blob: 7c87631914f8dea8ffd0cac3e234a517e22f2b70 [file] [log] [blame]
Damien Miller041ab7c2010-09-10 11:23:34 +10001/* $OpenBSD: kex.c,v 1.85 2010/09/09 10:45:45 djm Exp $ */
Damien Millera664e872000-04-16 11:52:47 +10002/*
Ben Lindstrom44697232001-07-04 03:32:30 +00003 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
Damien Millera664e872000-04-16 11:52:47 +10004 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
Damien Millera664e872000-04-16 11:52:47 +100013 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#include "includes.h"
Damien Millera664e872000-04-16 11:52:47 +100027
Damien Miller8dbffe72006-08-05 11:02:17 +100028#include <sys/param.h>
29
Damien Millerd7834352006-08-05 12:39:39 +100030#include <signal.h>
Damien Millerded319c2006-09-01 15:38:36 +100031#include <stdarg.h>
Damien Millera7a73ee2006-08-05 11:37:59 +100032#include <stdio.h>
Damien Millere7a1e5c2006-08-05 11:34:19 +100033#include <stdlib.h>
Damien Millere3476ed2006-07-24 14:13:33 +100034#include <string.h>
35
Damien Millerd7834352006-08-05 12:39:39 +100036#include <openssl/crypto.h>
37
Ben Lindstrom226cfa02001-01-22 05:34:40 +000038#include "xmalloc.h"
Damien Millerd7834352006-08-05 12:39:39 +100039#include "ssh2.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000040#include "buffer.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000041#include "packet.h"
42#include "compat.h"
43#include "cipher.h"
Damien Miller0bc1bd82000-11-13 22:57:25 +110044#include "key.h"
Damien Millerd7834352006-08-05 12:39:39 +100045#include "kex.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000046#include "log.h"
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000047#include "mac.h"
Ben Lindstromb9be60a2001-03-11 01:49:19 +000048#include "match.h"
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000049#include "dispatch.h"
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000050#include "monitor.h"
Darren Tucker36331b52010-01-08 16:50:41 +110051#include "roaming.h"
Damien Millera664e872000-04-16 11:52:47 +100052
Damien Millerb3092032006-03-16 18:22:18 +110053#if OPENSSL_VERSION_NUMBER >= 0x00907000L
54# if defined(HAVE_EVP_SHA256)
Damien Milleraf87af12006-03-15 13:02:28 +110055# define evp_ssh_sha256 EVP_sha256
Damien Millerb3092032006-03-16 18:22:18 +110056# else
Damien Millera63128d2006-03-15 12:08:28 +110057extern const EVP_MD *evp_ssh_sha256(void);
Damien Millerb3092032006-03-16 18:22:18 +110058# endif
Tim Rice425a6882006-03-15 20:17:05 -080059#endif
Damien Millera63128d2006-03-15 12:08:28 +110060
Ben Lindstrombba81212001-06-25 05:01:22 +000061/* prototype */
62static void kex_kexinit_finish(Kex *);
63static void kex_choose_conf(Kex *);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000064
65/* put algorithm proposal into buffer */
Ben Lindstrombba81212001-06-25 05:01:22 +000066static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000067kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
Damien Millera664e872000-04-16 11:52:47 +100068{
Damien Millereccb9de2005-06-17 12:59:34 +100069 u_int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000070
71 buffer_clear(b);
Ben Lindstrom59971722002-03-27 17:42:57 +000072 /*
73 * add a dummy cookie, the cookie will be overwritten by
74 * kex_send_kexinit(), each time a kexinit is set
75 */
76 for (i = 0; i < KEX_COOKIE_LEN; i++)
77 buffer_put_char(b, 0);
Damien Millera664e872000-04-16 11:52:47 +100078 for (i = 0; i < PROPOSAL_MAX; i++)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000079 buffer_put_cstring(b, proposal[i]);
80 buffer_put_char(b, 0); /* first_kex_packet_follows */
81 buffer_put_int(b, 0); /* uint32 reserved */
Damien Millera664e872000-04-16 11:52:47 +100082}
83
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000084/* parse buffer and return algorithm proposal */
Ben Lindstrombba81212001-06-25 05:01:22 +000085static char **
Damien Millerbabb47a2003-02-24 11:53:32 +110086kex_buf2prop(Buffer *raw, int *first_kex_follows)
Damien Millerb1715dc2000-05-30 13:44:51 +100087{
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000088 Buffer b;
Darren Tucker0d0d1952007-06-05 18:23:28 +100089 u_int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000090 char **proposal;
Damien Millerb1715dc2000-05-30 13:44:51 +100091
Damien Miller07d86be2006-03-26 14:19:21 +110092 proposal = xcalloc(PROPOSAL_MAX, sizeof(char *));
Damien Millerb1715dc2000-05-30 13:44:51 +100093
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000094 buffer_init(&b);
95 buffer_append(&b, buffer_ptr(raw), buffer_len(raw));
Damien Millerb1715dc2000-05-30 13:44:51 +100096 /* skip cookie */
97 for (i = 0; i < KEX_COOKIE_LEN; i++)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000098 buffer_get_char(&b);
Damien Millerb1715dc2000-05-30 13:44:51 +100099 /* extract kex init proposal strings */
100 for (i = 0; i < PROPOSAL_MAX; i++) {
Damien Millerda108ec2010-08-31 22:36:39 +1000101 proposal[i] = buffer_get_cstring(&b,NULL);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000102 debug2("kex_parse_kexinit: %s", proposal[i]);
Damien Millerb1715dc2000-05-30 13:44:51 +1000103 }
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000104 /* first kex follows / reserved */
105 i = buffer_get_char(&b);
Damien Millerbabb47a2003-02-24 11:53:32 +1100106 if (first_kex_follows != NULL)
107 *first_kex_follows = i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000108 debug2("kex_parse_kexinit: first_kex_follows %d ", i);
109 i = buffer_get_int(&b);
Darren Tucker0d0d1952007-06-05 18:23:28 +1000110 debug2("kex_parse_kexinit: reserved %u ", i);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000111 buffer_free(&b);
112 return proposal;
Damien Millerb1715dc2000-05-30 13:44:51 +1000113}
114
Ben Lindstrombba81212001-06-25 05:01:22 +0000115static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000116kex_prop_free(char **proposal)
Damien Millera664e872000-04-16 11:52:47 +1000117{
Damien Millereccb9de2005-06-17 12:59:34 +1000118 u_int i;
Damien Millera664e872000-04-16 11:52:47 +1000119
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000120 for (i = 0; i < PROPOSAL_MAX; i++)
121 xfree(proposal[i]);
122 xfree(proposal);
Damien Millera664e872000-04-16 11:52:47 +1000123}
124
Darren Tucker0d0d1952007-06-05 18:23:28 +1000125/* ARGSUSED */
Ben Lindstrombba81212001-06-25 05:01:22 +0000126static void
Damien Miller630d6f42002-01-22 23:17:30 +1100127kex_protocol_error(int type, u_int32_t seq, void *ctxt)
Damien Miller874d77b2000-10-14 16:23:11 +1100128{
Damien Miller630d6f42002-01-22 23:17:30 +1100129 error("Hm, kex protocol error: type %d seq %u", type, seq);
Damien Miller874d77b2000-10-14 16:23:11 +1100130}
131
Ben Lindstrombba81212001-06-25 05:01:22 +0000132static void
Damien Millerbc27d4e2002-02-13 13:54:06 +1100133kex_reset_dispatch(void)
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000134{
Damien Miller7d053392002-01-22 23:24:13 +1100135 dispatch_range(SSH2_MSG_TRANSPORT_MIN,
136 SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error);
Damien Millerbc27d4e2002-02-13 13:54:06 +1100137 dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000138}
139
140void
Ben Lindstrom238abf62001-04-04 17:52:53 +0000141kex_finish(Kex *kex)
Damien Millera664e872000-04-16 11:52:47 +1000142{
Damien Millerbc27d4e2002-02-13 13:54:06 +1100143 kex_reset_dispatch();
Ben Lindstrom238abf62001-04-04 17:52:53 +0000144
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000145 packet_start(SSH2_MSG_NEWKEYS);
146 packet_send();
147 /* packet_write_wait(); */
148 debug("SSH2_MSG_NEWKEYS sent");
Damien Millera664e872000-04-16 11:52:47 +1000149
Ben Lindstrom064496f2002-12-23 02:04:22 +0000150 debug("expecting SSH2_MSG_NEWKEYS");
Damien Millerdff50992002-01-22 23:16:32 +1100151 packet_read_expect(SSH2_MSG_NEWKEYS);
Ben Lindstrom14519082002-02-26 17:58:29 +0000152 packet_check_eom();
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000153 debug("SSH2_MSG_NEWKEYS received");
Ben Lindstrom5ba23b32001-04-05 02:05:21 +0000154
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000155 kex->done = 1;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000156 buffer_clear(&kex->peer);
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000157 /* buffer_clear(&kex->my); */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000158 kex->flags &= ~KEX_INIT_SENT;
Ben Lindstrom5ba23b32001-04-05 02:05:21 +0000159 xfree(kex->name);
160 kex->name = NULL;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000161}
Damien Millera664e872000-04-16 11:52:47 +1000162
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000163void
164kex_send_kexinit(Kex *kex)
165{
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000166 u_int32_t rnd = 0;
Ben Lindstrom59971722002-03-27 17:42:57 +0000167 u_char *cookie;
Damien Millereccb9de2005-06-17 12:59:34 +1000168 u_int i;
Ben Lindstrom59971722002-03-27 17:42:57 +0000169
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000170 if (kex == NULL) {
171 error("kex_send_kexinit: no kex, cannot rekey");
172 return;
173 }
Ben Lindstrom238abf62001-04-04 17:52:53 +0000174 if (kex->flags & KEX_INIT_SENT) {
175 debug("KEX_INIT_SENT");
176 return;
177 }
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000178 kex->done = 0;
Ben Lindstrom59971722002-03-27 17:42:57 +0000179
180 /* generate a random cookie */
181 if (buffer_len(&kex->my) < KEX_COOKIE_LEN)
182 fatal("kex_send_kexinit: kex proposal too short");
183 cookie = buffer_ptr(&kex->my);
184 for (i = 0; i < KEX_COOKIE_LEN; i++) {
185 if (i % 4 == 0)
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000186 rnd = arc4random();
187 cookie[i] = rnd;
188 rnd >>= 8;
Ben Lindstrom59971722002-03-27 17:42:57 +0000189 }
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000190 packet_start(SSH2_MSG_KEXINIT);
191 packet_put_raw(buffer_ptr(&kex->my), buffer_len(&kex->my));
192 packet_send();
193 debug("SSH2_MSG_KEXINIT sent");
194 kex->flags |= KEX_INIT_SENT;
195}
196
Darren Tucker0d0d1952007-06-05 18:23:28 +1000197/* ARGSUSED */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000198void
Damien Miller630d6f42002-01-22 23:17:30 +1100199kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000200{
201 char *ptr;
Damien Millereccb9de2005-06-17 12:59:34 +1000202 u_int i, dlen;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000203 Kex *kex = (Kex *)ctxt;
204
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000205 debug("SSH2_MSG_KEXINIT received");
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000206 if (kex == NULL)
207 fatal("kex_input_kexinit: no kex, cannot rekey");
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000208
209 ptr = packet_get_raw(&dlen);
210 buffer_append(&kex->peer, ptr, dlen);
211
Ben Lindstrom8e312f32001-04-04 23:50:21 +0000212 /* discard packet */
213 for (i = 0; i < KEX_COOKIE_LEN; i++)
214 packet_get_char();
215 for (i = 0; i < PROPOSAL_MAX; i++)
216 xfree(packet_get_string(NULL));
Ben Lindstromc5a7f4f2002-06-25 23:19:13 +0000217 (void) packet_get_char();
218 (void) packet_get_int();
Damien Miller48b03fc2002-01-22 23:11:40 +1100219 packet_check_eom();
Ben Lindstrom8e312f32001-04-04 23:50:21 +0000220
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000221 kex_kexinit_finish(kex);
222}
223
224Kex *
Ben Lindstrom238abf62001-04-04 17:52:53 +0000225kex_setup(char *proposal[PROPOSAL_MAX])
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000226{
227 Kex *kex;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000228
Damien Miller07d86be2006-03-26 14:19:21 +1100229 kex = xcalloc(1, sizeof(*kex));
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000230 buffer_init(&kex->peer);
231 buffer_init(&kex->my);
232 kex_prop2buf(&kex->my, proposal);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000233 kex->done = 0;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000234
235 kex_send_kexinit(kex); /* we start */
Damien Millerbc27d4e2002-02-13 13:54:06 +1100236 kex_reset_dispatch();
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000237
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000238 return kex;
239}
240
Ben Lindstrombba81212001-06-25 05:01:22 +0000241static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000242kex_kexinit_finish(Kex *kex)
243{
244 if (!(kex->flags & KEX_INIT_SENT))
245 kex_send_kexinit(kex);
246
247 kex_choose_conf(kex);
248
Damien Miller8e7fb332003-02-24 12:03:03 +1100249 if (kex->kex_type >= 0 && kex->kex_type < KEX_MAX &&
250 kex->kex[kex->kex_type] != NULL) {
251 (kex->kex[kex->kex_type])(kex);
252 } else {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000253 fatal("Unsupported key exchange %d", kex->kex_type);
Damien Millera664e872000-04-16 11:52:47 +1000254 }
Damien Millera664e872000-04-16 11:52:47 +1000255}
256
Ben Lindstrombba81212001-06-25 05:01:22 +0000257static void
Damien Millera664e872000-04-16 11:52:47 +1000258choose_enc(Enc *enc, char *client, char *server)
259{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000260 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000261 if (name == NULL)
Darren Tucker0d0d1952007-06-05 18:23:28 +1000262 fatal("no matching cipher found: client %s server %s",
263 client, server);
Damien Miller963f6b22002-02-19 15:21:23 +1100264 if ((enc->cipher = cipher_by_name(name)) == NULL)
Damien Miller874d77b2000-10-14 16:23:11 +1100265 fatal("matching cipher is not supported: %s", name);
Damien Millera664e872000-04-16 11:52:47 +1000266 enc->name = name;
267 enc->enabled = 0;
268 enc->iv = NULL;
269 enc->key = NULL;
Damien Miller963f6b22002-02-19 15:21:23 +1100270 enc->key_len = cipher_keylen(enc->cipher);
271 enc->block_size = cipher_blocksize(enc->cipher);
Damien Millera664e872000-04-16 11:52:47 +1000272}
Damien Miller4f7becb2006-03-26 14:10:14 +1100273
Ben Lindstrombba81212001-06-25 05:01:22 +0000274static void
Damien Millera664e872000-04-16 11:52:47 +1000275choose_mac(Mac *mac, char *client, char *server)
276{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000277 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000278 if (name == NULL)
Darren Tucker0d0d1952007-06-05 18:23:28 +1000279 fatal("no matching mac found: client %s server %s",
280 client, server);
Darren Tucker5f3d5be2007-06-05 18:30:18 +1000281 if (mac_setup(mac, name) < 0)
Damien Millera664e872000-04-16 11:52:47 +1000282 fatal("unsupported mac %s", name);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000283 /* truncate the key */
284 if (datafellows & SSH_BUG_HMAC)
285 mac->key_len = 16;
Damien Millera664e872000-04-16 11:52:47 +1000286 mac->name = name;
Damien Millera664e872000-04-16 11:52:47 +1000287 mac->key = NULL;
288 mac->enabled = 0;
289}
Damien Miller4f7becb2006-03-26 14:10:14 +1100290
Ben Lindstrombba81212001-06-25 05:01:22 +0000291static void
Damien Millera664e872000-04-16 11:52:47 +1000292choose_comp(Comp *comp, char *client, char *server)
293{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000294 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000295 if (name == NULL)
296 fatal("no matching comp found: client %s server %s", client, server);
Damien Miller9786e6e2005-07-26 21:54:56 +1000297 if (strcmp(name, "zlib@openssh.com") == 0) {
298 comp->type = COMP_DELAYED;
299 } else if (strcmp(name, "zlib") == 0) {
300 comp->type = COMP_ZLIB;
Damien Millera664e872000-04-16 11:52:47 +1000301 } else if (strcmp(name, "none") == 0) {
Damien Miller9786e6e2005-07-26 21:54:56 +1000302 comp->type = COMP_NONE;
Damien Millera664e872000-04-16 11:52:47 +1000303 } else {
304 fatal("unsupported comp %s", name);
305 }
306 comp->name = name;
307}
Damien Miller4f7becb2006-03-26 14:10:14 +1100308
Ben Lindstrombba81212001-06-25 05:01:22 +0000309static void
Damien Millera664e872000-04-16 11:52:47 +1000310choose_kex(Kex *k, char *client, char *server)
311{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000312 k->name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000313 if (k->name == NULL)
Darren Tucker0d0d1952007-06-05 18:23:28 +1000314 fatal("Unable to negotiate a key exchange method");
Damien Miller874d77b2000-10-14 16:23:11 +1100315 if (strcmp(k->name, KEX_DH1) == 0) {
Damien Miller8e7fb332003-02-24 12:03:03 +1100316 k->kex_type = KEX_DH_GRP1_SHA1;
Damien Miller19bb3a52005-11-05 15:19:35 +1100317 k->evp_md = EVP_sha1();
Damien Millerf675fc42004-06-15 10:30:09 +1000318 } else if (strcmp(k->name, KEX_DH14) == 0) {
319 k->kex_type = KEX_DH_GRP14_SHA1;
Damien Miller19bb3a52005-11-05 15:19:35 +1100320 k->evp_md = EVP_sha1();
321 } else if (strcmp(k->name, KEX_DHGEX_SHA1) == 0) {
Damien Miller8e7fb332003-02-24 12:03:03 +1100322 k->kex_type = KEX_DH_GEX_SHA1;
Damien Miller19bb3a52005-11-05 15:19:35 +1100323 k->evp_md = EVP_sha1();
Damien Millerb3092032006-03-16 18:22:18 +1100324#if OPENSSL_VERSION_NUMBER >= 0x00907000L
Damien Millera63128d2006-03-15 12:08:28 +1100325 } else if (strcmp(k->name, KEX_DHGEX_SHA256) == 0) {
326 k->kex_type = KEX_DH_GEX_SHA256;
327 k->evp_md = evp_ssh_sha256();
Damien Miller041ab7c2010-09-10 11:23:34 +1000328 } else if (strncmp(k->name, KEX_ECDH_SHA2_STEM,
329 sizeof(KEX_ECDH_SHA2_STEM) - 1) == 0) {
330 k->kex_type = KEX_ECDH_SHA2;
331 k->evp_md = kex_ecdh_name_to_evpmd(k->name);
Damien Millerb3092032006-03-16 18:22:18 +1100332#endif
Damien Miller874d77b2000-10-14 16:23:11 +1100333 } else
Damien Millera664e872000-04-16 11:52:47 +1000334 fatal("bad kex alg %s", k->name);
335}
Damien Miller19bb3a52005-11-05 15:19:35 +1100336
Ben Lindstrombba81212001-06-25 05:01:22 +0000337static void
Damien Millera664e872000-04-16 11:52:47 +1000338choose_hostkeyalg(Kex *k, char *client, char *server)
339{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000340 char *hostkeyalg = match_list(client, server, NULL);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100341 if (hostkeyalg == NULL)
Damien Millera664e872000-04-16 11:52:47 +1000342 fatal("no hostkey alg");
Damien Miller0bc1bd82000-11-13 22:57:25 +1100343 k->hostkey_type = key_type_from_name(hostkeyalg);
344 if (k->hostkey_type == KEY_UNSPEC)
345 fatal("bad hostkey alg '%s'", hostkeyalg);
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000346 xfree(hostkeyalg);
Damien Millera664e872000-04-16 11:52:47 +1000347}
348
Damien Millera8e06ce2003-11-21 23:48:55 +1100349static int
Damien Millerbabb47a2003-02-24 11:53:32 +1100350proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX])
351{
352 static int check[] = {
353 PROPOSAL_KEX_ALGS, PROPOSAL_SERVER_HOST_KEY_ALGS, -1
354 };
355 int *idx;
356 char *p;
357
358 for (idx = &check[0]; *idx != -1; idx++) {
359 if ((p = strchr(my[*idx], ',')) != NULL)
360 *p = '\0';
361 if ((p = strchr(peer[*idx], ',')) != NULL)
362 *p = '\0';
363 if (strcmp(my[*idx], peer[*idx]) != 0) {
364 debug2("proposal mismatch: my %s peer %s",
365 my[*idx], peer[*idx]);
366 return (0);
367 }
368 }
369 debug2("proposals match");
370 return (1);
371}
372
Ben Lindstrombba81212001-06-25 05:01:22 +0000373static void
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000374kex_choose_conf(Kex *kex)
Damien Millera664e872000-04-16 11:52:47 +1000375{
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000376 Newkeys *newkeys;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000377 char **my, **peer;
378 char **cprop, **sprop;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000379 int nenc, nmac, ncomp;
Damien Millereccb9de2005-06-17 12:59:34 +1000380 u_int mode, ctos, need;
Damien Millerbabb47a2003-02-24 11:53:32 +1100381 int first_kex_follows, type;
Damien Millera664e872000-04-16 11:52:47 +1000382
Damien Millerbabb47a2003-02-24 11:53:32 +1100383 my = kex_buf2prop(&kex->my, NULL);
384 peer = kex_buf2prop(&kex->peer, &first_kex_follows);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000385
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000386 if (kex->server) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000387 cprop=peer;
388 sprop=my;
389 } else {
390 cprop=my;
391 sprop=peer;
392 }
Damien Millera664e872000-04-16 11:52:47 +1000393
Darren Tucker36331b52010-01-08 16:50:41 +1100394 /* Check whether server offers roaming */
395 if (!kex->server) {
396 char *roaming;
397 roaming = match_list(KEX_RESUME, peer[PROPOSAL_KEX_ALGS], NULL);
398 if (roaming) {
399 kex->roaming = 1;
400 xfree(roaming);
401 }
402 }
403
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000404 /* Algorithm Negotiation */
Damien Millera664e872000-04-16 11:52:47 +1000405 for (mode = 0; mode < MODE_MAX; mode++) {
Damien Miller07d86be2006-03-26 14:19:21 +1100406 newkeys = xcalloc(1, sizeof(*newkeys));
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000407 kex->newkeys[mode] = newkeys;
Darren Tucker0d0d1952007-06-05 18:23:28 +1000408 ctos = (!kex->server && mode == MODE_OUT) ||
409 (kex->server && mode == MODE_IN);
Damien Millera664e872000-04-16 11:52:47 +1000410 nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC;
411 nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC;
412 ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000413 choose_enc (&newkeys->enc, cprop[nenc], sprop[nenc]);
414 choose_mac (&newkeys->mac, cprop[nmac], sprop[nmac]);
415 choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
Damien Millera664e872000-04-16 11:52:47 +1000416 debug("kex: %s %s %s %s",
417 ctos ? "client->server" : "server->client",
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000418 newkeys->enc.name,
419 newkeys->mac.name,
420 newkeys->comp.name);
Damien Millera664e872000-04-16 11:52:47 +1000421 }
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000422 choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
423 choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
Damien Millera664e872000-04-16 11:52:47 +1000424 sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
Damien Millera664e872000-04-16 11:52:47 +1000425 need = 0;
426 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000427 newkeys = kex->newkeys[mode];
Damien Miller963f6b22002-02-19 15:21:23 +1100428 if (need < newkeys->enc.key_len)
429 need = newkeys->enc.key_len;
430 if (need < newkeys->enc.block_size)
431 need = newkeys->enc.block_size;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000432 if (need < newkeys->mac.key_len)
433 need = newkeys->mac.key_len;
Damien Millera664e872000-04-16 11:52:47 +1000434 }
Damien Millerb1715dc2000-05-30 13:44:51 +1000435 /* XXX need runden? */
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000436 kex->we_need = need;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000437
Damien Millerbabb47a2003-02-24 11:53:32 +1100438 /* ignore the next message if the proposals do not match */
Damien Millera8e06ce2003-11-21 23:48:55 +1100439 if (first_kex_follows && !proposals_match(my, peer) &&
Damien Miller0dc1bef2005-07-17 17:22:45 +1000440 !(datafellows & SSH_BUG_FIRSTKEX)) {
Damien Millerbabb47a2003-02-24 11:53:32 +1100441 type = packet_read();
442 debug2("skipping next packet (type %u)", type);
443 }
444
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000445 kex_prop_free(my);
446 kex_prop_free(peer);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000447}
448
Ben Lindstrombba81212001-06-25 05:01:22 +0000449static u_char *
Damien Miller19bb3a52005-11-05 15:19:35 +1100450derive_key(Kex *kex, int id, u_int need, u_char *hash, u_int hashlen,
451 BIGNUM *shared_secret)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000452{
453 Buffer b;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000454 EVP_MD_CTX md;
455 char c = id;
Damien Millereccb9de2005-06-17 12:59:34 +1000456 u_int have;
Damien Miller19bb3a52005-11-05 15:19:35 +1100457 int mdsz;
Damien Millereccb9de2005-06-17 12:59:34 +1000458 u_char *digest;
Damien Miller46d38de2005-07-17 17:02:09 +1000459
Damien Miller19bb3a52005-11-05 15:19:35 +1100460 if ((mdsz = EVP_MD_size(kex->evp_md)) <= 0)
461 fatal("bad kex md size %d", mdsz);
Damien Millerc91e5562006-03-26 13:58:55 +1100462 digest = xmalloc(roundup(need, mdsz));
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000463
464 buffer_init(&b);
465 buffer_put_bignum2(&b, shared_secret);
466
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000467 /* K1 = HASH(K || H || "A" || session_id) */
Damien Miller19bb3a52005-11-05 15:19:35 +1100468 EVP_DigestInit(&md, kex->evp_md);
Ben Lindstrom8c963922001-04-30 23:06:57 +0000469 if (!(datafellows & SSH_BUG_DERIVEKEY))
470 EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
Damien Miller19bb3a52005-11-05 15:19:35 +1100471 EVP_DigestUpdate(&md, hash, hashlen);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000472 EVP_DigestUpdate(&md, &c, 1);
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000473 EVP_DigestUpdate(&md, kex->session_id, kex->session_id_len);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000474 EVP_DigestFinal(&md, digest, NULL);
475
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000476 /*
477 * expand key:
478 * Kn = HASH(K || H || K1 || K2 || ... || Kn-1)
479 * Key = K1 || K2 || ... || Kn
480 */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000481 for (have = mdsz; need > have; have += mdsz) {
Damien Miller19bb3a52005-11-05 15:19:35 +1100482 EVP_DigestInit(&md, kex->evp_md);
Ben Lindstrom8c963922001-04-30 23:06:57 +0000483 if (!(datafellows & SSH_BUG_DERIVEKEY))
484 EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
Damien Miller19bb3a52005-11-05 15:19:35 +1100485 EVP_DigestUpdate(&md, hash, hashlen);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000486 EVP_DigestUpdate(&md, digest, have);
487 EVP_DigestFinal(&md, digest + have, NULL);
488 }
489 buffer_free(&b);
490#ifdef DEBUG_KEX
491 fprintf(stderr, "key '%c'== ", c);
492 dump_digest("key", digest, need);
493#endif
494 return digest;
Damien Millera664e872000-04-16 11:52:47 +1000495}
496
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000497Newkeys *current_keys[MODE_MAX];
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000498
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000499#define NKEYS 6
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000500void
Damien Miller19bb3a52005-11-05 15:19:35 +1100501kex_derive_keys(Kex *kex, u_char *hash, u_int hashlen, BIGNUM *shared_secret)
Damien Millera664e872000-04-16 11:52:47 +1000502{
Ben Lindstrom46c16222000-12-22 01:43:59 +0000503 u_char *keys[NKEYS];
Damien Millereccb9de2005-06-17 12:59:34 +1000504 u_int i, mode, ctos;
Damien Millera664e872000-04-16 11:52:47 +1000505
Damien Miller19bb3a52005-11-05 15:19:35 +1100506 for (i = 0; i < NKEYS; i++) {
507 keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, hashlen,
508 shared_secret);
509 }
Damien Millera664e872000-04-16 11:52:47 +1000510
Ben Lindstrom064496f2002-12-23 02:04:22 +0000511 debug2("kex_derive_keys");
Damien Millera664e872000-04-16 11:52:47 +1000512 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000513 current_keys[mode] = kex->newkeys[mode];
514 kex->newkeys[mode] = NULL;
Damien Miller4f7becb2006-03-26 14:10:14 +1100515 ctos = (!kex->server && mode == MODE_OUT) ||
516 (kex->server && mode == MODE_IN);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000517 current_keys[mode]->enc.iv = keys[ctos ? 0 : 1];
518 current_keys[mode]->enc.key = keys[ctos ? 2 : 3];
519 current_keys[mode]->mac.key = keys[ctos ? 4 : 5];
Damien Millera664e872000-04-16 11:52:47 +1000520 }
Damien Millera664e872000-04-16 11:52:47 +1000521}
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000522
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000523Newkeys *
524kex_get_newkeys(int mode)
525{
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000526 Newkeys *ret;
527
528 ret = current_keys[mode];
529 current_keys[mode] = NULL;
530 return ret;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000531}
532
Darren Tuckere14e0052004-05-13 16:30:44 +1000533void
534derive_ssh1_session_id(BIGNUM *host_modulus, BIGNUM *server_modulus,
535 u_int8_t cookie[8], u_int8_t id[16])
536{
537 const EVP_MD *evp_md = EVP_md5();
538 EVP_MD_CTX md;
539 u_int8_t nbuf[2048], obuf[EVP_MAX_MD_SIZE];
540 int len;
541
542 EVP_DigestInit(&md, evp_md);
543
544 len = BN_num_bytes(host_modulus);
Damien Millereccb9de2005-06-17 12:59:34 +1000545 if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
Darren Tuckere14e0052004-05-13 16:30:44 +1000546 fatal("%s: bad host modulus (len %d)", __func__, len);
547 BN_bn2bin(host_modulus, nbuf);
548 EVP_DigestUpdate(&md, nbuf, len);
549
550 len = BN_num_bytes(server_modulus);
Damien Millereccb9de2005-06-17 12:59:34 +1000551 if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
Darren Tuckere14e0052004-05-13 16:30:44 +1000552 fatal("%s: bad server modulus (len %d)", __func__, len);
553 BN_bn2bin(server_modulus, nbuf);
554 EVP_DigestUpdate(&md, nbuf, len);
555
556 EVP_DigestUpdate(&md, cookie, 8);
557
Darren Tuckerb42714e2004-05-13 16:31:48 +1000558 EVP_DigestFinal(&md, obuf, NULL);
Darren Tuckere14e0052004-05-13 16:30:44 +1000559 memcpy(id, obuf, 16);
560
561 memset(nbuf, 0, sizeof(nbuf));
562 memset(obuf, 0, sizeof(obuf));
563 memset(&md, 0, sizeof(md));
564}
565
Damien Millereb8b60e2010-08-31 22:41:14 +1000566#if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000567void
568dump_digest(char *msg, u_char *digest, int len)
569{
Damien Millereb8b60e2010-08-31 22:41:14 +1000570 int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000571
572 fprintf(stderr, "%s\n", msg);
Darren Tucker82a3d2b2007-02-19 22:10:25 +1100573 for (i = 0; i < len; i++) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000574 fprintf(stderr, "%02x", digest[i]);
575 if (i%32 == 31)
576 fprintf(stderr, "\n");
577 else if (i%8 == 7)
578 fprintf(stderr, " ");
579 }
580 fprintf(stderr, "\n");
581}
582#endif