diff options
Diffstat (limited to 'kexgex.c')
-rw-r--r-- | kexgex.c | 328 |
1 files changed, 3 insertions, 325 deletions
@@ -24,23 +24,16 @@ | |||
24 | */ | 24 | */ |
25 | 25 | ||
26 | #include "includes.h" | 26 | #include "includes.h" |
27 | RCSID("$OpenBSD: kexgex.c,v 1.22 2002/03/24 17:27:03 stevesk Exp $"); | 27 | RCSID("$OpenBSD: kexgex.c,v 1.23 2003/02/16 17:09:57 markus Exp $"); |
28 | 28 | ||
29 | #include <openssl/bn.h> | 29 | #include <openssl/evp.h> |
30 | 30 | ||
31 | #include "xmalloc.h" | ||
32 | #include "buffer.h" | 31 | #include "buffer.h" |
33 | #include "bufaux.h" | 32 | #include "bufaux.h" |
34 | #include "key.h" | ||
35 | #include "kex.h" | 33 | #include "kex.h" |
36 | #include "log.h" | ||
37 | #include "packet.h" | ||
38 | #include "dh.h" | ||
39 | #include "ssh2.h" | 34 | #include "ssh2.h" |
40 | #include "compat.h" | ||
41 | #include "monitor_wrap.h" | ||
42 | 35 | ||
43 | static u_char * | 36 | u_char * |
44 | kexgex_hash( | 37 | kexgex_hash( |
45 | char *client_version_string, | 38 | char *client_version_string, |
46 | char *server_version_string, | 39 | char *server_version_string, |
@@ -97,318 +90,3 @@ kexgex_hash( | |||
97 | #endif | 90 | #endif |
98 | return digest; | 91 | return digest; |
99 | } | 92 | } |
100 | |||
101 | /* client */ | ||
102 | |||
103 | static void | ||
104 | kexgex_client(Kex *kex) | ||
105 | { | ||
106 | BIGNUM *dh_server_pub = NULL, *shared_secret = NULL; | ||
107 | BIGNUM *p = NULL, *g = NULL; | ||
108 | Key *server_host_key; | ||
109 | u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL; | ||
110 | u_int klen, kout, slen, sbloblen; | ||
111 | int min, max, nbits; | ||
112 | DH *dh; | ||
113 | |||
114 | nbits = dh_estimate(kex->we_need * 8); | ||
115 | |||
116 | if (datafellows & SSH_OLD_DHGEX) { | ||
117 | debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD sent"); | ||
118 | |||
119 | /* Old GEX request */ | ||
120 | packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST_OLD); | ||
121 | packet_put_int(nbits); | ||
122 | min = DH_GRP_MIN; | ||
123 | max = DH_GRP_MAX; | ||
124 | } else { | ||
125 | debug("SSH2_MSG_KEX_DH_GEX_REQUEST sent"); | ||
126 | |||
127 | /* New GEX request */ | ||
128 | min = DH_GRP_MIN; | ||
129 | max = DH_GRP_MAX; | ||
130 | packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST); | ||
131 | packet_put_int(min); | ||
132 | packet_put_int(nbits); | ||
133 | packet_put_int(max); | ||
134 | } | ||
135 | #ifdef DEBUG_KEXDH | ||
136 | fprintf(stderr, "\nmin = %d, nbits = %d, max = %d\n", | ||
137 | min, nbits, max); | ||
138 | #endif | ||
139 | packet_send(); | ||
140 | |||
141 | debug("expecting SSH2_MSG_KEX_DH_GEX_GROUP"); | ||
142 | packet_read_expect(SSH2_MSG_KEX_DH_GEX_GROUP); | ||
143 | |||
144 | if ((p = BN_new()) == NULL) | ||
145 | fatal("BN_new"); | ||
146 | packet_get_bignum2(p); | ||
147 | if ((g = BN_new()) == NULL) | ||
148 | fatal("BN_new"); | ||
149 | packet_get_bignum2(g); | ||
150 | packet_check_eom(); | ||
151 | |||
152 | if (BN_num_bits(p) < min || BN_num_bits(p) > max) | ||
153 | fatal("DH_GEX group out of range: %d !< %d !< %d", | ||
154 | min, BN_num_bits(p), max); | ||
155 | |||
156 | dh = dh_new_group(g, p); | ||
157 | dh_gen_key(dh, kex->we_need * 8); | ||
158 | |||
159 | #ifdef DEBUG_KEXDH | ||
160 | DHparams_print_fp(stderr, dh); | ||
161 | fprintf(stderr, "pub= "); | ||
162 | BN_print_fp(stderr, dh->pub_key); | ||
163 | fprintf(stderr, "\n"); | ||
164 | #endif | ||
165 | |||
166 | debug("SSH2_MSG_KEX_DH_GEX_INIT sent"); | ||
167 | /* generate and send 'e', client DH public key */ | ||
168 | packet_start(SSH2_MSG_KEX_DH_GEX_INIT); | ||
169 | packet_put_bignum2(dh->pub_key); | ||
170 | packet_send(); | ||
171 | |||
172 | debug("expecting SSH2_MSG_KEX_DH_GEX_REPLY"); | ||
173 | packet_read_expect(SSH2_MSG_KEX_DH_GEX_REPLY); | ||
174 | |||
175 | /* key, cert */ | ||
176 | server_host_key_blob = packet_get_string(&sbloblen); | ||
177 | server_host_key = key_from_blob(server_host_key_blob, sbloblen); | ||
178 | if (server_host_key == NULL) | ||
179 | fatal("cannot decode server_host_key_blob"); | ||
180 | if (server_host_key->type != kex->hostkey_type) | ||
181 | fatal("type mismatch for decoded server_host_key_blob"); | ||
182 | if (kex->verify_host_key == NULL) | ||
183 | fatal("cannot verify server_host_key"); | ||
184 | if (kex->verify_host_key(server_host_key) == -1) | ||
185 | fatal("server_host_key verification failed"); | ||
186 | |||
187 | /* DH paramter f, server public DH key */ | ||
188 | if ((dh_server_pub = BN_new()) == NULL) | ||
189 | fatal("dh_server_pub == NULL"); | ||
190 | packet_get_bignum2(dh_server_pub); | ||
191 | |||
192 | #ifdef DEBUG_KEXDH | ||
193 | fprintf(stderr, "dh_server_pub= "); | ||
194 | BN_print_fp(stderr, dh_server_pub); | ||
195 | fprintf(stderr, "\n"); | ||
196 | debug("bits %d", BN_num_bits(dh_server_pub)); | ||
197 | #endif | ||
198 | |||
199 | /* signed H */ | ||
200 | signature = packet_get_string(&slen); | ||
201 | packet_check_eom(); | ||
202 | |||
203 | if (!dh_pub_is_valid(dh, dh_server_pub)) | ||
204 | packet_disconnect("bad server public DH value"); | ||
205 | |||
206 | klen = DH_size(dh); | ||
207 | kbuf = xmalloc(klen); | ||
208 | kout = DH_compute_key(kbuf, dh_server_pub, dh); | ||
209 | #ifdef DEBUG_KEXDH | ||
210 | dump_digest("shared secret", kbuf, kout); | ||
211 | #endif | ||
212 | if ((shared_secret = BN_new()) == NULL) | ||
213 | fatal("kexgex_client: BN_new failed"); | ||
214 | BN_bin2bn(kbuf, kout, shared_secret); | ||
215 | memset(kbuf, 0, klen); | ||
216 | xfree(kbuf); | ||
217 | |||
218 | if (datafellows & SSH_OLD_DHGEX) | ||
219 | min = max = -1; | ||
220 | |||
221 | /* calc and verify H */ | ||
222 | hash = kexgex_hash( | ||
223 | kex->client_version_string, | ||
224 | kex->server_version_string, | ||
225 | buffer_ptr(&kex->my), buffer_len(&kex->my), | ||
226 | buffer_ptr(&kex->peer), buffer_len(&kex->peer), | ||
227 | server_host_key_blob, sbloblen, | ||
228 | min, nbits, max, | ||
229 | dh->p, dh->g, | ||
230 | dh->pub_key, | ||
231 | dh_server_pub, | ||
232 | shared_secret | ||
233 | ); | ||
234 | /* have keys, free DH */ | ||
235 | DH_free(dh); | ||
236 | xfree(server_host_key_blob); | ||
237 | BN_clear_free(dh_server_pub); | ||
238 | |||
239 | if (key_verify(server_host_key, signature, slen, hash, 20) != 1) | ||
240 | fatal("key_verify failed for server_host_key"); | ||
241 | key_free(server_host_key); | ||
242 | xfree(signature); | ||
243 | |||
244 | /* save session id */ | ||
245 | if (kex->session_id == NULL) { | ||
246 | kex->session_id_len = 20; | ||
247 | kex->session_id = xmalloc(kex->session_id_len); | ||
248 | memcpy(kex->session_id, hash, kex->session_id_len); | ||
249 | } | ||
250 | kex_derive_keys(kex, hash, shared_secret); | ||
251 | BN_clear_free(shared_secret); | ||
252 | |||
253 | kex_finish(kex); | ||
254 | } | ||
255 | |||
256 | /* server */ | ||
257 | |||
258 | static void | ||
259 | kexgex_server(Kex *kex) | ||
260 | { | ||
261 | BIGNUM *shared_secret = NULL, *dh_client_pub = NULL; | ||
262 | Key *server_host_key; | ||
263 | DH *dh; | ||
264 | u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL; | ||
265 | u_int sbloblen, klen, kout, slen; | ||
266 | int min = -1, max = -1, nbits = -1, type; | ||
267 | |||
268 | if (kex->load_host_key == NULL) | ||
269 | fatal("Cannot load hostkey"); | ||
270 | server_host_key = kex->load_host_key(kex->hostkey_type); | ||
271 | if (server_host_key == NULL) | ||
272 | fatal("Unsupported hostkey type %d", kex->hostkey_type); | ||
273 | |||
274 | type = packet_read(); | ||
275 | switch (type) { | ||
276 | case SSH2_MSG_KEX_DH_GEX_REQUEST: | ||
277 | debug("SSH2_MSG_KEX_DH_GEX_REQUEST received"); | ||
278 | min = packet_get_int(); | ||
279 | nbits = packet_get_int(); | ||
280 | max = packet_get_int(); | ||
281 | min = MAX(DH_GRP_MIN, min); | ||
282 | max = MIN(DH_GRP_MAX, max); | ||
283 | break; | ||
284 | case SSH2_MSG_KEX_DH_GEX_REQUEST_OLD: | ||
285 | debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD received"); | ||
286 | nbits = packet_get_int(); | ||
287 | min = DH_GRP_MIN; | ||
288 | max = DH_GRP_MAX; | ||
289 | /* unused for old GEX */ | ||
290 | break; | ||
291 | default: | ||
292 | fatal("protocol error during kex, no DH_GEX_REQUEST: %d", type); | ||
293 | } | ||
294 | packet_check_eom(); | ||
295 | |||
296 | if (max < min || nbits < min || max < nbits) | ||
297 | fatal("DH_GEX_REQUEST, bad parameters: %d !< %d !< %d", | ||
298 | min, nbits, max); | ||
299 | |||
300 | /* Contact privileged parent */ | ||
301 | dh = PRIVSEP(choose_dh(min, nbits, max)); | ||
302 | if (dh == NULL) | ||
303 | packet_disconnect("Protocol error: no matching DH grp found"); | ||
304 | |||
305 | debug("SSH2_MSG_KEX_DH_GEX_GROUP sent"); | ||
306 | packet_start(SSH2_MSG_KEX_DH_GEX_GROUP); | ||
307 | packet_put_bignum2(dh->p); | ||
308 | packet_put_bignum2(dh->g); | ||
309 | packet_send(); | ||
310 | |||
311 | /* flush */ | ||
312 | packet_write_wait(); | ||
313 | |||
314 | /* Compute our exchange value in parallel with the client */ | ||
315 | dh_gen_key(dh, kex->we_need * 8); | ||
316 | |||
317 | debug("expecting SSH2_MSG_KEX_DH_GEX_INIT"); | ||
318 | packet_read_expect(SSH2_MSG_KEX_DH_GEX_INIT); | ||
319 | |||
320 | /* key, cert */ | ||
321 | if ((dh_client_pub = BN_new()) == NULL) | ||
322 | fatal("dh_client_pub == NULL"); | ||
323 | packet_get_bignum2(dh_client_pub); | ||
324 | packet_check_eom(); | ||
325 | |||
326 | #ifdef DEBUG_KEXDH | ||
327 | fprintf(stderr, "dh_client_pub= "); | ||
328 | BN_print_fp(stderr, dh_client_pub); | ||
329 | fprintf(stderr, "\n"); | ||
330 | debug("bits %d", BN_num_bits(dh_client_pub)); | ||
331 | #endif | ||
332 | |||
333 | #ifdef DEBUG_KEXDH | ||
334 | DHparams_print_fp(stderr, dh); | ||
335 | fprintf(stderr, "pub= "); | ||
336 | BN_print_fp(stderr, dh->pub_key); | ||
337 | fprintf(stderr, "\n"); | ||
338 | #endif | ||
339 | if (!dh_pub_is_valid(dh, dh_client_pub)) | ||
340 | packet_disconnect("bad client public DH value"); | ||
341 | |||
342 | klen = DH_size(dh); | ||
343 | kbuf = xmalloc(klen); | ||
344 | kout = DH_compute_key(kbuf, dh_client_pub, dh); | ||
345 | #ifdef DEBUG_KEXDH | ||
346 | dump_digest("shared secret", kbuf, kout); | ||
347 | #endif | ||
348 | if ((shared_secret = BN_new()) == NULL) | ||
349 | fatal("kexgex_server: BN_new failed"); | ||
350 | BN_bin2bn(kbuf, kout, shared_secret); | ||
351 | memset(kbuf, 0, klen); | ||
352 | xfree(kbuf); | ||
353 | |||
354 | key_to_blob(server_host_key, &server_host_key_blob, &sbloblen); | ||
355 | |||
356 | if (type == SSH2_MSG_KEX_DH_GEX_REQUEST_OLD) | ||
357 | min = max = -1; | ||
358 | |||
359 | /* calc H */ /* XXX depends on 'kex' */ | ||
360 | hash = kexgex_hash( | ||
361 | kex->client_version_string, | ||
362 | kex->server_version_string, | ||
363 | buffer_ptr(&kex->peer), buffer_len(&kex->peer), | ||
364 | buffer_ptr(&kex->my), buffer_len(&kex->my), | ||
365 | server_host_key_blob, sbloblen, | ||
366 | min, nbits, max, | ||
367 | dh->p, dh->g, | ||
368 | dh_client_pub, | ||
369 | dh->pub_key, | ||
370 | shared_secret | ||
371 | ); | ||
372 | BN_clear_free(dh_client_pub); | ||
373 | |||
374 | /* save session id := H */ | ||
375 | /* XXX hashlen depends on KEX */ | ||
376 | if (kex->session_id == NULL) { | ||
377 | kex->session_id_len = 20; | ||
378 | kex->session_id = xmalloc(kex->session_id_len); | ||
379 | memcpy(kex->session_id, hash, kex->session_id_len); | ||
380 | } | ||
381 | |||
382 | /* sign H */ | ||
383 | /* XXX hashlen depends on KEX */ | ||
384 | PRIVSEP(key_sign(server_host_key, &signature, &slen, hash, 20)); | ||
385 | |||
386 | /* destroy_sensitive_data(); */ | ||
387 | |||
388 | /* send server hostkey, DH pubkey 'f' and singed H */ | ||
389 | debug("SSH2_MSG_KEX_DH_GEX_REPLY sent"); | ||
390 | packet_start(SSH2_MSG_KEX_DH_GEX_REPLY); | ||
391 | packet_put_string(server_host_key_blob, sbloblen); | ||
392 | packet_put_bignum2(dh->pub_key); /* f */ | ||
393 | packet_put_string(signature, slen); | ||
394 | packet_send(); | ||
395 | |||
396 | xfree(signature); | ||
397 | xfree(server_host_key_blob); | ||
398 | /* have keys, free DH */ | ||
399 | DH_free(dh); | ||
400 | |||
401 | kex_derive_keys(kex, hash, shared_secret); | ||
402 | BN_clear_free(shared_secret); | ||
403 | |||
404 | kex_finish(kex); | ||
405 | } | ||
406 | |||
407 | void | ||
408 | kexgex(Kex *kex) | ||
409 | { | ||
410 | if (kex->server) | ||
411 | kexgex_server(kex); | ||
412 | else | ||
413 | kexgex_client(kex); | ||
414 | } | ||