blob: 449603592cc6de6aec0dafafe297f2f0a86a0a37 [file] [log] [blame]
deraadt@openbsd.org9136ec12016-09-12 01:22:38 +00001/* $OpenBSD: kexgexs.c,v 1.30 2016/09/12 01:22:38 deraadt Exp $ */
Damien Miller8e7fb332003-02-24 12:03:03 +11002/*
3 * Copyright (c) 2000 Niels Provos. All rights reserved.
4 * Copyright (c) 2001 Markus Friedl. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include "includes.h"
Damien Miller8e7fb332003-02-24 12:03:03 +110028
Damien Miller72ef7c12015-01-15 02:21:31 +110029#ifdef WITH_OPENSSL
30
Damien Miller8dbffe72006-08-05 11:02:17 +100031
Damien Millerded319c2006-09-01 15:38:36 +100032#include <stdarg.h>
Damien Millera7a73ee2006-08-05 11:37:59 +100033#include <stdio.h>
Damien Millere3476ed2006-07-24 14:13:33 +100034#include <string.h>
Damien Millerd7834352006-08-05 12:39:39 +100035#include <signal.h>
Damien Millere3476ed2006-07-24 14:13:33 +100036
Damien Miller4499f4c2010-11-20 15:15:49 +110037#include <openssl/dh.h>
38
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000039#include "sshkey.h"
Damien Millerd7834352006-08-05 12:39:39 +100040#include "cipher.h"
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000041#include "digest.h"
Damien Miller8e7fb332003-02-24 12:03:03 +110042#include "kex.h"
43#include "log.h"
44#include "packet.h"
45#include "dh.h"
46#include "ssh2.h"
47#include "compat.h"
Damien Millerd7834352006-08-05 12:39:39 +100048#ifdef GSSAPI
49#include "ssh-gss.h"
50#endif
Damien Miller8e7fb332003-02-24 12:03:03 +110051#include "monitor_wrap.h"
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000052#include "dispatch.h"
53#include "ssherr.h"
54#include "sshbuf.h"
deraadt@openbsd.org9136ec12016-09-12 01:22:38 +000055#include "misc.h"
Damien Miller8e7fb332003-02-24 12:03:03 +110056
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000057static int input_kex_dh_gex_request(int, u_int32_t, void *);
58static int input_kex_dh_gex_init(int, u_int32_t, void *);
59
60int
61kexgex_server(struct ssh *ssh)
Damien Miller8e7fb332003-02-24 12:03:03 +110062{
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000063 ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_REQUEST,
64 &input_kex_dh_gex_request);
65 debug("expecting SSH2_MSG_KEX_DH_GEX_REQUEST");
66 return 0;
67}
Damien Miller8e7fb332003-02-24 12:03:03 +110068
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000069static int
70input_kex_dh_gex_request(int type, u_int32_t seq, void *ctxt)
71{
72 struct ssh *ssh = ctxt;
73 struct kex *kex = ssh->kex;
74 int r;
75 u_int min = 0, max = 0, nbits = 0;
Damien Miller8e7fb332003-02-24 12:03:03 +110076
djm@openbsd.org318be282015-04-13 02:04:08 +000077 debug("SSH2_MSG_KEX_DH_GEX_REQUEST received");
78 if ((r = sshpkt_get_u32(ssh, &min)) != 0 ||
79 (r = sshpkt_get_u32(ssh, &nbits)) != 0 ||
80 (r = sshpkt_get_u32(ssh, &max)) != 0 ||
81 (r = sshpkt_get_end(ssh)) != 0)
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000082 goto out;
djm@openbsd.org318be282015-04-13 02:04:08 +000083 kex->nbits = nbits;
84 kex->min = min;
85 kex->max = max;
deraadt@openbsd.org9136ec12016-09-12 01:22:38 +000086 min = MAXIMUM(DH_GRP_MIN, min);
87 max = MINIMUM(DH_GRP_MAX, max);
88 nbits = MAXIMUM(DH_GRP_MIN, nbits);
89 nbits = MINIMUM(DH_GRP_MAX, nbits);
dtucker@openbsd.org68777fa2016-06-08 02:13:01 +000090
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000091 if (kex->max < kex->min || kex->nbits < kex->min ||
dtucker@openbsd.org68777fa2016-06-08 02:13:01 +000092 kex->max < kex->nbits || kex->max < DH_GRP_MIN) {
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000093 r = SSH_ERR_DH_GEX_OUT_OF_RANGE;
94 goto out;
95 }
Damien Miller8e7fb332003-02-24 12:03:03 +110096
97 /* Contact privileged parent */
dtucker@openbsd.org68777fa2016-06-08 02:13:01 +000098 kex->dh = PRIVSEP(choose_dh(min, nbits, max));
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000099 if (kex->dh == NULL) {
dtucker@openbsd.org68777fa2016-06-08 02:13:01 +0000100 sshpkt_disconnect(ssh, "no matching DH grp found");
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000101 r = SSH_ERR_ALLOC_FAIL;
102 goto out;
103 }
Damien Miller8e7fb332003-02-24 12:03:03 +1100104 debug("SSH2_MSG_KEX_DH_GEX_GROUP sent");
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000105 if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_GROUP)) != 0 ||
106 (r = sshpkt_put_bignum2(ssh, kex->dh->p)) != 0 ||
107 (r = sshpkt_put_bignum2(ssh, kex->dh->g)) != 0 ||
108 (r = sshpkt_send(ssh)) != 0)
109 goto out;
Damien Miller8e7fb332003-02-24 12:03:03 +1100110
111 /* Compute our exchange value in parallel with the client */
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000112 if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
113 goto out;
114
Damien Miller8e7fb332003-02-24 12:03:03 +1100115 debug("expecting SSH2_MSG_KEX_DH_GEX_INIT");
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000116 ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_INIT, &input_kex_dh_gex_init);
117 r = 0;
118 out:
119 return r;
120}
121
122static int
123input_kex_dh_gex_init(int type, u_int32_t seq, void *ctxt)
124{
125 struct ssh *ssh = ctxt;
126 struct kex *kex = ssh->kex;
127 BIGNUM *shared_secret = NULL, *dh_client_pub = NULL;
128 struct sshkey *server_host_public, *server_host_private;
129 u_char *kbuf = NULL, *signature = NULL, *server_host_key_blob = NULL;
130 u_char hash[SSH_DIGEST_MAX_LENGTH];
131 size_t sbloblen, slen;
132 size_t klen = 0, hashlen;
133 int kout, r;
134
135 if (kex->load_host_public_key == NULL ||
136 kex->load_host_private_key == NULL) {
137 r = SSH_ERR_INVALID_ARGUMENT;
138 goto out;
139 }
djm@openbsd.org5104db72015-01-26 06:10:03 +0000140 server_host_public = kex->load_host_public_key(kex->hostkey_type,
141 kex->hostkey_nid, ssh);
142 server_host_private = kex->load_host_private_key(kex->hostkey_type,
143 kex->hostkey_nid, ssh);
djm@openbsd.orge2cc6be2015-01-20 07:55:33 +0000144 if (server_host_public == NULL) {
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000145 r = SSH_ERR_NO_HOSTKEY_LOADED;
146 goto out;
147 }
Damien Miller8e7fb332003-02-24 12:03:03 +1100148
149 /* key, cert */
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000150 if ((dh_client_pub = BN_new()) == NULL) {
151 r = SSH_ERR_ALLOC_FAIL;
152 goto out;
153 }
154 if ((r = sshpkt_get_bignum2(ssh, dh_client_pub)) != 0 ||
155 (r = sshpkt_get_end(ssh)) != 0)
156 goto out;
Damien Miller8e7fb332003-02-24 12:03:03 +1100157
158#ifdef DEBUG_KEXDH
159 fprintf(stderr, "dh_client_pub= ");
160 BN_print_fp(stderr, dh_client_pub);
161 fprintf(stderr, "\n");
162 debug("bits %d", BN_num_bits(dh_client_pub));
163#endif
164
165#ifdef DEBUG_KEXDH
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000166 DHparams_print_fp(stderr, kex->dh);
Damien Miller8e7fb332003-02-24 12:03:03 +1100167 fprintf(stderr, "pub= ");
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000168 BN_print_fp(stderr, kex->dh->pub_key);
Damien Miller8e7fb332003-02-24 12:03:03 +1100169 fprintf(stderr, "\n");
170#endif
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000171 if (!dh_pub_is_valid(kex->dh, dh_client_pub)) {
172 sshpkt_disconnect(ssh, "bad client public DH value");
173 r = SSH_ERR_MESSAGE_INCOMPLETE;
174 goto out;
175 }
Damien Miller8e7fb332003-02-24 12:03:03 +1100176
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000177 klen = DH_size(kex->dh);
178 if ((kbuf = malloc(klen)) == NULL ||
179 (shared_secret = BN_new()) == NULL) {
180 r = SSH_ERR_ALLOC_FAIL;
181 goto out;
182 }
183 if ((kout = DH_compute_key(kbuf, dh_client_pub, kex->dh)) < 0 ||
184 BN_bin2bn(kbuf, kout, shared_secret) == NULL) {
185 r = SSH_ERR_LIBCRYPTO_ERROR;
186 goto out;
187 }
Damien Miller8e7fb332003-02-24 12:03:03 +1100188#ifdef DEBUG_KEXDH
189 dump_digest("shared secret", kbuf, kout);
190#endif
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000191 if ((r = sshkey_to_blob(server_host_public, &server_host_key_blob,
192 &sbloblen)) != 0)
193 goto out;
Damien Miller19bb3a52005-11-05 15:19:35 +1100194 /* calc H */
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000195 hashlen = sizeof(hash);
196 if ((r = kexgex_hash(
Damien Millerb3051d02014-01-10 10:58:53 +1100197 kex->hash_alg,
Damien Miller8e7fb332003-02-24 12:03:03 +1100198 kex->client_version_string,
199 kex->server_version_string,
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000200 sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
201 sshbuf_ptr(kex->my), sshbuf_len(kex->my),
Damien Miller8e7fb332003-02-24 12:03:03 +1100202 server_host_key_blob, sbloblen,
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000203 kex->min, kex->nbits, kex->max,
204 kex->dh->p, kex->dh->g,
Damien Miller8e7fb332003-02-24 12:03:03 +1100205 dh_client_pub,
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000206 kex->dh->pub_key,
Damien Miller19bb3a52005-11-05 15:19:35 +1100207 shared_secret,
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000208 hash, &hashlen)) != 0)
209 goto out;
Damien Miller8e7fb332003-02-24 12:03:03 +1100210
211 /* save session id := H */
Damien Miller8e7fb332003-02-24 12:03:03 +1100212 if (kex->session_id == NULL) {
Damien Miller19bb3a52005-11-05 15:19:35 +1100213 kex->session_id_len = hashlen;
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000214 kex->session_id = malloc(kex->session_id_len);
215 if (kex->session_id == NULL) {
216 r = SSH_ERR_ALLOC_FAIL;
217 goto out;
218 }
Damien Miller8e7fb332003-02-24 12:03:03 +1100219 memcpy(kex->session_id, hash, kex->session_id_len);
220 }
221
222 /* sign H */
markus@openbsd.org76c9fbb2015-12-04 16:41:28 +0000223 if ((r = kex->sign(server_host_private, server_host_public, &signature,
224 &slen, hash, hashlen, kex->hostkey_alg, ssh->compat)) < 0)
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000225 goto out;
Damien Miller8e7fb332003-02-24 12:03:03 +1100226
227 /* destroy_sensitive_data(); */
228
229 /* send server hostkey, DH pubkey 'f' and singed H */
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000230 if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_REPLY)) != 0 ||
231 (r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 ||
232 (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 || /* f */
233 (r = sshpkt_put_string(ssh, signature, slen)) != 0 ||
234 (r = sshpkt_send(ssh)) != 0)
235 goto out;
Damien Miller8e7fb332003-02-24 12:03:03 +1100236
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000237 if ((r = kex_derive_keys_bn(ssh, hash, hashlen, shared_secret)) == 0)
238 r = kex_send_newkeys(ssh);
239 out:
240 DH_free(kex->dh);
241 kex->dh = NULL;
242 if (dh_client_pub)
243 BN_clear_free(dh_client_pub);
244 if (kbuf) {
245 explicit_bzero(kbuf, klen);
246 free(kbuf);
247 }
248 if (shared_secret)
249 BN_clear_free(shared_secret);
Darren Tuckera627d422013-06-02 07:31:17 +1000250 free(server_host_key_blob);
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000251 free(signature);
252 return r;
Damien Miller8e7fb332003-02-24 12:03:03 +1100253}
Damien Miller72ef7c12015-01-15 02:21:31 +1100254#endif /* WITH_OPENSSL */