Annotation of src/usr.bin/ssh/kex.c, Revision 1.101
1.101 ! markus 1: /* $OpenBSD: kex.c,v 1.100 2015/01/19 19:52:16 markus Exp $ */
1.1 markus 2: /*
1.36 markus 3: * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
1.1 markus 4: *
5: * Redistribution and use in source and binary forms, with or without
6: * modification, are permitted provided that the following conditions
7: * are met:
8: * 1. Redistributions of source code must retain the above copyright
9: * notice, this list of conditions and the following disclaimer.
10: * 2. Redistributions in binary form must reproduce the above copyright
11: * notice, this list of conditions and the following disclaimer in the
12: * documentation and/or other materials provided with the distribution.
13: *
14: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24: */
25:
1.73 stevesk 26: #include <sys/param.h>
1.18 markus 27:
1.76 deraadt 28: #include <signal.h>
1.75 stevesk 29: #include <stdio.h>
1.74 stevesk 30: #include <stdlib.h>
1.72 stevesk 31: #include <string.h>
1.1 markus 32:
1.99 markus 33: #ifdef WITH_OPENSSL
1.76 deraadt 34: #include <openssl/crypto.h>
1.99 markus 35: #endif
1.76 deraadt 36:
37: #include "xmalloc.h"
1.1 markus 38: #include "ssh2.h"
39: #include "buffer.h"
1.7 markus 40: #include "packet.h"
1.1 markus 41: #include "compat.h"
1.18 markus 42: #include "cipher.h"
1.76 deraadt 43: #include "key.h"
1.1 markus 44: #include "kex.h"
1.18 markus 45: #include "log.h"
1.21 markus 46: #include "mac.h"
1.23 markus 47: #include "match.h"
1.26 markus 48: #include "dispatch.h"
1.48 provos 49: #include "monitor.h"
1.82 andreas 50: #include "roaming.h"
1.94 djm 51: #include "digest.h"
1.48 provos 52:
1.35 itojun 53: /* prototype */
54: static void kex_kexinit_finish(Kex *);
55: static void kex_choose_conf(Kex *);
1.86 djm 56:
1.89 djm 57: struct kexalg {
58: char *name;
59: int type;
60: int ec_nid;
1.94 djm 61: int hash_alg;
1.89 djm 62: };
63: static const struct kexalg kexalgs[] = {
1.99 markus 64: #ifdef WITH_OPENSSL
1.94 djm 65: { KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
66: { KEX_DH14, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
67: { KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, SSH_DIGEST_SHA1 },
68: { KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256 },
69: { KEX_ECDH_SHA2_NISTP256, KEX_ECDH_SHA2,
70: NID_X9_62_prime256v1, SSH_DIGEST_SHA256 },
71: { KEX_ECDH_SHA2_NISTP384, KEX_ECDH_SHA2, NID_secp384r1,
72: SSH_DIGEST_SHA384 },
73: { KEX_ECDH_SHA2_NISTP521, KEX_ECDH_SHA2, NID_secp521r1,
74: SSH_DIGEST_SHA512 },
1.99 markus 75: #endif
1.94 djm 76: { KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
77: { NULL, -1, -1, -1},
1.89 djm 78: };
79:
80: char *
1.93 dtucker 81: kex_alg_list(char sep)
1.89 djm 82: {
83: char *ret = NULL;
84: size_t nlen, rlen = 0;
85: const struct kexalg *k;
86:
87: for (k = kexalgs; k->name != NULL; k++) {
88: if (ret != NULL)
1.93 dtucker 89: ret[rlen++] = sep;
1.89 djm 90: nlen = strlen(k->name);
91: ret = xrealloc(ret, 1, rlen + nlen + 2);
92: memcpy(ret + rlen, k->name, nlen + 1);
93: rlen += nlen;
94: }
95: return ret;
96: }
97:
98: static const struct kexalg *
99: kex_alg_by_name(const char *name)
100: {
101: const struct kexalg *k;
102:
103: for (k = kexalgs; k->name != NULL; k++) {
104: if (strcmp(k->name, name) == 0)
105: return k;
106: }
107: return NULL;
108: }
109:
1.86 djm 110: /* Validate KEX method name list */
111: int
112: kex_names_valid(const char *names)
113: {
114: char *s, *cp, *p;
115:
116: if (names == NULL || strcmp(names, "") == 0)
117: return 0;
118: s = cp = xstrdup(names);
119: for ((p = strsep(&cp, ",")); p && *p != '\0';
120: (p = strsep(&cp, ","))) {
1.89 djm 121: if (kex_alg_by_name(p) == NULL) {
1.86 djm 122: error("Unsupported KEX algorithm \"%.100s\"", p);
1.91 djm 123: free(s);
1.86 djm 124: return 0;
125: }
126: }
127: debug3("kex names ok: [%s]", names);
1.91 djm 128: free(s);
1.86 djm 129: return 1;
130: }
1.26 markus 131:
132: /* put algorithm proposal into buffer */
1.35 itojun 133: static void
1.26 markus 134: kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
1.1 markus 135: {
1.61 djm 136: u_int i;
1.26 markus 137:
138: buffer_clear(b);
1.49 markus 139: /*
140: * add a dummy cookie, the cookie will be overwritten by
141: * kex_send_kexinit(), each time a kexinit is set
142: */
143: for (i = 0; i < KEX_COOKIE_LEN; i++)
144: buffer_put_char(b, 0);
1.1 markus 145: for (i = 0; i < PROPOSAL_MAX; i++)
1.26 markus 146: buffer_put_cstring(b, proposal[i]);
147: buffer_put_char(b, 0); /* first_kex_packet_follows */
148: buffer_put_int(b, 0); /* uint32 reserved */
1.1 markus 149: }
150:
1.26 markus 151: /* parse buffer and return algorithm proposal */
1.35 itojun 152: static char **
1.53 markus 153: kex_buf2prop(Buffer *raw, int *first_kex_follows)
1.7 markus 154: {
1.26 markus 155: Buffer b;
1.78 djm 156: u_int i;
1.26 markus 157: char **proposal;
1.7 markus 158:
1.70 djm 159: proposal = xcalloc(PROPOSAL_MAX, sizeof(char *));
1.7 markus 160:
1.26 markus 161: buffer_init(&b);
162: buffer_append(&b, buffer_ptr(raw), buffer_len(raw));
1.7 markus 163: /* skip cookie */
164: for (i = 0; i < KEX_COOKIE_LEN; i++)
1.26 markus 165: buffer_get_char(&b);
1.7 markus 166: /* extract kex init proposal strings */
167: for (i = 0; i < PROPOSAL_MAX; i++) {
1.83 djm 168: proposal[i] = buffer_get_cstring(&b,NULL);
1.26 markus 169: debug2("kex_parse_kexinit: %s", proposal[i]);
1.7 markus 170: }
1.26 markus 171: /* first kex follows / reserved */
172: i = buffer_get_char(&b);
1.53 markus 173: if (first_kex_follows != NULL)
174: *first_kex_follows = i;
1.26 markus 175: debug2("kex_parse_kexinit: first_kex_follows %d ", i);
176: i = buffer_get_int(&b);
1.78 djm 177: debug2("kex_parse_kexinit: reserved %u ", i);
1.26 markus 178: buffer_free(&b);
179: return proposal;
1.1 markus 180: }
181:
1.35 itojun 182: static void
1.26 markus 183: kex_prop_free(char **proposal)
1.1 markus 184: {
1.61 djm 185: u_int i;
1.26 markus 186:
187: for (i = 0; i < PROPOSAL_MAX; i++)
1.91 djm 188: free(proposal[i]);
189: free(proposal);
1.1 markus 190: }
191:
1.78 djm 192: /* ARGSUSED */
1.101 ! markus 193: static int
1.41 markus 194: kex_protocol_error(int type, u_int32_t seq, void *ctxt)
1.1 markus 195: {
1.41 markus 196: error("Hm, kex protocol error: type %d seq %u", type, seq);
1.101 ! markus 197: return 0;
1.26 markus 198: }
1.1 markus 199:
1.35 itojun 200: static void
1.44 markus 201: kex_reset_dispatch(void)
1.29 markus 202: {
1.42 markus 203: dispatch_range(SSH2_MSG_TRANSPORT_MIN,
204: SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error);
1.44 markus 205: dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
1.29 markus 206: }
207:
208: void
1.28 markus 209: kex_finish(Kex *kex)
1.26 markus 210: {
1.44 markus 211: kex_reset_dispatch();
1.28 markus 212:
1.26 markus 213: packet_start(SSH2_MSG_NEWKEYS);
214: packet_send();
215: /* packet_write_wait(); */
216: debug("SSH2_MSG_NEWKEYS sent");
1.19 stevesk 217:
1.52 markus 218: debug("expecting SSH2_MSG_NEWKEYS");
1.40 markus 219: packet_read_expect(SSH2_MSG_NEWKEYS);
1.46 markus 220: packet_check_eom();
1.26 markus 221: debug("SSH2_MSG_NEWKEYS received");
1.32 markus 222:
1.30 markus 223: kex->done = 1;
1.100 markus 224: buffer_clear(kex->peer);
225: /* buffer_clear(kex->my); */
1.26 markus 226: kex->flags &= ~KEX_INIT_SENT;
1.91 djm 227: free(kex->name);
1.32 markus 228: kex->name = NULL;
1.26 markus 229: }
1.1 markus 230:
1.26 markus 231: void
232: kex_send_kexinit(Kex *kex)
233: {
1.60 avsm 234: u_int32_t rnd = 0;
1.49 markus 235: u_char *cookie;
1.61 djm 236: u_int i;
1.49 markus 237:
1.29 markus 238: if (kex == NULL) {
239: error("kex_send_kexinit: no kex, cannot rekey");
240: return;
241: }
1.28 markus 242: if (kex->flags & KEX_INIT_SENT) {
243: debug("KEX_INIT_SENT");
244: return;
245: }
1.30 markus 246: kex->done = 0;
1.49 markus 247:
248: /* generate a random cookie */
1.100 markus 249: if (buffer_len(kex->my) < KEX_COOKIE_LEN)
1.49 markus 250: fatal("kex_send_kexinit: kex proposal too short");
1.100 markus 251: cookie = buffer_ptr(kex->my);
1.49 markus 252: for (i = 0; i < KEX_COOKIE_LEN; i++) {
253: if (i % 4 == 0)
1.60 avsm 254: rnd = arc4random();
255: cookie[i] = rnd;
256: rnd >>= 8;
1.49 markus 257: }
1.26 markus 258: packet_start(SSH2_MSG_KEXINIT);
1.100 markus 259: packet_put_raw(buffer_ptr(kex->my), buffer_len(kex->my));
1.26 markus 260: packet_send();
261: debug("SSH2_MSG_KEXINIT sent");
262: kex->flags |= KEX_INIT_SENT;
1.1 markus 263: }
264:
1.78 djm 265: /* ARGSUSED */
1.101 ! markus 266: int
1.41 markus 267: kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
1.11 provos 268: {
1.100 markus 269: const char *ptr;
270: u_int i;
271: size_t dlen;
1.26 markus 272: Kex *kex = (Kex *)ctxt;
1.11 provos 273:
1.26 markus 274: debug("SSH2_MSG_KEXINIT received");
1.29 markus 275: if (kex == NULL)
276: fatal("kex_input_kexinit: no kex, cannot rekey");
1.11 provos 277:
1.26 markus 278: ptr = packet_get_raw(&dlen);
1.100 markus 279: buffer_append(kex->peer, ptr, dlen);
1.31 markus 280:
281: /* discard packet */
282: for (i = 0; i < KEX_COOKIE_LEN; i++)
283: packet_get_char();
284: for (i = 0; i < PROPOSAL_MAX; i++)
1.91 djm 285: free(packet_get_string(NULL));
1.87 djm 286: /*
287: * XXX RFC4253 sec 7: "each side MAY guess" - currently no supported
288: * KEX method has the server move first, but a server might be using
289: * a custom method or one that we otherwise don't support. We should
290: * be prepared to remember first_kex_follows here so we can eat a
291: * packet later.
292: * XXX2 - RFC4253 is kind of ambiguous on what first_kex_follows means
293: * for cases where the server *doesn't* go first. I guess we should
294: * ignore it when it is set for these cases, which is what we do now.
295: */
296: (void) packet_get_char(); /* first_kex_follows */
297: (void) packet_get_int(); /* reserved */
1.39 markus 298: packet_check_eom();
1.19 stevesk 299:
1.26 markus 300: kex_kexinit_finish(kex);
1.101 ! markus 301: return 0;
1.26 markus 302: }
1.11 provos 303:
1.100 markus 304: void
305: kex_free_newkeys(struct newkeys *newkeys)
306: {
307: if (newkeys == NULL)
308: return;
309: if (newkeys->enc.key) {
310: explicit_bzero(newkeys->enc.key, newkeys->enc.key_len);
311: free(newkeys->enc.key);
312: newkeys->enc.key = NULL;
313: }
314: if (newkeys->enc.iv) {
315: explicit_bzero(newkeys->enc.iv, newkeys->enc.block_size);
316: free(newkeys->enc.iv);
317: newkeys->enc.iv = NULL;
318: }
319: free(newkeys->enc.name);
320: explicit_bzero(&newkeys->enc, sizeof(newkeys->enc));
321: free(newkeys->comp.name);
322: explicit_bzero(&newkeys->comp, sizeof(newkeys->comp));
323: mac_clear(&newkeys->mac);
324: if (newkeys->mac.key) {
325: explicit_bzero(newkeys->mac.key, newkeys->mac.key_len);
326: free(newkeys->mac.key);
327: newkeys->mac.key = NULL;
328: }
329: free(newkeys->mac.name);
330: explicit_bzero(&newkeys->mac, sizeof(newkeys->mac));
331: explicit_bzero(newkeys, sizeof(*newkeys));
332: free(newkeys);
333: }
334:
1.26 markus 335: Kex *
1.28 markus 336: kex_setup(char *proposal[PROPOSAL_MAX])
1.26 markus 337: {
1.100 markus 338: struct kex *kex;
1.11 provos 339:
1.100 markus 340: if ((kex = calloc(1, sizeof(*kex))) == NULL)
341: fatal("%s: calloc", __func__);
342: if ((kex->peer = sshbuf_new()) == NULL ||
343: (kex->my = sshbuf_new()) == NULL) {
344: fatal("%s: sshbuf_new", __func__);
345: }
346: kex_prop2buf(kex->my, proposal);
1.30 markus 347: kex->done = 0;
1.26 markus 348:
349: kex_send_kexinit(kex); /* we start */
1.44 markus 350: kex_reset_dispatch();
1.26 markus 351:
352: return kex;
1.11 provos 353: }
354:
1.35 itojun 355: static void
1.26 markus 356: kex_kexinit_finish(Kex *kex)
1.1 markus 357: {
1.26 markus 358: if (!(kex->flags & KEX_INIT_SENT))
359: kex_send_kexinit(kex);
1.1 markus 360:
1.26 markus 361: kex_choose_conf(kex);
1.1 markus 362:
1.54 markus 363: if (kex->kex_type >= 0 && kex->kex_type < KEX_MAX &&
364: kex->kex[kex->kex_type] != NULL) {
365: (kex->kex[kex->kex_type])(kex);
366: } else {
1.26 markus 367: fatal("Unsupported key exchange %d", kex->kex_type);
1.1 markus 368: }
369: }
370:
1.35 itojun 371: static void
1.1 markus 372: choose_enc(Enc *enc, char *client, char *server)
373: {
1.23 markus 374: char *name = match_list(client, server, NULL);
1.1 markus 375: if (name == NULL)
1.78 djm 376: fatal("no matching cipher found: client %s server %s",
377: client, server);
1.45 markus 378: if ((enc->cipher = cipher_by_name(name)) == NULL)
1.12 markus 379: fatal("matching cipher is not supported: %s", name);
1.1 markus 380: enc->name = name;
381: enc->enabled = 0;
382: enc->iv = NULL;
1.88 markus 383: enc->iv_len = cipher_ivlen(enc->cipher);
1.1 markus 384: enc->key = NULL;
1.45 markus 385: enc->key_len = cipher_keylen(enc->cipher);
386: enc->block_size = cipher_blocksize(enc->cipher);
1.1 markus 387: }
1.69 deraadt 388:
1.35 itojun 389: static void
1.1 markus 390: choose_mac(Mac *mac, char *client, char *server)
391: {
1.23 markus 392: char *name = match_list(client, server, NULL);
1.1 markus 393: if (name == NULL)
1.78 djm 394: fatal("no matching mac found: client %s server %s",
395: client, server);
1.79 djm 396: if (mac_setup(mac, name) < 0)
1.1 markus 397: fatal("unsupported mac %s", name);
1.21 markus 398: /* truncate the key */
399: if (datafellows & SSH_BUG_HMAC)
400: mac->key_len = 16;
1.1 markus 401: mac->name = name;
402: mac->key = NULL;
403: mac->enabled = 0;
404: }
1.69 deraadt 405:
1.35 itojun 406: static void
1.1 markus 407: choose_comp(Comp *comp, char *client, char *server)
408: {
1.23 markus 409: char *name = match_list(client, server, NULL);
1.1 markus 410: if (name == NULL)
411: fatal("no matching comp found: client %s server %s", client, server);
1.64 markus 412: if (strcmp(name, "zlib@openssh.com") == 0) {
413: comp->type = COMP_DELAYED;
414: } else if (strcmp(name, "zlib") == 0) {
415: comp->type = COMP_ZLIB;
1.1 markus 416: } else if (strcmp(name, "none") == 0) {
1.64 markus 417: comp->type = COMP_NONE;
1.1 markus 418: } else {
419: fatal("unsupported comp %s", name);
420: }
421: comp->name = name;
422: }
1.69 deraadt 423:
1.35 itojun 424: static void
1.1 markus 425: choose_kex(Kex *k, char *client, char *server)
426: {
1.89 djm 427: const struct kexalg *kexalg;
428:
1.23 markus 429: k->name = match_list(client, server, NULL);
1.1 markus 430: if (k->name == NULL)
1.78 djm 431: fatal("Unable to negotiate a key exchange method");
1.89 djm 432: if ((kexalg = kex_alg_by_name(k->name)) == NULL)
433: fatal("unsupported kex alg %s", k->name);
434: k->kex_type = kexalg->type;
1.94 djm 435: k->hash_alg = kexalg->hash_alg;
1.89 djm 436: k->ec_nid = kexalg->ec_nid;
1.1 markus 437: }
1.65 djm 438:
1.35 itojun 439: static void
1.1 markus 440: choose_hostkeyalg(Kex *k, char *client, char *server)
441: {
1.23 markus 442: char *hostkeyalg = match_list(client, server, NULL);
1.13 markus 443: if (hostkeyalg == NULL)
1.1 markus 444: fatal("no hostkey alg");
1.13 markus 445: k->hostkey_type = key_type_from_name(hostkeyalg);
446: if (k->hostkey_type == KEY_UNSPEC)
447: fatal("bad hostkey alg '%s'", hostkeyalg);
1.91 djm 448: free(hostkeyalg);
1.1 markus 449: }
450:
1.56 djm 451: static int
1.53 markus 452: proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX])
453: {
454: static int check[] = {
455: PROPOSAL_KEX_ALGS, PROPOSAL_SERVER_HOST_KEY_ALGS, -1
456: };
457: int *idx;
458: char *p;
459:
460: for (idx = &check[0]; *idx != -1; idx++) {
461: if ((p = strchr(my[*idx], ',')) != NULL)
462: *p = '\0';
463: if ((p = strchr(peer[*idx], ',')) != NULL)
464: *p = '\0';
465: if (strcmp(my[*idx], peer[*idx]) != 0) {
466: debug2("proposal mismatch: my %s peer %s",
467: my[*idx], peer[*idx]);
468: return (0);
469: }
470: }
471: debug2("proposals match");
472: return (1);
473: }
474:
1.35 itojun 475: static void
1.27 markus 476: kex_choose_conf(Kex *kex)
1.1 markus 477: {
1.27 markus 478: Newkeys *newkeys;
1.26 markus 479: char **my, **peer;
480: char **cprop, **sprop;
1.27 markus 481: int nenc, nmac, ncomp;
1.96 dtucker 482: u_int mode, ctos, need, dh_need, authlen;
1.53 markus 483: int first_kex_follows, type;
1.1 markus 484:
1.100 markus 485: my = kex_buf2prop(kex->my, NULL);
486: peer = kex_buf2prop(kex->peer, &first_kex_follows);
1.26 markus 487:
1.27 markus 488: if (kex->server) {
1.26 markus 489: cprop=peer;
490: sprop=my;
491: } else {
492: cprop=my;
493: sprop=peer;
1.82 andreas 494: }
495:
496: /* Check whether server offers roaming */
497: if (!kex->server) {
498: char *roaming;
499: roaming = match_list(KEX_RESUME, peer[PROPOSAL_KEX_ALGS], NULL);
500: if (roaming) {
501: kex->roaming = 1;
1.91 djm 502: free(roaming);
1.82 andreas 503: }
1.26 markus 504: }
1.1 markus 505:
1.30 markus 506: /* Algorithm Negotiation */
1.1 markus 507: for (mode = 0; mode < MODE_MAX; mode++) {
1.70 djm 508: newkeys = xcalloc(1, sizeof(*newkeys));
1.30 markus 509: kex->newkeys[mode] = newkeys;
1.78 djm 510: ctos = (!kex->server && mode == MODE_OUT) ||
511: (kex->server && mode == MODE_IN);
1.1 markus 512: nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC;
513: nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC;
514: ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
1.88 markus 515: choose_enc(&newkeys->enc, cprop[nenc], sprop[nenc]);
516: /* ignore mac for authenticated encryption */
517: authlen = cipher_authlen(newkeys->enc.cipher);
518: if (authlen == 0)
519: choose_mac(&newkeys->mac, cprop[nmac], sprop[nmac]);
1.27 markus 520: choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
1.2 markus 521: debug("kex: %s %s %s %s",
1.1 markus 522: ctos ? "client->server" : "server->client",
1.27 markus 523: newkeys->enc.name,
1.88 markus 524: authlen == 0 ? newkeys->mac.name : "<implicit>",
1.27 markus 525: newkeys->comp.name);
1.1 markus 526: }
1.27 markus 527: choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
528: choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
1.1 markus 529: sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
1.96 dtucker 530: need = dh_need = 0;
1.1 markus 531: for (mode = 0; mode < MODE_MAX; mode++) {
1.30 markus 532: newkeys = kex->newkeys[mode];
1.97 markus 533: need = MAX(need, newkeys->enc.key_len);
534: need = MAX(need, newkeys->enc.block_size);
535: need = MAX(need, newkeys->enc.iv_len);
536: need = MAX(need, newkeys->mac.key_len);
537: dh_need = MAX(dh_need, cipher_seclen(newkeys->enc.cipher));
538: dh_need = MAX(dh_need, newkeys->enc.block_size);
539: dh_need = MAX(dh_need, newkeys->enc.iv_len);
540: dh_need = MAX(dh_need, newkeys->mac.key_len);
1.1 markus 541: }
1.7 markus 542: /* XXX need runden? */
1.27 markus 543: kex->we_need = need;
1.96 dtucker 544: kex->dh_need = dh_need;
1.53 markus 545:
546: /* ignore the next message if the proposals do not match */
1.56 djm 547: if (first_kex_follows && !proposals_match(my, peer) &&
1.63 djm 548: !(datafellows & SSH_BUG_FIRSTKEX)) {
1.53 markus 549: type = packet_read();
550: debug2("skipping next packet (type %u)", type);
551: }
1.26 markus 552:
553: kex_prop_free(my);
554: kex_prop_free(peer);
555: }
556:
1.35 itojun 557: static u_char *
1.65 djm 558: derive_key(Kex *kex, int id, u_int need, u_char *hash, u_int hashlen,
1.95 djm 559: const u_char *shared_secret, u_int slen)
1.26 markus 560: {
561: Buffer b;
1.94 djm 562: struct ssh_digest_ctx *hashctx;
1.26 markus 563: char c = id;
1.61 djm 564: u_int have;
1.94 djm 565: size_t mdsz;
1.61 djm 566: u_char *digest;
1.62 djm 567:
1.94 djm 568: if ((mdsz = ssh_digest_bytes(kex->hash_alg)) == 0)
569: fatal("bad kex md size %zu", mdsz);
1.68 deraadt 570: digest = xmalloc(roundup(need, mdsz));
1.26 markus 571:
572: buffer_init(&b);
1.95 djm 573: buffer_append(&b, shared_secret, slen);
1.26 markus 574:
1.30 markus 575: /* K1 = HASH(K || H || "A" || session_id) */
1.94 djm 576: if ((hashctx = ssh_digest_start(kex->hash_alg)) == NULL)
577: fatal("%s: ssh_digest_start failed", __func__);
578: if (ssh_digest_update_buffer(hashctx, &b) != 0 ||
579: ssh_digest_update(hashctx, hash, hashlen) != 0 ||
580: ssh_digest_update(hashctx, &c, 1) != 0 ||
581: ssh_digest_update(hashctx, kex->session_id,
582: kex->session_id_len) != 0)
583: fatal("%s: ssh_digest_update failed", __func__);
584: if (ssh_digest_final(hashctx, digest, mdsz) != 0)
585: fatal("%s: ssh_digest_final failed", __func__);
586: ssh_digest_free(hashctx);
1.26 markus 587:
1.30 markus 588: /*
589: * expand key:
590: * Kn = HASH(K || H || K1 || K2 || ... || Kn-1)
591: * Key = K1 || K2 || ... || Kn
592: */
1.26 markus 593: for (have = mdsz; need > have; have += mdsz) {
1.94 djm 594: if ((hashctx = ssh_digest_start(kex->hash_alg)) == NULL)
595: fatal("%s: ssh_digest_start failed", __func__);
596: if (ssh_digest_update_buffer(hashctx, &b) != 0 ||
597: ssh_digest_update(hashctx, hash, hashlen) != 0 ||
598: ssh_digest_update(hashctx, digest, have) != 0)
599: fatal("%s: ssh_digest_update failed", __func__);
600: if (ssh_digest_final(hashctx, digest + have, mdsz) != 0)
601: fatal("%s: ssh_digest_final failed", __func__);
602: ssh_digest_free(hashctx);
1.26 markus 603: }
604: buffer_free(&b);
605: #ifdef DEBUG_KEX
606: fprintf(stderr, "key '%c'== ", c);
607: dump_digest("key", digest, need);
608: #endif
609: return digest;
1.1 markus 610: }
611:
1.23 markus 612: #define NKEYS 6
1.26 markus 613: void
1.95 djm 614: kex_derive_keys(Kex *kex, u_char *hash, u_int hashlen,
615: const u_char *shared_secret, u_int slen)
1.1 markus 616: {
1.15 markus 617: u_char *keys[NKEYS];
1.61 djm 618: u_int i, mode, ctos;
1.1 markus 619:
1.65 djm 620: for (i = 0; i < NKEYS; i++) {
621: keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, hashlen,
1.95 djm 622: shared_secret, slen);
1.65 djm 623: }
1.1 markus 624:
1.52 markus 625: debug2("kex_derive_keys");
1.1 markus 626: for (mode = 0; mode < MODE_MAX; mode++) {
1.69 deraadt 627: ctos = (!kex->server && mode == MODE_OUT) ||
628: (kex->server && mode == MODE_IN);
1.100 markus 629: kex->newkeys[mode]->enc.iv = keys[ctos ? 0 : 1];
630: kex->newkeys[mode]->enc.key = keys[ctos ? 2 : 3];
631: kex->newkeys[mode]->mac.key = keys[ctos ? 4 : 5];
1.1 markus 632: }
1.95 djm 633: }
634:
1.99 markus 635: #ifdef WITH_OPENSSL
1.95 djm 636: void
637: kex_derive_keys_bn(Kex *kex, u_char *hash, u_int hashlen, const BIGNUM *secret)
638: {
639: Buffer shared_secret;
640:
641: buffer_init(&shared_secret);
642: buffer_put_bignum2(&shared_secret, secret);
643: kex_derive_keys(kex, hash, hashlen,
644: buffer_ptr(&shared_secret), buffer_len(&shared_secret));
645: buffer_free(&shared_secret);
1.27 markus 646: }
1.99 markus 647: #endif
1.57 djm 648:
1.99 markus 649: #ifdef WITH_SSH1
1.57 djm 650: void
651: derive_ssh1_session_id(BIGNUM *host_modulus, BIGNUM *server_modulus,
652: u_int8_t cookie[8], u_int8_t id[16])
653: {
1.94 djm 654: u_int8_t nbuf[2048], obuf[SSH_DIGEST_MAX_LENGTH];
1.57 djm 655: int len;
1.94 djm 656: struct ssh_digest_ctx *hashctx;
1.57 djm 657:
1.94 djm 658: if ((hashctx = ssh_digest_start(SSH_DIGEST_MD5)) == NULL)
659: fatal("%s: ssh_digest_start", __func__);
1.57 djm 660:
661: len = BN_num_bytes(host_modulus);
1.61 djm 662: if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
1.57 djm 663: fatal("%s: bad host modulus (len %d)", __func__, len);
664: BN_bn2bin(host_modulus, nbuf);
1.94 djm 665: if (ssh_digest_update(hashctx, nbuf, len) != 0)
666: fatal("%s: ssh_digest_update failed", __func__);
1.57 djm 667:
668: len = BN_num_bytes(server_modulus);
1.61 djm 669: if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
1.57 djm 670: fatal("%s: bad server modulus (len %d)", __func__, len);
671: BN_bn2bin(server_modulus, nbuf);
1.94 djm 672: if (ssh_digest_update(hashctx, nbuf, len) != 0 ||
673: ssh_digest_update(hashctx, cookie, 8) != 0)
674: fatal("%s: ssh_digest_update failed", __func__);
675: if (ssh_digest_final(hashctx, obuf, sizeof(obuf)) != 0)
676: fatal("%s: ssh_digest_final failed", __func__);
677: memcpy(id, obuf, ssh_digest_bytes(SSH_DIGEST_MD5));
1.57 djm 678:
1.98 djm 679: explicit_bzero(nbuf, sizeof(nbuf));
680: explicit_bzero(obuf, sizeof(obuf));
1.1 markus 681: }
1.99 markus 682: #endif
1.26 markus 683:
1.84 djm 684: #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
1.26 markus 685: void
686: dump_digest(char *msg, u_char *digest, int len)
687: {
1.84 djm 688: int i;
1.26 markus 689:
690: fprintf(stderr, "%s\n", msg);
1.77 stevesk 691: for (i = 0; i < len; i++) {
1.26 markus 692: fprintf(stderr, "%02x", digest[i]);
693: if (i%32 == 31)
694: fprintf(stderr, "\n");
695: else if (i%8 == 7)
696: fprintf(stderr, " ");
697: }
698: fprintf(stderr, "\n");
699: }
700: #endif
![[BACK]](/icons/back.gif){kind=icon}
Return to kex.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh