Annotation of src/usr.bin/ssh/kex.c, Revision 1.100
1.100 ! markus 1: /* $OpenBSD: kex.c,v 1.99 2014/04/29 18:01:49 markus Exp $ */
1.1 markus 2: /*
1.36 markus 3: * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
1.1 markus 4: *
5: * Redistribution and use in source and binary forms, with or without
6: * modification, are permitted provided that the following conditions
7: * are met:
8: * 1. Redistributions of source code must retain the above copyright
9: * notice, this list of conditions and the following disclaimer.
10: * 2. Redistributions in binary form must reproduce the above copyright
11: * notice, this list of conditions and the following disclaimer in the
12: * documentation and/or other materials provided with the distribution.
13: *
14: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24: */
25:
1.73 stevesk 26: #include <sys/param.h>
1.18 markus 27:
1.76 deraadt 28: #include <signal.h>
1.75 stevesk 29: #include <stdio.h>
1.74 stevesk 30: #include <stdlib.h>
1.72 stevesk 31: #include <string.h>
1.1 markus 32:
1.99 markus 33: #ifdef WITH_OPENSSL
1.76 deraadt 34: #include <openssl/crypto.h>
1.99 markus 35: #endif
1.76 deraadt 36:
37: #include "xmalloc.h"
1.1 markus 38: #include "ssh2.h"
39: #include "buffer.h"
1.7 markus 40: #include "packet.h"
1.1 markus 41: #include "compat.h"
1.18 markus 42: #include "cipher.h"
1.76 deraadt 43: #include "key.h"
1.1 markus 44: #include "kex.h"
1.18 markus 45: #include "log.h"
1.21 markus 46: #include "mac.h"
1.23 markus 47: #include "match.h"
1.26 markus 48: #include "dispatch.h"
1.48 provos 49: #include "monitor.h"
1.82 andreas 50: #include "roaming.h"
1.94 djm 51: #include "digest.h"
1.48 provos 52:
1.35 itojun 53: /* prototype */
54: static void kex_kexinit_finish(Kex *);
55: static void kex_choose_conf(Kex *);
1.86 djm 56:
1.89 djm 57: struct kexalg {
58: char *name;
59: int type;
60: int ec_nid;
1.94 djm 61: int hash_alg;
1.89 djm 62: };
63: static const struct kexalg kexalgs[] = {
1.99 markus 64: #ifdef WITH_OPENSSL
1.94 djm 65: { KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
66: { KEX_DH14, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
67: { KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, SSH_DIGEST_SHA1 },
68: { KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256 },
69: { KEX_ECDH_SHA2_NISTP256, KEX_ECDH_SHA2,
70: NID_X9_62_prime256v1, SSH_DIGEST_SHA256 },
71: { KEX_ECDH_SHA2_NISTP384, KEX_ECDH_SHA2, NID_secp384r1,
72: SSH_DIGEST_SHA384 },
73: { KEX_ECDH_SHA2_NISTP521, KEX_ECDH_SHA2, NID_secp521r1,
74: SSH_DIGEST_SHA512 },
1.99 markus 75: #endif
1.94 djm 76: { KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
77: { NULL, -1, -1, -1},
1.89 djm 78: };
79:
80: char *
1.93 dtucker 81: kex_alg_list(char sep)
1.89 djm 82: {
83: char *ret = NULL;
84: size_t nlen, rlen = 0;
85: const struct kexalg *k;
86:
87: for (k = kexalgs; k->name != NULL; k++) {
88: if (ret != NULL)
1.93 dtucker 89: ret[rlen++] = sep;
1.89 djm 90: nlen = strlen(k->name);
91: ret = xrealloc(ret, 1, rlen + nlen + 2);
92: memcpy(ret + rlen, k->name, nlen + 1);
93: rlen += nlen;
94: }
95: return ret;
96: }
97:
98: static const struct kexalg *
99: kex_alg_by_name(const char *name)
100: {
101: const struct kexalg *k;
102:
103: for (k = kexalgs; k->name != NULL; k++) {
104: if (strcmp(k->name, name) == 0)
105: return k;
106: }
107: return NULL;
108: }
109:
1.86 djm 110: /* Validate KEX method name list */
111: int
112: kex_names_valid(const char *names)
113: {
114: char *s, *cp, *p;
115:
116: if (names == NULL || strcmp(names, "") == 0)
117: return 0;
118: s = cp = xstrdup(names);
119: for ((p = strsep(&cp, ",")); p && *p != '\0';
120: (p = strsep(&cp, ","))) {
1.89 djm 121: if (kex_alg_by_name(p) == NULL) {
1.86 djm 122: error("Unsupported KEX algorithm \"%.100s\"", p);
1.91 djm 123: free(s);
1.86 djm 124: return 0;
125: }
126: }
127: debug3("kex names ok: [%s]", names);
1.91 djm 128: free(s);
1.86 djm 129: return 1;
130: }
1.26 markus 131:
132: /* put algorithm proposal into buffer */
1.35 itojun 133: static void
1.26 markus 134: kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
1.1 markus 135: {
1.61 djm 136: u_int i;
1.26 markus 137:
138: buffer_clear(b);
1.49 markus 139: /*
140: * add a dummy cookie, the cookie will be overwritten by
141: * kex_send_kexinit(), each time a kexinit is set
142: */
143: for (i = 0; i < KEX_COOKIE_LEN; i++)
144: buffer_put_char(b, 0);
1.1 markus 145: for (i = 0; i < PROPOSAL_MAX; i++)
1.26 markus 146: buffer_put_cstring(b, proposal[i]);
147: buffer_put_char(b, 0); /* first_kex_packet_follows */
148: buffer_put_int(b, 0); /* uint32 reserved */
1.1 markus 149: }
150:
1.26 markus 151: /* parse buffer and return algorithm proposal */
1.35 itojun 152: static char **
1.53 markus 153: kex_buf2prop(Buffer *raw, int *first_kex_follows)
1.7 markus 154: {
1.26 markus 155: Buffer b;
1.78 djm 156: u_int i;
1.26 markus 157: char **proposal;
1.7 markus 158:
1.70 djm 159: proposal = xcalloc(PROPOSAL_MAX, sizeof(char *));
1.7 markus 160:
1.26 markus 161: buffer_init(&b);
162: buffer_append(&b, buffer_ptr(raw), buffer_len(raw));
1.7 markus 163: /* skip cookie */
164: for (i = 0; i < KEX_COOKIE_LEN; i++)
1.26 markus 165: buffer_get_char(&b);
1.7 markus 166: /* extract kex init proposal strings */
167: for (i = 0; i < PROPOSAL_MAX; i++) {
1.83 djm 168: proposal[i] = buffer_get_cstring(&b,NULL);
1.26 markus 169: debug2("kex_parse_kexinit: %s", proposal[i]);
1.7 markus 170: }
1.26 markus 171: /* first kex follows / reserved */
172: i = buffer_get_char(&b);
1.53 markus 173: if (first_kex_follows != NULL)
174: *first_kex_follows = i;
1.26 markus 175: debug2("kex_parse_kexinit: first_kex_follows %d ", i);
176: i = buffer_get_int(&b);
1.78 djm 177: debug2("kex_parse_kexinit: reserved %u ", i);
1.26 markus 178: buffer_free(&b);
179: return proposal;
1.1 markus 180: }
181:
1.35 itojun 182: static void
1.26 markus 183: kex_prop_free(char **proposal)
1.1 markus 184: {
1.61 djm 185: u_int i;
1.26 markus 186:
187: for (i = 0; i < PROPOSAL_MAX; i++)
1.91 djm 188: free(proposal[i]);
189: free(proposal);
1.1 markus 190: }
191:
1.78 djm 192: /* ARGSUSED */
1.35 itojun 193: static void
1.41 markus 194: kex_protocol_error(int type, u_int32_t seq, void *ctxt)
1.1 markus 195: {
1.41 markus 196: error("Hm, kex protocol error: type %d seq %u", type, seq);
1.26 markus 197: }
1.1 markus 198:
1.35 itojun 199: static void
1.44 markus 200: kex_reset_dispatch(void)
1.29 markus 201: {
1.42 markus 202: dispatch_range(SSH2_MSG_TRANSPORT_MIN,
203: SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error);
1.44 markus 204: dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
1.29 markus 205: }
206:
207: void
1.28 markus 208: kex_finish(Kex *kex)
1.26 markus 209: {
1.44 markus 210: kex_reset_dispatch();
1.28 markus 211:
1.26 markus 212: packet_start(SSH2_MSG_NEWKEYS);
213: packet_send();
214: /* packet_write_wait(); */
215: debug("SSH2_MSG_NEWKEYS sent");
1.19 stevesk 216:
1.52 markus 217: debug("expecting SSH2_MSG_NEWKEYS");
1.40 markus 218: packet_read_expect(SSH2_MSG_NEWKEYS);
1.46 markus 219: packet_check_eom();
1.26 markus 220: debug("SSH2_MSG_NEWKEYS received");
1.32 markus 221:
1.30 markus 222: kex->done = 1;
1.100 ! markus 223: buffer_clear(kex->peer);
! 224: /* buffer_clear(kex->my); */
1.26 markus 225: kex->flags &= ~KEX_INIT_SENT;
1.91 djm 226: free(kex->name);
1.32 markus 227: kex->name = NULL;
1.26 markus 228: }
1.1 markus 229:
1.26 markus 230: void
231: kex_send_kexinit(Kex *kex)
232: {
1.60 avsm 233: u_int32_t rnd = 0;
1.49 markus 234: u_char *cookie;
1.61 djm 235: u_int i;
1.49 markus 236:
1.29 markus 237: if (kex == NULL) {
238: error("kex_send_kexinit: no kex, cannot rekey");
239: return;
240: }
1.28 markus 241: if (kex->flags & KEX_INIT_SENT) {
242: debug("KEX_INIT_SENT");
243: return;
244: }
1.30 markus 245: kex->done = 0;
1.49 markus 246:
247: /* generate a random cookie */
1.100 ! markus 248: if (buffer_len(kex->my) < KEX_COOKIE_LEN)
1.49 markus 249: fatal("kex_send_kexinit: kex proposal too short");
1.100 ! markus 250: cookie = buffer_ptr(kex->my);
1.49 markus 251: for (i = 0; i < KEX_COOKIE_LEN; i++) {
252: if (i % 4 == 0)
1.60 avsm 253: rnd = arc4random();
254: cookie[i] = rnd;
255: rnd >>= 8;
1.49 markus 256: }
1.26 markus 257: packet_start(SSH2_MSG_KEXINIT);
1.100 ! markus 258: packet_put_raw(buffer_ptr(kex->my), buffer_len(kex->my));
1.26 markus 259: packet_send();
260: debug("SSH2_MSG_KEXINIT sent");
261: kex->flags |= KEX_INIT_SENT;
1.1 markus 262: }
263:
1.78 djm 264: /* ARGSUSED */
1.26 markus 265: void
1.41 markus 266: kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
1.11 provos 267: {
1.100 ! markus 268: const char *ptr;
! 269: u_int i;
! 270: size_t dlen;
1.26 markus 271: Kex *kex = (Kex *)ctxt;
1.11 provos 272:
1.26 markus 273: debug("SSH2_MSG_KEXINIT received");
1.29 markus 274: if (kex == NULL)
275: fatal("kex_input_kexinit: no kex, cannot rekey");
1.11 provos 276:
1.26 markus 277: ptr = packet_get_raw(&dlen);
1.100 ! markus 278: buffer_append(kex->peer, ptr, dlen);
1.31 markus 279:
280: /* discard packet */
281: for (i = 0; i < KEX_COOKIE_LEN; i++)
282: packet_get_char();
283: for (i = 0; i < PROPOSAL_MAX; i++)
1.91 djm 284: free(packet_get_string(NULL));
1.87 djm 285: /*
286: * XXX RFC4253 sec 7: "each side MAY guess" - currently no supported
287: * KEX method has the server move first, but a server might be using
288: * a custom method or one that we otherwise don't support. We should
289: * be prepared to remember first_kex_follows here so we can eat a
290: * packet later.
291: * XXX2 - RFC4253 is kind of ambiguous on what first_kex_follows means
292: * for cases where the server *doesn't* go first. I guess we should
293: * ignore it when it is set for these cases, which is what we do now.
294: */
295: (void) packet_get_char(); /* first_kex_follows */
296: (void) packet_get_int(); /* reserved */
1.39 markus 297: packet_check_eom();
1.19 stevesk 298:
1.26 markus 299: kex_kexinit_finish(kex);
300: }
1.11 provos 301:
1.100 ! markus 302: void
! 303: kex_free_newkeys(struct newkeys *newkeys)
! 304: {
! 305: if (newkeys == NULL)
! 306: return;
! 307: if (newkeys->enc.key) {
! 308: explicit_bzero(newkeys->enc.key, newkeys->enc.key_len);
! 309: free(newkeys->enc.key);
! 310: newkeys->enc.key = NULL;
! 311: }
! 312: if (newkeys->enc.iv) {
! 313: explicit_bzero(newkeys->enc.iv, newkeys->enc.block_size);
! 314: free(newkeys->enc.iv);
! 315: newkeys->enc.iv = NULL;
! 316: }
! 317: free(newkeys->enc.name);
! 318: explicit_bzero(&newkeys->enc, sizeof(newkeys->enc));
! 319: free(newkeys->comp.name);
! 320: explicit_bzero(&newkeys->comp, sizeof(newkeys->comp));
! 321: mac_clear(&newkeys->mac);
! 322: if (newkeys->mac.key) {
! 323: explicit_bzero(newkeys->mac.key, newkeys->mac.key_len);
! 324: free(newkeys->mac.key);
! 325: newkeys->mac.key = NULL;
! 326: }
! 327: free(newkeys->mac.name);
! 328: explicit_bzero(&newkeys->mac, sizeof(newkeys->mac));
! 329: explicit_bzero(newkeys, sizeof(*newkeys));
! 330: free(newkeys);
! 331: }
! 332:
1.26 markus 333: Kex *
1.28 markus 334: kex_setup(char *proposal[PROPOSAL_MAX])
1.26 markus 335: {
1.100 ! markus 336: struct kex *kex;
1.11 provos 337:
1.100 ! markus 338: if ((kex = calloc(1, sizeof(*kex))) == NULL)
! 339: fatal("%s: calloc", __func__);
! 340: if ((kex->peer = sshbuf_new()) == NULL ||
! 341: (kex->my = sshbuf_new()) == NULL) {
! 342: fatal("%s: sshbuf_new", __func__);
! 343: }
! 344: kex_prop2buf(kex->my, proposal);
1.30 markus 345: kex->done = 0;
1.26 markus 346:
347: kex_send_kexinit(kex); /* we start */
1.44 markus 348: kex_reset_dispatch();
1.26 markus 349:
350: return kex;
1.11 provos 351: }
352:
1.35 itojun 353: static void
1.26 markus 354: kex_kexinit_finish(Kex *kex)
1.1 markus 355: {
1.26 markus 356: if (!(kex->flags & KEX_INIT_SENT))
357: kex_send_kexinit(kex);
1.1 markus 358:
1.26 markus 359: kex_choose_conf(kex);
1.1 markus 360:
1.54 markus 361: if (kex->kex_type >= 0 && kex->kex_type < KEX_MAX &&
362: kex->kex[kex->kex_type] != NULL) {
363: (kex->kex[kex->kex_type])(kex);
364: } else {
1.26 markus 365: fatal("Unsupported key exchange %d", kex->kex_type);
1.1 markus 366: }
367: }
368:
1.35 itojun 369: static void
1.1 markus 370: choose_enc(Enc *enc, char *client, char *server)
371: {
1.23 markus 372: char *name = match_list(client, server, NULL);
1.1 markus 373: if (name == NULL)
1.78 djm 374: fatal("no matching cipher found: client %s server %s",
375: client, server);
1.45 markus 376: if ((enc->cipher = cipher_by_name(name)) == NULL)
1.12 markus 377: fatal("matching cipher is not supported: %s", name);
1.1 markus 378: enc->name = name;
379: enc->enabled = 0;
380: enc->iv = NULL;
1.88 markus 381: enc->iv_len = cipher_ivlen(enc->cipher);
1.1 markus 382: enc->key = NULL;
1.45 markus 383: enc->key_len = cipher_keylen(enc->cipher);
384: enc->block_size = cipher_blocksize(enc->cipher);
1.1 markus 385: }
1.69 deraadt 386:
1.35 itojun 387: static void
1.1 markus 388: choose_mac(Mac *mac, char *client, char *server)
389: {
1.23 markus 390: char *name = match_list(client, server, NULL);
1.1 markus 391: if (name == NULL)
1.78 djm 392: fatal("no matching mac found: client %s server %s",
393: client, server);
1.79 djm 394: if (mac_setup(mac, name) < 0)
1.1 markus 395: fatal("unsupported mac %s", name);
1.21 markus 396: /* truncate the key */
397: if (datafellows & SSH_BUG_HMAC)
398: mac->key_len = 16;
1.1 markus 399: mac->name = name;
400: mac->key = NULL;
401: mac->enabled = 0;
402: }
1.69 deraadt 403:
1.35 itojun 404: static void
1.1 markus 405: choose_comp(Comp *comp, char *client, char *server)
406: {
1.23 markus 407: char *name = match_list(client, server, NULL);
1.1 markus 408: if (name == NULL)
409: fatal("no matching comp found: client %s server %s", client, server);
1.64 markus 410: if (strcmp(name, "zlib@openssh.com") == 0) {
411: comp->type = COMP_DELAYED;
412: } else if (strcmp(name, "zlib") == 0) {
413: comp->type = COMP_ZLIB;
1.1 markus 414: } else if (strcmp(name, "none") == 0) {
1.64 markus 415: comp->type = COMP_NONE;
1.1 markus 416: } else {
417: fatal("unsupported comp %s", name);
418: }
419: comp->name = name;
420: }
1.69 deraadt 421:
1.35 itojun 422: static void
1.1 markus 423: choose_kex(Kex *k, char *client, char *server)
424: {
1.89 djm 425: const struct kexalg *kexalg;
426:
1.23 markus 427: k->name = match_list(client, server, NULL);
1.1 markus 428: if (k->name == NULL)
1.78 djm 429: fatal("Unable to negotiate a key exchange method");
1.89 djm 430: if ((kexalg = kex_alg_by_name(k->name)) == NULL)
431: fatal("unsupported kex alg %s", k->name);
432: k->kex_type = kexalg->type;
1.94 djm 433: k->hash_alg = kexalg->hash_alg;
1.89 djm 434: k->ec_nid = kexalg->ec_nid;
1.1 markus 435: }
1.65 djm 436:
1.35 itojun 437: static void
1.1 markus 438: choose_hostkeyalg(Kex *k, char *client, char *server)
439: {
1.23 markus 440: char *hostkeyalg = match_list(client, server, NULL);
1.13 markus 441: if (hostkeyalg == NULL)
1.1 markus 442: fatal("no hostkey alg");
1.13 markus 443: k->hostkey_type = key_type_from_name(hostkeyalg);
444: if (k->hostkey_type == KEY_UNSPEC)
445: fatal("bad hostkey alg '%s'", hostkeyalg);
1.91 djm 446: free(hostkeyalg);
1.1 markus 447: }
448:
1.56 djm 449: static int
1.53 markus 450: proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX])
451: {
452: static int check[] = {
453: PROPOSAL_KEX_ALGS, PROPOSAL_SERVER_HOST_KEY_ALGS, -1
454: };
455: int *idx;
456: char *p;
457:
458: for (idx = &check[0]; *idx != -1; idx++) {
459: if ((p = strchr(my[*idx], ',')) != NULL)
460: *p = '\0';
461: if ((p = strchr(peer[*idx], ',')) != NULL)
462: *p = '\0';
463: if (strcmp(my[*idx], peer[*idx]) != 0) {
464: debug2("proposal mismatch: my %s peer %s",
465: my[*idx], peer[*idx]);
466: return (0);
467: }
468: }
469: debug2("proposals match");
470: return (1);
471: }
472:
1.35 itojun 473: static void
1.27 markus 474: kex_choose_conf(Kex *kex)
1.1 markus 475: {
1.27 markus 476: Newkeys *newkeys;
1.26 markus 477: char **my, **peer;
478: char **cprop, **sprop;
1.27 markus 479: int nenc, nmac, ncomp;
1.96 dtucker 480: u_int mode, ctos, need, dh_need, authlen;
1.53 markus 481: int first_kex_follows, type;
1.1 markus 482:
1.100 ! markus 483: my = kex_buf2prop(kex->my, NULL);
! 484: peer = kex_buf2prop(kex->peer, &first_kex_follows);
1.26 markus 485:
1.27 markus 486: if (kex->server) {
1.26 markus 487: cprop=peer;
488: sprop=my;
489: } else {
490: cprop=my;
491: sprop=peer;
1.82 andreas 492: }
493:
494: /* Check whether server offers roaming */
495: if (!kex->server) {
496: char *roaming;
497: roaming = match_list(KEX_RESUME, peer[PROPOSAL_KEX_ALGS], NULL);
498: if (roaming) {
499: kex->roaming = 1;
1.91 djm 500: free(roaming);
1.82 andreas 501: }
1.26 markus 502: }
1.1 markus 503:
1.30 markus 504: /* Algorithm Negotiation */
1.1 markus 505: for (mode = 0; mode < MODE_MAX; mode++) {
1.70 djm 506: newkeys = xcalloc(1, sizeof(*newkeys));
1.30 markus 507: kex->newkeys[mode] = newkeys;
1.78 djm 508: ctos = (!kex->server && mode == MODE_OUT) ||
509: (kex->server && mode == MODE_IN);
1.1 markus 510: nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC;
511: nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC;
512: ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
1.88 markus 513: choose_enc(&newkeys->enc, cprop[nenc], sprop[nenc]);
514: /* ignore mac for authenticated encryption */
515: authlen = cipher_authlen(newkeys->enc.cipher);
516: if (authlen == 0)
517: choose_mac(&newkeys->mac, cprop[nmac], sprop[nmac]);
1.27 markus 518: choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
1.2 markus 519: debug("kex: %s %s %s %s",
1.1 markus 520: ctos ? "client->server" : "server->client",
1.27 markus 521: newkeys->enc.name,
1.88 markus 522: authlen == 0 ? newkeys->mac.name : "<implicit>",
1.27 markus 523: newkeys->comp.name);
1.1 markus 524: }
1.27 markus 525: choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
526: choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
1.1 markus 527: sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
1.96 dtucker 528: need = dh_need = 0;
1.1 markus 529: for (mode = 0; mode < MODE_MAX; mode++) {
1.30 markus 530: newkeys = kex->newkeys[mode];
1.97 markus 531: need = MAX(need, newkeys->enc.key_len);
532: need = MAX(need, newkeys->enc.block_size);
533: need = MAX(need, newkeys->enc.iv_len);
534: need = MAX(need, newkeys->mac.key_len);
535: dh_need = MAX(dh_need, cipher_seclen(newkeys->enc.cipher));
536: dh_need = MAX(dh_need, newkeys->enc.block_size);
537: dh_need = MAX(dh_need, newkeys->enc.iv_len);
538: dh_need = MAX(dh_need, newkeys->mac.key_len);
1.1 markus 539: }
1.7 markus 540: /* XXX need runden? */
1.27 markus 541: kex->we_need = need;
1.96 dtucker 542: kex->dh_need = dh_need;
1.53 markus 543:
544: /* ignore the next message if the proposals do not match */
1.56 djm 545: if (first_kex_follows && !proposals_match(my, peer) &&
1.63 djm 546: !(datafellows & SSH_BUG_FIRSTKEX)) {
1.53 markus 547: type = packet_read();
548: debug2("skipping next packet (type %u)", type);
549: }
1.26 markus 550:
551: kex_prop_free(my);
552: kex_prop_free(peer);
553: }
554:
1.35 itojun 555: static u_char *
1.65 djm 556: derive_key(Kex *kex, int id, u_int need, u_char *hash, u_int hashlen,
1.95 djm 557: const u_char *shared_secret, u_int slen)
1.26 markus 558: {
559: Buffer b;
1.94 djm 560: struct ssh_digest_ctx *hashctx;
1.26 markus 561: char c = id;
1.61 djm 562: u_int have;
1.94 djm 563: size_t mdsz;
1.61 djm 564: u_char *digest;
1.62 djm 565:
1.94 djm 566: if ((mdsz = ssh_digest_bytes(kex->hash_alg)) == 0)
567: fatal("bad kex md size %zu", mdsz);
1.68 deraadt 568: digest = xmalloc(roundup(need, mdsz));
1.26 markus 569:
570: buffer_init(&b);
1.95 djm 571: buffer_append(&b, shared_secret, slen);
1.26 markus 572:
1.30 markus 573: /* K1 = HASH(K || H || "A" || session_id) */
1.94 djm 574: if ((hashctx = ssh_digest_start(kex->hash_alg)) == NULL)
575: fatal("%s: ssh_digest_start failed", __func__);
576: if (ssh_digest_update_buffer(hashctx, &b) != 0 ||
577: ssh_digest_update(hashctx, hash, hashlen) != 0 ||
578: ssh_digest_update(hashctx, &c, 1) != 0 ||
579: ssh_digest_update(hashctx, kex->session_id,
580: kex->session_id_len) != 0)
581: fatal("%s: ssh_digest_update failed", __func__);
582: if (ssh_digest_final(hashctx, digest, mdsz) != 0)
583: fatal("%s: ssh_digest_final failed", __func__);
584: ssh_digest_free(hashctx);
1.26 markus 585:
1.30 markus 586: /*
587: * expand key:
588: * Kn = HASH(K || H || K1 || K2 || ... || Kn-1)
589: * Key = K1 || K2 || ... || Kn
590: */
1.26 markus 591: for (have = mdsz; need > have; have += mdsz) {
1.94 djm 592: if ((hashctx = ssh_digest_start(kex->hash_alg)) == NULL)
593: fatal("%s: ssh_digest_start failed", __func__);
594: if (ssh_digest_update_buffer(hashctx, &b) != 0 ||
595: ssh_digest_update(hashctx, hash, hashlen) != 0 ||
596: ssh_digest_update(hashctx, digest, have) != 0)
597: fatal("%s: ssh_digest_update failed", __func__);
598: if (ssh_digest_final(hashctx, digest + have, mdsz) != 0)
599: fatal("%s: ssh_digest_final failed", __func__);
600: ssh_digest_free(hashctx);
1.26 markus 601: }
602: buffer_free(&b);
603: #ifdef DEBUG_KEX
604: fprintf(stderr, "key '%c'== ", c);
605: dump_digest("key", digest, need);
606: #endif
607: return digest;
1.1 markus 608: }
609:
1.23 markus 610: #define NKEYS 6
1.26 markus 611: void
1.95 djm 612: kex_derive_keys(Kex *kex, u_char *hash, u_int hashlen,
613: const u_char *shared_secret, u_int slen)
1.1 markus 614: {
1.15 markus 615: u_char *keys[NKEYS];
1.61 djm 616: u_int i, mode, ctos;
1.1 markus 617:
1.65 djm 618: for (i = 0; i < NKEYS; i++) {
619: keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, hashlen,
1.95 djm 620: shared_secret, slen);
1.65 djm 621: }
1.1 markus 622:
1.52 markus 623: debug2("kex_derive_keys");
1.1 markus 624: for (mode = 0; mode < MODE_MAX; mode++) {
1.69 deraadt 625: ctos = (!kex->server && mode == MODE_OUT) ||
626: (kex->server && mode == MODE_IN);
1.100 ! markus 627: kex->newkeys[mode]->enc.iv = keys[ctos ? 0 : 1];
! 628: kex->newkeys[mode]->enc.key = keys[ctos ? 2 : 3];
! 629: kex->newkeys[mode]->mac.key = keys[ctos ? 4 : 5];
1.1 markus 630: }
1.95 djm 631: }
632:
1.99 markus 633: #ifdef WITH_OPENSSL
1.95 djm 634: void
635: kex_derive_keys_bn(Kex *kex, u_char *hash, u_int hashlen, const BIGNUM *secret)
636: {
637: Buffer shared_secret;
638:
639: buffer_init(&shared_secret);
640: buffer_put_bignum2(&shared_secret, secret);
641: kex_derive_keys(kex, hash, hashlen,
642: buffer_ptr(&shared_secret), buffer_len(&shared_secret));
643: buffer_free(&shared_secret);
1.27 markus 644: }
1.99 markus 645: #endif
1.57 djm 646:
1.99 markus 647: #ifdef WITH_SSH1
1.57 djm 648: void
649: derive_ssh1_session_id(BIGNUM *host_modulus, BIGNUM *server_modulus,
650: u_int8_t cookie[8], u_int8_t id[16])
651: {
1.94 djm 652: u_int8_t nbuf[2048], obuf[SSH_DIGEST_MAX_LENGTH];
1.57 djm 653: int len;
1.94 djm 654: struct ssh_digest_ctx *hashctx;
1.57 djm 655:
1.94 djm 656: if ((hashctx = ssh_digest_start(SSH_DIGEST_MD5)) == NULL)
657: fatal("%s: ssh_digest_start", __func__);
1.57 djm 658:
659: len = BN_num_bytes(host_modulus);
1.61 djm 660: if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
1.57 djm 661: fatal("%s: bad host modulus (len %d)", __func__, len);
662: BN_bn2bin(host_modulus, nbuf);
1.94 djm 663: if (ssh_digest_update(hashctx, nbuf, len) != 0)
664: fatal("%s: ssh_digest_update failed", __func__);
1.57 djm 665:
666: len = BN_num_bytes(server_modulus);
1.61 djm 667: if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
1.57 djm 668: fatal("%s: bad server modulus (len %d)", __func__, len);
669: BN_bn2bin(server_modulus, nbuf);
1.94 djm 670: if (ssh_digest_update(hashctx, nbuf, len) != 0 ||
671: ssh_digest_update(hashctx, cookie, 8) != 0)
672: fatal("%s: ssh_digest_update failed", __func__);
673: if (ssh_digest_final(hashctx, obuf, sizeof(obuf)) != 0)
674: fatal("%s: ssh_digest_final failed", __func__);
675: memcpy(id, obuf, ssh_digest_bytes(SSH_DIGEST_MD5));
1.57 djm 676:
1.98 djm 677: explicit_bzero(nbuf, sizeof(nbuf));
678: explicit_bzero(obuf, sizeof(obuf));
1.1 markus 679: }
1.99 markus 680: #endif
1.26 markus 681:
1.84 djm 682: #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
1.26 markus 683: void
684: dump_digest(char *msg, u_char *digest, int len)
685: {
1.84 djm 686: int i;
1.26 markus 687:
688: fprintf(stderr, "%s\n", msg);
1.77 stevesk 689: for (i = 0; i < len; i++) {
1.26 markus 690: fprintf(stderr, "%02x", digest[i]);
691: if (i%32 == 31)
692: fprintf(stderr, "\n");
693: else if (i%8 == 7)
694: fprintf(stderr, " ");
695: }
696: fprintf(stderr, "\n");
697: }
698: #endif
![[BACK]](/icons/back.gif){kind=icon}
Return to kex.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh