blob: a668346c393411efac7a27978ff029e4a194bb83 [file] [log] [blame]
Damien Millera664e872000-04-16 11:52:47 +10001/*
Ben Lindstrom44697232001-07-04 03:32:30 +00002 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
Damien Millera664e872000-04-16 11:52:47 +10003 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
Damien Millera664e872000-04-16 11:52:47 +100012 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24
25#include "includes.h"
Darren Tucker3f9fdc72004-06-22 12:56:01 +100026RCSID("$OpenBSD: kex.c,v 1.60 2004/06/21 17:36:31 avsm Exp $");
Damien Millera664e872000-04-16 11:52:47 +100027
28#include <openssl/crypto.h>
Damien Millera664e872000-04-16 11:52:47 +100029
Ben Lindstrom226cfa02001-01-22 05:34:40 +000030#include "ssh2.h"
31#include "xmalloc.h"
32#include "buffer.h"
33#include "bufaux.h"
34#include "packet.h"
35#include "compat.h"
36#include "cipher.h"
Damien Millera664e872000-04-16 11:52:47 +100037#include "kex.h"
Damien Miller0bc1bd82000-11-13 22:57:25 +110038#include "key.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000039#include "log.h"
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000040#include "mac.h"
Ben Lindstromb9be60a2001-03-11 01:49:19 +000041#include "match.h"
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000042#include "dispatch.h"
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000043#include "monitor.h"
Damien Millera664e872000-04-16 11:52:47 +100044
Damien Millerb1715dc2000-05-30 13:44:51 +100045#define KEX_COOKIE_LEN 16
46
Ben Lindstrombba81212001-06-25 05:01:22 +000047/* prototype */
48static void kex_kexinit_finish(Kex *);
49static void kex_choose_conf(Kex *);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000050
51/* put algorithm proposal into buffer */
Ben Lindstrombba81212001-06-25 05:01:22 +000052static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000053kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
Damien Millera664e872000-04-16 11:52:47 +100054{
Damien Millera664e872000-04-16 11:52:47 +100055 int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000056
57 buffer_clear(b);
Ben Lindstrom59971722002-03-27 17:42:57 +000058 /*
59 * add a dummy cookie, the cookie will be overwritten by
60 * kex_send_kexinit(), each time a kexinit is set
61 */
62 for (i = 0; i < KEX_COOKIE_LEN; i++)
63 buffer_put_char(b, 0);
Damien Millera664e872000-04-16 11:52:47 +100064 for (i = 0; i < PROPOSAL_MAX; i++)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000065 buffer_put_cstring(b, proposal[i]);
66 buffer_put_char(b, 0); /* first_kex_packet_follows */
67 buffer_put_int(b, 0); /* uint32 reserved */
Damien Millera664e872000-04-16 11:52:47 +100068}
69
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000070/* parse buffer and return algorithm proposal */
Ben Lindstrombba81212001-06-25 05:01:22 +000071static char **
Damien Millerbabb47a2003-02-24 11:53:32 +110072kex_buf2prop(Buffer *raw, int *first_kex_follows)
Damien Millerb1715dc2000-05-30 13:44:51 +100073{
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000074 Buffer b;
Damien Millerb1715dc2000-05-30 13:44:51 +100075 int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000076 char **proposal;
Damien Millerb1715dc2000-05-30 13:44:51 +100077
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000078 proposal = xmalloc(PROPOSAL_MAX * sizeof(char *));
Damien Millerb1715dc2000-05-30 13:44:51 +100079
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000080 buffer_init(&b);
81 buffer_append(&b, buffer_ptr(raw), buffer_len(raw));
Damien Millerb1715dc2000-05-30 13:44:51 +100082 /* skip cookie */
83 for (i = 0; i < KEX_COOKIE_LEN; i++)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000084 buffer_get_char(&b);
Damien Millerb1715dc2000-05-30 13:44:51 +100085 /* extract kex init proposal strings */
86 for (i = 0; i < PROPOSAL_MAX; i++) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000087 proposal[i] = buffer_get_string(&b,NULL);
88 debug2("kex_parse_kexinit: %s", proposal[i]);
Damien Millerb1715dc2000-05-30 13:44:51 +100089 }
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000090 /* first kex follows / reserved */
91 i = buffer_get_char(&b);
Damien Millerbabb47a2003-02-24 11:53:32 +110092 if (first_kex_follows != NULL)
93 *first_kex_follows = i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000094 debug2("kex_parse_kexinit: first_kex_follows %d ", i);
95 i = buffer_get_int(&b);
96 debug2("kex_parse_kexinit: reserved %d ", i);
97 buffer_free(&b);
98 return proposal;
Damien Millerb1715dc2000-05-30 13:44:51 +100099}
100
Ben Lindstrombba81212001-06-25 05:01:22 +0000101static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000102kex_prop_free(char **proposal)
Damien Millera664e872000-04-16 11:52:47 +1000103{
104 int i;
Damien Millera664e872000-04-16 11:52:47 +1000105
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000106 for (i = 0; i < PROPOSAL_MAX; i++)
107 xfree(proposal[i]);
108 xfree(proposal);
Damien Millera664e872000-04-16 11:52:47 +1000109}
110
Ben Lindstrombba81212001-06-25 05:01:22 +0000111static void
Damien Miller630d6f42002-01-22 23:17:30 +1100112kex_protocol_error(int type, u_int32_t seq, void *ctxt)
Damien Miller874d77b2000-10-14 16:23:11 +1100113{
Damien Miller630d6f42002-01-22 23:17:30 +1100114 error("Hm, kex protocol error: type %d seq %u", type, seq);
Damien Miller874d77b2000-10-14 16:23:11 +1100115}
116
Ben Lindstrombba81212001-06-25 05:01:22 +0000117static void
Damien Millerbc27d4e2002-02-13 13:54:06 +1100118kex_reset_dispatch(void)
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000119{
Damien Miller7d053392002-01-22 23:24:13 +1100120 dispatch_range(SSH2_MSG_TRANSPORT_MIN,
121 SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error);
Damien Millerbc27d4e2002-02-13 13:54:06 +1100122 dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000123}
124
125void
Ben Lindstrom238abf62001-04-04 17:52:53 +0000126kex_finish(Kex *kex)
Damien Millera664e872000-04-16 11:52:47 +1000127{
Damien Millerbc27d4e2002-02-13 13:54:06 +1100128 kex_reset_dispatch();
Ben Lindstrom238abf62001-04-04 17:52:53 +0000129
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000130 packet_start(SSH2_MSG_NEWKEYS);
131 packet_send();
132 /* packet_write_wait(); */
133 debug("SSH2_MSG_NEWKEYS sent");
Damien Millera664e872000-04-16 11:52:47 +1000134
Ben Lindstrom064496f2002-12-23 02:04:22 +0000135 debug("expecting SSH2_MSG_NEWKEYS");
Damien Millerdff50992002-01-22 23:16:32 +1100136 packet_read_expect(SSH2_MSG_NEWKEYS);
Ben Lindstrom14519082002-02-26 17:58:29 +0000137 packet_check_eom();
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000138 debug("SSH2_MSG_NEWKEYS received");
Ben Lindstrom5ba23b32001-04-05 02:05:21 +0000139
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000140 kex->done = 1;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000141 buffer_clear(&kex->peer);
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000142 /* buffer_clear(&kex->my); */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000143 kex->flags &= ~KEX_INIT_SENT;
Ben Lindstrom5ba23b32001-04-05 02:05:21 +0000144 xfree(kex->name);
145 kex->name = NULL;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000146}
Damien Millera664e872000-04-16 11:52:47 +1000147
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000148void
149kex_send_kexinit(Kex *kex)
150{
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000151 u_int32_t rnd = 0;
Ben Lindstrom59971722002-03-27 17:42:57 +0000152 u_char *cookie;
153 int i;
154
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000155 if (kex == NULL) {
156 error("kex_send_kexinit: no kex, cannot rekey");
157 return;
158 }
Ben Lindstrom238abf62001-04-04 17:52:53 +0000159 if (kex->flags & KEX_INIT_SENT) {
160 debug("KEX_INIT_SENT");
161 return;
162 }
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000163 kex->done = 0;
Ben Lindstrom59971722002-03-27 17:42:57 +0000164
165 /* generate a random cookie */
166 if (buffer_len(&kex->my) < KEX_COOKIE_LEN)
167 fatal("kex_send_kexinit: kex proposal too short");
168 cookie = buffer_ptr(&kex->my);
169 for (i = 0; i < KEX_COOKIE_LEN; i++) {
170 if (i % 4 == 0)
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000171 rnd = arc4random();
172 cookie[i] = rnd;
173 rnd >>= 8;
Ben Lindstrom59971722002-03-27 17:42:57 +0000174 }
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000175 packet_start(SSH2_MSG_KEXINIT);
176 packet_put_raw(buffer_ptr(&kex->my), buffer_len(&kex->my));
177 packet_send();
178 debug("SSH2_MSG_KEXINIT sent");
179 kex->flags |= KEX_INIT_SENT;
180}
181
182void
Damien Miller630d6f42002-01-22 23:17:30 +1100183kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000184{
185 char *ptr;
186 int dlen;
Ben Lindstrom8e312f32001-04-04 23:50:21 +0000187 int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000188 Kex *kex = (Kex *)ctxt;
189
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000190 debug("SSH2_MSG_KEXINIT received");
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000191 if (kex == NULL)
192 fatal("kex_input_kexinit: no kex, cannot rekey");
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000193
194 ptr = packet_get_raw(&dlen);
195 buffer_append(&kex->peer, ptr, dlen);
196
Ben Lindstrom8e312f32001-04-04 23:50:21 +0000197 /* discard packet */
198 for (i = 0; i < KEX_COOKIE_LEN; i++)
199 packet_get_char();
200 for (i = 0; i < PROPOSAL_MAX; i++)
201 xfree(packet_get_string(NULL));
Ben Lindstromc5a7f4f2002-06-25 23:19:13 +0000202 (void) packet_get_char();
203 (void) packet_get_int();
Damien Miller48b03fc2002-01-22 23:11:40 +1100204 packet_check_eom();
Ben Lindstrom8e312f32001-04-04 23:50:21 +0000205
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000206 kex_kexinit_finish(kex);
207}
208
209Kex *
Ben Lindstrom238abf62001-04-04 17:52:53 +0000210kex_setup(char *proposal[PROPOSAL_MAX])
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000211{
212 Kex *kex;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000213
214 kex = xmalloc(sizeof(*kex));
215 memset(kex, 0, sizeof(*kex));
216 buffer_init(&kex->peer);
217 buffer_init(&kex->my);
218 kex_prop2buf(&kex->my, proposal);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000219 kex->done = 0;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000220
221 kex_send_kexinit(kex); /* we start */
Damien Millerbc27d4e2002-02-13 13:54:06 +1100222 kex_reset_dispatch();
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000223
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000224 return kex;
225}
226
Ben Lindstrombba81212001-06-25 05:01:22 +0000227static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000228kex_kexinit_finish(Kex *kex)
229{
230 if (!(kex->flags & KEX_INIT_SENT))
231 kex_send_kexinit(kex);
232
233 kex_choose_conf(kex);
234
Damien Miller8e7fb332003-02-24 12:03:03 +1100235 if (kex->kex_type >= 0 && kex->kex_type < KEX_MAX &&
236 kex->kex[kex->kex_type] != NULL) {
237 (kex->kex[kex->kex_type])(kex);
238 } else {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000239 fatal("Unsupported key exchange %d", kex->kex_type);
Damien Millera664e872000-04-16 11:52:47 +1000240 }
Damien Millera664e872000-04-16 11:52:47 +1000241}
242
Ben Lindstrombba81212001-06-25 05:01:22 +0000243static void
Damien Millera664e872000-04-16 11:52:47 +1000244choose_enc(Enc *enc, char *client, char *server)
245{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000246 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000247 if (name == NULL)
248 fatal("no matching cipher found: client %s server %s", client, server);
Damien Miller963f6b22002-02-19 15:21:23 +1100249 if ((enc->cipher = cipher_by_name(name)) == NULL)
Damien Miller874d77b2000-10-14 16:23:11 +1100250 fatal("matching cipher is not supported: %s", name);
Damien Millera664e872000-04-16 11:52:47 +1000251 enc->name = name;
252 enc->enabled = 0;
253 enc->iv = NULL;
254 enc->key = NULL;
Damien Miller963f6b22002-02-19 15:21:23 +1100255 enc->key_len = cipher_keylen(enc->cipher);
256 enc->block_size = cipher_blocksize(enc->cipher);
Damien Millera664e872000-04-16 11:52:47 +1000257}
Ben Lindstrombba81212001-06-25 05:01:22 +0000258static void
Damien Millera664e872000-04-16 11:52:47 +1000259choose_mac(Mac *mac, char *client, char *server)
260{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000261 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000262 if (name == NULL)
263 fatal("no matching mac found: client %s server %s", client, server);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000264 if (mac_init(mac, name) < 0)
Damien Millera664e872000-04-16 11:52:47 +1000265 fatal("unsupported mac %s", name);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000266 /* truncate the key */
267 if (datafellows & SSH_BUG_HMAC)
268 mac->key_len = 16;
Damien Millera664e872000-04-16 11:52:47 +1000269 mac->name = name;
Damien Millera664e872000-04-16 11:52:47 +1000270 mac->key = NULL;
271 mac->enabled = 0;
272}
Ben Lindstrombba81212001-06-25 05:01:22 +0000273static void
Damien Millera664e872000-04-16 11:52:47 +1000274choose_comp(Comp *comp, char *client, char *server)
275{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000276 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000277 if (name == NULL)
278 fatal("no matching comp found: client %s server %s", client, server);
279 if (strcmp(name, "zlib") == 0) {
280 comp->type = 1;
281 } else if (strcmp(name, "none") == 0) {
282 comp->type = 0;
283 } else {
284 fatal("unsupported comp %s", name);
285 }
286 comp->name = name;
287}
Ben Lindstrombba81212001-06-25 05:01:22 +0000288static void
Damien Millera664e872000-04-16 11:52:47 +1000289choose_kex(Kex *k, char *client, char *server)
290{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000291 k->name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000292 if (k->name == NULL)
293 fatal("no kex alg");
Damien Miller874d77b2000-10-14 16:23:11 +1100294 if (strcmp(k->name, KEX_DH1) == 0) {
Damien Miller8e7fb332003-02-24 12:03:03 +1100295 k->kex_type = KEX_DH_GRP1_SHA1;
Damien Millerf675fc42004-06-15 10:30:09 +1000296 } else if (strcmp(k->name, KEX_DH14) == 0) {
297 k->kex_type = KEX_DH_GRP14_SHA1;
Damien Miller874d77b2000-10-14 16:23:11 +1100298 } else if (strcmp(k->name, KEX_DHGEX) == 0) {
Damien Miller8e7fb332003-02-24 12:03:03 +1100299 k->kex_type = KEX_DH_GEX_SHA1;
Damien Miller874d77b2000-10-14 16:23:11 +1100300 } else
Damien Millera664e872000-04-16 11:52:47 +1000301 fatal("bad kex alg %s", k->name);
302}
Ben Lindstrombba81212001-06-25 05:01:22 +0000303static void
Damien Millera664e872000-04-16 11:52:47 +1000304choose_hostkeyalg(Kex *k, char *client, char *server)
305{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000306 char *hostkeyalg = match_list(client, server, NULL);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100307 if (hostkeyalg == NULL)
Damien Millera664e872000-04-16 11:52:47 +1000308 fatal("no hostkey alg");
Damien Miller0bc1bd82000-11-13 22:57:25 +1100309 k->hostkey_type = key_type_from_name(hostkeyalg);
310 if (k->hostkey_type == KEY_UNSPEC)
311 fatal("bad hostkey alg '%s'", hostkeyalg);
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000312 xfree(hostkeyalg);
Damien Millera664e872000-04-16 11:52:47 +1000313}
314
Damien Millera8e06ce2003-11-21 23:48:55 +1100315static int
Damien Millerbabb47a2003-02-24 11:53:32 +1100316proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX])
317{
318 static int check[] = {
319 PROPOSAL_KEX_ALGS, PROPOSAL_SERVER_HOST_KEY_ALGS, -1
320 };
321 int *idx;
322 char *p;
323
324 for (idx = &check[0]; *idx != -1; idx++) {
325 if ((p = strchr(my[*idx], ',')) != NULL)
326 *p = '\0';
327 if ((p = strchr(peer[*idx], ',')) != NULL)
328 *p = '\0';
329 if (strcmp(my[*idx], peer[*idx]) != 0) {
330 debug2("proposal mismatch: my %s peer %s",
331 my[*idx], peer[*idx]);
332 return (0);
333 }
334 }
335 debug2("proposals match");
336 return (1);
337}
338
Ben Lindstrombba81212001-06-25 05:01:22 +0000339static void
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000340kex_choose_conf(Kex *kex)
Damien Millera664e872000-04-16 11:52:47 +1000341{
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000342 Newkeys *newkeys;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000343 char **my, **peer;
344 char **cprop, **sprop;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000345 int nenc, nmac, ncomp;
Damien Millera664e872000-04-16 11:52:47 +1000346 int mode;
347 int ctos; /* direction: if true client-to-server */
348 int need;
Damien Millerbabb47a2003-02-24 11:53:32 +1100349 int first_kex_follows, type;
Damien Millera664e872000-04-16 11:52:47 +1000350
Damien Millerbabb47a2003-02-24 11:53:32 +1100351 my = kex_buf2prop(&kex->my, NULL);
352 peer = kex_buf2prop(&kex->peer, &first_kex_follows);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000353
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000354 if (kex->server) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000355 cprop=peer;
356 sprop=my;
357 } else {
358 cprop=my;
359 sprop=peer;
360 }
Damien Millera664e872000-04-16 11:52:47 +1000361
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000362 /* Algorithm Negotiation */
Damien Millera664e872000-04-16 11:52:47 +1000363 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000364 newkeys = xmalloc(sizeof(*newkeys));
365 memset(newkeys, 0, sizeof(*newkeys));
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000366 kex->newkeys[mode] = newkeys;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000367 ctos = (!kex->server && mode == MODE_OUT) || (kex->server && mode == MODE_IN);
Damien Millera664e872000-04-16 11:52:47 +1000368 nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC;
369 nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC;
370 ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000371 choose_enc (&newkeys->enc, cprop[nenc], sprop[nenc]);
372 choose_mac (&newkeys->mac, cprop[nmac], sprop[nmac]);
373 choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
Damien Millera664e872000-04-16 11:52:47 +1000374 debug("kex: %s %s %s %s",
375 ctos ? "client->server" : "server->client",
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000376 newkeys->enc.name,
377 newkeys->mac.name,
378 newkeys->comp.name);
Damien Millera664e872000-04-16 11:52:47 +1000379 }
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000380 choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
381 choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
Damien Millera664e872000-04-16 11:52:47 +1000382 sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
Damien Millera664e872000-04-16 11:52:47 +1000383 need = 0;
384 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000385 newkeys = kex->newkeys[mode];
Damien Miller963f6b22002-02-19 15:21:23 +1100386 if (need < newkeys->enc.key_len)
387 need = newkeys->enc.key_len;
388 if (need < newkeys->enc.block_size)
389 need = newkeys->enc.block_size;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000390 if (need < newkeys->mac.key_len)
391 need = newkeys->mac.key_len;
Damien Millera664e872000-04-16 11:52:47 +1000392 }
Damien Millerb1715dc2000-05-30 13:44:51 +1000393 /* XXX need runden? */
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000394 kex->we_need = need;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000395
Damien Millerbabb47a2003-02-24 11:53:32 +1100396 /* ignore the next message if the proposals do not match */
Damien Millera8e06ce2003-11-21 23:48:55 +1100397 if (first_kex_follows && !proposals_match(my, peer) &&
Damien Millerd3209042003-04-01 21:44:37 +1000398 !(datafellows & SSH_BUG_FIRSTKEX)) {
Damien Millerbabb47a2003-02-24 11:53:32 +1100399 type = packet_read();
400 debug2("skipping next packet (type %u)", type);
401 }
402
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000403 kex_prop_free(my);
404 kex_prop_free(peer);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000405}
406
Ben Lindstrombba81212001-06-25 05:01:22 +0000407static u_char *
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000408derive_key(Kex *kex, int id, int need, u_char *hash, BIGNUM *shared_secret)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000409{
410 Buffer b;
Ben Lindstrom80cb27d2002-03-05 01:33:36 +0000411 const EVP_MD *evp_md = EVP_sha1();
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000412 EVP_MD_CTX md;
413 char c = id;
414 int have;
Damien Miller3672e4b2002-02-05 11:54:07 +1100415 int mdsz = EVP_MD_size(evp_md);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000416 u_char *digest = xmalloc(roundup(need, mdsz));
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000417
418 buffer_init(&b);
419 buffer_put_bignum2(&b, shared_secret);
420
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000421 /* K1 = HASH(K || H || "A" || session_id) */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000422 EVP_DigestInit(&md, evp_md);
Ben Lindstrom8c963922001-04-30 23:06:57 +0000423 if (!(datafellows & SSH_BUG_DERIVEKEY))
424 EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000425 EVP_DigestUpdate(&md, hash, mdsz);
426 EVP_DigestUpdate(&md, &c, 1);
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000427 EVP_DigestUpdate(&md, kex->session_id, kex->session_id_len);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000428 EVP_DigestFinal(&md, digest, NULL);
429
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000430 /*
431 * expand key:
432 * Kn = HASH(K || H || K1 || K2 || ... || Kn-1)
433 * Key = K1 || K2 || ... || Kn
434 */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000435 for (have = mdsz; need > have; have += mdsz) {
436 EVP_DigestInit(&md, evp_md);
Ben Lindstrom8c963922001-04-30 23:06:57 +0000437 if (!(datafellows & SSH_BUG_DERIVEKEY))
438 EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000439 EVP_DigestUpdate(&md, hash, mdsz);
440 EVP_DigestUpdate(&md, digest, have);
441 EVP_DigestFinal(&md, digest + have, NULL);
442 }
443 buffer_free(&b);
444#ifdef DEBUG_KEX
445 fprintf(stderr, "key '%c'== ", c);
446 dump_digest("key", digest, need);
447#endif
448 return digest;
Damien Millera664e872000-04-16 11:52:47 +1000449}
450
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000451Newkeys *current_keys[MODE_MAX];
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000452
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000453#define NKEYS 6
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000454void
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000455kex_derive_keys(Kex *kex, u_char *hash, BIGNUM *shared_secret)
Damien Millera664e872000-04-16 11:52:47 +1000456{
Ben Lindstrom46c16222000-12-22 01:43:59 +0000457 u_char *keys[NKEYS];
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000458 int i, mode, ctos;
Damien Millera664e872000-04-16 11:52:47 +1000459
460 for (i = 0; i < NKEYS; i++)
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000461 keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, shared_secret);
Damien Millera664e872000-04-16 11:52:47 +1000462
Ben Lindstrom064496f2002-12-23 02:04:22 +0000463 debug2("kex_derive_keys");
Damien Millera664e872000-04-16 11:52:47 +1000464 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000465 current_keys[mode] = kex->newkeys[mode];
466 kex->newkeys[mode] = NULL;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000467 ctos = (!kex->server && mode == MODE_OUT) || (kex->server && mode == MODE_IN);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000468 current_keys[mode]->enc.iv = keys[ctos ? 0 : 1];
469 current_keys[mode]->enc.key = keys[ctos ? 2 : 3];
470 current_keys[mode]->mac.key = keys[ctos ? 4 : 5];
Damien Millera664e872000-04-16 11:52:47 +1000471 }
Damien Millera664e872000-04-16 11:52:47 +1000472}
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000473
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000474Newkeys *
475kex_get_newkeys(int mode)
476{
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000477 Newkeys *ret;
478
479 ret = current_keys[mode];
480 current_keys[mode] = NULL;
481 return ret;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000482}
483
Darren Tuckere14e0052004-05-13 16:30:44 +1000484void
485derive_ssh1_session_id(BIGNUM *host_modulus, BIGNUM *server_modulus,
486 u_int8_t cookie[8], u_int8_t id[16])
487{
488 const EVP_MD *evp_md = EVP_md5();
489 EVP_MD_CTX md;
490 u_int8_t nbuf[2048], obuf[EVP_MAX_MD_SIZE];
491 int len;
492
493 EVP_DigestInit(&md, evp_md);
494
495 len = BN_num_bytes(host_modulus);
496 if (len < (512 / 8) || len > sizeof(nbuf))
497 fatal("%s: bad host modulus (len %d)", __func__, len);
498 BN_bn2bin(host_modulus, nbuf);
499 EVP_DigestUpdate(&md, nbuf, len);
500
501 len = BN_num_bytes(server_modulus);
502 if (len < (512 / 8) || len > sizeof(nbuf))
503 fatal("%s: bad server modulus (len %d)", __func__, len);
504 BN_bn2bin(server_modulus, nbuf);
505 EVP_DigestUpdate(&md, nbuf, len);
506
507 EVP_DigestUpdate(&md, cookie, 8);
508
Darren Tuckerb42714e2004-05-13 16:31:48 +1000509 EVP_DigestFinal(&md, obuf, NULL);
Darren Tuckere14e0052004-05-13 16:30:44 +1000510 memcpy(id, obuf, 16);
511
512 memset(nbuf, 0, sizeof(nbuf));
513 memset(obuf, 0, sizeof(obuf));
514 memset(&md, 0, sizeof(md));
515}
516
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000517#if defined(DEBUG_KEX) || defined(DEBUG_KEXDH)
518void
519dump_digest(char *msg, u_char *digest, int len)
520{
521 int i;
522
523 fprintf(stderr, "%s\n", msg);
Ben Lindstrom1c37c6a2001-12-06 18:00:18 +0000524 for (i = 0; i< len; i++) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000525 fprintf(stderr, "%02x", digest[i]);
526 if (i%32 == 31)
527 fprintf(stderr, "\n");
528 else if (i%8 == 7)
529 fprintf(stderr, " ");
530 }
531 fprintf(stderr, "\n");
532}
533#endif