external/openssh: update to 6.8p1.

In preparation for some updates to external/openssh to make it work with
BoringSSL, this change updates the code to a recent version. The current
version (5.9p1) is coming up on four years old now.

  * Confirmed that f5c67b478bef9992de9e9ec91ce10af4f6205e0d matches
    OpenSSH 5.9p1 exactly (save for the removal of the scard
    subdirectory).

  * Downloaded openssh-6.8p1.tar.gz (SHA256:
    3ff64ce73ee124480b5bf767b9830d7d3c03bbcb6abe716b78f0192c37ce160e)
    and verified with PGP signature. (I've verified Damien's key in
    person previously.)

  * Applied changes between f5c67b478bef9992de9e9ec91ce10af4f6205e0d and
    OpenSSH 5.9p1 to 6.8p1 and updated the build as best I can. The
    ugliest change is probably the duplication of umac.c to umac128.c
    because Android conditionally compiles that file twice. See the
    comment in those files.

Change-Id: I63cb07a8118afb5a377f116087a0882914cea486
diff --git a/kex.h b/kex.h
index 7373d3c..f70b81f 100644
--- a/kex.h
+++ b/kex.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.h,v 1.52 2010/09/22 05:01:29 djm Exp $ */
+/* $OpenBSD: kex.h,v 1.71 2015/02/16 22:13:32 djm Exp $ */
 
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
@@ -26,13 +26,28 @@
 #ifndef KEX_H
 #define KEX_H
 
-#include <signal.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#ifdef OPENSSL_HAS_ECC
-#include <openssl/ec.h>
+#include "mac.h"
+#include "buffer.h" /* XXX for typedef */
+#include "key.h" /* XXX for typedef */
+
+#ifdef WITH_LEAKMALLOC
+#include "leakmalloc.h"
 #endif
 
+#ifdef WITH_OPENSSL
+# ifdef OPENSSL_HAS_ECC
+#  include <openssl/ec.h>
+# else /* OPENSSL_HAS_ECC */
+#  define EC_KEY	void
+#  define EC_GROUP	void
+#  define EC_POINT	void
+# endif /* OPENSSL_HAS_ECC */
+#else /* WITH_OPENSSL */
+# define EC_KEY		void
+# define EC_GROUP	void
+# define EC_POINT	void
+#endif /* WITH_OPENSSL */
+
 #define KEX_COOKIE_LEN	16
 
 #define	KEX_DH1			"diffie-hellman-group1-sha1"
@@ -40,13 +55,17 @@
 #define	KEX_DHGEX_SHA1		"diffie-hellman-group-exchange-sha1"
 #define	KEX_DHGEX_SHA256	"diffie-hellman-group-exchange-sha256"
 #define	KEX_RESUME		"resume@appgate.com"
-/* The following represents the family of ECDH methods */
-#define	KEX_ECDH_SHA2_STEM	"ecdh-sha2-"
+#define	KEX_ECDH_SHA2_NISTP256	"ecdh-sha2-nistp256"
+#define	KEX_ECDH_SHA2_NISTP384	"ecdh-sha2-nistp384"
+#define	KEX_ECDH_SHA2_NISTP521	"ecdh-sha2-nistp521"
+#define	KEX_CURVE25519_SHA256	"curve25519-sha256@libssh.org"
 
 #define COMP_NONE	0
 #define COMP_ZLIB	1
 #define COMP_DELAYED	2
 
+#define CURVE25519_SIZE 32
+
 enum kex_init_proposals {
 	PROPOSAL_KEX_ALGS,
 	PROPOSAL_SERVER_HOST_KEY_ALGS,
@@ -73,113 +92,136 @@
 	KEX_DH_GEX_SHA1,
 	KEX_DH_GEX_SHA256,
 	KEX_ECDH_SHA2,
+	KEX_C25519_SHA256,
 	KEX_MAX
 };
 
 #define KEX_INIT_SENT	0x0001
 
-typedef struct Kex Kex;
-typedef struct Mac Mac;
-typedef struct Comp Comp;
-typedef struct Enc Enc;
-typedef struct Newkeys Newkeys;
-
-struct Enc {
+struct sshenc {
 	char	*name;
-	Cipher	*cipher;
+	const struct sshcipher *cipher;
 	int	enabled;
 	u_int	key_len;
+	u_int	iv_len;
 	u_int	block_size;
 	u_char	*key;
 	u_char	*iv;
 };
-struct Mac {
-	char	*name;
-	int	enabled;
-	u_int	mac_len;
-	u_char	*key;
-	u_int	key_len;
-	int	type;
-	const EVP_MD	*evp_md;
-	HMAC_CTX	evp_ctx;
-	struct umac_ctx *umac_ctx;
-};
-struct Comp {
-	int	type;
+struct sshcomp {
+	u_int	type;
 	int	enabled;
 	char	*name;
 };
-struct Newkeys {
-	Enc	enc;
-	Mac	mac;
-	Comp	comp;
+struct newkeys {
+	struct sshenc	enc;
+	struct sshmac	mac;
+	struct sshcomp  comp;
 };
-struct Kex {
+
+struct ssh;
+
+struct kex {
 	u_char	*session_id;
-	u_int	session_id_len;
-	Newkeys	*newkeys[MODE_MAX];
+	size_t	session_id_len;
+	struct newkeys	*newkeys[MODE_MAX];
 	u_int	we_need;
+	u_int	dh_need;
 	int	server;
 	char	*name;
 	int	hostkey_type;
-	int	kex_type;
+	int	hostkey_nid;
+	u_int	kex_type;
 	int	roaming;
-	Buffer	my;
-	Buffer	peer;
+	struct sshbuf *my;
+	struct sshbuf *peer;
 	sig_atomic_t done;
-	int	flags;
-	const EVP_MD *evp_md;
+	u_int	flags;
+	int	hash_alg;
+	int	ec_nid;
 	char	*client_version_string;
 	char	*server_version_string;
-	int	(*verify_host_key)(Key *);
-	Key	*(*load_host_public_key)(int);
-	Key	*(*load_host_private_key)(int);
-	int	(*host_key_index)(Key *);
-	void	(*kex[KEX_MAX])(Kex *);
+	int	(*verify_host_key)(struct sshkey *, struct ssh *);
+	struct sshkey *(*load_host_public_key)(int, int, struct ssh *);
+	struct sshkey *(*load_host_private_key)(int, int, struct ssh *);
+	int	(*host_key_index)(struct sshkey *, int, struct ssh *);
+	int	(*sign)(struct sshkey *, struct sshkey *,
+	    u_char **, size_t *, const u_char *, size_t, u_int);
+	int	(*kex[KEX_MAX])(struct ssh *);
+	/* kex specific state */
+	DH	*dh;			/* DH */
+	u_int	min, max, nbits;	/* GEX */
+	EC_KEY	*ec_client_key;		/* ECDH */
+	const EC_GROUP *ec_group;	/* ECDH */
+	u_char c25519_client_key[CURVE25519_SIZE]; /* 25519 */
+	u_char c25519_client_pubkey[CURVE25519_SIZE]; /* 25519 */
 };
 
 int	 kex_names_valid(const char *);
+char	*kex_alg_list(char);
 
-Kex	*kex_setup(char *[PROPOSAL_MAX]);
-void	 kex_finish(Kex *);
+int	 kex_new(struct ssh *, char *[PROPOSAL_MAX], struct kex **);
+int	 kex_setup(struct ssh *, char *[PROPOSAL_MAX]);
+void	 kex_free_newkeys(struct newkeys *);
+void	 kex_free(struct kex *);
 
-void	 kex_send_kexinit(Kex *);
-void	 kex_input_kexinit(int, u_int32_t, void *);
-void	 kex_derive_keys(Kex *, u_char *, u_int, BIGNUM *);
+int	 kex_buf2prop(struct sshbuf *, int *, char ***);
+int	 kex_prop2buf(struct sshbuf *, char *proposal[PROPOSAL_MAX]);
+void	 kex_prop_free(char **);
 
-Newkeys *kex_get_newkeys(int);
+int	 kex_send_kexinit(struct ssh *);
+int	 kex_input_kexinit(int, u_int32_t, void *);
+int	 kex_derive_keys(struct ssh *, u_char *, u_int, const struct sshbuf *);
+int	 kex_derive_keys_bn(struct ssh *, u_char *, u_int, const BIGNUM *);
+int	 kex_send_newkeys(struct ssh *);
 
-void	 kexdh_client(Kex *);
-void	 kexdh_server(Kex *);
-void	 kexgex_client(Kex *);
-void	 kexgex_server(Kex *);
-void	 kexecdh_client(Kex *);
-void	 kexecdh_server(Kex *);
+int	 kexdh_client(struct ssh *);
+int	 kexdh_server(struct ssh *);
+int	 kexgex_client(struct ssh *);
+int	 kexgex_server(struct ssh *);
+int	 kexecdh_client(struct ssh *);
+int	 kexecdh_server(struct ssh *);
+int	 kexc25519_client(struct ssh *);
+int	 kexc25519_server(struct ssh *);
 
-void
-kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int,
-    BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *);
-void
-kexgex_hash(const EVP_MD *, char *, char *, char *, int, char *,
-    int, u_char *, int, int, int, int, BIGNUM *, BIGNUM *, BIGNUM *,
-    BIGNUM *, BIGNUM *, u_char **, u_int *);
-#ifdef OPENSSL_HAS_ECC
-void
-kex_ecdh_hash(const EVP_MD *, const EC_GROUP *, char *, char *, char *, int,
-    char *, int, u_char *, int, const EC_POINT *, const EC_POINT *,
-    const BIGNUM *, u_char **, u_int *);
-int	kex_ecdh_name_to_nid(const char *);
-const EVP_MD *kex_ecdh_name_to_evpmd(const char *);
-#else
-# define kex_ecdh_name_to_nid(x) (-1)
-# define kex_ecdh_name_to_evpmd(x) (NULL)
-#endif
+int	 kex_dh_hash(const char *, const char *,
+    const u_char *, size_t, const u_char *, size_t, const u_char *, size_t,
+    const BIGNUM *, const BIGNUM *, const BIGNUM *, u_char *, size_t *);
 
-void
+int	 kexgex_hash(int, const char *, const char *,
+    const u_char *, size_t, const u_char *, size_t, const u_char *, size_t,
+    int, int, int,
+    const BIGNUM *, const BIGNUM *, const BIGNUM *,
+    const BIGNUM *, const BIGNUM *,
+    u_char *, size_t *);
+
+int kex_ecdh_hash(int, const EC_GROUP *, const char *, const char *,
+    const u_char *, size_t, const u_char *, size_t, const u_char *, size_t,
+    const EC_POINT *, const EC_POINT *, const BIGNUM *, u_char *, size_t *);
+
+int	 kex_c25519_hash(int, const char *, const char *, const char *, size_t,
+    const char *, size_t, const u_char *, size_t, const u_char *, const u_char *,
+    const u_char *, size_t, u_char *, size_t *);
+
+void	kexc25519_keygen(u_char key[CURVE25519_SIZE], u_char pub[CURVE25519_SIZE])
+	__attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
+	__attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
+int	kexc25519_shared_key(const u_char key[CURVE25519_SIZE],
+    const u_char pub[CURVE25519_SIZE], struct sshbuf *out)
+	__attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
+	__attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
+
+int
 derive_ssh1_session_id(BIGNUM *, BIGNUM *, u_int8_t[8], u_int8_t[16]);
 
 #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
 void	dump_digest(char *, u_char *, int);
 #endif
 
+#if !defined(WITH_OPENSSL) || !defined(OPENSSL_HAS_ECC)
+# undef EC_KEY
+# undef EC_GROUP
+# undef EC_POINT
+#endif
+
 #endif