1 /* $NetBSD: kexgexc.c,v 1.17 2022/02/23 19:07:20 christos Exp $ */
2 /* $OpenBSD: kexgexc.c,v 1.38 2021/12/19 22:08:06 djm Exp $ */
3 /*
4 * Copyright (c) 2000 Niels Provos. All rights reserved.
5 * Copyright (c) 2001 Markus Friedl. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28 #include "includes.h"
29 __RCSID("$NetBSD: kexgexc.c,v 1.17 2022/02/23 19:07:20 christos Exp $");
30
31 #include <sys/param.h>
32 #include <sys/types.h>
33
34 #include <openssl/dh.h>
35
36 #include <stdio.h>
37 #include <string.h>
38 #include <signal.h>
39
40 #include "sshkey.h"
41 #include "cipher.h"
42 #include "digest.h"
43 #include "kex.h"
44 #include "log.h"
45 #include "packet.h"
46 #include "dh.h"
47 #include "ssh2.h"
48 #include "compat.h"
49 #include "dispatch.h"
50 #include "ssherr.h"
51 #include "sshbuf.h"
52 #include "misc.h"
53
54 static int input_kex_dh_gex_group(int, u_int32_t, struct ssh *);
55 static int input_kex_dh_gex_reply(int, u_int32_t, struct ssh *);
56
57 int
kexgex_client(struct ssh * ssh)58 kexgex_client(struct ssh *ssh)
59 {
60 struct kex *kex = ssh->kex;
61 int r;
62 u_int nbits;
63
64 nbits = dh_estimate(kex->dh_need * 8);
65
66 kex->min = DH_GRP_MIN;
67 kex->max = DH_GRP_MAX;
68 kex->nbits = nbits;
69 if (ssh->compat & SSH_BUG_DHGEX_LARGE)
70 kex->nbits = MINIMUM(kex->nbits, 4096);
71 /* New GEX request */
72 if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_REQUEST)) != 0 ||
73 (r = sshpkt_put_u32(ssh, kex->min)) != 0 ||
74 (r = sshpkt_put_u32(ssh, kex->nbits)) != 0 ||
75 (r = sshpkt_put_u32(ssh, kex->max)) != 0 ||
76 (r = sshpkt_send(ssh)) != 0)
77 goto out;
78 debug("SSH2_MSG_KEX_DH_GEX_REQUEST(%u<%u<%u) sent",
79 kex->min, kex->nbits, kex->max);
80 #ifdef DEBUG_KEXDH
81 fprintf(stderr, "\nmin = %d, nbits = %d, max = %d\n",
82 kex->min, kex->nbits, kex->max);
83 #endif
84 debug("expecting SSH2_MSG_KEX_DH_GEX_GROUP");
85 ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_GROUP,
86 &input_kex_dh_gex_group);
87 r = 0;
88 out:
89 return r;
90 }
91
92 static int
input_kex_dh_gex_group(int type,u_int32_t seq,struct ssh * ssh)93 input_kex_dh_gex_group(int type, u_int32_t seq, struct ssh *ssh)
94 {
95 struct kex *kex = ssh->kex;
96 BIGNUM *p = NULL, *g = NULL;
97 const BIGNUM *pub_key;
98 int r, bits;
99
100 debug("SSH2_MSG_KEX_DH_GEX_GROUP received");
101 ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_GROUP, &kex_protocol_error);
102
103 if ((r = sshpkt_get_bignum2(ssh, &p)) != 0 ||
104 (r = sshpkt_get_bignum2(ssh, &g)) != 0 ||
105 (r = sshpkt_get_end(ssh)) != 0)
106 goto out;
107 if ((bits = BN_num_bits(p)) < 0 ||
108 (u_int)bits < kex->min || (u_int)bits > kex->max) {
109 r = SSH_ERR_DH_GEX_OUT_OF_RANGE;
110 goto out;
111 }
112 if ((kex->dh = dh_new_group(g, p)) == NULL) {
113 r = SSH_ERR_ALLOC_FAIL;
114 goto out;
115 }
116 p = g = NULL; /* belong to kex->dh now */
117
118 /* generate and send 'e', client DH public key */
119 if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
120 goto out;
121 DH_get0_key(kex->dh, &pub_key, NULL);
122 if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_INIT)) != 0 ||
123 (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 ||
124 (r = sshpkt_send(ssh)) != 0)
125 goto out;
126 debug("SSH2_MSG_KEX_DH_GEX_INIT sent");
127 #ifdef DEBUG_KEXDH
128 DHparams_print_fp(stderr, kex->dh);
129 fprintf(stderr, "pub= ");
130 BN_print_fp(stderr, pub_key);
131 fprintf(stderr, "\n");
132 #endif
133 debug("expecting SSH2_MSG_KEX_DH_GEX_REPLY");
134 ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_REPLY, &input_kex_dh_gex_reply);
135 r = 0;
136 out:
137 BN_clear_free(p);
138 BN_clear_free(g);
139 return r;
140 }
141
142 static int
input_kex_dh_gex_reply(int type,u_int32_t seq,struct ssh * ssh)143 input_kex_dh_gex_reply(int type, u_int32_t seq, struct ssh *ssh)
144 {
145 struct kex *kex = ssh->kex;
146 BIGNUM *dh_server_pub = NULL;
147 const BIGNUM *pub_key, *dh_p, *dh_g;
148 struct sshbuf *shared_secret = NULL;
149 struct sshbuf *tmp = NULL, *server_host_key_blob = NULL;
150 struct sshkey *server_host_key = NULL;
151 u_char *signature = NULL;
152 u_char hash[SSH_DIGEST_MAX_LENGTH];
153 size_t slen, hashlen;
154 int r;
155
156 debug("SSH2_MSG_KEX_DH_GEX_REPLY received");
157 ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_REPLY, &kex_protocol_error);
158
159 /* key, cert */
160 if ((r = sshpkt_getb_froms(ssh, &server_host_key_blob)) != 0)
161 goto out;
162 /* sshkey_fromb() consumes its buffer, so make a copy */
163 if ((tmp = sshbuf_fromb(server_host_key_blob)) == NULL) {
164 r = SSH_ERR_ALLOC_FAIL;
165 goto out;
166 }
167 if ((r = sshkey_fromb(tmp, &server_host_key)) != 0 ||
168 (r = kex_verify_host_key(ssh, server_host_key)) != 0)
169 goto out;
170 /* DH parameter f, server public DH key, signed H */
171 if ((r = sshpkt_get_bignum2(ssh, &dh_server_pub)) != 0 ||
172 (r = sshpkt_get_string(ssh, &signature, &slen)) != 0 ||
173 (r = sshpkt_get_end(ssh)) != 0)
174 goto out;
175 if ((shared_secret = sshbuf_new()) == NULL) {
176 r = SSH_ERR_ALLOC_FAIL;
177 goto out;
178 }
179 if ((r = kex_dh_compute_key(kex, dh_server_pub, shared_secret)) != 0)
180 goto out;
181 if (ssh->compat & SSH_OLD_DHGEX)
182 kex->min = kex->max = -1;
183
184 /* calc and verify H */
185 DH_get0_key(kex->dh, &pub_key, NULL);
186 DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g);
187 hashlen = sizeof(hash);
188 if ((r = kexgex_hash(
189 kex->hash_alg,
190 kex->client_version,
191 kex->server_version,
192 kex->my,
193 kex->peer,
194 server_host_key_blob,
195 kex->min, kex->nbits, kex->max,
196 dh_p, dh_g,
197 pub_key,
198 dh_server_pub,
199 sshbuf_ptr(shared_secret), sshbuf_len(shared_secret),
200 hash, &hashlen)) != 0)
201 goto out;
202
203 if ((r = sshkey_verify(server_host_key, signature, slen, hash,
204 hashlen, kex->hostkey_alg, ssh->compat, NULL)) != 0)
205 goto out;
206
207 if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) != 0 ||
208 (r = kex_send_newkeys(ssh)) != 0)
209 goto out;
210
211 /* save initial signature and hostkey */
212 if ((kex->flags & KEX_INITIAL) != 0) {
213 if (kex->initial_hostkey != NULL || kex->initial_sig != NULL) {
214 r = SSH_ERR_INTERNAL_ERROR;
215 goto out;
216 }
217 if ((kex->initial_sig = sshbuf_new()) == NULL) {
218 r = SSH_ERR_ALLOC_FAIL;
219 goto out;
220 }
221 if ((r = sshbuf_put(kex->initial_sig, signature, slen)) != 0)
222 goto out;
223 kex->initial_hostkey = server_host_key;
224 server_host_key = NULL;
225 }
226 /* success */
227 out:
228 explicit_bzero(hash, sizeof(hash));
229 DH_free(kex->dh);
230 kex->dh = NULL;
231 BN_clear_free(dh_server_pub);
232 sshbuf_free(shared_secret);
233 sshkey_free(server_host_key);
234 sshbuf_free(tmp);
235 sshbuf_free(server_host_key_blob);
236 free(signature);
237 return r;
238 }
239