10Sstevel@tonic-gate /* 20Sstevel@tonic-gate * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 30Sstevel@tonic-gate * 40Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 50Sstevel@tonic-gate * modification, are permitted provided that the following conditions 60Sstevel@tonic-gate * are met: 70Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright 80Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 90Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 100Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the 110Sstevel@tonic-gate * documentation and/or other materials provided with the distribution. 120Sstevel@tonic-gate * 130Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 140Sstevel@tonic-gate * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 150Sstevel@tonic-gate * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 160Sstevel@tonic-gate * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 170Sstevel@tonic-gate * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 180Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 190Sstevel@tonic-gate * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 200Sstevel@tonic-gate * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 210Sstevel@tonic-gate * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 220Sstevel@tonic-gate * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 230Sstevel@tonic-gate * 24*5562Sjp161948 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 250Sstevel@tonic-gate * Use is subject to license terms. 260Sstevel@tonic-gate */ 270Sstevel@tonic-gate 280Sstevel@tonic-gate #include "includes.h" 290Sstevel@tonic-gate RCSID("$OpenBSD: kex.c,v 1.51 2002/06/24 14:55:38 markus Exp $"); 300Sstevel@tonic-gate 310Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 320Sstevel@tonic-gate 330Sstevel@tonic-gate #include <locale.h> 340Sstevel@tonic-gate 350Sstevel@tonic-gate #include <openssl/crypto.h> 360Sstevel@tonic-gate 370Sstevel@tonic-gate #include "ssh2.h" 380Sstevel@tonic-gate #include "xmalloc.h" 390Sstevel@tonic-gate #include "buffer.h" 400Sstevel@tonic-gate #include "bufaux.h" 410Sstevel@tonic-gate #include "packet.h" 420Sstevel@tonic-gate #include "compat.h" 430Sstevel@tonic-gate #include "cipher.h" 440Sstevel@tonic-gate #include "kex.h" 450Sstevel@tonic-gate #include "key.h" 460Sstevel@tonic-gate #include "log.h" 470Sstevel@tonic-gate #include "mac.h" 480Sstevel@tonic-gate #include "match.h" 490Sstevel@tonic-gate #include "dispatch.h" 500Sstevel@tonic-gate #include "g11n.h" 510Sstevel@tonic-gate 520Sstevel@tonic-gate #ifdef GSSAPI 530Sstevel@tonic-gate #include "ssh-gss.h" 540Sstevel@tonic-gate #endif 550Sstevel@tonic-gate 560Sstevel@tonic-gate #define KEX_COOKIE_LEN 16 570Sstevel@tonic-gate 580Sstevel@tonic-gate char *session_lang = NULL; 590Sstevel@tonic-gate 600Sstevel@tonic-gate 610Sstevel@tonic-gate /* prototype */ 620Sstevel@tonic-gate static void kex_do_hook(Kex *kex); 630Sstevel@tonic-gate static void kex_kexinit_finish(Kex *); 640Sstevel@tonic-gate static void kex_choose_conf(Kex *); 650Sstevel@tonic-gate 660Sstevel@tonic-gate /* put algorithm proposal into buffer */ 670Sstevel@tonic-gate static 680Sstevel@tonic-gate void 690Sstevel@tonic-gate kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX]) 700Sstevel@tonic-gate { 710Sstevel@tonic-gate int i; 720Sstevel@tonic-gate 730Sstevel@tonic-gate buffer_clear(b); 740Sstevel@tonic-gate /* 750Sstevel@tonic-gate * add a dummy cookie, the cookie will be overwritten by 760Sstevel@tonic-gate * kex_send_kexinit(), each time a kexinit is set 770Sstevel@tonic-gate */ 780Sstevel@tonic-gate for (i = 0; i < KEX_COOKIE_LEN; i++) 790Sstevel@tonic-gate buffer_put_char(b, 0); 800Sstevel@tonic-gate for (i = 0; i < PROPOSAL_MAX; i++) 810Sstevel@tonic-gate buffer_put_cstring(b, proposal[i]); 820Sstevel@tonic-gate buffer_put_char(b, 0); /* first_kex_packet_follows */ 830Sstevel@tonic-gate buffer_put_int(b, 0); /* uint32 reserved */ 840Sstevel@tonic-gate } 850Sstevel@tonic-gate 860Sstevel@tonic-gate /* parse buffer and return algorithm proposal */ 870Sstevel@tonic-gate static 880Sstevel@tonic-gate char ** 890Sstevel@tonic-gate kex_buf2prop(Buffer *raw, int *first_kex_follows) 900Sstevel@tonic-gate { 910Sstevel@tonic-gate Buffer b; 920Sstevel@tonic-gate int i; 930Sstevel@tonic-gate char **proposal; 940Sstevel@tonic-gate 950Sstevel@tonic-gate proposal = xmalloc(PROPOSAL_MAX * sizeof(char *)); 960Sstevel@tonic-gate 970Sstevel@tonic-gate buffer_init(&b); 980Sstevel@tonic-gate buffer_append(&b, buffer_ptr(raw), buffer_len(raw)); 990Sstevel@tonic-gate /* skip cookie */ 1000Sstevel@tonic-gate for (i = 0; i < KEX_COOKIE_LEN; i++) 1010Sstevel@tonic-gate buffer_get_char(&b); 1020Sstevel@tonic-gate /* extract kex init proposal strings */ 1030Sstevel@tonic-gate for (i = 0; i < PROPOSAL_MAX; i++) { 1040Sstevel@tonic-gate proposal[i] = buffer_get_string(&b,NULL); 1050Sstevel@tonic-gate debug2("kex_parse_kexinit: %s", proposal[i]); 1060Sstevel@tonic-gate } 1070Sstevel@tonic-gate /* first kex follows / reserved */ 1080Sstevel@tonic-gate i = buffer_get_char(&b); 1090Sstevel@tonic-gate if (first_kex_follows != NULL) 1100Sstevel@tonic-gate *first_kex_follows = i; 1110Sstevel@tonic-gate debug2("kex_parse_kexinit: first_kex_follows %d ", i); 1120Sstevel@tonic-gate i = buffer_get_int(&b); 1130Sstevel@tonic-gate debug2("kex_parse_kexinit: reserved %d ", i); 1140Sstevel@tonic-gate buffer_free(&b); 1150Sstevel@tonic-gate return proposal; 1160Sstevel@tonic-gate } 1170Sstevel@tonic-gate 1180Sstevel@tonic-gate static 1190Sstevel@tonic-gate void 1200Sstevel@tonic-gate kex_prop_free(char **proposal) 1210Sstevel@tonic-gate { 1220Sstevel@tonic-gate int i; 1230Sstevel@tonic-gate 1240Sstevel@tonic-gate for (i = 0; i < PROPOSAL_MAX; i++) 1250Sstevel@tonic-gate xfree(proposal[i]); 1260Sstevel@tonic-gate xfree(proposal); 1270Sstevel@tonic-gate } 1280Sstevel@tonic-gate 1290Sstevel@tonic-gate static void 1300Sstevel@tonic-gate kex_protocol_error(int type, u_int32_t seq, void *ctxt) 1310Sstevel@tonic-gate { 1320Sstevel@tonic-gate error("Hm, kex protocol error: type %d seq %u", type, seq); 1330Sstevel@tonic-gate } 1340Sstevel@tonic-gate 1350Sstevel@tonic-gate static void 1360Sstevel@tonic-gate kex_reset_dispatch(void) 1370Sstevel@tonic-gate { 1380Sstevel@tonic-gate #ifdef ALTPRIVSEP 1390Sstevel@tonic-gate /* unprivileged sshd has a kex packet handler that must not be reset */ 1400Sstevel@tonic-gate debug3("kex_reset_dispatch -- should we dispatch_set(KEXINIT) here? %d && !%d", 1410Sstevel@tonic-gate packet_is_server(), packet_is_monitor()); 1420Sstevel@tonic-gate if (packet_is_server() && !packet_is_monitor()) { 1430Sstevel@tonic-gate debug3("kex_reset_dispatch -- skipping dispatch_set(KEXINIT) in unpriv proc"); 1440Sstevel@tonic-gate return; 1450Sstevel@tonic-gate } 1460Sstevel@tonic-gate #endif /* ALTPRIVSEP */ 1470Sstevel@tonic-gate 1480Sstevel@tonic-gate dispatch_range(SSH2_MSG_TRANSPORT_MIN, 1490Sstevel@tonic-gate SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error); 1500Sstevel@tonic-gate dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit); 1510Sstevel@tonic-gate } 1520Sstevel@tonic-gate 1530Sstevel@tonic-gate void 1540Sstevel@tonic-gate kex_finish(Kex *kex) 1550Sstevel@tonic-gate { 1560Sstevel@tonic-gate kex_reset_dispatch(); 1570Sstevel@tonic-gate 1580Sstevel@tonic-gate packet_start(SSH2_MSG_NEWKEYS); 1590Sstevel@tonic-gate packet_send(); 1600Sstevel@tonic-gate /* packet_write_wait(); */ 1610Sstevel@tonic-gate debug("SSH2_MSG_NEWKEYS sent"); 1620Sstevel@tonic-gate 1630Sstevel@tonic-gate #ifdef ALTPRIVSEP 1640Sstevel@tonic-gate if (packet_is_monitor()) 1650Sstevel@tonic-gate goto skip_newkeys; 1660Sstevel@tonic-gate #endif /* ALTPRIVSEP */ 1670Sstevel@tonic-gate debug("expecting SSH2_MSG_NEWKEYS"); 1680Sstevel@tonic-gate packet_read_expect(SSH2_MSG_NEWKEYS); 1690Sstevel@tonic-gate packet_check_eom(); 1700Sstevel@tonic-gate debug("SSH2_MSG_NEWKEYS received"); 1710Sstevel@tonic-gate #ifdef ALTPRIVSEP 1720Sstevel@tonic-gate skip_newkeys: 1730Sstevel@tonic-gate #endif /* ALTPRIVSEP */ 1740Sstevel@tonic-gate 1750Sstevel@tonic-gate kex->done = 1; 1760Sstevel@tonic-gate kex->initial_kex_done = 1; /* never to be cleared once set */ 1770Sstevel@tonic-gate buffer_clear(&kex->peer); 1780Sstevel@tonic-gate /* buffer_clear(&kex->my); */ 1790Sstevel@tonic-gate kex->flags &= ~KEX_INIT_SENT; 1800Sstevel@tonic-gate xfree(kex->name); 1810Sstevel@tonic-gate kex->name = NULL; 1820Sstevel@tonic-gate } 1830Sstevel@tonic-gate 1840Sstevel@tonic-gate void 1850Sstevel@tonic-gate kex_send_kexinit(Kex *kex) 1860Sstevel@tonic-gate { 1870Sstevel@tonic-gate u_int32_t rand = 0; 1880Sstevel@tonic-gate u_char *cookie; 1890Sstevel@tonic-gate int i; 1900Sstevel@tonic-gate 1910Sstevel@tonic-gate if (kex == NULL) { 1920Sstevel@tonic-gate error("kex_send_kexinit: no kex, cannot rekey"); 1930Sstevel@tonic-gate return; 1940Sstevel@tonic-gate } 1950Sstevel@tonic-gate if (kex->flags & KEX_INIT_SENT) { 1960Sstevel@tonic-gate debug("KEX_INIT_SENT"); 1970Sstevel@tonic-gate return; 1980Sstevel@tonic-gate } 1990Sstevel@tonic-gate kex->done = 0; 2000Sstevel@tonic-gate 2010Sstevel@tonic-gate /* update my proposal -- e.g., add/remove GSS kexalgs */ 2020Sstevel@tonic-gate kex_do_hook(kex); 2030Sstevel@tonic-gate 2040Sstevel@tonic-gate /* generate a random cookie */ 2050Sstevel@tonic-gate if (buffer_len(&kex->my) < KEX_COOKIE_LEN) 2060Sstevel@tonic-gate fatal("kex_send_kexinit: kex proposal too short"); 2070Sstevel@tonic-gate cookie = buffer_ptr(&kex->my); 2080Sstevel@tonic-gate for (i = 0; i < KEX_COOKIE_LEN; i++) { 2090Sstevel@tonic-gate if (i % 4 == 0) 2100Sstevel@tonic-gate rand = arc4random(); 2110Sstevel@tonic-gate cookie[i] = rand; 2120Sstevel@tonic-gate rand >>= 8; 2130Sstevel@tonic-gate } 2140Sstevel@tonic-gate packet_start(SSH2_MSG_KEXINIT); 2150Sstevel@tonic-gate packet_put_raw(buffer_ptr(&kex->my), buffer_len(&kex->my)); 2160Sstevel@tonic-gate packet_send(); 2170Sstevel@tonic-gate debug("SSH2_MSG_KEXINIT sent"); 2180Sstevel@tonic-gate kex->flags |= KEX_INIT_SENT; 2190Sstevel@tonic-gate } 2200Sstevel@tonic-gate 2210Sstevel@tonic-gate void 2220Sstevel@tonic-gate kex_input_kexinit(int type, u_int32_t seq, void *ctxt) 2230Sstevel@tonic-gate { 2240Sstevel@tonic-gate char *ptr; 2250Sstevel@tonic-gate u_int dlen; 2260Sstevel@tonic-gate int i; 2270Sstevel@tonic-gate Kex *kex = (Kex *)ctxt; 2280Sstevel@tonic-gate 2290Sstevel@tonic-gate debug("SSH2_MSG_KEXINIT received"); 2300Sstevel@tonic-gate if (kex == NULL) 2310Sstevel@tonic-gate fatal("kex_input_kexinit: no kex, cannot rekey"); 2320Sstevel@tonic-gate 2330Sstevel@tonic-gate ptr = packet_get_raw(&dlen); 2340Sstevel@tonic-gate buffer_append(&kex->peer, ptr, dlen); 2350Sstevel@tonic-gate 2360Sstevel@tonic-gate /* discard packet */ 2370Sstevel@tonic-gate for (i = 0; i < KEX_COOKIE_LEN; i++) 2380Sstevel@tonic-gate packet_get_char(); 2390Sstevel@tonic-gate for (i = 0; i < PROPOSAL_MAX; i++) 2400Sstevel@tonic-gate xfree(packet_get_string(NULL)); 2410Sstevel@tonic-gate (void) packet_get_char(); 2420Sstevel@tonic-gate (void) packet_get_int(); 2430Sstevel@tonic-gate packet_check_eom(); 2440Sstevel@tonic-gate 2450Sstevel@tonic-gate kex_kexinit_finish(kex); 2460Sstevel@tonic-gate } 2470Sstevel@tonic-gate 2480Sstevel@tonic-gate /* 2490Sstevel@tonic-gate * This is for GSS keyex, where actual KEX offer can change at rekey 2500Sstevel@tonic-gate * time due to credential expiration/renewal... 2510Sstevel@tonic-gate */ 2520Sstevel@tonic-gate static 2530Sstevel@tonic-gate void 2540Sstevel@tonic-gate kex_do_hook(Kex *kex) 2550Sstevel@tonic-gate { 2560Sstevel@tonic-gate char **prop; 2570Sstevel@tonic-gate 2580Sstevel@tonic-gate if (kex->kex_hook == NULL) 2590Sstevel@tonic-gate return; 2600Sstevel@tonic-gate 2610Sstevel@tonic-gate /* Unmarshall my proposal, let the hook modify it, remarshall it */ 2620Sstevel@tonic-gate prop = kex_buf2prop(&kex->my, NULL); 2630Sstevel@tonic-gate buffer_clear(&kex->my); 2640Sstevel@tonic-gate (kex->kex_hook)(kex, prop); 2650Sstevel@tonic-gate kex_prop2buf(&kex->my, prop); 2660Sstevel@tonic-gate kex_prop_free(prop); 2670Sstevel@tonic-gate } 2680Sstevel@tonic-gate 2690Sstevel@tonic-gate Kex * 2700Sstevel@tonic-gate kex_setup(const char *host, char *proposal[PROPOSAL_MAX], Kex_hook_func hook) 2710Sstevel@tonic-gate { 2720Sstevel@tonic-gate Kex *kex; 2730Sstevel@tonic-gate 2740Sstevel@tonic-gate kex = xmalloc(sizeof(*kex)); 2750Sstevel@tonic-gate memset(kex, 0, sizeof(*kex)); 2760Sstevel@tonic-gate buffer_init(&kex->peer); 2770Sstevel@tonic-gate buffer_init(&kex->my); 2780Sstevel@tonic-gate 2790Sstevel@tonic-gate kex->kex_hook = hook; /* called by kex_send_kexinit() */ 2800Sstevel@tonic-gate 2810Sstevel@tonic-gate if (host != NULL && *host != '\0') 2820Sstevel@tonic-gate kex->serverhost = xstrdup(host); 2830Sstevel@tonic-gate else 2840Sstevel@tonic-gate kex->server = 1; 2850Sstevel@tonic-gate 2860Sstevel@tonic-gate kex_prop2buf(&kex->my, proposal); 2870Sstevel@tonic-gate 2880Sstevel@tonic-gate kex_send_kexinit(kex); 2890Sstevel@tonic-gate kex_reset_dispatch(); 2900Sstevel@tonic-gate 2910Sstevel@tonic-gate return kex; 2920Sstevel@tonic-gate } 2930Sstevel@tonic-gate 2940Sstevel@tonic-gate static void 2950Sstevel@tonic-gate kex_kexinit_finish(Kex *kex) 2960Sstevel@tonic-gate { 2970Sstevel@tonic-gate if (!(kex->flags & KEX_INIT_SENT)) 2980Sstevel@tonic-gate kex_send_kexinit(kex); 2990Sstevel@tonic-gate 3000Sstevel@tonic-gate kex_choose_conf(kex); 3010Sstevel@tonic-gate 3020Sstevel@tonic-gate if (kex->kex_type >= 0 && kex->kex_type < KEX_MAX && 3030Sstevel@tonic-gate kex->kex[kex->kex_type] != NULL) 3040Sstevel@tonic-gate (kex->kex[kex->kex_type])(kex); 3050Sstevel@tonic-gate else 3060Sstevel@tonic-gate fatal("Unsupported key exchange %d", kex->kex_type); 3070Sstevel@tonic-gate } 3080Sstevel@tonic-gate 3090Sstevel@tonic-gate static void 3100Sstevel@tonic-gate choose_lang(char **lang, char *client, char *server) 3110Sstevel@tonic-gate { 3120Sstevel@tonic-gate if (datafellows & SSH_BUG_LOCALES_NOT_LANGTAGS) 3130Sstevel@tonic-gate *lang = match_list(client, server, NULL); 3140Sstevel@tonic-gate else 3150Sstevel@tonic-gate *lang = g11n_srvr_locale_negotiate(client, NULL); 3160Sstevel@tonic-gate } 3170Sstevel@tonic-gate static void 3180Sstevel@tonic-gate choose_enc(Enc *enc, char *client, char *server) 3190Sstevel@tonic-gate { 3200Sstevel@tonic-gate char *name = match_list(client, server, NULL); 3210Sstevel@tonic-gate if (name == NULL) 3220Sstevel@tonic-gate fatal("no matching cipher found: client %s server %s", client, server); 3230Sstevel@tonic-gate if ((enc->cipher = cipher_by_name(name)) == NULL) 3240Sstevel@tonic-gate fatal("matching cipher is not supported: %s", name); 3250Sstevel@tonic-gate enc->name = name; 3260Sstevel@tonic-gate enc->enabled = 0; 3270Sstevel@tonic-gate enc->iv = NULL; 3280Sstevel@tonic-gate enc->key = NULL; 3290Sstevel@tonic-gate enc->key_len = cipher_keylen(enc->cipher); 3300Sstevel@tonic-gate enc->block_size = cipher_blocksize(enc->cipher); 3310Sstevel@tonic-gate } 3320Sstevel@tonic-gate static void 3330Sstevel@tonic-gate choose_mac(Mac *mac, char *client, char *server) 3340Sstevel@tonic-gate { 3350Sstevel@tonic-gate char *name = match_list(client, server, NULL); 3360Sstevel@tonic-gate if (name == NULL) 3370Sstevel@tonic-gate fatal("no matching mac found: client %s server %s", client, server); 3380Sstevel@tonic-gate if (mac_init(mac, name) < 0) 3390Sstevel@tonic-gate fatal("unsupported mac %s", name); 3400Sstevel@tonic-gate /* truncate the key */ 3410Sstevel@tonic-gate if (datafellows & SSH_BUG_HMAC) 3420Sstevel@tonic-gate mac->key_len = 16; 3430Sstevel@tonic-gate mac->name = name; 3440Sstevel@tonic-gate mac->key = NULL; 3450Sstevel@tonic-gate mac->enabled = 0; 3460Sstevel@tonic-gate } 3470Sstevel@tonic-gate static void 3480Sstevel@tonic-gate choose_comp(Comp *comp, char *client, char *server) 3490Sstevel@tonic-gate { 3500Sstevel@tonic-gate char *name = match_list(client, server, NULL); 3510Sstevel@tonic-gate if (name == NULL) 3520Sstevel@tonic-gate fatal("no matching comp found: client %s server %s", client, server); 3530Sstevel@tonic-gate if (strcmp(name, "zlib") == 0) { 3540Sstevel@tonic-gate comp->type = 1; 3550Sstevel@tonic-gate } else if (strcmp(name, "none") == 0) { 3560Sstevel@tonic-gate comp->type = 0; 3570Sstevel@tonic-gate } else { 3580Sstevel@tonic-gate fatal("unsupported comp %s", name); 3590Sstevel@tonic-gate } 3600Sstevel@tonic-gate comp->name = name; 3610Sstevel@tonic-gate } 3620Sstevel@tonic-gate static void 3630Sstevel@tonic-gate choose_kex(Kex *k, char *client, char *server) 3640Sstevel@tonic-gate { 3650Sstevel@tonic-gate k->name = match_list(client, server, NULL); 3660Sstevel@tonic-gate if (k->name == NULL) 3670Sstevel@tonic-gate fatal("no kex alg"); 3680Sstevel@tonic-gate /* XXX Finish 3.6/7 merge of kex stuff -- choose_kex() done */ 3690Sstevel@tonic-gate if (strcmp(k->name, KEX_DH1) == 0) { 3700Sstevel@tonic-gate k->kex_type = KEX_DH_GRP1_SHA1; 3710Sstevel@tonic-gate } else if (strcmp(k->name, KEX_DHGEX) == 0) { 3720Sstevel@tonic-gate k->kex_type = KEX_DH_GEX_SHA1; 3730Sstevel@tonic-gate #ifdef GSSAPI 3740Sstevel@tonic-gate } else if (strncmp(k->name, KEX_GSS_SHA1, sizeof(KEX_GSS_SHA1)-1) == 0) { 3750Sstevel@tonic-gate k->kex_type = KEX_GSS_GRP1_SHA1; 3760Sstevel@tonic-gate #endif 3770Sstevel@tonic-gate } else 3780Sstevel@tonic-gate fatal("bad kex alg %s", k->name); 3790Sstevel@tonic-gate } 3800Sstevel@tonic-gate static void 3810Sstevel@tonic-gate choose_hostkeyalg(Kex *k, char *client, char *server) 3820Sstevel@tonic-gate { 3830Sstevel@tonic-gate char *hostkeyalg = match_list(client, server, NULL); 3840Sstevel@tonic-gate if (hostkeyalg == NULL) 3850Sstevel@tonic-gate fatal("no hostkey alg"); 3860Sstevel@tonic-gate k->hostkey_type = key_type_from_name(hostkeyalg); 3870Sstevel@tonic-gate if (k->hostkey_type == KEY_UNSPEC) 3880Sstevel@tonic-gate fatal("bad hostkey alg '%s'", hostkeyalg); 3890Sstevel@tonic-gate xfree(hostkeyalg); 3900Sstevel@tonic-gate } 3910Sstevel@tonic-gate 3920Sstevel@tonic-gate static int 3930Sstevel@tonic-gate proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX]) 3940Sstevel@tonic-gate { 3950Sstevel@tonic-gate static int check[] = { 3960Sstevel@tonic-gate PROPOSAL_KEX_ALGS, PROPOSAL_SERVER_HOST_KEY_ALGS, -1 3970Sstevel@tonic-gate }; 3980Sstevel@tonic-gate int *idx; 3990Sstevel@tonic-gate char *p; 4000Sstevel@tonic-gate 4010Sstevel@tonic-gate for (idx = &check[0]; *idx != -1; idx++) { 4020Sstevel@tonic-gate if ((p = strchr(my[*idx], ',')) != NULL) 4030Sstevel@tonic-gate *p = '\0'; 4040Sstevel@tonic-gate if ((p = strchr(peer[*idx], ',')) != NULL) 4050Sstevel@tonic-gate *p = '\0'; 4060Sstevel@tonic-gate if (strcmp(my[*idx], peer[*idx]) != 0) { 4070Sstevel@tonic-gate debug2("proposal mismatch: my %s peer %s", 4080Sstevel@tonic-gate my[*idx], peer[*idx]); 4090Sstevel@tonic-gate return (0); 4100Sstevel@tonic-gate } 4110Sstevel@tonic-gate } 4120Sstevel@tonic-gate debug2("proposals match"); 4130Sstevel@tonic-gate return (1); 4140Sstevel@tonic-gate } 4150Sstevel@tonic-gate 4160Sstevel@tonic-gate static void 4170Sstevel@tonic-gate kex_choose_conf(Kex *kex) 4180Sstevel@tonic-gate { 4190Sstevel@tonic-gate Newkeys *newkeys; 4200Sstevel@tonic-gate char **my, **peer; 4210Sstevel@tonic-gate char **cprop, **sprop; 4220Sstevel@tonic-gate char *p_langs_c2s, *p_langs_s2c; /* peer's langs */ 4230Sstevel@tonic-gate char *plangs = NULL; /* peer's langs*/ 4240Sstevel@tonic-gate char *mlangs = NULL; /* my langs */ 4250Sstevel@tonic-gate int nenc, nmac, ncomp; 4260Sstevel@tonic-gate int mode; 4270Sstevel@tonic-gate int ctos; /* direction: if true client-to-server */ 4280Sstevel@tonic-gate int need; 4290Sstevel@tonic-gate int first_kex_follows, type; 4300Sstevel@tonic-gate 4310Sstevel@tonic-gate my = kex_buf2prop(&kex->my, NULL); 4320Sstevel@tonic-gate peer = kex_buf2prop(&kex->peer, &first_kex_follows); 4330Sstevel@tonic-gate 4340Sstevel@tonic-gate if (kex->server) { 4350Sstevel@tonic-gate cprop=peer; 4360Sstevel@tonic-gate sprop=my; 4370Sstevel@tonic-gate } else { 4380Sstevel@tonic-gate cprop=my; 4390Sstevel@tonic-gate sprop=peer; 4400Sstevel@tonic-gate } 4410Sstevel@tonic-gate 4420Sstevel@tonic-gate /* Algorithm Negotiation */ 4430Sstevel@tonic-gate for (mode = 0; mode < MODE_MAX; mode++) { 4440Sstevel@tonic-gate newkeys = xmalloc(sizeof(*newkeys)); 4450Sstevel@tonic-gate memset(newkeys, 0, sizeof(*newkeys)); 4460Sstevel@tonic-gate kex->newkeys[mode] = newkeys; 4470Sstevel@tonic-gate ctos = (!kex->server && mode == MODE_OUT) || (kex->server && mode == MODE_IN); 4480Sstevel@tonic-gate nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC; 4490Sstevel@tonic-gate nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC; 4500Sstevel@tonic-gate ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC; 4510Sstevel@tonic-gate choose_enc (&newkeys->enc, cprop[nenc], sprop[nenc]); 4520Sstevel@tonic-gate choose_mac (&newkeys->mac, cprop[nmac], sprop[nmac]); 4530Sstevel@tonic-gate choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]); 4540Sstevel@tonic-gate debug("kex: %s %s %s %s", 4550Sstevel@tonic-gate ctos ? "client->server" : "server->client", 4560Sstevel@tonic-gate newkeys->enc.name, 4570Sstevel@tonic-gate newkeys->mac.name, 4580Sstevel@tonic-gate newkeys->comp.name); 4590Sstevel@tonic-gate } 4600Sstevel@tonic-gate choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]); 4610Sstevel@tonic-gate choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS], 4620Sstevel@tonic-gate sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]); 4630Sstevel@tonic-gate need = 0; 4640Sstevel@tonic-gate for (mode = 0; mode < MODE_MAX; mode++) { 4650Sstevel@tonic-gate newkeys = kex->newkeys[mode]; 4660Sstevel@tonic-gate if (need < newkeys->enc.key_len) 4670Sstevel@tonic-gate need = newkeys->enc.key_len; 4680Sstevel@tonic-gate if (need < newkeys->enc.block_size) 4690Sstevel@tonic-gate need = newkeys->enc.block_size; 4700Sstevel@tonic-gate if (need < newkeys->mac.key_len) 4710Sstevel@tonic-gate need = newkeys->mac.key_len; 4720Sstevel@tonic-gate } 4730Sstevel@tonic-gate /* XXX need runden? */ 4740Sstevel@tonic-gate kex->we_need = need; 4750Sstevel@tonic-gate 4760Sstevel@tonic-gate /* ignore the next message if the proposals do not match */ 4770Sstevel@tonic-gate if (first_kex_follows && !proposals_match(my, peer) && 4780Sstevel@tonic-gate !(datafellows & SSH_BUG_FIRSTKEX)) { 4790Sstevel@tonic-gate type = packet_read(); 4800Sstevel@tonic-gate debug2("skipping next packet (type %u)", type); 4810Sstevel@tonic-gate } 4820Sstevel@tonic-gate 4830Sstevel@tonic-gate /* Language/locale negotiation -- not worth doing on re-key */ 4840Sstevel@tonic-gate 4850Sstevel@tonic-gate if (!kex->initial_kex_done) { 4860Sstevel@tonic-gate p_langs_c2s = peer[PROPOSAL_LANG_CTOS]; 4870Sstevel@tonic-gate p_langs_s2c = peer[PROPOSAL_LANG_STOC]; 4880Sstevel@tonic-gate debug("Peer sent proposed langtags, ctos: %s", p_langs_c2s); 4890Sstevel@tonic-gate debug("Peer sent proposed langtags, stoc: %s", p_langs_s2c); 4900Sstevel@tonic-gate plangs = NULL; 4910Sstevel@tonic-gate 4920Sstevel@tonic-gate /* We propose the same langs for each protocol direction */ 4930Sstevel@tonic-gate mlangs = my[PROPOSAL_LANG_STOC]; 4940Sstevel@tonic-gate debug("We proposed langtags, ctos: %s", my[PROPOSAL_LANG_CTOS]); 4950Sstevel@tonic-gate debug("We proposed langtags, stoc: %s", mlangs); 4960Sstevel@tonic-gate 4970Sstevel@tonic-gate /* 4980Sstevel@tonic-gate * Why oh why did they bother with negotiating langs for 4990Sstevel@tonic-gate * each protocol direction?! 5000Sstevel@tonic-gate * 5010Sstevel@tonic-gate * The semantics of this are vaguely specified, but one can 5020Sstevel@tonic-gate * imagine using one language (locale) for the whole session and 5030Sstevel@tonic-gate * a different one for message localization (e.g., 'en_US.UTF-8' 5040Sstevel@tonic-gate * overall and 'fr' for messages). Weird? Maybe. But lang 5050Sstevel@tonic-gate * tags don't include codeset info, like locales do... 5060Sstevel@tonic-gate * 5070Sstevel@tonic-gate * So, server-side we want: 5080Sstevel@tonic-gate * - setlocale(LC_ALL, c2s_locale); 5090Sstevel@tonic-gate * and 5100Sstevel@tonic-gate * - setlocale(LC_MESSAGES, s2c_locale); 5110Sstevel@tonic-gate * 5120Sstevel@tonic-gate * Client-side we don't really care. But we could do: 5130Sstevel@tonic-gate * 5140Sstevel@tonic-gate * - when very verbose, tell the use what lang the server's 5150Sstevel@tonic-gate * messages are in, if left out in the protocol 5160Sstevel@tonic-gate * - when sending messages to the server, and if applicable, we 5170Sstevel@tonic-gate * can localize them according to the language negotiated for 5180Sstevel@tonic-gate * that direction. 5190Sstevel@tonic-gate * 5200Sstevel@tonic-gate * But for now we do nothing on the client side. 5210Sstevel@tonic-gate */ 5220Sstevel@tonic-gate if ((p_langs_c2s && *p_langs_c2s) && !(p_langs_s2c && *p_langs_s2c)) 5230Sstevel@tonic-gate plangs = p_langs_c2s; 5240Sstevel@tonic-gate else if ((p_langs_s2c && *p_langs_s2c) && !(p_langs_c2s && *p_langs_c2s)) 5250Sstevel@tonic-gate plangs = p_langs_s2c; 5260Sstevel@tonic-gate else 5270Sstevel@tonic-gate plangs = p_langs_c2s; 5280Sstevel@tonic-gate 5290Sstevel@tonic-gate if (kex->server) { 5300Sstevel@tonic-gate if (plangs && mlangs && *plangs && *mlangs) { 5310Sstevel@tonic-gate char *locale; 5320Sstevel@tonic-gate 5330Sstevel@tonic-gate choose_lang(&locale, plangs, mlangs); 5340Sstevel@tonic-gate if (locale) { 5350Sstevel@tonic-gate g11n_setlocale(LC_ALL, locale); 5360Sstevel@tonic-gate debug("Negotiated main locale: %s", locale); 5370Sstevel@tonic-gate packet_send_debug("Negotiated main locale: %s", locale); 538*5562Sjp161948 xfree(locale); 5390Sstevel@tonic-gate } 5400Sstevel@tonic-gate if (plangs != p_langs_s2c && 5410Sstevel@tonic-gate p_langs_s2c && *p_langs_s2c) { 5420Sstevel@tonic-gate choose_lang(&locale, p_langs_s2c, mlangs); 5430Sstevel@tonic-gate if (locale) { 5440Sstevel@tonic-gate g11n_setlocale(LC_MESSAGES, locale); 5450Sstevel@tonic-gate debug("Negotiated messages locale: %s", locale); 546*5562Sjp161948 packet_send_debug("Negotiated " 547*5562Sjp161948 "messages locale: %s", locale); 548*5562Sjp161948 xfree(locale); 5490Sstevel@tonic-gate } 5500Sstevel@tonic-gate } 5510Sstevel@tonic-gate } 5520Sstevel@tonic-gate } 5530Sstevel@tonic-gate else { 5540Sstevel@tonic-gate if (plangs && mlangs && *plangs && *mlangs && 5550Sstevel@tonic-gate !(datafellows & SSH_BUG_LOCALES_NOT_LANGTAGS)) { 5560Sstevel@tonic-gate char *lang; 5570Sstevel@tonic-gate lang = g11n_clnt_langtag_negotiate(mlangs, plangs); 5580Sstevel@tonic-gate if (lang) { 5590Sstevel@tonic-gate session_lang = lang; 5600Sstevel@tonic-gate debug("Negotiated lang: %s", lang); 5610Sstevel@tonic-gate } 5620Sstevel@tonic-gate } 5630Sstevel@tonic-gate } 5640Sstevel@tonic-gate } 5650Sstevel@tonic-gate 5660Sstevel@tonic-gate kex_prop_free(my); 5670Sstevel@tonic-gate kex_prop_free(peer); 5680Sstevel@tonic-gate } 5690Sstevel@tonic-gate 5700Sstevel@tonic-gate static u_char * 5710Sstevel@tonic-gate derive_key(Kex *kex, int id, int need, u_char *hash, BIGNUM *shared_secret) 5720Sstevel@tonic-gate { 5730Sstevel@tonic-gate Buffer b; 5740Sstevel@tonic-gate const EVP_MD *evp_md = EVP_sha1(); 5750Sstevel@tonic-gate EVP_MD_CTX md; 5760Sstevel@tonic-gate char c = id; 5770Sstevel@tonic-gate int have; 5780Sstevel@tonic-gate int mdsz = EVP_MD_size(evp_md); 5790Sstevel@tonic-gate u_char *digest = xmalloc(roundup(need, mdsz)); 5800Sstevel@tonic-gate 5810Sstevel@tonic-gate buffer_init(&b); 5820Sstevel@tonic-gate buffer_put_bignum2(&b, shared_secret); 5830Sstevel@tonic-gate 5840Sstevel@tonic-gate /* K1 = HASH(K || H || "A" || session_id) */ 5850Sstevel@tonic-gate EVP_DigestInit(&md, evp_md); 5860Sstevel@tonic-gate if (!(datafellows & SSH_BUG_DERIVEKEY)) 5870Sstevel@tonic-gate EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b)); 5880Sstevel@tonic-gate EVP_DigestUpdate(&md, hash, mdsz); 5890Sstevel@tonic-gate EVP_DigestUpdate(&md, &c, 1); 5900Sstevel@tonic-gate EVP_DigestUpdate(&md, kex->session_id, kex->session_id_len); 5910Sstevel@tonic-gate EVP_DigestFinal(&md, digest, NULL); 5920Sstevel@tonic-gate 5930Sstevel@tonic-gate /* 5940Sstevel@tonic-gate * expand key: 5950Sstevel@tonic-gate * Kn = HASH(K || H || K1 || K2 || ... || Kn-1) 5960Sstevel@tonic-gate * Key = K1 || K2 || ... || Kn 5970Sstevel@tonic-gate */ 5980Sstevel@tonic-gate for (have = mdsz; need > have; have += mdsz) { 5990Sstevel@tonic-gate EVP_DigestInit(&md, evp_md); 6000Sstevel@tonic-gate if (!(datafellows & SSH_BUG_DERIVEKEY)) 6010Sstevel@tonic-gate EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b)); 6020Sstevel@tonic-gate EVP_DigestUpdate(&md, hash, mdsz); 6030Sstevel@tonic-gate EVP_DigestUpdate(&md, digest, have); 6040Sstevel@tonic-gate EVP_DigestFinal(&md, digest + have, NULL); 6050Sstevel@tonic-gate } 6060Sstevel@tonic-gate buffer_free(&b); 6070Sstevel@tonic-gate #ifdef DEBUG_KEX 6080Sstevel@tonic-gate fprintf(stderr, "key '%c'== ", c); 6090Sstevel@tonic-gate dump_digest("key", digest, need); 6100Sstevel@tonic-gate #endif 6110Sstevel@tonic-gate return digest; 6120Sstevel@tonic-gate } 6130Sstevel@tonic-gate 6140Sstevel@tonic-gate Newkeys *current_keys[MODE_MAX]; 6150Sstevel@tonic-gate 6160Sstevel@tonic-gate #define NKEYS 6 6170Sstevel@tonic-gate void 6180Sstevel@tonic-gate kex_derive_keys(Kex *kex, u_char *hash, BIGNUM *shared_secret) 6190Sstevel@tonic-gate { 6200Sstevel@tonic-gate u_char *keys[NKEYS]; 6210Sstevel@tonic-gate int i, mode, ctos; 6220Sstevel@tonic-gate 6230Sstevel@tonic-gate for (i = 0; i < NKEYS; i++) 6240Sstevel@tonic-gate keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, shared_secret); 6250Sstevel@tonic-gate 6260Sstevel@tonic-gate debug2("kex_derive_keys"); 6270Sstevel@tonic-gate for (mode = 0; mode < MODE_MAX; mode++) { 6280Sstevel@tonic-gate current_keys[mode] = kex->newkeys[mode]; 6290Sstevel@tonic-gate kex->newkeys[mode] = NULL; 6300Sstevel@tonic-gate ctos = (!kex->server && mode == MODE_OUT) || (kex->server && mode == MODE_IN); 6310Sstevel@tonic-gate current_keys[mode]->enc.iv = keys[ctos ? 0 : 1]; 6320Sstevel@tonic-gate current_keys[mode]->enc.key = keys[ctos ? 2 : 3]; 6330Sstevel@tonic-gate current_keys[mode]->mac.key = keys[ctos ? 4 : 5]; 6340Sstevel@tonic-gate } 6350Sstevel@tonic-gate } 6360Sstevel@tonic-gate 6370Sstevel@tonic-gate Newkeys * 6380Sstevel@tonic-gate kex_get_newkeys(int mode) 6390Sstevel@tonic-gate { 6400Sstevel@tonic-gate Newkeys *ret; 6410Sstevel@tonic-gate 6420Sstevel@tonic-gate ret = current_keys[mode]; 6430Sstevel@tonic-gate current_keys[mode] = NULL; 6440Sstevel@tonic-gate return ret; 6450Sstevel@tonic-gate } 6460Sstevel@tonic-gate 6470Sstevel@tonic-gate #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) 6480Sstevel@tonic-gate void 6490Sstevel@tonic-gate dump_digest(char *msg, u_char *digest, int len) 6500Sstevel@tonic-gate { 6510Sstevel@tonic-gate int i; 6520Sstevel@tonic-gate 6530Sstevel@tonic-gate fprintf(stderr, "%s\n", msg); 6540Sstevel@tonic-gate for (i = 0; i< len; i++) { 6550Sstevel@tonic-gate fprintf(stderr, "%02x", digest[i]); 6560Sstevel@tonic-gate if (i%32 == 31) 6570Sstevel@tonic-gate fprintf(stderr, "\n"); 6580Sstevel@tonic-gate else if (i%8 == 7) 6590Sstevel@tonic-gate fprintf(stderr, " "); 6600Sstevel@tonic-gate } 6610Sstevel@tonic-gate fprintf(stderr, "\n"); 6620Sstevel@tonic-gate } 6630Sstevel@tonic-gate #endif 664