Annotation of src/usr.bin/ssh/kex.c, Revision 1.99
1.99 ! markus 1: /* $OpenBSD: kex.c,v 1.98 2014/02/02 03:44:31 djm Exp $ */
1.1 markus 2: /*
1.36 markus 3: * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
1.1 markus 4: *
5: * Redistribution and use in source and binary forms, with or without
6: * modification, are permitted provided that the following conditions
7: * are met:
8: * 1. Redistributions of source code must retain the above copyright
9: * notice, this list of conditions and the following disclaimer.
10: * 2. Redistributions in binary form must reproduce the above copyright
11: * notice, this list of conditions and the following disclaimer in the
12: * documentation and/or other materials provided with the distribution.
13: *
14: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24: */
25:
1.73 stevesk 26: #include <sys/param.h>
1.18 markus 27:
1.76 deraadt 28: #include <signal.h>
1.75 stevesk 29: #include <stdio.h>
1.74 stevesk 30: #include <stdlib.h>
1.72 stevesk 31: #include <string.h>
1.1 markus 32:
1.99 ! markus 33: #ifdef WITH_OPENSSL
1.76 deraadt 34: #include <openssl/crypto.h>
1.99 ! markus 35: #endif
1.76 deraadt 36:
37: #include "xmalloc.h"
1.1 markus 38: #include "ssh2.h"
39: #include "buffer.h"
1.7 markus 40: #include "packet.h"
1.1 markus 41: #include "compat.h"
1.18 markus 42: #include "cipher.h"
1.76 deraadt 43: #include "key.h"
1.1 markus 44: #include "kex.h"
1.18 markus 45: #include "log.h"
1.21 markus 46: #include "mac.h"
1.23 markus 47: #include "match.h"
1.26 markus 48: #include "dispatch.h"
1.48 provos 49: #include "monitor.h"
1.82 andreas 50: #include "roaming.h"
1.94 djm 51: #include "digest.h"
1.48 provos 52:
1.35 itojun 53: /* prototype */
54: static void kex_kexinit_finish(Kex *);
55: static void kex_choose_conf(Kex *);
1.86 djm 56:
1.89 djm 57: struct kexalg {
58: char *name;
59: int type;
60: int ec_nid;
1.94 djm 61: int hash_alg;
1.89 djm 62: };
63: static const struct kexalg kexalgs[] = {
1.99 ! markus 64: #ifdef WITH_OPENSSL
1.94 djm 65: { KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
66: { KEX_DH14, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
67: { KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, SSH_DIGEST_SHA1 },
68: { KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256 },
69: { KEX_ECDH_SHA2_NISTP256, KEX_ECDH_SHA2,
70: NID_X9_62_prime256v1, SSH_DIGEST_SHA256 },
71: { KEX_ECDH_SHA2_NISTP384, KEX_ECDH_SHA2, NID_secp384r1,
72: SSH_DIGEST_SHA384 },
73: { KEX_ECDH_SHA2_NISTP521, KEX_ECDH_SHA2, NID_secp521r1,
74: SSH_DIGEST_SHA512 },
1.99 ! markus 75: #endif
1.94 djm 76: { KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
77: { NULL, -1, -1, -1},
1.89 djm 78: };
79:
80: char *
1.93 dtucker 81: kex_alg_list(char sep)
1.89 djm 82: {
83: char *ret = NULL;
84: size_t nlen, rlen = 0;
85: const struct kexalg *k;
86:
87: for (k = kexalgs; k->name != NULL; k++) {
88: if (ret != NULL)
1.93 dtucker 89: ret[rlen++] = sep;
1.89 djm 90: nlen = strlen(k->name);
91: ret = xrealloc(ret, 1, rlen + nlen + 2);
92: memcpy(ret + rlen, k->name, nlen + 1);
93: rlen += nlen;
94: }
95: return ret;
96: }
97:
98: static const struct kexalg *
99: kex_alg_by_name(const char *name)
100: {
101: const struct kexalg *k;
102:
103: for (k = kexalgs; k->name != NULL; k++) {
104: if (strcmp(k->name, name) == 0)
105: return k;
106: }
107: return NULL;
108: }
109:
1.86 djm 110: /* Validate KEX method name list */
111: int
112: kex_names_valid(const char *names)
113: {
114: char *s, *cp, *p;
115:
116: if (names == NULL || strcmp(names, "") == 0)
117: return 0;
118: s = cp = xstrdup(names);
119: for ((p = strsep(&cp, ",")); p && *p != '\0';
120: (p = strsep(&cp, ","))) {
1.89 djm 121: if (kex_alg_by_name(p) == NULL) {
1.86 djm 122: error("Unsupported KEX algorithm \"%.100s\"", p);
1.91 djm 123: free(s);
1.86 djm 124: return 0;
125: }
126: }
127: debug3("kex names ok: [%s]", names);
1.91 djm 128: free(s);
1.86 djm 129: return 1;
130: }
1.26 markus 131:
132: /* put algorithm proposal into buffer */
1.35 itojun 133: static void
1.26 markus 134: kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
1.1 markus 135: {
1.61 djm 136: u_int i;
1.26 markus 137:
138: buffer_clear(b);
1.49 markus 139: /*
140: * add a dummy cookie, the cookie will be overwritten by
141: * kex_send_kexinit(), each time a kexinit is set
142: */
143: for (i = 0; i < KEX_COOKIE_LEN; i++)
144: buffer_put_char(b, 0);
1.1 markus 145: for (i = 0; i < PROPOSAL_MAX; i++)
1.26 markus 146: buffer_put_cstring(b, proposal[i]);
147: buffer_put_char(b, 0); /* first_kex_packet_follows */
148: buffer_put_int(b, 0); /* uint32 reserved */
1.1 markus 149: }
150:
1.26 markus 151: /* parse buffer and return algorithm proposal */
1.35 itojun 152: static char **
1.53 markus 153: kex_buf2prop(Buffer *raw, int *first_kex_follows)
1.7 markus 154: {
1.26 markus 155: Buffer b;
1.78 djm 156: u_int i;
1.26 markus 157: char **proposal;
1.7 markus 158:
1.70 djm 159: proposal = xcalloc(PROPOSAL_MAX, sizeof(char *));
1.7 markus 160:
1.26 markus 161: buffer_init(&b);
162: buffer_append(&b, buffer_ptr(raw), buffer_len(raw));
1.7 markus 163: /* skip cookie */
164: for (i = 0; i < KEX_COOKIE_LEN; i++)
1.26 markus 165: buffer_get_char(&b);
1.7 markus 166: /* extract kex init proposal strings */
167: for (i = 0; i < PROPOSAL_MAX; i++) {
1.83 djm 168: proposal[i] = buffer_get_cstring(&b,NULL);
1.26 markus 169: debug2("kex_parse_kexinit: %s", proposal[i]);
1.7 markus 170: }
1.26 markus 171: /* first kex follows / reserved */
172: i = buffer_get_char(&b);
1.53 markus 173: if (first_kex_follows != NULL)
174: *first_kex_follows = i;
1.26 markus 175: debug2("kex_parse_kexinit: first_kex_follows %d ", i);
176: i = buffer_get_int(&b);
1.78 djm 177: debug2("kex_parse_kexinit: reserved %u ", i);
1.26 markus 178: buffer_free(&b);
179: return proposal;
1.1 markus 180: }
181:
1.35 itojun 182: static void
1.26 markus 183: kex_prop_free(char **proposal)
1.1 markus 184: {
1.61 djm 185: u_int i;
1.26 markus 186:
187: for (i = 0; i < PROPOSAL_MAX; i++)
1.91 djm 188: free(proposal[i]);
189: free(proposal);
1.1 markus 190: }
191:
1.78 djm 192: /* ARGSUSED */
1.35 itojun 193: static void
1.41 markus 194: kex_protocol_error(int type, u_int32_t seq, void *ctxt)
1.1 markus 195: {
1.41 markus 196: error("Hm, kex protocol error: type %d seq %u", type, seq);
1.26 markus 197: }
1.1 markus 198:
1.35 itojun 199: static void
1.44 markus 200: kex_reset_dispatch(void)
1.29 markus 201: {
1.42 markus 202: dispatch_range(SSH2_MSG_TRANSPORT_MIN,
203: SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error);
1.44 markus 204: dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
1.29 markus 205: }
206:
207: void
1.28 markus 208: kex_finish(Kex *kex)
1.26 markus 209: {
1.44 markus 210: kex_reset_dispatch();
1.28 markus 211:
1.26 markus 212: packet_start(SSH2_MSG_NEWKEYS);
213: packet_send();
214: /* packet_write_wait(); */
215: debug("SSH2_MSG_NEWKEYS sent");
1.19 stevesk 216:
1.52 markus 217: debug("expecting SSH2_MSG_NEWKEYS");
1.40 markus 218: packet_read_expect(SSH2_MSG_NEWKEYS);
1.46 markus 219: packet_check_eom();
1.26 markus 220: debug("SSH2_MSG_NEWKEYS received");
1.32 markus 221:
1.30 markus 222: kex->done = 1;
1.26 markus 223: buffer_clear(&kex->peer);
1.27 markus 224: /* buffer_clear(&kex->my); */
1.26 markus 225: kex->flags &= ~KEX_INIT_SENT;
1.91 djm 226: free(kex->name);
1.32 markus 227: kex->name = NULL;
1.26 markus 228: }
1.1 markus 229:
1.26 markus 230: void
231: kex_send_kexinit(Kex *kex)
232: {
1.60 avsm 233: u_int32_t rnd = 0;
1.49 markus 234: u_char *cookie;
1.61 djm 235: u_int i;
1.49 markus 236:
1.29 markus 237: if (kex == NULL) {
238: error("kex_send_kexinit: no kex, cannot rekey");
239: return;
240: }
1.28 markus 241: if (kex->flags & KEX_INIT_SENT) {
242: debug("KEX_INIT_SENT");
243: return;
244: }
1.30 markus 245: kex->done = 0;
1.49 markus 246:
247: /* generate a random cookie */
248: if (buffer_len(&kex->my) < KEX_COOKIE_LEN)
249: fatal("kex_send_kexinit: kex proposal too short");
250: cookie = buffer_ptr(&kex->my);
251: for (i = 0; i < KEX_COOKIE_LEN; i++) {
252: if (i % 4 == 0)
1.60 avsm 253: rnd = arc4random();
254: cookie[i] = rnd;
255: rnd >>= 8;
1.49 markus 256: }
1.26 markus 257: packet_start(SSH2_MSG_KEXINIT);
258: packet_put_raw(buffer_ptr(&kex->my), buffer_len(&kex->my));
259: packet_send();
260: debug("SSH2_MSG_KEXINIT sent");
261: kex->flags |= KEX_INIT_SENT;
1.1 markus 262: }
263:
1.78 djm 264: /* ARGSUSED */
1.26 markus 265: void
1.41 markus 266: kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
1.11 provos 267: {
1.26 markus 268: char *ptr;
1.61 djm 269: u_int i, dlen;
1.26 markus 270: Kex *kex = (Kex *)ctxt;
1.11 provos 271:
1.26 markus 272: debug("SSH2_MSG_KEXINIT received");
1.29 markus 273: if (kex == NULL)
274: fatal("kex_input_kexinit: no kex, cannot rekey");
1.11 provos 275:
1.26 markus 276: ptr = packet_get_raw(&dlen);
277: buffer_append(&kex->peer, ptr, dlen);
1.31 markus 278:
279: /* discard packet */
280: for (i = 0; i < KEX_COOKIE_LEN; i++)
281: packet_get_char();
282: for (i = 0; i < PROPOSAL_MAX; i++)
1.91 djm 283: free(packet_get_string(NULL));
1.87 djm 284: /*
285: * XXX RFC4253 sec 7: "each side MAY guess" - currently no supported
286: * KEX method has the server move first, but a server might be using
287: * a custom method or one that we otherwise don't support. We should
288: * be prepared to remember first_kex_follows here so we can eat a
289: * packet later.
290: * XXX2 - RFC4253 is kind of ambiguous on what first_kex_follows means
291: * for cases where the server *doesn't* go first. I guess we should
292: * ignore it when it is set for these cases, which is what we do now.
293: */
294: (void) packet_get_char(); /* first_kex_follows */
295: (void) packet_get_int(); /* reserved */
1.39 markus 296: packet_check_eom();
1.19 stevesk 297:
1.26 markus 298: kex_kexinit_finish(kex);
299: }
1.11 provos 300:
1.26 markus 301: Kex *
1.28 markus 302: kex_setup(char *proposal[PROPOSAL_MAX])
1.26 markus 303: {
304: Kex *kex;
1.11 provos 305:
1.70 djm 306: kex = xcalloc(1, sizeof(*kex));
1.26 markus 307: buffer_init(&kex->peer);
308: buffer_init(&kex->my);
309: kex_prop2buf(&kex->my, proposal);
1.30 markus 310: kex->done = 0;
1.26 markus 311:
312: kex_send_kexinit(kex); /* we start */
1.44 markus 313: kex_reset_dispatch();
1.26 markus 314:
315: return kex;
1.11 provos 316: }
317:
1.35 itojun 318: static void
1.26 markus 319: kex_kexinit_finish(Kex *kex)
1.1 markus 320: {
1.26 markus 321: if (!(kex->flags & KEX_INIT_SENT))
322: kex_send_kexinit(kex);
1.1 markus 323:
1.26 markus 324: kex_choose_conf(kex);
1.1 markus 325:
1.54 markus 326: if (kex->kex_type >= 0 && kex->kex_type < KEX_MAX &&
327: kex->kex[kex->kex_type] != NULL) {
328: (kex->kex[kex->kex_type])(kex);
329: } else {
1.26 markus 330: fatal("Unsupported key exchange %d", kex->kex_type);
1.1 markus 331: }
332: }
333:
1.35 itojun 334: static void
1.1 markus 335: choose_enc(Enc *enc, char *client, char *server)
336: {
1.23 markus 337: char *name = match_list(client, server, NULL);
1.1 markus 338: if (name == NULL)
1.78 djm 339: fatal("no matching cipher found: client %s server %s",
340: client, server);
1.45 markus 341: if ((enc->cipher = cipher_by_name(name)) == NULL)
1.12 markus 342: fatal("matching cipher is not supported: %s", name);
1.1 markus 343: enc->name = name;
344: enc->enabled = 0;
345: enc->iv = NULL;
1.88 markus 346: enc->iv_len = cipher_ivlen(enc->cipher);
1.1 markus 347: enc->key = NULL;
1.45 markus 348: enc->key_len = cipher_keylen(enc->cipher);
349: enc->block_size = cipher_blocksize(enc->cipher);
1.1 markus 350: }
1.69 deraadt 351:
1.35 itojun 352: static void
1.1 markus 353: choose_mac(Mac *mac, char *client, char *server)
354: {
1.23 markus 355: char *name = match_list(client, server, NULL);
1.1 markus 356: if (name == NULL)
1.78 djm 357: fatal("no matching mac found: client %s server %s",
358: client, server);
1.79 djm 359: if (mac_setup(mac, name) < 0)
1.1 markus 360: fatal("unsupported mac %s", name);
1.21 markus 361: /* truncate the key */
362: if (datafellows & SSH_BUG_HMAC)
363: mac->key_len = 16;
1.1 markus 364: mac->name = name;
365: mac->key = NULL;
366: mac->enabled = 0;
367: }
1.69 deraadt 368:
1.35 itojun 369: static void
1.1 markus 370: choose_comp(Comp *comp, char *client, char *server)
371: {
1.23 markus 372: char *name = match_list(client, server, NULL);
1.1 markus 373: if (name == NULL)
374: fatal("no matching comp found: client %s server %s", client, server);
1.64 markus 375: if (strcmp(name, "zlib@openssh.com") == 0) {
376: comp->type = COMP_DELAYED;
377: } else if (strcmp(name, "zlib") == 0) {
378: comp->type = COMP_ZLIB;
1.1 markus 379: } else if (strcmp(name, "none") == 0) {
1.64 markus 380: comp->type = COMP_NONE;
1.1 markus 381: } else {
382: fatal("unsupported comp %s", name);
383: }
384: comp->name = name;
385: }
1.69 deraadt 386:
1.35 itojun 387: static void
1.1 markus 388: choose_kex(Kex *k, char *client, char *server)
389: {
1.89 djm 390: const struct kexalg *kexalg;
391:
1.23 markus 392: k->name = match_list(client, server, NULL);
1.1 markus 393: if (k->name == NULL)
1.78 djm 394: fatal("Unable to negotiate a key exchange method");
1.89 djm 395: if ((kexalg = kex_alg_by_name(k->name)) == NULL)
396: fatal("unsupported kex alg %s", k->name);
397: k->kex_type = kexalg->type;
1.94 djm 398: k->hash_alg = kexalg->hash_alg;
1.89 djm 399: k->ec_nid = kexalg->ec_nid;
1.1 markus 400: }
1.65 djm 401:
1.35 itojun 402: static void
1.1 markus 403: choose_hostkeyalg(Kex *k, char *client, char *server)
404: {
1.23 markus 405: char *hostkeyalg = match_list(client, server, NULL);
1.13 markus 406: if (hostkeyalg == NULL)
1.1 markus 407: fatal("no hostkey alg");
1.13 markus 408: k->hostkey_type = key_type_from_name(hostkeyalg);
409: if (k->hostkey_type == KEY_UNSPEC)
410: fatal("bad hostkey alg '%s'", hostkeyalg);
1.91 djm 411: free(hostkeyalg);
1.1 markus 412: }
413:
1.56 djm 414: static int
1.53 markus 415: proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX])
416: {
417: static int check[] = {
418: PROPOSAL_KEX_ALGS, PROPOSAL_SERVER_HOST_KEY_ALGS, -1
419: };
420: int *idx;
421: char *p;
422:
423: for (idx = &check[0]; *idx != -1; idx++) {
424: if ((p = strchr(my[*idx], ',')) != NULL)
425: *p = '\0';
426: if ((p = strchr(peer[*idx], ',')) != NULL)
427: *p = '\0';
428: if (strcmp(my[*idx], peer[*idx]) != 0) {
429: debug2("proposal mismatch: my %s peer %s",
430: my[*idx], peer[*idx]);
431: return (0);
432: }
433: }
434: debug2("proposals match");
435: return (1);
436: }
437:
1.35 itojun 438: static void
1.27 markus 439: kex_choose_conf(Kex *kex)
1.1 markus 440: {
1.27 markus 441: Newkeys *newkeys;
1.26 markus 442: char **my, **peer;
443: char **cprop, **sprop;
1.27 markus 444: int nenc, nmac, ncomp;
1.96 dtucker 445: u_int mode, ctos, need, dh_need, authlen;
1.53 markus 446: int first_kex_follows, type;
1.1 markus 447:
1.53 markus 448: my = kex_buf2prop(&kex->my, NULL);
449: peer = kex_buf2prop(&kex->peer, &first_kex_follows);
1.26 markus 450:
1.27 markus 451: if (kex->server) {
1.26 markus 452: cprop=peer;
453: sprop=my;
454: } else {
455: cprop=my;
456: sprop=peer;
1.82 andreas 457: }
458:
459: /* Check whether server offers roaming */
460: if (!kex->server) {
461: char *roaming;
462: roaming = match_list(KEX_RESUME, peer[PROPOSAL_KEX_ALGS], NULL);
463: if (roaming) {
464: kex->roaming = 1;
1.91 djm 465: free(roaming);
1.82 andreas 466: }
1.26 markus 467: }
1.1 markus 468:
1.30 markus 469: /* Algorithm Negotiation */
1.1 markus 470: for (mode = 0; mode < MODE_MAX; mode++) {
1.70 djm 471: newkeys = xcalloc(1, sizeof(*newkeys));
1.30 markus 472: kex->newkeys[mode] = newkeys;
1.78 djm 473: ctos = (!kex->server && mode == MODE_OUT) ||
474: (kex->server && mode == MODE_IN);
1.1 markus 475: nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC;
476: nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC;
477: ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
1.88 markus 478: choose_enc(&newkeys->enc, cprop[nenc], sprop[nenc]);
479: /* ignore mac for authenticated encryption */
480: authlen = cipher_authlen(newkeys->enc.cipher);
481: if (authlen == 0)
482: choose_mac(&newkeys->mac, cprop[nmac], sprop[nmac]);
1.27 markus 483: choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
1.2 markus 484: debug("kex: %s %s %s %s",
1.1 markus 485: ctos ? "client->server" : "server->client",
1.27 markus 486: newkeys->enc.name,
1.88 markus 487: authlen == 0 ? newkeys->mac.name : "<implicit>",
1.27 markus 488: newkeys->comp.name);
1.1 markus 489: }
1.27 markus 490: choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
491: choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
1.1 markus 492: sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
1.96 dtucker 493: need = dh_need = 0;
1.1 markus 494: for (mode = 0; mode < MODE_MAX; mode++) {
1.30 markus 495: newkeys = kex->newkeys[mode];
1.97 markus 496: need = MAX(need, newkeys->enc.key_len);
497: need = MAX(need, newkeys->enc.block_size);
498: need = MAX(need, newkeys->enc.iv_len);
499: need = MAX(need, newkeys->mac.key_len);
500: dh_need = MAX(dh_need, cipher_seclen(newkeys->enc.cipher));
501: dh_need = MAX(dh_need, newkeys->enc.block_size);
502: dh_need = MAX(dh_need, newkeys->enc.iv_len);
503: dh_need = MAX(dh_need, newkeys->mac.key_len);
1.1 markus 504: }
1.7 markus 505: /* XXX need runden? */
1.27 markus 506: kex->we_need = need;
1.96 dtucker 507: kex->dh_need = dh_need;
1.53 markus 508:
509: /* ignore the next message if the proposals do not match */
1.56 djm 510: if (first_kex_follows && !proposals_match(my, peer) &&
1.63 djm 511: !(datafellows & SSH_BUG_FIRSTKEX)) {
1.53 markus 512: type = packet_read();
513: debug2("skipping next packet (type %u)", type);
514: }
1.26 markus 515:
516: kex_prop_free(my);
517: kex_prop_free(peer);
518: }
519:
1.35 itojun 520: static u_char *
1.65 djm 521: derive_key(Kex *kex, int id, u_int need, u_char *hash, u_int hashlen,
1.95 djm 522: const u_char *shared_secret, u_int slen)
1.26 markus 523: {
524: Buffer b;
1.94 djm 525: struct ssh_digest_ctx *hashctx;
1.26 markus 526: char c = id;
1.61 djm 527: u_int have;
1.94 djm 528: size_t mdsz;
1.61 djm 529: u_char *digest;
1.62 djm 530:
1.94 djm 531: if ((mdsz = ssh_digest_bytes(kex->hash_alg)) == 0)
532: fatal("bad kex md size %zu", mdsz);
1.68 deraadt 533: digest = xmalloc(roundup(need, mdsz));
1.26 markus 534:
535: buffer_init(&b);
1.95 djm 536: buffer_append(&b, shared_secret, slen);
1.26 markus 537:
1.30 markus 538: /* K1 = HASH(K || H || "A" || session_id) */
1.94 djm 539: if ((hashctx = ssh_digest_start(kex->hash_alg)) == NULL)
540: fatal("%s: ssh_digest_start failed", __func__);
541: if (ssh_digest_update_buffer(hashctx, &b) != 0 ||
542: ssh_digest_update(hashctx, hash, hashlen) != 0 ||
543: ssh_digest_update(hashctx, &c, 1) != 0 ||
544: ssh_digest_update(hashctx, kex->session_id,
545: kex->session_id_len) != 0)
546: fatal("%s: ssh_digest_update failed", __func__);
547: if (ssh_digest_final(hashctx, digest, mdsz) != 0)
548: fatal("%s: ssh_digest_final failed", __func__);
549: ssh_digest_free(hashctx);
1.26 markus 550:
1.30 markus 551: /*
552: * expand key:
553: * Kn = HASH(K || H || K1 || K2 || ... || Kn-1)
554: * Key = K1 || K2 || ... || Kn
555: */
1.26 markus 556: for (have = mdsz; need > have; have += mdsz) {
1.94 djm 557: if ((hashctx = ssh_digest_start(kex->hash_alg)) == NULL)
558: fatal("%s: ssh_digest_start failed", __func__);
559: if (ssh_digest_update_buffer(hashctx, &b) != 0 ||
560: ssh_digest_update(hashctx, hash, hashlen) != 0 ||
561: ssh_digest_update(hashctx, digest, have) != 0)
562: fatal("%s: ssh_digest_update failed", __func__);
563: if (ssh_digest_final(hashctx, digest + have, mdsz) != 0)
564: fatal("%s: ssh_digest_final failed", __func__);
565: ssh_digest_free(hashctx);
1.26 markus 566: }
567: buffer_free(&b);
568: #ifdef DEBUG_KEX
569: fprintf(stderr, "key '%c'== ", c);
570: dump_digest("key", digest, need);
571: #endif
572: return digest;
1.1 markus 573: }
574:
1.30 markus 575: Newkeys *current_keys[MODE_MAX];
1.27 markus 576:
1.23 markus 577: #define NKEYS 6
1.26 markus 578: void
1.95 djm 579: kex_derive_keys(Kex *kex, u_char *hash, u_int hashlen,
580: const u_char *shared_secret, u_int slen)
1.1 markus 581: {
1.15 markus 582: u_char *keys[NKEYS];
1.61 djm 583: u_int i, mode, ctos;
1.1 markus 584:
1.65 djm 585: for (i = 0; i < NKEYS; i++) {
586: keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, hashlen,
1.95 djm 587: shared_secret, slen);
1.65 djm 588: }
1.1 markus 589:
1.52 markus 590: debug2("kex_derive_keys");
1.1 markus 591: for (mode = 0; mode < MODE_MAX; mode++) {
1.30 markus 592: current_keys[mode] = kex->newkeys[mode];
593: kex->newkeys[mode] = NULL;
1.69 deraadt 594: ctos = (!kex->server && mode == MODE_OUT) ||
595: (kex->server && mode == MODE_IN);
1.30 markus 596: current_keys[mode]->enc.iv = keys[ctos ? 0 : 1];
597: current_keys[mode]->enc.key = keys[ctos ? 2 : 3];
598: current_keys[mode]->mac.key = keys[ctos ? 4 : 5];
1.1 markus 599: }
1.95 djm 600: }
601:
1.99 ! markus 602: #ifdef WITH_OPENSSL
1.95 djm 603: void
604: kex_derive_keys_bn(Kex *kex, u_char *hash, u_int hashlen, const BIGNUM *secret)
605: {
606: Buffer shared_secret;
607:
608: buffer_init(&shared_secret);
609: buffer_put_bignum2(&shared_secret, secret);
610: kex_derive_keys(kex, hash, hashlen,
611: buffer_ptr(&shared_secret), buffer_len(&shared_secret));
612: buffer_free(&shared_secret);
1.27 markus 613: }
1.99 ! markus 614: #endif
1.27 markus 615:
616: Newkeys *
617: kex_get_newkeys(int mode)
618: {
1.30 markus 619: Newkeys *ret;
620:
621: ret = current_keys[mode];
622: current_keys[mode] = NULL;
623: return ret;
1.57 djm 624: }
625:
1.99 ! markus 626: #ifdef WITH_SSH1
1.57 djm 627: void
628: derive_ssh1_session_id(BIGNUM *host_modulus, BIGNUM *server_modulus,
629: u_int8_t cookie[8], u_int8_t id[16])
630: {
1.94 djm 631: u_int8_t nbuf[2048], obuf[SSH_DIGEST_MAX_LENGTH];
1.57 djm 632: int len;
1.94 djm 633: struct ssh_digest_ctx *hashctx;
1.57 djm 634:
1.94 djm 635: if ((hashctx = ssh_digest_start(SSH_DIGEST_MD5)) == NULL)
636: fatal("%s: ssh_digest_start", __func__);
1.57 djm 637:
638: len = BN_num_bytes(host_modulus);
1.61 djm 639: if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
1.57 djm 640: fatal("%s: bad host modulus (len %d)", __func__, len);
641: BN_bn2bin(host_modulus, nbuf);
1.94 djm 642: if (ssh_digest_update(hashctx, nbuf, len) != 0)
643: fatal("%s: ssh_digest_update failed", __func__);
1.57 djm 644:
645: len = BN_num_bytes(server_modulus);
1.61 djm 646: if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
1.57 djm 647: fatal("%s: bad server modulus (len %d)", __func__, len);
648: BN_bn2bin(server_modulus, nbuf);
1.94 djm 649: if (ssh_digest_update(hashctx, nbuf, len) != 0 ||
650: ssh_digest_update(hashctx, cookie, 8) != 0)
651: fatal("%s: ssh_digest_update failed", __func__);
652: if (ssh_digest_final(hashctx, obuf, sizeof(obuf)) != 0)
653: fatal("%s: ssh_digest_final failed", __func__);
654: memcpy(id, obuf, ssh_digest_bytes(SSH_DIGEST_MD5));
1.57 djm 655:
1.98 djm 656: explicit_bzero(nbuf, sizeof(nbuf));
657: explicit_bzero(obuf, sizeof(obuf));
1.1 markus 658: }
1.99 ! markus 659: #endif
1.26 markus 660:
1.84 djm 661: #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
1.26 markus 662: void
663: dump_digest(char *msg, u_char *digest, int len)
664: {
1.84 djm 665: int i;
1.26 markus 666:
667: fprintf(stderr, "%s\n", msg);
1.77 stevesk 668: for (i = 0; i < len; i++) {
1.26 markus 669: fprintf(stderr, "%02x", digest[i]);
670: if (i%32 == 31)
671: fprintf(stderr, "\n");
672: else if (i%8 == 7)
673: fprintf(stderr, " ");
674: }
675: fprintf(stderr, "\n");
676: }
677: #endif
![[BACK]](/icons/back.gif){kind=icon}
Return to kex.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh