Check the format name in host key blobs

The host key parsers compare the format identifier at the head of the
key blob (RFC 4253 section 6.6) against the expected name and return
WS_INVALID_ALGO_ID on a mismatch, as ParseECCPubKey() already does.
RSA blobs must say "ssh-rsa", Ed25519 "ssh-ed25519", and ML-DSA the
negotiated algorithm name.

- add GetPubKeyFormat() and use it in place of GetSkip()
- add the wolfSSH_TestParseMlDsaPubKey() hook
- test a mismatched name for each key type

Issue: F-15666

Author: ejohnstown

src/internal.c

@@ -7619,6 +7619,30 @@ static int CheckRsaKeyBits(RsaKey* key)
 #endif
 
 
+#if !defined(WOLFSSH_NO_RSA) || !defined(WOLFSSH_NO_ED25519) \
+    || !defined(WOLFSSH_NO_MLDSA)
+/* Compare the format identifier at the start of a public key blob
+ * against the expected name (RFC 4253 section 6.6). */
+static int GetPubKeyFormat(const char* expected, const byte* pubKey,
+        word32 pubKeySz, word32* pubKeyIdx)
+{
+    const byte* name = NULL;
+    word32 nameSz = 0;
+    int ret;
+
+    ret = GetStringRef(&nameSz, &name, pubKey, pubKeySz, pubKeyIdx);
+    if (ret == WS_SUCCESS) {
+        if (nameSz != (word32)WSTRLEN(expected)
+                || WMEMCMP(name, expected, nameSz) != 0) {
+            ret = WS_INVALID_ALGO_ID;
+        }
+    }
+
+    return ret;
+}
+#endif
+
+
 /* Parse out a RAW RSA public key from buffer */
 static int ParseRSAPubKey(WOLFSSH *ssh,
     struct wolfSSH_sigKeyBlock *sigKeyBlock_ptr, byte *pubKey, word32 pubKeySz)
@@ -7632,9 +7656,9 @@ static int ParseRSAPubKey(WOLFSSH *ssh,
     word32 pubKeyIdx = 0;
 
     ret = InitPubKey(sigKeyBlock_ptr, ssh);
-    /* Skip the algo name. */
+    /* All three RSA host key algorithms use the "ssh-rsa" format. */
     if (ret == WS_SUCCESS)
-        ret = GetSkip(pubKey, pubKeySz, &pubKeyIdx);
+        ret = GetPubKeyFormat("ssh-rsa", pubKey, pubKeySz, &pubKeyIdx);
     if (ret == WS_SUCCESS) {
         ret = GetUint32(&eSz, pubKey, pubKeySz, &pubKeyIdx);
         if (ret == WS_SUCCESS && eSz > pubKeySz - pubKeyIdx)
@@ -7775,9 +7799,8 @@ static int ParseEd25519PubKey(WOLFSSH *ssh,
 
     ret = InitPubKey(sigKeyBlock_ptr, ssh);
 
-    /* Skip the algo name */
     if (ret == WS_SUCCESS) {
-        ret = GetSkip(pubKey, pubKeySz, &pubKeyIdx);
+        ret = GetPubKeyFormat("ssh-ed25519", pubKey, pubKeySz, &pubKeyIdx);
     }
 
     if (ret == WS_SUCCESS) {
@@ -7859,8 +7882,7 @@ static int ParseMlDsaPubKey(WOLFSSH* ssh,
         return WS_INVALID_ALGO_ID;
     }
 
-    /* skip the algo name string */
-    ret = GetSkip(pubKey, pubKeySz, &pubKeyIdx);
+    ret = GetPubKeyFormat(IdToName(keyId), pubKey, pubKeySz, &pubKeyIdx);
     if (ret == WS_SUCCESS)
         ret = GetStringRef(&pubSz, &pub, pubKey, pubKeySz, &pubKeyIdx);
     if (ret == WS_SUCCESS)
@@ -26874,6 +26896,20 @@ int wolfSSH_TestDoUserAuthRequestEd25519(WOLFSSH* ssh,
 
 #ifndef WOLFSSH_NO_MLDSA
 
+int wolfSSH_TestParseMlDsaPubKey(WOLFSSH* ssh, byte* pubKey, word32 pubKeySz,
+        byte keyId)
+{
+    struct wolfSSH_sigKeyBlock sigKeyBlock;
+    int ret;
+
+    WMEMSET(&sigKeyBlock, 0, sizeof(sigKeyBlock));
+    sigKeyBlock.useMlDsa = 1;
+    ret = ParseMlDsaPubKey(ssh, &sigKeyBlock, pubKey, pubKeySz, keyId);
+    FreePubKey(&sigKeyBlock);
+
+    return ret;
+}
+
 WOLFSSH_API int wolfSSH_TestDoUserAuthRequestMlDsa(WOLFSSH* ssh,
         WS_UserAuthData* authData, word32 pubKeyBlobSz)
 {

tests/unit.c

@@ -14898,6 +14898,15 @@ static int test_ParseEd25519PubKey(void)
         failures++;
     }
 
+    /* format identifier other than "ssh-ed25519" */
+    blob[UINT32_SZ + keyTypeNameSz - 1] = '8';
+    ret = wolfSSH_TestParseEd25519PubKey(ssh, blob, blobSz);
+    if (ret != WS_INVALID_ALGO_ID) {
+        fprintf(stderr, "\t\"format mismatch\" FAIL: got %d, expected %d\n",
+                ret, WS_INVALID_ALGO_ID);
+        failures++;
+    }
+
     wolfSSH_free(ssh);
     wolfSSH_CTX_free(ctx);
 
@@ -15931,6 +15940,99 @@ static int test_DoUserAuthRequestMlDsa(void)
     return 0;
 }
 
+#ifndef WOLFSSH_NO_MLDSA44
+/* Host key blob parse for ssh-mldsa-44. The format identifier must match
+ * the negotiated algorithm (RFC 4253 section 6.6). */
+static int test_ParseMlDsaPubKey(void)
+{
+    static const char keyTypeName[] = "ssh-mldsa-44";
+    const word32 keyTypeNameSz = (word32)(sizeof(keyTypeName) - 1);
+    WOLFSSH_CTX* ctx = NULL;
+    WOLFSSH* ssh = NULL;
+    MlDsaKey key;
+    int keyInit = 0;
+    WC_RNG rng;
+    int rngInit = 0;
+    byte blob[UINT32_SZ * 2 + sizeof(keyTypeName) - 1
+            + WC_MLDSA_44_PUB_KEY_SIZE];
+    word32 pubSz = WC_MLDSA_44_PUB_KEY_SIZE;
+    word32 blobSz;
+    int ret;
+    int result = 0;
+
+    ctx = wolfSSH_CTX_new(WOLFSSH_ENDPOINT_CLIENT, NULL);
+    if (ctx == NULL)
+        return -780;
+    ssh = wolfSSH_new(ctx);
+    if (ssh == NULL) {
+        result = -781;
+        goto done;
+    }
+
+    if (wc_InitRng(&rng) != 0) {
+        result = -782;
+        goto done;
+    }
+    rngInit = 1;
+    if (wc_MlDsaKey_Init(&key, NULL, INVALID_DEVID) != 0) {
+        result = -783;
+        goto done;
+    }
+    keyInit = 1;
+    if (wc_MlDsaKey_SetParams(&key, WC_ML_DSA_44) != 0
+            || wc_MlDsaKey_MakeKey(&key, &rng) != 0) {
+        result = -784;
+        goto done;
+    }
+
+    /* string "ssh-mldsa-44" || string pubkey */
+    PutU32BE(blob, keyTypeNameSz);
+    WMEMCPY(blob + UINT32_SZ, keyTypeName, keyTypeNameSz);
+    if (wc_MlDsaKey_ExportPubRaw(&key,
+            blob + UINT32_SZ * 2 + keyTypeNameSz, &pubSz) != 0) {
+        result = -785;
+        goto done;
+    }
+    PutU32BE(blob + UINT32_SZ + keyTypeNameSz, pubSz);
+    blobSz = UINT32_SZ * 2 + keyTypeNameSz + pubSz;
+
+    ret = wolfSSH_TestParseMlDsaPubKey(ssh, blob, blobSz, ID_MLDSA44);
+    if (ret != WS_SUCCESS) {
+        fprintf(stderr, "\t\"valid\" FAIL: got %d, expected %d\n",
+                ret, WS_SUCCESS);
+        result = -786;
+        goto done;
+    }
+
+    ret = wolfSSH_TestParseMlDsaPubKey(ssh, blob, blobSz - 4, ID_MLDSA44);
+    if (ret == WS_SUCCESS) {
+        fprintf(stderr, "\t\"truncated\" FAIL: got %d\n", ret);
+        result = -787;
+        goto done;
+    }
+
+    /* format identifier other than "ssh-mldsa-44" */
+    blob[UINT32_SZ + keyTypeNameSz - 1] = '5';
+    ret = wolfSSH_TestParseMlDsaPubKey(ssh, blob, blobSz, ID_MLDSA44);
+    if (ret != WS_INVALID_ALGO_ID) {
+        fprintf(stderr, "\t\"format mismatch\" FAIL: got %d, expected %d\n",
+                ret, WS_INVALID_ALGO_ID);
+        result = -788;
+        goto done;
+    }
+
+done:
+    if (keyInit)
+        wc_MlDsaKey_Free(&key);
+    if (rngInit)
+        wc_FreeRng(&rng);
+    if (ssh != NULL)
+        wolfSSH_free(ssh);
+    wolfSSH_CTX_free(ctx);
+    return result;
+}
+#endif /* !WOLFSSH_NO_MLDSA44 */
+
 /* tamperSig: 0 = no tampering, 1 = flip a byte in the trad-algorithm
  * signature component, 2 = flip a byte in the ML-DSA signature component,
  * 3 = claim a composite signature length shorter than the ML-DSA half
@@ -22717,6 +22819,7 @@ static const byte userAuthRsaSigBlob[] = {
 static const byte userAuthRsaSigLenOverrun[] = { 0x00, 0x00, 0x01, 0x01 };
 
 /* Offsets of interest in userAuthRsaPubKeyBlob. */
+#define RSA_PUB_BLOB_ALGO 4   /* "ssh-rsa" */
 #define RSA_PUB_BLOB_NLEN 18  /* length of the modulus mpint */
 #define RSA_PUB_BLOB_N    23  /* first byte of the modulus, past the pad */
 
@@ -22883,6 +22986,16 @@ static int test_ParseRSAPubKey(void)
         failures++;
     }
 
+    /* format identifier other than "ssh-rsa" */
+    WMEMCPY(blob, userAuthRsaPubKeyBlob, sizeof(blob));
+    WMEMCPY(blob + RSA_PUB_BLOB_ALGO, "ssh-dss", 7);
+    ret = wolfSSH_TestParseRSAPubKey(ssh, blob, (word32)sizeof(blob));
+    if (ret != WS_INVALID_ALGO_ID) {
+        fprintf(stderr, "\t\"format mismatch\" FAIL: got %d, expected %d\n",
+                ret, WS_INVALID_ALGO_ID);
+        failures++;
+    }
+
     wolfSSH_free(ssh);
     wolfSSH_CTX_free(ctx);
 
@@ -26083,6 +26196,12 @@ int wolfSSH_UnitTest(int argc, char** argv)
     printf("DoUserAuthRequestMlDsa: %s (result=%d)\n",
             (unitResult == 0 ? "SUCCESS" : "FAILED"), unitResult);
     testResult = testResult || (unitResult != 0);
+#ifndef WOLFSSH_NO_MLDSA44
+    unitResult = test_ParseMlDsaPubKey();
+    printf("ParseMlDsaPubKey: %s (result=%d)\n",
+            (unitResult == 0 ? "SUCCESS" : "FAILED"), unitResult);
+    testResult = testResult || (unitResult != 0);
+#endif
 #ifndef WOLFSSH_NO_MLDSA_COMPOSITES
     unitResult = test_DoUserAuthRequestMlDsaComposite();
     printf("DoUserAuthRequestMlDsaComposite: %s (result=%d)\n",

wolfssh/internal.h

@@ -2258,6 +2258,8 @@ enum WS_MessageIdLimits {
             WS_UserAuthData* authData);
 #endif /* !WOLFSSH_NO_ED25519 */
 #ifndef WOLFSSH_NO_MLDSA
+    WOLFSSH_API int wolfSSH_TestParseMlDsaPubKey(WOLFSSH* ssh, byte* pubKey,
+            word32 pubKeySz, byte keyId);
     WOLFSSH_API int wolfSSH_TestDoUserAuthRequestMlDsa(WOLFSSH* ssh,
             WS_UserAuthData* authData, word32 pubKeyBlobSz);
     WOLFSSH_API int wolfSSH_TestPrepareUserAuthRequestMlDsa(WOLFSSH* ssh,