=================================================================== RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/kexgex.c,v retrieving revision 1.5.4.2 retrieving revision 1.5.4.3 diff -u -r1.5.4.2 -r1.5.4.3 --- src/usr.bin/ssh/kexgex.c 2001/09/27 00:15:42 1.5.4.2 +++ src/usr.bin/ssh/kexgex.c 2002/03/08 17:04:42 1.5.4.3 @@ -24,7 +24,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: kexgex.c,v 1.5.4.2 2001/09/27 00:15:42 miod Exp $"); +RCSID("$OpenBSD: kexgex.c,v 1.5.4.3 2002/03/08 17:04:42 brad Exp $"); #include @@ -53,7 +53,7 @@ { Buffer b; static u_char digest[EVP_MAX_MD_SIZE]; - EVP_MD *evp_md = EVP_sha1(); + const EVP_MD *evp_md = EVP_sha1(); EVP_MD_CTX md; buffer_init(&b); @@ -92,7 +92,7 @@ buffer_free(&b); #ifdef DEBUG_KEXDH - dump_digest("hash", digest, evp_md->md_size); + dump_digest("hash", digest, EVP_MD_size(evp_md)); #endif return digest; } @@ -107,7 +107,7 @@ Key *server_host_key; u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL; u_int klen, kout, slen, sbloblen; - int dlen, plen, min, max, nbits; + int min, max, nbits; DH *dh; nbits = dh_estimate(kex->we_need * 8); @@ -138,15 +138,15 @@ packet_send(); debug("expecting SSH2_MSG_KEX_DH_GEX_GROUP"); - packet_read_expect(&plen, SSH2_MSG_KEX_DH_GEX_GROUP); + packet_read_expect(SSH2_MSG_KEX_DH_GEX_GROUP); if ((p = BN_new()) == NULL) fatal("BN_new"); - packet_get_bignum2(p, &dlen); + packet_get_bignum2(p); if ((g = BN_new()) == NULL) fatal("BN_new"); - packet_get_bignum2(g, &dlen); - packet_done(); + packet_get_bignum2(g); + packet_check_eom(); if (BN_num_bits(p) < min || BN_num_bits(p) > max) fatal("DH_GEX group out of range: %d !< %d !< %d", @@ -169,24 +169,24 @@ packet_send(); debug("expecting SSH2_MSG_KEX_DH_GEX_REPLY"); - packet_read_expect(&plen, SSH2_MSG_KEX_DH_GEX_REPLY); + packet_read_expect(SSH2_MSG_KEX_DH_GEX_REPLY); /* key, cert */ server_host_key_blob = packet_get_string(&sbloblen); server_host_key = key_from_blob(server_host_key_blob, sbloblen); if (server_host_key == NULL) fatal("cannot decode server_host_key_blob"); - + if (server_host_key->type != kex->hostkey_type) + fatal("type mismatch for decoded server_host_key_blob"); if (kex->verify_host_key == NULL) fatal("cannot verify server_host_key"); if (kex->verify_host_key(server_host_key) == -1) fatal("server_host_key verification failed"); /* DH paramter f, server public DH key */ - dh_server_pub = BN_new(); - if (dh_server_pub == NULL) + if ((dh_server_pub = BN_new()) == NULL) fatal("dh_server_pub == NULL"); - packet_get_bignum2(dh_server_pub, &dlen); + packet_get_bignum2(dh_server_pub); #ifdef DEBUG_KEXDH fprintf(stderr, "dh_server_pub= "); @@ -197,7 +197,7 @@ /* signed H */ signature = packet_get_string(&slen); - packet_done(); + packet_check_eom(); if (!dh_pub_is_valid(dh, dh_server_pub)) packet_disconnect("bad server public DH value"); @@ -208,7 +208,8 @@ #ifdef DEBUG_KEXDH dump_digest("shared secret", kbuf, kout); #endif - shared_secret = BN_new(); + if ((shared_secret = BN_new()) == NULL) + fatal("kexgex_client: BN_new failed"); BN_bin2bn(kbuf, kout, shared_secret); memset(kbuf, 0, klen); xfree(kbuf); @@ -232,7 +233,7 @@ /* have keys, free DH */ DH_free(dh); xfree(server_host_key_blob); - BN_free(dh_server_pub); + BN_clear_free(dh_server_pub); if (key_verify(server_host_key, signature, slen, hash, 20) != 1) fatal("key_verify failed for server_host_key"); @@ -260,8 +261,8 @@ Key *server_host_key; DH *dh = dh; u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL; - u_int sbloblen, klen, kout; - int min = -1, max = -1, nbits = -1, type, plen, dlen, slen; + u_int sbloblen, klen, kout, slen; + int min = -1, max = -1, nbits = -1, type; if (kex->load_host_key == NULL) fatal("Cannot load hostkey"); @@ -269,8 +270,8 @@ if (server_host_key == NULL) fatal("Unsupported hostkey type %d", kex->hostkey_type); - type = packet_read(&plen); - switch(type){ + type = packet_read(); + switch (type) { case SSH2_MSG_KEX_DH_GEX_REQUEST: debug("SSH2_MSG_KEX_DH_GEX_REQUEST received"); min = packet_get_int(); @@ -289,7 +290,7 @@ default: fatal("protocol error during kex, no DH_GEX_REQUEST: %d", type); } - packet_done(); + packet_check_eom(); if (max < min || nbits < min || max < nbits) fatal("DH_GEX_REQUEST, bad parameters: %d !< %d !< %d", @@ -312,13 +313,13 @@ dh_gen_key(dh, kex->we_need * 8); debug("expecting SSH2_MSG_KEX_DH_GEX_INIT"); - packet_read_expect(&plen, SSH2_MSG_KEX_DH_GEX_INIT); + packet_read_expect(SSH2_MSG_KEX_DH_GEX_INIT); /* key, cert */ - dh_client_pub = BN_new(); - if (dh_client_pub == NULL) + if ((dh_client_pub = BN_new()) == NULL) fatal("dh_client_pub == NULL"); - packet_get_bignum2(dh_client_pub, &dlen); + packet_get_bignum2(dh_client_pub); + packet_check_eom(); #ifdef DEBUG_KEXDH fprintf(stderr, "dh_client_pub= "); @@ -342,7 +343,8 @@ #ifdef DEBUG_KEXDH dump_digest("shared secret", kbuf, kout); #endif - shared_secret = BN_new(); + if ((shared_secret = BN_new()) == NULL) + fatal("kexgex_server: BN_new failed"); BN_bin2bn(kbuf, kout, shared_secret); memset(kbuf, 0, klen); xfree(kbuf); @@ -365,7 +367,7 @@ dh->pub_key, shared_secret ); - BN_free(dh_client_pub); + BN_clear_free(dh_client_pub); /* save session id := H */ /* XXX hashlen depends on KEX */