diff options
| author | cinap_lenrek <cinap_lenrek@felloff.net> | 2017-04-23 19:00:08 +0200 |
|---|---|---|
| committer | cinap_lenrek <cinap_lenrek@felloff.net> | 2017-04-23 19:00:08 +0200 |
| commit | 346f5828e0e435d76ef7da8316e77a426c826d19 (patch) | |
| tree | 316f4fb2d2c4d08e51a32efa6206b814362393dc /sys/man/6 | |
| parent | 2d1fbbdafa37080ddaacb76ac1e4f5a413ef2dc3 (diff) | |
libsec: sha256 support for thumbprint files, use it in ssh as well
initThumbprints() now takes an application tag argument
so x509 and ssh can coexist.
the thumbprint entries can now hold both sha1 and sha256
hashes. okThumbprint() now takes a len argument for the
hash length used.
the new function okCertificate() hashes the certificate
with both and checks for any matches.
on failure, okCertificate() returns 0 and sets error string.
we also check for include loops now in thumbfiles, limiting
the number of includes to 8.
Diffstat (limited to 'sys/man/6')
| -rw-r--r-- | sys/man/6/thumbprint | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/sys/man/6/thumbprint b/sys/man/6/thumbprint index 63be911af..196108e1f 100644 --- a/sys/man/6/thumbprint +++ b/sys/man/6/thumbprint @@ -8,6 +8,8 @@ for example by calling .B tlsClient and .B okThumbprint +or +.B okCertificate (see .IR pushtls (2)), check the remote side's public key by comparing against @@ -25,13 +27,21 @@ attribute/value pairs of the form .IB attr = value or .IR attr . -The first attribute must be +The first attribute must be the application tag: .B x509 -and the second must be -.BI sha1= {hex checksum of binary certificate}. +for tls applications or +.B ssh +for ssh server fingerprints. +The second attribute must be a hash type of +.B sha1= +or +.BI sha256= +followed by the hex or base64 encoded hash of binary certificate +or public key. All other attributes are treated as comments. The file may also contain lines of the form -.BI #include file +.B #include +.I file .PP For example, a web server might have thumbprint .EX |