8 @@ pubkey_verify_hashed_data(const gnutls_sign_entry_st *se,
                          const gnutls_datum_t * hash,
                          const gnutls_datum_t * signature,
                          gnutls_pk_params_st * params,
-                         gnutls_x509_spki_st * sign_params);
+                         gnutls_x509_spki_st * sign_params,
+                         unsigned flags);
 
 unsigned pubkey_to_bits(gnutls_pk_params_st * params)
 {
@@ -1588,17 +1589,12 @@ gnutls_pubkey_verify_data2(gnutls_pubkey_t pubkey,
                return gnutls_assert_val(ret);
 
        ret = pubkey_verify_data(se, data, signature, &pubkey->params,
-                                &params);
+                                &params, flags);
        if (ret < 0) {
                gnutls_assert();
                return ret;
        }
 
-       if (gnutls_sign_is_secure(algo) == 0 && _gnutls_is_broken_sig_allowed(algo, flags) == 0) {
-               _gnutls_debug_log("signature algorithm %s is insecure\n", gnutls_sign_get_name(algo));
-               return gnutls_assert_val(GNUTLS_E_INSUFFICIENT_SECURITY);
-       }
-
        return 0;
 }
 
@@ -1669,17 +1665,13 @@ gnutls_pubkey_verify_hash2(gnutls_pubkey_t key,
 
                ret = pubkey_verify_hashed_data(se, hash, signature,
                                                &key->params,
-                                               &params);
+                                               &params, flags);
                if (ret < 0) {
                        gnutls_assert();
                        return ret;
                }
        }
 
-       if (algo != GNUTLS_SIGN_UNKNOWN && gnutls_sign_is_secure(algo) == 0 && _gnutls_is_broken_sig_allowed(algo, flags) == 0) {
-               return gnutls_assert_val(GNUTLS_E_INSUFFICIENT_SECURITY);
-       }
-
        return 0;
 }
 
@@ -1926,7 +1918,8 @@ pubkey_verify_hashed_data(const gnutls_sign_entry_st *se,
                          const gnutls_datum_t * hash,
                          const gnutls_datum_t * signature,
                          gnutls_pk_params_st * params,
-                         gnutls_x509_spki_st * sign_params)
+                         gnutls_x509_spki_st * sign_params,
+                         unsigned flags)
 {
        const mac_entry_st *me;
 
@@ -1966,6 +1959,12 @@ pubkey_verify_hashed_data(const gnutls_sign_entry_st *se,
                return GNUTLS_E_INVALID_REQUEST;
 
        }
+
+       if (gnutls_sign_is_secure(se->id) == 0 && _gnutls_is_broken_sig_allowed(se->id, flags) == 0) {
+               return gnutls_assert_val(GNUTLS_E_INSUFFICIENT_SECURITY);
+       }
+
+       return 1;
 }
 
 /* Verifies the signature data, and returns GNUTLS_E_PK_SIG_VERIFY_FAILED if 
@@ -1976,7 +1975,8 @@ pubkey_verify_data(const gnutls_sign_entry_st *se,
                   const gnutls_datum_t * data,
                   const gnutls_datum_t * signature,
                   gnutls_pk_params_st * params,
-                  gnutls_x509_spki_st * sign_params)
+                  gnutls_x509_spki_st * sign_params,
+                  unsigned flags)
 {
        const mac_entry_st *me;
 
@@ -1994,7 +1994,6 @@ pubkey_verify_data(const gnutls_sign_entry_st *se,
                        return GNUTLS_E_PK_SIG_VERIFY_FAILED;
                }
 
-               return 1;
                break;
 
        case GNUTLS_PK_EDDSA_ED25519:
@@ -2003,7 +2002,6 @@ pubkey_verify_data(const gnutls_sign_entry_st *se,
                        return GNUTLS_E_PK_SIG_VERIFY_FAILED;
                }
 
-               return 1;
                break;
 
        case GNUTLS_PK_EC:
@@ -2017,13 +2015,18 @@ pubkey_verify_data(const gnutls_sign_entry_st *se,
                        return GNUTLS_E_PK_SIG_VERIFY_FAILED;
                }
 
-               return 1;
                break;
        default:
                gnutls_assert();
                return GNUTLS_E_INVALID_REQUEST;
 
        }
+
+       if (gnutls_sign_is_secure(se->id) == 0 && _gnutls_is_broken_sig_allowed(se->id, flags) == 0) {
+               return gnutls_assert_val(GNUTLS_E_INSUFFICIENT_SECURITY);
+       }
+
+       return 1;
 }
 
 const mac_entry_st *_gnutls_dsa_q_to_hash(const gnutls_pk_params_st *

diff --git a/lib/x509/crq.c b/lib/x509/crq.c
index b0a4a9d531213cc93d55b1e32dbaafe8a8a2c5a5..1add284ac406f494176faae25d45e46c5374beb4 100644 (file)
--- a/lib/x509/crq.c
+++ b/lib/x509/crq.c
@@ -2972,7 +2972,7 @@ int gnutls_x509_crq_verify(gnutls_x509_crq_t crq, unsigned int flags)
 
        ret =
            pubkey_verify_data(se, &data, &signature,
-                              &params, &sign_params);
+                              &params, &sign_params, flags);
        if (ret < 0) {
                gnutls_assert();
                goto cleanup;

diff --git a/lib/x509/verify.c b/lib/x509/verify.c
index 2ccc33ecd27236b8c09a3e577abaf0c4bc684e8c..ea70b06487fcc6e59e32e4cc03b08349e466048b 100644 (file)
--- a/lib/x509/verify.c
+++ b/lib/x509/verify.c
@@ -583,7 +583,8 @@ static int _gnutls_x509_verify_data(gnutls_sign_algorithm_t sign,
                                    const gnutls_datum_t * data,
                                    const gnutls_datum_t * signature,
                                    gnutls_x509_crt_t cert,
-                                   gnutls_x509_crt_t issuer);
+                                   gnutls_x509_crt_t issuer,
+                                   unsigned vflags);
 
 /* 
  * Verifies the given certificate against a certificate list of
@@ -747,7 +748,7 @@ verify_crt(gnutls_x509_crt_t cert,
                                                     &cert_signed_data,
                                                     &cert_signature,
                                                     cert,
-                                                    issuer);
+                                                    issuer, flags);
 
                        if (ret == GNUTLS_E_PK_SIG_VERIFY_FAILED) {
                                MARK_INVALID(GNUTLS_CERT_SIGNATURE_FAILURE);
@@ -1320,12 +1321,13 @@ _gnutls_x509_validate_sign_params(gnutls_pk_algorithm_t pk_algorithm,
  * 'data' is the signed data
  * 'signature' is the signature!
  */
-int
+static int
 _gnutls_x509_verify_data(gnutls_sign_algorithm_t sign,
                         const gnutls_datum_t * data,
                         const gnutls_datum_t * signature,
                         gnutls_x509_crt_t cert,
-                        gnutls_x509_crt_t issuer)
+                        gnutls_x509_crt_t issuer,
+                        unsigned vflags)
 {
        gnutls_pk_params_st params;
        gnutls_pk_algorithm_t issuer_pk;
@@ -1376,7 +1378,7 @@ _gnutls_x509_verify_data(gnutls_sign_algorithm_t sign,
        }
 
        ret = pubkey_verify_data(se, data, signature, &params,
-                                &sign_params);
+                                &sign_params, vflags);
        if (ret < 0) {
                gnutls_assert();
        }
@@ -1635,7 +1637,7 @@ gnutls_x509_crl_verify(gnutls_x509_crl_t crl,
                    _gnutls_x509_verify_data(sigalg,
                                             &crl_signed_data, &crl_signature,
                                             NULL,
-                                            issuer);
+                                            issuer, flags);
                if (result == GNUTLS_E_PK_SIG_VERIFY_FAILED) {
                        gnutls_assert();
                        /* error. ignore it */