1 /* $NetBSD: mac.c,v 1.16 2019/10/12 18:32:22 christos Exp $ */
2 /* $OpenBSD: mac.c,v 1.35 2019/09/06 04:53:27 djm Exp $ */
3 /*
4 * Copyright (c) 2001 Markus Friedl. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27 #include "includes.h"
28 __RCSID("$NetBSD: mac.c,v 1.16 2019/10/12 18:32:22 christos Exp $");
29 #include <sys/types.h>
30
31 #include <string.h>
32 #include <stdio.h>
33 #include <stdlib.h>
34
35 #include "digest.h"
36 #include "hmac.h"
37 #include "umac.h"
38 #include "mac.h"
39 #include "misc.h"
40 #include "ssherr.h"
41 #include "sshbuf.h"
42
43 #define SSH_DIGEST 1 /* SSH_DIGEST_XXX */
44 #define SSH_UMAC 2 /* UMAC (not integrated with OpenSSL) */
45 #define SSH_UMAC128 3
46
47 struct macalg {
48 const char *name;
49 int type;
50 int alg;
51 int truncatebits; /* truncate digest if != 0 */
52 int key_len; /* just for UMAC */
53 int len; /* just for UMAC */
54 int etm; /* Encrypt-then-MAC */
55 };
56
57 static const struct macalg macs[] = {
58 /* Encrypt-and-MAC (encrypt-and-authenticate) variants */
59 { "hmac-sha1", SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 0 },
60 { "hmac-sha1-96", SSH_DIGEST, SSH_DIGEST_SHA1, 96, 0, 0, 0 },
61 { "hmac-sha2-256", SSH_DIGEST, SSH_DIGEST_SHA256, 0, 0, 0, 0 },
62 { "hmac-sha2-512", SSH_DIGEST, SSH_DIGEST_SHA512, 0, 0, 0, 0 },
63 { "hmac-md5", SSH_DIGEST, SSH_DIGEST_MD5, 0, 0, 0, 0 },
64 { "hmac-md5-96", SSH_DIGEST, SSH_DIGEST_MD5, 96, 0, 0, 0 },
65 { "umac-64@openssh.com", SSH_UMAC, 0, 0, 128, 64, 0 },
66 { "umac-128@openssh.com", SSH_UMAC128, 0, 0, 128, 128, 0 },
67
68 /* Encrypt-then-MAC variants */
69 { "hmac-sha1-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 1 },
70 { "hmac-sha1-96-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_SHA1, 96, 0, 0, 1 },
71 { "hmac-sha2-256-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_SHA256, 0, 0, 0, 1 },
72 { "hmac-sha2-512-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_SHA512, 0, 0, 0, 1 },
73 { "hmac-md5-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_MD5, 0, 0, 0, 1 },
74 { "hmac-md5-96-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_MD5, 96, 0, 0, 1 },
75 { "umac-64-etm@openssh.com", SSH_UMAC, 0, 0, 128, 64, 1 },
76 { "umac-128-etm@openssh.com", SSH_UMAC128, 0, 0, 128, 128, 1 },
77
78 { NULL, 0, 0, 0, 0, 0, 0 }
79 };
80
81 /* Returns a list of supported MACs separated by the specified char. */
82 char *
mac_alg_list(char sep)83 mac_alg_list(char sep)
84 {
85 char *ret = NULL, *tmp;
86 size_t nlen, rlen = 0;
87 const struct macalg *m;
88
89 for (m = macs; m->name != NULL; m++) {
90 if (ret != NULL)
91 ret[rlen++] = sep;
92 nlen = strlen(m->name);
93 if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) {
94 free(ret);
95 return NULL;
96 }
97 ret = tmp;
98 memcpy(ret + rlen, m->name, nlen + 1);
99 rlen += nlen;
100 }
101 return ret;
102 }
103
104 static int
mac_setup_by_alg(struct sshmac * mac,const struct macalg * macalg)105 mac_setup_by_alg(struct sshmac *mac, const struct macalg *macalg)
106 {
107 mac->type = macalg->type;
108 if (mac->type == SSH_DIGEST) {
109 if ((mac->hmac_ctx = ssh_hmac_start(macalg->alg)) == NULL)
110 return SSH_ERR_ALLOC_FAIL;
111 mac->key_len = mac->mac_len = ssh_hmac_bytes(macalg->alg);
112 } else {
113 mac->mac_len = macalg->len / 8;
114 mac->key_len = macalg->key_len / 8;
115 mac->umac_ctx = NULL;
116 }
117 if (macalg->truncatebits != 0)
118 mac->mac_len = macalg->truncatebits / 8;
119 mac->etm = macalg->etm;
120 return 0;
121 }
122
123 int
mac_setup(struct sshmac * mac,char * name)124 mac_setup(struct sshmac *mac, char *name)
125 {
126 const struct macalg *m;
127
128 for (m = macs; m->name != NULL; m++) {
129 if (strcmp(name, m->name) != 0)
130 continue;
131 if (mac != NULL)
132 return mac_setup_by_alg(mac, m);
133 return 0;
134 }
135 return SSH_ERR_INVALID_ARGUMENT;
136 }
137
138 int
mac_init(struct sshmac * mac)139 mac_init(struct sshmac *mac)
140 {
141 if (mac->key == NULL)
142 return SSH_ERR_INVALID_ARGUMENT;
143 switch (mac->type) {
144 case SSH_DIGEST:
145 if (mac->hmac_ctx == NULL ||
146 ssh_hmac_init(mac->hmac_ctx, mac->key, mac->key_len) < 0)
147 return SSH_ERR_INVALID_ARGUMENT;
148 return 0;
149 case SSH_UMAC:
150 if ((mac->umac_ctx = umac_new(mac->key)) == NULL)
151 return SSH_ERR_ALLOC_FAIL;
152 return 0;
153 case SSH_UMAC128:
154 if ((mac->umac_ctx = umac128_new(mac->key)) == NULL)
155 return SSH_ERR_ALLOC_FAIL;
156 return 0;
157 default:
158 return SSH_ERR_INVALID_ARGUMENT;
159 }
160 }
161
162 int
mac_compute(struct sshmac * mac,u_int32_t seqno,const u_char * data,int datalen,u_char * digest,size_t dlen)163 mac_compute(struct sshmac *mac, u_int32_t seqno,
164 const u_char *data, int datalen,
165 u_char *digest, size_t dlen)
166 {
167 static union {
168 u_char m[SSH_DIGEST_MAX_LENGTH];
169 u_int64_t for_align;
170 } u;
171 u_char b[4];
172 u_char nonce[8];
173
174 if (mac->mac_len > sizeof(u))
175 return SSH_ERR_INTERNAL_ERROR;
176
177 switch (mac->type) {
178 case SSH_DIGEST:
179 put_u32(b, seqno);
180 /* reset HMAC context */
181 if (ssh_hmac_init(mac->hmac_ctx, NULL, 0) < 0 ||
182 ssh_hmac_update(mac->hmac_ctx, b, sizeof(b)) < 0 ||
183 ssh_hmac_update(mac->hmac_ctx, data, datalen) < 0 ||
184 ssh_hmac_final(mac->hmac_ctx, u.m, sizeof(u.m)) < 0)
185 return SSH_ERR_LIBCRYPTO_ERROR;
186 break;
187 case SSH_UMAC:
188 POKE_U64(nonce, seqno);
189 umac_update(mac->umac_ctx, data, datalen);
190 umac_final(mac->umac_ctx, u.m, nonce);
191 break;
192 case SSH_UMAC128:
193 put_u64(nonce, seqno);
194 umac128_update(mac->umac_ctx, data, datalen);
195 umac128_final(mac->umac_ctx, u.m, nonce);
196 break;
197 default:
198 return SSH_ERR_INVALID_ARGUMENT;
199 }
200 if (digest != NULL) {
201 if (dlen > mac->mac_len)
202 dlen = mac->mac_len;
203 memcpy(digest, u.m, dlen);
204 }
205 return 0;
206 }
207
208 int
mac_check(struct sshmac * mac,u_int32_t seqno,const u_char * data,size_t dlen,const u_char * theirmac,size_t mlen)209 mac_check(struct sshmac *mac, u_int32_t seqno,
210 const u_char *data, size_t dlen,
211 const u_char *theirmac, size_t mlen)
212 {
213 u_char ourmac[SSH_DIGEST_MAX_LENGTH];
214 int r;
215
216 if (mac->mac_len > mlen)
217 return SSH_ERR_INVALID_ARGUMENT;
218 if ((r = mac_compute(mac, seqno, data, dlen,
219 ourmac, sizeof(ourmac))) != 0)
220 return r;
221 if (timingsafe_bcmp(ourmac, theirmac, mac->mac_len) != 0)
222 return SSH_ERR_MAC_INVALID;
223 return 0;
224 }
225
226 void
mac_clear(struct sshmac * mac)227 mac_clear(struct sshmac *mac)
228 {
229 if (mac->type == SSH_UMAC) {
230 if (mac->umac_ctx != NULL)
231 umac_delete(mac->umac_ctx);
232 } else if (mac->type == SSH_UMAC128) {
233 if (mac->umac_ctx != NULL)
234 umac128_delete(mac->umac_ctx);
235 } else if (mac->hmac_ctx != NULL)
236 ssh_hmac_free(mac->hmac_ctx);
237 mac->hmac_ctx = NULL;
238 mac->umac_ctx = NULL;
239 }
240
241 /* XXX copied from ciphers_valid */
242 #define MAC_SEP ","
243 int
mac_valid(const char * names)244 mac_valid(const char *names)
245 {
246 char *maclist, *cp, *p;
247
248 if (names == NULL || strcmp(names, "") == 0)
249 return 0;
250 if ((maclist = cp = strdup(names)) == NULL)
251 return 0;
252 for ((p = strsep(&cp, MAC_SEP)); p && *p != '\0';
253 (p = strsep(&cp, MAC_SEP))) {
254 if (mac_setup(NULL, p) < 0) {
255 free(maclist);
256 return 0;
257 }
258 }
259 free(maclist);
260 return 1;
261 }
262