blob: 332fadf6e20b3ed5495926abbdad3220a8a40b03 [file] [log] [blame]
Darren Tucker5f3d5be2007-06-05 18:30:18 +10001/* $OpenBSD: kex.c,v 1.79 2007/06/05 06:52:37 djm Exp $ */
Damien Millera664e872000-04-16 11:52:47 +10002/*
Ben Lindstrom44697232001-07-04 03:32:30 +00003 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
Damien Millera664e872000-04-16 11:52:47 +10004 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
Damien Millera664e872000-04-16 11:52:47 +100013 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#include "includes.h"
Damien Millera664e872000-04-16 11:52:47 +100027
Damien Miller8dbffe72006-08-05 11:02:17 +100028#include <sys/param.h>
29
Damien Millerd7834352006-08-05 12:39:39 +100030#include <signal.h>
Damien Millerded319c2006-09-01 15:38:36 +100031#include <stdarg.h>
Damien Millera7a73ee2006-08-05 11:37:59 +100032#include <stdio.h>
Damien Millere7a1e5c2006-08-05 11:34:19 +100033#include <stdlib.h>
Damien Millere3476ed2006-07-24 14:13:33 +100034#include <string.h>
35
Damien Millerd7834352006-08-05 12:39:39 +100036#include <openssl/crypto.h>
37
Ben Lindstrom226cfa02001-01-22 05:34:40 +000038#include "xmalloc.h"
Damien Millerd7834352006-08-05 12:39:39 +100039#include "ssh2.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000040#include "buffer.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000041#include "packet.h"
42#include "compat.h"
43#include "cipher.h"
Damien Miller0bc1bd82000-11-13 22:57:25 +110044#include "key.h"
Damien Millerd7834352006-08-05 12:39:39 +100045#include "kex.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000046#include "log.h"
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000047#include "mac.h"
Ben Lindstromb9be60a2001-03-11 01:49:19 +000048#include "match.h"
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000049#include "dispatch.h"
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000050#include "monitor.h"
Damien Millera664e872000-04-16 11:52:47 +100051
Damien Millerb1715dc2000-05-30 13:44:51 +100052#define KEX_COOKIE_LEN 16
53
Damien Millerb3092032006-03-16 18:22:18 +110054#if OPENSSL_VERSION_NUMBER >= 0x00907000L
55# if defined(HAVE_EVP_SHA256)
Damien Milleraf87af12006-03-15 13:02:28 +110056# define evp_ssh_sha256 EVP_sha256
Damien Millerb3092032006-03-16 18:22:18 +110057# else
Damien Millera63128d2006-03-15 12:08:28 +110058extern const EVP_MD *evp_ssh_sha256(void);
Damien Millerb3092032006-03-16 18:22:18 +110059# endif
Tim Rice425a6882006-03-15 20:17:05 -080060#endif
Damien Millera63128d2006-03-15 12:08:28 +110061
Ben Lindstrombba81212001-06-25 05:01:22 +000062/* prototype */
63static void kex_kexinit_finish(Kex *);
64static void kex_choose_conf(Kex *);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000065
66/* put algorithm proposal into buffer */
Ben Lindstrombba81212001-06-25 05:01:22 +000067static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000068kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
Damien Millera664e872000-04-16 11:52:47 +100069{
Damien Millereccb9de2005-06-17 12:59:34 +100070 u_int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000071
72 buffer_clear(b);
Ben Lindstrom59971722002-03-27 17:42:57 +000073 /*
74 * add a dummy cookie, the cookie will be overwritten by
75 * kex_send_kexinit(), each time a kexinit is set
76 */
77 for (i = 0; i < KEX_COOKIE_LEN; i++)
78 buffer_put_char(b, 0);
Damien Millera664e872000-04-16 11:52:47 +100079 for (i = 0; i < PROPOSAL_MAX; i++)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000080 buffer_put_cstring(b, proposal[i]);
81 buffer_put_char(b, 0); /* first_kex_packet_follows */
82 buffer_put_int(b, 0); /* uint32 reserved */
Damien Millera664e872000-04-16 11:52:47 +100083}
84
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000085/* parse buffer and return algorithm proposal */
Ben Lindstrombba81212001-06-25 05:01:22 +000086static char **
Damien Millerbabb47a2003-02-24 11:53:32 +110087kex_buf2prop(Buffer *raw, int *first_kex_follows)
Damien Millerb1715dc2000-05-30 13:44:51 +100088{
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000089 Buffer b;
Darren Tucker0d0d1952007-06-05 18:23:28 +100090 u_int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000091 char **proposal;
Damien Millerb1715dc2000-05-30 13:44:51 +100092
Damien Miller07d86be2006-03-26 14:19:21 +110093 proposal = xcalloc(PROPOSAL_MAX, sizeof(char *));
Damien Millerb1715dc2000-05-30 13:44:51 +100094
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000095 buffer_init(&b);
96 buffer_append(&b, buffer_ptr(raw), buffer_len(raw));
Damien Millerb1715dc2000-05-30 13:44:51 +100097 /* skip cookie */
98 for (i = 0; i < KEX_COOKIE_LEN; i++)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000099 buffer_get_char(&b);
Damien Millerb1715dc2000-05-30 13:44:51 +1000100 /* extract kex init proposal strings */
101 for (i = 0; i < PROPOSAL_MAX; i++) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000102 proposal[i] = buffer_get_string(&b,NULL);
103 debug2("kex_parse_kexinit: %s", proposal[i]);
Damien Millerb1715dc2000-05-30 13:44:51 +1000104 }
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000105 /* first kex follows / reserved */
106 i = buffer_get_char(&b);
Damien Millerbabb47a2003-02-24 11:53:32 +1100107 if (first_kex_follows != NULL)
108 *first_kex_follows = i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000109 debug2("kex_parse_kexinit: first_kex_follows %d ", i);
110 i = buffer_get_int(&b);
Darren Tucker0d0d1952007-06-05 18:23:28 +1000111 debug2("kex_parse_kexinit: reserved %u ", i);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000112 buffer_free(&b);
113 return proposal;
Damien Millerb1715dc2000-05-30 13:44:51 +1000114}
115
Ben Lindstrombba81212001-06-25 05:01:22 +0000116static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000117kex_prop_free(char **proposal)
Damien Millera664e872000-04-16 11:52:47 +1000118{
Damien Millereccb9de2005-06-17 12:59:34 +1000119 u_int i;
Damien Millera664e872000-04-16 11:52:47 +1000120
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000121 for (i = 0; i < PROPOSAL_MAX; i++)
122 xfree(proposal[i]);
123 xfree(proposal);
Damien Millera664e872000-04-16 11:52:47 +1000124}
125
Darren Tucker0d0d1952007-06-05 18:23:28 +1000126/* ARGSUSED */
Ben Lindstrombba81212001-06-25 05:01:22 +0000127static void
Damien Miller630d6f42002-01-22 23:17:30 +1100128kex_protocol_error(int type, u_int32_t seq, void *ctxt)
Damien Miller874d77b2000-10-14 16:23:11 +1100129{
Damien Miller630d6f42002-01-22 23:17:30 +1100130 error("Hm, kex protocol error: type %d seq %u", type, seq);
Damien Miller874d77b2000-10-14 16:23:11 +1100131}
132
Ben Lindstrombba81212001-06-25 05:01:22 +0000133static void
Damien Millerbc27d4e2002-02-13 13:54:06 +1100134kex_reset_dispatch(void)
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000135{
Damien Miller7d053392002-01-22 23:24:13 +1100136 dispatch_range(SSH2_MSG_TRANSPORT_MIN,
137 SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error);
Damien Millerbc27d4e2002-02-13 13:54:06 +1100138 dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000139}
140
141void
Ben Lindstrom238abf62001-04-04 17:52:53 +0000142kex_finish(Kex *kex)
Damien Millera664e872000-04-16 11:52:47 +1000143{
Damien Millerbc27d4e2002-02-13 13:54:06 +1100144 kex_reset_dispatch();
Ben Lindstrom238abf62001-04-04 17:52:53 +0000145
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000146 packet_start(SSH2_MSG_NEWKEYS);
147 packet_send();
148 /* packet_write_wait(); */
149 debug("SSH2_MSG_NEWKEYS sent");
Damien Millera664e872000-04-16 11:52:47 +1000150
Ben Lindstrom064496f2002-12-23 02:04:22 +0000151 debug("expecting SSH2_MSG_NEWKEYS");
Damien Millerdff50992002-01-22 23:16:32 +1100152 packet_read_expect(SSH2_MSG_NEWKEYS);
Ben Lindstrom14519082002-02-26 17:58:29 +0000153 packet_check_eom();
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000154 debug("SSH2_MSG_NEWKEYS received");
Ben Lindstrom5ba23b32001-04-05 02:05:21 +0000155
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000156 kex->done = 1;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000157 buffer_clear(&kex->peer);
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000158 /* buffer_clear(&kex->my); */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000159 kex->flags &= ~KEX_INIT_SENT;
Ben Lindstrom5ba23b32001-04-05 02:05:21 +0000160 xfree(kex->name);
161 kex->name = NULL;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000162}
Damien Millera664e872000-04-16 11:52:47 +1000163
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000164void
165kex_send_kexinit(Kex *kex)
166{
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000167 u_int32_t rnd = 0;
Ben Lindstrom59971722002-03-27 17:42:57 +0000168 u_char *cookie;
Damien Millereccb9de2005-06-17 12:59:34 +1000169 u_int i;
Ben Lindstrom59971722002-03-27 17:42:57 +0000170
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000171 if (kex == NULL) {
172 error("kex_send_kexinit: no kex, cannot rekey");
173 return;
174 }
Ben Lindstrom238abf62001-04-04 17:52:53 +0000175 if (kex->flags & KEX_INIT_SENT) {
176 debug("KEX_INIT_SENT");
177 return;
178 }
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000179 kex->done = 0;
Ben Lindstrom59971722002-03-27 17:42:57 +0000180
181 /* generate a random cookie */
182 if (buffer_len(&kex->my) < KEX_COOKIE_LEN)
183 fatal("kex_send_kexinit: kex proposal too short");
184 cookie = buffer_ptr(&kex->my);
185 for (i = 0; i < KEX_COOKIE_LEN; i++) {
186 if (i % 4 == 0)
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000187 rnd = arc4random();
188 cookie[i] = rnd;
189 rnd >>= 8;
Ben Lindstrom59971722002-03-27 17:42:57 +0000190 }
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000191 packet_start(SSH2_MSG_KEXINIT);
192 packet_put_raw(buffer_ptr(&kex->my), buffer_len(&kex->my));
193 packet_send();
194 debug("SSH2_MSG_KEXINIT sent");
195 kex->flags |= KEX_INIT_SENT;
196}
197
Darren Tucker0d0d1952007-06-05 18:23:28 +1000198/* ARGSUSED */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000199void
Damien Miller630d6f42002-01-22 23:17:30 +1100200kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000201{
202 char *ptr;
Damien Millereccb9de2005-06-17 12:59:34 +1000203 u_int i, dlen;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000204 Kex *kex = (Kex *)ctxt;
205
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000206 debug("SSH2_MSG_KEXINIT received");
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000207 if (kex == NULL)
208 fatal("kex_input_kexinit: no kex, cannot rekey");
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000209
210 ptr = packet_get_raw(&dlen);
211 buffer_append(&kex->peer, ptr, dlen);
212
Ben Lindstrom8e312f32001-04-04 23:50:21 +0000213 /* discard packet */
214 for (i = 0; i < KEX_COOKIE_LEN; i++)
215 packet_get_char();
216 for (i = 0; i < PROPOSAL_MAX; i++)
217 xfree(packet_get_string(NULL));
Ben Lindstromc5a7f4f2002-06-25 23:19:13 +0000218 (void) packet_get_char();
219 (void) packet_get_int();
Damien Miller48b03fc2002-01-22 23:11:40 +1100220 packet_check_eom();
Ben Lindstrom8e312f32001-04-04 23:50:21 +0000221
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000222 kex_kexinit_finish(kex);
223}
224
225Kex *
Ben Lindstrom238abf62001-04-04 17:52:53 +0000226kex_setup(char *proposal[PROPOSAL_MAX])
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000227{
228 Kex *kex;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000229
Damien Miller07d86be2006-03-26 14:19:21 +1100230 kex = xcalloc(1, sizeof(*kex));
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000231 buffer_init(&kex->peer);
232 buffer_init(&kex->my);
233 kex_prop2buf(&kex->my, proposal);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000234 kex->done = 0;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000235
236 kex_send_kexinit(kex); /* we start */
Damien Millerbc27d4e2002-02-13 13:54:06 +1100237 kex_reset_dispatch();
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000238
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000239 return kex;
240}
241
Ben Lindstrombba81212001-06-25 05:01:22 +0000242static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000243kex_kexinit_finish(Kex *kex)
244{
245 if (!(kex->flags & KEX_INIT_SENT))
246 kex_send_kexinit(kex);
247
248 kex_choose_conf(kex);
249
Damien Miller8e7fb332003-02-24 12:03:03 +1100250 if (kex->kex_type >= 0 && kex->kex_type < KEX_MAX &&
251 kex->kex[kex->kex_type] != NULL) {
252 (kex->kex[kex->kex_type])(kex);
253 } else {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000254 fatal("Unsupported key exchange %d", kex->kex_type);
Damien Millera664e872000-04-16 11:52:47 +1000255 }
Damien Millera664e872000-04-16 11:52:47 +1000256}
257
Ben Lindstrombba81212001-06-25 05:01:22 +0000258static void
Damien Millera664e872000-04-16 11:52:47 +1000259choose_enc(Enc *enc, char *client, char *server)
260{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000261 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000262 if (name == NULL)
Darren Tucker0d0d1952007-06-05 18:23:28 +1000263 fatal("no matching cipher found: client %s server %s",
264 client, server);
Damien Miller963f6b22002-02-19 15:21:23 +1100265 if ((enc->cipher = cipher_by_name(name)) == NULL)
Damien Miller874d77b2000-10-14 16:23:11 +1100266 fatal("matching cipher is not supported: %s", name);
Damien Millera664e872000-04-16 11:52:47 +1000267 enc->name = name;
268 enc->enabled = 0;
269 enc->iv = NULL;
270 enc->key = NULL;
Damien Miller963f6b22002-02-19 15:21:23 +1100271 enc->key_len = cipher_keylen(enc->cipher);
272 enc->block_size = cipher_blocksize(enc->cipher);
Damien Millera664e872000-04-16 11:52:47 +1000273}
Damien Miller4f7becb2006-03-26 14:10:14 +1100274
Ben Lindstrombba81212001-06-25 05:01:22 +0000275static void
Damien Millera664e872000-04-16 11:52:47 +1000276choose_mac(Mac *mac, char *client, char *server)
277{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000278 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000279 if (name == NULL)
Darren Tucker0d0d1952007-06-05 18:23:28 +1000280 fatal("no matching mac found: client %s server %s",
281 client, server);
Darren Tucker5f3d5be2007-06-05 18:30:18 +1000282 if (mac_setup(mac, name) < 0)
Damien Millera664e872000-04-16 11:52:47 +1000283 fatal("unsupported mac %s", name);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000284 /* truncate the key */
285 if (datafellows & SSH_BUG_HMAC)
286 mac->key_len = 16;
Damien Millera664e872000-04-16 11:52:47 +1000287 mac->name = name;
Damien Millera664e872000-04-16 11:52:47 +1000288 mac->key = NULL;
289 mac->enabled = 0;
290}
Damien Miller4f7becb2006-03-26 14:10:14 +1100291
Ben Lindstrombba81212001-06-25 05:01:22 +0000292static void
Damien Millera664e872000-04-16 11:52:47 +1000293choose_comp(Comp *comp, char *client, char *server)
294{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000295 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000296 if (name == NULL)
297 fatal("no matching comp found: client %s server %s", client, server);
Damien Miller9786e6e2005-07-26 21:54:56 +1000298 if (strcmp(name, "zlib@openssh.com") == 0) {
299 comp->type = COMP_DELAYED;
300 } else if (strcmp(name, "zlib") == 0) {
301 comp->type = COMP_ZLIB;
Damien Millera664e872000-04-16 11:52:47 +1000302 } else if (strcmp(name, "none") == 0) {
Damien Miller9786e6e2005-07-26 21:54:56 +1000303 comp->type = COMP_NONE;
Damien Millera664e872000-04-16 11:52:47 +1000304 } else {
305 fatal("unsupported comp %s", name);
306 }
307 comp->name = name;
308}
Damien Miller4f7becb2006-03-26 14:10:14 +1100309
Ben Lindstrombba81212001-06-25 05:01:22 +0000310static void
Damien Millera664e872000-04-16 11:52:47 +1000311choose_kex(Kex *k, char *client, char *server)
312{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000313 k->name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000314 if (k->name == NULL)
Darren Tucker0d0d1952007-06-05 18:23:28 +1000315 fatal("Unable to negotiate a key exchange method");
Damien Miller874d77b2000-10-14 16:23:11 +1100316 if (strcmp(k->name, KEX_DH1) == 0) {
Damien Miller8e7fb332003-02-24 12:03:03 +1100317 k->kex_type = KEX_DH_GRP1_SHA1;
Damien Miller19bb3a52005-11-05 15:19:35 +1100318 k->evp_md = EVP_sha1();
Damien Millerf675fc42004-06-15 10:30:09 +1000319 } else if (strcmp(k->name, KEX_DH14) == 0) {
320 k->kex_type = KEX_DH_GRP14_SHA1;
Damien Miller19bb3a52005-11-05 15:19:35 +1100321 k->evp_md = EVP_sha1();
322 } else if (strcmp(k->name, KEX_DHGEX_SHA1) == 0) {
Damien Miller8e7fb332003-02-24 12:03:03 +1100323 k->kex_type = KEX_DH_GEX_SHA1;
Damien Miller19bb3a52005-11-05 15:19:35 +1100324 k->evp_md = EVP_sha1();
Damien Millerb3092032006-03-16 18:22:18 +1100325#if OPENSSL_VERSION_NUMBER >= 0x00907000L
Damien Millera63128d2006-03-15 12:08:28 +1100326 } else if (strcmp(k->name, KEX_DHGEX_SHA256) == 0) {
327 k->kex_type = KEX_DH_GEX_SHA256;
328 k->evp_md = evp_ssh_sha256();
Damien Millerb3092032006-03-16 18:22:18 +1100329#endif
Damien Miller874d77b2000-10-14 16:23:11 +1100330 } else
Damien Millera664e872000-04-16 11:52:47 +1000331 fatal("bad kex alg %s", k->name);
332}
Damien Miller19bb3a52005-11-05 15:19:35 +1100333
Ben Lindstrombba81212001-06-25 05:01:22 +0000334static void
Damien Millera664e872000-04-16 11:52:47 +1000335choose_hostkeyalg(Kex *k, char *client, char *server)
336{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000337 char *hostkeyalg = match_list(client, server, NULL);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100338 if (hostkeyalg == NULL)
Damien Millera664e872000-04-16 11:52:47 +1000339 fatal("no hostkey alg");
Damien Miller0bc1bd82000-11-13 22:57:25 +1100340 k->hostkey_type = key_type_from_name(hostkeyalg);
341 if (k->hostkey_type == KEY_UNSPEC)
342 fatal("bad hostkey alg '%s'", hostkeyalg);
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000343 xfree(hostkeyalg);
Damien Millera664e872000-04-16 11:52:47 +1000344}
345
Damien Millera8e06ce2003-11-21 23:48:55 +1100346static int
Damien Millerbabb47a2003-02-24 11:53:32 +1100347proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX])
348{
349 static int check[] = {
350 PROPOSAL_KEX_ALGS, PROPOSAL_SERVER_HOST_KEY_ALGS, -1
351 };
352 int *idx;
353 char *p;
354
355 for (idx = &check[0]; *idx != -1; idx++) {
356 if ((p = strchr(my[*idx], ',')) != NULL)
357 *p = '\0';
358 if ((p = strchr(peer[*idx], ',')) != NULL)
359 *p = '\0';
360 if (strcmp(my[*idx], peer[*idx]) != 0) {
361 debug2("proposal mismatch: my %s peer %s",
362 my[*idx], peer[*idx]);
363 return (0);
364 }
365 }
366 debug2("proposals match");
367 return (1);
368}
369
Ben Lindstrombba81212001-06-25 05:01:22 +0000370static void
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000371kex_choose_conf(Kex *kex)
Damien Millera664e872000-04-16 11:52:47 +1000372{
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000373 Newkeys *newkeys;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000374 char **my, **peer;
375 char **cprop, **sprop;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000376 int nenc, nmac, ncomp;
Damien Millereccb9de2005-06-17 12:59:34 +1000377 u_int mode, ctos, need;
Damien Millerbabb47a2003-02-24 11:53:32 +1100378 int first_kex_follows, type;
Damien Millera664e872000-04-16 11:52:47 +1000379
Damien Millerbabb47a2003-02-24 11:53:32 +1100380 my = kex_buf2prop(&kex->my, NULL);
381 peer = kex_buf2prop(&kex->peer, &first_kex_follows);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000382
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000383 if (kex->server) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000384 cprop=peer;
385 sprop=my;
386 } else {
387 cprop=my;
388 sprop=peer;
389 }
Damien Millera664e872000-04-16 11:52:47 +1000390
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000391 /* Algorithm Negotiation */
Damien Millera664e872000-04-16 11:52:47 +1000392 for (mode = 0; mode < MODE_MAX; mode++) {
Damien Miller07d86be2006-03-26 14:19:21 +1100393 newkeys = xcalloc(1, sizeof(*newkeys));
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000394 kex->newkeys[mode] = newkeys;
Darren Tucker0d0d1952007-06-05 18:23:28 +1000395 ctos = (!kex->server && mode == MODE_OUT) ||
396 (kex->server && mode == MODE_IN);
Damien Millera664e872000-04-16 11:52:47 +1000397 nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC;
398 nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC;
399 ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000400 choose_enc (&newkeys->enc, cprop[nenc], sprop[nenc]);
401 choose_mac (&newkeys->mac, cprop[nmac], sprop[nmac]);
402 choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
Damien Millera664e872000-04-16 11:52:47 +1000403 debug("kex: %s %s %s %s",
404 ctos ? "client->server" : "server->client",
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000405 newkeys->enc.name,
406 newkeys->mac.name,
407 newkeys->comp.name);
Damien Millera664e872000-04-16 11:52:47 +1000408 }
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000409 choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
410 choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
Damien Millera664e872000-04-16 11:52:47 +1000411 sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
Damien Millera664e872000-04-16 11:52:47 +1000412 need = 0;
413 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000414 newkeys = kex->newkeys[mode];
Damien Miller963f6b22002-02-19 15:21:23 +1100415 if (need < newkeys->enc.key_len)
416 need = newkeys->enc.key_len;
417 if (need < newkeys->enc.block_size)
418 need = newkeys->enc.block_size;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000419 if (need < newkeys->mac.key_len)
420 need = newkeys->mac.key_len;
Damien Millera664e872000-04-16 11:52:47 +1000421 }
Damien Millerb1715dc2000-05-30 13:44:51 +1000422 /* XXX need runden? */
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000423 kex->we_need = need;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000424
Damien Millerbabb47a2003-02-24 11:53:32 +1100425 /* ignore the next message if the proposals do not match */
Damien Millera8e06ce2003-11-21 23:48:55 +1100426 if (first_kex_follows && !proposals_match(my, peer) &&
Damien Miller0dc1bef2005-07-17 17:22:45 +1000427 !(datafellows & SSH_BUG_FIRSTKEX)) {
Damien Millerbabb47a2003-02-24 11:53:32 +1100428 type = packet_read();
429 debug2("skipping next packet (type %u)", type);
430 }
431
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000432 kex_prop_free(my);
433 kex_prop_free(peer);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000434}
435
Ben Lindstrombba81212001-06-25 05:01:22 +0000436static u_char *
Damien Miller19bb3a52005-11-05 15:19:35 +1100437derive_key(Kex *kex, int id, u_int need, u_char *hash, u_int hashlen,
438 BIGNUM *shared_secret)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000439{
440 Buffer b;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000441 EVP_MD_CTX md;
442 char c = id;
Damien Millereccb9de2005-06-17 12:59:34 +1000443 u_int have;
Damien Miller19bb3a52005-11-05 15:19:35 +1100444 int mdsz;
Damien Millereccb9de2005-06-17 12:59:34 +1000445 u_char *digest;
Damien Miller46d38de2005-07-17 17:02:09 +1000446
Damien Miller19bb3a52005-11-05 15:19:35 +1100447 if ((mdsz = EVP_MD_size(kex->evp_md)) <= 0)
448 fatal("bad kex md size %d", mdsz);
Damien Millerc91e5562006-03-26 13:58:55 +1100449 digest = xmalloc(roundup(need, mdsz));
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000450
451 buffer_init(&b);
452 buffer_put_bignum2(&b, shared_secret);
453
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000454 /* K1 = HASH(K || H || "A" || session_id) */
Damien Miller19bb3a52005-11-05 15:19:35 +1100455 EVP_DigestInit(&md, kex->evp_md);
Ben Lindstrom8c963922001-04-30 23:06:57 +0000456 if (!(datafellows & SSH_BUG_DERIVEKEY))
457 EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
Damien Miller19bb3a52005-11-05 15:19:35 +1100458 EVP_DigestUpdate(&md, hash, hashlen);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000459 EVP_DigestUpdate(&md, &c, 1);
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000460 EVP_DigestUpdate(&md, kex->session_id, kex->session_id_len);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000461 EVP_DigestFinal(&md, digest, NULL);
462
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000463 /*
464 * expand key:
465 * Kn = HASH(K || H || K1 || K2 || ... || Kn-1)
466 * Key = K1 || K2 || ... || Kn
467 */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000468 for (have = mdsz; need > have; have += mdsz) {
Damien Miller19bb3a52005-11-05 15:19:35 +1100469 EVP_DigestInit(&md, kex->evp_md);
Ben Lindstrom8c963922001-04-30 23:06:57 +0000470 if (!(datafellows & SSH_BUG_DERIVEKEY))
471 EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
Damien Miller19bb3a52005-11-05 15:19:35 +1100472 EVP_DigestUpdate(&md, hash, hashlen);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000473 EVP_DigestUpdate(&md, digest, have);
474 EVP_DigestFinal(&md, digest + have, NULL);
475 }
476 buffer_free(&b);
477#ifdef DEBUG_KEX
478 fprintf(stderr, "key '%c'== ", c);
479 dump_digest("key", digest, need);
480#endif
481 return digest;
Damien Millera664e872000-04-16 11:52:47 +1000482}
483
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000484Newkeys *current_keys[MODE_MAX];
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000485
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000486#define NKEYS 6
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000487void
Damien Miller19bb3a52005-11-05 15:19:35 +1100488kex_derive_keys(Kex *kex, u_char *hash, u_int hashlen, BIGNUM *shared_secret)
Damien Millera664e872000-04-16 11:52:47 +1000489{
Ben Lindstrom46c16222000-12-22 01:43:59 +0000490 u_char *keys[NKEYS];
Damien Millereccb9de2005-06-17 12:59:34 +1000491 u_int i, mode, ctos;
Damien Millera664e872000-04-16 11:52:47 +1000492
Damien Miller19bb3a52005-11-05 15:19:35 +1100493 for (i = 0; i < NKEYS; i++) {
494 keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, hashlen,
495 shared_secret);
496 }
Damien Millera664e872000-04-16 11:52:47 +1000497
Ben Lindstrom064496f2002-12-23 02:04:22 +0000498 debug2("kex_derive_keys");
Damien Millera664e872000-04-16 11:52:47 +1000499 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000500 current_keys[mode] = kex->newkeys[mode];
501 kex->newkeys[mode] = NULL;
Damien Miller4f7becb2006-03-26 14:10:14 +1100502 ctos = (!kex->server && mode == MODE_OUT) ||
503 (kex->server && mode == MODE_IN);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000504 current_keys[mode]->enc.iv = keys[ctos ? 0 : 1];
505 current_keys[mode]->enc.key = keys[ctos ? 2 : 3];
506 current_keys[mode]->mac.key = keys[ctos ? 4 : 5];
Damien Millera664e872000-04-16 11:52:47 +1000507 }
Damien Millera664e872000-04-16 11:52:47 +1000508}
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000509
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000510Newkeys *
511kex_get_newkeys(int mode)
512{
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000513 Newkeys *ret;
514
515 ret = current_keys[mode];
516 current_keys[mode] = NULL;
517 return ret;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000518}
519
Darren Tuckere14e0052004-05-13 16:30:44 +1000520void
521derive_ssh1_session_id(BIGNUM *host_modulus, BIGNUM *server_modulus,
522 u_int8_t cookie[8], u_int8_t id[16])
523{
524 const EVP_MD *evp_md = EVP_md5();
525 EVP_MD_CTX md;
526 u_int8_t nbuf[2048], obuf[EVP_MAX_MD_SIZE];
527 int len;
528
529 EVP_DigestInit(&md, evp_md);
530
531 len = BN_num_bytes(host_modulus);
Damien Millereccb9de2005-06-17 12:59:34 +1000532 if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
Darren Tuckere14e0052004-05-13 16:30:44 +1000533 fatal("%s: bad host modulus (len %d)", __func__, len);
534 BN_bn2bin(host_modulus, nbuf);
535 EVP_DigestUpdate(&md, nbuf, len);
536
537 len = BN_num_bytes(server_modulus);
Damien Millereccb9de2005-06-17 12:59:34 +1000538 if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
Darren Tuckere14e0052004-05-13 16:30:44 +1000539 fatal("%s: bad server modulus (len %d)", __func__, len);
540 BN_bn2bin(server_modulus, nbuf);
541 EVP_DigestUpdate(&md, nbuf, len);
542
543 EVP_DigestUpdate(&md, cookie, 8);
544
Darren Tuckerb42714e2004-05-13 16:31:48 +1000545 EVP_DigestFinal(&md, obuf, NULL);
Darren Tuckere14e0052004-05-13 16:30:44 +1000546 memcpy(id, obuf, 16);
547
548 memset(nbuf, 0, sizeof(nbuf));
549 memset(obuf, 0, sizeof(obuf));
550 memset(&md, 0, sizeof(md));
551}
552
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000553#if defined(DEBUG_KEX) || defined(DEBUG_KEXDH)
554void
555dump_digest(char *msg, u_char *digest, int len)
556{
Damien Millereccb9de2005-06-17 12:59:34 +1000557 u_int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000558
559 fprintf(stderr, "%s\n", msg);
Darren Tucker82a3d2b2007-02-19 22:10:25 +1100560 for (i = 0; i < len; i++) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000561 fprintf(stderr, "%02x", digest[i]);
562 if (i%32 == 31)
563 fprintf(stderr, "\n");
564 else if (i%8 == 7)
565 fprintf(stderr, " ");
566 }
567 fprintf(stderr, "\n");
568}
569#endif