summaryrefslogtreecommitdiff
path: root/kexgex.c
diff options
context:
space:
mode:
authorDamien Miller <djm@mindrot.org>2003-02-24 12:03:03 +1100
committerDamien Miller <djm@mindrot.org>2003-02-24 12:03:03 +1100
commit8e7fb335235bd6a7f8387a40bf71eaf9798f6f7e (patch)
tree46ba3e898aebfc99e531d793bccac6c0eba5e87d /kexgex.c
parent1587fb8a174f57a064d603bbd595c3369aa697aa (diff)
- markus@cvs.openbsd.org 2003/02/16 17:09:57
[kex.c kexdh.c kexgex.c kex.h sshconnect2.c sshd.c ssh-keyscan.c] split kex into client and server code, no need to link server code into the client; ok provos@
Diffstat (limited to 'kexgex.c')
-rw-r--r--kexgex.c328
1 files changed, 3 insertions, 325 deletions
diff --git a/kexgex.c b/kexgex.c
index 2d4a58153..b0c39c8cb 100644
--- a/kexgex.c
+++ b/kexgex.c
@@ -24,23 +24,16 @@
24 */ 24 */
25 25
26#include "includes.h" 26#include "includes.h"
27RCSID("$OpenBSD: kexgex.c,v 1.22 2002/03/24 17:27:03 stevesk Exp $"); 27RCSID("$OpenBSD: kexgex.c,v 1.23 2003/02/16 17:09:57 markus Exp $");
28 28
29#include <openssl/bn.h> 29#include <openssl/evp.h>
30 30
31#include "xmalloc.h"
32#include "buffer.h" 31#include "buffer.h"
33#include "bufaux.h" 32#include "bufaux.h"
34#include "key.h"
35#include "kex.h" 33#include "kex.h"
36#include "log.h"
37#include "packet.h"
38#include "dh.h"
39#include "ssh2.h" 34#include "ssh2.h"
40#include "compat.h"
41#include "monitor_wrap.h"
42 35
43static u_char * 36u_char *
44kexgex_hash( 37kexgex_hash(
45 char *client_version_string, 38 char *client_version_string,
46 char *server_version_string, 39 char *server_version_string,
@@ -97,318 +90,3 @@ kexgex_hash(
97#endif 90#endif
98 return digest; 91 return digest;
99} 92}
100
101/* client */
102
103static void
104kexgex_client(Kex *kex)
105{
106 BIGNUM *dh_server_pub = NULL, *shared_secret = NULL;
107 BIGNUM *p = NULL, *g = NULL;
108 Key *server_host_key;
109 u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
110 u_int klen, kout, slen, sbloblen;
111 int min, max, nbits;
112 DH *dh;
113
114 nbits = dh_estimate(kex->we_need * 8);
115
116 if (datafellows & SSH_OLD_DHGEX) {
117 debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD sent");
118
119 /* Old GEX request */
120 packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST_OLD);
121 packet_put_int(nbits);
122 min = DH_GRP_MIN;
123 max = DH_GRP_MAX;
124 } else {
125 debug("SSH2_MSG_KEX_DH_GEX_REQUEST sent");
126
127 /* New GEX request */
128 min = DH_GRP_MIN;
129 max = DH_GRP_MAX;
130 packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST);
131 packet_put_int(min);
132 packet_put_int(nbits);
133 packet_put_int(max);
134 }
135#ifdef DEBUG_KEXDH
136 fprintf(stderr, "\nmin = %d, nbits = %d, max = %d\n",
137 min, nbits, max);
138#endif
139 packet_send();
140
141 debug("expecting SSH2_MSG_KEX_DH_GEX_GROUP");
142 packet_read_expect(SSH2_MSG_KEX_DH_GEX_GROUP);
143
144 if ((p = BN_new()) == NULL)
145 fatal("BN_new");
146 packet_get_bignum2(p);
147 if ((g = BN_new()) == NULL)
148 fatal("BN_new");
149 packet_get_bignum2(g);
150 packet_check_eom();
151
152 if (BN_num_bits(p) < min || BN_num_bits(p) > max)
153 fatal("DH_GEX group out of range: %d !< %d !< %d",
154 min, BN_num_bits(p), max);
155
156 dh = dh_new_group(g, p);
157 dh_gen_key(dh, kex->we_need * 8);
158
159#ifdef DEBUG_KEXDH
160 DHparams_print_fp(stderr, dh);
161 fprintf(stderr, "pub= ");
162 BN_print_fp(stderr, dh->pub_key);
163 fprintf(stderr, "\n");
164#endif
165
166 debug("SSH2_MSG_KEX_DH_GEX_INIT sent");
167 /* generate and send 'e', client DH public key */
168 packet_start(SSH2_MSG_KEX_DH_GEX_INIT);
169 packet_put_bignum2(dh->pub_key);
170 packet_send();
171
172 debug("expecting SSH2_MSG_KEX_DH_GEX_REPLY");
173 packet_read_expect(SSH2_MSG_KEX_DH_GEX_REPLY);
174
175 /* key, cert */
176 server_host_key_blob = packet_get_string(&sbloblen);
177 server_host_key = key_from_blob(server_host_key_blob, sbloblen);
178 if (server_host_key == NULL)
179 fatal("cannot decode server_host_key_blob");
180 if (server_host_key->type != kex->hostkey_type)
181 fatal("type mismatch for decoded server_host_key_blob");
182 if (kex->verify_host_key == NULL)
183 fatal("cannot verify server_host_key");
184 if (kex->verify_host_key(server_host_key) == -1)
185 fatal("server_host_key verification failed");
186
187 /* DH paramter f, server public DH key */
188 if ((dh_server_pub = BN_new()) == NULL)
189 fatal("dh_server_pub == NULL");
190 packet_get_bignum2(dh_server_pub);
191
192#ifdef DEBUG_KEXDH
193 fprintf(stderr, "dh_server_pub= ");
194 BN_print_fp(stderr, dh_server_pub);
195 fprintf(stderr, "\n");
196 debug("bits %d", BN_num_bits(dh_server_pub));
197#endif
198
199 /* signed H */
200 signature = packet_get_string(&slen);
201 packet_check_eom();
202
203 if (!dh_pub_is_valid(dh, dh_server_pub))
204 packet_disconnect("bad server public DH value");
205
206 klen = DH_size(dh);
207 kbuf = xmalloc(klen);
208 kout = DH_compute_key(kbuf, dh_server_pub, dh);
209#ifdef DEBUG_KEXDH
210 dump_digest("shared secret", kbuf, kout);
211#endif
212 if ((shared_secret = BN_new()) == NULL)
213 fatal("kexgex_client: BN_new failed");
214 BN_bin2bn(kbuf, kout, shared_secret);
215 memset(kbuf, 0, klen);
216 xfree(kbuf);
217
218 if (datafellows & SSH_OLD_DHGEX)
219 min = max = -1;
220
221 /* calc and verify H */
222 hash = kexgex_hash(
223 kex->client_version_string,
224 kex->server_version_string,
225 buffer_ptr(&kex->my), buffer_len(&kex->my),
226 buffer_ptr(&kex->peer), buffer_len(&kex->peer),
227 server_host_key_blob, sbloblen,
228 min, nbits, max,
229 dh->p, dh->g,
230 dh->pub_key,
231 dh_server_pub,
232 shared_secret
233 );
234 /* have keys, free DH */
235 DH_free(dh);
236 xfree(server_host_key_blob);
237 BN_clear_free(dh_server_pub);
238
239 if (key_verify(server_host_key, signature, slen, hash, 20) != 1)
240 fatal("key_verify failed for server_host_key");
241 key_free(server_host_key);
242 xfree(signature);
243
244 /* save session id */
245 if (kex->session_id == NULL) {
246 kex->session_id_len = 20;
247 kex->session_id = xmalloc(kex->session_id_len);
248 memcpy(kex->session_id, hash, kex->session_id_len);
249 }
250 kex_derive_keys(kex, hash, shared_secret);
251 BN_clear_free(shared_secret);
252
253 kex_finish(kex);
254}
255
256/* server */
257
258static void
259kexgex_server(Kex *kex)
260{
261 BIGNUM *shared_secret = NULL, *dh_client_pub = NULL;
262 Key *server_host_key;
263 DH *dh;
264 u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
265 u_int sbloblen, klen, kout, slen;
266 int min = -1, max = -1, nbits = -1, type;
267
268 if (kex->load_host_key == NULL)
269 fatal("Cannot load hostkey");
270 server_host_key = kex->load_host_key(kex->hostkey_type);
271 if (server_host_key == NULL)
272 fatal("Unsupported hostkey type %d", kex->hostkey_type);
273
274 type = packet_read();
275 switch (type) {
276 case SSH2_MSG_KEX_DH_GEX_REQUEST:
277 debug("SSH2_MSG_KEX_DH_GEX_REQUEST received");
278 min = packet_get_int();
279 nbits = packet_get_int();
280 max = packet_get_int();
281 min = MAX(DH_GRP_MIN, min);
282 max = MIN(DH_GRP_MAX, max);
283 break;
284 case SSH2_MSG_KEX_DH_GEX_REQUEST_OLD:
285 debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD received");
286 nbits = packet_get_int();
287 min = DH_GRP_MIN;
288 max = DH_GRP_MAX;
289 /* unused for old GEX */
290 break;
291 default:
292 fatal("protocol error during kex, no DH_GEX_REQUEST: %d", type);
293 }
294 packet_check_eom();
295
296 if (max < min || nbits < min || max < nbits)
297 fatal("DH_GEX_REQUEST, bad parameters: %d !< %d !< %d",
298 min, nbits, max);
299
300 /* Contact privileged parent */
301 dh = PRIVSEP(choose_dh(min, nbits, max));
302 if (dh == NULL)
303 packet_disconnect("Protocol error: no matching DH grp found");
304
305 debug("SSH2_MSG_KEX_DH_GEX_GROUP sent");
306 packet_start(SSH2_MSG_KEX_DH_GEX_GROUP);
307 packet_put_bignum2(dh->p);
308 packet_put_bignum2(dh->g);
309 packet_send();
310
311 /* flush */
312 packet_write_wait();
313
314 /* Compute our exchange value in parallel with the client */
315 dh_gen_key(dh, kex->we_need * 8);
316
317 debug("expecting SSH2_MSG_KEX_DH_GEX_INIT");
318 packet_read_expect(SSH2_MSG_KEX_DH_GEX_INIT);
319
320 /* key, cert */
321 if ((dh_client_pub = BN_new()) == NULL)
322 fatal("dh_client_pub == NULL");
323 packet_get_bignum2(dh_client_pub);
324 packet_check_eom();
325
326#ifdef DEBUG_KEXDH
327 fprintf(stderr, "dh_client_pub= ");
328 BN_print_fp(stderr, dh_client_pub);
329 fprintf(stderr, "\n");
330 debug("bits %d", BN_num_bits(dh_client_pub));
331#endif
332
333#ifdef DEBUG_KEXDH
334 DHparams_print_fp(stderr, dh);
335 fprintf(stderr, "pub= ");
336 BN_print_fp(stderr, dh->pub_key);
337 fprintf(stderr, "\n");
338#endif
339 if (!dh_pub_is_valid(dh, dh_client_pub))
340 packet_disconnect("bad client public DH value");
341
342 klen = DH_size(dh);
343 kbuf = xmalloc(klen);
344 kout = DH_compute_key(kbuf, dh_client_pub, dh);
345#ifdef DEBUG_KEXDH
346 dump_digest("shared secret", kbuf, kout);
347#endif
348 if ((shared_secret = BN_new()) == NULL)
349 fatal("kexgex_server: BN_new failed");
350 BN_bin2bn(kbuf, kout, shared_secret);
351 memset(kbuf, 0, klen);
352 xfree(kbuf);
353
354 key_to_blob(server_host_key, &server_host_key_blob, &sbloblen);
355
356 if (type == SSH2_MSG_KEX_DH_GEX_REQUEST_OLD)
357 min = max = -1;
358
359 /* calc H */ /* XXX depends on 'kex' */
360 hash = kexgex_hash(
361 kex->client_version_string,
362 kex->server_version_string,
363 buffer_ptr(&kex->peer), buffer_len(&kex->peer),
364 buffer_ptr(&kex->my), buffer_len(&kex->my),
365 server_host_key_blob, sbloblen,
366 min, nbits, max,
367 dh->p, dh->g,
368 dh_client_pub,
369 dh->pub_key,
370 shared_secret
371 );
372 BN_clear_free(dh_client_pub);
373
374 /* save session id := H */
375 /* XXX hashlen depends on KEX */
376 if (kex->session_id == NULL) {
377 kex->session_id_len = 20;
378 kex->session_id = xmalloc(kex->session_id_len);
379 memcpy(kex->session_id, hash, kex->session_id_len);
380 }
381
382 /* sign H */
383 /* XXX hashlen depends on KEX */
384 PRIVSEP(key_sign(server_host_key, &signature, &slen, hash, 20));
385
386 /* destroy_sensitive_data(); */
387
388 /* send server hostkey, DH pubkey 'f' and singed H */
389 debug("SSH2_MSG_KEX_DH_GEX_REPLY sent");
390 packet_start(SSH2_MSG_KEX_DH_GEX_REPLY);
391 packet_put_string(server_host_key_blob, sbloblen);
392 packet_put_bignum2(dh->pub_key); /* f */
393 packet_put_string(signature, slen);
394 packet_send();
395
396 xfree(signature);
397 xfree(server_host_key_blob);
398 /* have keys, free DH */
399 DH_free(dh);
400
401 kex_derive_keys(kex, hash, shared_secret);
402 BN_clear_free(shared_secret);
403
404 kex_finish(kex);
405}
406
407void
408kexgex(Kex *kex)
409{
410 if (kex->server)
411 kexgex_server(kex);
412 else
413 kexgex_client(kex);
414}
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-02 12:04:02 +0000