blob: c71b6a7412f2c63168b74ec9eb72219ef0ae312b [file] [log] [blame]
Damien Miller690d9892013-11-08 12:16:49 +11001/* $OpenBSD: mac.c,v 1.25 2013/11/07 11:58:27 dtucker Exp $ */
Ben Lindstrom06b33aa2001-02-15 03:01:59 +00002/*
3 * Copyright (c) 2001 Markus Friedl. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#include "includes.h"
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000027
Damien Millerd7834352006-08-05 12:39:39 +100028#include <sys/types.h>
29
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000030#include <openssl/hmac.h>
31
Damien Millerded319c2006-09-01 15:38:36 +100032#include <stdarg.h>
Damien Millere3476ed2006-07-24 14:13:33 +100033#include <string.h>
Damien Millerd7834352006-08-05 12:39:39 +100034#include <signal.h>
Damien Millere3476ed2006-07-24 14:13:33 +100035
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000036#include "xmalloc.h"
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000037#include "log.h"
38#include "cipher.h"
Damien Millerd7834352006-08-05 12:39:39 +100039#include "buffer.h"
40#include "key.h"
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000041#include "kex.h"
42#include "mac.h"
Damien Miller3f941882006-03-31 23:13:02 +110043#include "misc.h"
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000044
Damien Millere45796f2007-06-11 14:01:42 +100045#include "umac.h"
46
Darren Tuckere9b3ad72012-01-17 14:03:34 +110047#include "openbsd-compat/openssl-compat.h"
48
Damien Millere45796f2007-06-11 14:01:42 +100049#define SSH_EVP 1 /* OpenSSL EVP-based MAC */
50#define SSH_UMAC 2 /* UMAC (not integrated with OpenSSL) */
Darren Tucker427e4092012-10-05 11:02:39 +100051#define SSH_UMAC128 3
Damien Millere45796f2007-06-11 14:01:42 +100052
Damien Millerea111192013-04-23 19:24:32 +100053struct macalg {
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000054 char *name;
Damien Millere45796f2007-06-11 14:01:42 +100055 int type;
Ben Lindstrom6a246412002-06-06 19:48:16 +000056 const EVP_MD * (*mdfunc)(void);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000057 int truncatebits; /* truncate digest if != 0 */
Damien Millere45796f2007-06-11 14:01:42 +100058 int key_len; /* just for UMAC */
59 int len; /* just for UMAC */
Damien Miller37834af2012-12-12 11:00:37 +110060 int etm; /* Encrypt-then-MAC */
Damien Millerea111192013-04-23 19:24:32 +100061};
62
63static const struct macalg macs[] = {
Damien Milleraf43a7a2012-12-12 10:46:31 +110064 /* Encrypt-and-MAC (encrypt-and-authenticate) variants */
65 { "hmac-sha1", SSH_EVP, EVP_sha1, 0, 0, 0, 0 },
66 { "hmac-sha1-96", SSH_EVP, EVP_sha1, 96, 0, 0, 0 },
Tim Ricea1226822011-08-16 17:29:01 -070067#ifdef HAVE_EVP_SHA256
Damien Milleraf43a7a2012-12-12 10:46:31 +110068 { "hmac-sha2-256", SSH_EVP, EVP_sha256, 0, 0, 0, 0 },
69 { "hmac-sha2-512", SSH_EVP, EVP_sha512, 0, 0, 0, 0 },
Tim Ricea1226822011-08-16 17:29:01 -070070#endif
Damien Milleraf43a7a2012-12-12 10:46:31 +110071 { "hmac-md5", SSH_EVP, EVP_md5, 0, 0, 0, 0 },
72 { "hmac-md5-96", SSH_EVP, EVP_md5, 96, 0, 0, 0 },
73 { "hmac-ripemd160", SSH_EVP, EVP_ripemd160, 0, 0, 0, 0 },
74 { "hmac-ripemd160@openssh.com", SSH_EVP, EVP_ripemd160, 0, 0, 0, 0 },
75 { "umac-64@openssh.com", SSH_UMAC, NULL, 0, 128, 64, 0 },
76 { "umac-128@openssh.com", SSH_UMAC128, NULL, 0, 128, 128, 0 },
77
78 /* Encrypt-then-MAC variants */
79 { "hmac-sha1-etm@openssh.com", SSH_EVP, EVP_sha1, 0, 0, 0, 1 },
80 { "hmac-sha1-96-etm@openssh.com", SSH_EVP, EVP_sha1, 96, 0, 0, 1 },
81#ifdef HAVE_EVP_SHA256
82 { "hmac-sha2-256-etm@openssh.com", SSH_EVP, EVP_sha256, 0, 0, 0, 1 },
83 { "hmac-sha2-512-etm@openssh.com", SSH_EVP, EVP_sha512, 0, 0, 0, 1 },
84#endif
85 { "hmac-md5-etm@openssh.com", SSH_EVP, EVP_md5, 0, 0, 0, 1 },
86 { "hmac-md5-96-etm@openssh.com", SSH_EVP, EVP_md5, 96, 0, 0, 1 },
Damien Miller74f13bd2012-12-12 10:46:53 +110087 { "hmac-ripemd160-etm@openssh.com", SSH_EVP, EVP_ripemd160, 0, 0, 0, 1 },
Damien Milleraf43a7a2012-12-12 10:46:31 +110088 { "umac-64-etm@openssh.com", SSH_UMAC, NULL, 0, 128, 64, 1 },
89 { "umac-128-etm@openssh.com", SSH_UMAC128, NULL, 0, 128, 128, 1 },
90
91 { NULL, 0, NULL, 0, 0, 0, 0 }
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000092};
93
Damien Miller690d9892013-11-08 12:16:49 +110094/* Returns a list of supported MACs separated by the specified char. */
Damien Millerea111192013-04-23 19:24:32 +100095char *
Damien Miller690d9892013-11-08 12:16:49 +110096mac_alg_list(char sep)
Damien Millerea111192013-04-23 19:24:32 +100097{
98 char *ret = NULL;
99 size_t nlen, rlen = 0;
100 const struct macalg *m;
101
102 for (m = macs; m->name != NULL; m++) {
103 if (ret != NULL)
Damien Miller690d9892013-11-08 12:16:49 +1100104 ret[rlen++] = sep;
Damien Millerea111192013-04-23 19:24:32 +1000105 nlen = strlen(m->name);
106 ret = xrealloc(ret, 1, rlen + nlen + 2);
107 memcpy(ret + rlen, m->name, nlen + 1);
108 rlen += nlen;
109 }
110 return ret;
111}
112
Damien Millere45796f2007-06-11 14:01:42 +1000113static void
Damien Millerea111192013-04-23 19:24:32 +1000114mac_setup_by_alg(Mac *mac, const struct macalg *macalg)
Damien Millere45796f2007-06-11 14:01:42 +1000115{
116 int evp_len;
Damien Millerea111192013-04-23 19:24:32 +1000117
118 mac->type = macalg->type;
Damien Millere45796f2007-06-11 14:01:42 +1000119 if (mac->type == SSH_EVP) {
Damien Millerea111192013-04-23 19:24:32 +1000120 mac->evp_md = macalg->mdfunc();
Damien Millere45796f2007-06-11 14:01:42 +1000121 if ((evp_len = EVP_MD_size(mac->evp_md)) <= 0)
122 fatal("mac %s len %d", mac->name, evp_len);
123 mac->key_len = mac->mac_len = (u_int)evp_len;
124 } else {
Damien Millerea111192013-04-23 19:24:32 +1000125 mac->mac_len = macalg->len / 8;
126 mac->key_len = macalg->key_len / 8;
Damien Millere45796f2007-06-11 14:01:42 +1000127 mac->umac_ctx = NULL;
128 }
Damien Millerea111192013-04-23 19:24:32 +1000129 if (macalg->truncatebits != 0)
130 mac->mac_len = macalg->truncatebits / 8;
131 mac->etm = macalg->etm;
Damien Millere45796f2007-06-11 14:01:42 +1000132}
133
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000134int
Darren Tucker5f3d5be2007-06-05 18:30:18 +1000135mac_setup(Mac *mac, char *name)
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000136{
Damien Millerea111192013-04-23 19:24:32 +1000137 const struct macalg *m;
Damien Millereccb9de2005-06-17 12:59:34 +1000138
Damien Millerea111192013-04-23 19:24:32 +1000139 for (m = macs; m->name != NULL; m++) {
140 if (strcmp(name, m->name) != 0)
141 continue;
142 if (mac != NULL)
143 mac_setup_by_alg(mac, m);
144 debug2("mac_setup: found %s", name);
145 return (0);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000146 }
Darren Tucker5f3d5be2007-06-05 18:30:18 +1000147 debug2("mac_setup: unknown %s", name);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000148 return (-1);
149}
150
Damien Millere45796f2007-06-11 14:01:42 +1000151int
Darren Tucker5f3d5be2007-06-05 18:30:18 +1000152mac_init(Mac *mac)
153{
154 if (mac->key == NULL)
155 fatal("mac_init: no key");
Damien Millere45796f2007-06-11 14:01:42 +1000156 switch (mac->type) {
157 case SSH_EVP:
158 if (mac->evp_md == NULL)
159 return -1;
Damien Millerd0e582c2011-12-19 10:51:39 +1100160 HMAC_CTX_init(&mac->evp_ctx);
Damien Millere45796f2007-06-11 14:01:42 +1000161 HMAC_Init(&mac->evp_ctx, mac->key, mac->key_len, mac->evp_md);
162 return 0;
163 case SSH_UMAC:
164 mac->umac_ctx = umac_new(mac->key);
165 return 0;
Darren Tucker427e4092012-10-05 11:02:39 +1000166 case SSH_UMAC128:
167 mac->umac_ctx = umac128_new(mac->key);
168 return 0;
Damien Millere45796f2007-06-11 14:01:42 +1000169 default:
170 return -1;
171 }
Darren Tucker5f3d5be2007-06-05 18:30:18 +1000172}
173
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000174u_char *
175mac_compute(Mac *mac, u_int32_t seqno, u_char *data, int datalen)
176{
Darren Tucker4ac66af2013-06-06 08:12:37 +1000177 static union {
178 u_char m[EVP_MAX_MD_SIZE];
179 u_int64_t for_align;
180 } u;
Damien Millere45796f2007-06-11 14:01:42 +1000181 u_char b[4], nonce[8];
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000182
Darren Tucker4ac66af2013-06-06 08:12:37 +1000183 if (mac->mac_len > sizeof(u))
Damien Millere45796f2007-06-11 14:01:42 +1000184 fatal("mac_compute: mac too long %u %lu",
Darren Tucker4ac66af2013-06-06 08:12:37 +1000185 mac->mac_len, (u_long)sizeof(u));
Damien Millere45796f2007-06-11 14:01:42 +1000186
187 switch (mac->type) {
188 case SSH_EVP:
189 put_u32(b, seqno);
190 /* reset HMAC context */
191 HMAC_Init(&mac->evp_ctx, NULL, 0, NULL);
192 HMAC_Update(&mac->evp_ctx, b, sizeof(b));
193 HMAC_Update(&mac->evp_ctx, data, datalen);
Darren Tucker4ac66af2013-06-06 08:12:37 +1000194 HMAC_Final(&mac->evp_ctx, u.m, NULL);
Damien Millere45796f2007-06-11 14:01:42 +1000195 break;
196 case SSH_UMAC:
197 put_u64(nonce, seqno);
198 umac_update(mac->umac_ctx, data, datalen);
Darren Tucker4ac66af2013-06-06 08:12:37 +1000199 umac_final(mac->umac_ctx, u.m, nonce);
Damien Millere45796f2007-06-11 14:01:42 +1000200 break;
Darren Tucker427e4092012-10-05 11:02:39 +1000201 case SSH_UMAC128:
202 put_u64(nonce, seqno);
203 umac128_update(mac->umac_ctx, data, datalen);
Darren Tucker4ac66af2013-06-06 08:12:37 +1000204 umac128_final(mac->umac_ctx, u.m, nonce);
Darren Tucker427e4092012-10-05 11:02:39 +1000205 break;
Damien Millere45796f2007-06-11 14:01:42 +1000206 default:
207 fatal("mac_compute: unknown MAC type");
208 }
Darren Tucker4ac66af2013-06-06 08:12:37 +1000209 return (u.m);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000210}
211
Darren Tucker5f3d5be2007-06-05 18:30:18 +1000212void
213mac_clear(Mac *mac)
214{
Damien Millere45796f2007-06-11 14:01:42 +1000215 if (mac->type == SSH_UMAC) {
216 if (mac->umac_ctx != NULL)
217 umac_delete(mac->umac_ctx);
Darren Tucker427e4092012-10-05 11:02:39 +1000218 } else if (mac->type == SSH_UMAC128) {
219 if (mac->umac_ctx != NULL)
220 umac128_delete(mac->umac_ctx);
Damien Millere45796f2007-06-11 14:01:42 +1000221 } else if (mac->evp_md != NULL)
222 HMAC_cleanup(&mac->evp_ctx);
223 mac->evp_md = NULL;
224 mac->umac_ctx = NULL;
Darren Tucker5f3d5be2007-06-05 18:30:18 +1000225}
226
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000227/* XXX copied from ciphers_valid */
228#define MAC_SEP ","
229int
230mac_valid(const char *names)
231{
232 char *maclist, *cp, *p;
233
234 if (names == NULL || strcmp(names, "") == 0)
235 return (0);
236 maclist = cp = xstrdup(names);
237 for ((p = strsep(&cp, MAC_SEP)); p && *p != '\0';
Damien Miller9f0f5c62001-12-21 14:45:46 +1100238 (p = strsep(&cp, MAC_SEP))) {
Darren Tucker5f3d5be2007-06-05 18:30:18 +1000239 if (mac_setup(NULL, p) < 0) {
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000240 debug("bad mac %s [%s]", p, names);
Darren Tuckera627d422013-06-02 07:31:17 +1000241 free(maclist);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000242 return (0);
243 } else {
244 debug3("mac ok: %s [%s]", p, names);
245 }
246 }
247 debug3("macs ok: [%s]", names);
Darren Tuckera627d422013-06-02 07:31:17 +1000248 free(maclist);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000249 return (1);
250}