signature security level check were moved to lower level functions

That way all callers (including PKI functions) get protected by
the available checks.

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

4 files changed, 31 insertions, 25 deletions

diff --git a/lib/abstract_int.h b/lib/abstract_int.h
index b3f99c2505..be87039b18 100644
--- a/lib/abstract_int.h
+++ b/lib/abstract_int.h
@@ -103,7 +103,8 @@ int pubkey_verify_data(const gnutls_sign_entry_st *se,
 		       const gnutls_datum_t * data,
 		       const gnutls_datum_t * signature,
 		       gnutls_pk_params_st * params,
-		       gnutls_x509_spki_st * sign_params);
+		       gnutls_x509_spki_st * sign_params,
+		       unsigned vflags);
 
 
 
diff --git a/lib/pubkey.c b/lib/pubkey.c
index 8c522a76a9..6266ca260a 100644
--- a/lib/pubkey.c
+++ b/lib/pubkey.c
@@ -43,7 +43,8 @@ pubkey_verify_hashed_data(const gnutls_sign_entry_st *se,
 			  const gnutls_datum_t * hash,
 			  const gnutls_datum_t * signature,
 			  gnutls_pk_params_st * params,
-			  gnutls_x509_spki_st * sign_params);
+			  gnutls_x509_spki_st * sign_params,
+			  unsigned flags);
 
 unsigned pubkey_to_bits(gnutls_pk_params_st * params)
 {
@@ -1588,17 +1589,12 @@ gnutls_pubkey_verify_data2(gnutls_pubkey_t pubkey,
 		return gnutls_assert_val(ret);
 
 	ret = pubkey_verify_data(se, data, signature, &pubkey->params,
-				 &params);
+				 &params, flags);
 	if (ret < 0) {
 		gnutls_assert();
 		return ret;
 	}
 
-	if (gnutls_sign_is_secure(algo) == 0 && _gnutls_is_broken_sig_allowed(algo, flags) == 0) {
-		_gnutls_debug_log("signature algorithm %s is insecure\n", gnutls_sign_get_name(algo));
-		return gnutls_assert_val(GNUTLS_E_INSUFFICIENT_SECURITY);
-	}
-
 	return 0;
 }
 
@@ -1669,17 +1665,13 @@ gnutls_pubkey_verify_hash2(gnutls_pubkey_t key,
 
 		ret = pubkey_verify_hashed_data(se, hash, signature,
 						&key->params,
-						&params);
+						&params, flags);
 		if (ret < 0) {
 			gnutls_assert();
 			return ret;
 		}
 	}
 
-	if (algo != GNUTLS_SIGN_UNKNOWN && gnutls_sign_is_secure(algo) == 0 && _gnutls_is_broken_sig_allowed(algo, flags) == 0) {
-		return gnutls_assert_val(GNUTLS_E_INSUFFICIENT_SECURITY);
-	}
-
 	return 0;
 }
 
@@ -1926,7 +1918,8 @@ pubkey_verify_hashed_data(const gnutls_sign_entry_st *se,
 			  const gnutls_datum_t * hash,
 			  const gnutls_datum_t * signature,
 			  gnutls_pk_params_st * params,
-			  gnutls_x509_spki_st * sign_params)
+			  gnutls_x509_spki_st * sign_params,
+			  unsigned flags)
 {
 	const mac_entry_st *me;
 
@@ -1966,6 +1959,12 @@ pubkey_verify_hashed_data(const gnutls_sign_entry_st *se,
 		return GNUTLS_E_INVALID_REQUEST;
 
 	}
+
+	if (gnutls_sign_is_secure(se->id) == 0 && _gnutls_is_broken_sig_allowed(se->id, flags) == 0) {
+		return gnutls_assert_val(GNUTLS_E_INSUFFICIENT_SECURITY);
+	}
+
+	return 1;
 }
 
 /* Verifies the signature data, and returns GNUTLS_E_PK_SIG_VERIFY_FAILED if 
@@ -1976,7 +1975,8 @@ pubkey_verify_data(const gnutls_sign_entry_st *se,
 		   const gnutls_datum_t * data,
 		   const gnutls_datum_t * signature,
 		   gnutls_pk_params_st * params,
-		   gnutls_x509_spki_st * sign_params)
+		   gnutls_x509_spki_st * sign_params,
+		   unsigned flags)
 {
 	const mac_entry_st *me;
 
@@ -1994,7 +1994,6 @@ pubkey_verify_data(const gnutls_sign_entry_st *se,
 			return GNUTLS_E_PK_SIG_VERIFY_FAILED;
 		}
 
-		return 1;
 		break;
 
 	case GNUTLS_PK_EDDSA_ED25519:
@@ -2003,7 +2002,6 @@ pubkey_verify_data(const gnutls_sign_entry_st *se,
 			return GNUTLS_E_PK_SIG_VERIFY_FAILED;
 		}
 
-		return 1;
 		break;
 
 	case GNUTLS_PK_EC:
@@ -2017,13 +2015,18 @@ pubkey_verify_data(const gnutls_sign_entry_st *se,
 			return GNUTLS_E_PK_SIG_VERIFY_FAILED;
 		}
 
-		return 1;
 		break;
 	default:
 		gnutls_assert();
 		return GNUTLS_E_INVALID_REQUEST;
 
 	}
+
+	if (gnutls_sign_is_secure(se->id) == 0 && _gnutls_is_broken_sig_allowed(se->id, flags) == 0) {
+		return gnutls_assert_val(GNUTLS_E_INSUFFICIENT_SECURITY);
+	}
+
+	return 1;
 }
 
 const mac_entry_st *_gnutls_dsa_q_to_hash(const gnutls_pk_params_st *
diff --git a/lib/x509/crq.c b/lib/x509/crq.c
index b0a4a9d531..1add284ac4 100644
--- a/lib/x509/crq.c
+++ b/lib/x509/crq.c
@@ -2972,7 +2972,7 @@ int gnutls_x509_crq_verify(gnutls_x509_crq_t crq, unsigned int flags)
 
 	ret =
 	    pubkey_verify_data(se, &data, &signature,
-			       &params, &sign_params);
+			       &params, &sign_params, flags);
 	if (ret < 0) {
 		gnutls_assert();
 		goto cleanup;
diff --git a/lib/x509/verify.c b/lib/x509/verify.c
index 2ccc33ecd2..ea70b06487 100644
--- a/lib/x509/verify.c
+++ b/lib/x509/verify.c
@@ -583,7 +583,8 @@ static int _gnutls_x509_verify_data(gnutls_sign_algorithm_t sign,
 				    const gnutls_datum_t * data,
 				    const gnutls_datum_t * signature,
 				    gnutls_x509_crt_t cert,
-				    gnutls_x509_crt_t issuer);
+				    gnutls_x509_crt_t issuer,
+				    unsigned vflags);
 
 /* 
  * Verifies the given certificate against a certificate list of
@@ -747,7 +748,7 @@ verify_crt(gnutls_x509_crt_t cert,
 						     &cert_signed_data,
 						     &cert_signature,
 						     cert,
-						     issuer);
+						     issuer, flags);
 
 			if (ret == GNUTLS_E_PK_SIG_VERIFY_FAILED) {
 				MARK_INVALID(GNUTLS_CERT_SIGNATURE_FAILURE);
@@ -1320,12 +1321,13 @@ _gnutls_x509_validate_sign_params(gnutls_pk_algorithm_t pk_algorithm,
  * 'data' is the signed data
  * 'signature' is the signature!
  */
-int
+static int
 _gnutls_x509_verify_data(gnutls_sign_algorithm_t sign,
 			 const gnutls_datum_t * data,
 			 const gnutls_datum_t * signature,
 			 gnutls_x509_crt_t cert,
-			 gnutls_x509_crt_t issuer)
+			 gnutls_x509_crt_t issuer,
+			 unsigned vflags)
 {
 	gnutls_pk_params_st params;
 	gnutls_pk_algorithm_t issuer_pk;
@@ -1376,7 +1378,7 @@ _gnutls_x509_verify_data(gnutls_sign_algorithm_t sign,
 	}
 
 	ret = pubkey_verify_data(se, data, signature, &params,
-				 &sign_params);
+				 &sign_params, vflags);
 	if (ret < 0) {
 		gnutls_assert();
 	}
@@ -1635,7 +1637,7 @@ gnutls_x509_crl_verify(gnutls_x509_crl_t crl,
 		    _gnutls_x509_verify_data(sigalg,
 					     &crl_signed_data, &crl_signature,
 					     NULL,
-					     issuer);
+					     issuer, flags);
 		if (result == GNUTLS_E_PK_SIG_VERIFY_FAILED) {
 			gnutls_assert();
 			/* error. ignore it */