blob: b2223c5ffa0fb5f31e5a05b5c18777de706fb6da [file] [log] [blame]
Darren Tucker82a3d2b2007-02-19 22:10:25 +11001/* $OpenBSD: kex.c,v 1.77 2007/01/21 01:41:54 stevesk Exp $ */
Damien Millera664e872000-04-16 11:52:47 +10002/*
Ben Lindstrom44697232001-07-04 03:32:30 +00003 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
Damien Millera664e872000-04-16 11:52:47 +10004 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
Damien Millera664e872000-04-16 11:52:47 +100013 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#include "includes.h"
Damien Millera664e872000-04-16 11:52:47 +100027
Damien Miller8dbffe72006-08-05 11:02:17 +100028#include <sys/param.h>
29
Damien Millerd7834352006-08-05 12:39:39 +100030#include <signal.h>
Damien Millerded319c2006-09-01 15:38:36 +100031#include <stdarg.h>
Damien Millera7a73ee2006-08-05 11:37:59 +100032#include <stdio.h>
Damien Millere7a1e5c2006-08-05 11:34:19 +100033#include <stdlib.h>
Damien Millere3476ed2006-07-24 14:13:33 +100034#include <string.h>
35
Damien Millerd7834352006-08-05 12:39:39 +100036#include <openssl/crypto.h>
37
Ben Lindstrom226cfa02001-01-22 05:34:40 +000038#include "xmalloc.h"
Damien Millerd7834352006-08-05 12:39:39 +100039#include "ssh2.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000040#include "buffer.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000041#include "packet.h"
42#include "compat.h"
43#include "cipher.h"
Damien Miller0bc1bd82000-11-13 22:57:25 +110044#include "key.h"
Damien Millerd7834352006-08-05 12:39:39 +100045#include "kex.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000046#include "log.h"
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000047#include "mac.h"
Ben Lindstromb9be60a2001-03-11 01:49:19 +000048#include "match.h"
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000049#include "dispatch.h"
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000050#include "monitor.h"
Damien Millera664e872000-04-16 11:52:47 +100051
Damien Millerb1715dc2000-05-30 13:44:51 +100052#define KEX_COOKIE_LEN 16
53
Damien Millerb3092032006-03-16 18:22:18 +110054#if OPENSSL_VERSION_NUMBER >= 0x00907000L
55# if defined(HAVE_EVP_SHA256)
Damien Milleraf87af12006-03-15 13:02:28 +110056# define evp_ssh_sha256 EVP_sha256
Damien Millerb3092032006-03-16 18:22:18 +110057# else
Damien Millera63128d2006-03-15 12:08:28 +110058extern const EVP_MD *evp_ssh_sha256(void);
Damien Millerb3092032006-03-16 18:22:18 +110059# endif
Tim Rice425a6882006-03-15 20:17:05 -080060#endif
Damien Millera63128d2006-03-15 12:08:28 +110061
Ben Lindstrombba81212001-06-25 05:01:22 +000062/* prototype */
63static void kex_kexinit_finish(Kex *);
64static void kex_choose_conf(Kex *);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000065
66/* put algorithm proposal into buffer */
Ben Lindstrombba81212001-06-25 05:01:22 +000067static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000068kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
Damien Millera664e872000-04-16 11:52:47 +100069{
Damien Millereccb9de2005-06-17 12:59:34 +100070 u_int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000071
72 buffer_clear(b);
Ben Lindstrom59971722002-03-27 17:42:57 +000073 /*
74 * add a dummy cookie, the cookie will be overwritten by
75 * kex_send_kexinit(), each time a kexinit is set
76 */
77 for (i = 0; i < KEX_COOKIE_LEN; i++)
78 buffer_put_char(b, 0);
Damien Millera664e872000-04-16 11:52:47 +100079 for (i = 0; i < PROPOSAL_MAX; i++)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000080 buffer_put_cstring(b, proposal[i]);
81 buffer_put_char(b, 0); /* first_kex_packet_follows */
82 buffer_put_int(b, 0); /* uint32 reserved */
Damien Millera664e872000-04-16 11:52:47 +100083}
84
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000085/* parse buffer and return algorithm proposal */
Ben Lindstrombba81212001-06-25 05:01:22 +000086static char **
Damien Millerbabb47a2003-02-24 11:53:32 +110087kex_buf2prop(Buffer *raw, int *first_kex_follows)
Damien Millerb1715dc2000-05-30 13:44:51 +100088{
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000089 Buffer b;
Damien Millerb1715dc2000-05-30 13:44:51 +100090 int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000091 char **proposal;
Damien Millerb1715dc2000-05-30 13:44:51 +100092
Damien Miller07d86be2006-03-26 14:19:21 +110093 proposal = xcalloc(PROPOSAL_MAX, sizeof(char *));
Damien Millerb1715dc2000-05-30 13:44:51 +100094
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000095 buffer_init(&b);
96 buffer_append(&b, buffer_ptr(raw), buffer_len(raw));
Damien Millerb1715dc2000-05-30 13:44:51 +100097 /* skip cookie */
98 for (i = 0; i < KEX_COOKIE_LEN; i++)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000099 buffer_get_char(&b);
Damien Millerb1715dc2000-05-30 13:44:51 +1000100 /* extract kex init proposal strings */
101 for (i = 0; i < PROPOSAL_MAX; i++) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000102 proposal[i] = buffer_get_string(&b,NULL);
103 debug2("kex_parse_kexinit: %s", proposal[i]);
Damien Millerb1715dc2000-05-30 13:44:51 +1000104 }
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000105 /* first kex follows / reserved */
106 i = buffer_get_char(&b);
Damien Millerbabb47a2003-02-24 11:53:32 +1100107 if (first_kex_follows != NULL)
108 *first_kex_follows = i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000109 debug2("kex_parse_kexinit: first_kex_follows %d ", i);
110 i = buffer_get_int(&b);
111 debug2("kex_parse_kexinit: reserved %d ", i);
112 buffer_free(&b);
113 return proposal;
Damien Millerb1715dc2000-05-30 13:44:51 +1000114}
115
Ben Lindstrombba81212001-06-25 05:01:22 +0000116static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000117kex_prop_free(char **proposal)
Damien Millera664e872000-04-16 11:52:47 +1000118{
Damien Millereccb9de2005-06-17 12:59:34 +1000119 u_int i;
Damien Millera664e872000-04-16 11:52:47 +1000120
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000121 for (i = 0; i < PROPOSAL_MAX; i++)
122 xfree(proposal[i]);
123 xfree(proposal);
Damien Millera664e872000-04-16 11:52:47 +1000124}
125
Ben Lindstrombba81212001-06-25 05:01:22 +0000126static void
Damien Miller630d6f42002-01-22 23:17:30 +1100127kex_protocol_error(int type, u_int32_t seq, void *ctxt)
Damien Miller874d77b2000-10-14 16:23:11 +1100128{
Damien Miller630d6f42002-01-22 23:17:30 +1100129 error("Hm, kex protocol error: type %d seq %u", type, seq);
Damien Miller874d77b2000-10-14 16:23:11 +1100130}
131
Ben Lindstrombba81212001-06-25 05:01:22 +0000132static void
Damien Millerbc27d4e2002-02-13 13:54:06 +1100133kex_reset_dispatch(void)
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000134{
Damien Miller7d053392002-01-22 23:24:13 +1100135 dispatch_range(SSH2_MSG_TRANSPORT_MIN,
136 SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error);
Damien Millerbc27d4e2002-02-13 13:54:06 +1100137 dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000138}
139
140void
Ben Lindstrom238abf62001-04-04 17:52:53 +0000141kex_finish(Kex *kex)
Damien Millera664e872000-04-16 11:52:47 +1000142{
Damien Millerbc27d4e2002-02-13 13:54:06 +1100143 kex_reset_dispatch();
Ben Lindstrom238abf62001-04-04 17:52:53 +0000144
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000145 packet_start(SSH2_MSG_NEWKEYS);
146 packet_send();
147 /* packet_write_wait(); */
148 debug("SSH2_MSG_NEWKEYS sent");
Damien Millera664e872000-04-16 11:52:47 +1000149
Ben Lindstrom064496f2002-12-23 02:04:22 +0000150 debug("expecting SSH2_MSG_NEWKEYS");
Damien Millerdff50992002-01-22 23:16:32 +1100151 packet_read_expect(SSH2_MSG_NEWKEYS);
Ben Lindstrom14519082002-02-26 17:58:29 +0000152 packet_check_eom();
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000153 debug("SSH2_MSG_NEWKEYS received");
Ben Lindstrom5ba23b32001-04-05 02:05:21 +0000154
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000155 kex->done = 1;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000156 buffer_clear(&kex->peer);
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000157 /* buffer_clear(&kex->my); */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000158 kex->flags &= ~KEX_INIT_SENT;
Ben Lindstrom5ba23b32001-04-05 02:05:21 +0000159 xfree(kex->name);
160 kex->name = NULL;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000161}
Damien Millera664e872000-04-16 11:52:47 +1000162
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000163void
164kex_send_kexinit(Kex *kex)
165{
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000166 u_int32_t rnd = 0;
Ben Lindstrom59971722002-03-27 17:42:57 +0000167 u_char *cookie;
Damien Millereccb9de2005-06-17 12:59:34 +1000168 u_int i;
Ben Lindstrom59971722002-03-27 17:42:57 +0000169
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000170 if (kex == NULL) {
171 error("kex_send_kexinit: no kex, cannot rekey");
172 return;
173 }
Ben Lindstrom238abf62001-04-04 17:52:53 +0000174 if (kex->flags & KEX_INIT_SENT) {
175 debug("KEX_INIT_SENT");
176 return;
177 }
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000178 kex->done = 0;
Ben Lindstrom59971722002-03-27 17:42:57 +0000179
180 /* generate a random cookie */
181 if (buffer_len(&kex->my) < KEX_COOKIE_LEN)
182 fatal("kex_send_kexinit: kex proposal too short");
183 cookie = buffer_ptr(&kex->my);
184 for (i = 0; i < KEX_COOKIE_LEN; i++) {
185 if (i % 4 == 0)
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000186 rnd = arc4random();
187 cookie[i] = rnd;
188 rnd >>= 8;
Ben Lindstrom59971722002-03-27 17:42:57 +0000189 }
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000190 packet_start(SSH2_MSG_KEXINIT);
191 packet_put_raw(buffer_ptr(&kex->my), buffer_len(&kex->my));
192 packet_send();
193 debug("SSH2_MSG_KEXINIT sent");
194 kex->flags |= KEX_INIT_SENT;
195}
196
197void
Damien Miller630d6f42002-01-22 23:17:30 +1100198kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000199{
200 char *ptr;
Damien Millereccb9de2005-06-17 12:59:34 +1000201 u_int i, dlen;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000202 Kex *kex = (Kex *)ctxt;
203
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000204 debug("SSH2_MSG_KEXINIT received");
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000205 if (kex == NULL)
206 fatal("kex_input_kexinit: no kex, cannot rekey");
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000207
208 ptr = packet_get_raw(&dlen);
209 buffer_append(&kex->peer, ptr, dlen);
210
Ben Lindstrom8e312f32001-04-04 23:50:21 +0000211 /* discard packet */
212 for (i = 0; i < KEX_COOKIE_LEN; i++)
213 packet_get_char();
214 for (i = 0; i < PROPOSAL_MAX; i++)
215 xfree(packet_get_string(NULL));
Ben Lindstromc5a7f4f2002-06-25 23:19:13 +0000216 (void) packet_get_char();
217 (void) packet_get_int();
Damien Miller48b03fc2002-01-22 23:11:40 +1100218 packet_check_eom();
Ben Lindstrom8e312f32001-04-04 23:50:21 +0000219
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000220 kex_kexinit_finish(kex);
221}
222
223Kex *
Ben Lindstrom238abf62001-04-04 17:52:53 +0000224kex_setup(char *proposal[PROPOSAL_MAX])
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000225{
226 Kex *kex;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000227
Damien Miller07d86be2006-03-26 14:19:21 +1100228 kex = xcalloc(1, sizeof(*kex));
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000229 buffer_init(&kex->peer);
230 buffer_init(&kex->my);
231 kex_prop2buf(&kex->my, proposal);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000232 kex->done = 0;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000233
234 kex_send_kexinit(kex); /* we start */
Damien Millerbc27d4e2002-02-13 13:54:06 +1100235 kex_reset_dispatch();
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000236
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000237 return kex;
238}
239
Ben Lindstrombba81212001-06-25 05:01:22 +0000240static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000241kex_kexinit_finish(Kex *kex)
242{
243 if (!(kex->flags & KEX_INIT_SENT))
244 kex_send_kexinit(kex);
245
246 kex_choose_conf(kex);
247
Damien Miller8e7fb332003-02-24 12:03:03 +1100248 if (kex->kex_type >= 0 && kex->kex_type < KEX_MAX &&
249 kex->kex[kex->kex_type] != NULL) {
250 (kex->kex[kex->kex_type])(kex);
251 } else {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000252 fatal("Unsupported key exchange %d", kex->kex_type);
Damien Millera664e872000-04-16 11:52:47 +1000253 }
Damien Millera664e872000-04-16 11:52:47 +1000254}
255
Ben Lindstrombba81212001-06-25 05:01:22 +0000256static void
Damien Millera664e872000-04-16 11:52:47 +1000257choose_enc(Enc *enc, char *client, char *server)
258{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000259 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000260 if (name == NULL)
261 fatal("no matching cipher found: client %s server %s", client, server);
Damien Miller963f6b22002-02-19 15:21:23 +1100262 if ((enc->cipher = cipher_by_name(name)) == NULL)
Damien Miller874d77b2000-10-14 16:23:11 +1100263 fatal("matching cipher is not supported: %s", name);
Damien Millera664e872000-04-16 11:52:47 +1000264 enc->name = name;
265 enc->enabled = 0;
266 enc->iv = NULL;
267 enc->key = NULL;
Damien Miller963f6b22002-02-19 15:21:23 +1100268 enc->key_len = cipher_keylen(enc->cipher);
269 enc->block_size = cipher_blocksize(enc->cipher);
Damien Millera664e872000-04-16 11:52:47 +1000270}
Damien Miller4f7becb2006-03-26 14:10:14 +1100271
Ben Lindstrombba81212001-06-25 05:01:22 +0000272static void
Damien Millera664e872000-04-16 11:52:47 +1000273choose_mac(Mac *mac, char *client, char *server)
274{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000275 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000276 if (name == NULL)
277 fatal("no matching mac found: client %s server %s", client, server);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000278 if (mac_init(mac, name) < 0)
Damien Millera664e872000-04-16 11:52:47 +1000279 fatal("unsupported mac %s", name);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000280 /* truncate the key */
281 if (datafellows & SSH_BUG_HMAC)
282 mac->key_len = 16;
Damien Millera664e872000-04-16 11:52:47 +1000283 mac->name = name;
Damien Millera664e872000-04-16 11:52:47 +1000284 mac->key = NULL;
285 mac->enabled = 0;
286}
Damien Miller4f7becb2006-03-26 14:10:14 +1100287
Ben Lindstrombba81212001-06-25 05:01:22 +0000288static void
Damien Millera664e872000-04-16 11:52:47 +1000289choose_comp(Comp *comp, char *client, char *server)
290{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000291 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000292 if (name == NULL)
293 fatal("no matching comp found: client %s server %s", client, server);
Damien Miller9786e6e2005-07-26 21:54:56 +1000294 if (strcmp(name, "zlib@openssh.com") == 0) {
295 comp->type = COMP_DELAYED;
296 } else if (strcmp(name, "zlib") == 0) {
297 comp->type = COMP_ZLIB;
Damien Millera664e872000-04-16 11:52:47 +1000298 } else if (strcmp(name, "none") == 0) {
Damien Miller9786e6e2005-07-26 21:54:56 +1000299 comp->type = COMP_NONE;
Damien Millera664e872000-04-16 11:52:47 +1000300 } else {
301 fatal("unsupported comp %s", name);
302 }
303 comp->name = name;
304}
Damien Miller4f7becb2006-03-26 14:10:14 +1100305
Ben Lindstrombba81212001-06-25 05:01:22 +0000306static void
Damien Millera664e872000-04-16 11:52:47 +1000307choose_kex(Kex *k, char *client, char *server)
308{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000309 k->name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000310 if (k->name == NULL)
311 fatal("no kex alg");
Damien Miller874d77b2000-10-14 16:23:11 +1100312 if (strcmp(k->name, KEX_DH1) == 0) {
Damien Miller8e7fb332003-02-24 12:03:03 +1100313 k->kex_type = KEX_DH_GRP1_SHA1;
Damien Miller19bb3a52005-11-05 15:19:35 +1100314 k->evp_md = EVP_sha1();
Damien Millerf675fc42004-06-15 10:30:09 +1000315 } else if (strcmp(k->name, KEX_DH14) == 0) {
316 k->kex_type = KEX_DH_GRP14_SHA1;
Damien Miller19bb3a52005-11-05 15:19:35 +1100317 k->evp_md = EVP_sha1();
318 } else if (strcmp(k->name, KEX_DHGEX_SHA1) == 0) {
Damien Miller8e7fb332003-02-24 12:03:03 +1100319 k->kex_type = KEX_DH_GEX_SHA1;
Damien Miller19bb3a52005-11-05 15:19:35 +1100320 k->evp_md = EVP_sha1();
Damien Millerb3092032006-03-16 18:22:18 +1100321#if OPENSSL_VERSION_NUMBER >= 0x00907000L
Damien Millera63128d2006-03-15 12:08:28 +1100322 } else if (strcmp(k->name, KEX_DHGEX_SHA256) == 0) {
323 k->kex_type = KEX_DH_GEX_SHA256;
324 k->evp_md = evp_ssh_sha256();
Damien Millerb3092032006-03-16 18:22:18 +1100325#endif
Damien Miller874d77b2000-10-14 16:23:11 +1100326 } else
Damien Millera664e872000-04-16 11:52:47 +1000327 fatal("bad kex alg %s", k->name);
328}
Damien Miller19bb3a52005-11-05 15:19:35 +1100329
Ben Lindstrombba81212001-06-25 05:01:22 +0000330static void
Damien Millera664e872000-04-16 11:52:47 +1000331choose_hostkeyalg(Kex *k, char *client, char *server)
332{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000333 char *hostkeyalg = match_list(client, server, NULL);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100334 if (hostkeyalg == NULL)
Damien Millera664e872000-04-16 11:52:47 +1000335 fatal("no hostkey alg");
Damien Miller0bc1bd82000-11-13 22:57:25 +1100336 k->hostkey_type = key_type_from_name(hostkeyalg);
337 if (k->hostkey_type == KEY_UNSPEC)
338 fatal("bad hostkey alg '%s'", hostkeyalg);
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000339 xfree(hostkeyalg);
Damien Millera664e872000-04-16 11:52:47 +1000340}
341
Damien Millera8e06ce2003-11-21 23:48:55 +1100342static int
Damien Millerbabb47a2003-02-24 11:53:32 +1100343proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX])
344{
345 static int check[] = {
346 PROPOSAL_KEX_ALGS, PROPOSAL_SERVER_HOST_KEY_ALGS, -1
347 };
348 int *idx;
349 char *p;
350
351 for (idx = &check[0]; *idx != -1; idx++) {
352 if ((p = strchr(my[*idx], ',')) != NULL)
353 *p = '\0';
354 if ((p = strchr(peer[*idx], ',')) != NULL)
355 *p = '\0';
356 if (strcmp(my[*idx], peer[*idx]) != 0) {
357 debug2("proposal mismatch: my %s peer %s",
358 my[*idx], peer[*idx]);
359 return (0);
360 }
361 }
362 debug2("proposals match");
363 return (1);
364}
365
Ben Lindstrombba81212001-06-25 05:01:22 +0000366static void
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000367kex_choose_conf(Kex *kex)
Damien Millera664e872000-04-16 11:52:47 +1000368{
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000369 Newkeys *newkeys;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000370 char **my, **peer;
371 char **cprop, **sprop;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000372 int nenc, nmac, ncomp;
Damien Millereccb9de2005-06-17 12:59:34 +1000373 u_int mode, ctos, need;
Damien Millerbabb47a2003-02-24 11:53:32 +1100374 int first_kex_follows, type;
Damien Millera664e872000-04-16 11:52:47 +1000375
Damien Millerbabb47a2003-02-24 11:53:32 +1100376 my = kex_buf2prop(&kex->my, NULL);
377 peer = kex_buf2prop(&kex->peer, &first_kex_follows);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000378
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000379 if (kex->server) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000380 cprop=peer;
381 sprop=my;
382 } else {
383 cprop=my;
384 sprop=peer;
385 }
Damien Millera664e872000-04-16 11:52:47 +1000386
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000387 /* Algorithm Negotiation */
Damien Millera664e872000-04-16 11:52:47 +1000388 for (mode = 0; mode < MODE_MAX; mode++) {
Damien Miller07d86be2006-03-26 14:19:21 +1100389 newkeys = xcalloc(1, sizeof(*newkeys));
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000390 kex->newkeys[mode] = newkeys;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000391 ctos = (!kex->server && mode == MODE_OUT) || (kex->server && mode == MODE_IN);
Damien Millera664e872000-04-16 11:52:47 +1000392 nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC;
393 nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC;
394 ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000395 choose_enc (&newkeys->enc, cprop[nenc], sprop[nenc]);
396 choose_mac (&newkeys->mac, cprop[nmac], sprop[nmac]);
397 choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
Damien Millera664e872000-04-16 11:52:47 +1000398 debug("kex: %s %s %s %s",
399 ctos ? "client->server" : "server->client",
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000400 newkeys->enc.name,
401 newkeys->mac.name,
402 newkeys->comp.name);
Damien Millera664e872000-04-16 11:52:47 +1000403 }
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000404 choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
405 choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
Damien Millera664e872000-04-16 11:52:47 +1000406 sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
Damien Millera664e872000-04-16 11:52:47 +1000407 need = 0;
408 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000409 newkeys = kex->newkeys[mode];
Damien Miller963f6b22002-02-19 15:21:23 +1100410 if (need < newkeys->enc.key_len)
411 need = newkeys->enc.key_len;
412 if (need < newkeys->enc.block_size)
413 need = newkeys->enc.block_size;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000414 if (need < newkeys->mac.key_len)
415 need = newkeys->mac.key_len;
Damien Millera664e872000-04-16 11:52:47 +1000416 }
Damien Millerb1715dc2000-05-30 13:44:51 +1000417 /* XXX need runden? */
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000418 kex->we_need = need;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000419
Damien Millerbabb47a2003-02-24 11:53:32 +1100420 /* ignore the next message if the proposals do not match */
Damien Millera8e06ce2003-11-21 23:48:55 +1100421 if (first_kex_follows && !proposals_match(my, peer) &&
Damien Miller0dc1bef2005-07-17 17:22:45 +1000422 !(datafellows & SSH_BUG_FIRSTKEX)) {
Damien Millerbabb47a2003-02-24 11:53:32 +1100423 type = packet_read();
424 debug2("skipping next packet (type %u)", type);
425 }
426
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000427 kex_prop_free(my);
428 kex_prop_free(peer);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000429}
430
Ben Lindstrombba81212001-06-25 05:01:22 +0000431static u_char *
Damien Miller19bb3a52005-11-05 15:19:35 +1100432derive_key(Kex *kex, int id, u_int need, u_char *hash, u_int hashlen,
433 BIGNUM *shared_secret)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000434{
435 Buffer b;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000436 EVP_MD_CTX md;
437 char c = id;
Damien Millereccb9de2005-06-17 12:59:34 +1000438 u_int have;
Damien Miller19bb3a52005-11-05 15:19:35 +1100439 int mdsz;
Damien Millereccb9de2005-06-17 12:59:34 +1000440 u_char *digest;
Damien Miller46d38de2005-07-17 17:02:09 +1000441
Damien Miller19bb3a52005-11-05 15:19:35 +1100442 if ((mdsz = EVP_MD_size(kex->evp_md)) <= 0)
443 fatal("bad kex md size %d", mdsz);
Damien Millerc91e5562006-03-26 13:58:55 +1100444 digest = xmalloc(roundup(need, mdsz));
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000445
446 buffer_init(&b);
447 buffer_put_bignum2(&b, shared_secret);
448
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000449 /* K1 = HASH(K || H || "A" || session_id) */
Damien Miller19bb3a52005-11-05 15:19:35 +1100450 EVP_DigestInit(&md, kex->evp_md);
Ben Lindstrom8c963922001-04-30 23:06:57 +0000451 if (!(datafellows & SSH_BUG_DERIVEKEY))
452 EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
Damien Miller19bb3a52005-11-05 15:19:35 +1100453 EVP_DigestUpdate(&md, hash, hashlen);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000454 EVP_DigestUpdate(&md, &c, 1);
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000455 EVP_DigestUpdate(&md, kex->session_id, kex->session_id_len);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000456 EVP_DigestFinal(&md, digest, NULL);
457
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000458 /*
459 * expand key:
460 * Kn = HASH(K || H || K1 || K2 || ... || Kn-1)
461 * Key = K1 || K2 || ... || Kn
462 */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000463 for (have = mdsz; need > have; have += mdsz) {
Damien Miller19bb3a52005-11-05 15:19:35 +1100464 EVP_DigestInit(&md, kex->evp_md);
Ben Lindstrom8c963922001-04-30 23:06:57 +0000465 if (!(datafellows & SSH_BUG_DERIVEKEY))
466 EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
Damien Miller19bb3a52005-11-05 15:19:35 +1100467 EVP_DigestUpdate(&md, hash, hashlen);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000468 EVP_DigestUpdate(&md, digest, have);
469 EVP_DigestFinal(&md, digest + have, NULL);
470 }
471 buffer_free(&b);
472#ifdef DEBUG_KEX
473 fprintf(stderr, "key '%c'== ", c);
474 dump_digest("key", digest, need);
475#endif
476 return digest;
Damien Millera664e872000-04-16 11:52:47 +1000477}
478
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000479Newkeys *current_keys[MODE_MAX];
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000480
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000481#define NKEYS 6
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000482void
Damien Miller19bb3a52005-11-05 15:19:35 +1100483kex_derive_keys(Kex *kex, u_char *hash, u_int hashlen, BIGNUM *shared_secret)
Damien Millera664e872000-04-16 11:52:47 +1000484{
Ben Lindstrom46c16222000-12-22 01:43:59 +0000485 u_char *keys[NKEYS];
Damien Millereccb9de2005-06-17 12:59:34 +1000486 u_int i, mode, ctos;
Damien Millera664e872000-04-16 11:52:47 +1000487
Damien Miller19bb3a52005-11-05 15:19:35 +1100488 for (i = 0; i < NKEYS; i++) {
489 keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, hashlen,
490 shared_secret);
491 }
Damien Millera664e872000-04-16 11:52:47 +1000492
Ben Lindstrom064496f2002-12-23 02:04:22 +0000493 debug2("kex_derive_keys");
Damien Millera664e872000-04-16 11:52:47 +1000494 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000495 current_keys[mode] = kex->newkeys[mode];
496 kex->newkeys[mode] = NULL;
Damien Miller4f7becb2006-03-26 14:10:14 +1100497 ctos = (!kex->server && mode == MODE_OUT) ||
498 (kex->server && mode == MODE_IN);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000499 current_keys[mode]->enc.iv = keys[ctos ? 0 : 1];
500 current_keys[mode]->enc.key = keys[ctos ? 2 : 3];
501 current_keys[mode]->mac.key = keys[ctos ? 4 : 5];
Damien Millera664e872000-04-16 11:52:47 +1000502 }
Damien Millera664e872000-04-16 11:52:47 +1000503}
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000504
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000505Newkeys *
506kex_get_newkeys(int mode)
507{
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000508 Newkeys *ret;
509
510 ret = current_keys[mode];
511 current_keys[mode] = NULL;
512 return ret;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000513}
514
Darren Tuckere14e0052004-05-13 16:30:44 +1000515void
516derive_ssh1_session_id(BIGNUM *host_modulus, BIGNUM *server_modulus,
517 u_int8_t cookie[8], u_int8_t id[16])
518{
519 const EVP_MD *evp_md = EVP_md5();
520 EVP_MD_CTX md;
521 u_int8_t nbuf[2048], obuf[EVP_MAX_MD_SIZE];
522 int len;
523
524 EVP_DigestInit(&md, evp_md);
525
526 len = BN_num_bytes(host_modulus);
Damien Millereccb9de2005-06-17 12:59:34 +1000527 if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
Darren Tuckere14e0052004-05-13 16:30:44 +1000528 fatal("%s: bad host modulus (len %d)", __func__, len);
529 BN_bn2bin(host_modulus, nbuf);
530 EVP_DigestUpdate(&md, nbuf, len);
531
532 len = BN_num_bytes(server_modulus);
Damien Millereccb9de2005-06-17 12:59:34 +1000533 if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
Darren Tuckere14e0052004-05-13 16:30:44 +1000534 fatal("%s: bad server modulus (len %d)", __func__, len);
535 BN_bn2bin(server_modulus, nbuf);
536 EVP_DigestUpdate(&md, nbuf, len);
537
538 EVP_DigestUpdate(&md, cookie, 8);
539
Darren Tuckerb42714e2004-05-13 16:31:48 +1000540 EVP_DigestFinal(&md, obuf, NULL);
Darren Tuckere14e0052004-05-13 16:30:44 +1000541 memcpy(id, obuf, 16);
542
543 memset(nbuf, 0, sizeof(nbuf));
544 memset(obuf, 0, sizeof(obuf));
545 memset(&md, 0, sizeof(md));
546}
547
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000548#if defined(DEBUG_KEX) || defined(DEBUG_KEXDH)
549void
550dump_digest(char *msg, u_char *digest, int len)
551{
Damien Millereccb9de2005-06-17 12:59:34 +1000552 u_int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000553
554 fprintf(stderr, "%s\n", msg);
Darren Tucker82a3d2b2007-02-19 22:10:25 +1100555 for (i = 0; i < len; i++) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000556 fprintf(stderr, "%02x", digest[i]);
557 if (i%32 == 31)
558 fprintf(stderr, "\n");
559 else if (i%8 == 7)
560 fprintf(stderr, " ");
561 }
562 fprintf(stderr, "\n");
563}
564#endif