1 /* $OpenBSD: kex.c,v 1.136 2018/02/07 02:06:50 jsing Exp $ */ 2 /* 3 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24 */ 25 26 27 #include <signal.h> 28 #include <stdio.h> 29 #include <stdlib.h> 30 #include <string.h> 31 32 #ifdef WITH_OPENSSL 33 #include <openssl/crypto.h> 34 #endif 35 36 #include "ssh2.h" 37 #include "packet.h" 38 #include "compat.h" 39 #include "cipher.h" 40 #include "sshkey.h" 41 #include "kex.h" 42 #include "log.h" 43 #include "mac.h" 44 #include "match.h" 45 #include "misc.h" 46 #include "dispatch.h" 47 #include "monitor.h" 48 49 #include "ssherr.h" 50 #include "sshbuf.h" 51 #include "digest.h" 52 53 /* prototype */ 54 static int kex_choose_conf(struct ssh *); 55 static int kex_input_newkeys(int, u_int32_t, struct ssh *); 56 57 static const char *proposal_names[PROPOSAL_MAX] = { 58 "KEX algorithms", 59 "host key algorithms", 60 "ciphers ctos", 61 "ciphers stoc", 62 "MACs ctos", 63 "MACs stoc", 64 "compression ctos", 65 "compression stoc", 66 "languages ctos", 67 "languages stoc", 68 }; 69 70 struct kexalg { 71 char *name; 72 u_int type; 73 int ec_nid; 74 int hash_alg; 75 }; 76 static const struct kexalg kexalgs[] = { 77 #ifdef WITH_OPENSSL 78 { KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 }, 79 { KEX_DH14_SHA1, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 }, 80 { KEX_DH14_SHA256, KEX_DH_GRP14_SHA256, 0, SSH_DIGEST_SHA256 }, 81 { KEX_DH16_SHA512, KEX_DH_GRP16_SHA512, 0, SSH_DIGEST_SHA512 }, 82 { KEX_DH18_SHA512, KEX_DH_GRP18_SHA512, 0, SSH_DIGEST_SHA512 }, 83 { KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, SSH_DIGEST_SHA1 }, 84 { KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256 }, 85 { KEX_ECDH_SHA2_NISTP256, KEX_ECDH_SHA2, 86 NID_X9_62_prime256v1, SSH_DIGEST_SHA256 }, 87 { KEX_ECDH_SHA2_NISTP384, KEX_ECDH_SHA2, NID_secp384r1, 88 SSH_DIGEST_SHA384 }, 89 { KEX_ECDH_SHA2_NISTP521, KEX_ECDH_SHA2, NID_secp521r1, 90 SSH_DIGEST_SHA512 }, 91 #endif 92 { KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 }, 93 { KEX_CURVE25519_SHA256_OLD, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 }, 94 { NULL, -1, -1, -1}, 95 }; 96 97 char * 98 kex_alg_list(char sep) 99 { 100 char *ret = NULL, *tmp; 101 size_t nlen, rlen = 0; 102 const struct kexalg *k; 103 104 for (k = kexalgs; k->name != NULL; k++) { 105 if (ret != NULL) 106 ret[rlen++] = sep; 107 nlen = strlen(k->name); 108 if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) { 109 free(ret); 110 return NULL; 111 } 112 ret = tmp; 113 memcpy(ret + rlen, k->name, nlen + 1); 114 rlen += nlen; 115 } 116 return ret; 117 } 118 119 static const struct kexalg * 120 kex_alg_by_name(const char *name) 121 { 122 const struct kexalg *k; 123 124 for (k = kexalgs; k->name != NULL; k++) { 125 if (strcmp(k->name, name) == 0) 126 return k; 127 } 128 return NULL; 129 } 130 131 /* Validate KEX method name list */ 132 int 133 kex_names_valid(const char *names) 134 { 135 char *s, *cp, *p; 136 137 if (names == NULL || strcmp(names, "") == 0) 138 return 0; 139 if ((s = cp = strdup(names)) == NULL) 140 return 0; 141 for ((p = strsep(&cp, ",")); p && *p != '\0'; 142 (p = strsep(&cp, ","))) { 143 if (kex_alg_by_name(p) == NULL) { 144 error("Unsupported KEX algorithm \"%.100s\"", p); 145 free(s); 146 return 0; 147 } 148 } 149 debug3("kex names ok: [%s]", names); 150 free(s); 151 return 1; 152 } 153 154 /* 155 * Concatenate algorithm names, avoiding duplicates in the process. 156 * Caller must free returned string. 157 */ 158 char * 159 kex_names_cat(const char *a, const char *b) 160 { 161 char *ret = NULL, *tmp = NULL, *cp, *p, *m; 162 size_t len; 163 164 if (a == NULL || *a == '\0') 165 return NULL; 166 if (b == NULL || *b == '\0') 167 return strdup(a); 168 if (strlen(b) > 1024*1024) 169 return NULL; 170 len = strlen(a) + strlen(b) + 2; 171 if ((tmp = cp = strdup(b)) == NULL || 172 (ret = calloc(1, len)) == NULL) { 173 free(tmp); 174 return NULL; 175 } 176 strlcpy(ret, a, len); 177 for ((p = strsep(&cp, ",")); p && *p != '\0'; (p = strsep(&cp, ","))) { 178 if ((m = match_list(ret, p, NULL)) != NULL) { 179 free(m); 180 continue; /* Algorithm already present */ 181 } 182 if (strlcat(ret, ",", len) >= len || 183 strlcat(ret, p, len) >= len) { 184 free(tmp); 185 free(ret); 186 return NULL; /* Shouldn't happen */ 187 } 188 } 189 free(tmp); 190 return ret; 191 } 192 193 /* 194 * Assemble a list of algorithms from a default list and a string from a 195 * configuration file. The user-provided string may begin with '+' to 196 * indicate that it should be appended to the default or '-' that the 197 * specified names should be removed. 198 */ 199 int 200 kex_assemble_names(const char *def, char **list) 201 { 202 char *ret; 203 204 if (list == NULL || *list == NULL || **list == '\0') { 205 *list = strdup(def); 206 return 0; 207 } 208 if (**list == '+') { 209 if ((ret = kex_names_cat(def, *list + 1)) == NULL) 210 return SSH_ERR_ALLOC_FAIL; 211 free(*list); 212 *list = ret; 213 } else if (**list == '-') { 214 if ((ret = match_filter_list(def, *list + 1)) == NULL) 215 return SSH_ERR_ALLOC_FAIL; 216 free(*list); 217 *list = ret; 218 } 219 220 return 0; 221 } 222 223 /* put algorithm proposal into buffer */ 224 int 225 kex_prop2buf(struct sshbuf *b, char *proposal[PROPOSAL_MAX]) 226 { 227 u_int i; 228 int r; 229 230 sshbuf_reset(b); 231 232 /* 233 * add a dummy cookie, the cookie will be overwritten by 234 * kex_send_kexinit(), each time a kexinit is set 235 */ 236 for (i = 0; i < KEX_COOKIE_LEN; i++) { 237 if ((r = sshbuf_put_u8(b, 0)) != 0) 238 return r; 239 } 240 for (i = 0; i < PROPOSAL_MAX; i++) { 241 if ((r = sshbuf_put_cstring(b, proposal[i])) != 0) 242 return r; 243 } 244 if ((r = sshbuf_put_u8(b, 0)) != 0 || /* first_kex_packet_follows */ 245 (r = sshbuf_put_u32(b, 0)) != 0) /* uint32 reserved */ 246 return r; 247 return 0; 248 } 249 250 /* parse buffer and return algorithm proposal */ 251 int 252 kex_buf2prop(struct sshbuf *raw, int *first_kex_follows, char ***propp) 253 { 254 struct sshbuf *b = NULL; 255 u_char v; 256 u_int i; 257 char **proposal = NULL; 258 int r; 259 260 *propp = NULL; 261 if ((proposal = calloc(PROPOSAL_MAX, sizeof(char *))) == NULL) 262 return SSH_ERR_ALLOC_FAIL; 263 if ((b = sshbuf_fromb(raw)) == NULL) { 264 r = SSH_ERR_ALLOC_FAIL; 265 goto out; 266 } 267 if ((r = sshbuf_consume(b, KEX_COOKIE_LEN)) != 0) /* skip cookie */ 268 goto out; 269 /* extract kex init proposal strings */ 270 for (i = 0; i < PROPOSAL_MAX; i++) { 271 if ((r = sshbuf_get_cstring(b, &(proposal[i]), NULL)) != 0) 272 goto out; 273 debug2("%s: %s", proposal_names[i], proposal[i]); 274 } 275 /* first kex follows / reserved */ 276 if ((r = sshbuf_get_u8(b, &v)) != 0 || /* first_kex_follows */ 277 (r = sshbuf_get_u32(b, &i)) != 0) /* reserved */ 278 goto out; 279 if (first_kex_follows != NULL) 280 *first_kex_follows = v; 281 debug2("first_kex_follows %d ", v); 282 debug2("reserved %u ", i); 283 r = 0; 284 *propp = proposal; 285 out: 286 if (r != 0 && proposal != NULL) 287 kex_prop_free(proposal); 288 sshbuf_free(b); 289 return r; 290 } 291 292 void 293 kex_prop_free(char **proposal) 294 { 295 u_int i; 296 297 if (proposal == NULL) 298 return; 299 for (i = 0; i < PROPOSAL_MAX; i++) 300 free(proposal[i]); 301 free(proposal); 302 } 303 304 /* ARGSUSED */ 305 static int 306 kex_protocol_error(int type, u_int32_t seq, struct ssh *ssh) 307 { 308 int r; 309 310 error("kex protocol error: type %d seq %u", type, seq); 311 if ((r = sshpkt_start(ssh, SSH2_MSG_UNIMPLEMENTED)) != 0 || 312 (r = sshpkt_put_u32(ssh, seq)) != 0 || 313 (r = sshpkt_send(ssh)) != 0) 314 return r; 315 return 0; 316 } 317 318 static void 319 kex_reset_dispatch(struct ssh *ssh) 320 { 321 ssh_dispatch_range(ssh, SSH2_MSG_TRANSPORT_MIN, 322 SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error); 323 } 324 325 static int 326 kex_send_ext_info(struct ssh *ssh) 327 { 328 int r; 329 char *algs; 330 331 if ((algs = sshkey_alg_list(0, 1, 1, ',')) == NULL) 332 return SSH_ERR_ALLOC_FAIL; 333 if ((r = sshpkt_start(ssh, SSH2_MSG_EXT_INFO)) != 0 || 334 (r = sshpkt_put_u32(ssh, 1)) != 0 || 335 (r = sshpkt_put_cstring(ssh, "server-sig-algs")) != 0 || 336 (r = sshpkt_put_cstring(ssh, algs)) != 0 || 337 (r = sshpkt_send(ssh)) != 0) 338 goto out; 339 /* success */ 340 r = 0; 341 out: 342 free(algs); 343 return r; 344 } 345 346 int 347 kex_send_newkeys(struct ssh *ssh) 348 { 349 int r; 350 351 kex_reset_dispatch(ssh); 352 if ((r = sshpkt_start(ssh, SSH2_MSG_NEWKEYS)) != 0 || 353 (r = sshpkt_send(ssh)) != 0) 354 return r; 355 debug("SSH2_MSG_NEWKEYS sent"); 356 debug("expecting SSH2_MSG_NEWKEYS"); 357 ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_input_newkeys); 358 if (ssh->kex->ext_info_c) 359 if ((r = kex_send_ext_info(ssh)) != 0) 360 return r; 361 return 0; 362 } 363 364 int 365 kex_input_ext_info(int type, u_int32_t seq, struct ssh *ssh) 366 { 367 struct kex *kex = ssh->kex; 368 u_int32_t i, ninfo; 369 char *name, *found; 370 u_char *val; 371 size_t vlen; 372 int r; 373 374 debug("SSH2_MSG_EXT_INFO received"); 375 ssh_dispatch_set(ssh, SSH2_MSG_EXT_INFO, &kex_protocol_error); 376 if ((r = sshpkt_get_u32(ssh, &ninfo)) != 0) 377 return r; 378 for (i = 0; i < ninfo; i++) { 379 if ((r = sshpkt_get_cstring(ssh, &name, NULL)) != 0) 380 return r; 381 if ((r = sshpkt_get_string(ssh, &val, &vlen)) != 0) { 382 free(name); 383 return r; 384 } 385 if (strcmp(name, "server-sig-algs") == 0) { 386 /* Ensure no \0 lurking in value */ 387 if (memchr(val, '\0', vlen) != NULL) { 388 error("%s: nul byte in %s", __func__, name); 389 return SSH_ERR_INVALID_FORMAT; 390 } 391 debug("%s: %s=<%s>", __func__, name, val); 392 found = match_list("rsa-sha2-256", val, NULL); 393 if (found) { 394 kex->rsa_sha2 = 256; 395 free(found); 396 } 397 found = match_list("rsa-sha2-512", val, NULL); 398 if (found) { 399 kex->rsa_sha2 = 512; 400 free(found); 401 } 402 } else 403 debug("%s: %s (unrecognised)", __func__, name); 404 free(name); 405 free(val); 406 } 407 return sshpkt_get_end(ssh); 408 } 409 410 static int 411 kex_input_newkeys(int type, u_int32_t seq, struct ssh *ssh) 412 { 413 struct kex *kex = ssh->kex; 414 int r; 415 416 debug("SSH2_MSG_NEWKEYS received"); 417 ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_protocol_error); 418 ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, &kex_input_kexinit); 419 if ((r = sshpkt_get_end(ssh)) != 0) 420 return r; 421 if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0) 422 return r; 423 kex->done = 1; 424 sshbuf_reset(kex->peer); 425 /* sshbuf_reset(kex->my); */ 426 kex->flags &= ~KEX_INIT_SENT; 427 free(kex->name); 428 kex->name = NULL; 429 return 0; 430 } 431 432 int 433 kex_send_kexinit(struct ssh *ssh) 434 { 435 u_char *cookie; 436 struct kex *kex = ssh->kex; 437 int r; 438 439 if (kex == NULL) 440 return SSH_ERR_INTERNAL_ERROR; 441 if (kex->flags & KEX_INIT_SENT) 442 return 0; 443 kex->done = 0; 444 445 /* generate a random cookie */ 446 if (sshbuf_len(kex->my) < KEX_COOKIE_LEN) 447 return SSH_ERR_INVALID_FORMAT; 448 if ((cookie = sshbuf_mutable_ptr(kex->my)) == NULL) 449 return SSH_ERR_INTERNAL_ERROR; 450 arc4random_buf(cookie, KEX_COOKIE_LEN); 451 452 if ((r = sshpkt_start(ssh, SSH2_MSG_KEXINIT)) != 0 || 453 (r = sshpkt_putb(ssh, kex->my)) != 0 || 454 (r = sshpkt_send(ssh)) != 0) 455 return r; 456 debug("SSH2_MSG_KEXINIT sent"); 457 kex->flags |= KEX_INIT_SENT; 458 return 0; 459 } 460 461 /* ARGSUSED */ 462 int 463 kex_input_kexinit(int type, u_int32_t seq, struct ssh *ssh) 464 { 465 struct kex *kex = ssh->kex; 466 const u_char *ptr; 467 u_int i; 468 size_t dlen; 469 int r; 470 471 debug("SSH2_MSG_KEXINIT received"); 472 if (kex == NULL) 473 return SSH_ERR_INVALID_ARGUMENT; 474 475 ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL); 476 ptr = sshpkt_ptr(ssh, &dlen); 477 if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0) 478 return r; 479 480 /* discard packet */ 481 for (i = 0; i < KEX_COOKIE_LEN; i++) 482 if ((r = sshpkt_get_u8(ssh, NULL)) != 0) 483 return r; 484 for (i = 0; i < PROPOSAL_MAX; i++) 485 if ((r = sshpkt_get_string(ssh, NULL, NULL)) != 0) 486 return r; 487 /* 488 * XXX RFC4253 sec 7: "each side MAY guess" - currently no supported 489 * KEX method has the server move first, but a server might be using 490 * a custom method or one that we otherwise don't support. We should 491 * be prepared to remember first_kex_follows here so we can eat a 492 * packet later. 493 * XXX2 - RFC4253 is kind of ambiguous on what first_kex_follows means 494 * for cases where the server *doesn't* go first. I guess we should 495 * ignore it when it is set for these cases, which is what we do now. 496 */ 497 if ((r = sshpkt_get_u8(ssh, NULL)) != 0 || /* first_kex_follows */ 498 (r = sshpkt_get_u32(ssh, NULL)) != 0 || /* reserved */ 499 (r = sshpkt_get_end(ssh)) != 0) 500 return r; 501 502 if (!(kex->flags & KEX_INIT_SENT)) 503 if ((r = kex_send_kexinit(ssh)) != 0) 504 return r; 505 if ((r = kex_choose_conf(ssh)) != 0) 506 return r; 507 508 if (kex->kex_type < KEX_MAX && kex->kex[kex->kex_type] != NULL) 509 return (kex->kex[kex->kex_type])(ssh); 510 511 return SSH_ERR_INTERNAL_ERROR; 512 } 513 514 int 515 kex_new(struct ssh *ssh, char *proposal[PROPOSAL_MAX], struct kex **kexp) 516 { 517 struct kex *kex; 518 int r; 519 520 *kexp = NULL; 521 if ((kex = calloc(1, sizeof(*kex))) == NULL) 522 return SSH_ERR_ALLOC_FAIL; 523 if ((kex->peer = sshbuf_new()) == NULL || 524 (kex->my = sshbuf_new()) == NULL) { 525 r = SSH_ERR_ALLOC_FAIL; 526 goto out; 527 } 528 if ((r = kex_prop2buf(kex->my, proposal)) != 0) 529 goto out; 530 kex->done = 0; 531 kex_reset_dispatch(ssh); 532 ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, &kex_input_kexinit); 533 r = 0; 534 *kexp = kex; 535 out: 536 if (r != 0) 537 kex_free(kex); 538 return r; 539 } 540 541 void 542 kex_free_newkeys(struct newkeys *newkeys) 543 { 544 if (newkeys == NULL) 545 return; 546 if (newkeys->enc.key) { 547 explicit_bzero(newkeys->enc.key, newkeys->enc.key_len); 548 free(newkeys->enc.key); 549 newkeys->enc.key = NULL; 550 } 551 if (newkeys->enc.iv) { 552 explicit_bzero(newkeys->enc.iv, newkeys->enc.iv_len); 553 free(newkeys->enc.iv); 554 newkeys->enc.iv = NULL; 555 } 556 free(newkeys->enc.name); 557 explicit_bzero(&newkeys->enc, sizeof(newkeys->enc)); 558 free(newkeys->comp.name); 559 explicit_bzero(&newkeys->comp, sizeof(newkeys->comp)); 560 mac_clear(&newkeys->mac); 561 if (newkeys->mac.key) { 562 explicit_bzero(newkeys->mac.key, newkeys->mac.key_len); 563 free(newkeys->mac.key); 564 newkeys->mac.key = NULL; 565 } 566 free(newkeys->mac.name); 567 explicit_bzero(&newkeys->mac, sizeof(newkeys->mac)); 568 explicit_bzero(newkeys, sizeof(*newkeys)); 569 free(newkeys); 570 } 571 572 void 573 kex_free(struct kex *kex) 574 { 575 u_int mode; 576 577 #ifdef WITH_OPENSSL 578 DH_free(kex->dh); 579 EC_KEY_free(kex->ec_client_key); 580 #endif 581 for (mode = 0; mode < MODE_MAX; mode++) { 582 kex_free_newkeys(kex->newkeys[mode]); 583 kex->newkeys[mode] = NULL; 584 } 585 sshbuf_free(kex->peer); 586 sshbuf_free(kex->my); 587 free(kex->session_id); 588 free(kex->client_version_string); 589 free(kex->server_version_string); 590 free(kex->failed_choice); 591 free(kex->hostkey_alg); 592 free(kex->name); 593 free(kex); 594 } 595 596 int 597 kex_setup(struct ssh *ssh, char *proposal[PROPOSAL_MAX]) 598 { 599 int r; 600 601 if ((r = kex_new(ssh, proposal, &ssh->kex)) != 0) 602 return r; 603 if ((r = kex_send_kexinit(ssh)) != 0) { /* we start */ 604 kex_free(ssh->kex); 605 ssh->kex = NULL; 606 return r; 607 } 608 return 0; 609 } 610 611 /* 612 * Request key re-exchange, returns 0 on success or a ssherr.h error 613 * code otherwise. Must not be called if KEX is incomplete or in-progress. 614 */ 615 int 616 kex_start_rekex(struct ssh *ssh) 617 { 618 if (ssh->kex == NULL) { 619 error("%s: no kex", __func__); 620 return SSH_ERR_INTERNAL_ERROR; 621 } 622 if (ssh->kex->done == 0) { 623 error("%s: requested twice", __func__); 624 return SSH_ERR_INTERNAL_ERROR; 625 } 626 ssh->kex->done = 0; 627 return kex_send_kexinit(ssh); 628 } 629 630 static int 631 choose_enc(struct sshenc *enc, char *client, char *server) 632 { 633 char *name = match_list(client, server, NULL); 634 635 if (name == NULL) 636 return SSH_ERR_NO_CIPHER_ALG_MATCH; 637 if ((enc->cipher = cipher_by_name(name)) == NULL) { 638 free(name); 639 return SSH_ERR_INTERNAL_ERROR; 640 } 641 enc->name = name; 642 enc->enabled = 0; 643 enc->iv = NULL; 644 enc->iv_len = cipher_ivlen(enc->cipher); 645 enc->key = NULL; 646 enc->key_len = cipher_keylen(enc->cipher); 647 enc->block_size = cipher_blocksize(enc->cipher); 648 return 0; 649 } 650 651 static int 652 choose_mac(struct ssh *ssh, struct sshmac *mac, char *client, char *server) 653 { 654 char *name = match_list(client, server, NULL); 655 656 if (name == NULL) 657 return SSH_ERR_NO_MAC_ALG_MATCH; 658 if (mac_setup(mac, name) < 0) { 659 free(name); 660 return SSH_ERR_INTERNAL_ERROR; 661 } 662 mac->name = name; 663 mac->key = NULL; 664 mac->enabled = 0; 665 return 0; 666 } 667 668 static int 669 choose_comp(struct sshcomp *comp, char *client, char *server) 670 { 671 char *name = match_list(client, server, NULL); 672 673 if (name == NULL) 674 return SSH_ERR_NO_COMPRESS_ALG_MATCH; 675 if (strcmp(name, "zlib@openssh.com") == 0) { 676 comp->type = COMP_DELAYED; 677 } else if (strcmp(name, "zlib") == 0) { 678 comp->type = COMP_ZLIB; 679 } else if (strcmp(name, "none") == 0) { 680 comp->type = COMP_NONE; 681 } else { 682 free(name); 683 return SSH_ERR_INTERNAL_ERROR; 684 } 685 comp->name = name; 686 return 0; 687 } 688 689 static int 690 choose_kex(struct kex *k, char *client, char *server) 691 { 692 const struct kexalg *kexalg; 693 694 k->name = match_list(client, server, NULL); 695 696 debug("kex: algorithm: %s", k->name ? k->name : "(no match)"); 697 if (k->name == NULL) 698 return SSH_ERR_NO_KEX_ALG_MATCH; 699 if ((kexalg = kex_alg_by_name(k->name)) == NULL) 700 return SSH_ERR_INTERNAL_ERROR; 701 k->kex_type = kexalg->type; 702 k->hash_alg = kexalg->hash_alg; 703 k->ec_nid = kexalg->ec_nid; 704 return 0; 705 } 706 707 static int 708 choose_hostkeyalg(struct kex *k, char *client, char *server) 709 { 710 k->hostkey_alg = match_list(client, server, NULL); 711 712 debug("kex: host key algorithm: %s", 713 k->hostkey_alg ? k->hostkey_alg : "(no match)"); 714 if (k->hostkey_alg == NULL) 715 return SSH_ERR_NO_HOSTKEY_ALG_MATCH; 716 k->hostkey_type = sshkey_type_from_name(k->hostkey_alg); 717 if (k->hostkey_type == KEY_UNSPEC) 718 return SSH_ERR_INTERNAL_ERROR; 719 k->hostkey_nid = sshkey_ecdsa_nid_from_name(k->hostkey_alg); 720 return 0; 721 } 722 723 static int 724 proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX]) 725 { 726 static int check[] = { 727 PROPOSAL_KEX_ALGS, PROPOSAL_SERVER_HOST_KEY_ALGS, -1 728 }; 729 int *idx; 730 char *p; 731 732 for (idx = &check[0]; *idx != -1; idx++) { 733 if ((p = strchr(my[*idx], ',')) != NULL) 734 *p = '\0'; 735 if ((p = strchr(peer[*idx], ',')) != NULL) 736 *p = '\0'; 737 if (strcmp(my[*idx], peer[*idx]) != 0) { 738 debug2("proposal mismatch: my %s peer %s", 739 my[*idx], peer[*idx]); 740 return (0); 741 } 742 } 743 debug2("proposals match"); 744 return (1); 745 } 746 747 static int 748 kex_choose_conf(struct ssh *ssh) 749 { 750 struct kex *kex = ssh->kex; 751 struct newkeys *newkeys; 752 char **my = NULL, **peer = NULL; 753 char **cprop, **sprop; 754 int nenc, nmac, ncomp; 755 u_int mode, ctos, need, dh_need, authlen; 756 int r, first_kex_follows; 757 758 debug2("local %s KEXINIT proposal", kex->server ? "server" : "client"); 759 if ((r = kex_buf2prop(kex->my, NULL, &my)) != 0) 760 goto out; 761 debug2("peer %s KEXINIT proposal", kex->server ? "client" : "server"); 762 if ((r = kex_buf2prop(kex->peer, &first_kex_follows, &peer)) != 0) 763 goto out; 764 765 if (kex->server) { 766 cprop=peer; 767 sprop=my; 768 } else { 769 cprop=my; 770 sprop=peer; 771 } 772 773 /* Check whether client supports ext_info_c */ 774 if (kex->server) { 775 char *ext; 776 777 ext = match_list("ext-info-c", peer[PROPOSAL_KEX_ALGS], NULL); 778 kex->ext_info_c = (ext != NULL); 779 free(ext); 780 } 781 782 /* Algorithm Negotiation */ 783 if ((r = choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], 784 sprop[PROPOSAL_KEX_ALGS])) != 0) { 785 kex->failed_choice = peer[PROPOSAL_KEX_ALGS]; 786 peer[PROPOSAL_KEX_ALGS] = NULL; 787 goto out; 788 } 789 if ((r = choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS], 790 sprop[PROPOSAL_SERVER_HOST_KEY_ALGS])) != 0) { 791 kex->failed_choice = peer[PROPOSAL_SERVER_HOST_KEY_ALGS]; 792 peer[PROPOSAL_SERVER_HOST_KEY_ALGS] = NULL; 793 goto out; 794 } 795 for (mode = 0; mode < MODE_MAX; mode++) { 796 if ((newkeys = calloc(1, sizeof(*newkeys))) == NULL) { 797 r = SSH_ERR_ALLOC_FAIL; 798 goto out; 799 } 800 kex->newkeys[mode] = newkeys; 801 ctos = (!kex->server && mode == MODE_OUT) || 802 (kex->server && mode == MODE_IN); 803 nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC; 804 nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC; 805 ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC; 806 if ((r = choose_enc(&newkeys->enc, cprop[nenc], 807 sprop[nenc])) != 0) { 808 kex->failed_choice = peer[nenc]; 809 peer[nenc] = NULL; 810 goto out; 811 } 812 authlen = cipher_authlen(newkeys->enc.cipher); 813 /* ignore mac for authenticated encryption */ 814 if (authlen == 0 && 815 (r = choose_mac(ssh, &newkeys->mac, cprop[nmac], 816 sprop[nmac])) != 0) { 817 kex->failed_choice = peer[nmac]; 818 peer[nmac] = NULL; 819 goto out; 820 } 821 if ((r = choose_comp(&newkeys->comp, cprop[ncomp], 822 sprop[ncomp])) != 0) { 823 kex->failed_choice = peer[ncomp]; 824 peer[ncomp] = NULL; 825 goto out; 826 } 827 debug("kex: %s cipher: %s MAC: %s compression: %s", 828 ctos ? "client->server" : "server->client", 829 newkeys->enc.name, 830 authlen == 0 ? newkeys->mac.name : "<implicit>", 831 newkeys->comp.name); 832 } 833 need = dh_need = 0; 834 for (mode = 0; mode < MODE_MAX; mode++) { 835 newkeys = kex->newkeys[mode]; 836 need = MAXIMUM(need, newkeys->enc.key_len); 837 need = MAXIMUM(need, newkeys->enc.block_size); 838 need = MAXIMUM(need, newkeys->enc.iv_len); 839 need = MAXIMUM(need, newkeys->mac.key_len); 840 dh_need = MAXIMUM(dh_need, cipher_seclen(newkeys->enc.cipher)); 841 dh_need = MAXIMUM(dh_need, newkeys->enc.block_size); 842 dh_need = MAXIMUM(dh_need, newkeys->enc.iv_len); 843 dh_need = MAXIMUM(dh_need, newkeys->mac.key_len); 844 } 845 /* XXX need runden? */ 846 kex->we_need = need; 847 kex->dh_need = dh_need; 848 849 /* ignore the next message if the proposals do not match */ 850 if (first_kex_follows && !proposals_match(my, peer)) 851 ssh->dispatch_skip_packets = 1; 852 r = 0; 853 out: 854 kex_prop_free(my); 855 kex_prop_free(peer); 856 return r; 857 } 858 859 static int 860 derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen, 861 const struct sshbuf *shared_secret, u_char **keyp) 862 { 863 struct kex *kex = ssh->kex; 864 struct ssh_digest_ctx *hashctx = NULL; 865 char c = id; 866 u_int have; 867 size_t mdsz; 868 u_char *digest; 869 int r; 870 871 if ((mdsz = ssh_digest_bytes(kex->hash_alg)) == 0) 872 return SSH_ERR_INVALID_ARGUMENT; 873 if ((digest = calloc(1, ROUNDUP(need, mdsz))) == NULL) { 874 r = SSH_ERR_ALLOC_FAIL; 875 goto out; 876 } 877 878 /* K1 = HASH(K || H || "A" || session_id) */ 879 if ((hashctx = ssh_digest_start(kex->hash_alg)) == NULL || 880 ssh_digest_update_buffer(hashctx, shared_secret) != 0 || 881 ssh_digest_update(hashctx, hash, hashlen) != 0 || 882 ssh_digest_update(hashctx, &c, 1) != 0 || 883 ssh_digest_update(hashctx, kex->session_id, 884 kex->session_id_len) != 0 || 885 ssh_digest_final(hashctx, digest, mdsz) != 0) { 886 r = SSH_ERR_LIBCRYPTO_ERROR; 887 goto out; 888 } 889 ssh_digest_free(hashctx); 890 hashctx = NULL; 891 892 /* 893 * expand key: 894 * Kn = HASH(K || H || K1 || K2 || ... || Kn-1) 895 * Key = K1 || K2 || ... || Kn 896 */ 897 for (have = mdsz; need > have; have += mdsz) { 898 if ((hashctx = ssh_digest_start(kex->hash_alg)) == NULL || 899 ssh_digest_update_buffer(hashctx, shared_secret) != 0 || 900 ssh_digest_update(hashctx, hash, hashlen) != 0 || 901 ssh_digest_update(hashctx, digest, have) != 0 || 902 ssh_digest_final(hashctx, digest + have, mdsz) != 0) { 903 r = SSH_ERR_LIBCRYPTO_ERROR; 904 goto out; 905 } 906 ssh_digest_free(hashctx); 907 hashctx = NULL; 908 } 909 #ifdef DEBUG_KEX 910 fprintf(stderr, "key '%c'== ", c); 911 dump_digest("key", digest, need); 912 #endif 913 *keyp = digest; 914 digest = NULL; 915 r = 0; 916 out: 917 free(digest); 918 ssh_digest_free(hashctx); 919 return r; 920 } 921 922 #define NKEYS 6 923 int 924 kex_derive_keys(struct ssh *ssh, u_char *hash, u_int hashlen, 925 const struct sshbuf *shared_secret) 926 { 927 struct kex *kex = ssh->kex; 928 u_char *keys[NKEYS]; 929 u_int i, j, mode, ctos; 930 int r; 931 932 for (i = 0; i < NKEYS; i++) { 933 if ((r = derive_key(ssh, 'A'+i, kex->we_need, hash, hashlen, 934 shared_secret, &keys[i])) != 0) { 935 for (j = 0; j < i; j++) 936 free(keys[j]); 937 return r; 938 } 939 } 940 for (mode = 0; mode < MODE_MAX; mode++) { 941 ctos = (!kex->server && mode == MODE_OUT) || 942 (kex->server && mode == MODE_IN); 943 kex->newkeys[mode]->enc.iv = keys[ctos ? 0 : 1]; 944 kex->newkeys[mode]->enc.key = keys[ctos ? 2 : 3]; 945 kex->newkeys[mode]->mac.key = keys[ctos ? 4 : 5]; 946 } 947 return 0; 948 } 949 950 #ifdef WITH_OPENSSL 951 int 952 kex_derive_keys_bn(struct ssh *ssh, u_char *hash, u_int hashlen, 953 const BIGNUM *secret) 954 { 955 struct sshbuf *shared_secret; 956 int r; 957 958 if ((shared_secret = sshbuf_new()) == NULL) 959 return SSH_ERR_ALLOC_FAIL; 960 if ((r = sshbuf_put_bignum2(shared_secret, secret)) == 0) 961 r = kex_derive_keys(ssh, hash, hashlen, shared_secret); 962 sshbuf_free(shared_secret); 963 return r; 964 } 965 #endif 966 967 968 #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH) 969 void 970 dump_digest(char *msg, u_char *digest, int len) 971 { 972 fprintf(stderr, "%s\n", msg); 973 sshbuf_dump_data(digest, len, stderr); 974 } 975 #endif 976