=================================================================== RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/kexgex.c,v retrieving revision 1.9.2.2 retrieving revision 1.10 diff -u -r1.9.2.2 -r1.10 --- src/usr.bin/ssh/kexgex.c 2002/05/17 00:03:23 1.9.2.2 +++ src/usr.bin/ssh/kexgex.c 2001/12/05 10:06:12 1.10 @@ -24,7 +24,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: kexgex.c,v 1.9.2.2 2002/05/17 00:03:23 miod Exp $"); +RCSID("$OpenBSD: kexgex.c,v 1.10 2001/12/05 10:06:12 deraadt Exp $"); #include @@ -38,7 +38,6 @@ #include "dh.h" #include "ssh2.h" #include "compat.h" -#include "monitor_wrap.h" static u_char * kexgex_hash( @@ -54,7 +53,7 @@ { Buffer b; static u_char digest[EVP_MAX_MD_SIZE]; - const EVP_MD *evp_md = EVP_sha1(); + EVP_MD *evp_md = EVP_sha1(); EVP_MD_CTX md; buffer_init(&b); @@ -93,7 +92,7 @@ buffer_free(&b); #ifdef DEBUG_KEXDH - dump_digest("hash", digest, EVP_MD_size(evp_md)); + dump_digest("hash", digest, evp_md->md_size); #endif return digest; } @@ -108,7 +107,7 @@ Key *server_host_key; u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL; u_int klen, kout, slen, sbloblen; - int min, max, nbits; + int dlen, plen, min, max, nbits; DH *dh; nbits = dh_estimate(kex->we_need * 8); @@ -139,15 +138,15 @@ packet_send(); debug("expecting SSH2_MSG_KEX_DH_GEX_GROUP"); - packet_read_expect(SSH2_MSG_KEX_DH_GEX_GROUP); + packet_read_expect(&plen, SSH2_MSG_KEX_DH_GEX_GROUP); if ((p = BN_new()) == NULL) fatal("BN_new"); - packet_get_bignum2(p); + packet_get_bignum2(p, &dlen); if ((g = BN_new()) == NULL) fatal("BN_new"); - packet_get_bignum2(g); - packet_check_eom(); + packet_get_bignum2(g, &dlen); + packet_done(); if (BN_num_bits(p) < min || BN_num_bits(p) > max) fatal("DH_GEX group out of range: %d !< %d !< %d", @@ -170,24 +169,24 @@ packet_send(); debug("expecting SSH2_MSG_KEX_DH_GEX_REPLY"); - packet_read_expect(SSH2_MSG_KEX_DH_GEX_REPLY); + packet_read_expect(&plen, SSH2_MSG_KEX_DH_GEX_REPLY); /* key, cert */ server_host_key_blob = packet_get_string(&sbloblen); server_host_key = key_from_blob(server_host_key_blob, sbloblen); if (server_host_key == NULL) fatal("cannot decode server_host_key_blob"); - if (server_host_key->type != kex->hostkey_type) - fatal("type mismatch for decoded server_host_key_blob"); + if (kex->verify_host_key == NULL) fatal("cannot verify server_host_key"); if (kex->verify_host_key(server_host_key) == -1) fatal("server_host_key verification failed"); /* DH paramter f, server public DH key */ - if ((dh_server_pub = BN_new()) == NULL) + dh_server_pub = BN_new(); + if (dh_server_pub == NULL) fatal("dh_server_pub == NULL"); - packet_get_bignum2(dh_server_pub); + packet_get_bignum2(dh_server_pub, &dlen); #ifdef DEBUG_KEXDH fprintf(stderr, "dh_server_pub= "); @@ -198,7 +197,7 @@ /* signed H */ signature = packet_get_string(&slen); - packet_check_eom(); + packet_done(); if (!dh_pub_is_valid(dh, dh_server_pub)) packet_disconnect("bad server public DH value"); @@ -209,8 +208,7 @@ #ifdef DEBUG_KEXDH dump_digest("shared secret", kbuf, kout); #endif - if ((shared_secret = BN_new()) == NULL) - fatal("kexgex_client: BN_new failed"); + shared_secret = BN_new(); BN_bin2bn(kbuf, kout, shared_secret); memset(kbuf, 0, klen); xfree(kbuf); @@ -234,7 +232,7 @@ /* have keys, free DH */ DH_free(dh); xfree(server_host_key_blob); - BN_clear_free(dh_server_pub); + BN_free(dh_server_pub); if (key_verify(server_host_key, signature, slen, hash, 20) != 1) fatal("key_verify failed for server_host_key"); @@ -260,10 +258,10 @@ { BIGNUM *shared_secret = NULL, *dh_client_pub = NULL; Key *server_host_key; - DH *dh; + DH *dh = dh; u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL; - u_int sbloblen, klen, kout, slen; - int min = -1, max = -1, nbits = -1, type; + u_int sbloblen, klen, kout; + int min = -1, max = -1, nbits = -1, type, plen, dlen, slen; if (kex->load_host_key == NULL) fatal("Cannot load hostkey"); @@ -271,7 +269,7 @@ if (server_host_key == NULL) fatal("Unsupported hostkey type %d", kex->hostkey_type); - type = packet_read(); + type = packet_read(&plen); switch (type) { case SSH2_MSG_KEX_DH_GEX_REQUEST: debug("SSH2_MSG_KEX_DH_GEX_REQUEST received"); @@ -291,14 +289,13 @@ default: fatal("protocol error during kex, no DH_GEX_REQUEST: %d", type); } - packet_check_eom(); + packet_done(); if (max < min || nbits < min || max < nbits) fatal("DH_GEX_REQUEST, bad parameters: %d !< %d !< %d", min, nbits, max); - /* Contact privileged parent */ - dh = PRIVSEP(choose_dh(min, nbits, max)); + dh = choose_dh(min, nbits, max); if (dh == NULL) packet_disconnect("Protocol error: no matching DH grp found"); @@ -315,13 +312,13 @@ dh_gen_key(dh, kex->we_need * 8); debug("expecting SSH2_MSG_KEX_DH_GEX_INIT"); - packet_read_expect(SSH2_MSG_KEX_DH_GEX_INIT); + packet_read_expect(&plen, SSH2_MSG_KEX_DH_GEX_INIT); /* key, cert */ - if ((dh_client_pub = BN_new()) == NULL) + dh_client_pub = BN_new(); + if (dh_client_pub == NULL) fatal("dh_client_pub == NULL"); - packet_get_bignum2(dh_client_pub); - packet_check_eom(); + packet_get_bignum2(dh_client_pub, &dlen); #ifdef DEBUG_KEXDH fprintf(stderr, "dh_client_pub= "); @@ -345,8 +342,7 @@ #ifdef DEBUG_KEXDH dump_digest("shared secret", kbuf, kout); #endif - if ((shared_secret = BN_new()) == NULL) - fatal("kexgex_server: BN_new failed"); + shared_secret = BN_new(); BN_bin2bn(kbuf, kout, shared_secret); memset(kbuf, 0, klen); xfree(kbuf); @@ -369,7 +365,7 @@ dh->pub_key, shared_secret ); - BN_clear_free(dh_client_pub); + BN_free(dh_client_pub); /* save session id := H */ /* XXX hashlen depends on KEX */ @@ -381,7 +377,7 @@ /* sign H */ /* XXX hashlen depends on KEX */ - PRIVSEP(key_sign(server_host_key, &signature, &slen, hash, 20)); + key_sign(server_host_key, &signature, &slen, hash, 20); /* destroy_sensitive_data(); */ @@ -392,7 +388,6 @@ packet_put_bignum2(dh->pub_key); /* f */ packet_put_string(signature, slen); packet_send(); - xfree(signature); xfree(server_host_key_blob); /* have keys, free DH */