diff options
Diffstat (limited to 'kexecdhs.c')
-rw-r--r-- | kexecdhs.c | 190 |
1 files changed, 121 insertions, 69 deletions
diff --git a/kexecdhs.c b/kexecdhs.c index 6bfad04cf..6b8d95d9c 100644 --- a/kexecdhs.c +++ b/kexecdhs.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: kexecdhs.c,v 1.11 2015/01/19 19:52:16 markus Exp $ */ | 1 | /* $OpenBSD: kexecdhs.c,v 1.12 2015/01/19 20:16:15 markus Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 2001 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2001 Markus Friedl. All rights reserved. |
4 | * Copyright (c) 2010 Damien Miller. All rights reserved. | 4 | * Copyright (c) 2010 Damien Miller. All rights reserved. |
@@ -32,124 +32,176 @@ | |||
32 | #include <string.h> | 32 | #include <string.h> |
33 | #include <signal.h> | 33 | #include <signal.h> |
34 | 34 | ||
35 | #include "xmalloc.h" | 35 | #include <openssl/ecdh.h> |
36 | #include "buffer.h" | 36 | |
37 | #include "key.h" | 37 | #include "sshkey.h" |
38 | #include "cipher.h" | 38 | #include "cipher.h" |
39 | #include "digest.h" | ||
39 | #include "kex.h" | 40 | #include "kex.h" |
40 | #include "log.h" | 41 | #include "log.h" |
41 | #include "packet.h" | 42 | #include "packet.h" |
42 | #include "ssh2.h" | 43 | #include "ssh2.h" |
43 | 44 | ||
44 | #include <openssl/ecdh.h> | 45 | #include "dispatch.h" |
46 | #include "compat.h" | ||
47 | #include "ssherr.h" | ||
48 | #include "sshbuf.h" | ||
49 | |||
50 | static int input_kex_ecdh_init(int, u_int32_t, void *); | ||
51 | |||
52 | int | ||
53 | kexecdh_server(struct ssh *ssh) | ||
54 | { | ||
55 | debug("expecting SSH2_MSG_KEX_ECDH_INIT"); | ||
56 | ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_INIT, &input_kex_ecdh_init); | ||
57 | return 0; | ||
58 | } | ||
45 | 59 | ||
46 | void | 60 | static int |
47 | kexecdh_server(Kex *kex) | 61 | input_kex_ecdh_init(int type, u_int32_t seq, void *ctxt) |
48 | { | 62 | { |
63 | struct ssh *ssh = ctxt; | ||
64 | struct kex *kex = ssh->kex; | ||
49 | EC_POINT *client_public; | 65 | EC_POINT *client_public; |
50 | EC_KEY *server_key; | 66 | EC_KEY *server_key = NULL; |
51 | const EC_GROUP *group; | 67 | const EC_GROUP *group; |
52 | BIGNUM *shared_secret; | 68 | const EC_POINT *public_key; |
53 | Key *server_host_private, *server_host_public; | 69 | BIGNUM *shared_secret = NULL; |
70 | struct sshkey *server_host_private, *server_host_public; | ||
54 | u_char *server_host_key_blob = NULL, *signature = NULL; | 71 | u_char *server_host_key_blob = NULL, *signature = NULL; |
55 | u_char *kbuf, *hash; | 72 | u_char *kbuf = NULL; |
56 | u_int klen, slen, sbloblen, hashlen; | 73 | u_char hash[SSH_DIGEST_MAX_LENGTH]; |
57 | 74 | size_t slen, sbloblen; | |
58 | if ((server_key = EC_KEY_new_by_curve_name(kex->ec_nid)) == NULL) | 75 | size_t klen = 0, hashlen; |
59 | fatal("%s: EC_KEY_new_by_curve_name failed", __func__); | 76 | int r; |
60 | if (EC_KEY_generate_key(server_key) != 1) | 77 | |
61 | fatal("%s: EC_KEY_generate_key failed", __func__); | 78 | if ((server_key = EC_KEY_new_by_curve_name(kex->ec_nid)) == NULL) { |
79 | r = SSH_ERR_ALLOC_FAIL; | ||
80 | goto out; | ||
81 | } | ||
82 | if (EC_KEY_generate_key(server_key) != 1) { | ||
83 | r = SSH_ERR_LIBCRYPTO_ERROR; | ||
84 | goto out; | ||
85 | } | ||
62 | group = EC_KEY_get0_group(server_key); | 86 | group = EC_KEY_get0_group(server_key); |
63 | 87 | ||
64 | #ifdef DEBUG_KEXECDH | 88 | #ifdef DEBUG_KEXECDH |
65 | fputs("server private key:\n", stderr); | 89 | fputs("server private key:\n", stderr); |
66 | key_dump_ec_key(server_key); | 90 | sshkey_dump_ec_key(server_key); |
67 | #endif | 91 | #endif |
68 | 92 | ||
69 | if (kex->load_host_public_key == NULL || | 93 | if (kex->load_host_public_key == NULL || |
70 | kex->load_host_private_key == NULL) | 94 | kex->load_host_private_key == NULL) { |
71 | fatal("Cannot load hostkey"); | 95 | r = SSH_ERR_INVALID_ARGUMENT; |
72 | server_host_public = kex->load_host_public_key(kex->hostkey_type); | 96 | goto out; |
73 | if (server_host_public == NULL) | 97 | } |
74 | fatal("Unsupported hostkey type %d", kex->hostkey_type); | 98 | if ((server_host_public = kex->load_host_public_key(kex->hostkey_type, |
75 | server_host_private = kex->load_host_private_key(kex->hostkey_type); | 99 | ssh)) == NULL || |
76 | 100 | (server_host_private = kex->load_host_private_key(kex->hostkey_type, | |
77 | debug("expecting SSH2_MSG_KEX_ECDH_INIT"); | 101 | ssh)) == NULL) { |
78 | packet_read_expect(SSH2_MSG_KEX_ECDH_INIT); | 102 | r = SSH_ERR_NO_HOSTKEY_LOADED; |
79 | if ((client_public = EC_POINT_new(group)) == NULL) | 103 | goto out; |
80 | fatal("%s: EC_POINT_new failed", __func__); | 104 | } |
81 | packet_get_ecpoint(group, client_public); | 105 | if ((client_public = EC_POINT_new(group)) == NULL) { |
82 | packet_check_eom(); | 106 | r = SSH_ERR_ALLOC_FAIL; |
83 | 107 | goto out; | |
84 | if (key_ec_validate_public(group, client_public) != 0) | 108 | } |
85 | fatal("%s: invalid client public key", __func__); | 109 | if ((r = sshpkt_get_ec(ssh, client_public, group)) != 0 || |
110 | (r = sshpkt_get_end(ssh)) != 0) | ||
111 | goto out; | ||
86 | 112 | ||
87 | #ifdef DEBUG_KEXECDH | 113 | #ifdef DEBUG_KEXECDH |
88 | fputs("client public key:\n", stderr); | 114 | fputs("client public key:\n", stderr); |
89 | key_dump_ec_point(group, client_public); | 115 | sshkey_dump_ec_point(group, client_public); |
90 | #endif | 116 | #endif |
117 | if (sshkey_ec_validate_public(group, client_public) != 0) { | ||
118 | sshpkt_disconnect(ssh, "invalid client public key"); | ||
119 | r = SSH_ERR_MESSAGE_INCOMPLETE; | ||
120 | goto out; | ||
121 | } | ||
91 | 122 | ||
92 | /* Calculate shared_secret */ | 123 | /* Calculate shared_secret */ |
93 | klen = (EC_GROUP_get_degree(group) + 7) / 8; | 124 | klen = (EC_GROUP_get_degree(group) + 7) / 8; |
94 | kbuf = xmalloc(klen); | 125 | if ((kbuf = malloc(klen)) == NULL || |
126 | (shared_secret = BN_new()) == NULL) { | ||
127 | r = SSH_ERR_ALLOC_FAIL; | ||
128 | goto out; | ||
129 | } | ||
95 | if (ECDH_compute_key(kbuf, klen, client_public, | 130 | if (ECDH_compute_key(kbuf, klen, client_public, |
96 | server_key, NULL) != (int)klen) | 131 | server_key, NULL) != (int)klen || |
97 | fatal("%s: ECDH_compute_key failed", __func__); | 132 | BN_bin2bn(kbuf, klen, shared_secret) == NULL) { |
133 | r = SSH_ERR_LIBCRYPTO_ERROR; | ||
134 | goto out; | ||
135 | } | ||
98 | 136 | ||
99 | #ifdef DEBUG_KEXDH | 137 | #ifdef DEBUG_KEXECDH |
100 | dump_digest("shared secret", kbuf, klen); | 138 | dump_digest("shared secret", kbuf, klen); |
101 | #endif | 139 | #endif |
102 | if ((shared_secret = BN_new()) == NULL) | ||
103 | fatal("%s: BN_new failed", __func__); | ||
104 | if (BN_bin2bn(kbuf, klen, shared_secret) == NULL) | ||
105 | fatal("%s: BN_bin2bn failed", __func__); | ||
106 | explicit_bzero(kbuf, klen); | ||
107 | free(kbuf); | ||
108 | |||
109 | /* calc H */ | 140 | /* calc H */ |
110 | key_to_blob(server_host_public, &server_host_key_blob, &sbloblen); | 141 | if ((r = sshkey_to_blob(server_host_public, &server_host_key_blob, |
111 | kex_ecdh_hash( | 142 | &sbloblen)) != 0) |
143 | goto out; | ||
144 | hashlen = sizeof(hash); | ||
145 | if ((r = kex_ecdh_hash( | ||
112 | kex->hash_alg, | 146 | kex->hash_alg, |
113 | group, | 147 | group, |
114 | kex->client_version_string, | 148 | kex->client_version_string, |
115 | kex->server_version_string, | 149 | kex->server_version_string, |
116 | buffer_ptr(kex->peer), buffer_len(kex->peer), | 150 | sshbuf_ptr(kex->peer), sshbuf_len(kex->peer), |
117 | buffer_ptr(kex->my), buffer_len(kex->my), | 151 | sshbuf_ptr(kex->my), sshbuf_len(kex->my), |
118 | server_host_key_blob, sbloblen, | 152 | server_host_key_blob, sbloblen, |
119 | client_public, | 153 | client_public, |
120 | EC_KEY_get0_public_key(server_key), | 154 | EC_KEY_get0_public_key(server_key), |
121 | shared_secret, | 155 | shared_secret, |
122 | &hash, &hashlen | 156 | hash, &hashlen)) != 0) |
123 | ); | 157 | goto out; |
124 | EC_POINT_clear_free(client_public); | ||
125 | 158 | ||
126 | /* save session id := H */ | 159 | /* save session id := H */ |
127 | if (kex->session_id == NULL) { | 160 | if (kex->session_id == NULL) { |
128 | kex->session_id_len = hashlen; | 161 | kex->session_id_len = hashlen; |
129 | kex->session_id = xmalloc(kex->session_id_len); | 162 | kex->session_id = malloc(kex->session_id_len); |
163 | if (kex->session_id == NULL) { | ||
164 | r = SSH_ERR_ALLOC_FAIL; | ||
165 | goto out; | ||
166 | } | ||
130 | memcpy(kex->session_id, hash, kex->session_id_len); | 167 | memcpy(kex->session_id, hash, kex->session_id_len); |
131 | } | 168 | } |
132 | 169 | ||
133 | /* sign H */ | 170 | /* sign H */ |
134 | kex->sign(server_host_private, server_host_public, &signature, &slen, | 171 | if ((r = kex->sign(server_host_private, server_host_public, |
135 | hash, hashlen); | 172 | &signature, &slen, hash, hashlen, ssh->compat)) < 0) |
173 | goto out; | ||
136 | 174 | ||
137 | /* destroy_sensitive_data(); */ | 175 | /* destroy_sensitive_data(); */ |
138 | 176 | ||
177 | public_key = EC_KEY_get0_public_key(server_key); | ||
139 | /* send server hostkey, ECDH pubkey 'Q_S' and signed H */ | 178 | /* send server hostkey, ECDH pubkey 'Q_S' and signed H */ |
140 | packet_start(SSH2_MSG_KEX_ECDH_REPLY); | 179 | if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_REPLY)) != 0 || |
141 | packet_put_string(server_host_key_blob, sbloblen); | 180 | (r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 || |
142 | packet_put_ecpoint(group, EC_KEY_get0_public_key(server_key)); | 181 | (r = sshpkt_put_ec(ssh, public_key, group)) != 0 || |
143 | packet_put_string(signature, slen); | 182 | (r = sshpkt_put_string(ssh, signature, slen)) != 0 || |
144 | packet_send(); | 183 | (r = sshpkt_send(ssh)) != 0) |
145 | 184 | goto out; | |
146 | free(signature); | 185 | |
186 | if ((r = kex_derive_keys_bn(ssh, hash, hashlen, shared_secret)) == 0) | ||
187 | r = kex_send_newkeys(ssh); | ||
188 | out: | ||
189 | explicit_bzero(hash, sizeof(hash)); | ||
190 | if (kex->ec_client_key) { | ||
191 | EC_KEY_free(kex->ec_client_key); | ||
192 | kex->ec_client_key = NULL; | ||
193 | } | ||
194 | if (server_key) | ||
195 | EC_KEY_free(server_key); | ||
196 | if (kbuf) { | ||
197 | explicit_bzero(kbuf, klen); | ||
198 | free(kbuf); | ||
199 | } | ||
200 | if (shared_secret) | ||
201 | BN_clear_free(shared_secret); | ||
147 | free(server_host_key_blob); | 202 | free(server_host_key_blob); |
148 | /* have keys, free server key */ | 203 | free(signature); |
149 | EC_KEY_free(server_key); | 204 | return r; |
150 | |||
151 | kex_derive_keys_bn(kex, hash, hashlen, shared_secret); | ||
152 | BN_clear_free(shared_secret); | ||
153 | kex_finish(kex); | ||
154 | } | 205 | } |
155 | #endif /* defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) */ | 206 | #endif /* defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC) */ |
207 | |||